BASELINE: Update Chromium to 77.0.3865.59

Change-Id: I1e89a5f3b009a9519a6705102ad65c92fe736f21
Reviewed-by: Michael Brüning <michael.bruning@qt.io>

49 files changed, 704 insertions, 391 deletions

diff --git a/chromium/net/base/address_list.cc b/chromium/net/base/address_list.cc
index 20a6d3d4cc0..94eea32bf5d 100644
--- a/chromium/net/base/address_list.cc
+++ b/chromium/net/base/address_list.cc
@@ -15,23 +15,6 @@
 
 namespace net {
 
-namespace {
-
-base::Value NetLogAddressListCallback(const AddressList* address_list,
-                                      NetLogCaptureMode capture_mode) {
-  base::Value dict(base::Value::Type::DICTIONARY);
-  base::Value list(base::Value::Type::LIST);
-
-  for (const auto& ip_endpoint : *address_list)
-    list.GetList().emplace_back(ip_endpoint.ToString());
-
-  dict.SetKey("address_list", std::move(list));
-  dict.SetStringKey("canonical_name", address_list->canonical_name());
-  return dict;
-}
-
-}  // namespace
-
 AddressList::AddressList() = default;
 
 AddressList::AddressList(const AddressList&) = default;
@@ -91,8 +74,16 @@ void AddressList::SetDefaultCanonicalName() {
   set_canonical_name(front().ToStringWithoutPort());
 }
 
-NetLogParametersCallback AddressList::CreateNetLogCallback() const {
-  return base::Bind(&NetLogAddressListCallback, this);
+base::Value AddressList::NetLogParams() const {
+  base::Value dict(base::Value::Type::DICTIONARY);
+  base::Value list(base::Value::Type::LIST);
+
+  for (const auto& ip_endpoint : *this)
+    list.GetList().emplace_back(ip_endpoint.ToString());
+
+  dict.SetKey("address_list", std::move(list));
+  dict.SetStringKey("canonical_name", canonical_name());
+  return dict;
 }
 
 }  // namespace net
diff --git a/chromium/net/base/address_list.h b/chromium/net/base/address_list.h
index 9b4a6741856..1baf593701d 100644
--- a/chromium/net/base/address_list.h
+++ b/chromium/net/base/address_list.h
@@ -13,10 +13,13 @@
 #include "base/compiler_specific.h"
 #include "net/base/ip_endpoint.h"
 #include "net/base/net_export.h"
-#include "net/log/net_log_parameters_callback.h"
 
 struct addrinfo;
 
+namespace base {
+class Value;
+}
+
 namespace net {
 
 class IPAddress;
@@ -52,10 +55,9 @@ class NET_EXPORT AddressList {
   // Sets canonical name to the literal of the first IP address on the list.
   void SetDefaultCanonicalName();
 
-  // Creates a callback for use with the NetLog that returns a Value
-  // representation of the address list.  The callback must be destroyed before
-  // |this| is.
-  NetLogParametersCallback CreateNetLogCallback() const;
+  // Creates a value representation of the address list, appropriate for
+  // inclusion in a NetLog.
+  base::Value NetLogParams() const;
 
   using iterator = std::vector<IPEndPoint>::iterator;
   using const_iterator = std::vector<IPEndPoint>::const_iterator;
diff --git a/chromium/net/base/cache_type.h b/chromium/net/base/cache_type.h
index 23995948c69..f7eb3a140f2 100644
--- a/chromium/net/base/cache_type.h
+++ b/chromium/net/base/cache_type.h
@@ -9,14 +9,16 @@ namespace net {
 
 // The types of caches that can be created.
 enum CacheType {
-  DISK_CACHE,            // Disk is used as the backing storage.
-  MEMORY_CACHE,          // Data is stored only in memory.
-  MEDIA_CACHE,           // Optimized to handle media files.
-  APP_CACHE,             // Backing store for an AppCache.
-  SHADER_CACHE,          // Backing store for the GL shader cache.
-  PNACL_CACHE,           // Backing store the PNaCl translation cache
-  GENERATED_CODE_CACHE,  // Backing store for data (like code for JavaScript)
-                         // generated by renderer.
+  DISK_CACHE,                 // Disk is used as the backing storage.
+  MEMORY_CACHE,               // Data is stored only in memory.
+  MEDIA_CACHE,                // Optimized to handle media files.
+  APP_CACHE,                  // Backing store for an AppCache.
+  SHADER_CACHE,               // Backing store for the GL shader cache.
+  PNACL_CACHE,                // Backing store the PNaCl translation cache
+  GENERATED_BYTE_CODE_CACHE,  // Backing store for renderer generated data like
+                              // bytecode for JavaScript.
+  GENERATED_NATIVE_CODE_CACHE,  // Backing store for renderer generated data
+                                // like native code for WebAssembly.
 };
 
 // The types of disk cache backend, only used at backend instantiation.
diff --git a/chromium/net/base/chunked_upload_data_stream.cc b/chromium/net/base/chunked_upload_data_stream.cc
index f7e2a66f473..f4db7d73a60 100644
--- a/chromium/net/base/chunked_upload_data_stream.cc
+++ b/chromium/net/base/chunked_upload_data_stream.cc
@@ -31,8 +31,7 @@ ChunkedUploadDataStream::ChunkedUploadDataStream(int64_t identifier)
       read_index_(0),
       read_offset_(0),
       all_data_appended_(false),
-      read_buffer_len_(0),
-      weak_factory_(this) {}
+      read_buffer_len_(0) {}
 
 ChunkedUploadDataStream::~ChunkedUploadDataStream() = default;
 
diff --git a/chromium/net/base/chunked_upload_data_stream.h b/chromium/net/base/chunked_upload_data_stream.h
index 65da00deae0..50f644f94bf 100644
--- a/chromium/net/base/chunked_upload_data_stream.h
+++ b/chromium/net/base/chunked_upload_data_stream.h
@@ -98,7 +98,7 @@ class NET_EXPORT ChunkedUploadDataStream : public UploadDataStream {
   scoped_refptr<IOBuffer> read_buffer_;
   int read_buffer_len_;
 
-  base::WeakPtrFactory<ChunkedUploadDataStream> weak_factory_;
+  base::WeakPtrFactory<ChunkedUploadDataStream> weak_factory_{this};
 
   DISALLOW_COPY_AND_ASSIGN(ChunkedUploadDataStream);
 };
diff --git a/chromium/net/base/elements_upload_data_stream.cc b/chromium/net/base/elements_upload_data_stream.cc
index 9465b746162..5cc6590811f 100644
--- a/chromium/net/base/elements_upload_data_stream.cc
+++ b/chromium/net/base/elements_upload_data_stream.cc
@@ -19,8 +19,7 @@ ElementsUploadDataStream::ElementsUploadDataStream(
     : UploadDataStream(false, identifier),
       element_readers_(std::move(element_readers)),
       element_index_(0),
-      read_error_(OK),
-      weak_ptr_factory_(this) {}
+      read_error_(OK) {}
 
 ElementsUploadDataStream::~ElementsUploadDataStream() = default;
 
diff --git a/chromium/net/base/elements_upload_data_stream.h b/chromium/net/base/elements_upload_data_stream.h
index 4ad404897fe..ba8f9457e7c 100644
--- a/chromium/net/base/elements_upload_data_stream.h
+++ b/chromium/net/base/elements_upload_data_stream.h
@@ -80,7 +80,7 @@ class NET_EXPORT ElementsUploadDataStream : public UploadDataStream {
   // Set to actual error if read fails, otherwise set to net::OK.
   int read_error_;
 
-  base::WeakPtrFactory<ElementsUploadDataStream> weak_ptr_factory_;
+  base::WeakPtrFactory<ElementsUploadDataStream> weak_ptr_factory_{this};
 
   DISALLOW_COPY_AND_ASSIGN(ElementsUploadDataStream);
 };
diff --git a/chromium/net/base/expiring_cache_unittest.cc b/chromium/net/base/expiring_cache_unittest.cc
index f1414f90656..1f3c5d38073 100644
--- a/chromium/net/base/expiring_cache_unittest.cc
+++ b/chromium/net/base/expiring_cache_unittest.cc
@@ -119,16 +119,16 @@ TEST(ExpiringCacheTest, Compact) {
   }
   EXPECT_EQ(10U, cache.size());
 
-  EXPECT_TRUE(base::ContainsKey(cache.entries_, "valid0"));
-  EXPECT_TRUE(base::ContainsKey(cache.entries_, "valid1"));
-  EXPECT_TRUE(base::ContainsKey(cache.entries_, "valid2"));
-  EXPECT_TRUE(base::ContainsKey(cache.entries_, "valid3"));
-  EXPECT_TRUE(base::ContainsKey(cache.entries_, "valid4"));
-  EXPECT_TRUE(base::ContainsKey(cache.entries_, "expired0"));
-  EXPECT_TRUE(base::ContainsKey(cache.entries_, "expired1"));
-  EXPECT_TRUE(base::ContainsKey(cache.entries_, "expired2"));
-  EXPECT_TRUE(base::ContainsKey(cache.entries_, "negative0"));
-  EXPECT_TRUE(base::ContainsKey(cache.entries_, "negative1"));
+  EXPECT_TRUE(base::Contains(cache.entries_, "valid0"));
+  EXPECT_TRUE(base::Contains(cache.entries_, "valid1"));
+  EXPECT_TRUE(base::Contains(cache.entries_, "valid2"));
+  EXPECT_TRUE(base::Contains(cache.entries_, "valid3"));
+  EXPECT_TRUE(base::Contains(cache.entries_, "valid4"));
+  EXPECT_TRUE(base::Contains(cache.entries_, "expired0"));
+  EXPECT_TRUE(base::Contains(cache.entries_, "expired1"));
+  EXPECT_TRUE(base::Contains(cache.entries_, "expired2"));
+  EXPECT_TRUE(base::Contains(cache.entries_, "negative0"));
+  EXPECT_TRUE(base::Contains(cache.entries_, "negative1"));
 
   // Shrink the new max constraints bound and compact. The "negative" and
   // "expired" entries should be dropped.
@@ -136,16 +136,16 @@ TEST(ExpiringCacheTest, Compact) {
   cache.Compact(now);
   EXPECT_EQ(5U, cache.size());
 
-  EXPECT_TRUE(base::ContainsKey(cache.entries_, "valid0"));
-  EXPECT_TRUE(base::ContainsKey(cache.entries_, "valid1"));
-  EXPECT_TRUE(base::ContainsKey(cache.entries_, "valid2"));
-  EXPECT_TRUE(base::ContainsKey(cache.entries_, "valid3"));
-  EXPECT_TRUE(base::ContainsKey(cache.entries_, "valid4"));
-  EXPECT_FALSE(base::ContainsKey(cache.entries_, "expired0"));
-  EXPECT_FALSE(base::ContainsKey(cache.entries_, "expired1"));
-  EXPECT_FALSE(base::ContainsKey(cache.entries_, "expired2"));
-  EXPECT_FALSE(base::ContainsKey(cache.entries_, "negative0"));
-  EXPECT_FALSE(base::ContainsKey(cache.entries_, "negative1"));
+  EXPECT_TRUE(base::Contains(cache.entries_, "valid0"));
+  EXPECT_TRUE(base::Contains(cache.entries_, "valid1"));
+  EXPECT_TRUE(base::Contains(cache.entries_, "valid2"));
+  EXPECT_TRUE(base::Contains(cache.entries_, "valid3"));
+  EXPECT_TRUE(base::Contains(cache.entries_, "valid4"));
+  EXPECT_FALSE(base::Contains(cache.entries_, "expired0"));
+  EXPECT_FALSE(base::Contains(cache.entries_, "expired1"));
+  EXPECT_FALSE(base::Contains(cache.entries_, "expired2"));
+  EXPECT_FALSE(base::Contains(cache.entries_, "negative0"));
+  EXPECT_FALSE(base::Contains(cache.entries_, "negative1"));
 
   // Shrink further -- this time the compact will start dropping valid entries
   // to make space.
diff --git a/chromium/net/base/features.cc b/chromium/net/base/features.cc
index ae53c907147..6bc86e560f0 100644
--- a/chromium/net/base/features.cc
+++ b/chromium/net/base/features.cc
@@ -7,28 +7,14 @@
 namespace net {
 namespace features {
 
-// Toggles the `Accept-Language` HTTP request header, which
-// https://github.com/WICG/lang-client-hint proposes that we deprecate.
 const base::Feature kAcceptLanguageHeader{"AcceptLanguageHeader",
                                           base::FEATURE_ENABLED_BY_DEFAULT};
 
 const base::Feature kCapRefererHeaderLength = {
-    "CapRefererHeaderLength", base::FEATURE_DISABLED_BY_DEFAULT};
+    "CapRefererHeaderLength", base::FEATURE_ENABLED_BY_DEFAULT};
 const base::FeatureParam<int> kMaxRefererHeaderLength = {
     &kCapRefererHeaderLength, "MaxRefererHeaderLength", 4096};
 
-// Uses a site isolated code cache that is keyed on the resource url and the
-// origin lock of the renderer that is requesting the resource. The requests
-// to site-isolated code cache are handled by the content/GeneratedCodeCache
-// When this flag is enabled, the metadata field of the HttpCache is unused.
-const base::Feature kIsolatedCodeCache = {"IsolatedCodeCache",
-                                          base::FEATURE_ENABLED_BY_DEFAULT};
-
-// Enables the additional TLS 1.3 server-random-based downgrade protection
-// described in https://tools.ietf.org/html/rfc8446#section-4.1.3
-//
-// This is a MUST-level requirement of TLS 1.3, but has compatibility issues
-// with some buggy non-compliant TLS-terminating proxies.
 const base::Feature kEnforceTLS13Downgrade{"EnforceTLS13Downgrade",
                                            base::FEATURE_ENABLED_BY_DEFAULT};
 
@@ -38,13 +24,17 @@ const base::Feature kEnableTLS13EarlyData{"EnableTLS13EarlyData",
 const base::Feature kNetworkQualityEstimator{"NetworkQualityEstimator",
                                              base::FEATURE_DISABLED_BY_DEFAULT};
 
-const base::Feature kSplitCacheByTopFrameOrigin{
-    "SplitCacheByTopFrameOrigin", base::FEATURE_DISABLED_BY_DEFAULT};
+const base::Feature kSplitCacheByNetworkIsolationKey{
+    "SplitCacheByNetworkIsolationKey", base::FEATURE_DISABLED_BY_DEFAULT};
 
 const base::Feature kPartitionConnectionsByNetworkIsolationKey{
     "PartitionConnectionsByNetworkIsolationKey",
     base::FEATURE_DISABLED_BY_DEFAULT};
 
+const base::Feature kPartitionSSLSessionsByNetworkIsolationKey{
+    "PartitionSSLSessionsByNetworkIsolationKey",
+    base::FEATURE_DISABLED_BY_DEFAULT};
+
 const base::Feature kTLS13KeyUpdate{"TLS13KeyUpdate",
                                     base::FEATURE_DISABLED_BY_DEFAULT};
 
@@ -60,5 +50,14 @@ const base::Feature kSameSiteByDefaultCookies{
 const base::Feature kCookiesWithoutSameSiteMustBeSecure{
     "CookiesWithoutSameSiteMustBeSecure", base::FEATURE_DISABLED_BY_DEFAULT};
 
+#if BUILDFLAG(BUILTIN_CERT_VERIFIER_FEATURE_SUPPORTED)
+const base::Feature kCertVerifierBuiltinFeature{
+    "CertVerifierBuiltin", base::FEATURE_DISABLED_BY_DEFAULT};
+#endif
+
+const base::Feature kAppendFrameOriginToNetworkIsolationKey{
+    "AppendFrameOriginToNetworkIsolationKey",
+    base::FEATURE_DISABLED_BY_DEFAULT};
+
 }  // namespace features
 }  // namespace net
diff --git a/chromium/net/base/features.h b/chromium/net/base/features.h
index 00856023cc4..3e2bd969f1a 100644
--- a/chromium/net/base/features.h
+++ b/chromium/net/base/features.h
@@ -8,6 +8,7 @@
 #include "base/feature_list.h"
 #include "base/metrics/field_trial_params.h"
 #include "net/base/net_export.h"
+#include "net/net_buildflags.h"
 
 namespace net {
 namespace features {
@@ -21,12 +22,6 @@ NET_EXPORT extern const base::Feature kAcceptLanguageHeader;
 NET_EXPORT extern const base::Feature kCapRefererHeaderLength;
 NET_EXPORT extern const base::FeatureParam<int> kMaxRefererHeaderLength;
 
-// Uses a site isolated code cache that is keyed on the resource url and the
-// origin lock of the renderer that is requesting the resource. The requests
-// to site-isolated code cache are handled by the content/GeneratedCodeCache
-// When this flag is enabled, the metadata field of the HttpCache is unused.
-NET_EXPORT extern const base::Feature kIsolatedCodeCache;
-
 // Enables the additional TLS 1.3 server-random-based downgrade protection
 // described in https://tools.ietf.org/html/rfc8446#section-4.1.3
 //
@@ -41,14 +36,23 @@ NET_EXPORT extern const base::Feature kEnableTLS13EarlyData;
 // quality estimator (NQE).
 NET_EXPORT extern const base::Feature kNetworkQualityEstimator;
 
-// Splits cache entries by the request's top frame's origin if one is available.
-NET_EXPORT extern const base::Feature kSplitCacheByTopFrameOrigin;
+// Splits cache entries by the request's network isolation key if one is
+// available.
+NET_EXPORT extern const base::Feature kSplitCacheByNetworkIsolationKey;
 
 // Partitions connections based on the NetworkIsolationKey associated with a
 // request.
 NET_EXPORT extern const base::Feature
     kPartitionConnectionsByNetworkIsolationKey;
 
+// Partitions TLS sessions and QUIC server configs based on the
+// NetworkIsolationKey associated with a request.
+//
+// This feature requires kPartitionConnectionsByNetworkIsolationKey to be
+// enabled to work.
+NET_EXPORT extern const base::Feature
+    kPartitionSSLSessionsByNetworkIsolationKey;
+
 // Enables sending TLS 1.3 Key Update messages on TLS 1.3 connections in order
 // to ensure that this corner of the spec is exercised. This is currently
 // disabled by default because we discovered incompatibilities with some
@@ -74,6 +78,13 @@ NET_EXPORT extern const base::Feature kSameSiteByDefaultCookies;
 // SameSiteByDefaultCookies is also enabled.
 NET_EXPORT extern const base::Feature kCookiesWithoutSameSiteMustBeSecure;
 
+#if BUILDFLAG(BUILTIN_CERT_VERIFIER_FEATURE_SUPPORTED)
+// When enabled, use the builtin cert verifier instead of the platform verifier.
+NET_EXPORT extern const base::Feature kCertVerifierBuiltinFeature;
+#endif
+
+NET_EXPORT extern const base::Feature kAppendFrameOriginToNetworkIsolationKey;
+
 }  // namespace features
 }  // namespace net
 
diff --git a/chromium/net/base/file_stream_unittest.cc b/chromium/net/base/file_stream_unittest.cc
index e9cf586e671..34caefaa6ff 100644
--- a/chromium/net/base/file_stream_unittest.cc
+++ b/chromium/net/base/file_stream_unittest.cc
@@ -537,7 +537,6 @@ class TestWriteReadCompletionCallback {
           base::MakeRefCounted<IOBufferWithSize>(4);
       rv = stream_->Read(buf.get(), buf->size(), callback.callback());
       if (rv == ERR_IO_PENDING) {
-        base::MessageLoopCurrent::ScopedNestableTaskAllower allow;
         rv = callback.WaitForResult();
       }
       EXPECT_LE(0, rv);
@@ -574,7 +573,6 @@ class TestWriteReadCompletionCallback {
       EXPECT_THAT(stream_->Seek(0, callback64.callback()),
                   IsError(ERR_IO_PENDING));
       {
-        base::MessageLoopCurrent::ScopedNestableTaskAllower allow;
         EXPECT_LE(0, callback64.WaitForResult());
       }
     }
diff --git a/chromium/net/base/filename_util_internal.cc b/chromium/net/base/filename_util_internal.cc
index 46dc33aaaf8..b8ce2e01b35 100644
--- a/chromium/net/base/filename_util_internal.cc
+++ b/chromium/net/base/filename_util_internal.cc
@@ -55,7 +55,7 @@ base::FilePath::StringType GetCorrectedExtensionUnsafe(
   // "foo.jpg" to "foo.jpeg".
   std::vector<base::FilePath::StringType> all_mime_extensions;
   GetExtensionsForMimeType(mime_type, &all_mime_extensions);
-  if (base::ContainsValue(all_mime_extensions, extension))
+  if (base::Contains(all_mime_extensions, extension))
     return extension;
 
   // Get the "final" extension. In most cases, this is the same as the
@@ -69,7 +69,7 @@ base::FilePath::StringType GetCorrectedExtensionUnsafe(
   // If there's a double extension, and the second extension is in the
   // list of valid extensions for the given type, keep the double extension.
   // This avoids renaming things like "foo.tar.gz" to "foo.gz".
-  if (base::ContainsValue(all_mime_extensions, final_extension))
+  if (base::Contains(all_mime_extensions, final_extension))
     return extension;
   return preferred_mime_extension;
 }
diff --git a/chromium/net/base/logging_network_change_observer.cc b/chromium/net/base/logging_network_change_observer.cc
index 5ca13b70189..e408f526c0f 100644
--- a/chromium/net/base/logging_network_change_observer.cc
+++ b/chromium/net/base/logging_network_change_observer.cc
@@ -38,9 +38,8 @@ int HumanReadableNetworkHandle(NetworkChangeNotifier::NetworkHandle network) {
 // Return a dictionary of values that provide information about a
 // network-specific change. This also includes relevant current state
 // like the default network, and the types of active networks.
-base::Value NetworkSpecificNetLogCallback(
-    NetworkChangeNotifier::NetworkHandle network,
-    NetLogCaptureMode capture_mode) {
+base::Value NetworkSpecificNetLogParams(
+    NetworkChangeNotifier::NetworkHandle network) {
   base::Value dict(base::Value::Type::DICTIONARY);
   dict.SetIntKey("changed_network_handle", HumanReadableNetworkHandle(network));
   dict.SetStringKey(
@@ -62,6 +61,16 @@ base::Value NetworkSpecificNetLogCallback(
   return dict;
 }
 
+void NetLogNetworkSpecific(NetLog* net_log,
+                           NetLogEventType type,
+                           NetworkChangeNotifier::NetworkHandle network) {
+  if (!net_log)
+    return;
+
+  net_log->AddGlobalEntry(type,
+                          [&] { return NetworkSpecificNetLogParams(network); });
+}
+
 }  // namespace
 
 LoggingNetworkChangeObserver::LoggingNetworkChangeObserver(NetLog* net_log)
@@ -95,9 +104,9 @@ void LoggingNetworkChangeObserver::OnConnectionTypeChanged(
   VLOG(1) << "Observed a change to network connectivity state "
           << type_as_string;
 
-  net_log_->AddGlobalEntry(
-      NetLogEventType::NETWORK_CONNECTIVITY_CHANGED,
-      NetLog::StringCallback("new_connection_type", &type_as_string));
+  net_log_->AddGlobalEntryWithStringParams(
+      NetLogEventType::NETWORK_CONNECTIVITY_CHANGED, "new_connection_type",
+      type_as_string);
 }
 
 void LoggingNetworkChangeObserver::OnNetworkChanged(
@@ -107,41 +116,40 @@ void LoggingNetworkChangeObserver::OnNetworkChanged(
 
   VLOG(1) << "Observed a network change to state " << type_as_string;
 
-  net_log_->AddGlobalEntry(
-      NetLogEventType::NETWORK_CHANGED,
-      NetLog::StringCallback("new_connection_type", &type_as_string));
+  net_log_->AddGlobalEntryWithStringParams(
+      NetLogEventType::NETWORK_CHANGED, "new_connection_type", type_as_string);
 }
 
 void LoggingNetworkChangeObserver::OnNetworkConnected(
     NetworkChangeNotifier::NetworkHandle network) {
   VLOG(1) << "Observed network " << network << " connect";
 
-  net_log_->AddGlobalEntry(NetLogEventType::SPECIFIC_NETWORK_CONNECTED,
-                           base::Bind(&NetworkSpecificNetLogCallback, network));
+  NetLogNetworkSpecific(net_log_, NetLogEventType::SPECIFIC_NETWORK_CONNECTED,
+                        network);
 }
 
 void LoggingNetworkChangeObserver::OnNetworkDisconnected(
     NetworkChangeNotifier::NetworkHandle network) {
   VLOG(1) << "Observed network " << network << " disconnect";
 
-  net_log_->AddGlobalEntry(NetLogEventType::SPECIFIC_NETWORK_DISCONNECTED,
-                           base::Bind(&NetworkSpecificNetLogCallback, network));
+  NetLogNetworkSpecific(
+      net_log_, NetLogEventType::SPECIFIC_NETWORK_DISCONNECTED, network);
 }
 
 void LoggingNetworkChangeObserver::OnNetworkSoonToDisconnect(
     NetworkChangeNotifier::NetworkHandle network) {
   VLOG(1) << "Observed network " << network << " soon to disconnect";
 
-  net_log_->AddGlobalEntry(NetLogEventType::SPECIFIC_NETWORK_SOON_TO_DISCONNECT,
-                           base::Bind(&NetworkSpecificNetLogCallback, network));
+  NetLogNetworkSpecific(
+      net_log_, NetLogEventType::SPECIFIC_NETWORK_SOON_TO_DISCONNECT, network);
 }
 
 void LoggingNetworkChangeObserver::OnNetworkMadeDefault(
     NetworkChangeNotifier::NetworkHandle network) {
   VLOG(1) << "Observed network " << network << " made the default network";
 
-  net_log_->AddGlobalEntry(NetLogEventType::SPECIFIC_NETWORK_MADE_DEFAULT,
-                           base::Bind(&NetworkSpecificNetLogCallback, network));
+  NetLogNetworkSpecific(
+      net_log_, NetLogEventType::SPECIFIC_NETWORK_MADE_DEFAULT, network);
 }
 
 }  // namespace net
diff --git a/chromium/net/base/mime_util.cc b/chromium/net/base/mime_util.cc
index a2ff77a7895..09a10df7910 100644
--- a/chromium/net/base/mime_util.cc
+++ b/chromium/net/base/mime_util.cc
@@ -194,6 +194,7 @@ static const MimeInfo kSecondaryMappings[] = {
     {"application/x-mpegurl", "m3u8"},
     {"application/x-shockwave-flash", "swf,swl"},
     {"application/x-tar", "tar"},
+    {"application/x-x509-ca-cert", "cer,crt"},
     {"application/zip", "zip"},
     {"audio/mpeg", "mp3"},
     // This is the platform mapping on recent versions of Windows 10.
diff --git a/chromium/net/base/mime_util_unittest.cc b/chromium/net/base/mime_util_unittest.cc
index 49ce6342a6b..ade41926fd6 100644
--- a/chromium/net/base/mime_util_unittest.cc
+++ b/chromium/net/base/mime_util_unittest.cc
@@ -37,6 +37,8 @@ TEST(MimeUtilTest, ExtensionTest) {
     // These are test cases for testing platform mime types on Chrome OS.
     {FILE_PATH_LITERAL("epub"), "application/epub+zip", true},
     {FILE_PATH_LITERAL("apk"), "application/vnd.android.package-archive", true},
+    {FILE_PATH_LITERAL("cer"), "application/x-x509-ca-cert", true},
+    {FILE_PATH_LITERAL("crt"), "application/x-x509-ca-cert", true},
     {FILE_PATH_LITERAL("zip"), "application/zip", true},
     {FILE_PATH_LITERAL("ics"), "text/calendar", true},
 #endif
@@ -328,7 +330,7 @@ TEST(MimeUtilTest, TestGetExtensionsForMimeType) {
           test.contained_result,
           test.contained_result + strlen(test.contained_result));
 
-      bool found = base::ContainsValue(extensions, contained_result);
+      bool found = base::Contains(extensions, contained_result);
 
       ASSERT_TRUE(found) << "Must find at least the contained result within "
                          << test.mime_type;
diff --git a/chromium/net/base/mock_file_stream.cc b/chromium/net/base/mock_file_stream.cc
index 4cff945228c..64104ee200b 100644
--- a/chromium/net/base/mock_file_stream.cc
+++ b/chromium/net/base/mock_file_stream.cc
@@ -20,9 +20,7 @@ MockFileStream::MockFileStream(
     : FileStream(task_runner),
       forced_error_(OK),
       async_error_(false),
-      throttled_(false),
-      weak_factory_(this) {
-}
+      throttled_(false) {}
 
 MockFileStream::MockFileStream(
     base::File file,
@@ -30,8 +28,7 @@ MockFileStream::MockFileStream(
     : FileStream(std::move(file), task_runner),
       forced_error_(OK),
       async_error_(false),
-      throttled_(false),
-      weak_factory_(this) {}
+      throttled_(false) {}
 
 MockFileStream::~MockFileStream() = default;
 
diff --git a/chromium/net/base/mock_file_stream.h b/chromium/net/base/mock_file_stream.h
index 9f1eb98b94a..fba7843256c 100644
--- a/chromium/net/base/mock_file_stream.h
+++ b/chromium/net/base/mock_file_stream.h
@@ -98,7 +98,7 @@ class MockFileStream : public FileStream {
   base::OnceClosure throttled_task_;
   base::FilePath path_;
 
-  base::WeakPtrFactory<MockFileStream> weak_factory_;
+  base::WeakPtrFactory<MockFileStream> weak_factory_{this};
 };
 
 }  // namespace testing
diff --git a/chromium/net/base/mock_network_change_notifier.cc b/chromium/net/base/mock_network_change_notifier.cc
index 65e3f96be43..872f5cf4949 100644
--- a/chromium/net/base/mock_network_change_notifier.cc
+++ b/chromium/net/base/mock_network_change_notifier.cc
@@ -4,15 +4,28 @@
 
 #include "net/base/mock_network_change_notifier.h"
 
+#include <utility>
+
+#include "base/memory/ptr_util.h"
 #include "base/run_loop.h"
+#include "net/dns/dns_config_service.h"
+#include "net/dns/system_dns_config_change_notifier.h"
 
 namespace net {
 namespace test {
 
-MockNetworkChangeNotifier::MockNetworkChangeNotifier()
-    : force_network_handles_supported_(false),
-      connection_type_(CONNECTION_UNKNOWN) {}
-MockNetworkChangeNotifier::~MockNetworkChangeNotifier() = default;
+// static
+std::unique_ptr<MockNetworkChangeNotifier> MockNetworkChangeNotifier::Create() {
+  // Use an empty noop SystemDnsConfigChangeNotifier to disable actual system
+  // DNS configuration notifications.
+  return base::WrapUnique(new MockNetworkChangeNotifier(
+      std::make_unique<SystemDnsConfigChangeNotifier>(
+          nullptr /* task_runner */, nullptr /* dns_config_service */)));
+}
+
+MockNetworkChangeNotifier::~MockNetworkChangeNotifier() {
+  StopSystemDnsConfigNotifier();
+}
 
 MockNetworkChangeNotifier::ConnectionType
 MockNetworkChangeNotifier::GetCurrentConnectionType() const {
@@ -72,10 +85,18 @@ void MockNetworkChangeNotifier::NotifyNetworkConnected(
   base::RunLoop().RunUntilIdle();
 }
 
+MockNetworkChangeNotifier::MockNetworkChangeNotifier(
+    std::unique_ptr<SystemDnsConfigChangeNotifier> dns_config_notifier)
+    : NetworkChangeNotifier(NetworkChangeCalculatorParams(),
+                            dns_config_notifier.get()),
+      force_network_handles_supported_(false),
+      connection_type_(CONNECTION_UNKNOWN),
+      dns_config_notifier_(std::move(dns_config_notifier)) {}
+
 ScopedMockNetworkChangeNotifier::ScopedMockNetworkChangeNotifier()
     : disable_network_change_notifier_for_tests_(
           new NetworkChangeNotifier::DisableForTest()),
-      mock_network_change_notifier_(new MockNetworkChangeNotifier()) {}
+      mock_network_change_notifier_(MockNetworkChangeNotifier::Create()) {}
 
 ScopedMockNetworkChangeNotifier::~ScopedMockNetworkChangeNotifier() = default;
 
diff --git a/chromium/net/base/mock_network_change_notifier.h b/chromium/net/base/mock_network_change_notifier.h
index e8d4269dd8c..c047536ea65 100644
--- a/chromium/net/base/mock_network_change_notifier.h
+++ b/chromium/net/base/mock_network_change_notifier.h
@@ -5,14 +5,19 @@
 #ifndef NET_BASE_MOCK_NETWORK_CHANGE_NOTIFIER_H_
 #define NET_BASE_MOCK_NETWORK_CHANGE_NOTIFIER_H_
 
+#include <memory>
+
 #include "net/base/network_change_notifier.h"
 
 namespace net {
+
+class SystemDnsConfigChangeNotifier;
+
 namespace test {
 
 class MockNetworkChangeNotifier : public NetworkChangeNotifier {
  public:
-  MockNetworkChangeNotifier();
+  static std::unique_ptr<MockNetworkChangeNotifier> Create();
   ~MockNetworkChangeNotifier() override;
 
   ConnectionType GetCurrentConnectionType() const override;
@@ -47,9 +52,14 @@ class MockNetworkChangeNotifier : public NetworkChangeNotifier {
   void NotifyNetworkConnected(NetworkChangeNotifier::NetworkHandle network);
 
  private:
+  // Create using MockNetworkChangeNotifier::Create().
+  MockNetworkChangeNotifier(
+      std::unique_ptr<SystemDnsConfigChangeNotifier> dns_config_notifier);
+
   bool force_network_handles_supported_;
   ConnectionType connection_type_;
   NetworkChangeNotifier::NetworkList connected_networks_;
+  std::unique_ptr<SystemDnsConfigChangeNotifier> dns_config_notifier_;
 };
 
 // Class to replace existing NetworkChangeNotifier singleton with a
diff --git a/chromium/net/base/net_error_list.h b/chromium/net/base/net_error_list.h
index 9614b3d857d..6fc8c5ea1d2 100644
--- a/chromium/net/base/net_error_list.h
+++ b/chromium/net/base/net_error_list.h
@@ -309,9 +309,7 @@ NET_ERROR(SSL_PINNED_KEY_NOT_IN_CERT_CHAIN, -150)
 // Server request for client certificate did not contain any types we support.
 NET_ERROR(CLIENT_AUTH_CERT_TYPE_UNSUPPORTED, -151)
 
-// Server requested one type of cert, then requested a different type while the
-// first was still being generated.
-NET_ERROR(ORIGIN_BOUND_CERT_GENERATION_TYPE_MISMATCH, -152)
+// Error -152 was removed (ORIGIN_BOUND_CERT_GENERATION_TYPE_MISMATCH)
 
 // An SSL peer sent us a fatal decrypt_error alert. This typically occurs when
 // a peer could not correctly verify a signature (in CertificateVerify or
@@ -627,8 +625,8 @@ NET_ERROR(UNRECOGNIZED_FTP_DIRECTORY_LISTING_FORMAT, -334)
 // There are no supported proxies in the provided list.
 NET_ERROR(NO_SUPPORTED_PROXIES, -336)
 
-// There is a SPDY protocol error.
-NET_ERROR(SPDY_PROTOCOL_ERROR, -337)
+// There is an HTTP/2 protocol error.
+NET_ERROR(HTTP2_PROTOCOL_ERROR, -337)
 
 // Credentials could not be established during HTTP Authentication.
 NET_ERROR(INVALID_AUTH_CREDENTIALS, -338)
@@ -659,9 +657,9 @@ NET_ERROR(RESPONSE_BODY_TOO_BIG_TO_DRAIN, -345)
 // The HTTP response contained multiple distinct Content-Length headers.
 NET_ERROR(RESPONSE_HEADERS_MULTIPLE_CONTENT_LENGTH, -346)
 
-// SPDY Headers have been received, but not all of them - status or version
+// HTTP/2 headers have been received, but not all of them - status or version
 // headers are missing, so we're expecting additional frames to complete them.
-NET_ERROR(INCOMPLETE_SPDY_HEADERS, -347)
+NET_ERROR(INCOMPLETE_HTTP2_HEADERS, -347)
 
 // No PAC URL configuration could be retrieved from DHCP. This can indicate
 // either a failure to retrieve the DHCP configuration, or that there was no
@@ -679,10 +677,10 @@ NET_ERROR(RESPONSE_HEADERS_MULTIPLE_LOCATION, -350)
 // stream id corresponding to the request indicating that this request has not
 // been processed yet, or a RST_STREAM frame with error code REFUSED_STREAM.
 // Client MAY retry (on a different connection).  See RFC7540 Section 8.1.4.
-NET_ERROR(SPDY_SERVER_REFUSED_STREAM, -351)
+NET_ERROR(HTTP2_SERVER_REFUSED_STREAM, -351)
 
-// SPDY server didn't respond to the PING message.
-NET_ERROR(SPDY_PING_FAILED, -352)
+// HTTP/2 server didn't respond to the PING message.
+NET_ERROR(HTTP2_PING_FAILED, -352)
 
 // Obsolete.  Kept here to avoid reuse, as the old error can still appear on
 // histograms.
@@ -710,17 +708,17 @@ NET_ERROR(QUIC_HANDSHAKE_FAILED, -358)
 // histograms.
 // NET_ERROR(REQUEST_FOR_SECURE_RESOURCE_OVER_INSECURE_QUIC, -359)
 
-// Transport security is inadequate for the SPDY version.
-NET_ERROR(SPDY_INADEQUATE_TRANSPORT_SECURITY, -360)
+// Transport security is inadequate for the HTTP/2 version.
+NET_ERROR(HTTP2_INADEQUATE_TRANSPORT_SECURITY, -360)
 
-// The peer violated SPDY flow control.
-NET_ERROR(SPDY_FLOW_CONTROL_ERROR, -361)
+// The peer violated HTTP/2 flow control.
+NET_ERROR(HTTP2_FLOW_CONTROL_ERROR, -361)
 
-// The peer sent an improperly sized SPDY frame.
-NET_ERROR(SPDY_FRAME_SIZE_ERROR, -362)
+// The peer sent an improperly sized HTTP/2 frame.
+NET_ERROR(HTTP2_FRAME_SIZE_ERROR, -362)
 
-// Decoding or encoding of compressed SPDY headers failed.
-NET_ERROR(SPDY_COMPRESSION_ERROR, -363)
+// Decoding or encoding of compressed HTTP/2 headers failed.
+NET_ERROR(HTTP2_COMPRESSION_ERROR, -363)
 
 // Proxy Auth Requested without a valid Client Socket Handle.
 NET_ERROR(PROXY_AUTH_REQUESTED_WITH_NO_CONNECTION, -364)
@@ -749,14 +747,14 @@ NET_ERROR(CONTENT_DECODING_INIT_FAILED, -371)
 // Received HTTP/2 RST_STREAM frame with NO_ERROR error code.  This error should
 // be handled internally by HTTP/2 code, and should not make it above the
 // SpdyStream layer.
-NET_ERROR(SPDY_RST_STREAM_NO_ERROR_RECEIVED, -372)
+NET_ERROR(HTTP2_RST_STREAM_NO_ERROR_RECEIVED, -372)
 
 // The pushed stream claimed by the request is no longer available.
-NET_ERROR(SPDY_PUSHED_STREAM_NOT_AVAILABLE, -373)
+NET_ERROR(HTTP2_PUSHED_STREAM_NOT_AVAILABLE, -373)
 
 // A pushed stream was claimed and later reset by the server. When this happens,
 // the request should be retried.
-NET_ERROR(SPDY_CLAIMED_PUSHED_STREAM_RESET_BY_SERVER, -374)
+NET_ERROR(HTTP2_CLAIMED_PUSHED_STREAM_RESET_BY_SERVER, -374)
 
 // An HTTP transaction was retried too many times due for authentication or
 // invalid certificates. This may be due to a bug in the net stack that would
@@ -765,14 +763,14 @@ NET_ERROR(SPDY_CLAIMED_PUSHED_STREAM_RESET_BY_SERVER, -374)
 NET_ERROR(TOO_MANY_RETRIES, -375)
 
 // Received an HTTP/2 frame on a closed stream.
-NET_ERROR(SPDY_STREAM_CLOSED, -376)
+NET_ERROR(HTTP2_STREAM_CLOSED, -376)
 
 // Client is refusing an HTTP/2 stream.
-NET_ERROR(SPDY_CLIENT_REFUSED_STREAM, -377)
+NET_ERROR(HTTP2_CLIENT_REFUSED_STREAM, -377)
 
 // A pushed HTTP/2 stream was claimed by a request based on matching URL and
 // request headers, but the pushed response headers do not match the request.
-NET_ERROR(SPDY_PUSHED_RESPONSE_DOES_NOT_MATCH, -378)
+NET_ERROR(HTTP2_PUSHED_RESPONSE_DOES_NOT_MATCH, -378)
 
 // The cache does not have the requested entry.
 NET_ERROR(CACHE_MISS, -400)
diff --git a/chromium/net/base/net_string_util_icu_alternatives_android.cc b/chromium/net/base/net_string_util_icu_alternatives_android.cc
index 222312e18f5..fad7f451270 100644
--- a/chromium/net/base/net_string_util_icu_alternatives_android.cc
+++ b/chromium/net/base/net_string_util_icu_alternatives_android.cc
@@ -6,8 +6,8 @@
 #include "base/android/jni_string.h"
 #include "base/strings/string16.h"
 #include "base/strings/string_piece.h"
-#include "jni/NetStringUtil_jni.h"
 #include "net/base/net_string_util.h"
+#include "net/net_jni_headers/NetStringUtil_jni.h"
 
 using base::android::ScopedJavaLocalRef;
 
diff --git a/chromium/net/base/network_change_notifier.cc b/chromium/net/base/network_change_notifier.cc
index 48fb8504ff5..dd6a55f1b57 100644
--- a/chromium/net/base/network_change_notifier.cc
+++ b/chromium/net/base/network_change_notifier.cc
@@ -5,10 +5,15 @@
 #include "net/base/network_change_notifier.h"
 
 #include <limits>
+#include <string>
 #include <unordered_set>
+#include <utility>
 
 #include "base/macros.h"
 #include "base/memory/ref_counted.h"
+#include "base/no_destructor.h"
+#include "base/optional.h"
+#include "base/sequence_checker.h"
 #include "base/stl_util.h"
 #include "base/strings/string_util.h"
 #include "base/synchronization/lock.h"
@@ -19,6 +24,8 @@
 #include "net/base/network_interfaces.h"
 #include "net/base/url_util.h"
 #include "net/dns/dns_config.h"
+#include "net/dns/dns_config_service.h"
+#include "net/dns/system_dns_config_change_notifier.h"
 #include "net/url_request/url_request.h"
 #include "url/gurl.h"
 
@@ -49,22 +56,27 @@ NetworkChangeNotifierFactory* g_network_change_notifier_factory = nullptr;
 
 class MockNetworkChangeNotifier : public NetworkChangeNotifier {
  public:
+  MockNetworkChangeNotifier(
+      std::unique_ptr<SystemDnsConfigChangeNotifier> dns_config_notifier)
+      : NetworkChangeNotifier(NetworkChangeCalculatorParams(),
+                              dns_config_notifier.get()),
+        dns_config_notifier_(std::move(dns_config_notifier)) {}
+
+  ~MockNetworkChangeNotifier() override { StopSystemDnsConfigNotifier(); }
+
   ConnectionType GetCurrentConnectionType() const override {
     return CONNECTION_UNKNOWN;
   }
-};
 
-}  // namespace
-
-// static
-bool NetworkChangeNotifier::test_notifications_only_ = false;
-// static
-const NetworkChangeNotifier::NetworkHandle
-    NetworkChangeNotifier::kInvalidNetworkHandle = -1;
+ private:
+  std::unique_ptr<SystemDnsConfigChangeNotifier> dns_config_notifier_;
+};
 
 // NetworkState is thread safe.
-class NetworkChangeNotifier::NetworkState
-    : public base::RefCountedThreadSafe<NetworkChangeNotifier::NetworkState> {
+//
+// TODO(crbug.com/971411): Remove once HostResolverManager converted to directly
+// use SystemDnsConfigChangeNotifier.
+class NetworkState : public base::RefCountedThreadSafe<NetworkState> {
  public:
   NetworkState() = default;
 
@@ -95,6 +107,14 @@ class NetworkChangeNotifier::NetworkState
   bool set_ = false;
 };
 
+}  // namespace
+
+// static
+bool NetworkChangeNotifier::test_notifications_only_ = false;
+// static
+const NetworkChangeNotifier::NetworkHandle
+    NetworkChangeNotifier::kInvalidNetworkHandle = -1;
+
 NetworkChangeNotifier::NetworkChangeCalculatorParams::
     NetworkChangeCalculatorParams() = default;
 
@@ -177,6 +197,43 @@ class NetworkChangeNotifier::NetworkChangeCalculator
   DISALLOW_COPY_AND_ASSIGN(NetworkChangeCalculator);
 };
 
+class NetworkChangeNotifier::SystemDnsConfigObserver
+    : public SystemDnsConfigChangeNotifier::Observer {
+ public:
+  virtual ~SystemDnsConfigObserver() = default;
+
+  void OnSystemDnsConfigChanged(base::Optional<DnsConfig> config) override {
+    DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
+
+    bool was_set = network_state_->SetDnsConfig(config.value_or(DnsConfig()));
+    DCHECK_EQ(initial_config_received_, was_set);
+
+    if (initial_config_received_) {
+      NotifyObserversOfDNSChange();
+    } else {
+      initial_config_received_ = true;
+      NotifyObserversOfInitialDNSConfigRead();
+    }
+  }
+
+  scoped_refptr<const NetworkState> network_state() { return network_state_; }
+
+  void ClearDnsConfigForTesting() {
+    initial_config_received_ = false;
+    network_state_->ClearDnsConfigForTesting();
+  }
+
+ private:
+  bool initial_config_received_ = false;
+
+  // TODO(crbug.com/971411): Remove once HostResolverManager converted to
+  // directly use SystemDnsConfigChangeNotifier.
+  scoped_refptr<NetworkState> network_state_ =
+      base::MakeRefCounted<NetworkState>();
+
+  SEQUENCE_CHECKER(sequence_checker_);
+};
+
 void NetworkChangeNotifier::ClearGlobalPointer() {
   if (!cleared_global_pointer_) {
     cleared_global_pointer_ = true;
@@ -188,6 +245,7 @@ void NetworkChangeNotifier::ClearGlobalPointer() {
 NetworkChangeNotifier::~NetworkChangeNotifier() {
   network_change_calculator_.reset();
   ClearGlobalPointer();
+  StopSystemDnsConfigNotifier();
 }
 
 // static
@@ -203,13 +261,13 @@ void NetworkChangeNotifier::SetFactory(
 }
 
 // static
-NetworkChangeNotifier* NetworkChangeNotifier::Create() {
+std::unique_ptr<NetworkChangeNotifier> NetworkChangeNotifier::Create() {
   if (g_network_change_notifier_factory)
     return g_network_change_notifier_factory->CreateInstance();
 
 #if defined(OS_WIN)
-  NetworkChangeNotifierWin* network_change_notifier =
-      new NetworkChangeNotifierWin();
+  std::unique_ptr<NetworkChangeNotifierWin> network_change_notifier =
+      std::make_unique<NetworkChangeNotifierWin>();
   network_change_notifier->WatchForAddressChange();
   return network_change_notifier;
 #elif defined(OS_ANDROID)
@@ -217,13 +275,16 @@ NetworkChangeNotifier* NetworkChangeNotifier::Create() {
   CHECK(false);
   return NULL;
 #elif defined(OS_CHROMEOS)
-  return new NetworkChangeNotifierPosix(CONNECTION_NONE, SUBTYPE_NONE);
+  return std::make_unique<NetworkChangeNotifierPosix>(CONNECTION_NONE,
+                                                      SUBTYPE_NONE);
 #elif defined(OS_LINUX)
-  return new NetworkChangeNotifierLinux(std::unordered_set<std::string>());
+  return std::make_unique<NetworkChangeNotifierLinux>(
+      std::unordered_set<std::string>());
 #elif defined(OS_MACOSX)
-  return new NetworkChangeNotifierMac();
+  return std::make_unique<NetworkChangeNotifierMac>();
 #elif defined(OS_FUCHSIA)
-  return new NetworkChangeNotifierFuchsia(0 /* required_features */);
+  return std::make_unique<NetworkChangeNotifierFuchsia>(
+      0 /* required_features */);
 #else
   NOTIMPLEMENTED();
   return NULL;
@@ -383,8 +444,8 @@ void NetworkChangeNotifier::GetDnsConfig(DnsConfig* config) {
   if (!g_network_change_notifier) {
     *config = DnsConfig();
   } else {
-    scoped_refptr<NetworkState> network_state =
-        g_network_change_notifier->network_state_;
+    scoped_refptr<const NetworkState> network_state =
+        g_network_change_notifier->system_dns_config_observer_->network_state();
     network_state->GetDnsConfig(config);
   }
 }
@@ -491,8 +552,12 @@ NetworkChangeNotifier::ConnectionTypeFromInterfaceList(
 }
 
 // static
-NetworkChangeNotifier* NetworkChangeNotifier::CreateMock() {
-  return new MockNetworkChangeNotifier();
+std::unique_ptr<NetworkChangeNotifier> NetworkChangeNotifier::CreateMock() {
+  // Use an empty noop SystemDnsConfigChangeNotifier to disable actual system
+  // DNS configuration notifications.
+  return std::make_unique<MockNetworkChangeNotifier>(
+      std::make_unique<SystemDnsConfigChangeNotifier>(
+          nullptr /* task_runner */, nullptr /* dns_config_service */));
 }
 
 NetworkChangeNotifier::IPAddressObserver::IPAddressObserver() = default;
@@ -664,7 +729,8 @@ void NetworkChangeNotifier::SetTestNotificationsOnly(bool test_only) {
 
 NetworkChangeNotifier::NetworkChangeNotifier(
     const NetworkChangeCalculatorParams& params
-    /*= NetworkChangeCalculatorParams()*/)
+    /*= NetworkChangeCalculatorParams()*/,
+    SystemDnsConfigChangeNotifier* system_dns_config_notifier /*= nullptr */)
     : ip_address_observer_list_(
           new base::ObserverListThreadSafe<IPAddressObserver>(
               base::ObserverListPolicy::EXISTING_ONLY)),
@@ -682,11 +748,19 @@ NetworkChangeNotifier::NetworkChangeNotifier(
               base::ObserverListPolicy::EXISTING_ONLY)),
       network_observer_list_(new base::ObserverListThreadSafe<NetworkObserver>(
           base::ObserverListPolicy::EXISTING_ONLY)),
-      network_state_(new NetworkState()),
+      system_dns_config_notifier_(system_dns_config_notifier),
+      system_dns_config_observer_(std::make_unique<SystemDnsConfigObserver>()),
       network_change_calculator_(new NetworkChangeCalculator(params)) {
+  if (!system_dns_config_notifier_) {
+    static base::NoDestructor<SystemDnsConfigChangeNotifier> singleton{};
+    system_dns_config_notifier_ = singleton.get();
+  }
+
   DCHECK(!g_network_change_notifier);
   g_network_change_notifier = this;
   network_change_calculator_->Init();
+
+  system_dns_config_notifier_->AddObserver(system_dns_config_observer_.get());
 }
 
 #if defined(OS_LINUX)
@@ -799,24 +873,29 @@ void NetworkChangeNotifier::NotifyObserversOfSpecificNetworkChange(
 }
 
 // static
-void NetworkChangeNotifier::SetDnsConfig(const DnsConfig& config) {
-  if (!g_network_change_notifier)
-    return;
-  scoped_refptr<NetworkState> network_state =
-      g_network_change_notifier->network_state_;
-  if (network_state->SetDnsConfig(config)) {
-    NotifyObserversOfDNSChange();
-  } else {
-    NotifyObserversOfInitialDNSConfigRead();
+void NetworkChangeNotifier::SetDnsConfigForTesting(const DnsConfig& config) {
+  if (g_network_change_notifier) {
+    g_network_change_notifier->system_dns_config_observer_
+        ->OnSystemDnsConfigChanged(config);
   }
 }
 
+// static
 void NetworkChangeNotifier::ClearDnsConfigForTesting() {
   if (!g_network_change_notifier)
     return;
-  scoped_refptr<NetworkState> network_state =
-      g_network_change_notifier->network_state_;
-  network_state->ClearDnsConfigForTesting();
+  g_network_change_notifier->system_dns_config_observer_
+      ->ClearDnsConfigForTesting();
+}
+
+void NetworkChangeNotifier::StopSystemDnsConfigNotifier() {
+  if (!system_dns_config_notifier_)
+    return;
+
+  system_dns_config_notifier_->RemoveObserver(
+      system_dns_config_observer_.get());
+  system_dns_config_observer_ = nullptr;
+  system_dns_config_notifier_ = nullptr;
 }
 
 void NetworkChangeNotifier::NotifyObserversOfIPAddressChangeImpl() {
diff --git a/chromium/net/base/network_change_notifier.h b/chromium/net/base/network_change_notifier.h
index 9cf4f6f240b..e6d06cf0dcd 100644
--- a/chromium/net/base/network_change_notifier.h
+++ b/chromium/net/base/network_change_notifier.h
@@ -21,6 +21,7 @@ namespace net {
 struct DnsConfig;
 class NetworkChangeNotifierFactory;
 struct NetworkInterface;
+class SystemDnsConfigChangeNotifier;
 typedef std::vector<NetworkInterface> NetworkInterfaceList;
 
 #if defined(OS_LINUX)
@@ -293,7 +294,7 @@ class NET_EXPORT NetworkChangeNotifier {
   // monitored), but if you do create it, you must do so before any other
   // threads try to access the API below, and it must outlive all other threads
   // which might try to use it.
-  static NetworkChangeNotifier* Create();
+  static std::unique_ptr<NetworkChangeNotifier> Create();
 
   // Returns whether the process-wide, platform-specific NetworkChangeNotifier
   // has been created.
@@ -369,6 +370,9 @@ class NET_EXPORT NetworkChangeNotifier {
 
   // Retrieve the last read DnsConfig. This could be expensive if the system has
   // a large HOSTS file.
+  //
+  // TODO(crbug.com/971411): Remove once HostResolverManager converted to
+  // directly use SystemDnsConfigChangeNotifier.
   static void GetDnsConfig(DnsConfig* config);
 
 #if defined(OS_LINUX)
@@ -402,7 +406,7 @@ class NET_EXPORT NetworkChangeNotifier {
 
   // Like Create(), but for use in tests.  The mock object doesn't monitor any
   // events, it merely rebroadcasts notifications when requested.
-  static NetworkChangeNotifier* CreateMock();
+  static std::unique_ptr<NetworkChangeNotifier> CreateMock();
 
   // Registers |observer| to receive notifications of network changes.  The
   // thread on which this is called is the thread on which |observer| will be
@@ -509,9 +513,12 @@ class NET_EXPORT NetworkChangeNotifier {
     base::TimeDelta connection_type_online_delay_;
   };
 
-  explicit NetworkChangeNotifier(
+  // If |system_dns_config_notifier| is null (the default), a shared singleton
+  // will be used that will be leaked on shutdown.
+  NetworkChangeNotifier(
       const NetworkChangeCalculatorParams& params =
-          NetworkChangeCalculatorParams());
+          NetworkChangeCalculatorParams(),
+      SystemDnsConfigChangeNotifier* system_dns_config_notifier = nullptr);
 
 #if defined(OS_LINUX)
   // Returns the AddressTrackerLinux if present.
@@ -550,7 +557,7 @@ class NET_EXPORT NetworkChangeNotifier {
 
   // Stores |config| in NetworkState and notifies observers. The first
   // notification will be OnInitialDNSConfigRead, and after that OnDNSChanged.
-  static void SetDnsConfig(const DnsConfig& config);
+  static void SetDnsConfigForTesting(const DnsConfig& config);
 
   // Clears previous DnsConfig, if any, to simulate the first one being set.
   static void ClearDnsConfigForTesting();
@@ -559,6 +566,14 @@ class NET_EXPORT NetworkChangeNotifier {
   // have the same type, return it, otherwise return CONNECTION_UNKNOWN.
   static ConnectionType ConnectionTypeFromInterfaces();
 
+  SystemDnsConfigChangeNotifier* system_dns_config_notifier() {
+    DCHECK(system_dns_config_notifier_);
+    return system_dns_config_notifier_;
+  }
+  // Unregisters and clears |system_dns_config_notifier_|. Useful if a subclass
+  // owns the notifier and is destroying it before |this|'s destructor is called
+  void StopSystemDnsConfigNotifier();
+
   // Clears the global NetworkChangeNotifier pointer.  This should be called
   // as early as possible in the destructor to prevent races.
   void ClearGlobalPointer();
@@ -569,8 +584,8 @@ class NET_EXPORT NetworkChangeNotifier {
   friend class NetworkChangeNotifierLinuxTest;
   friend class NetworkChangeNotifierWinTest;
 
-  class NetworkState;
   class NetworkChangeCalculator;
+  class SystemDnsConfigObserver;
 
   void NotifyObserversOfIPAddressChangeImpl();
   void NotifyObserversOfConnectionTypeChangeImpl(ConnectionType type);
@@ -595,8 +610,8 @@ class NET_EXPORT NetworkChangeNotifier {
   const scoped_refptr<base::ObserverListThreadSafe<NetworkObserver>>
       network_observer_list_;
 
-  // The current network state. Hosts DnsConfig, exposed via GetDnsConfig.
-  scoped_refptr<NetworkState> network_state_;
+  SystemDnsConfigChangeNotifier* system_dns_config_notifier_;
+  std::unique_ptr<SystemDnsConfigObserver> system_dns_config_observer_;
 
   // Computes NetworkChange signal from IPAddress and ConnectionType signals.
   std::unique_ptr<NetworkChangeCalculator> network_change_calculator_;
diff --git a/chromium/net/base/network_change_notifier_factory.h b/chromium/net/base/network_change_notifier_factory.h
index 88cc15ab44d..203e9972528 100644
--- a/chromium/net/base/network_change_notifier_factory.h
+++ b/chromium/net/base/network_change_notifier_factory.h
@@ -5,6 +5,8 @@
 #ifndef NET_BASE_NETWORK_CHANGE_NOTIFIER_FACTORY_H_
 #define NET_BASE_NETWORK_CHANGE_NOTIFIER_FACTORY_H_
 
+#include <memory>
+
 #include "net/base/net_export.h"
 
 namespace net {
@@ -16,7 +18,7 @@ class NET_EXPORT NetworkChangeNotifierFactory {
  public:
   NetworkChangeNotifierFactory() {}
   virtual ~NetworkChangeNotifierFactory() {}
-  virtual NetworkChangeNotifier* CreateInstance() = 0;
+  virtual std::unique_ptr<NetworkChangeNotifier> CreateInstance() = 0;
 };
 
 }  // namespace net
diff --git a/chromium/net/base/network_change_notifier_fuchsia.cc b/chromium/net/base/network_change_notifier_fuchsia.cc
index f3d48538629..ddeae7d0e3a 100644
--- a/chromium/net/base/network_change_notifier_fuchsia.cc
+++ b/chromium/net/base/network_change_notifier_fuchsia.cc
@@ -28,14 +28,18 @@ NetworkChangeNotifierFuchsia::NetworkChangeNotifierFuchsia(
 
 NetworkChangeNotifierFuchsia::NetworkChangeNotifierFuchsia(
     fuchsia::netstack::NetstackPtr netstack,
-    uint32_t required_features)
-    : required_features_(required_features) {
+    uint32_t required_features,
+    SystemDnsConfigChangeNotifier* system_dns_config_notifier)
+    : NetworkChangeNotifier(NetworkChangeCalculatorParams(),
+                            system_dns_config_notifier),
+      required_features_(required_features) {
   DCHECK(netstack);
 
   // Temporarily re-wrap our Netstack channel so we can query the interfaces
   // and routing table synchronously to populate the initial state.
   fuchsia::netstack::NetstackSyncPtr sync_netstack;
   sync_netstack.Bind(netstack.Unbind());
+  DCHECK(sync_netstack);
 
   // Manually fetch the interfaces and routes.
   std::vector<fuchsia::netstack::NetInterface> interfaces;
@@ -48,6 +52,7 @@ NetworkChangeNotifierFuchsia::NetworkChangeNotifierFuchsia(
 
   // Re-wrap Netstack back into an asynchronous pointer.
   netstack_.Bind(sync_netstack.Unbind());
+  DCHECK(netstack_);
   netstack_.set_error_handler([](zx_status_t status) {
     // TODO(https://crbug.com/901092): Unit tests that use NetworkService are
     // crashing because NetworkService does not clean up properly, and the
diff --git a/chromium/net/base/network_change_notifier_fuchsia.h b/chromium/net/base/network_change_notifier_fuchsia.h
index acee7d48f14..7fddead7682 100644
--- a/chromium/net/base/network_change_notifier_fuchsia.h
+++ b/chromium/net/base/network_change_notifier_fuchsia.h
@@ -36,8 +36,10 @@ class NET_EXPORT_PRIVATE NetworkChangeNotifierFuchsia
   // For testing purposes. Receives a |netstack| pointer for easy mocking.
   // Interfaces can be filtered out by passing in |required_features|, which is
   // defined in fuchsia::hardware::ethernet.
-  NetworkChangeNotifierFuchsia(fuchsia::netstack::NetstackPtr netstack,
-                               uint32_t required_features);
+  NetworkChangeNotifierFuchsia(
+      fuchsia::netstack::NetstackPtr netstack,
+      uint32_t required_features,
+      SystemDnsConfigChangeNotifier* system_dns_config_notifier = nullptr);
 
   // Forwards the network interface list along with the result of
   // GetRouteTable() to OnRouteTableReceived().
diff --git a/chromium/net/base/network_change_notifier_fuchsia_unittest.cc b/chromium/net/base/network_change_notifier_fuchsia_unittest.cc
index b301f08d878..cd339bf8d10 100644
--- a/chromium/net/base/network_change_notifier_fuchsia_unittest.cc
+++ b/chromium/net/base/network_change_notifier_fuchsia_unittest.cc
@@ -16,6 +16,8 @@
 #include "base/threading/sequence_bound.h"
 #include "base/threading/thread.h"
 #include "net/base/ip_address.h"
+#include "net/dns/dns_config_service.h"
+#include "net/dns/system_dns_config_change_notifier.h"
 #include "testing/gmock/include/gmock/gmock.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
@@ -234,8 +236,12 @@ class NetworkChangeNotifierFuchsiaTest : public testing::Test {
     // notifier queries it.
     netstack_.Synchronize();
 
-    notifier_.reset(new NetworkChangeNotifierFuchsia(std::move(netstack_ptr_),
-                                                     required_features));
+    // Use a noop DNS notifier.
+    dns_config_notifier_ = std::make_unique<SystemDnsConfigChangeNotifier>(
+        nullptr /* task_runner */, nullptr /* dns_config_service */);
+    notifier_.reset(new NetworkChangeNotifierFuchsia(
+        std::move(netstack_ptr_), required_features,
+        dns_config_notifier_.get()));
 
     NetworkChangeNotifier::AddConnectionTypeObserver(&observer_);
     NetworkChangeNotifier::AddIPAddressObserver(&ip_observer_);
@@ -260,6 +266,7 @@ class NetworkChangeNotifierFuchsiaTest : public testing::Test {
 
   // Allows us to allocate our own NetworkChangeNotifier for unit testing.
   NetworkChangeNotifier::DisableForTest disable_for_test_;
+  std::unique_ptr<SystemDnsConfigChangeNotifier> dns_config_notifier_;
   std::unique_ptr<NetworkChangeNotifierFuchsia> notifier_;
 
   testing::InSequence seq_;
diff --git a/chromium/net/base/network_change_notifier_linux.cc b/chromium/net/base/network_change_notifier_linux.cc
index 682395d63da..6dc7d2c6ba9 100644
--- a/chromium/net/base/network_change_notifier_linux.cc
+++ b/chromium/net/base/network_change_notifier_linux.cc
@@ -40,7 +40,6 @@ class NetworkChangeNotifierLinux::BlockingThreadObjects {
  private:
   void OnIPAddressChanged();
   void OnLinkChanged();
-  internal::DnsConfigServicePosix dns_config_service_;
   // Used to detect online/offline state and IP address changes.
   internal::AddressTrackerLinux address_tracker_;
   NetworkChangeNotifier::ConnectionType last_type_;
@@ -64,8 +63,6 @@ NetworkChangeNotifierLinux::BlockingThreadObjects::BlockingThreadObjects(
 void NetworkChangeNotifierLinux::BlockingThreadObjects::Init() {
   address_tracker_.Init();
   last_type_ = GetCurrentConnectionType();
-  dns_config_service_.WatchConfig(
-      base::Bind(&NetworkChangeNotifier::SetDnsConfig));
 }
 
 void NetworkChangeNotifierLinux::BlockingThreadObjects::OnIPAddressChanged() {
diff --git a/chromium/net/base/network_change_notifier_linux.h b/chromium/net/base/network_change_notifier_linux.h
index fa14f307587..8c4c3255924 100644
--- a/chromium/net/base/network_change_notifier_linux.h
+++ b/chromium/net/base/network_change_notifier_linux.h
@@ -33,10 +33,11 @@ class NET_EXPORT_PRIVATE NetworkChangeNotifierLinux
   explicit NetworkChangeNotifierLinux(
       const std::unordered_set<std::string>& ignored_interfaces);
 
+  ~NetworkChangeNotifierLinux() override;
+
  private:
   class BlockingThreadObjects;
 
-  ~NetworkChangeNotifierLinux() override;
   static NetworkChangeCalculatorParams NetworkChangeCalculatorParamsLinux();
 
   // NetworkChangeNotifier:
diff --git a/chromium/net/base/network_change_notifier_mac.cc b/chromium/net/base/network_change_notifier_mac.cc
index 76ad20fd8c1..c082e84822e 100644
--- a/chromium/net/base/network_change_notifier_mac.cc
+++ b/chromium/net/base/network_change_notifier_mac.cc
@@ -28,28 +28,7 @@ NetworkChangeNotifierMac::NetworkChangeNotifierMac()
       connection_type_(CONNECTION_UNKNOWN),
       connection_type_initialized_(false),
       initial_connection_type_cv_(&connection_type_lock_),
-      forwarder_(this)
-#if !defined(OS_IOS)
-      ,
-      dns_config_service_runner_(
-          base::CreateSequencedTaskRunnerWithTraits({base::MayBlock()})),
-      dns_config_service_(
-          DnsConfigService::CreateSystemService().release(),
-          // Ensure DnsConfigService lives on |dns_config_service_runner_|
-          // to prevent races where NetworkChangeNotifierPosix outlives
-          // ScopedTaskEnvironment. https://crbug.com/938126
-          base::OnTaskRunnerDeleter(dns_config_service_runner_)) {
-  // DnsConfigService on iOS doesn't watch the config so its result can become
-  // inaccurate at any time.  Disable it to prevent promulgation of inaccurate
-  // DnsConfigs.
-  dns_config_service_runner_->PostTask(
-      FROM_HERE, base::BindOnce(&DnsConfigService::WatchConfig,
-                                base::Unretained(dns_config_service_.get()),
-                                base::BindRepeating(
-                                    &NetworkChangeNotifier::SetDnsConfig)));
-#else
-{
-#endif  // defined(OS_IOS)
+      forwarder_(this) {
   // Must be initialized after the rest of this object, as it may call back into
   // SetInitialConnectionType().
   config_watcher_ = std::make_unique<NetworkConfigWatcherMac>(&forwarder_);
diff --git a/chromium/net/base/network_change_notifier_mac.h b/chromium/net/base/network_change_notifier_mac.h
index 4037534350d..516264d27d5 100644
--- a/chromium/net/base/network_change_notifier_mac.h
+++ b/chromium/net/base/network_change_notifier_mac.h
@@ -19,15 +19,8 @@
 #include "net/base/network_change_notifier.h"
 #include "net/base/network_config_watcher_mac.h"
 
-namespace base {
-class SequencedTaskRunner;
-struct OnTaskRunnerDeleter;
-}  // namespace base
-
 namespace net {
 
-class DnsConfigService;
-
 class NetworkChangeNotifierMac: public NetworkChangeNotifier {
  public:
   NetworkChangeNotifierMac();
@@ -83,14 +76,6 @@ class NetworkChangeNotifierMac: public NetworkChangeNotifier {
   Forwarder forwarder_;
   std::unique_ptr<const NetworkConfigWatcherMac> config_watcher_;
 
-#if !defined(OS_IOS)
-  // |dns_config_service_| will live on this runner.
-  scoped_refptr<base::SequencedTaskRunner> dns_config_service_runner_;
-  // DnsConfigService that lives on |dns_config_service_runner_|.
-  std::unique_ptr<DnsConfigService, base::OnTaskRunnerDeleter>
-      dns_config_service_;
-#endif
-
   DISALLOW_COPY_AND_ASSIGN(NetworkChangeNotifierMac);
 };
 
diff --git a/chromium/net/base/network_change_notifier_posix.cc b/chromium/net/base/network_change_notifier_posix.cc
index adb09dc4cd5..c5aa68d40ac 100644
--- a/chromium/net/base/network_change_notifier_posix.cc
+++ b/chromium/net/base/network_change_notifier_posix.cc
@@ -3,14 +3,15 @@
 // found in the LICENSE file.
 
 #include <string>
+#include <utility>
 
 #include "base/bind.h"
-#include "base/sequenced_task_runner.h"
 #include "base/task/post_task.h"
 #include "base/task/task_traits.h"
 #include "build/build_config.h"
 #include "net/base/network_change_notifier_posix.h"
 #include "net/dns/dns_config_service_posix.h"
+#include "net/dns/system_dns_config_change_notifier.h"
 
 #if defined(OS_ANDROID)
 #include "net/android/network_change_notifier_android.h"
@@ -18,65 +19,21 @@
 
 namespace net {
 
-// DNS config services on Chrome OS and Android are signalled by the network
-// state handler rather than relying on watching files in /etc.
-class NetworkChangeNotifierPosix::DnsConfigService
-    : public net::internal::DnsConfigServicePosix {
- public:
-  DnsConfigService() = default;
-  ~DnsConfigService() override = default;
-
-  // net::internal::DnsConfigService() overrides.
-  bool StartWatching() override {
-    CreateReaders();
-    // DNS config changes are handled and notified by the network
-    // state handlers.
-    return true;
-  }
-
-  void OnNetworkChange() {
-    InvalidateConfig();
-    InvalidateHosts();
-    ReadNow();
-  }
-};
-
 NetworkChangeNotifierPosix::NetworkChangeNotifierPosix(
     NetworkChangeNotifier::ConnectionType initial_connection_type,
     NetworkChangeNotifier::ConnectionSubtype initial_connection_subtype)
     : NetworkChangeNotifier(NetworkChangeCalculatorParamsPosix()),
-      dns_config_service_runner_(
-          base::CreateSequencedTaskRunnerWithTraits({base::MayBlock()})),
-      dns_config_service_(
-          new DnsConfigService(),
-          // Ensure DnsConfigService lives on |dns_config_service_runner_|
-          // to prevent races where NetworkChangeNotifierPosix outlives
-          // ScopedTaskEnvironment. https://crbug.com/938126
-          base::OnTaskRunnerDeleter(dns_config_service_runner_)),
       connection_type_(initial_connection_type),
       max_bandwidth_mbps_(
           NetworkChangeNotifier::GetMaxBandwidthMbpsForConnectionSubtype(
-              initial_connection_subtype)) {
-  dns_config_service_runner_->PostTask(
-      FROM_HERE,
-      base::BindOnce(
-          &NetworkChangeNotifierPosix::DnsConfigService::WatchConfig,
-          base::Unretained(dns_config_service_.get()),
-          base::BindRepeating(&NetworkChangeNotifier::SetDnsConfig)));
-  OnDNSChanged();
-}
+              initial_connection_subtype)) {}
 
 NetworkChangeNotifierPosix::~NetworkChangeNotifierPosix() {
   ClearGlobalPointer();
 }
 
 void NetworkChangeNotifierPosix::OnDNSChanged() {
-  DCHECK_CALLED_ON_VALID_THREAD(thread_checker_);
-  dns_config_service_runner_->PostTask(
-      FROM_HERE,
-      base::BindOnce(
-          &NetworkChangeNotifierPosix::DnsConfigService::OnNetworkChange,
-          base::Unretained(dns_config_service_.get())));
+  system_dns_config_notifier()->RefreshConfig();
 }
 
 void NetworkChangeNotifierPosix::OnIPAddressChanged() {
diff --git a/chromium/net/base/network_change_notifier_posix.h b/chromium/net/base/network_change_notifier_posix.h
index eefd15f2c58..76171243881 100644
--- a/chromium/net/base/network_change_notifier_posix.h
+++ b/chromium/net/base/network_change_notifier_posix.h
@@ -18,11 +18,6 @@
 #include "net/base/net_export.h"
 #include "net/base/network_change_notifier.h"
 
-namespace base {
-class SequencedTaskRunner;
-struct OnTaskRunnerDeleter;
-}  // namespace base
-
 namespace net {
 
 // A NetworkChangeNotifier that needs to be told about network changes by some
@@ -57,14 +52,6 @@ class NET_EXPORT NetworkChangeNotifierPosix : public NetworkChangeNotifier {
  private:
   friend class NetworkChangeNotifierPosixTest;
 
-  class DnsConfigService;
-
-  // |dns_config_service_| will live on this runner.
-  scoped_refptr<base::SequencedTaskRunner> dns_config_service_runner_;
-  // DnsConfigService that lives on |dns_config_service_runner_|.
-  std::unique_ptr<DnsConfigService, base::OnTaskRunnerDeleter>
-      dns_config_service_;
-
   // Calculates parameters used for network change notifier online/offline
   // signals.
   static NetworkChangeNotifier::NetworkChangeCalculatorParams
diff --git a/chromium/net/base/network_change_notifier_posix_unittest.cc b/chromium/net/base/network_change_notifier_posix_unittest.cc
index c540877f651..682fb2e00d0 100644
--- a/chromium/net/base/network_change_notifier_posix_unittest.cc
+++ b/chromium/net/base/network_change_notifier_posix_unittest.cc
@@ -4,8 +4,12 @@
 
 #include "net/base/network_change_notifier_posix.h"
 
+#include <utility>
+
 #include "base/test/scoped_task_environment.h"
 #include "net/base/network_change_notifier.h"
+#include "net/dns/system_dns_config_change_notifier.h"
+#include "net/dns/test_dns_config_service.h"
 #include "testing/gmock/include/gmock/gmock.h"
 
 namespace net {
@@ -14,21 +18,28 @@ class NetworkChangeNotifierPosixTest : public testing::Test {
  public:
   NetworkChangeNotifierPosixTest()
       : scoped_task_environment_(
-            base::test::ScopedTaskEnvironment::MainThreadType::MOCK_TIME),
+            base::test::ScopedTaskEnvironment::TimeSource::MOCK_TIME),
         notifier_(new NetworkChangeNotifierPosix(
             NetworkChangeNotifier::CONNECTION_UNKNOWN,
-            NetworkChangeNotifier::SUBTYPE_UNKNOWN)) {}
+            NetworkChangeNotifier::SUBTYPE_UNKNOWN)) {
+    auto dns_config_service = std::make_unique<TestDnsConfigService>();
+    dns_config_service_ = dns_config_service.get();
+    notifier_->system_dns_config_notifier()->SetDnsConfigServiceForTesting(
+        std::move(dns_config_service));
+  }
 
   void FastForwardUntilIdle() {
     scoped_task_environment_.FastForwardUntilNoTasksRemain();
   }
 
   NetworkChangeNotifierPosix* notifier() { return notifier_.get(); }
+  TestDnsConfigService* dns_config_service() { return dns_config_service_; }
 
  private:
   base::test::ScopedTaskEnvironment scoped_task_environment_;
   net::NetworkChangeNotifier::DisableForTest mock_notifier_disabler_;
   std::unique_ptr<NetworkChangeNotifierPosix> notifier_;
+  TestDnsConfigService* dns_config_service_;
 };
 
 class MockIPAddressObserver : public NetworkChangeNotifier::IPAddressObserver {
@@ -86,4 +97,17 @@ TEST_F(NetworkChangeNotifierPosixTest, OnMaxBandwidthChanged) {
   NetworkChangeNotifier::RemoveMaxBandwidthObserver(&observer);
 }
 
+TEST_F(NetworkChangeNotifierPosixTest, OnDNSChanged) {
+  DnsConfig expected_config;
+  expected_config.nameservers = {IPEndPoint(IPAddress(1, 2, 3, 4), 233)};
+  dns_config_service()->SetConfigForRefresh(expected_config);
+
+  notifier()->OnDNSChanged();
+  FastForwardUntilIdle();
+
+  DnsConfig actual_config;
+  NetworkChangeNotifier::GetDnsConfig(&actual_config);
+  EXPECT_EQ(expected_config, actual_config);
+}
+
 }  // namespace net
diff --git a/chromium/net/base/network_change_notifier_win.cc b/chromium/net/base/network_change_notifier_win.cc
index 44336d60c12..e39014bd214 100644
--- a/chromium/net/base/network_change_notifier_win.cc
+++ b/chromium/net/base/network_change_notifier_win.cc
@@ -7,6 +7,8 @@
 #include <iphlpapi.h>
 #include <winsock2.h>
 
+#include <utility>
+
 #include "base/bind.h"
 #include "base/location.h"
 #include "base/logging.h"
@@ -22,7 +24,6 @@
 #include "base/time/time.h"
 #include "net/base/winsock_init.h"
 #include "net/base/winsock_util.h"
-#include "net/dns/dns_config_service.h"
 
 namespace net {
 
@@ -37,14 +38,8 @@ NetworkChangeNotifierWin::NetworkChangeNotifierWin()
     : NetworkChangeNotifier(NetworkChangeCalculatorParamsWin()),
       is_watching_(false),
       sequential_failures_(0),
-      dns_config_service_runner_(
+      blocking_task_runner_(
           base::CreateSequencedTaskRunnerWithTraits({base::MayBlock()})),
-      dns_config_service_(
-          DnsConfigService::CreateSystemService().release(),
-          // Ensure DnsConfigService lives on |dns_config_service_runner_|
-          // to prevent races where NetworkChangeNotifierWin outlives
-          // ScopedTaskEnvironment. https://crbug.com/938126
-          base::OnTaskRunnerDeleter(dns_config_service_runner_)),
       last_computed_connection_type_(RecomputeCurrentConnectionType()),
       last_announced_offline_(last_computed_connection_type_ ==
                               CONNECTION_NONE),
@@ -194,12 +189,12 @@ NetworkChangeNotifierWin::RecomputeCurrentConnectionType() const {
                           : NetworkChangeNotifier::CONNECTION_NONE;
 }
 
-void NetworkChangeNotifierWin::RecomputeCurrentConnectionTypeOnDnsSequence(
+void NetworkChangeNotifierWin::RecomputeCurrentConnectionTypeOnBlockingSequence(
     base::OnceCallback<void(ConnectionType)> reply_callback) const {
   // Unretained is safe in this call because this object owns the thread and the
   // thread is stopped in this object's destructor.
   base::PostTaskAndReplyWithResult(
-      dns_config_service_runner_.get(), FROM_HERE,
+      blocking_task_runner_.get(), FROM_HERE,
       base::BindOnce(&NetworkChangeNotifierWin::RecomputeCurrentConnectionType,
                      base::Unretained(this)),
       std::move(reply_callback));
@@ -225,7 +220,7 @@ void NetworkChangeNotifierWin::OnObjectSignaled(HANDLE object) {
   // Start watching for the next address change.
   WatchForAddressChange();
 
-  RecomputeCurrentConnectionTypeOnDnsSequence(base::BindOnce(
+  RecomputeCurrentConnectionTypeOnBlockingSequence(base::BindOnce(
       &NetworkChangeNotifierWin::NotifyObservers, weak_factory_.GetWeakPtr()));
 }
 
@@ -277,7 +272,7 @@ void NetworkChangeNotifierWin::WatchForAddressChange() {
   // network change event, since network changes were not being observed in
   // that interval.
   if (sequential_failures_ > 0) {
-    RecomputeCurrentConnectionTypeOnDnsSequence(
+    RecomputeCurrentConnectionTypeOnBlockingSequence(
         base::Bind(&NetworkChangeNotifierWin::NotifyObservers,
                    weak_factory_.GetWeakPtr()));
   }
@@ -294,15 +289,6 @@ void NetworkChangeNotifierWin::WatchForAddressChange() {
 bool NetworkChangeNotifierWin::WatchForAddressChangeInternal() {
   DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
 
-  if (!posted_watch_config_) {
-    posted_watch_config_ = true;
-    dns_config_service_runner_->PostTask(
-        FROM_HERE, base::BindOnce(&DnsConfigService::WatchConfig,
-                                  base::Unretained(dns_config_service_.get()),
-                                  base::BindRepeating(
-                                      &NetworkChangeNotifier::SetDnsConfig)));
-  }
-
   ResetEventIfSignaled(addr_overlapped_.hEvent);
   HANDLE handle = nullptr;
   DWORD ret = NotifyAddrChange(&handle, &addr_overlapped_);
@@ -314,7 +300,7 @@ bool NetworkChangeNotifierWin::WatchForAddressChangeInternal() {
 }
 
 void NetworkChangeNotifierWin::NotifyParentOfConnectionTypeChange() {
-  RecomputeCurrentConnectionTypeOnDnsSequence(base::BindOnce(
+  RecomputeCurrentConnectionTypeOnBlockingSequence(base::BindOnce(
       &NetworkChangeNotifierWin::NotifyParentOfConnectionTypeChangeImpl,
       weak_factory_.GetWeakPtr()));
 }
diff --git a/chromium/net/base/network_change_notifier_win.h b/chromium/net/base/network_change_notifier_win.h
index e7a00b9cd71..ca8a28e51df 100644
--- a/chromium/net/base/network_change_notifier_win.h
+++ b/chromium/net/base/network_change_notifier_win.h
@@ -22,13 +22,10 @@
 
 namespace base {
 class SequencedTaskRunner;
-struct OnTaskRunnerDeleter;
 }  // namespace base
 
 namespace net {
 
-class DnsConfigService;
-
 // NetworkChangeNotifierWin uses a SequenceChecker, as all its internal
 // notification code must be called on the sequence it is created and destroyed
 // on.  All the NetworkChangeNotifier methods it implements are threadsafe.
@@ -37,6 +34,7 @@ class NET_EXPORT_PRIVATE NetworkChangeNotifierWin
       public base::win::ObjectWatcher::Delegate {
  public:
   NetworkChangeNotifierWin();
+  ~NetworkChangeNotifierWin() override;
 
   // Begins listening for a single subsequent address change.  If it fails to
   // start watching, it retries on a timer.  Must be called only once, on the
@@ -48,8 +46,6 @@ class NET_EXPORT_PRIVATE NetworkChangeNotifierWin
   void WatchForAddressChange();
 
  protected:
-  ~NetworkChangeNotifierWin() override;
-
   // For unit tests only.
   bool is_watching() { return is_watching_; }
   void set_is_watching(bool is_watching) { is_watching_ = is_watching; }
@@ -71,7 +67,7 @@ class NET_EXPORT_PRIVATE NetworkChangeNotifierWin
 
   // Calls RecomputeCurrentConnectionTypeImpl on the DNS sequence and runs
   // |reply_callback| with the type on the calling sequence.
-  virtual void RecomputeCurrentConnectionTypeOnDnsSequence(
+  virtual void RecomputeCurrentConnectionTypeOnBlockingSequence(
       base::OnceCallback<void(ConnectionType)> reply_callback) const;
 
   void SetCurrentConnectionType(ConnectionType connection_type);
@@ -109,11 +105,7 @@ class NET_EXPORT_PRIVATE NetworkChangeNotifierWin
   // Number of times WatchForAddressChange has failed in a row.
   int sequential_failures_;
 
-  // |dns_config_service_| will live on this runner.
-  scoped_refptr<base::SequencedTaskRunner> dns_config_service_runner_;
-  // DnsConfigService that lives on |dns_config_service_runner_|.
-  std::unique_ptr<DnsConfigService, base::OnTaskRunnerDeleter>
-      dns_config_service_;
+  scoped_refptr<base::SequencedTaskRunner> blocking_task_runner_;
 
   mutable base::Lock last_computed_connection_type_lock_;
   ConnectionType last_computed_connection_type_;
@@ -124,9 +116,6 @@ class NET_EXPORT_PRIVATE NetworkChangeNotifierWin
   // Number of times polled to check if still offline.
   int offline_polls_;
 
-  // Keeps track of whether DnsConfigService::WatchConfig() has been called.
-  bool posted_watch_config_ = false;
-
   SEQUENCE_CHECKER(sequence_checker_);
 
   // Used for calling WatchForAddressChange again on failure.
diff --git a/chromium/net/base/network_change_notifier_win_unittest.cc b/chromium/net/base/network_change_notifier_win_unittest.cc
index 0d512053c2d..1f2d4bd5fdd 100644
--- a/chromium/net/base/network_change_notifier_win_unittest.cc
+++ b/chromium/net/base/network_change_notifier_win_unittest.cc
@@ -4,6 +4,8 @@
 
 #include "net/base/network_change_notifier_win.h"
 
+#include <utility>
+
 #include "base/bind.h"
 #include "base/macros.h"
 #include "base/run_loop.h"
@@ -43,7 +45,7 @@ class TestNetworkChangeNotifierWin : public NetworkChangeNotifierWin {
   }
 
   // From NetworkChangeNotifierWin.
-  void RecomputeCurrentConnectionTypeOnDnsSequence(
+  void RecomputeCurrentConnectionTypeOnBlockingSequence(
       base::OnceCallback<void(ConnectionType)> reply_callback) const override {
     base::ThreadTaskRunnerHandle::Get()->PostTask(
         FROM_HERE, base::BindOnce(std::move(reply_callback),
diff --git a/chromium/net/base/network_interfaces_win.cc b/chromium/net/base/network_interfaces_win.cc
index 6c3dde17188..c8b9fe09be3 100644
--- a/chromium/net/base/network_interfaces_win.cc
+++ b/chromium/net/base/network_interfaces_win.cc
@@ -15,6 +15,7 @@
 #include "base/strings/sys_string_conversions.h"
 #include "base/strings/utf_string_conversions.h"
 #include "base/threading/scoped_blocking_call.h"
+#include "base/threading/scoped_thread_priority.h"
 #include "base/win/scoped_handle.h"
 #include "net/base/escape.h"
 #include "net/base/ip_endpoint.h"
@@ -103,11 +104,12 @@ WlanApi& WlanApi::GetInstance() {
 }
 
 WlanApi::WlanApi() : initialized(false) {
-  // Use an absolute path to load the DLL to avoid DLL preloading attacks.
-  static const wchar_t* const kDLL = L"%WINDIR%\\system32\\wlanapi.dll";
-  wchar_t path[MAX_PATH] = {0};
-  ExpandEnvironmentStrings(kDLL, path, base::size(path));
-  module = ::LoadLibraryEx(path, nullptr, LOAD_WITH_ALTERED_SEARCH_PATH);
+  // Mitigate the issues caused by loading DLLs on a background thread
+  // (http://crbug/973868).
+  base::ScopedThreadMayLoadLibraryOnBackgroundThread priority_boost(FROM_HERE);
+
+  HMODULE module =
+      ::LoadLibraryEx(L"wlanapi.dll", nullptr, LOAD_LIBRARY_SEARCH_SYSTEM32);
   if (!module)
     return;
 
diff --git a/chromium/net/base/network_isolation_key.cc b/chromium/net/base/network_isolation_key.cc
index 183c87f5260..646d615c666 100644
--- a/chromium/net/base/network_isolation_key.cc
+++ b/chromium/net/base/network_isolation_key.cc
@@ -3,14 +3,32 @@
 // found in the LICENSE file.
 
 #include "net/base/network_isolation_key.h"
+#include "base/feature_list.h"
+#include "net/base/features.h"
 
 namespace net {
 
-NetworkIsolationKey::NetworkIsolationKey(
-    const base::Optional<url::Origin>& top_frame_origin)
-    : top_frame_origin_(top_frame_origin) {}
+namespace {
+
+std::string GetOriginDebugString(const base::Optional<url::Origin>& origin) {
+  return origin ? origin->GetDebugString() : "null";
+}
 
-NetworkIsolationKey::NetworkIsolationKey() = default;
+}  // namespace
+
+NetworkIsolationKey::NetworkIsolationKey(const url::Origin& top_frame_origin,
+                                         const url::Origin& frame_origin)
+    : use_frame_origin_(base::FeatureList::IsEnabled(
+          net::features::kAppendFrameOriginToNetworkIsolationKey)),
+      top_frame_origin_(top_frame_origin) {
+  if (use_frame_origin_) {
+    frame_origin_ = frame_origin;
+  }
+}
+
+NetworkIsolationKey::NetworkIsolationKey()
+    : use_frame_origin_(base::FeatureList::IsEnabled(
+          net::features::kAppendFrameOriginToNetworkIsolationKey)) {}
 
 NetworkIsolationKey::NetworkIsolationKey(
     const NetworkIsolationKey& network_isolation_key) = default;
@@ -24,25 +42,37 @@ NetworkIsolationKey& NetworkIsolationKey::operator=(
     NetworkIsolationKey&& network_isolation_key) = default;
 
 std::string NetworkIsolationKey::ToString() const {
-  if (top_frame_origin_ && !top_frame_origin_->opaque())
-    return top_frame_origin_->Serialize();
-  return std::string();
+  if (IsTransient())
+    return "";
+
+  return top_frame_origin_->Serialize() +
+         (use_frame_origin_ ? " " + frame_origin_->Serialize() : "");
 }
 
 std::string NetworkIsolationKey::ToDebugString() const {
-  if (!top_frame_origin_)
-    return "null";
-  return top_frame_origin_->GetDebugString();
+  // The space-separated serialization of |top_frame_origin_| and
+  // |frame_origin_|.
+  std::string return_string = GetOriginDebugString(top_frame_origin_);
+  if (use_frame_origin_) {
+    return_string += " " + GetOriginDebugString(frame_origin_);
+  }
+  return return_string;
 }
 
 bool NetworkIsolationKey::IsFullyPopulated() const {
-  return top_frame_origin_.has_value();
+  return top_frame_origin_.has_value() &&
+         (!use_frame_origin_ || frame_origin_.has_value());
 }
 
 bool NetworkIsolationKey::IsTransient() const {
   if (!IsFullyPopulated())
     return true;
-  return top_frame_origin_->opaque();
+  return top_frame_origin_->opaque() ||
+         (use_frame_origin_ && frame_origin_->opaque());
+}
+
+bool NetworkIsolationKey::IsEmpty() const {
+  return !top_frame_origin_.has_value();
 }
 
 }  // namespace net
diff --git a/chromium/net/base/network_isolation_key.h b/chromium/net/base/network_isolation_key.h
index ced5858a40c..82bfba04cfc 100644
--- a/chromium/net/base/network_isolation_key.h
+++ b/chromium/net/base/network_isolation_key.h
@@ -18,7 +18,10 @@ namespace net {
 // the context on which they were made.
 class NET_EXPORT NetworkIsolationKey {
  public:
-  NetworkIsolationKey(const base::Optional<url::Origin>& top_frame_origin);
+  // Full constructor.  When a request is initiated by the top frame, it must
+  // also populate the |frame_origin| parameter when calling this constructor.
+  explicit NetworkIsolationKey(const url::Origin& top_frame_origin,
+                               const url::Origin& frame_origin);
 
   // Construct an empty key.
   NetworkIsolationKey();
@@ -31,18 +34,27 @@ class NET_EXPORT NetworkIsolationKey {
       const NetworkIsolationKey& network_isolation_key);
   NetworkIsolationKey& operator=(NetworkIsolationKey&& network_isolation_key);
 
+  // Compare keys for equality, true if all enabled fields are equal.
   bool operator==(const NetworkIsolationKey& other) const {
-    return top_frame_origin_ == other.top_frame_origin_;
+    return top_frame_origin_ == other.top_frame_origin_ &&
+           frame_origin_ == other.frame_origin_;
   }
 
-  bool operator<(const NetworkIsolationKey& other) const {
-    return top_frame_origin_ < other.top_frame_origin_;
+  // Compare keys for inequality, true if any enabled field varies.
+  bool operator!=(const NetworkIsolationKey& other) const {
+    return (top_frame_origin_ != other.top_frame_origin_) ||
+           (frame_origin_ != other.frame_origin_);
   }
 
-  // TODO(shivanisha): Use feature flags in the below methods to determine which
-  // parts of the key are being used based on the enabled experiment.
+  // Provide an ordering for keys based on all enabled fields.
+  bool operator<(const NetworkIsolationKey& other) const {
+    return top_frame_origin_ < other.top_frame_origin_ ||
+           (top_frame_origin_ == other.top_frame_origin_ &&
+            frame_origin_ < other.frame_origin_);
+  }
 
-  // Returns the string representation of the key.
+  // Returns the string representation of the key, which is the string
+  // representation of each piece of the key separated by spaces.
   std::string ToString() const;
 
   // Returns string for debugging. Difference from ToString() is that transient
@@ -56,11 +68,27 @@ class NET_EXPORT NetworkIsolationKey {
   // to persist state to disk related to it (e.g., disk cache).
   bool IsTransient() const;
 
+  // APIs for serialization to and from the mojo structure.
+  const base::Optional<url::Origin>& GetTopFrameOrigin() const {
+    return top_frame_origin_;
+  }
+
+  const base::Optional<url::Origin>& GetFrameOrigin() const {
+    return frame_origin_;
+  }
+
+  // Returns true if all parts of the key are empty.
+  bool IsEmpty() const;
+
  private:
-  // The origin of the top frame of the request (if applicable).
+  // Whether or not to use the |frame_origin_| as part of the key.
+  bool use_frame_origin_;
+
+  // The origin of the top frame of the page making the request.
   base::Optional<url::Origin> top_frame_origin_;
 
-  // TODO(crbug.com/950069): Also add initiator origin to the key.
+  // The origin of the frame that initiates the request.
+  base::Optional<url::Origin> frame_origin_;
 };
 
 }  // namespace net
diff --git a/chromium/net/base/network_isolation_key_unittest.cc b/chromium/net/base/network_isolation_key_unittest.cc
index 74549a84e7f..c3b52dc724d 100644
--- a/chromium/net/base/network_isolation_key_unittest.cc
+++ b/chromium/net/base/network_isolation_key_unittest.cc
@@ -5,6 +5,8 @@
 #include "net/base/network_isolation_key.h"
 
 #include "base/stl_util.h"
+#include "base/test/scoped_feature_list.h"
+#include "net/base/features.h"
 #include "testing/gtest/include/gtest/gtest.h"
 #include "url/gurl.h"
 #include "url/origin.h"
@@ -21,7 +23,7 @@ TEST(NetworkIsolationKeyTest, EmptyKey) {
 
 TEST(NetworkIsolationKeyTest, NonEmptyKey) {
   url::Origin origin = url::Origin::Create(GURL("http://a.test/"));
-  NetworkIsolationKey key(origin);
+  NetworkIsolationKey key(origin, origin);
   EXPECT_TRUE(key.IsFullyPopulated());
   EXPECT_EQ(origin.Serialize(), key.ToString());
   EXPECT_FALSE(key.IsTransient());
@@ -31,16 +33,16 @@ TEST(NetworkIsolationKeyTest, NonEmptyKey) {
 TEST(NetworkIsolationKeyTest, OpaqueOriginKey) {
   url::Origin origin_data =
       url::Origin::Create(GURL("data:text/html,<body>Hello World</body>"));
-  NetworkIsolationKey key(origin_data);
+  NetworkIsolationKey key(origin_data, origin_data);
   EXPECT_TRUE(key.IsFullyPopulated());
   EXPECT_EQ(std::string(), key.ToString());
   EXPECT_TRUE(key.IsTransient());
 
   // Create another opaque origin, and make sure it has a different debug
   // string.
-  EXPECT_NE(
-      key.ToDebugString(),
-      NetworkIsolationKey(origin_data.DeriveNewOpaqueOrigin()).ToDebugString());
+  const auto kOriginNew = origin_data.DeriveNewOpaqueOrigin();
+  EXPECT_NE(key.ToDebugString(),
+            NetworkIsolationKey(kOriginNew, kOriginNew).ToDebugString());
 }
 
 TEST(NetworkIsolationKeyTest, Operators) {
@@ -50,11 +52,16 @@ TEST(NetworkIsolationKeyTest, Operators) {
       // Unique origins are still sorted by scheme, so data is before file, and
       // file before http.
       NetworkIsolationKey(
+          url::Origin::Create(GURL("data:text/html,<body>Hello World</body>")),
           url::Origin::Create(GURL("data:text/html,<body>Hello World</body>"))),
-      NetworkIsolationKey(url::Origin::Create(GURL("file:///foo"))),
-      NetworkIsolationKey(url::Origin::Create(GURL("http://a.test/"))),
-      NetworkIsolationKey(url::Origin::Create(GURL("http://b.test/"))),
-      NetworkIsolationKey(url::Origin::Create(GURL("https://a.test/"))),
+      NetworkIsolationKey(url::Origin::Create(GURL("file:///foo")),
+                          url::Origin::Create(GURL("file:///foo"))),
+      NetworkIsolationKey(url::Origin::Create(GURL("http://a.test/")),
+                          url::Origin::Create(GURL("http://a.test/"))),
+      NetworkIsolationKey(url::Origin::Create(GURL("http://b.test/")),
+                          url::Origin::Create(GURL("http://b.test/"))),
+      NetworkIsolationKey(url::Origin::Create(GURL("https://a.test/")),
+                          url::Origin::Create(GURL("https://a.test/"))),
   };
 
   for (size_t first = 0; first < base::size(kKeys); ++first) {
@@ -84,10 +91,12 @@ TEST(NetworkIsolationKeyTest, Operators) {
 }
 
 TEST(NetworkIsolationKeyTest, UniqueOriginOperators) {
-  NetworkIsolationKey key1(
-      url::Origin::Create(GURL("data:text/html,<body>Hello World</body>")));
-  NetworkIsolationKey key2(
-      url::Origin::Create(GURL("data:text/html,<body>Hello World</body>")));
+  const auto kOrigin1 =
+      url::Origin::Create(GURL("data:text/html,<body>Hello World</body>"));
+  const auto kOrigin2 =
+      url::Origin::Create(GURL("data:text/html,<body>Hello World</body>"));
+  NetworkIsolationKey key1(kOrigin1, kOrigin1);
+  NetworkIsolationKey key2(kOrigin2, kOrigin2);
 
   EXPECT_TRUE(key1 == key1);
   EXPECT_TRUE(key2 == key2);
@@ -104,4 +113,126 @@ TEST(NetworkIsolationKeyTest, UniqueOriginOperators) {
   EXPECT_TRUE(!(key1 < key2) || !(key2 < key1));
 }
 
+TEST(NetworkIsolationKeyTest, WithFrameOrigin) {
+  const auto kOriginA = url::Origin::Create(GURL("http://a.test"));
+  const auto kOriginB = url::Origin::Create(GURL("http://b.test"));
+  NetworkIsolationKey key1(kOriginB, kOriginB);
+  NetworkIsolationKey key2(kOriginB, kOriginA);
+  EXPECT_TRUE(key2.IsFullyPopulated());
+  EXPECT_FALSE(key2.IsTransient());
+  EXPECT_EQ("http://b.test", key2.ToString());
+  EXPECT_EQ("http://b.test", key2.ToDebugString());
+
+  EXPECT_TRUE(key1 == key2);
+  EXPECT_FALSE(key1 != key2);
+  EXPECT_FALSE(key1 < key2);
+  EXPECT_FALSE(key2 < key1);
+}
+
+TEST(NetworkIsolationKeyTest, OpaqueOriginKeyWithFrameOrigin) {
+  url::Origin origin_data =
+      url::Origin::Create(GURL("data:text/html,<body>Hello World</body>"));
+
+  NetworkIsolationKey key1(url::Origin::Create(GURL("http://a.test")),
+                           origin_data);
+  EXPECT_TRUE(key1.IsFullyPopulated());
+  EXPECT_FALSE(key1.IsTransient());
+  EXPECT_EQ("http://a.test", key1.ToString());
+  EXPECT_EQ("http://a.test", key1.ToDebugString());
+
+  NetworkIsolationKey key2(origin_data,
+                           url::Origin::Create(GURL("http://a.test")));
+  EXPECT_TRUE(key2.IsFullyPopulated());
+  EXPECT_TRUE(key2.IsTransient());
+  EXPECT_EQ("", key2.ToString());
+  EXPECT_EQ(origin_data.GetDebugString(), key2.ToDebugString());
+  EXPECT_NE(origin_data.DeriveNewOpaqueOrigin().GetDebugString(),
+            key2.ToDebugString());
+}
+
+class NetworkIsolationKeyWithFrameOriginTest : public testing::Test {
+ public:
+  NetworkIsolationKeyWithFrameOriginTest() {
+    feature_list_.InitAndEnableFeature(
+        net::features::kAppendFrameOriginToNetworkIsolationKey);
+  }
+
+ private:
+  base::test::ScopedFeatureList feature_list_;
+};
+
+TEST_F(NetworkIsolationKeyWithFrameOriginTest, WithFrameOrigin) {
+  NetworkIsolationKey key(url::Origin::Create(GURL("http://b.test")),
+                          url::Origin::Create(GURL("http://a.test/")));
+  EXPECT_TRUE(key.IsFullyPopulated());
+  EXPECT_FALSE(key.IsTransient());
+  EXPECT_EQ("http://b.test http://a.test", key.ToString());
+  EXPECT_EQ("http://b.test http://a.test", key.ToDebugString());
+
+  EXPECT_TRUE(key == key);
+  EXPECT_FALSE(key != key);
+  EXPECT_FALSE(key < key);
+}
+
+TEST_F(NetworkIsolationKeyWithFrameOriginTest, OpaqueOriginKey) {
+  url::Origin origin_data =
+      url::Origin::Create(GURL("data:text/html,<body>Hello World</body>"));
+
+  NetworkIsolationKey key1(url::Origin::Create(GURL("http://a.test")),
+                           origin_data);
+  EXPECT_TRUE(key1.IsFullyPopulated());
+  EXPECT_TRUE(key1.IsTransient());
+  EXPECT_EQ("", key1.ToString());
+  EXPECT_EQ("http://a.test " + origin_data.GetDebugString(),
+            key1.ToDebugString());
+  EXPECT_NE(
+      "http://a.test " + origin_data.DeriveNewOpaqueOrigin().GetDebugString(),
+      key1.ToDebugString());
+
+  NetworkIsolationKey key2(origin_data,
+                           url::Origin::Create(GURL("http://a.test")));
+  EXPECT_TRUE(key2.IsFullyPopulated());
+  EXPECT_TRUE(key2.IsTransient());
+  EXPECT_EQ("", key2.ToString());
+  EXPECT_EQ(origin_data.GetDebugString() + " http://a.test",
+            key2.ToDebugString());
+  EXPECT_NE(
+      origin_data.DeriveNewOpaqueOrigin().GetDebugString() + " http://a.test",
+      key2.ToDebugString());
+}
+
+TEST_F(NetworkIsolationKeyWithFrameOriginTest, OpaqueOriginKeyBoth) {
+  url::Origin origin_data_1 =
+      url::Origin::Create(GURL("data:text/html,<body>Hello World</body>"));
+  url::Origin origin_data_2 =
+      url::Origin::Create(GURL("data:text/html,<body>Hello Universe</body>"));
+  url::Origin origin_data_3 =
+      url::Origin::Create(GURL("data:text/html,<body>Hello Cosmos</body>"));
+
+  NetworkIsolationKey key1(origin_data_1, origin_data_2);
+  NetworkIsolationKey key2(origin_data_1, origin_data_2);
+  NetworkIsolationKey key3(origin_data_1, origin_data_3);
+
+  // All the keys should be fully populated and transient.
+  EXPECT_TRUE(key1.IsFullyPopulated());
+  EXPECT_TRUE(key2.IsFullyPopulated());
+  EXPECT_TRUE(key3.IsFullyPopulated());
+  EXPECT_TRUE(key1.IsTransient());
+  EXPECT_TRUE(key2.IsTransient());
+  EXPECT_TRUE(key3.IsTransient());
+
+  // Test the equality/comparisons of the various keys
+  EXPECT_TRUE(key1 == key2);
+  EXPECT_FALSE(key1 == key3);
+  EXPECT_FALSE(key1 < key2 || key2 < key1);
+  EXPECT_TRUE(key1 < key3 || key3 < key1);
+
+  // Test the ToString and ToDebugString
+  EXPECT_EQ(key1.ToDebugString(), key2.ToDebugString());
+  EXPECT_NE(key1.ToDebugString(), key3.ToDebugString());
+  EXPECT_EQ("", key1.ToString());
+  EXPECT_EQ("", key2.ToString());
+  EXPECT_EQ("", key3.ToString());
+}
+
 }  // namespace net
diff --git a/chromium/net/base/network_notification_thread_mac.cc b/chromium/net/base/network_notification_thread_mac.cc
new file mode 100644
index 00000000000..436b99b6ca4
--- /dev/null
+++ b/chromium/net/base/network_notification_thread_mac.cc
@@ -0,0 +1,51 @@
+// Copyright 2019 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "net/base/network_notification_thread_mac.h"
+
+#include "base/no_destructor.h"
+#include "base/threading/thread.h"
+
+namespace net {
+
+namespace {
+
+class NotificationThreadMac {
+ public:
+  scoped_refptr<base::SingleThreadTaskRunner> task_runner() const {
+    return task_runner_;
+  }
+
+ private:
+  friend base::NoDestructor<NotificationThreadMac>;
+
+  NotificationThreadMac() : thread_("NetworkNotificationThreadMac") {
+    base::Thread::Options options;
+    options.message_loop_type = base::MessageLoop::TYPE_UI;
+    options.joinable = false;
+    thread_.StartWithOptions(options);
+    task_runner_ = thread_.task_runner();
+    thread_.DetachFromSequence();
+  }
+
+  ~NotificationThreadMac() = delete;
+
+  // The |thread_| object is not thread-safe. This should not be accessed
+  // outside the constructor.
+  base::Thread thread_;
+
+  // Saved TaskRunner handle that can be accessed from any thread.
+  scoped_refptr<base::SingleThreadTaskRunner> task_runner_;
+
+  DISALLOW_COPY_AND_ASSIGN(NotificationThreadMac);
+};
+
+}  // namespace
+
+scoped_refptr<base::SingleThreadTaskRunner> GetNetworkNotificationThreadMac() {
+  static base::NoDestructor<NotificationThreadMac> notification_thread;
+  return notification_thread->task_runner();
+}
+
+}  // namespace net
diff --git a/chromium/net/base/network_notification_thread_mac.h b/chromium/net/base/network_notification_thread_mac.h
new file mode 100644
index 00000000000..8ced7568203
--- /dev/null
+++ b/chromium/net/base/network_notification_thread_mac.h
@@ -0,0 +1,20 @@
+// Copyright 2019 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef NET_BASE_NETWORK_NOTIFICATION_THREAD_MAC_H_
+#define NET_BASE_NETWORK_NOTIFICATION_THREAD_MAC_H_
+
+#include "base/single_thread_task_runner.h"
+
+namespace net {
+
+// Returns a TaskRunner that runs on a TYPE_UI thread, for macOS notification
+// APIs that require a CFRunLoop. The thread is not joined on shutdown (like
+// TaskShutdownBehavior::CONTINUE_ON_SHUTDOWN), so any users of this thread
+// must take care not to access invalid objects during shutdown.
+scoped_refptr<base::SingleThreadTaskRunner> GetNetworkNotificationThreadMac();
+
+}  // namespace net
+
+#endif  // NET_BASE_NETWORK_NOTIFICATION_THREAD_MAC_H_
diff --git a/chromium/net/base/network_throttle_manager_impl.cc b/chromium/net/base/network_throttle_manager_impl.cc
index d5043bcf390..0c0e7ec5450 100644
--- a/chromium/net/base/network_throttle_manager_impl.cc
+++ b/chromium/net/base/network_throttle_manager_impl.cc
@@ -240,8 +240,8 @@ void NetworkThrottleManagerImpl::OnThrottleDestroyed(ThrottleImpl* throttle) {
       break;
   }
 
-  DCHECK(!base::ContainsValue(blocked_throttles_, throttle));
-  DCHECK(!base::ContainsValue(outstanding_throttles_, throttle));
+  DCHECK(!base::Contains(blocked_throttles_, throttle));
+  DCHECK(!base::Contains(outstanding_throttles_, throttle));
 
   // Unblock the throttles if there's some chance there's a throttle to
   // unblock.
diff --git a/chromium/net/base/port_util.h b/chromium/net/base/port_util.h
index 72d4b394ed6..b64b137be98 100644
--- a/chromium/net/base/port_util.h
+++ b/chromium/net/base/port_util.h
@@ -21,7 +21,7 @@ NET_EXPORT bool IsPortValid(int port);
 
 // Returns true if the port is in the range [0, 1023]. These ports are
 // registered by IANA and typically need root access to listen on.
-bool IsWellKnownPort(int port);
+NET_EXPORT bool IsWellKnownPort(int port);
 
 // Checks if the port is allowed for the specified scheme.  Ports set as allowed
 // with SetExplicitlyAllowedPorts() or by using ScopedPortException() will be
diff --git a/chromium/net/base/test_completion_callback.cc b/chromium/net/base/test_completion_callback.cc
index 3cd8957c685..7f88f799168 100644
--- a/chromium/net/base/test_completion_callback.cc
+++ b/chromium/net/base/test_completion_callback.cc
@@ -23,7 +23,8 @@ void TestCompletionCallbackBaseInternal::DidSetResult() {
 void TestCompletionCallbackBaseInternal::WaitForResult() {
   DCHECK(!run_loop_);
   if (!have_result_) {
-    run_loop_.reset(new base::RunLoop());
+    run_loop_ = std::make_unique<base::RunLoop>(
+        base::RunLoop::Type::kNestableTasksAllowed);
     run_loop_->Run();
     run_loop_.reset();
     DCHECK(have_result_);
diff --git a/chromium/net/base/upload_data_stream.cc b/chromium/net/base/upload_data_stream.cc
index 6804a1e794f..ed6c705d6ed 100644
--- a/chromium/net/base/upload_data_stream.cc
+++ b/chromium/net/base/upload_data_stream.cc
@@ -4,7 +4,6 @@
 
 #include "net/base/upload_data_stream.h"
 
-#include "base/bind.h"
 #include "base/logging.h"
 #include "base/values.h"
 #include "net/base/io_buffer.h"
@@ -15,10 +14,9 @@ namespace net {
 
 namespace {
 
-base::Value NetLogInitEndInfoCallback(int result,
-                                      int total_size,
-                                      bool is_chunked,
-                                      NetLogCaptureMode /* capture_mode */) {
+base::Value NetLogInitEndInfoParams(int result,
+                                    int total_size,
+                                    bool is_chunked) {
   base::Value dict(base::Value::Type::DICTIONARY);
 
   dict.SetIntKey("net_error", result);
@@ -27,8 +25,7 @@ base::Value NetLogInitEndInfoCallback(int result,
   return dict;
 }
 
-base::Value NetLogReadInfoCallback(int current_position,
-                                   NetLogCaptureMode /* capture_mode */) {
+base::Value CreateReadInfoParams(int current_position) {
   base::Value dict(base::Value::Type::DICTIONARY);
 
   dict.SetIntKey("current_position", current_position);
@@ -76,7 +73,7 @@ int UploadDataStream::Read(IOBuffer* buf,
   DCHECK_GT(buf_len, 0);
 
   net_log_.BeginEvent(NetLogEventType::UPLOAD_DATA_STREAM_READ,
-                      base::Bind(&NetLogReadInfoCallback, current_position_));
+                      [&] { return CreateReadInfoParams(current_position_); });
 
   int result = 0;
   if (!is_eof_)
@@ -156,9 +153,9 @@ void UploadDataStream::OnInitCompleted(int result) {
       is_eof_ = true;
   }
 
-  net_log_.EndEvent(
-      NetLogEventType::UPLOAD_DATA_STREAM_INIT,
-      base::Bind(&NetLogInitEndInfoCallback, result, total_size_, is_chunked_));
+  net_log_.EndEvent(NetLogEventType::UPLOAD_DATA_STREAM_INIT, [&] {
+    return NetLogInitEndInfoParams(result, total_size_, is_chunked_);
+  });
 
   if (!callback_.is_null())
     std::move(callback_).Run(result);
diff --git a/chromium/net/base/upload_file_element_reader.cc b/chromium/net/base/upload_file_element_reader.cc
index adf4e74551c..b393600077a 100644
--- a/chromium/net/base/upload_file_element_reader.cc
+++ b/chromium/net/base/upload_file_element_reader.cc
@@ -38,8 +38,7 @@ UploadFileElementReader::UploadFileElementReader(
       content_length_(0),
       bytes_remaining_(0),
       next_state_(State::IDLE),
-      init_called_while_operation_pending_(false),
-      weak_ptr_factory_(this) {
+      init_called_while_operation_pending_(false) {
   DCHECK(file.IsValid());
   DCHECK(task_runner_.get());
   file_stream_ = std::make_unique<FileStream>(std::move(file), task_runner);
@@ -59,8 +58,7 @@ UploadFileElementReader::UploadFileElementReader(
       content_length_(0),
       bytes_remaining_(0),
       next_state_(State::IDLE),
-      init_called_while_operation_pending_(false),
-      weak_ptr_factory_(this) {
+      init_called_while_operation_pending_(false) {
   DCHECK(task_runner_.get());
 }
 
diff --git a/chromium/net/base/upload_file_element_reader.h b/chromium/net/base/upload_file_element_reader.h
index 190bbc4b8f1..706137af85e 100644
--- a/chromium/net/base/upload_file_element_reader.h
+++ b/chromium/net/base/upload_file_element_reader.h
@@ -129,7 +129,7 @@ class NET_EXPORT UploadFileElementReader : public UploadElementReader {
   // True if Init() was called while an async operation was in progress.
   bool init_called_while_operation_pending_;
 
-  base::WeakPtrFactory<UploadFileElementReader> weak_ptr_factory_;
+  base::WeakPtrFactory<UploadFileElementReader> weak_ptr_factory_{this};
 
   DISALLOW_COPY_AND_ASSIGN(UploadFileElementReader);
 };