BASELINE: Update Chromium to 61.0.3163.99

Change-Id: I8452f34574d88ca2b27af9bd56fc9ff3f16b1367
Reviewed-by: Alexandru Croitor <alexandru.croitor@qt.io>

31 files changed, 753 insertions, 336 deletions

diff --git a/chromium/net/tools/cert_verify_tool/verify_using_path_builder.cc b/chromium/net/tools/cert_verify_tool/verify_using_path_builder.cc
index 2426f61c1e5..7a85816ff37 100644
--- a/chromium/net/tools/cert_verify_tool/verify_using_path_builder.cc
+++ b/chromium/net/tools/cert_verify_tool/verify_using_path_builder.cc
@@ -210,7 +210,9 @@ bool VerifyUsingPathBuilder(
   net::CertPathBuilder::Result result;
   net::CertPathBuilder path_builder(
       target_cert, ssl_trust_store->GetTrustStore(), &signature_policy, time,
-      net::KeyPurpose::SERVER_AUTH, &result);
+      net::KeyPurpose::SERVER_AUTH, net::InitialExplicitPolicy::kFalse,
+      {net::AnyPolicy()}, net::InitialPolicyMappingInhibit::kFalse,
+      net::InitialAnyPolicyInhibit::kFalse, &result);
   path_builder.AddCertIssuerSource(&intermediate_cert_issuer_source);
 
   // Create a network thread to be used for AIA fetches, and wait for a
diff --git a/chromium/net/tools/gdig/gdig.cc b/chromium/net/tools/gdig/gdig.cc
index 3eceb46ce82..6c71b7d46c9 100644
--- a/chromium/net/tools/gdig/gdig.cc
+++ b/chromium/net/tools/gdig/gdig.cc
@@ -256,7 +256,7 @@ GDig::GDig()
 
 GDig::~GDig() {
   if (log_)
-    log_->DeprecatedRemoveObserver(log_observer_.get());
+    log_->RemoveObserver(log_observer_.get());
 }
 
 GDig::Result GDig::Main(int argc, const char* argv[]) {
@@ -324,7 +324,7 @@ bool GDig::ParseCommandLine(int argc, const char* argv[]) {
     }
     log_.reset(new NetLog);
     log_observer_.reset(new FileNetLogObserver(stderr));
-    log_->DeprecatedAddObserver(log_observer_.get(), capture_mode);
+    log_->AddObserver(log_observer_.get(), capture_mode);
   }
 
   print_config_ = parsed_command_line.HasSwitch("print_config");
diff --git a/chromium/net/tools/get_server_time/get_server_time.cc b/chromium/net/tools/get_server_time/get_server_time.cc
index 75ca214f8a7..2cd8767cdbd 100644
--- a/chromium/net/tools/get_server_time/get_server_time.cc
+++ b/chromium/net/tools/get_server_time/get_server_time.cc
@@ -107,7 +107,7 @@ class PrintingLogObserver : public net::NetLog::ThreadSafeObserver {
 
   ~PrintingLogObserver() override {
     // This is guaranteed to be safe as this program is single threaded.
-    net_log()->DeprecatedRemoveObserver(this);
+    net_log()->RemoveObserver(this);
   }
 
   // NetLog::ThreadSafeObserver implementation:
@@ -230,8 +230,8 @@ int main(int argc, char* argv[]) {
   // printing_log_observer.
   net::NetLog net_log;
   PrintingLogObserver printing_log_observer;
-  net_log.DeprecatedAddObserver(&printing_log_observer,
-                                net::NetLogCaptureMode::IncludeSocketBytes());
+  net_log.AddObserver(&printing_log_observer,
+                      net::NetLogCaptureMode::IncludeSocketBytes());
 
   QuitDelegate delegate;
   std::unique_ptr<net::URLFetcher> fetcher =
diff --git a/chromium/net/tools/net_watcher/net_watcher.cc b/chromium/net/tools/net_watcher/net_watcher.cc
index 02cb3987ace..53ca175c7ed 100644
--- a/chromium/net/tools/net_watcher/net_watcher.cc
+++ b/chromium/net/tools/net_watcher/net_watcher.cc
@@ -181,7 +181,7 @@ int main(int argc, char* argv[]) {
   // Use the network loop as the file loop also.
   std::unique_ptr<net::ProxyConfigService> proxy_config_service(
       net::ProxyService::CreateSystemProxyConfigService(
-          network_loop.task_runner(), network_loop.task_runner()));
+          network_loop.task_runner()));
 
   // Uses |network_change_notifier|.
   net::NetworkChangeNotifier::AddIPAddressObserver(&net_watcher);
diff --git a/chromium/net/tools/quic/chlo_extractor_test.cc b/chromium/net/tools/quic/chlo_extractor_test.cc
index 54f5a310064..90de56b6f5e 100644
--- a/chromium/net/tools/quic/chlo_extractor_test.cc
+++ b/chromium/net/tools/quic/chlo_extractor_test.cc
@@ -95,8 +95,7 @@ TEST_F(ChloExtractorTest, FindsValidChlo) {
     EXPECT_TRUE(ChloExtractor::Extract(*packet_, versions, &delegate_))
         << QuicVersionToString(version);
     EXPECT_EQ(version, delegate_.version());
-    EXPECT_EQ(GetPeerInMemoryConnectionId(header_.public_header.connection_id),
-              delegate_.connection_id());
+    EXPECT_EQ(header_.public_header.connection_id, delegate_.connection_id());
     EXPECT_EQ(client_hello.DebugString(Perspective::IS_SERVER),
               delegate_.chlo())
         << QuicVersionToString(version);
diff --git a/chromium/net/tools/quic/end_to_end_test.cc b/chromium/net/tools/quic/end_to_end_test.cc
index ca66c54988b..acaeea697fe 100644
--- a/chromium/net/tools/quic/end_to_end_test.cc
+++ b/chromium/net/tools/quic/end_to_end_test.cc
@@ -35,6 +35,7 @@
 #include "net/quic/platform/api/quic_str_cat.h"
 #include "net/quic/platform/api/quic_string_piece.h"
 #include "net/quic/platform/api/quic_test.h"
+#include "net/quic/platform/api/quic_test_loopback.h"
 #include "net/quic/platform/api/quic_text_utils.h"
 #include "net/quic/test_tools/crypto_test_utils.h"
 #include "net/quic/test_tools/quic_config_peer.h"
@@ -87,9 +88,7 @@ struct TestParams {
              QuicTag congestion_control_tag,
              bool disable_hpack_dynamic_table,
              bool force_hol_blocking,
-             bool use_cheap_stateless_reject,
-             bool connection_id_big_endian_client,
-             bool connection_id_big_endian_server)
+             bool use_cheap_stateless_reject)
       : client_supported_versions(client_supported_versions),
         server_supported_versions(server_supported_versions),
         negotiated_version(negotiated_version),
@@ -99,9 +98,7 @@ struct TestParams {
         congestion_control_tag(congestion_control_tag),
         disable_hpack_dynamic_table(disable_hpack_dynamic_table),
         force_hol_blocking(force_hol_blocking),
-        use_cheap_stateless_reject(use_cheap_stateless_reject),
-        connection_id_big_endian_client(connection_id_big_endian_client),
-        connection_id_big_endian_server(connection_id_big_endian_server) {}
+        use_cheap_stateless_reject(use_cheap_stateless_reject) {}
 
   friend std::ostream& operator<<(std::ostream& os, const TestParams& p) {
     os << "{ server_supported_versions: "
@@ -117,11 +114,8 @@ struct TestParams {
        << QuicTagToString(p.congestion_control_tag);
     os << " disable_hpack_dynamic_table: " << p.disable_hpack_dynamic_table;
     os << " force_hol_blocking: " << p.force_hol_blocking;
-    os << " use_cheap_stateless_reject: " << p.use_cheap_stateless_reject;
-    os << " connection_id_big_endian_client: "
-       << p.connection_id_big_endian_client;
-    os << " connection_id_big_endian_server: "
-       << p.connection_id_big_endian_server << " }";
+    os << " use_cheap_stateless_reject: " << p.use_cheap_stateless_reject
+       << " }";
     return os;
   }
 
@@ -134,8 +128,6 @@ struct TestParams {
   bool disable_hpack_dynamic_table;
   bool force_hol_blocking;
   bool use_cheap_stateless_reject;
-  bool connection_id_big_endian_client;
-  bool connection_id_big_endian_server;
 };
 
 // Constructs various test permutations.
@@ -161,7 +153,7 @@ std::vector<TestParams> GetTestParams() {
 
   // This must be kept in sync with the number of nested for-loops below as it
   // is used to prune the number of tests that are run.
-  const int kMaxEnabledOptions = 7;
+  const int kMaxEnabledOptions = 5;
   int max_enabled_options = 0;
   std::vector<TestParams> params;
   for (bool server_uses_stateless_rejects_if_peer_supported : {true, false}) {
@@ -171,101 +163,84 @@ std::vector<TestParams> GetTestParams() {
         for (bool disable_hpack_dynamic_table : {false}) {
           for (bool force_hol_blocking : {true, false}) {
             for (bool use_cheap_stateless_reject : {true, false}) {
-              for (bool connection_id_big_endian_client : {true, false}) {
-                for (bool connection_id_big_endian_server : {true, false}) {
-                  int enabled_options = 0;
-                  if (force_hol_blocking) {
-                    ++enabled_options;
-                  }
-                  if (congestion_control_tag != kQBIC) {
-                    ++enabled_options;
-                  }
-                  if (disable_hpack_dynamic_table) {
-                    ++enabled_options;
-                  }
-                  if (client_supports_stateless_rejects) {
-                    ++enabled_options;
-                  }
-                  if (server_uses_stateless_rejects_if_peer_supported) {
-                    ++enabled_options;
-                  }
-                  if (use_cheap_stateless_reject) {
-                    ++enabled_options;
-                  }
-                  if (connection_id_big_endian_server) {
-                    ++enabled_options;
-                  }
-                  if (connection_id_big_endian_client) {
-                    ++enabled_options;
-                  }
-                  CHECK_GE(kMaxEnabledOptions, enabled_options);
-                  if (enabled_options > max_enabled_options) {
-                    max_enabled_options = enabled_options;
-                  }
-
-                  // Run tests with no options, a single option, or all the
-                  // options enabled to avoid a combinatorial explosion.
-                  if (enabled_options > 1 &&
-                      enabled_options < kMaxEnabledOptions) {
+              int enabled_options = 0;
+              if (force_hol_blocking) {
+                ++enabled_options;
+              }
+              if (congestion_control_tag != kQBIC) {
+                ++enabled_options;
+              }
+              if (disable_hpack_dynamic_table) {
+                ++enabled_options;
+              }
+              if (client_supports_stateless_rejects) {
+                ++enabled_options;
+              }
+              if (server_uses_stateless_rejects_if_peer_supported) {
+                ++enabled_options;
+              }
+              if (use_cheap_stateless_reject) {
+                ++enabled_options;
+              }
+              CHECK_GE(kMaxEnabledOptions, enabled_options);
+              if (enabled_options > max_enabled_options) {
+                max_enabled_options = enabled_options;
+              }
+
+              // Run tests with no options, a single option, or all the
+              // options enabled to avoid a combinatorial explosion.
+              if (enabled_options > 1 && enabled_options < kMaxEnabledOptions) {
+                continue;
+              }
+
+              for (const QuicVersionVector& client_versions : version_buckets) {
+                CHECK(!client_versions.empty());
+                if (FilterSupportedVersions(client_versions).empty()) {
+                  continue;
+                }
+                // Add an entry for server and client supporting all
+                // versions.
+                params.push_back(TestParams(
+                    client_versions, all_supported_versions,
+                    client_versions.front(), client_supports_stateless_rejects,
+                    server_uses_stateless_rejects_if_peer_supported,
+                    congestion_control_tag, disable_hpack_dynamic_table,
+                    force_hol_blocking, use_cheap_stateless_reject));
+
+                // Run version negotiation tests tests with no options, or
+                // all the options enabled to avoid a combinatorial
+                // explosion.
+                if (enabled_options > 1 &&
+                    enabled_options < kMaxEnabledOptions) {
+                  continue;
+                }
+
+                // Test client supporting all versions and server supporting
+                // 1 version. Simulate an old server and exercise version
+                // downgrade in the client. Protocol negotiation should
+                // occur.  Skip the i = 0 case because it is essentially the
+                // same as the default case.
+                for (size_t i = 1; i < client_versions.size(); ++i) {
+                  QuicVersionVector server_supported_versions;
+                  server_supported_versions.push_back(client_versions[i]);
+                  if (FilterSupportedVersions(server_supported_versions)
+                          .empty()) {
                     continue;
                   }
-
-                  for (const QuicVersionVector& client_versions :
-                       version_buckets) {
-                    CHECK(!client_versions.empty());
-                    if (FilterSupportedVersions(client_versions).empty()) {
-                      continue;
-                    }
-                    // Add an entry for server and client supporting all
-                    // versions.
-                    params.push_back(TestParams(
-                        client_versions, all_supported_versions,
-                        client_versions.front(),
-                        client_supports_stateless_rejects,
-                        server_uses_stateless_rejects_if_peer_supported,
-                        congestion_control_tag, disable_hpack_dynamic_table,
-                        force_hol_blocking, use_cheap_stateless_reject,
-                        connection_id_big_endian_client,
-                        connection_id_big_endian_server));
-
-                    // Run version negotiation tests tests with no options, or
-                    // all the options enabled to avoid a combinatorial
-                    // explosion.
-                    if (enabled_options > 1 &&
-                        enabled_options < kMaxEnabledOptions) {
-                      continue;
-                    }
-
-                    // Test client supporting all versions and server supporting
-                    // 1 version. Simulate an old server and exercise version
-                    // downgrade in the client. Protocol negotiation should
-                    // occur.  Skip the i = 0 case because it is essentially the
-                    // same as the default case.
-                    for (size_t i = 1; i < client_versions.size(); ++i) {
-                      QuicVersionVector server_supported_versions;
-                      server_supported_versions.push_back(client_versions[i]);
-                      if (FilterSupportedVersions(server_supported_versions)
-                              .empty()) {
-                        continue;
-                      }
-                      params.push_back(TestParams(
-                          client_versions, server_supported_versions,
-                          server_supported_versions.front(),
-                          client_supports_stateless_rejects,
-                          server_uses_stateless_rejects_if_peer_supported,
-                          congestion_control_tag, disable_hpack_dynamic_table,
-                          force_hol_blocking, use_cheap_stateless_reject,
-                          connection_id_big_endian_client,
-                          connection_id_big_endian_server));
-                    }  // End of version for loop.
-                  }    // End of 2nd version for loop.
-                }      // End of connection_id_big_endian_server
-              }        // End of connection_id_big_endian_client
-            }          // End of use_cheap_stateless_reject for loop.
-          }            // End of force_hol_blocking loop.
-        }              // End of disable_hpack_dynamic_table for loop.
-      }                // End of congestion_control_tag for loop.
-    }                  // End of client_supports_stateless_rejects for loop.
+                  params.push_back(TestParams(
+                      client_versions, server_supported_versions,
+                      server_supported_versions.front(),
+                      client_supports_stateless_rejects,
+                      server_uses_stateless_rejects_if_peer_supported,
+                      congestion_control_tag, disable_hpack_dynamic_table,
+                      force_hol_blocking, use_cheap_stateless_reject));
+                }  // End of version for loop.
+              }    // End of 2nd version for loop.
+            }      // End of use_cheap_stateless_reject for loop.
+          }        // End of force_hol_blocking loop.
+        }          // End of disable_hpack_dynamic_table for loop.
+      }            // End of congestion_control_tag for loop.
+    }              // End of client_supports_stateless_rejects for loop.
     CHECK_EQ(kMaxEnabledOptions, max_enabled_options);
   }  // End of server_uses_stateless_rejects_if_peer_supported for loop.
   return params;
@@ -299,7 +274,7 @@ class EndToEndTest : public QuicTestWithParam<TestParams> {
  protected:
   EndToEndTest()
       : initialized_(false),
-        server_address_(QuicSocketAddress(QuicIpAddress::Loopback4(), 0)),
+        server_address_(QuicSocketAddress(TestLoopback(), 0)),
         server_hostname_("test.example.com"),
         client_writer_(nullptr),
         server_writer_(nullptr),
@@ -333,11 +308,6 @@ class EndToEndTest : public QuicTestWithParam<TestParams> {
 
     AddToCache("/foo", 200, kFooResponseBody);
     AddToCache("/bar", 200, kBarResponseBody);
-
-    FLAGS_quic_restart_flag_quic_big_endian_connection_id_client =
-        GetParam().connection_id_big_endian_client;
-    FLAGS_quic_restart_flag_quic_big_endian_connection_id_server =
-        GetParam().connection_id_big_endian_server;
   }
 
   ~EndToEndTest() override {
@@ -414,16 +384,13 @@ class EndToEndTest : public QuicTestWithParam<TestParams> {
     // TODO(nimia): Consider setting the congestion control algorithm for the
     // client as well according to the test parameter.
     copt.push_back(GetParam().congestion_control_tag);
-    if (GetParam().congestion_control_tag == kQBIC &&
-        FLAGS_quic_reloadable_flag_quic_fix_cubic_convex_mode) {
+    if (GetParam().congestion_control_tag == kQBIC) {
       copt.push_back(kCCVX);
     }
-    if (GetParam().congestion_control_tag == kQBIC &&
-        FLAGS_quic_reloadable_flag_quic_fix_cubic_bytes_quantization) {
+    if (GetParam().congestion_control_tag == kQBIC) {
       copt.push_back(kCBQT);
     }
-    if (GetParam().congestion_control_tag == kQBIC &&
-        FLAGS_quic_reloadable_flag_quic_enable_cubic_per_ack_updates) {
+    if (GetParam().congestion_control_tag == kQBIC) {
       copt.push_back(kCPAU);
     }
     if (GetParam().congestion_control_tag == kTPCC &&
@@ -555,7 +522,9 @@ class EndToEndTest : public QuicTestWithParam<TestParams> {
   void VerifyCleanConnection(bool had_packet_loss) {
     QuicConnectionStats client_stats =
         client_->client()->session()->connection()->GetStats();
-    if (!had_packet_loss) {
+    // TODO(ianswett): Determine why this becomes even more flaky with BBR
+    // enabled.  b/62141144
+    if (!had_packet_loss && !FLAGS_quic_reloadable_flag_quic_default_to_bbr) {
       EXPECT_EQ(0u, client_stats.packets_lost);
     }
     EXPECT_EQ(0u, client_stats.packets_discarded);
@@ -1351,7 +1320,6 @@ TEST_P(EndToEndTest, SetIndependentMaxIncomingDynamicStreamsLimits) {
 }
 
 TEST_P(EndToEndTest, NegotiateCongestionControl) {
-  FLAGS_quic_reloadable_flag_quic_allow_new_bbr = true;
   ASSERT_TRUE(Initialize());
 
   // For PCC, the underlying implementation may be a stub with a
@@ -1365,7 +1333,11 @@ TEST_P(EndToEndTest, NegotiateCongestionControl) {
   CongestionControlType expected_congestion_control_type = kReno;
   switch (GetParam().congestion_control_tag) {
     case kRENO:
-      expected_congestion_control_type = kReno;
+      if (!FLAGS_quic_reloadable_flag_quic_disable_packets_based_cc) {
+        expected_congestion_control_type = kReno;
+      } else {
+        expected_congestion_control_type = kRenoBytes;
+      }
       break;
     case kTBBR:
       expected_congestion_control_type = kBBR;
@@ -1598,7 +1570,6 @@ class WrongAddressWriter : public QuicPacketWriterWrapper {
 
 TEST_P(EndToEndTest, ConnectionMigrationClientIPChanged) {
   ASSERT_TRUE(Initialize());
-
   EXPECT_EQ(kFooResponseBody, client_->SendSynchronousRequest("/foo"));
   EXPECT_EQ("200", client_->response_headers()->find(":status")->second);
 
@@ -1606,8 +1577,7 @@ TEST_P(EndToEndTest, ConnectionMigrationClientIPChanged) {
   QuicIpAddress old_host = client_->client()->GetLatestClientAddress().host();
 
   // Migrate socket to the new IP address.
-  QuicIpAddress new_host;
-  new_host.FromString("127.0.0.2");
+  QuicIpAddress new_host = TestLoopback(2);
   EXPECT_NE(old_host, new_host);
   ASSERT_TRUE(client_->client()->MigrateSocket(new_host));
 
@@ -2021,8 +1991,7 @@ TEST_P(EndToEndTest, ServerSendPublicReset) {
   QuicConnectionId connection_id =
       client_->client()->session()->connection()->connection_id();
   QuicPublicResetPacket header;
-  header.public_header.connection_id =
-      GetPeerInMemoryConnectionId(connection_id);
+  header.public_header.connection_id = connection_id;
   header.public_header.reset_flag = true;
   header.public_header.version_flag = false;
   QuicFramer framer(server_supported_versions_, QuicTime::Zero(),
@@ -2054,8 +2023,7 @@ TEST_P(EndToEndTest, ServerSendPublicResetWithDifferentConnectionId) {
   QuicConnectionId incorrect_connection_id =
       client_->client()->session()->connection()->connection_id() + 1;
   QuicPublicResetPacket header;
-  header.public_header.connection_id =
-      GetPeerInMemoryConnectionId(incorrect_connection_id);
+  header.public_header.connection_id = incorrect_connection_id;
   header.public_header.reset_flag = true;
   header.public_header.version_flag = false;
   QuicFramer framer(server_supported_versions_, QuicTime::Zero(),
@@ -2118,9 +2086,8 @@ TEST_P(EndToEndTest, ServerSendVersionNegotiationWithDifferentConnectionId) {
   QuicConnectionId incorrect_connection_id =
       client_->client()->session()->connection()->connection_id() + 1;
   std::unique_ptr<QuicEncryptedPacket> packet(
-      QuicFramer::BuildVersionNegotiationPacket(
-          GetPeerInMemoryConnectionId(incorrect_connection_id),
-          server_supported_versions_));
+      QuicFramer::BuildVersionNegotiationPacket(incorrect_connection_id,
+                                                server_supported_versions_));
   testing::NiceMock<MockQuicConnectionDebugVisitor> visitor;
   client_->client()->session()->connection()->set_debug_visitor(&visitor);
   EXPECT_CALL(visitor, OnIncorrectConnectionId(incorrect_connection_id))
@@ -2250,6 +2217,27 @@ TEST_P(EndToEndTest, BadEncryptedData) {
   EXPECT_EQ("200", client_->response_headers()->find(":status")->second);
 }
 
+TEST_P(EndToEndTest, CanceledStreamDoesNotBecomeZombie) {
+  ASSERT_TRUE(Initialize());
+  EXPECT_TRUE(client_->client()->WaitForCryptoHandshakeConfirmed());
+  // Lose the request.
+  SetPacketLossPercentage(100);
+  SpdyHeaderBlock headers;
+  headers[":method"] = "POST";
+  headers[":path"] = "/foo";
+  headers[":scheme"] = "https";
+  headers[":authority"] = server_hostname_;
+  client_->SendMessage(headers, "test_body", /*fin=*/false);
+  QuicSpdyClientStream* stream = client_->GetOrCreateStream();
+
+  // Cancel the stream.
+  stream->Reset(QUIC_STREAM_CANCELLED);
+  QuicSession* session = client_->client()->session();
+  // Verify canceled stream does not become zombie.
+  EXPECT_TRUE(QuicSessionPeer::zombie_streams(session).empty());
+  EXPECT_EQ(1u, QuicSessionPeer::closed_streams(session).size());
+}
+
 // A test stream that gives |response_body_| as an error response body.
 class ServerStreamWithErrorResponseBody : public QuicSimpleServerStream {
  public:
@@ -2341,7 +2329,7 @@ class ServerStreamThatDropsBodyFactory : public QuicTestServer::StreamFactory {
  public:
   ServerStreamThatDropsBodyFactory() {}
 
-  ~ServerStreamThatDropsBodyFactory() override{};
+  ~ServerStreamThatDropsBodyFactory() override {}
 
   QuicSimpleServerStream* CreateStream(
       QuicStreamId id,
@@ -2384,7 +2372,7 @@ class ServerStreamThatSendsHugeResponseFactory
   explicit ServerStreamThatSendsHugeResponseFactory(int64_t body_bytes)
       : body_bytes_(body_bytes) {}
 
-  ~ServerStreamThatSendsHugeResponseFactory() override{};
+  ~ServerStreamThatSendsHugeResponseFactory() override {}
 
   QuicSimpleServerStream* CreateStream(
       QuicStreamId id,
diff --git a/chromium/net/tools/quic/platform/impl/quic_socket_utils.cc b/chromium/net/tools/quic/platform/impl/quic_socket_utils.cc
index 621767c0667..e188da2e8e9 100644
--- a/chromium/net/tools/quic/platform/impl/quic_socket_utils.cc
+++ b/chromium/net/tools/quic/platform/impl/quic_socket_utils.cc
@@ -249,7 +249,7 @@ WriteResult QuicSocketUtils::WritePacket(
       (kSpaceForIpv4 < kSpaceForIpv6) ? kSpaceForIpv6 : kSpaceForIpv4;
   char cbuf[kSpaceForIp];
   if (!self_address.IsInitialized()) {
-    hdr.msg_control = 0;
+    hdr.msg_control = nullptr;
     hdr.msg_controllen = 0;
   } else {
     hdr.msg_control = cbuf;
diff --git a/chromium/net/tools/quic/quic_client_session_test.cc b/chromium/net/tools/quic/quic_client_session_test.cc
index c970c77b8b1..b45312af054 100644
--- a/chromium/net/tools/quic/quic_client_session_test.cc
+++ b/chromium/net/tools/quic/quic_client_session_test.cc
@@ -153,6 +153,7 @@ TEST_P(QuicClientSessionTest, NoEncryptionAfterInitialEncryption) {
   // Now create a second session using the same crypto config.
   Initialize();
 
+  EXPECT_CALL(*connection_, OnCanWrite());
   // Starting the handshake should move immediately to encryption
   // established and will allow streams to be created.
   session_->CryptoConnect();
@@ -168,7 +169,8 @@ TEST_P(QuicClientSessionTest, NoEncryptionAfterInitialEncryption) {
   CryptoHandshakeMessage rej;
   crypto_test_utils::FillInDummyReject(&rej, /* stateless */ false);
   EXPECT_TRUE(session_->IsEncryptionEstablished());
-  session_->GetMutableCryptoStream()->OnHandshakeMessage(rej);
+  crypto_test_utils::SendHandshakeMessageToStream(
+      session_->GetMutableCryptoStream(), rej, Perspective::IS_CLIENT);
   EXPECT_FALSE(session_->IsEncryptionEstablished());
   EXPECT_EQ(ENCRYPTION_NONE,
             QuicPacketCreatorPeer::GetEncryptionLevel(
@@ -346,9 +348,8 @@ TEST_P(QuicClientSessionTest, InvalidPacketReceived) {
   // Verify that a non-decryptable packet doesn't close the connection.
   QuicConnectionId connection_id = session_->connection()->connection_id();
   std::unique_ptr<QuicEncryptedPacket> packet(ConstructEncryptedPacket(
-      GetPeerInMemoryConnectionId(connection_id), false, false, 100, "data",
-      PACKET_8BYTE_CONNECTION_ID, PACKET_6BYTE_PACKET_NUMBER, nullptr,
-      Perspective::IS_SERVER));
+      connection_id, false, false, 100, "data", PACKET_8BYTE_CONNECTION_ID,
+      PACKET_6BYTE_PACKET_NUMBER, nullptr, Perspective::IS_SERVER));
   std::unique_ptr<QuicReceivedPacket> received(
       ConstructReceivedPacket(*packet, QuicTime::Zero()));
   // Change the last byte of the encrypted data.
@@ -372,9 +373,8 @@ TEST_P(QuicClientSessionTest, InvalidFramedPacketReceived) {
   QuicConnectionId connection_id = session_->connection()->connection_id();
   QuicVersionVector versions = {GetParam()};
   std::unique_ptr<QuicEncryptedPacket> packet(ConstructMisFramedEncryptedPacket(
-      GetPeerInMemoryConnectionId(connection_id), false, false, 100, "data",
-      PACKET_8BYTE_CONNECTION_ID, PACKET_6BYTE_PACKET_NUMBER, &versions,
-      Perspective::IS_SERVER));
+      connection_id, false, false, 100, "data", PACKET_8BYTE_CONNECTION_ID,
+      PACKET_6BYTE_PACKET_NUMBER, &versions, Perspective::IS_SERVER));
   std::unique_ptr<QuicReceivedPacket> received(
       ConstructReceivedPacket(*packet, QuicTime::Zero()));
   EXPECT_CALL(*connection_, CloseConnection(_, _, _)).Times(1);
@@ -516,6 +516,8 @@ TEST_P(QuicClientSessionTest, IsClosedTrueAfterResetPromisedAlreadyOpen) {
   CompleteCryptoHandshake();
 
   session_->GetOrCreateStream(promised_stream_id_);
+  EXPECT_CALL(*connection_,
+              SendRstStream(promised_stream_id_, QUIC_REFUSED_STREAM, 0));
   session_->ResetPromised(promised_stream_id_, QUIC_REFUSED_STREAM);
   EXPECT_TRUE(session_->IsClosedStream(promised_stream_id_));
 }
@@ -524,6 +526,8 @@ TEST_P(QuicClientSessionTest, IsClosedTrueAfterResetPromisedNonexistant) {
   // Initialize crypto before the client session will create a stream.
   CompleteCryptoHandshake();
 
+  EXPECT_CALL(*connection_,
+              SendRstStream(promised_stream_id_, QUIC_REFUSED_STREAM, 0));
   session_->ResetPromised(promised_stream_id_, QUIC_REFUSED_STREAM);
   EXPECT_TRUE(session_->IsClosedStream(promised_stream_id_));
 }
diff --git a/chromium/net/tools/quic/quic_client_test.cc b/chromium/net/tools/quic/quic_client_test.cc
index 458a5b7a3b3..973826d0192 100644
--- a/chromium/net/tools/quic/quic_client_test.cc
+++ b/chromium/net/tools/quic/quic_client_test.cc
@@ -12,6 +12,7 @@
 #include "base/files/file_enumerator.h"
 #include "base/files/file_util.h"
 #include "net/quic/platform/api/quic_test.h"
+#include "net/quic/platform/api/quic_test_loopback.h"
 #include "net/quic/platform/api/quic_text_utils.h"
 #include "net/quic/test_tools/crypto_test_utils.h"
 #include "net/quic/test_tools/quic_test_utils.h"
@@ -49,8 +50,7 @@ size_t NumOpenSocketFDs() {
 // Creates a new QuicClient and Initializes it. Caller is responsible for
 // deletion.
 QuicClient* CreateAndInitializeQuicClient(EpollServer* eps, uint16_t port) {
-  QuicSocketAddress server_address(
-      QuicSocketAddress(QuicIpAddress::Loopback4(), port));
+  QuicSocketAddress server_address(QuicSocketAddress(TestLoopback(), port));
   QuicServerId server_id("hostname", server_address.port(),
                          PRIVACY_MODE_DISABLED);
   QuicVersionVector versions = AllSupportedVersions();
diff --git a/chromium/net/tools/quic/quic_dispatcher.cc b/chromium/net/tools/quic/quic_dispatcher.cc
index fda85001fee..aa6ef57261a 100644
--- a/chromium/net/tools/quic/quic_dispatcher.cc
+++ b/chromium/net/tools/quic/quic_dispatcher.cc
@@ -7,6 +7,7 @@
 #include <utility>
 
 #include "base/macros.h"
+#include "net/quic/core/crypto/crypto_protocol.h"
 #include "net/quic/core/crypto/quic_random.h"
 #include "net/quic/core/quic_utils.h"
 #include "net/quic/platform/api/quic_bug_tracker.h"
@@ -49,10 +50,14 @@ class DeleteSessionsAlarm : public QuicAlarm::Delegate {
 
 // Collects packets serialized by a QuicPacketCreator in order
 // to be handed off to the time wait list manager.
-class PacketCollector : public QuicPacketCreator::DelegateInterface {
+class PacketCollector : public QuicPacketCreator::DelegateInterface,
+                        public QuicStreamFrameDataProducer {
  public:
+  explicit PacketCollector(QuicBufferAllocator* allocator)
+      : send_buffer_(allocator) {}
   ~PacketCollector() override {}
 
+  // QuicPacketCreator::DelegateInterface methods:
   void OnSerializedPacket(SerializedPacket* serialized_packet) override {
     // Make a copy of the serialized packet to send later.
     packets_.push_back(std::unique_ptr<QuicEncryptedPacket>(
@@ -67,12 +72,33 @@ class PacketCollector : public QuicPacketCreator::DelegateInterface {
                             const string& error_details,
                             ConnectionCloseSource source) override {}
 
+  // QuicStreamFrameDataProducer methods:
+  void SaveStreamData(QuicStreamId id,
+                      QuicIOVector iov,
+                      size_t iov_offset,
+                      QuicStreamOffset offset,
+                      QuicByteCount data_length) override {
+    DCHECK_EQ(kCryptoStreamId, id);
+    send_buffer_.SaveStreamData(iov, iov_offset, offset, data_length);
+  }
+
+  bool WriteStreamData(QuicStreamId id,
+                       QuicStreamOffset offset,
+                       QuicByteCount data_length,
+                       QuicDataWriter* writer) override {
+    DCHECK_EQ(kCryptoStreamId, id);
+    return send_buffer_.WriteStreamData(offset, data_length, writer);
+  }
+
   std::vector<std::unique_ptr<QuicEncryptedPacket>>* packets() {
     return &packets_;
   }
 
  private:
   std::vector<std::unique_ptr<QuicEncryptedPacket>> packets_;
+  // This is only needed until the packets are encrypted. Once packets are
+  // encrypted, the stream data is no longer required.
+  QuicStreamSendBuffer send_buffer_;
 };
 
 // Helper for statelessly closing connections by generating the
@@ -86,11 +112,23 @@ class StatelessConnectionTerminator {
                                 QuicTimeWaitListManager* time_wait_list_manager)
       : connection_id_(connection_id),
         framer_(framer),
+        collector_(helper->GetBufferAllocator()),
         creator_(connection_id,
                  framer,
                  helper->GetBufferAllocator(),
                  &collector_),
-        time_wait_list_manager_(time_wait_list_manager) {}
+        time_wait_list_manager_(time_wait_list_manager) {
+    if (FLAGS_quic_reloadable_flag_quic_stream_owns_data) {
+      framer_->set_data_producer(&collector_);
+    }
+  }
+
+  ~StatelessConnectionTerminator() {
+    if (framer_->HasDataProducer()) {
+      // Clear framer's producer.
+      framer_->set_data_producer(nullptr);
+    }
+  }
 
   // Generates a packet containing a CONNECTION_CLOSE frame specifying
   // |error_code| and |error_details| and add the connection to time wait.
@@ -150,9 +188,27 @@ class StatelessConnectionTerminator {
   QuicTimeWaitListManager* time_wait_list_manager_;
 };
 
+// Class which extracts the ALPN from a CHLO packet.
+class ChloAlpnExtractor : public ChloExtractor::Delegate {
+ public:
+  void OnChlo(QuicVersion version,
+              QuicConnectionId connection_id,
+              const CryptoHandshakeMessage& chlo) override {
+    QuicStringPiece alpn_value;
+    if (chlo.GetStringPiece(kALPN, &alpn_value)) {
+      alpn_ = string(alpn_value);
+    }
+  }
+
+  string&& ConsumeAlpn() { return std::move(alpn_); }
+
+ private:
+  string alpn_;
+};
+
 // Class which sits between the ChloExtractor and the StatelessRejector
 // to give the QuicDispatcher a chance to apply policy checks to the CHLO.
-class ChloValidator : public ChloExtractor::Delegate {
+class ChloValidator : public ChloAlpnExtractor {
  public:
   ChloValidator(QuicCryptoServerStream::Helper* helper,
                 QuicSocketAddress self_address,
@@ -166,6 +222,8 @@ class ChloValidator : public ChloExtractor::Delegate {
   void OnChlo(QuicVersion version,
               QuicConnectionId connection_id,
               const CryptoHandshakeMessage& chlo) override {
+    // Extract the ALPN
+    ChloAlpnExtractor::OnChlo(version, connection_id, chlo);
     if (helper_->CanAcceptClientHello(chlo, self_address_, &error_details_)) {
       can_accept_ = true;
       rejector_->OnChlo(version, connection_id,
@@ -648,13 +706,14 @@ void QuicDispatcher::ProcessBufferedChlos(size_t max_connections_to_create) {
   for (; new_sessions_allowed_per_event_loop_ > 0;
        --new_sessions_allowed_per_event_loop_) {
     QuicConnectionId connection_id;
-    std::list<BufferedPacket> packets =
+    BufferedPacketList packet_list =
         buffered_packets_.DeliverPacketsForNextConnection(&connection_id);
+    const std::list<BufferedPacket>& packets = packet_list.buffered_packets;
     if (packets.empty()) {
       return;
     }
-    QuicSession* session =
-        CreateQuicSession(connection_id, packets.front().client_address);
+    QuicSession* session = CreateQuicSession(
+        connection_id, packets.front().client_address, packet_list.alpn);
     QUIC_DLOG(INFO) << "Created new session for " << connection_id;
     session_map_.insert(std::make_pair(connection_id, QuicWrapUnique(session)));
     DeliverPacketsToSession(packets, session);
@@ -697,21 +756,15 @@ QuicTimeWaitListManager* QuicDispatcher::CreateQuicTimeWaitListManager() {
 
 void QuicDispatcher::BufferEarlyPacket(QuicConnectionId connection_id) {
   bool is_new_connection = !buffered_packets_.HasBufferedPackets(connection_id);
-  if (FLAGS_quic_reloadable_flag_quic_create_session_after_insertion &&
-      is_new_connection &&
+  if (is_new_connection &&
       !ShouldCreateOrBufferPacketForConnection(connection_id)) {
-    QUIC_FLAG_COUNT_N(quic_reloadable_flag_quic_create_session_after_insertion,
-                      1, 5);
     return;
   }
   EnqueuePacketResult rs = buffered_packets_.EnqueuePacket(
       connection_id, *current_packet_, current_server_address_,
-      current_client_address_, /*is_chlo=*/false);
+      current_client_address_, /*is_chlo=*/false, /*alpn=*/"");
   if (rs != EnqueuePacketResult::SUCCESS) {
     OnBufferPacketFailure(rs, connection_id);
-  } else if (!FLAGS_quic_reloadable_flag_quic_create_session_after_insertion &&
-             is_new_connection) {
-    ShouldCreateOrBufferPacketForConnection(connection_id);
   }
 }
 
@@ -728,11 +781,8 @@ void QuicDispatcher::ProcessChlo() {
                                             current_connection_id());
     return;
   }
-  if (FLAGS_quic_reloadable_flag_quic_create_session_after_insertion &&
-      !buffered_packets_.HasBufferedPackets(current_connection_id_) &&
+  if (!buffered_packets_.HasBufferedPackets(current_connection_id_) &&
       !ShouldCreateOrBufferPacketForConnection(current_connection_id_)) {
-    QUIC_FLAG_COUNT_N(quic_reloadable_flag_quic_create_session_after_insertion,
-                      2, 5);
     return;
   }
   if (FLAGS_quic_allow_chlo_buffering &&
@@ -740,33 +790,23 @@ void QuicDispatcher::ProcessChlo() {
       new_sessions_allowed_per_event_loop_ <= 0) {
     // Can't create new session any more. Wait till next event loop.
     QUIC_BUG_IF(buffered_packets_.HasChloForConnection(current_connection_id_));
-    bool is_new_connection =
-        !buffered_packets_.HasBufferedPackets(current_connection_id_);
     EnqueuePacketResult rs = buffered_packets_.EnqueuePacket(
         current_connection_id_, *current_packet_, current_server_address_,
-        current_client_address_, /*is_chlo=*/true);
+        current_client_address_, /*is_chlo=*/true, current_alpn_);
     if (rs != EnqueuePacketResult::SUCCESS) {
       OnBufferPacketFailure(rs, current_connection_id_);
-    } else if (
-        !FLAGS_quic_reloadable_flag_quic_create_session_after_insertion &&
-        is_new_connection) {
-      ShouldCreateOrBufferPacketForConnection(current_connection_id_);
     }
     return;
   }
   // Creates a new session and process all buffered packets for this connection.
-  QuicSession* session =
-      CreateQuicSession(current_connection_id_, current_client_address_);
+  QuicSession* session = CreateQuicSession(
+      current_connection_id_, current_client_address_, current_alpn_);
   QUIC_DLOG(INFO) << "Created new session for " << current_connection_id_;
   session_map_.insert(
       std::make_pair(current_connection_id_, QuicWrapUnique(session)));
   std::list<BufferedPacket> packets =
-      buffered_packets_.DeliverPackets(current_connection_id_);
-  // Check if CHLO is the first packet arrived on this connection.
-  if (!FLAGS_quic_reloadable_flag_quic_create_session_after_insertion &&
-      packets.empty()) {
-    ShouldCreateOrBufferPacketForConnection(current_connection_id_);
-  }
+      buffered_packets_.DeliverPackets(current_connection_id_).buffered_packets;
+
   // Process CHLO at first.
   session->ProcessUdpPacket(current_server_address_, current_client_address_,
                             *current_packet_);
@@ -847,13 +887,15 @@ void QuicDispatcher::MaybeRejectStatelessly(QuicConnectionId connection_id,
       !FLAGS_quic_reloadable_flag_enable_quic_stateless_reject_support ||
       !ShouldAttemptCheapStatelessRejection()) {
     // Not use cheap stateless reject.
+    ChloAlpnExtractor alpn_extractor;
     if (FLAGS_quic_allow_chlo_buffering &&
         !ChloExtractor::Extract(*current_packet_, GetSupportedVersions(),
-                                nullptr)) {
+                                &alpn_extractor)) {
       // Buffer non-CHLO packets.
       ProcessUnauthenticatedHeaderFate(kFateBuffer, connection_id);
       return;
     }
+    current_alpn_ = alpn_extractor.ConsumeAlpn();
     ProcessUnauthenticatedHeaderFate(kFateProcess, connection_id);
     return;
   }
@@ -869,6 +911,7 @@ void QuicDispatcher::MaybeRejectStatelessly(QuicConnectionId connection_id,
     ProcessUnauthenticatedHeaderFate(kFateBuffer, connection_id);
     return;
   }
+  current_alpn_ = validator.ConsumeAlpn();
 
   if (!validator.can_accept()) {
     // This CHLO is prohibited by policy.
diff --git a/chromium/net/tools/quic/quic_dispatcher.h b/chromium/net/tools/quic/quic_dispatcher.h
index 877e602fac9..13bb50bbf95 100644
--- a/chromium/net/tools/quic/quic_dispatcher.h
+++ b/chromium/net/tools/quic/quic_dispatcher.h
@@ -9,7 +9,6 @@
 #define NET_TOOLS_QUIC_QUIC_DISPATCHER_H_
 
 #include <memory>
-#include <unordered_map>
 #include <vector>
 
 #include "base/macros.h"
@@ -96,7 +95,7 @@ class QuicDispatcher : public QuicTimeWaitListManager::Visitor,
   void OnConnectionAddedToTimeWaitList(QuicConnectionId connection_id) override;
 
   using SessionMap =
-      std::unordered_map<QuicConnectionId, std::unique_ptr<QuicSession>>;
+      QuicUnorderedMap<QuicConnectionId, std::unique_ptr<QuicSession>>;
 
   const SessionMap& session_map() const { return session_map_; }
 
@@ -162,7 +161,8 @@ class QuicDispatcher : public QuicTimeWaitListManager::Visitor,
  protected:
   virtual QuicSession* CreateQuicSession(
       QuicConnectionId connection_id,
-      const QuicSocketAddress& client_address) = 0;
+      const QuicSocketAddress& client_address,
+      QuicStringPiece alpn) = 0;
 
   // Called when a connection is rejected statelessly.
   virtual void OnConnectionRejectedStatelessly();
@@ -291,7 +291,7 @@ class QuicDispatcher : public QuicTimeWaitListManager::Visitor,
   friend class test::QuicDispatcherPeer;
   friend class StatelessRejectorProcessDoneCallback;
 
-  typedef std::unordered_set<QuicConnectionId> QuicConnectionIdSet;
+  typedef QuicUnorderedSet<QuicConnectionId> QuicConnectionIdSet;
 
   bool HandlePacketForTimeWait(const QuicPacketPublicHeader& header);
 
@@ -377,6 +377,8 @@ class QuicDispatcher : public QuicTimeWaitListManager::Visitor,
   QuicSocketAddress current_client_address_;
   QuicSocketAddress current_server_address_;
   const QuicReceivedPacket* current_packet_;
+  // If |current_packet_| is a CHLO packet, the extracted alpn.
+  std::string current_alpn_;
   QuicConnectionId current_connection_id_;
 
   // Used to get the supported versions based on flag. Does not own.
diff --git a/chromium/net/tools/quic/quic_dispatcher_test.cc b/chromium/net/tools/quic/quic_dispatcher_test.cc
index 6e9b8ec7417..6491ebfc7c1 100644
--- a/chromium/net/tools/quic/quic_dispatcher_test.cc
+++ b/chromium/net/tools/quic/quic_dispatcher_test.cc
@@ -10,6 +10,7 @@
 
 #include "base/macros.h"
 #include "net/quic/core/crypto/crypto_handshake.h"
+#include "net/quic/core/crypto/crypto_protocol.h"
 #include "net/quic/core/crypto/quic_crypto_server_config.h"
 #include "net/quic/core/crypto/quic_random.h"
 #include "net/quic/core/quic_crypto_stream.h"
@@ -131,9 +132,10 @@ class TestDispatcher : public QuicDispatcher {
             std::unique_ptr<QuicEpollAlarmFactory>(
                 new QuicEpollAlarmFactory(eps))) {}
 
-  MOCK_METHOD2(CreateQuicSession,
+  MOCK_METHOD3(CreateQuicSession,
                QuicServerSessionBase*(QuicConnectionId connection_id,
-                                      const QuicSocketAddress& client_address));
+                                      const QuicSocketAddress& client_address,
+                                      QuicStringPiece alpn));
 
   MOCK_METHOD1(ShouldCreateOrBufferPacketForConnection,
                bool(QuicConnectionId connection_id));
@@ -255,9 +257,8 @@ class QuicDispatcherTest : public QuicTest {
                      QuicPacketNumber packet_number) {
     QuicVersionVector versions(SupportedVersions(version));
     std::unique_ptr<QuicEncryptedPacket> packet(ConstructEncryptedPacket(
-        GetPeerInMemoryConnectionId(connection_id), has_version_flag, false,
-        packet_number, data, connection_id_length, packet_number_length,
-        &versions));
+        connection_id, has_version_flag, false, packet_number, data,
+        connection_id_length, packet_number_length, &versions));
     std::unique_ptr<QuicReceivedPacket> received_packet(
         ConstructReceivedPacket(*packet, helper_.GetClock()->Now()));
 
@@ -317,6 +318,7 @@ class QuicDispatcherTest : public QuicTest {
   string SerializeCHLO() {
     CryptoHandshakeMessage client_hello;
     client_hello.set_tag(kCHLO);
+    client_hello.SetStringPiece(kALPN, "hq");
     return client_hello.GetSerialized(Perspective::IS_CLIENT)
         .AsStringPiece()
         .as_string();
@@ -343,7 +345,8 @@ TEST_F(QuicDispatcherTest, ProcessPackets) {
   QuicSocketAddress client_address(QuicIpAddress::Loopback4(), 1);
   server_address_ = QuicSocketAddress(QuicIpAddress::Any4(), 5);
 
-  EXPECT_CALL(*dispatcher_, CreateQuicSession(1, client_address))
+  EXPECT_CALL(*dispatcher_,
+              CreateQuicSession(1, client_address, QuicStringPiece("hq")))
       .WillOnce(testing::Return(CreateSession(
           dispatcher_.get(), config_, 1, client_address, &mock_helper_,
           &mock_alarm_factory_, &crypto_config_,
@@ -352,11 +355,13 @@ TEST_F(QuicDispatcherTest, ProcessPackets) {
               ProcessUdpPacket(_, _, _))
       .WillOnce(testing::WithArgs<2>(Invoke(CreateFunctor(
           &QuicDispatcherTest::ValidatePacket, base::Unretained(this), 1))));
+  EXPECT_CALL(*dispatcher_, ShouldCreateOrBufferPacketForConnection(1));
   ProcessPacket(client_address, 1, true, SerializeCHLO());
   EXPECT_EQ(client_address, dispatcher_->current_client_address());
   EXPECT_EQ(server_address_, dispatcher_->current_server_address());
 
-  EXPECT_CALL(*dispatcher_, CreateQuicSession(2, client_address))
+  EXPECT_CALL(*dispatcher_,
+              CreateQuicSession(2, client_address, QuicStringPiece("hq")))
       .WillOnce(testing::Return(CreateSession(
           dispatcher_.get(), config_, 2, client_address, &mock_helper_,
           &mock_alarm_factory_, &crypto_config_,
@@ -365,6 +370,7 @@ TEST_F(QuicDispatcherTest, ProcessPackets) {
               ProcessUdpPacket(_, _, _))
       .WillOnce(testing::WithArgs<2>(Invoke(CreateFunctor(
           &QuicDispatcherTest::ValidatePacket, base::Unretained(this), 2))));
+  EXPECT_CALL(*dispatcher_, ShouldCreateOrBufferPacketForConnection(2));
   ProcessPacket(client_address, 2, true, SerializeCHLO());
 
   EXPECT_CALL(*reinterpret_cast<MockQuicConnection*>(session1_->connection()),
@@ -379,7 +385,9 @@ TEST_F(QuicDispatcherTest, StatelessVersionNegotiation) {
   QuicSocketAddress client_address(QuicIpAddress::Loopback4(), 1);
   server_address_ = QuicSocketAddress(QuicIpAddress::Any4(), 5);
 
-  EXPECT_CALL(*dispatcher_, CreateQuicSession(1, client_address)).Times(0);
+  EXPECT_CALL(*dispatcher_,
+              CreateQuicSession(1, client_address, QuicStringPiece("hq")))
+      .Times(0);
   QuicVersion version = static_cast<QuicVersion>(QuicVersionMin() - 1);
   ProcessPacket(client_address, 1, true, version, SerializeCHLO(),
                 PACKET_8BYTE_CONNECTION_ID, PACKET_6BYTE_PACKET_NUMBER, 1);
@@ -388,7 +396,8 @@ TEST_F(QuicDispatcherTest, StatelessVersionNegotiation) {
 TEST_F(QuicDispatcherTest, Shutdown) {
   QuicSocketAddress client_address(QuicIpAddress::Loopback4(), 1);
 
-  EXPECT_CALL(*dispatcher_, CreateQuicSession(_, client_address))
+  EXPECT_CALL(*dispatcher_,
+              CreateQuicSession(_, client_address, QuicStringPiece("hq")))
       .WillOnce(testing::Return(CreateSession(
           dispatcher_.get(), config_, 1, client_address, &mock_helper_,
           &mock_alarm_factory_, &crypto_config_,
@@ -398,6 +407,7 @@ TEST_F(QuicDispatcherTest, Shutdown) {
       .WillOnce(testing::WithArgs<2>(Invoke(CreateFunctor(
           &QuicDispatcherTest::ValidatePacket, base::Unretained(this), 1))));
 
+  EXPECT_CALL(*dispatcher_, ShouldCreateOrBufferPacketForConnection(1));
   ProcessPacket(client_address, 1, true, SerializeCHLO());
 
   EXPECT_CALL(*reinterpret_cast<MockQuicConnection*>(session1_->connection()),
@@ -412,7 +422,8 @@ TEST_F(QuicDispatcherTest, TimeWaitListManager) {
   // Create a new session.
   QuicSocketAddress client_address(QuicIpAddress::Loopback4(), 1);
   QuicConnectionId connection_id = 1;
-  EXPECT_CALL(*dispatcher_, CreateQuicSession(connection_id, client_address))
+  EXPECT_CALL(*dispatcher_, CreateQuicSession(connection_id, client_address,
+                                              QuicStringPiece("hq")))
       .WillOnce(testing::Return(CreateSession(
           dispatcher_.get(), config_, connection_id, client_address,
           &mock_helper_, &mock_alarm_factory_, &crypto_config_,
@@ -422,6 +433,7 @@ TEST_F(QuicDispatcherTest, TimeWaitListManager) {
       .WillOnce(testing::WithArgs<2>(Invoke(CreateFunctor(
           &QuicDispatcherTest::ValidatePacket, base::Unretained(this), 1))));
 
+  EXPECT_CALL(*dispatcher_, ShouldCreateOrBufferPacketForConnection(1));
   ProcessPacket(client_address, connection_id, true, SerializeCHLO());
 
   // Close the connection by sending public reset packet.
@@ -464,7 +476,8 @@ TEST_F(QuicDispatcherTest, NoVersionPacketToTimeWaitListManager) {
   QuicConnectionId connection_id = 1;
   // Dispatcher forwards all packets for this connection_id to the time wait
   // list manager.
-  EXPECT_CALL(*dispatcher_, CreateQuicSession(_, _)).Times(0);
+  EXPECT_CALL(*dispatcher_, CreateQuicSession(_, _, QuicStringPiece("hq")))
+      .Times(0);
   EXPECT_CALL(*time_wait_list_manager_, ProcessPacket(_, _, connection_id))
       .Times(1);
   EXPECT_CALL(*time_wait_list_manager_, AddConnectionIdToTimeWait(_, _, _, _))
@@ -479,7 +492,9 @@ TEST_F(QuicDispatcherTest, ProcessPacketWithZeroPort) {
   server_address_ = QuicSocketAddress(QuicIpAddress::Any4(), 5);
 
   // dispatcher_ should drop this packet.
-  EXPECT_CALL(*dispatcher_, CreateQuicSession(1, client_address)).Times(0);
+  EXPECT_CALL(*dispatcher_,
+              CreateQuicSession(1, client_address, QuicStringPiece("hq")))
+      .Times(0);
   EXPECT_CALL(*time_wait_list_manager_, ProcessPacket(_, _, _)).Times(0);
   EXPECT_CALL(*time_wait_list_manager_, AddConnectionIdToTimeWait(_, _, _, _))
       .Times(0);
@@ -491,7 +506,8 @@ TEST_F(QuicDispatcherTest, OKSeqNoPacketProcessed) {
   QuicConnectionId connection_id = 1;
   server_address_ = QuicSocketAddress(QuicIpAddress::Any4(), 5);
 
-  EXPECT_CALL(*dispatcher_, CreateQuicSession(1, client_address))
+  EXPECT_CALL(*dispatcher_,
+              CreateQuicSession(1, client_address, QuicStringPiece("hq")))
       .WillOnce(testing::Return(CreateSession(
           dispatcher_.get(), config_, 1, client_address, &mock_helper_,
           &mock_alarm_factory_, &crypto_config_,
@@ -502,6 +518,8 @@ TEST_F(QuicDispatcherTest, OKSeqNoPacketProcessed) {
           &QuicDispatcherTest::ValidatePacket, base::Unretained(this), 1))));
   // A packet whose packet number is the largest that is allowed to start a
   // connection.
+  EXPECT_CALL(*dispatcher_,
+              ShouldCreateOrBufferPacketForConnection(connection_id));
   ProcessPacket(client_address, connection_id, true, SerializeCHLO(),
                 PACKET_8BYTE_CONNECTION_ID, PACKET_6BYTE_PACKET_NUMBER,
                 QuicDispatcher::kMaxReasonableInitialPacketNumber);
@@ -516,7 +534,8 @@ TEST_F(QuicDispatcherTest, TooBigSeqNoPacketToTimeWaitListManager) {
   QuicConnectionId connection_id = 1;
   // Dispatcher forwards this packet for this connection_id to the time wait
   // list manager.
-  EXPECT_CALL(*dispatcher_, CreateQuicSession(_, _)).Times(0);
+  EXPECT_CALL(*dispatcher_, CreateQuicSession(_, _, QuicStringPiece("hq")))
+      .Times(0);
   EXPECT_CALL(*time_wait_list_manager_, ProcessPacket(_, _, connection_id))
       .Times(1);
   EXPECT_CALL(*time_wait_list_manager_, AddConnectionIdToTimeWait(_, _, _, _))
@@ -538,13 +557,15 @@ TEST_F(QuicDispatcherTest, SupportedVersionsChangeInFlight) {
   server_address_ = QuicSocketAddress(QuicIpAddress::Any4(), 5);
   QuicConnectionId connection_id = 1;
 
-  EXPECT_CALL(*dispatcher_, CreateQuicSession(connection_id, client_address))
+  EXPECT_CALL(*dispatcher_, CreateQuicSession(connection_id, client_address,
+                                              QuicStringPiece("hq")))
       .Times(0);
   ProcessPacket(client_address, connection_id, true,
                 static_cast<QuicVersion>(QuicVersionMin() - 1), SerializeCHLO(),
                 PACKET_8BYTE_CONNECTION_ID, PACKET_6BYTE_PACKET_NUMBER, 1);
   ++connection_id;
-  EXPECT_CALL(*dispatcher_, CreateQuicSession(connection_id, client_address))
+  EXPECT_CALL(*dispatcher_, CreateQuicSession(connection_id, client_address,
+                                              QuicStringPiece("hq")))
       .WillOnce(testing::Return(CreateSession(
           dispatcher_.get(), config_, connection_id, client_address,
           &mock_helper_, &mock_alarm_factory_, &crypto_config_,
@@ -554,11 +575,14 @@ TEST_F(QuicDispatcherTest, SupportedVersionsChangeInFlight) {
       .WillOnce(testing::WithArgs<2>(
           Invoke(CreateFunctor(&QuicDispatcherTest::ValidatePacket,
                                base::Unretained(this), connection_id))));
+  EXPECT_CALL(*dispatcher_,
+              ShouldCreateOrBufferPacketForConnection(connection_id));
   ProcessPacket(client_address, connection_id, true, QuicVersionMin(),
                 SerializeCHLO(), PACKET_8BYTE_CONNECTION_ID,
                 PACKET_6BYTE_PACKET_NUMBER, 1);
   ++connection_id;
-  EXPECT_CALL(*dispatcher_, CreateQuicSession(connection_id, client_address))
+  EXPECT_CALL(*dispatcher_, CreateQuicSession(connection_id, client_address,
+                                              QuicStringPiece("hq")))
       .WillOnce(testing::Return(CreateSession(
           dispatcher_.get(), config_, connection_id, client_address,
           &mock_helper_, &mock_alarm_factory_, &crypto_config_,
@@ -568,13 +592,16 @@ TEST_F(QuicDispatcherTest, SupportedVersionsChangeInFlight) {
       .WillOnce(testing::WithArgs<2>(
           Invoke(CreateFunctor(&QuicDispatcherTest::ValidatePacket,
                                base::Unretained(this), connection_id))));
+  EXPECT_CALL(*dispatcher_,
+              ShouldCreateOrBufferPacketForConnection(connection_id));
   ProcessPacket(client_address, connection_id, true, QuicVersionMax(),
                 SerializeCHLO(), PACKET_8BYTE_CONNECTION_ID,
                 PACKET_6BYTE_PACKET_NUMBER, 1);
   // Turn off version 40.
   SetQuicFlag(&FLAGS_quic_enable_version_40, false);
   ++connection_id;
-  EXPECT_CALL(*dispatcher_, CreateQuicSession(connection_id, client_address))
+  EXPECT_CALL(*dispatcher_, CreateQuicSession(connection_id, client_address,
+                                              QuicStringPiece("hq")))
       .Times(0);
   ProcessPacket(client_address, connection_id, true, QUIC_VERSION_40,
                 SerializeCHLO(), PACKET_8BYTE_CONNECTION_ID,
@@ -583,7 +610,8 @@ TEST_F(QuicDispatcherTest, SupportedVersionsChangeInFlight) {
   // Turn on version 40.
   SetQuicFlag(&FLAGS_quic_enable_version_40, true);
   ++connection_id;
-  EXPECT_CALL(*dispatcher_, CreateQuicSession(connection_id, client_address))
+  EXPECT_CALL(*dispatcher_, CreateQuicSession(connection_id, client_address,
+                                              QuicStringPiece("hq")))
       .WillOnce(testing::Return(CreateSession(
           dispatcher_.get(), config_, connection_id, client_address,
           &mock_helper_, &mock_alarm_factory_, &crypto_config_,
@@ -593,6 +621,8 @@ TEST_F(QuicDispatcherTest, SupportedVersionsChangeInFlight) {
       .WillOnce(testing::WithArgs<2>(
           Invoke(CreateFunctor(&QuicDispatcherTest::ValidatePacket,
                                base::Unretained(this), connection_id))));
+  EXPECT_CALL(*dispatcher_,
+              ShouldCreateOrBufferPacketForConnection(connection_id));
   ProcessPacket(client_address, connection_id, true, QUIC_VERSION_40,
                 SerializeCHLO(), PACKET_8BYTE_CONNECTION_ID,
                 PACKET_6BYTE_PACKET_NUMBER, 1);
@@ -600,7 +630,8 @@ TEST_F(QuicDispatcherTest, SupportedVersionsChangeInFlight) {
   // Turn off version 39.
   FLAGS_quic_reloadable_flag_quic_enable_version_39 = false;
   ++connection_id;
-  EXPECT_CALL(*dispatcher_, CreateQuicSession(connection_id, client_address))
+  EXPECT_CALL(*dispatcher_, CreateQuicSession(connection_id, client_address,
+                                              QuicStringPiece("hq")))
       .Times(0);
   ProcessPacket(client_address, connection_id, true, QUIC_VERSION_39,
                 SerializeCHLO(), PACKET_8BYTE_CONNECTION_ID,
@@ -609,7 +640,8 @@ TEST_F(QuicDispatcherTest, SupportedVersionsChangeInFlight) {
   // Turn on version 39.
   FLAGS_quic_reloadable_flag_quic_enable_version_39 = true;
   ++connection_id;
-  EXPECT_CALL(*dispatcher_, CreateQuicSession(connection_id, client_address))
+  EXPECT_CALL(*dispatcher_, CreateQuicSession(connection_id, client_address,
+                                              QuicStringPiece("hq")))
       .WillOnce(testing::Return(CreateSession(
           dispatcher_.get(), config_, connection_id, client_address,
           &mock_helper_, &mock_alarm_factory_, &crypto_config_,
@@ -619,6 +651,8 @@ TEST_F(QuicDispatcherTest, SupportedVersionsChangeInFlight) {
       .WillOnce(testing::WithArgs<2>(
           Invoke(CreateFunctor(&QuicDispatcherTest::ValidatePacket,
                                base::Unretained(this), connection_id))));
+  EXPECT_CALL(*dispatcher_,
+              ShouldCreateOrBufferPacketForConnection(connection_id));
   ProcessPacket(client_address, connection_id, true, QUIC_VERSION_39,
                 SerializeCHLO(), PACKET_8BYTE_CONNECTION_ID,
                 PACKET_6BYTE_PACKET_NUMBER, 1);
@@ -636,12 +670,17 @@ class MockQuicCryptoServerStream : public QuicCryptoServerStream {
             compressed_certs_cache,
             FLAGS_quic_reloadable_flag_enable_quic_stateless_reject_support,
             session,
-            helper) {}
+            helper),
+        handshake_confirmed_(false) {}
+
   void set_handshake_confirmed_for_testing(bool handshake_confirmed) {
     handshake_confirmed_ = handshake_confirmed;
   }
 
+  bool handshake_confirmed() const override { return handshake_confirmed_; }
+
  private:
+  bool handshake_confirmed_;
   DISALLOW_COPY_AND_ASSIGN(MockQuicCryptoServerStream);
 };
 
@@ -659,7 +698,7 @@ struct StatelessRejectTestParams {
        << p.enable_stateless_rejects_via_flag << std::endl;
     os << " client_supports_statelesss_rejects: "
        << p.client_supports_statelesss_rejects << std::endl;
-    os << "  crypto_handshake_successful: " << p.crypto_handshake_successful
+    os << " crypto_handshake_successful: " << p.crypto_handshake_successful
        << " }";
     return os;
   }
@@ -752,7 +791,8 @@ TEST_P(QuicDispatcherStatelessRejectTest, ParameterizedBasicTest) {
 
   QuicSocketAddress client_address(QuicIpAddress::Loopback4(), 1);
   QuicConnectionId connection_id = 1;
-  EXPECT_CALL(*dispatcher_, CreateQuicSession(connection_id, client_address))
+  EXPECT_CALL(*dispatcher_, CreateQuicSession(connection_id, client_address,
+                                              QuicStringPiece("hq")))
       .WillOnce(testing::Return(
           CreateSessionBasedOnTestParams(connection_id, client_address)));
   EXPECT_CALL(*reinterpret_cast<MockQuicConnection*>(session1_->connection()),
@@ -760,9 +800,15 @@ TEST_P(QuicDispatcherStatelessRejectTest, ParameterizedBasicTest) {
       .WillOnce(testing::WithArgs<2>(
           Invoke(CreateFunctor(&QuicDispatcherTest::ValidatePacket,
                                base::Unretained(this), connection_id))));
+  EXPECT_CALL(*dispatcher_,
+              ShouldCreateOrBufferPacketForConnection(connection_id))
+      .Times(1);
+
   // Process the first packet for the connection.
   ProcessPacket(client_address, connection_id, true, SerializeCHLO());
   if (ExpectStatelessReject()) {
+    EXPECT_CALL(*reinterpret_cast<MockQuicConnection*>(session1_->connection()),
+                CloseConnection(QUIC_CRYPTO_HANDSHAKE_STATELESS_REJECT, _, _));
     // If this is a stateless reject, the crypto stream will close the
     // connection.
     session1_->connection()->CloseConnection(
@@ -797,10 +843,12 @@ TEST_P(QuicDispatcherStatelessRejectTest, CheapRejects) {
   QuicSocketAddress client_address(QuicIpAddress::Loopback4(), 1);
   QuicConnectionId connection_id = 1;
   if (GetParam().enable_stateless_rejects_via_flag) {
-    EXPECT_CALL(*dispatcher_, CreateQuicSession(connection_id, client_address))
+    EXPECT_CALL(*dispatcher_,
+                CreateQuicSession(connection_id, client_address, _))
         .Times(0);
   } else {
-    EXPECT_CALL(*dispatcher_, CreateQuicSession(connection_id, client_address))
+    EXPECT_CALL(*dispatcher_, CreateQuicSession(connection_id, client_address,
+                                                QuicStringPiece("h2")))
         .WillOnce(testing::Return(
             CreateSessionBasedOnTestParams(connection_id, client_address)));
     EXPECT_CALL(*reinterpret_cast<MockQuicConnection*>(session1_->connection()),
@@ -817,9 +865,18 @@ TEST_P(QuicDispatcherStatelessRejectTest, CheapRejects) {
                                      {"KEXS", "C255"},
                                      {"COPT", "SREJ"},
                                      {"NONC", "1234567890123456789012"},
+                                     {"ALPN", "h2"},
                                      {"VER\0", "Q025"}},
                                     kClientHelloMinimumSize);
 
+  if (GetParam().enable_stateless_rejects_via_flag) {
+    EXPECT_CALL(*time_wait_list_manager_, ProcessPacket(_, _, connection_id))
+        .Times(1);
+  } else {
+    EXPECT_CALL(*dispatcher_,
+                ShouldCreateOrBufferPacketForConnection(connection_id))
+        .Times(1);
+  }
   ProcessPacket(client_address, connection_id, true,
                 client_hello.GetSerialized(Perspective::IS_CLIENT)
                     .AsStringPiece()
@@ -838,40 +895,45 @@ TEST_P(QuicDispatcherStatelessRejectTest, BufferNonChlo) {
   const QuicSocketAddress client_address(QuicIpAddress::Loopback4(), 1);
   const QuicConnectionId connection_id = 1;
 
+  EXPECT_CALL(*dispatcher_,
+              ShouldCreateOrBufferPacketForConnection(connection_id))
+      .Times(1);
   ProcessPacket(client_address, connection_id, true, "NOT DATA FOR A CHLO");
 
   // Process the first packet for the connection.
-    CryptoHandshakeMessage client_hello =
-        crypto_test_utils::CreateCHLO({{"AEAD", "AESG"},
-                                       {"KEXS", "C255"},
-                                       {"NONC", "1234567890123456789012"},
-                                       {"VER\0", "Q025"}},
-                                      kClientHelloMinimumSize);
-
-    // If stateless rejects are enabled then a connection will be created now
-    // and the buffered packet will be processed
-    EXPECT_CALL(*dispatcher_, CreateQuicSession(connection_id, client_address))
-        .WillOnce(testing::Return(
-            CreateSessionBasedOnTestParams(connection_id, client_address)));
-    EXPECT_CALL(*reinterpret_cast<MockQuicConnection*>(session1_->connection()),
-                ProcessUdpPacket(_, client_address, _))
-        .WillOnce(testing::WithArg<2>(
-            Invoke(CreateFunctor(&QuicDispatcherTest::ValidatePacket,
-                                 base::Unretained(this), connection_id))));
-    // Expect both packets to be passed to ProcessUdpPacket(). And one of them
-    // is already expected in CreateSessionBasedOnTestParams().
-    EXPECT_CALL(*reinterpret_cast<MockQuicConnection*>(session1_->connection()),
-                ProcessUdpPacket(_, client_address, _))
-        .WillOnce(testing::WithArg<2>(
-            Invoke(CreateFunctor(&QuicDispatcherTest::ValidatePacket,
-                                 base::Unretained(this), connection_id))))
-        .RetiresOnSaturation();
-    ProcessPacket(client_address, connection_id, true,
-                  client_hello.GetSerialized(Perspective::IS_CLIENT)
-                      .AsStringPiece()
-                      .as_string());
-    EXPECT_FALSE(
-        time_wait_list_manager_->IsConnectionIdInTimeWait(connection_id));
+  CryptoHandshakeMessage client_hello =
+      crypto_test_utils::CreateCHLO({{"AEAD", "AESG"},
+                                     {"KEXS", "C255"},
+                                     {"NONC", "1234567890123456789012"},
+                                     {"ALPN", "h3"},
+                                     {"VER\0", "Q025"}},
+                                    kClientHelloMinimumSize);
+
+  // If stateless rejects are enabled then a connection will be created now
+  // and the buffered packet will be processed
+  EXPECT_CALL(*dispatcher_, CreateQuicSession(connection_id, client_address,
+                                              QuicStringPiece("h3")))
+      .WillOnce(testing::Return(
+          CreateSessionBasedOnTestParams(connection_id, client_address)));
+  EXPECT_CALL(*reinterpret_cast<MockQuicConnection*>(session1_->connection()),
+              ProcessUdpPacket(_, client_address, _))
+      .WillOnce(testing::WithArg<2>(
+          Invoke(CreateFunctor(&QuicDispatcherTest::ValidatePacket,
+                               base::Unretained(this), connection_id))));
+  // Expect both packets to be passed to ProcessUdpPacket(). And one of them
+  // is already expected in CreateSessionBasedOnTestParams().
+  EXPECT_CALL(*reinterpret_cast<MockQuicConnection*>(session1_->connection()),
+              ProcessUdpPacket(_, client_address, _))
+      .WillOnce(testing::WithArg<2>(
+          Invoke(CreateFunctor(&QuicDispatcherTest::ValidatePacket,
+                               base::Unretained(this), connection_id))))
+      .RetiresOnSaturation();
+  ProcessPacket(client_address, connection_id, true,
+                client_hello.GetSerialized(Perspective::IS_CLIENT)
+                    .AsStringPiece()
+                    .as_string());
+  EXPECT_FALSE(
+      time_wait_list_manager_->IsConnectionIdInTimeWait(connection_id));
 }
 
 // Verify the stopgap test: Packets with truncated connection IDs should be
@@ -886,7 +948,8 @@ TEST_F(QuicDispatcherTestStrayPacketConnectionId,
   QuicSocketAddress client_address(QuicIpAddress::Loopback4(), 1);
   QuicConnectionId connection_id = 1;
   // Dispatcher drops this packet.
-  EXPECT_CALL(*dispatcher_, CreateQuicSession(_, _)).Times(0);
+  EXPECT_CALL(*dispatcher_, CreateQuicSession(_, _, QuicStringPiece("hq")))
+      .Times(0);
   EXPECT_CALL(*time_wait_list_manager_, ProcessPacket(_, _, connection_id))
       .Times(0);
   EXPECT_CALL(*time_wait_list_manager_, AddConnectionIdToTimeWait(_, _, _, _))
@@ -926,7 +989,8 @@ class QuicDispatcherWriteBlockedListTest : public QuicDispatcherTest {
 
     QuicSocketAddress client_address(QuicIpAddress::Loopback4(), 1);
 
-    EXPECT_CALL(*dispatcher_, CreateQuicSession(_, client_address))
+    EXPECT_CALL(*dispatcher_,
+                CreateQuicSession(_, client_address, QuicStringPiece("hq")))
         .WillOnce(testing::Return(CreateSession(
             dispatcher_.get(), config_, 1, client_address, &helper_,
             &alarm_factory_, &crypto_config_,
@@ -935,9 +999,11 @@ class QuicDispatcherWriteBlockedListTest : public QuicDispatcherTest {
                 ProcessUdpPacket(_, _, _))
         .WillOnce(testing::WithArgs<2>(Invoke(CreateFunctor(
             &QuicDispatcherTest::ValidatePacket, base::Unretained(this), 1))));
+    EXPECT_CALL(*dispatcher_, ShouldCreateOrBufferPacketForConnection(1));
     ProcessPacket(client_address, 1, true, SerializeCHLO());
 
-    EXPECT_CALL(*dispatcher_, CreateQuicSession(_, client_address))
+    EXPECT_CALL(*dispatcher_,
+                CreateQuicSession(_, client_address, QuicStringPiece("hq")))
         .WillOnce(testing::Return(CreateSession(
             dispatcher_.get(), config_, 2, client_address, &helper_,
             &alarm_factory_, &crypto_config_,
@@ -946,6 +1012,7 @@ class QuicDispatcherWriteBlockedListTest : public QuicDispatcherTest {
                 ProcessUdpPacket(_, _, _))
         .WillOnce(testing::WithArgs<2>(Invoke(CreateFunctor(
             &QuicDispatcherTest::ValidatePacket, base::Unretained(this), 2))));
+    EXPECT_CALL(*dispatcher_, ShouldCreateOrBufferPacketForConnection(2));
     ProcessPacket(client_address, 2, true, SerializeCHLO());
 
     blocked_list_ = QuicDispatcherPeer::GetWriteBlockedList(dispatcher_.get());
@@ -1208,7 +1275,8 @@ TEST_P(BufferedPacketStoreTest, ProcessNonChloPacketsUptoLimitAndProcessChlo) {
   data_connection_map_[conn_id].pop_back();
   // When CHLO arrives, a new session should be created, and all packets
   // buffered should be delivered to the session.
-  EXPECT_CALL(*dispatcher_, CreateQuicSession(conn_id, client_address))
+  EXPECT_CALL(*dispatcher_,
+              CreateQuicSession(conn_id, client_address, QuicStringPiece()))
       .WillOnce(testing::Return(CreateSession(
           dispatcher_.get(), config_, conn_id, client_address, &mock_helper_,
           &mock_alarm_factory_, &crypto_config_,
@@ -1238,18 +1306,7 @@ TEST_P(BufferedPacketStoreTest,
   for (size_t i = 1; i <= kNumConnections; ++i) {
     QuicSocketAddress client_address(QuicIpAddress::Loopback4(), i);
     QuicConnectionId conn_id = i;
-    if (FLAGS_quic_reloadable_flag_quic_create_session_after_insertion) {
-      EXPECT_CALL(*dispatcher_,
-                  ShouldCreateOrBufferPacketForConnection(conn_id));
-    } else {
-      if (i <= kNumConnections - 1) {
-        // As they are on different connection, they should trigger
-        // ShouldCreateOrBufferPacketForConnection(). The last packet should be
-        // dropped.
-        EXPECT_CALL(*dispatcher_,
-                    ShouldCreateOrBufferPacketForConnection(conn_id));
-      }
-    }
+    EXPECT_CALL(*dispatcher_, ShouldCreateOrBufferPacketForConnection(conn_id));
     ProcessPacket(client_address, conn_id, true,
                   QuicStrCat("data packet on connection ", i),
                   PACKET_8BYTE_CONNECTION_ID, PACKET_6BYTE_PACKET_NUMBER,
@@ -1268,26 +1325,16 @@ TEST_P(BufferedPacketStoreTest,
   for (size_t i = 1; i <= kNumConnections; ++i) {
     QuicSocketAddress client_address(QuicIpAddress::Loopback4(), i);
     QuicConnectionId conn_id = i;
-    if (FLAGS_quic_reloadable_flag_quic_create_session_after_insertion &&
-        conn_id == kNumConnections) {
-      // The last CHLO should trigger ShouldCreateOrBufferPacketForConnection()
-      // since it's the
-      // first packet arrives on that connection.
+    if (conn_id == kNumConnections) {
       EXPECT_CALL(*dispatcher_,
                   ShouldCreateOrBufferPacketForConnection(conn_id));
     }
-    EXPECT_CALL(*dispatcher_, CreateQuicSession(conn_id, client_address))
+    EXPECT_CALL(*dispatcher_,
+                CreateQuicSession(conn_id, client_address, QuicStringPiece()))
         .WillOnce(testing::Return(CreateSession(
             dispatcher_.get(), config_, conn_id, client_address, &mock_helper_,
             &mock_alarm_factory_, &crypto_config_,
             QuicDispatcherPeer::GetCache(dispatcher_.get()), &session1_)));
-    if (!FLAGS_quic_reloadable_flag_quic_create_session_after_insertion &&
-        conn_id == kNumConnections) {
-      // The last CHLO should trigger ShouldCreateOrBufferPacketForConnection()
-      // since it's the first packet arrives on that connection.
-      EXPECT_CALL(*dispatcher_,
-                  ShouldCreateOrBufferPacketForConnection(conn_id));
-    }
     // First |kNumConnections| - 1 connections should have buffered
     // a packet in store. The rest should have been dropped.
     size_t upper_limit =
@@ -1310,7 +1357,8 @@ TEST_P(BufferedPacketStoreTest, DeliverEmptyPackets) {
   QuicConnectionId conn_id = 1;
   QuicSocketAddress client_address(QuicIpAddress::Loopback4(), 1);
   EXPECT_CALL(*dispatcher_, ShouldCreateOrBufferPacketForConnection(conn_id));
-  EXPECT_CALL(*dispatcher_, CreateQuicSession(conn_id, client_address))
+  EXPECT_CALL(*dispatcher_,
+              CreateQuicSession(conn_id, client_address, QuicStringPiece()))
       .WillOnce(testing::Return(CreateSession(
           dispatcher_.get(), config_, conn_id, client_address, &mock_helper_,
           &mock_alarm_factory_, &crypto_config_,
@@ -1331,7 +1379,8 @@ TEST_P(BufferedPacketStoreTest, ReceiveRetransmittedCHLO) {
 
   // When CHLO arrives, a new session should be created, and all packets
   // buffered should be delivered to the session.
-  EXPECT_CALL(*dispatcher_, CreateQuicSession(conn_id, client_address))
+  EXPECT_CALL(*dispatcher_,
+              CreateQuicSession(conn_id, client_address, QuicStringPiece()))
       .Times(1)  // Only triggered by 1st CHLO.
       .WillOnce(testing::Return(CreateSession(
           dispatcher_.get(), config_, conn_id, client_address, &mock_helper_,
@@ -1388,19 +1437,10 @@ TEST_P(BufferedPacketStoreTest, ProcessCHLOsUptoLimitAndBufferTheRest) {
   const size_t kNumCHLOs =
       kMaxNumSessionsToCreate + kDefaultMaxConnectionsInStore + 1;
   for (size_t conn_id = 1; conn_id <= kNumCHLOs; ++conn_id) {
-    if (FLAGS_quic_reloadable_flag_quic_create_session_after_insertion) {
-      EXPECT_CALL(*dispatcher_,
-                  ShouldCreateOrBufferPacketForConnection(conn_id));
-    }
-    if (!FLAGS_quic_reloadable_flag_quic_create_session_after_insertion &&
-        conn_id < kNumCHLOs) {
-      // Except the last connection, all connections for previous CHLOs should
-      // be regarded as newly added.
-      EXPECT_CALL(*dispatcher_,
-                  ShouldCreateOrBufferPacketForConnection(conn_id));
-    }
+    EXPECT_CALL(*dispatcher_, ShouldCreateOrBufferPacketForConnection(conn_id));
     if (conn_id <= kMaxNumSessionsToCreate) {
-      EXPECT_CALL(*dispatcher_, CreateQuicSession(conn_id, client_addr_))
+      EXPECT_CALL(*dispatcher_,
+                  CreateQuicSession(conn_id, client_addr_, QuicStringPiece()))
           .WillOnce(testing::Return(CreateSession(
               dispatcher_.get(), config_, conn_id, client_addr_, &mock_helper_,
               &mock_alarm_factory_, &crypto_config_,
@@ -1429,7 +1469,8 @@ TEST_P(BufferedPacketStoreTest, ProcessCHLOsUptoLimitAndBufferTheRest) {
   for (size_t conn_id = kMaxNumSessionsToCreate + 1;
        conn_id <= kMaxNumSessionsToCreate + kDefaultMaxConnectionsInStore;
        ++conn_id) {
-    EXPECT_CALL(*dispatcher_, CreateQuicSession(conn_id, client_addr_))
+    EXPECT_CALL(*dispatcher_,
+                CreateQuicSession(conn_id, client_addr_, QuicStringPiece()))
         .WillOnce(testing::Return(CreateSession(
             dispatcher_.get(), config_, conn_id, client_addr_, &mock_helper_,
             &mock_alarm_factory_, &crypto_config_,
@@ -1440,7 +1481,8 @@ TEST_P(BufferedPacketStoreTest, ProcessCHLOsUptoLimitAndBufferTheRest) {
             Invoke(CreateFunctor(&QuicDispatcherTest::ValidatePacket,
                                  base::Unretained(this), conn_id))));
   }
-  EXPECT_CALL(*dispatcher_, CreateQuicSession(kNumCHLOs, client_addr_))
+  EXPECT_CALL(*dispatcher_,
+              CreateQuicSession(kNumCHLOs, client_addr_, QuicStringPiece()))
       .Times(0);
 
   while (store->HasChlosBuffered()) {
@@ -1459,7 +1501,8 @@ TEST_P(BufferedPacketStoreTest, BufferDuplicatedCHLO) {
        ++conn_id) {
     // Last CHLO will be buffered. Others will create connection right away.
     if (conn_id <= kMaxNumSessionsToCreate) {
-      EXPECT_CALL(*dispatcher_, CreateQuicSession(conn_id, client_addr_))
+      EXPECT_CALL(*dispatcher_,
+                  CreateQuicSession(conn_id, client_addr_, QuicStringPiece()))
           .WillOnce(testing::Return(CreateSession(
               dispatcher_.get(), config_, conn_id, client_addr_, &mock_helper_,
               &mock_alarm_factory_, &crypto_config_,
@@ -1480,7 +1523,8 @@ TEST_P(BufferedPacketStoreTest, BufferDuplicatedCHLO) {
   size_t packets_buffered = 2;
 
   // Reset counter and process buffered CHLO.
-  EXPECT_CALL(*dispatcher_, CreateQuicSession(last_connection, client_addr_))
+  EXPECT_CALL(*dispatcher_, CreateQuicSession(last_connection, client_addr_,
+                                              QuicStringPiece()))
       .WillOnce(testing::Return(CreateSession(
           dispatcher_.get(), config_, last_connection, client_addr_,
           &mock_helper_, &mock_alarm_factory_, &crypto_config_,
@@ -1501,7 +1545,8 @@ TEST_P(BufferedPacketStoreTest, BufferNonChloPacketsUptoLimitWithChloBuffered) {
   for (QuicConnectionId conn_id = 1; conn_id <= last_connection_id; ++conn_id) {
     // Last CHLO will be buffered. Others will create connection right away.
     if (conn_id <= kMaxNumSessionsToCreate) {
-      EXPECT_CALL(*dispatcher_, CreateQuicSession(conn_id, client_addr_))
+      EXPECT_CALL(*dispatcher_,
+                  CreateQuicSession(conn_id, client_addr_, QuicStringPiece()))
           .WillOnce(testing::Return(CreateSession(
               dispatcher_.get(), config_, conn_id, client_addr_, &mock_helper_,
               &mock_alarm_factory_, &crypto_config_,
@@ -1524,7 +1569,8 @@ TEST_P(BufferedPacketStoreTest, BufferNonChloPacketsUptoLimitWithChloBuffered) {
   }
 
   // Reset counter and process buffered CHLO.
-  EXPECT_CALL(*dispatcher_, CreateQuicSession(last_connection_id, client_addr_))
+  EXPECT_CALL(*dispatcher_, CreateQuicSession(last_connection_id, client_addr_,
+                                              QuicStringPiece()))
       .WillOnce(testing::Return(CreateSession(
           dispatcher_.get(), config_, last_connection_id, client_addr_,
           &mock_helper_, &mock_alarm_factory_, &crypto_config_,
@@ -1558,7 +1604,8 @@ TEST_P(BufferedPacketStoreTest, ReceiveCHLOForBufferedConnection) {
        conn_id <= kDefaultMaxConnectionsInStore + kMaxNumSessionsToCreate;
        ++conn_id) {
     if (conn_id <= kMaxNumSessionsToCreate + 1) {
-      EXPECT_CALL(*dispatcher_, CreateQuicSession(conn_id, client_addr_))
+      EXPECT_CALL(*dispatcher_,
+                  CreateQuicSession(conn_id, client_addr_, QuicStringPiece()))
           .WillOnce(testing::Return(CreateSession(
               dispatcher_.get(), config_, conn_id, client_addr_, &mock_helper_,
               &mock_alarm_factory_, &crypto_config_,
@@ -1591,7 +1638,6 @@ class AsyncGetProofTest : public QuicDispatcherTest {
         signed_config_(new QuicSignedServerConfig) {
     FLAGS_quic_reloadable_flag_enable_quic_stateless_reject_support = true;
     FLAGS_quic_reloadable_flag_quic_use_cheap_stateless_rejects = true;
-    FLAGS_quic_reloadable_flag_quic_create_session_after_insertion = true;
   }
 
   void SetUp() override {
@@ -1602,6 +1648,7 @@ class AsyncGetProofTest : public QuicDispatcherTest {
     chlo_ = crypto_test_utils::GenerateDefaultInchoateCHLO(clock_, version,
                                                            &crypto_config_);
     chlo_.SetVector(net::kCOPT, net::QuicTagVector{net::kSREJ});
+    chlo_.SetStringPiece(kALPN, "HTTP/1");
     // Pass an inchoate CHLO.
     crypto_test_utils::GenerateFullCHLO(
         chlo_, &crypto_config_, server_addr_, client_addr_, version, clock_,
@@ -1683,7 +1730,8 @@ TEST_F(AsyncGetProofTest, BasicAccept) {
 
     EXPECT_CALL(check, Call(1));
     EXPECT_CALL(*dispatcher_, ShouldCreateOrBufferPacketForConnection(conn_id));
-    EXPECT_CALL(*dispatcher_, CreateQuicSession(conn_id, client_addr_))
+    EXPECT_CALL(*dispatcher_, CreateQuicSession(conn_id, client_addr_,
+                                                QuicStringPiece("HTTP/1")))
         .WillOnce(testing::Return(GetSession(conn_id)));
     EXPECT_CALL(*reinterpret_cast<MockQuicConnection*>(
                     GetSession(conn_id)->connection()),
@@ -1733,7 +1781,8 @@ TEST_F(AsyncGetProofTest, BasicReject) {
                 ProcessPacket(_, client_addr_, conn_id));
 
     EXPECT_CALL(check, Call(2));
-    EXPECT_CALL(*dispatcher_, CreateQuicSession(conn_id, client_addr_))
+    EXPECT_CALL(*dispatcher_,
+                CreateQuicSession(conn_id, client_addr_, QuicStringPiece("hq")))
         .Times(0);
     EXPECT_CALL(*time_wait_list_manager_,
                 ProcessPacket(_, client_addr_, conn_id));
@@ -1768,7 +1817,8 @@ TEST_F(AsyncGetProofTest, MultipleAccept) {
     EXPECT_CALL(check, Call(1));
     EXPECT_CALL(*dispatcher_,
                 ShouldCreateOrBufferPacketForConnection(conn_id_2));
-    EXPECT_CALL(*dispatcher_, CreateQuicSession(conn_id_2, client_addr_))
+    EXPECT_CALL(*dispatcher_, CreateQuicSession(conn_id_2, client_addr_,
+                                                QuicStringPiece("HTTP/1")))
         .WillOnce(testing::Return(GetSession(conn_id_2)));
     EXPECT_CALL(*reinterpret_cast<MockQuicConnection*>(
                     GetSession(conn_id_2)->connection()),
@@ -1790,7 +1840,8 @@ TEST_F(AsyncGetProofTest, MultipleAccept) {
                 ShouldCreateOrBufferPacketForConnection(conn_id_1));
 
     EXPECT_CALL(check, Call(4));
-    EXPECT_CALL(*dispatcher_, CreateQuicSession(conn_id_1, client_addr_))
+    EXPECT_CALL(*dispatcher_, CreateQuicSession(conn_id_1, client_addr_,
+                                                QuicStringPiece("HTTP/1")))
         .WillOnce(testing::Return(GetSession(conn_id_1)));
     EXPECT_CALL(*reinterpret_cast<MockQuicConnection*>(
                     GetSession(conn_id_1)->connection()),
@@ -1847,7 +1898,7 @@ TEST_F(AsyncGetProofTest, MultipleReject) {
     InSequence s;
 
     EXPECT_CALL(check, Call(1));
-    EXPECT_CALL(*dispatcher_, CreateQuicSession(conn_id_2, client_addr_))
+    EXPECT_CALL(*dispatcher_, CreateQuicSession(conn_id_2, client_addr_, _))
         .Times(0);
     EXPECT_CALL(*time_wait_list_manager_,
                 AddConnectionIdToTimeWait(conn_id_2, _, true, _));
@@ -1920,7 +1971,8 @@ TEST_F(AsyncGetProofTest, MultipleIdenticalReject) {
                 ShouldCreateOrBufferPacketForConnection(conn_id_1));
 
     EXPECT_CALL(check, Call(2));
-    EXPECT_CALL(*dispatcher_, CreateQuicSession(conn_id_1, client_addr_))
+    EXPECT_CALL(*dispatcher_,
+                CreateQuicSession(conn_id_1, client_addr_, QuicStringPiece()))
         .Times(0);
     EXPECT_CALL(*time_wait_list_manager_,
                 AddConnectionIdToTimeWait(conn_id_1, _, true, _));
@@ -1966,7 +2018,8 @@ TEST_F(AsyncGetProofTest, BufferTimeout) {
     EXPECT_CALL(check, Call(2));
     EXPECT_CALL(*time_wait_list_manager_,
                 ProcessPacket(_, client_addr_, conn_id));
-    EXPECT_CALL(*dispatcher_, CreateQuicSession(conn_id, client_addr_))
+    EXPECT_CALL(*dispatcher_,
+                CreateQuicSession(conn_id, client_addr_, QuicStringPiece()))
         .Times(0);
   }
 
@@ -2018,7 +2071,8 @@ TEST_F(AsyncGetProofTest, TimeWaitTimeout) {
 
     EXPECT_CALL(check, Call(2));
     EXPECT_CALL(*dispatcher_, ShouldCreateOrBufferPacketForConnection(conn_id));
-    EXPECT_CALL(*dispatcher_, CreateQuicSession(conn_id, client_addr_))
+    EXPECT_CALL(*dispatcher_, CreateQuicSession(conn_id, client_addr_,
+                                                QuicStringPiece("HTTP/1")))
         .WillOnce(testing::Return(GetSession(conn_id)));
     EXPECT_CALL(*reinterpret_cast<MockQuicConnection*>(
                     GetSession(conn_id)->connection()),
diff --git a/chromium/net/tools/quic/quic_http_response_cache.h b/chromium/net/tools/quic/quic_http_response_cache.h
index 5c8f6ea7798..fe9360489ec 100644
--- a/chromium/net/tools/quic/quic_http_response_cache.h
+++ b/chromium/net/tools/quic/quic_http_response_cache.h
@@ -9,12 +9,12 @@
 #include <map>
 #include <memory>
 #include <string>
-#include <unordered_map>
 #include <vector>
 
 #include "base/files/file_path.h"
 #include "base/macros.h"
 #include "net/quic/core/spdy_utils.h"
+#include "net/quic/platform/api/quic_containers.h"
 #include "net/quic/platform/api/quic_mutex.h"
 #include "net/quic/platform/api/quic_string_piece.h"
 #include "net/quic/platform/api/quic_url.h"
@@ -203,7 +203,7 @@ class QuicHttpResponseCache {
                                  ServerPushInfo resource);
 
   // Cached responses.
-  std::unordered_map<std::string, std::unique_ptr<Response>> responses_
+  QuicUnorderedMap<std::string, std::unique_ptr<Response>> responses_
       GUARDED_BY(response_mutex_);
 
   // The default response for cache misses, if set.
diff --git a/chromium/net/tools/quic/quic_server_test.cc b/chromium/net/tools/quic/quic_server_test.cc
index 6c0037a3e85..5c923d9bd44 100644
--- a/chromium/net/tools/quic/quic_server_test.cc
+++ b/chromium/net/tools/quic/quic_server_test.cc
@@ -10,6 +10,7 @@
 #include "net/quic/platform/api/quic_logging.h"
 #include "net/quic/platform/api/quic_socket_address.h"
 #include "net/quic/platform/api/quic_test.h"
+#include "net/quic/platform/api/quic_test_loopback.h"
 #include "net/quic/test_tools/crypto_test_utils.h"
 #include "net/quic/test_tools/mock_quic_dispatcher.h"
 #include "net/tools/quic/quic_epoll_alarm_factory.h"
@@ -124,7 +125,9 @@ TEST_F(QuicServerEpollInTest, ProcessBufferedCHLOsOnEpollin) {
           DoAll(testing::Assign(&more_chlos, false), testing::Return(false)));
 
   // Send a packet to trigger epoll event.
-  int fd = socket(AF_INET, SOCK_DGRAM | SOCK_NONBLOCK, IPPROTO_UDP);
+  int fd = socket(
+      AddressFamilyUnderTest() == IpAddressFamily::IP_V4 ? AF_INET : AF_INET6,
+      SOCK_DGRAM | SOCK_NONBLOCK, IPPROTO_UDP);
   ASSERT_LT(0, fd);
 
   char buf[1024];
diff --git a/chromium/net/tools/quic/quic_simple_dispatcher.cc b/chromium/net/tools/quic/quic_simple_dispatcher.cc
index e173624489e..8b8e59c85e5 100644
--- a/chromium/net/tools/quic/quic_simple_dispatcher.cc
+++ b/chromium/net/tools/quic/quic_simple_dispatcher.cc
@@ -48,7 +48,8 @@ void QuicSimpleDispatcher::OnRstStreamReceived(
 
 QuicServerSessionBase* QuicSimpleDispatcher::CreateQuicSession(
     QuicConnectionId connection_id,
-    const QuicSocketAddress& client_address) {
+    const QuicSocketAddress& client_address,
+    QuicStringPiece /*alpn*/) {
   // The QuicServerSessionBase takes ownership of |connection| below.
   QuicConnection* connection = new QuicConnection(
       connection_id, client_address, helper(), alarm_factory(),
diff --git a/chromium/net/tools/quic/quic_simple_dispatcher.h b/chromium/net/tools/quic/quic_simple_dispatcher.h
index 41d24cfb33b..04e1252684b 100644
--- a/chromium/net/tools/quic/quic_simple_dispatcher.h
+++ b/chromium/net/tools/quic/quic_simple_dispatcher.h
@@ -31,7 +31,8 @@ class QuicSimpleDispatcher : public QuicDispatcher {
  protected:
   QuicServerSessionBase* CreateQuicSession(
       QuicConnectionId connection_id,
-      const QuicSocketAddress& client_address) override;
+      const QuicSocketAddress& client_address,
+      QuicStringPiece alpn) override;
 
   QuicHttpResponseCache* response_cache() { return response_cache_; }
 
diff --git a/chromium/net/tools/quic/quic_simple_server_session_test.cc b/chromium/net/tools/quic/quic_simple_server_session_test.cc
index 85e80ad30b5..3349def6676 100644
--- a/chromium/net/tools/quic/quic_simple_server_session_test.cc
+++ b/chromium/net/tools/quic/quic_simple_server_session_test.cc
@@ -103,10 +103,17 @@ class MockQuicCryptoServerStream : public QuicCryptoServerStream {
                void(const CachedNetworkParameters* cached_network_parameters));
 
   void set_encryption_established(bool has_established) {
-    encryption_established_ = has_established;
+    encryption_established_override_ = has_established;
+  }
+
+  bool encryption_established() const override {
+    return QuicCryptoServerStream::encryption_established() ||
+           encryption_established_override_;
   }
 
  private:
+  bool encryption_established_override_ = false;
+
   DISALLOW_COPY_AND_ASSIGN(MockQuicCryptoServerStream);
 };
 
diff --git a/chromium/net/tools/quic/quic_simple_server_stream_test.cc b/chromium/net/tools/quic/quic_simple_server_stream_test.cc
index 93b06cf5280..c1add55c19a 100644
--- a/chromium/net/tools/quic/quic_simple_server_stream_test.cc
+++ b/chromium/net/tools/quic/quic_simple_server_stream_test.cc
@@ -43,7 +43,7 @@ class QuicSimpleServerStreamPeer : public QuicSimpleServerStream {
                              QuicHttpResponseCache* response_cache)
       : QuicSimpleServerStream(stream_id, session, response_cache) {}
 
-  ~QuicSimpleServerStreamPeer() override{};
+  ~QuicSimpleServerStreamPeer() override {}
 
   using QuicSimpleServerStream::SendResponse;
   using QuicSimpleServerStream::SendErrorResponse;
diff --git a/chromium/net/tools/quic/quic_time_wait_list_manager_test.cc b/chromium/net/tools/quic/quic_time_wait_list_manager_test.cc
index e81ffaed353..c9e7a8ea067 100644
--- a/chromium/net/tools/quic/quic_time_wait_list_manager_test.cc
+++ b/chromium/net/tools/quic/quic_time_wait_list_manager_test.cc
@@ -154,8 +154,7 @@ class ValidatePublicResetPacketPredicate
                                   std::tr1::get<1>(packet_buffer));
     framer.ProcessPacket(encrypted);
     QuicPublicResetPacket packet = visitor.public_reset_packet();
-    return connection_id_ == GetPeerInMemoryConnectionId(
-                                 packet.public_header.connection_id) &&
+    return connection_id_ == packet.public_header.connection_id &&
            packet.public_header.reset_flag &&
            !packet.public_header.version_flag &&
            net::test::TestPeerIPAddress() == packet.client_address.host() &&
diff --git a/chromium/net/tools/quic/stateless_rejector_test.cc b/chromium/net/tools/quic/stateless_rejector_test.cc
index 190121cb48a..20fe8bce86b 100644
--- a/chromium/net/tools/quic/stateless_rejector_test.cc
+++ b/chromium/net/tools/quic/stateless_rejector_test.cc
@@ -239,11 +239,9 @@ TEST_P(StatelessRejectorTest, RejectChlo) {
   ASSERT_EQ(StatelessRejector::REJECTED, rejector_->state());
   const CryptoHandshakeMessage& reply = rejector_->reply();
   EXPECT_EQ(kSREJ, reply.tag());
-  const uint32_t* reject_reasons;
-  size_t num_reject_reasons;
-  EXPECT_EQ(QUIC_NO_ERROR,
-            reply.GetTaglist(kRREJ, &reject_reasons, &num_reject_reasons));
-  EXPECT_EQ(1u, num_reject_reasons);
+  QuicTagVector reject_reasons;
+  EXPECT_EQ(QUIC_NO_ERROR, reply.GetTaglist(kRREJ, &reject_reasons));
+  EXPECT_EQ(1u, reject_reasons.size());
   EXPECT_EQ(INVALID_EXPECTED_LEAF_CERTIFICATE,
             static_cast<HandshakeFailureReason>(reject_reasons[0]));
 }
diff --git a/chromium/net/tools/quic/test_tools/quic_test_server.cc b/chromium/net/tools/quic/test_tools/quic_test_server.cc
index a99706f96b3..a2a497377e6 100644
--- a/chromium/net/tools/quic/test_tools/quic_test_server.cc
+++ b/chromium/net/tools/quic/test_tools/quic_test_server.cc
@@ -95,13 +95,13 @@ class QuicTestDispatcher : public QuicSimpleDispatcher {
         stream_factory_(nullptr),
         crypto_stream_factory_(nullptr) {}
 
-  QuicServerSessionBase* CreateQuicSession(
-      QuicConnectionId id,
-      const QuicSocketAddress& client) override {
+  QuicServerSessionBase* CreateQuicSession(QuicConnectionId id,
+                                           const QuicSocketAddress& client,
+                                           QuicStringPiece alpn) override {
     QuicReaderMutexLock lock(&factory_lock_);
     if (session_factory_ == nullptr && stream_factory_ == nullptr &&
         crypto_stream_factory_ == nullptr) {
-      return QuicSimpleDispatcher::CreateQuicSession(id, client);
+      return QuicSimpleDispatcher::CreateQuicSession(id, client, alpn);
     }
     QuicConnection* connection = new QuicConnection(
         id, client, helper(), alarm_factory(), CreatePerConnectionWriter(),
diff --git a/chromium/net/tools/quic/test_tools/server_thread.h b/chromium/net/tools/quic/test_tools/server_thread.h
index 1c20ccddc89..287eb181a9a 100644
--- a/chromium/net/tools/quic/test_tools/server_thread.h
+++ b/chromium/net/tools/quic/test_tools/server_thread.h
@@ -8,6 +8,7 @@
 #include <memory>
 
 #include "base/macros.h"
+#include "base/synchronization/waitable_event.h"
 #include "base/threading/simple_thread.h"
 #include "net/quic/core/quic_config.h"
 #include "net/quic/platform/api/quic_mutex.h"
diff --git a/chromium/net/tools/stitch_net_log_files.py b/chromium/net/tools/stitch_net_log_files.py
new file mode 100755
index 00000000000..d81d792ddf9
--- /dev/null
+++ b/chromium/net/tools/stitch_net_log_files.py
@@ -0,0 +1,128 @@
+#!/usr/bin/env python
+# Copyright 2016 The Chromium Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+'''
+This script "stitches" the NetLog files from a ".inprogress" directory to
+create a single NetLog file.
+'''
+
+import glob
+import os
+import re
+import sys
+
+
+USAGE ='''Usage: stitch_net_log_files.py <INPROGRESS_DIR> [<OUTPUT_PATH>]
+
+Will copy all the files in <INPROGRESS_DIR> and write the their content into a
+NetLog file at path <OUTPUT_PATH>.
+
+If <OUTPUT_PATH> is not specified, it should end with ".inprogress", and the
+completed NetLog file will be written to the location with ".inprogress"
+stripped.
+'''
+
+
+def get_event_file_sort_key(path):
+  '''Returns a tuple (modification timestamp, file number) for a path of the
+  form event_file_%d.json'''
+
+  m = re.match('^event_file_(\d+).json$', path)
+  file_index = int(m.group(1))
+  return (os.path.getmtime(path), file_index)
+
+
+def get_ordered_event_files():
+  '''Returns a list of file paths to event files. The order of the files is
+  from oldest to newest. If modification times are the same, files will be
+  ordered based on the numeral in their file name.'''
+
+  paths = glob.glob("event_file_*.json")
+  paths = sorted(paths, key=get_event_file_sort_key)
+  sys.stdout.write("Identified %d event files:\n  %s\n" %
+                   (len(paths), "\n  ".join(paths)))
+  return paths
+
+
+def main():
+  if len(sys.argv) != 2 and len(sys.argv) != 3:
+    sys.stderr.write(USAGE)
+    sys.exit(1)
+
+  inprogress_dir = sys.argv[1]
+  output_path = None
+
+  # Pick an output path based on command line arguments.
+  if len(sys.argv) == 3:
+    output_path = sys.argv[2]
+  elif len(sys.argv) == 2:
+    m = re.match("^(.*)\.inprogress/?$", inprogress_dir)
+    if not m:
+      sys.stdout.write("Must specify OUTPUT_PATH\n")
+      sys.exit(1)
+    output_path = m.group(1)
+
+  output_path = os.path.abspath(output_path)
+
+  sys.stdout.write("Reading data from: %s\n" % inprogress_dir)
+  sys.stdout.write("Writing log file to: %s\n" % output_path)
+
+  os.chdir(inprogress_dir)
+
+  with open(output_path, "w") as stitched_file:
+    try:
+      file = open("constants.json")
+      with file:
+        for line in file:
+          stitched_file.write(line)
+    except IOError:
+      sys.stderr.write("Failed reading \"constants.json\".\n")
+      sys.exit(1)
+
+    events_written = False;
+    for event_file_path in get_ordered_event_files():
+      try:
+        file = open(event_file_path)
+        with file:
+          if not events_written:
+            line = file.readline();
+            events_written = True
+          for next_line in file:
+            if next_line.strip() == "":
+              line += next_line
+            else:
+              stitched_file.write(line)
+              line = next_line
+      except IOError:
+        sys.stderr.write("Failed reading \"%s\"\n" % event_file_path)
+        sys.exit(1)
+    # Remove hanging comma from last event
+    # TODO(dconnol): Check if the last line is a valid JSON object. If not,
+    # do not write the line to file. This handles incomplete logs.
+    line = line.strip()
+    if line[-1:] == ",":
+      stitched_file.write(line[:-1])
+    elif line:
+      raise ValueError('Last event is not properly formed')
+
+    if os.path.exists("end_netlog.json"):
+      try:
+        file = open("end_netlog.json")
+        with file:
+          for line in file:
+            stitched_file.write(line)
+      except IOError:
+          sys.stderr.write("Failed reading \"end_netlog.json\".\n")
+          sys.exit(1)
+    else:
+      # end_netlog.json won't exist when using this tool to stitch logging
+      # sessions that didn't shutdown gracefully.
+      #
+      # Close the events array and then the log (no polled_data).
+      stitched_file.write("]}\n")
+
+
+if __name__ == "__main__":
+  main()
diff --git a/chromium/net/tools/transport_security_state_generator/huffman/huffman_builder.h b/chromium/net/tools/transport_security_state_generator/huffman/huffman_builder.h
index 5e66ae4b8af..ecd2a2c61d7 100644
--- a/chromium/net/tools/transport_security_state_generator/huffman/huffman_builder.h
+++ b/chromium/net/tools/transport_security_state_generator/huffman/huffman_builder.h
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef NET_TOOLS_TRANSPORT_SECURITY_STATE_GENERATOR_HUFFMAN_BUILDER_H_
-#define NET_TOOLS_TRANSPORT_SECURITY_STATE_GENERATOR_HUFFMAN_BUILDER_H_
+#ifndef NET_TOOLS_TRANSPORT_SECURITY_STATE_GENERATOR_HUFFMAN_HUFFMAN_BUILDER_H_
+#define NET_TOOLS_TRANSPORT_SECURITY_STATE_GENERATOR_HUFFMAN_HUFFMAN_BUILDER_H_
 
 #include <stdint.h>
 
@@ -82,4 +82,4 @@ class HuffmanBuilder {
 
 }  // namespace net
 
-#endif  // NET_TOOLS_TRANSPORT_SECURITY_STATE_GENERATOR_HUFFMAN_BUILDER_H_
\ No newline at end of file
+#endif  // NET_TOOLS_TRANSPORT_SECURITY_STATE_GENERATOR_HUFFMAN_HUFFMAN_BUILDER_H_
diff --git a/chromium/net/tools/transport_security_state_generator/input_file_parsers.cc b/chromium/net/tools/transport_security_state_generator/input_file_parsers.cc
index 4a633080ed0..691b403281e 100644
--- a/chromium/net/tools/transport_security_state_generator/input_file_parsers.cc
+++ b/chromium/net/tools/transport_security_state_generator/input_file_parsers.cc
@@ -167,6 +167,12 @@ enum class CertificateParserState {
 }  // namespace
 
 bool ParseCertificatesFile(base::StringPiece certs_input, Pinsets* pinsets) {
+  if (certs_input.find("\r\n") != base::StringPiece::npos) {
+    LOG(ERROR) << "CRLF line-endings found in the pins file. All files must "
+                  "use LF (unix style) line-endings.";
+    return false;
+  }
+
   std::string line;
   CertificateParserState current_state = CertificateParserState::PRE_NAME;
 
@@ -303,6 +309,12 @@ bool ParseJSON(base::StringPiece json,
       return false;
     }
 
+    if (entry->hostname.empty()) {
+      LOG(ERROR) << "The hostname for entry " << base::SizeTToString(i)
+                 << " is empty";
+      return false;
+    }
+
     parsed->GetBoolean("include_subdomains", &entry->include_subdomains);
     std::string mode;
     parsed->GetString("mode", &mode);
diff --git a/chromium/net/tools/transport_security_state_generator/input_file_parsers.h b/chromium/net/tools/transport_security_state_generator/input_file_parsers.h
index fd4e8276231..9a21b61abb7 100644
--- a/chromium/net/tools/transport_security_state_generator/input_file_parsers.h
+++ b/chromium/net/tools/transport_security_state_generator/input_file_parsers.h
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef NET_TOOLS_TRANSPORT_SECURITY_STATE_INPUT_FILE_PARSERS_H_
-#define NET_TOOLS_TRANSPORT_SECURITY_STATE_INPUT_FILE_PARSERS_H_
+#ifndef NET_TOOLS_TRANSPORT_SECURITY_STATE_GENERATOR_INPUT_FILE_PARSERS_H_
+#define NET_TOOLS_TRANSPORT_SECURITY_STATE_GENERATOR_INPUT_FILE_PARSERS_H_
 
 #include <string>
 
@@ -36,4 +36,4 @@ bool ParseJSON(base::StringPiece json,
 
 }  // namespace net
 
-#endif  // NET_TOOLS_TRANSPORT_SECURITY_STATE_INPUT_FILE_PARSERS_H_
+#endif  // NET_TOOLS_TRANSPORT_SECURITY_STATE_GENERATOR_INPUT_FILE_PARSERS_H_
diff --git a/chromium/net/tools/transport_security_state_generator/spki_hash_unittest.cc b/chromium/net/tools/transport_security_state_generator/spki_hash_unittest.cc
index 5758d2a01a8..1914208c93f 100644
--- a/chromium/net/tools/transport_security_state_generator/spki_hash_unittest.cc
+++ b/chromium/net/tools/transport_security_state_generator/spki_hash_unittest.cc
@@ -40,7 +40,7 @@ TEST(SPKIHashTest, FromString) {
 
   SPKIHash hash3;
 
-  // Valid SHA1 should rejected.
+  // Valid SHA1 should be rejected.
   EXPECT_FALSE(hash3.FromString("sha1/111111111111111111111111111="));
   EXPECT_FALSE(hash3.FromString("sha1/gzF+YoVCU9bXeDGQ7JGQVumRueM="));
 
diff --git a/chromium/net/tools/transport_security_state_generator/transport_security_state_entry.h b/chromium/net/tools/transport_security_state_generator/transport_security_state_entry.h
index 5bfaddced7e..c3177dda029 100644
--- a/chromium/net/tools/transport_security_state_generator/transport_security_state_entry.h
+++ b/chromium/net/tools/transport_security_state_generator/transport_security_state_entry.h
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef NET_TOOLS_TRANSPORT_SECURITY_STATE_GENERATOR_DOMAIN_SECURITY_ENTRY_H_
-#define NET_TOOLS_TRANSPORT_SECURITY_STATE_GENERATOR_DOMAIN_SECURITY_ENTRY_H_
+#ifndef NET_TOOLS_TRANSPORT_SECURITY_STATE_GENERATOR_TRANSPORT_SECURITY_STATE_ENTRY_H_
+#define NET_TOOLS_TRANSPORT_SECURITY_STATE_GENERATOR_TRANSPORT_SECURITY_STATE_ENTRY_H_
 
 #include <memory>
 #include <string>
@@ -54,4 +54,4 @@ using ReversedEntries = std::vector<std::unique_ptr<ReversedEntry>>;
 
 }  // namespace net
 
-#endif  // NET_TOOLS_TRANSPORT_SECURITY_STATE_GENERATOR_DOMAIN_SECURITY_ENTRY_H_
+#endif  // NET_TOOLS_TRANSPORT_SECURITY_STATE_GENERATOR_TRANSPORT_SECURITY_STATE_ENTRY_H_
diff --git a/chromium/net/tools/transport_security_state_generator/transport_security_state_generator.cc b/chromium/net/tools/transport_security_state_generator/transport_security_state_generator.cc
index d5e98cde237..40e8f1d3c42 100644
--- a/chromium/net/tools/transport_security_state_generator/transport_security_state_generator.cc
+++ b/chromium/net/tools/transport_security_state_generator/transport_security_state_generator.cc
@@ -152,6 +152,50 @@ bool CheckSubdomainsFlags(const TransportSecurityStateEntries& entries) {
   return true;
 }
 
+bool IsLowercaseAlphanumeric(char c) {
+  return ((c >= 'a') && (c <= 'z')) || ((c >= '0') && (c <= '9'));
+}
+
+// Checks the well-formedness of the hostnames. All hostnames should be in their
+// canonicalized form because they will be matched against canonicalized input.
+bool CheckHostnames(const TransportSecurityStateEntries& entries) {
+  for (const auto& entry : entries) {
+    const std::string& hostname = entry->hostname;
+
+    bool in_component = false;
+    bool most_recent_component_started_alphanumeric = false;
+    for (const char& c : hostname) {
+      if (!in_component) {
+        most_recent_component_started_alphanumeric = IsLowercaseAlphanumeric(c);
+        if (!most_recent_component_started_alphanumeric && (c != '-') &&
+            (c != '_')) {
+          LOG(ERROR) << hostname << " is not in canonicalized form";
+          return false;
+        }
+        in_component = true;
+      } else if (c == '.') {
+        in_component = false;
+      } else if (!IsLowercaseAlphanumeric(c) && (c != '-') && (c != '_')) {
+        LOG(ERROR) << hostname << " is not in canonicalized form";
+        return false;
+      }
+    }
+
+    if (!most_recent_component_started_alphanumeric) {
+      LOG(ERROR) << "The last label of " << hostname
+                 << " must start with a lowercase alphanumeric character";
+      return false;
+    }
+
+    if (!in_component) {
+      LOG(ERROR) << hostname << " must not end with a \".\"";
+      return false;
+    }
+  }
+
+  return true;
+}
+
 }  // namespace
 
 int main(int argc, char* argv[]) {
@@ -216,7 +260,7 @@ int main(int argc, char* argv[]) {
 
   if (!CheckDuplicateEntries(entries) || !CheckNoopEntries(entries) ||
       !CheckSubdomainsFlags(entries) || !CheckForDuplicatePins(pinsets) ||
-      !CheckCertificatesInPinsets(pinsets)) {
+      !CheckCertificatesInPinsets(pinsets) || !CheckHostnames(entries)) {
     LOG(ERROR) << "Checks failed. Aborting.";
     return 1;
   }
diff --git a/chromium/net/tools/truncate_net_log.py b/chromium/net/tools/truncate_net_log.py
new file mode 100755
index 00000000000..1841b08f788
--- /dev/null
+++ b/chromium/net/tools/truncate_net_log.py
@@ -0,0 +1,129 @@
+#!/usr/bin/env python
+# Copyright 2017 The Chromium Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+import os
+import re
+import sys
+
+kUsage = '''Usage: truncate_net_log.py INPUT_FILE OUTPUT_FILE TRUNCATED_SIZE
+
+Creates a smaller version of INPUT_FILE (which is a chrome-net-export-log.json
+formatted NetLog file) and saves it to OUTPUT_FILE. Note that this works by
+reading the file line by line and not fully parsing the JSON, so it must match
+the exact format (whitespace and all).
+
+File truncation is done by dropping the oldest events and keeping everything
+else.
+
+Parameters:
+
+  INPUT_FILE:
+    Path to net-export JSON file
+
+  OUTPUT_FILE:
+    Path to save truncated file to
+
+  TRUNCATED_SIZE:
+    The desired (approximate) size for the truncated file. May use a suffix to
+    indicate units. Examples:
+          2003  -->  2003 bytes
+          100K  -->  100 KiB
+          8M    -->  8 MiB
+          1.5m  -->  1.5 MiB
+'''
+
+def get_file_size(path):
+  '''Returns the filesize of |path| in bytes'''
+  return os.stat(path).st_size
+
+
+def truncate_log_file(in_path, out_path, desired_size):
+  '''Copies |in_path| to |out_path| such that it is approximately
+  |desired_size| bytes large. This is accomplished by dropping the oldest
+  events first. The final file size may not be exactly |desired_size| as only
+  complete event lines are skipped.'''
+  orig_size = get_file_size(in_path)
+  bytes_to_truncate = orig_size - desired_size
+
+  # This variable is True if the current line being processed is an Event line.
+  inside_events = False
+  with open(out_path, 'w') as out_file:
+    with open(in_path, 'r') as in_file:
+      for line in in_file:
+        # The final line before polledData closes the events array, and hence
+        # ends in "],". The check for polledData is more for documentation
+        # sake.
+        if inside_events and (line.startswith('"polledData": {' or
+                              line.endswith('],\n'))):
+          inside_events = False
+
+        # If this is an event line and need to drop more bytes, go ahead and
+        # skip the line. Otherwise copy it to the output file.
+        if inside_events and bytes_to_truncate > 0:
+          bytes_to_truncate -= len(line)
+        else:
+          out_file.write(line)
+
+        # All lines after this are events (up until the closing square
+        # bracket).
+        if line.startswith('"events": ['):
+          inside_events = True
+
+  sys.stdout.write(
+      'Truncated file from %d to %d bytes\n' % (orig_size,
+                                                get_file_size(out_path)))
+
+def parse_filesize_str(filesize_str):
+  '''Parses a string representation of a file size into a byte value, or None
+  on failure'''
+  filesize_str = filesize_str.lower()
+  m = re.match('([0-9\.]+)([km]?)', filesize_str)
+
+  if not m:
+    return None
+
+  # Try to parse as decimal (regex above accepts some invalid decimals too).
+  float_value = 0.0
+  try:
+    float_value = float(m.group(1))
+  except ValueError:
+    return None
+
+  kSuffixValueBytes = {
+    'k': 1024,
+    'm': 1024 * 1024,
+    '': 1,
+  }
+
+  suffix = m.group(2)
+  return int(float_value * kSuffixValueBytes[suffix])
+
+
+def main():
+  if len(sys.argv) != 4:
+    sys.stderr.write('ERROR: Requires 3 command line arguments\n')
+    sys.stderr.write(kUsage)
+    sys.exit(1)
+
+  in_path = os.path.normpath(sys.argv[1])
+  out_path = os.path.normpath(sys.argv[2])
+
+  if in_path == out_path:
+    sys.stderr.write('ERROR: OUTPUT_FILE must be different from INPUT_FILE\n')
+    sys.stderr.write(kUsage)
+    sys.exit(1)
+
+  size_str = sys.argv[3]
+  size_bytes = parse_filesize_str(size_str)
+  if size_bytes is None:
+    sys.stderr.write('ERROR: Could not parse TRUNCATED_SIZE: %s\n' % size_str)
+    sys.stderr.write(kUsage)
+    sys.exit(1)
+
+  truncate_log_file(in_path, out_path, size_bytes)
+
+
+if __name__ == '__main__':
+  main()
diff --git a/chromium/net/tools/update_ios_bundle_data.py b/chromium/net/tools/update_ios_bundle_data.py
index 80d1334e325..9313ce0eaaf 100755
--- a/chromium/net/tools/update_ios_bundle_data.py
+++ b/chromium/net/tools/update_ios_bundle_data.py
@@ -43,6 +43,7 @@ net_unittest_bundle_data_globs = [
     "data/cert_issuer_source_aia_unittest/*.pem",
     "data/cert_issuer_source_static_unittest/*.pem",
     "data/certificate_policies_unittest/*.pem",
+    "data/embedded_test_server/*",
     "data/filter_unittests/*",
     "data/name_constraints_unittest/*.pem",
     "data/parse_certificate_unittest/*.pem",
@@ -51,6 +52,7 @@ net_unittest_bundle_data_globs = [
     "data/url_request_unittest/*",
     "data/verify_certificate_chain_unittest/**/*.pem",
     "data/verify_certificate_chain_unittest/**/*.test",
+    "data/verify_certificate_chain_unittest/pkits_errors/*.txt",
     "data/verify_name_match_unittest/names/*.pem",
     "data/verify_signed_data_unittest/*.pem",
     "third_party/nist-pkits/certs/*.crt",