BASELINE: Update Chromium to 55.0.2883.105

And updates ninja to 1.7.2

Change-Id: I20d43c737f82764d857ada9a55586901b18b9243
Reviewed-by: Michael Brüning <michael.bruning@qt.io>

36 files changed, 778 insertions, 222 deletions

diff --git a/chromium/pdf/BUILD.gn b/chromium/pdf/BUILD.gn
index d683ab2464e..f017ed2ff44 100644
--- a/chromium/pdf/BUILD.gn
+++ b/chromium/pdf/BUILD.gn
@@ -16,6 +16,7 @@ static_library("pdf") {
     "//net",
     "//ppapi/cpp:objects",
     "//ppapi/cpp/private:internal_module",
+    "//ui/base",
   ]
 
   sources = [
@@ -64,7 +65,8 @@ static_library("pdf") {
     ]
   }
 
+  defines = [ "PDFIUM_PRINT_TEXT_WITH_GDI" ]
   if (pdf_enable_xfa) {
-    defines = [ "PDF_ENABLE_XFA" ]
+    defines += [ "PDF_ENABLE_XFA" ]
   }
 }
diff --git a/chromium/pdf/DEPS b/chromium/pdf/DEPS
index 74181ceac4e..b7a8a170e88 100644
--- a/chromium/pdf/DEPS
+++ b/chromium/pdf/DEPS
@@ -2,6 +2,7 @@ include_rules = [
   "+chrome/common/content_restriction.h",
   "+net",
   "+ppapi",
+  "+ui/base/window_open_disposition.h",
   "+ui/events/keycodes/keyboard_codes.h",
   "+v8/include/v8.h"
 ]
diff --git a/chromium/pdf/OWNERS b/chromium/pdf/OWNERS
index bdb1ac3cac8..27d952a970f 100644
--- a/chromium/pdf/OWNERS
+++ b/chromium/pdf/OWNERS
@@ -1,5 +1,4 @@
-gene@chromium.org
-jam@chromium.org
+dsinclair@chromium.org
 jochen@chromium.org
 raymes@chromium.org
 thestig@chromium.org
diff --git a/chromium/pdf/document_loader.cc b/chromium/pdf/document_loader.cc
index ae608eff93e..ea4b664b27b 100644
--- a/chromium/pdf/document_loader.cc
+++ b/chromium/pdf/document_loader.cc
@@ -335,7 +335,7 @@ pp::URLRequestInfo DocumentLoader::GetRequest(uint32_t position,
   pp::URLRequestInfo request(client_->GetPluginInstance());
   request.SetURL(url_);
   request.SetMethod("GET");
-  request.SetFollowRedirects(true);
+  request.SetFollowRedirects(false);
   request.SetCustomReferrerURL(url_);
 
   const size_t kBufSize = 100;
diff --git a/chromium/pdf/out_of_process_instance.cc b/chromium/pdf/out_of_process_instance.cc
index ae680bde0ef..92511185c97 100644
--- a/chromium/pdf/out_of_process_instance.cc
+++ b/chromium/pdf/out_of_process_instance.cc
@@ -104,7 +104,7 @@ const char kJSCancelStreamUrlType[] = "cancelStreamUrl";
 // Navigate to the given URL (Plugin -> Page)
 const char kJSNavigateType[] = "navigate";
 const char kJSNavigateUrl[] = "url";
-const char kJSNavigateNewTab[] = "newTab";
+const char kJSNavigateWindowOpenDisposition[] = "disposition";
 // Open the email editor with the given parameters (Plugin -> Page)
 const char kJSEmailType[] = "email";
 const char kJSEmailTo[] = "to";
@@ -321,10 +321,9 @@ bool OutOfProcessInstance::Init(uint32_t argc,
   if (!document_url_var.is_string())
     return false;
   std::string document_url = document_url_var.AsString();
-  std::string extension_url = std::string(kChromeExtension);
-  std::string print_preview_url = std::string(kChromePrint);
-  if (!base::StringPiece(document_url).starts_with(kChromeExtension) &&
-      !base::StringPiece(document_url).starts_with(kChromePrint)) {
+  base::StringPiece document_url_piece(document_url);
+  if (!document_url_piece.starts_with(kChromeExtension) &&
+      !document_url_piece.starts_with(kChromePrint)) {
     return false;
   }
 
@@ -344,6 +343,7 @@ bool OutOfProcessInstance::Init(uint32_t argc,
 
   const char* stream_url = nullptr;
   const char* original_url = nullptr;
+  const char* top_level_url = nullptr;
   const char* headers = nullptr;
   for (uint32_t i = 0; i < argc; ++i) {
     bool success = true;
@@ -351,6 +351,8 @@ bool OutOfProcessInstance::Init(uint32_t argc,
       original_url = argv[i];
     else if (strcmp(argn[i], "stream-url") == 0)
       stream_url = argv[i];
+    else if (strcmp(argn[i], "top-level-url") == 0)
+      top_level_url = argv[i];
     else if (strcmp(argn[i], "headers") == 0)
       headers = argv[i];
     else if (strcmp(argn[i], "background-color") == 0)
@@ -377,6 +379,7 @@ bool OutOfProcessInstance::Init(uint32_t argc,
 
   LoadUrl(stream_url);
   url_ = original_url;
+  pp::PDF::SetCrashData(GetPluginInstance(), original_url, top_level_url);
   return engine_->New(original_url, headers);
 }
 
@@ -623,12 +626,7 @@ void OutOfProcessInstance::LoadAccessibility() {
     return;
   }
 
-  PP_PrivateAccessibilityViewportInfo viewport_info;
-  viewport_info.scroll.x = 0;
-  viewport_info.scroll.y = -top_toolbar_height_ * device_scale_;
-  viewport_info.offset = available_area_.point();
-  viewport_info.zoom = zoom_ * device_scale_;
-  pp::PDF::SetAccessibilityViewportInfo(GetPluginInstance(), &viewport_info);
+  SendAccessibilityViewportInfo();
 
   // Schedule loading the first page.
   pp::CompletionCallback callback = timer_factory_.NewCallback(
@@ -698,6 +696,15 @@ void OutOfProcessInstance::SendNextAccessibilityPage(int32_t page_index) {
                                               callback, page_index + 1);
 }
 
+void OutOfProcessInstance::SendAccessibilityViewportInfo() {
+  PP_PrivateAccessibilityViewportInfo viewport_info;
+  viewport_info.scroll.x = 0;
+  viewport_info.scroll.y = -top_toolbar_height_ * device_scale_;
+  viewport_info.offset = available_area_.point();
+  viewport_info.zoom = zoom_ * device_scale_;
+  pp::PDF::SetAccessibilityViewportInfo(GetPluginInstance(), &viewport_info);
+}
+
 pp::Var OutOfProcessInstance::GetLinkAtPosition(
     const pp::Point& point) {
   pp::Point offset_point(point);
@@ -977,11 +984,12 @@ void OutOfProcessInstance::ScrollToPage(int page) {
 }
 
 void OutOfProcessInstance::NavigateTo(const std::string& url,
-                                      bool open_in_new_tab) {
+                                      WindowOpenDisposition disposition) {
   pp::VarDictionary message;
   message.Set(kType, kJSNavigateType);
   message.Set(kJSNavigateUrl, url);
-  message.Set(kJSNavigateNewTab, open_in_new_tab);
+  message.Set(kJSNavigateWindowOpenDisposition,
+              pp::Var(static_cast<int32_t>(disposition)));
   PostMessage(message);
 }
 
@@ -1227,6 +1235,9 @@ void OutOfProcessInstance::DocumentLoadComplete(int page_count) {
   progress_message.Set(pp::Var(kJSProgressPercentage), pp::Var(100));
   PostMessage(progress_message);
 
+  if (accessibility_state_ == ACCESSIBILITY_STATE_PENDING)
+    LoadAccessibility();
+
   if (!full_)
     return;
 
@@ -1248,9 +1259,6 @@ void OutOfProcessInstance::DocumentLoadComplete(int page_count) {
   pp::PDF::SetContentRestriction(this, content_restrictions);
 
   uma_.HistogramCustomCounts("PDF.PageCount", page_count, 1, 1000000, 50);
-
-  if (accessibility_state_ == ACCESSIBILITY_STATE_PENDING)
-    LoadAccessibility();
 }
 
 void OutOfProcessInstance::RotateClockwise() {
@@ -1414,6 +1422,9 @@ void OutOfProcessInstance::OnGeometryChanged(double old_zoom,
   if (document_size_.IsEmpty())
     return;
   paint_manager_.InvalidateRect(pp::Rect(pp::Point(), plugin_size_));
+
+  if (accessibility_state_ == ACCESSIBILITY_STATE_LOADED)
+    SendAccessibilityViewportInfo();
 }
 
 void OutOfProcessInstance::LoadUrl(const std::string& url) {
diff --git a/chromium/pdf/out_of_process_instance.h b/chromium/pdf/out_of_process_instance.h
index fb08986078a..a998537dfd1 100644
--- a/chromium/pdf/out_of_process_instance.h
+++ b/chromium/pdf/out_of_process_instance.h
@@ -79,12 +79,6 @@ class OutOfProcessInstance : public pp::Instance,
   void GetPrintPresetOptionsFromDocument(PP_PdfPrintPresetOptions_Dev* options);
   void EnableAccessibility();
 
-  // Start loading accessibility information.
-  void LoadAccessibility();
-
-  // Send accessibility information about the given page index.
-  void SendNextAccessibilityPage(int32_t page_index);
-
   void FlushCallback(int32_t result);
   void DidOpen(int32_t result);
   void DidOpenPreview(int32_t result);
@@ -102,7 +96,8 @@ class OutOfProcessInstance : public pp::Instance,
   void ScrollToX(int position) override;
   void ScrollToY(int position) override;
   void ScrollToPage(int page) override;
-  void NavigateTo(const std::string& url, bool open_in_new_tab) override;
+  void NavigateTo(const std::string& url,
+                  WindowOpenDisposition disposition) override;
   void UpdateCursor(PP_CursorType_Dev cursor) override;
   void UpdateTickMarks(const std::vector<pp::Rect>& tickmarks) override;
   void NotifyNumberOfFindResultsChanged(int total, bool final_result) override;
@@ -181,6 +176,17 @@ class OutOfProcessInstance : public pp::Instance,
 
   void UserMetricsRecordAction(const std::string& action);
 
+  // Start loading accessibility information.
+  void LoadAccessibility();
+
+  // Send accessibility information about the given page index.
+  void SendNextAccessibilityPage(int32_t page_index);
+
+  // Send the accessibility information about the current viewport. This is
+  // done once when accessibility is first loaded and again when the geometry
+  // changes.
+  void SendAccessibilityViewportInfo();
+
   enum DocumentLoadState {
     LOAD_STATE_LOADING,
     LOAD_STATE_COMPLETE,
diff --git a/chromium/pdf/paint_aggregator.cc b/chromium/pdf/paint_aggregator.cc
index 50d77fe47d3..ba444cfdf99 100644
--- a/chromium/pdf/paint_aggregator.cc
+++ b/chromium/pdf/paint_aggregator.cc
@@ -34,11 +34,11 @@ bool IsNegative(int32_t num) {
 // therefore be treated as an invalidation.
 // ----------------------------------------------------------------------------
 
-PaintAggregator::PaintUpdate::PaintUpdate() {
-}
+PaintAggregator::PaintUpdate::PaintUpdate() = default;
 
-PaintAggregator::PaintUpdate::~PaintUpdate() {
-}
+PaintAggregator::PaintUpdate::PaintUpdate(const PaintUpdate& that) = default;
+
+PaintAggregator::PaintUpdate::~PaintUpdate() = default;
 
 PaintAggregator::InternalPaintUpdate::InternalPaintUpdate() :
     synthesized_scroll_damage_rect_(false) {
diff --git a/chromium/pdf/paint_aggregator.h b/chromium/pdf/paint_aggregator.h
index 74737ab8fb6..5bb4ea72251 100644
--- a/chromium/pdf/paint_aggregator.h
+++ b/chromium/pdf/paint_aggregator.h
@@ -9,7 +9,6 @@
 
 #include "ppapi/cpp/image_data.h"
 #include "ppapi/cpp/rect.h"
-#include "ppapi/cpp/rect.h"
 
 // This class is responsible for aggregating multiple invalidation and scroll
 // commands to produce a scroll and repaint sequence. You can use this manually
@@ -31,6 +30,7 @@ class PaintAggregator {
 
   struct PaintUpdate {
     PaintUpdate();
+    PaintUpdate(const PaintUpdate& that);
     ~PaintUpdate();
 
     // True if there is a scroll applied. This indicates that the scroll delta
diff --git a/chromium/pdf/paint_manager.cc b/chromium/pdf/paint_manager.cc
index 226994c3b05..7811f07d5f6 100644
--- a/chromium/pdf/paint_manager.cc
+++ b/chromium/pdf/paint_manager.cc
@@ -14,13 +14,22 @@
 #include "ppapi/cpp/instance.h"
 #include "ppapi/cpp/module.h"
 
+PaintManager::ReadyRect::ReadyRect() = default;
+
+PaintManager::ReadyRect::ReadyRect(const pp::Rect& r,
+                                   const pp::ImageData& i,
+                                   bool f)
+    : rect(r), image_data(i), flush_now(f) {}
+
+PaintManager::ReadyRect::ReadyRect(const ReadyRect& that) = default;
+
 PaintManager::PaintManager(pp::Instance* instance,
                            Client* client,
                            bool is_always_opaque)
     : instance_(instance),
       client_(client),
       is_always_opaque_(is_always_opaque),
-      callback_factory_(NULL),
+      callback_factory_(nullptr),
       manual_callback_pending_(false),
       flush_pending_(false),
       has_pending_resize_(false),
@@ -164,8 +173,8 @@ void PaintManager::EnsureCallbackPending() {
 void PaintManager::DoPaint() {
   in_paint_ = true;
 
-  std::vector<ReadyRect> ready;
-  std::vector<pp::Rect> pending;
+  std::vector<ReadyRect> ready_rects;
+  std::vector<pp::Rect> pending_rects;
 
   DCHECK(aggregator_.HasPendingUpdate());
 
@@ -201,18 +210,18 @@ void PaintManager::DoPaint() {
   }
 
   PaintAggregator::PaintUpdate update = aggregator_.GetPendingUpdate();
-  client_->OnPaint(update.paint_rects, &ready, &pending);
+  client_->OnPaint(update.paint_rects, &ready_rects, &pending_rects);
 
-  if (ready.empty() && pending.empty()) {
+  if (ready_rects.empty() && pending_rects.empty()) {
     in_paint_ = false;
     return;  // Nothing was painted, don't schedule a flush.
   }
 
   std::vector<PaintAggregator::ReadyRect> ready_now;
-  if (pending.empty()) {
+  if (pending_rects.empty()) {
     std::vector<PaintAggregator::ReadyRect> temp_ready;
-    temp_ready.insert(temp_ready.end(), ready.begin(), ready.end());
-    aggregator_.SetIntermediateResults(temp_ready, pending);
+    temp_ready.insert(temp_ready.end(), ready_rects.begin(), ready_rects.end());
+    aggregator_.SetIntermediateResults(temp_ready, pending_rects);
     ready_now = aggregator_.GetReadyRects();
     aggregator_.ClearPendingUpdate();
 
@@ -223,7 +232,7 @@ void PaintManager::DoPaint() {
     view_size_changed_waiting_for_paint_ = false;
   } else {
     std::vector<PaintAggregator::ReadyRect> ready_later;
-    for (const auto& ready_rect : ready) {
+    for (const auto& ready_rect : ready_rects) {
       // Don't flush any part (i.e. scrollbars) if we're resizing the browser,
       // as that'll lead to flashes.  Until we flush, the browser will use the
       // previous image, but if we flush, it'll revert to using the blank image.
@@ -238,7 +247,7 @@ void PaintManager::DoPaint() {
     }
     // Take the rectangles, except the ones that need to be flushed right away,
     // and save them so that everything is flushed at once.
-    aggregator_.SetIntermediateResults(ready_later, pending);
+    aggregator_.SetIntermediateResults(ready_later, pending_rects);
 
     if (ready_now.empty()) {
       in_paint_ = false;
diff --git a/chromium/pdf/paint_manager.h b/chromium/pdf/paint_manager.h
index d7f7e3f594b..dd99f9d2a61 100644
--- a/chromium/pdf/paint_manager.h
+++ b/chromium/pdf/paint_manager.h
@@ -33,13 +33,9 @@ class PaintManager {
   // it should be flushed to the screen immediately or when the rest of the
   // plugin viewport is ready.
   struct ReadyRect {
-    pp::Point offset;
-    pp::Rect rect;
-    pp::ImageData image_data;
-    bool flush_now;
-
-    ReadyRect(const pp::Rect& r, const pp::ImageData& i, bool f)
-        : rect(r), image_data(i), flush_now(f) {}
+    ReadyRect();
+    ReadyRect(const pp::Rect& r, const pp::ImageData& i, bool f);
+    ReadyRect(const ReadyRect& that);
 
     operator PaintAggregator::ReadyRect() const {
       PaintAggregator::ReadyRect rv;
@@ -48,6 +44,11 @@ class PaintManager {
       rv.image_data = image_data;
       return rv;
     }
+
+    pp::Point offset;
+    pp::Rect rect;
+    pp::ImageData image_data;
+    bool flush_now;
   };
   class Client {
    public:
@@ -72,6 +73,7 @@ class PaintManager {
     virtual void OnPaint(const std::vector<pp::Rect>& paint_rects,
                          std::vector<ReadyRect>* ready,
                          std::vector<pp::Rect>* pending) = 0;
+
    protected:
     // You shouldn't be doing deleting through this interface.
     virtual ~Client() {}
diff --git a/chromium/pdf/pdf.cc b/chromium/pdf/pdf.cc
index bad2ac4e2a8..57d5b0178c8 100644
--- a/chromium/pdf/pdf.cc
+++ b/chromium/pdf/pdf.cc
@@ -115,6 +115,14 @@ bool RenderPDFPageToDC(const void* pdf_buffer,
   return ret;
 }
 
+void SetPDFEnsureTypefaceCharactersAccessible(
+    PDFEnsureTypefaceCharactersAccessible func) {
+  PDFEngineExports::Get()->SetPDFEnsureTypefaceCharactersAccessible(func);
+}
+
+void SetPDFUseGDIPrinting(bool enable) {
+  PDFEngineExports::Get()->SetPDFUseGDIPrinting(enable);
+}
 #endif  // defined(OS_WIN)
 
 bool GetPDFDocInfo(const void* pdf_buffer,
diff --git a/chromium/pdf/pdf.gyp b/chromium/pdf/pdf.gyp
deleted file mode 100644
index 06ce3043f0f..00000000000
--- a/chromium/pdf/pdf.gyp
+++ /dev/null
@@ -1,71 +0,0 @@
-{
-  'variables': {
-    'chromium_code': 1,
-    'pdf_enable_xfa%': 0,
-    'pdf_engine%': 0,  # 0 PDFium
-  },
-  'targets': [
-    {
-      'target_name': 'pdf',
-      'type': 'static_library',
-      'dependencies': [
-        '../base/base.gyp:base',
-        '../gin/gin.gyp:gin',
-        '../net/net.gyp:net',
-        '../ppapi/ppapi.gyp:ppapi_cpp_objects',
-        '../ppapi/ppapi.gyp:ppapi_internal_module',
-      ],
-      'ldflags': [ '-L<(PRODUCT_DIR)',],
-      'sources': [
-        'chunk_stream.h',
-        'chunk_stream.cc',
-        'document_loader.h',
-        'document_loader.cc',
-        'draw_utils.cc',
-        'draw_utils.h',
-        'out_of_process_instance.cc',
-        'out_of_process_instance.h',
-        'paint_aggregator.cc',
-        'paint_aggregator.h',
-        'paint_manager.cc',
-        'paint_manager.h',
-        'pdf.cc',
-        'pdf.h',
-        'pdf_engine.h',
-        'preview_mode_client.cc',
-        'preview_mode_client.h',
-      ],
-      'conditions': [
-        ['pdf_engine==0', {
-          'dependencies': [
-            '../third_party/pdfium/pdfium.gyp:pdfium',
-          ],
-          'sources': [
-            'pdfium/pdfium_api_string_buffer_adapter.cc',
-            'pdfium/pdfium_api_string_buffer_adapter.h',
-            'pdfium/pdfium_assert_matching_enums.cc',
-            'pdfium/pdfium_engine.cc',
-            'pdfium/pdfium_engine.h',
-            'pdfium/pdfium_mem_buffer_file_read.cc',
-            'pdfium/pdfium_mem_buffer_file_read.h',
-            'pdfium/pdfium_mem_buffer_file_write.cc',
-            'pdfium/pdfium_mem_buffer_file_write.h',
-            'pdfium/pdfium_page.cc',
-            'pdfium/pdfium_page.h',
-            'pdfium/pdfium_range.cc',
-            'pdfium/pdfium_range.h',
-          ],
-        }],
-        ['pdf_enable_xfa==1', {
-           'defines': [
-             'PDF_ENABLE_XFA',
-           ]
-        }],
-        ['OS=="win"', {
-          # TODO(jschuh): crbug.com/167187 fix size_t to int truncations.
-          'msvs_disabled_warnings': [ 4267, ],
-        }],
-      ],
-    },
-  ],
-}
diff --git a/chromium/pdf/pdf.h b/chromium/pdf/pdf.h
index 342757f2462..fa3ae590aba 100644
--- a/chromium/pdf/pdf.h
+++ b/chromium/pdf/pdf.h
@@ -8,6 +8,16 @@
 #include "ppapi/c/ppb.h"
 #include "ppapi/cpp/module.h"
 
+#if defined(OS_WIN)
+#include <windows.h>
+#endif
+
+#if defined(OS_WIN)
+typedef void (*PDFEnsureTypefaceCharactersAccessible)(const LOGFONT* font,
+                                                      const wchar_t* text,
+                                                      size_t text_length);
+#endif
+
 namespace chrome_pdf {
 
 class PDFModule : public pp::Module {
@@ -67,7 +77,13 @@ bool RenderPDFPageToDC(const void* pdf_buffer,
                        bool keep_aspect_ratio,
                        bool center_in_bounds,
                        bool autorotate);
-#endif
+
+void SetPDFEnsureTypefaceCharactersAccessible(
+    PDFEnsureTypefaceCharactersAccessible func);
+
+void SetPDFUseGDIPrinting(bool enable);
+#endif  // defined(OS_WIN)
+
 // |page_count| and |max_page_width| are optional and can be NULL.
 // Returns false if the document is not valid.
 bool GetPDFDocInfo(const void* pdf_buffer,
diff --git a/chromium/pdf/pdf_engine.h b/chromium/pdf/pdf_engine.h
index 5bba8b9f860..4d17a403b18 100644
--- a/chromium/pdf/pdf_engine.h
+++ b/chromium/pdf/pdf_engine.h
@@ -27,6 +27,13 @@
 #include "ppapi/cpp/size.h"
 #include "ppapi/cpp/url_loader.h"
 #include "ppapi/cpp/var_array.h"
+#include "ui/base/window_open_disposition.h"
+
+#if defined(OS_WIN)
+typedef void (*PDFEnsureTypefaceCharactersAccessible)(const LOGFONT* font,
+                                                      const wchar_t* text,
+                                                      size_t text_length);
+#endif
 
 namespace pp {
 class InputEvent;
@@ -37,12 +44,6 @@ namespace chrome_pdf {
 
 class Stream;
 
-#if defined(OS_MACOSX)
-const uint32_t kDefaultKeyModifier = PP_INPUTEVENT_MODIFIER_METAKEY;
-#else  // !OS_MACOSX
-const uint32_t kDefaultKeyModifier = PP_INPUTEVENT_MODIFIER_CONTROLKEY;
-#endif  // OS_MACOSX
-
 // Do one time initialization of the SDK.
 bool InitializeSDK();
 // Tells the SDK that we're shutting down.
@@ -76,11 +77,12 @@ class PDFEngine {
     virtual void ScrollToX(int position) = 0;
     virtual void ScrollToY(int position) = 0;
 
-    // Scroll to the specified page.
+    // Scroll to zero-based |page|.
     virtual void ScrollToPage(int page) = 0;
 
     // Navigate to the given url.
-    virtual void NavigateTo(const std::string& url, bool open_in_new_tab) = 0;
+    virtual void NavigateTo(const std::string& url,
+                            WindowOpenDisposition disposition) = 0;
 
     // Updates the cursor.
     virtual void UpdateCursor(PP_CursorType_Dev cursor) = 0;
@@ -286,11 +288,12 @@ class PDFEngine {
   // document at page |index|.
   virtual void AppendPage(PDFEngine* engine, int index) = 0;
 
-  // Allow client to query and reset scroll positions in document coordinates.
-  // Note that this is meant for cases where the device scale factor changes,
-  // and not for general scrolling - the engine will not repaint due to this.
-  virtual pp::Point GetScrollPosition() = 0;
+#if defined(PDF_ENABLE_XFA)
+  // Allow client to set scroll positions in document coordinates. Note that
+  // this is meant for cases where the device scale factor changes, and not for
+  // general scrolling - the engine will not repaint due to this.
   virtual void SetScrollPosition(const pp::Point& position) = 0;
+#endif
 
   virtual bool IsProgressiveLoad() = 0;
 
@@ -308,12 +311,9 @@ class PDFEngineExports {
                       bool stretch_to_bounds,
                       bool keep_aspect_ratio,
                       bool center_in_bounds,
-                      bool autorotate)
-        : dpi_x(dpi_x), dpi_y(dpi_y), bounds(bounds),
-        fit_to_bounds(fit_to_bounds), stretch_to_bounds(stretch_to_bounds),
-        keep_aspect_ratio(keep_aspect_ratio),
-        center_in_bounds(center_in_bounds), autorotate(autorotate) {
-    }
+                      bool autorotate);
+    RenderingSettings(const RenderingSettings& that);
+
     int dpi_x;
     int dpi_y;
     pp::Rect bounds;
@@ -335,7 +335,13 @@ class PDFEngineExports {
                                  int page_number,
                                  const RenderingSettings& settings,
                                  HDC dc) = 0;
-#endif  // OS_WIN
+
+  virtual void SetPDFEnsureTypefaceCharactersAccessible(
+      PDFEnsureTypefaceCharactersAccessible func) = 0;
+
+  virtual void SetPDFUseGDIPrinting(bool enable) = 0;
+#endif  // defined(OS_WIN)
+
   // See the definition of RenderPDFPageToBitmap in pdf.cc for details.
   virtual bool RenderPDFPageToBitmap(const void* pdf_buffer,
                                      int pdf_buffer_size,
diff --git a/chromium/pdf/pdfium/fuzzers/BUILD.gn b/chromium/pdf/pdfium/fuzzers/BUILD.gn
index 2df2e9afded..1300910bbfa 100644
--- a/chromium/pdf/pdfium/fuzzers/BUILD.gn
+++ b/chromium/pdf/pdfium/fuzzers/BUILD.gn
@@ -28,11 +28,62 @@ fuzzer_test("pdfium_fuzzer") {
   dict = "dicts/pdf.dict"
 }
 
+fuzzer_test("pdf_cmap_fuzzer") {
+  sources = []
+  deps = [
+    "//third_party/pdfium/testing/libfuzzer:pdf_cmap_fuzzer",
+  ]
+}
+
+fuzzer_test("pdf_codec_fax_fuzzer") {
+  sources = []
+  deps = [
+    "//third_party/pdfium/testing/libfuzzer:pdf_codec_fax_fuzzer",
+  ]
+}
+
+fuzzer_test("pdf_codec_icc_fuzzer") {
+  sources = []
+  deps = [
+    "//third_party/pdfium/testing/libfuzzer:pdf_codec_icc_fuzzer",
+  ]
+  dict = "dicts/pdf_codec_icc.dict"
+}
+
+fuzzer_test("pdf_codec_jbig2_fuzzer") {
+  sources = []
+  deps = [
+    "//third_party/pdfium/testing/libfuzzer:pdf_codec_jbig2_fuzzer",
+  ]
+}
+
+fuzzer_test("pdf_hint_table_fuzzer") {
+  sources = []
+  deps = [
+    "//third_party/pdfium/testing/libfuzzer:pdf_hint_table_fuzzer",
+  ]
+}
+
 fuzzer_test("pdf_jpx_fuzzer") {
   sources = []
   deps = [
     "//third_party/pdfium/testing/libfuzzer:pdf_jpx_fuzzer",
   ]
+  seed_corpus = "corpora/pdf_jpx"
+}
+
+fuzzer_test("pdf_psengine_fuzzer") {
+  sources = []
+  deps = [
+    "//third_party/pdfium/testing/libfuzzer:pdf_psengine_fuzzer",
+  ]
+}
+
+fuzzer_test("pdf_streamparser_fuzzer") {
+  sources = []
+  deps = [
+    "//third_party/pdfium/testing/libfuzzer:pdf_streamparser_fuzzer",
+  ]
 }
 
 if (pdf_enable_xfa) {
@@ -41,6 +92,7 @@ if (pdf_enable_xfa) {
     deps = [
       "//third_party/pdfium/testing/libfuzzer:pdf_codec_bmp_fuzzer",
     ]
+    seed_corpus = "corpora/pdf_codec_bmp"
   }
 
   fuzzer_test("pdf_codec_gif_fuzzer") {
@@ -48,6 +100,8 @@ if (pdf_enable_xfa) {
     deps = [
       "//third_party/pdfium/testing/libfuzzer:pdf_codec_gif_fuzzer",
     ]
+    dict = "dicts/pdf_codec_gif.dict"
+    seed_corpus = "corpora/pdf_codec_gif"
   }
 
   fuzzer_test("pdf_codec_jpeg_fuzzer") {
@@ -55,6 +109,8 @@ if (pdf_enable_xfa) {
     deps = [
       "//third_party/pdfium/testing/libfuzzer:pdf_codec_jpeg_fuzzer",
     ]
+    dict = "dicts/pdf_codec_jpeg.dict"
+    seed_corpus = "corpora/pdf_codec_jpeg"
   }
 
   fuzzer_test("pdf_codec_png_fuzzer") {
@@ -62,6 +118,8 @@ if (pdf_enable_xfa) {
     deps = [
       "//third_party/pdfium/testing/libfuzzer:pdf_codec_png_fuzzer",
     ]
+    dict = "dicts/pdf_codec_png.dict"
+    seed_corpus = "corpora/pdf_codec_png"
   }
 
   fuzzer_test("pdf_codec_tiff_fuzzer") {
@@ -69,6 +127,8 @@ if (pdf_enable_xfa) {
     deps = [
       "//third_party/pdfium/testing/libfuzzer:pdf_codec_tiff_fuzzer",
     ]
+    dict = "dicts/pdf_codec_tiff.dict"
+    seed_corpus = "corpora/pdf_codec_tiff"
   }
 
   fuzzer_test("pdf_css_fuzzer") {
diff --git a/chromium/pdf/pdfium/fuzzers/corpora/pdf_codec_gif/not_kitty.gif b/chromium/pdf/pdfium/fuzzers/corpora/pdf_codec_gif/not_kitty.gif
new file mode 100644
index 00000000000..244fcc64524
--- /dev/null
+++ b/chromium/pdf/pdfium/fuzzers/corpora/pdf_codec_gif/not_kitty.gif
diff --git a/chromium/pdf/pdfium/fuzzers/corpora/pdf_codec_jpeg/not_kitty.jpg b/chromium/pdf/pdfium/fuzzers/corpora/pdf_codec_jpeg/not_kitty.jpg
new file mode 100644
index 00000000000..0497be49f57
--- /dev/null
+++ b/chromium/pdf/pdfium/fuzzers/corpora/pdf_codec_jpeg/not_kitty.jpg
diff --git a/chromium/pdf/pdfium/fuzzers/corpora/pdf_codec_png/not_kitty.png b/chromium/pdf/pdfium/fuzzers/corpora/pdf_codec_png/not_kitty.png
new file mode 100644
index 00000000000..eff7c1707b9
--- /dev/null
+++ b/chromium/pdf/pdfium/fuzzers/corpora/pdf_codec_png/not_kitty.png
diff --git a/chromium/pdf/pdfium/fuzzers/corpora/pdf_codec_png/not_kitty_alpha.png b/chromium/pdf/pdfium/fuzzers/corpora/pdf_codec_png/not_kitty_alpha.png
new file mode 100644
index 00000000000..2fb8da2c8f5
--- /dev/null
+++ b/chromium/pdf/pdfium/fuzzers/corpora/pdf_codec_png/not_kitty_alpha.png
diff --git a/chromium/pdf/pdfium/fuzzers/corpora/pdf_codec_png/not_kitty_gamma.png b/chromium/pdf/pdfium/fuzzers/corpora/pdf_codec_png/not_kitty_gamma.png
new file mode 100644
index 00000000000..939d9d29a9b
--- /dev/null
+++ b/chromium/pdf/pdfium/fuzzers/corpora/pdf_codec_png/not_kitty_gamma.png
diff --git a/chromium/pdf/pdfium/fuzzers/corpora/pdf_codec_png/not_kitty_icc.png b/chromium/pdf/pdfium/fuzzers/corpora/pdf_codec_png/not_kitty_icc.png
new file mode 100644
index 00000000000..f0c7804d998
--- /dev/null
+++ b/chromium/pdf/pdfium/fuzzers/corpora/pdf_codec_png/not_kitty_icc.png
diff --git a/chromium/pdf/pdfium/fuzzers/corpora/pdf_codec_tiff/not_kitty.tiff b/chromium/pdf/pdfium/fuzzers/corpora/pdf_codec_tiff/not_kitty.tiff
new file mode 100644
index 00000000000..506ca1ad4b5
--- /dev/null
+++ b/chromium/pdf/pdfium/fuzzers/corpora/pdf_codec_tiff/not_kitty.tiff
diff --git a/chromium/pdf/pdfium/fuzzers/corpora/pdf_jpx/not_kitty.jp2 b/chromium/pdf/pdfium/fuzzers/corpora/pdf_jpx/not_kitty.jp2
new file mode 100644
index 00000000000..14bca2924a0
--- /dev/null
+++ b/chromium/pdf/pdfium/fuzzers/corpora/pdf_jpx/not_kitty.jp2
diff --git a/chromium/pdf/pdfium/fuzzers/dicts/pdf_codec_gif.dict b/chromium/pdf/pdfium/fuzzers/dicts/pdf_codec_gif.dict
new file mode 100644
index 00000000000..71148937111
--- /dev/null
+++ b/chromium/pdf/pdfium/fuzzers/dicts/pdf_codec_gif.dict
@@ -0,0 +1,18 @@
+#
+# AFL dictionary for GIF images
+# -----------------------------
+#
+# Created by Michal Zalewski <lcamtuf@google.com>
+#
+
+header_87a="87a"
+header_89a="89a"
+header_gif="GIF"
+
+marker_2c=","
+marker_3b=";"
+
+section_2101="!\x01\x12"
+section_21f9="!\xf9\x04"
+section_21fe="!\xfe"
+section_21ff="!\xff\x11"
diff --git a/chromium/pdf/pdfium/fuzzers/dicts/pdf_codec_icc.dict b/chromium/pdf/pdfium/fuzzers/dicts/pdf_codec_icc.dict
new file mode 100644
index 00000000000..f112a948843
--- /dev/null
+++ b/chromium/pdf/pdfium/fuzzers/dicts/pdf_codec_icc.dict
@@ -0,0 +1,249 @@
+# Fuzzing dictionary for icc
+# Extracted from lcms2.h of Little-CMS project.
+
+magic="acsp"
+sig="lcms"
+
+# Base ICC type definitions
+"chrm"
+"clro"
+"clrt"
+"crdi"
+"curv"
+"data"
+"dict"
+"dtim"
+"devs"
+"mft2"
+"mft1"
+"mAB "
+"mBA "
+"meas"
+"mluc"
+"mpet"
+"ncol"
+"ncl2"
+"para"
+"pseq"
+"psid"
+"rcs2"
+"sf32"
+"scrn"
+"sig "
+"text"
+"desc"
+"uf32"
+"bfd "
+"ui16"
+"ui32"
+"ui64"
+"ui08"
+"vcgt"
+"view"
+"XYZ "
+
+# Base ICC tag definitions
+"A2B0"
+"A2B1"
+"A2B2"
+"bXYZ"
+"bXYZ"
+"bTRC"
+"B2A0"
+"B2A1"
+"B2A2"
+"calt"
+"targ"
+"chad"
+"chrm"
+"clro"
+"clrt"
+"clot"
+"ciis"
+"cprt"
+"crdi"
+"data"
+"dtim"
+"dmnd"
+"dmdd"
+"devs"
+"D2B0"
+"D2B1"
+"D2B2"
+"D2B3"
+"B2D0"
+"B2D1"
+"B2D2"
+"B2D3"
+"gamt"
+"kTRC"
+"gXYZ"
+"gXYZ"
+"gTRC"
+"lumi"
+"meas"
+"bkpt"
+"wtpt"
+"ncol"
+"ncl2"
+"resp"
+"rig0"
+"pre0"
+"pre1"
+"pre2"
+"desc"
+"dscm"
+"pseq"
+"psid"
+"psd0"
+"psd1"
+"psd2"
+"psd3"
+"ps2s"
+"ps2i"
+"rXYZ"
+"rXYZ"
+"rTRC"
+"rig2"
+"scrd"
+"scrn"
+"tech"
+"bfd "
+"vued"
+"view"
+"vcgt"
+"meta"
+
+# ICC Technology tag
+"dcam"
+"fscn"
+"rscn"
+"ijet"
+"twax"
+"epho"
+"esta"
+"dsub"
+"rpho"
+"fprn"
+"vidm"
+"vidc"
+"pjtv"
+"CRT "
+"PMD "
+"AMD "
+"KPCD"
+"imgs"
+"grav"
+"offs"
+"silk"
+"flex"
+"mpfs"
+"mpfr"
+"dmpc"
+"dcpj"
+
+# ICC Color spaces
+"XYZ "
+"Lab "
+"Luv "
+"YCbr"
+"Yxy "
+"RGB "
+"GRAY"
+"HSV "
+"HLS "
+"CMYK"
+"CMY "
+"MCH1"
+"MCH2"
+"MCH3"
+"MCH4"
+"MCH5"
+"MCH6"
+"MCH7"
+"MCH8"
+"MCH9"
+"MCHA"
+"MCHB"
+"MCHC"
+"MCHD"
+"MCHE"
+"MCHF"
+"nmcl"
+"1CLR"
+"2CLR"
+"3CLR"
+"4CLR"
+"5CLR"
+"6CLR"
+"7CLR"
+"8CLR"
+"9CLR"
+"ACLR"
+"BCLR"
+"CCLR"
+"DCLR"
+"ECLR"
+"FCLR"
+"LuvK"
+
+# ICC Profile Class
+"scnr"
+"mntr"
+"prtr"
+"link"
+"abst"
+"spac"
+"nmcl"
+
+# ICC Platforms
+"APPL"
+"MSFT"
+"SUNW"
+"SGI "
+"TGNT"
+"*nix"
+
+# Reference gamut
+"prmg"
+
+# For cmsSigColorimetricIntentImageStateTag
+"scoe"
+"sape"
+"fpce"
+"rhoc"
+"rpoc"
+
+# Multi process elements types
+"cvst"
+"matf"
+"clut"
+"bACS"
+"eACS"
+"l2x "
+"x2l "
+"ncl "
+"2 4 "
+"4 2 "
+"idn "
+"d2l "
+"l2d "
+"d2x "
+"x2d "
+
+# Types of CurveElements
+"parf"
+"samf"
+"curf"
+
+# Used in ResponseCurveType
+"StaA"
+"StaE"
+"StaI"
+"StaT"
+"StaM"
+"DN  "
+"DN P"
+"DNN "
+"DNNP"
+
diff --git a/chromium/pdf/pdfium/fuzzers/dicts/pdf_codec_jpeg.dict b/chromium/pdf/pdfium/fuzzers/dicts/pdf_codec_jpeg.dict
new file mode 100644
index 00000000000..15efede7630
--- /dev/null
+++ b/chromium/pdf/pdfium/fuzzers/dicts/pdf_codec_jpeg.dict
@@ -0,0 +1,22 @@
+#
+# AFL dictionary for JPEG images
+# ------------------------------
+#
+# Created by Michal Zalewski <lcamtuf@google.com>
+#
+
+header_jfif="JFIF\x00"
+header_jfxx="JFXX\x00"
+
+section_ffc0="\xff\xc0"
+section_ffc2="\xff\xc2"
+section_ffc4="\xff\xc4"
+section_ffd0="\xff\xd0"
+section_ffd8="\xff\xd8"
+section_ffd9="\xff\xd9"
+section_ffda="\xff\xda"
+section_ffdb="\xff\xdb"
+section_ffdd="\xff\xdd"
+section_ffe0="\xff\xe0"
+section_ffe1="\xff\xe1"
+section_fffe="\xff\xfe"
diff --git a/chromium/pdf/pdfium/fuzzers/dicts/pdf_codec_png.dict b/chromium/pdf/pdfium/fuzzers/dicts/pdf_codec_png.dict
new file mode 100644
index 00000000000..ea12d19e6ec
--- /dev/null
+++ b/chromium/pdf/pdfium/fuzzers/dicts/pdf_codec_png.dict
@@ -0,0 +1,38 @@
+#
+# AFL dictionary for PNG images
+# -----------------------------
+#
+# Just the basic, standard-originating sections; does not include vendor
+# extensions.
+#
+# Created by Michal Zalewski <lcamtuf@google.com>
+#
+
+header_png="\x89PNG\x0d\x0a\x1a\x0a"
+
+section_IDAT="IDAT"
+section_IEND="IEND"
+section_IHDR="IHDR"
+section_PLTE="PLTE"
+section_bKGD="bKGD"
+section_cHRM="cHRM"
+section_fRAc="fRAc"
+section_gAMA="gAMA"
+section_gIFg="gIFg"
+section_gIFt="gIFt"
+section_gIFx="gIFx"
+section_hIST="hIST"
+section_iCCP="iCCP"
+section_iTXt="iTXt"
+section_oFFs="oFFs"
+section_pCAL="pCAL"
+section_pHYs="pHYs"
+section_sBIT="sBIT"
+section_sCAL="sCAL"
+section_sPLT="sPLT"
+section_sRGB="sRGB"
+section_sTER="sTER"
+section_tEXt="tEXt"
+section_tIME="tIME"
+section_tRNS="tRNS"
+section_zTXt="zTXt"
diff --git a/chromium/pdf/pdfium/fuzzers/dicts/pdf_codec_tiff.dict b/chromium/pdf/pdfium/fuzzers/dicts/pdf_codec_tiff.dict
new file mode 100644
index 00000000000..8f04b5af1ba
--- /dev/null
+++ b/chromium/pdf/pdfium/fuzzers/dicts/pdf_codec_tiff.dict
@@ -0,0 +1,51 @@
+#
+# AFL dictionary for TIFF images
+# ------------------------------
+#
+# Just the basic, standard-originating sections; does not include vendor
+# extensions.
+#
+# Created by Michal Zalewski <lcamtuf@google.com>
+#
+
+header_ii="II*\x00"
+header_mm="MM\x00*"
+
+section_100="\x00\x01"
+section_101="\x01\x01"
+section_102="\x02\x01"
+section_103="\x03\x01"
+section_106="\x06\x01"
+section_107="\x07\x01"
+section_10D="\x0d\x01"
+section_10E="\x0e\x01"
+section_10F="\x0f\x01"
+section_110="\x10\x01"
+section_111="\x11\x01"
+section_112="\x12\x01"
+section_115="\x15\x01"
+section_116="\x16\x01"
+section_117="\x17\x01"
+section_11A="\x1a\x01"
+section_11B="\x1b\x01"
+section_11C="\x1c\x01"
+section_11D="\x1d\x01"
+section_11E="\x1e\x01"
+section_11F="\x1f\x01"
+section_122="\"\x01"
+section_123="#\x01"
+section_124="$\x01"
+section_125="%\x01"
+section_128="(\x01"
+section_129=")\x01"
+section_12D="-\x01"
+section_131="1\x01"
+section_132="2\x01"
+section_13B=";\x01"
+section_13C="<\x01"
+section_13D="=\x01"
+section_13E=">\x01"
+section_13F="?\x01"
+section_140="@\x01"
+section_FE="\xfe\x00"
+section_FF="\xff\x00"
diff --git a/chromium/pdf/pdfium/pdfium_engine.cc b/chromium/pdf/pdfium/pdfium_engine.cc
index 05f73098ec7..878ee20a7c3 100644
--- a/chromium/pdf/pdfium/pdfium_engine.cc
+++ b/chromium/pdf/pdfium/pdfium_engine.cc
@@ -8,10 +8,11 @@
 #include <stddef.h>
 #include <stdint.h>
 
+#include <algorithm>
 #include <memory>
 #include <set>
 
-#include "base/i18n/icu_encoding_detection.h"
+#include "base/i18n/encoding_detection.h"
 #include "base/i18n/icu_string_conversions.h"
 #include "base/lazy_instance.h"
 #include "base/logging.h"
@@ -52,6 +53,7 @@
 #include "third_party/pdfium/public/fpdf_searchex.h"
 #include "third_party/pdfium/public/fpdf_sysfontinfo.h"
 #include "third_party/pdfium/public/fpdf_transformpage.h"
+#include "third_party/pdfium/public/fpdfview.h"
 #include "ui/events/keycodes/keyboard_codes.h"
 #include "ui/gfx/geometry/rect.h"
 #include "v8/include/v8.h"
@@ -452,7 +454,7 @@ pp::VarDictionary TraverseBookmarks(FPDF_DOCUMENT doc,
              FPDFBookmark_GetFirstChild(doc, bookmark);
          child_bookmark;
          child_bookmark = FPDFBookmark_GetNextSibling(doc, child_bookmark)) {
-      if (ContainsKey(seen_bookmarks, child_bookmark))
+      if (base::ContainsKey(seen_bookmarks, child_bookmark))
         break;
 
       seen_bookmarks.insert(child_bookmark);
@@ -549,6 +551,7 @@ PDFiumEngine::PDFiumEngine(PDFEngine::Client* client)
       most_visible_page_(-1),
       called_do_document_action_(false),
       render_grayscale_(false),
+      render_annots_(true),
       progressive_paint_timeout_(0),
       getting_password_(false) {
   find_factory_.Initialize(this);
@@ -587,7 +590,7 @@ PDFiumEngine::PDFiumEngine(PDFEngine::Client* client)
   FPDF_FORMFILLINFO::FFI_SetTextFieldFocus = Form_SetTextFieldFocus;
   FPDF_FORMFILLINFO::FFI_DoURIAction = Form_DoURIAction;
   FPDF_FORMFILLINFO::FFI_DoGoToAction = Form_DoGoToAction;
-#ifdef PDF_USE_XFA
+#if defined(PDF_ENABLE_XFA)
   FPDF_FORMFILLINFO::version = 2;
   FPDF_FORMFILLINFO::FFI_EmailTo = Form_EmailTo;
   FPDF_FORMFILLINFO::FFI_DisplayCaret = Form_DisplayCaret;
@@ -604,7 +607,7 @@ PDFiumEngine::PDFiumEngine(PDFEngine::Client* client)
   FPDF_FORMFILLINFO::FFI_OpenFile = Form_OpenFile;
   FPDF_FORMFILLINFO::FFI_GotoURL = Form_GotoURL;
   FPDF_FORMFILLINFO::FFI_GetLanguage = Form_GetLanguage;
-#endif  // PDF_USE_XFA
+#endif  // defined(PDF_ENABLE_XFA)
   IPDF_JSPLATFORM::version = 3;
   IPDF_JSPLATFORM::app_alert = Form_Alert;
   IPDF_JSPLATFORM::app_beep = Form_Beep;
@@ -635,7 +638,7 @@ PDFiumEngine::~PDFiumEngine() {
   if (doc_) {
     FORM_DoDocumentAAction(form_, FPDFDOC_AACTION_WC);
 
-#ifdef PDF_USE_XFA
+#if defined(PDF_ENABLE_XFA)
     // XFA may require |form_| to outlive |doc_|, so shut down in that order.
     FPDF_CloseDocument(doc_);
     FPDFDOC_ExitFormFillEnvironment(form_);
@@ -647,10 +650,10 @@ PDFiumEngine::~PDFiumEngine() {
   }
   FPDFAvail_Destroy(fpdf_availability_);
 
-  STLDeleteElements(&pages_);
+  base::STLDeleteElements(&pages_);
 }
 
-#ifdef PDF_USE_XFA
+#if defined(PDF_ENABLE_XFA)
 
 void PDFiumEngine::Form_EmailTo(FPDF_FORMFILLINFO* param,
                                 FPDF_FILEHANDLER* file_handler,
@@ -832,7 +835,7 @@ int PDFiumEngine::Form_GetLanguage(FPDF_FORMFILLINFO* param,
   return 0;
 }
 
-#endif  // PDF_USE_XFA
+#endif  // defined(PDF_ENABLE_XFA)
 
 int PDFiumEngine::GetBlock(void* param, unsigned long position,
                            unsigned char* buffer, unsigned long size) {
@@ -857,10 +860,10 @@ void PDFiumEngine::AddSegment(FX_DOWNLOADHINTS* param,
 bool PDFiumEngine::New(const char* url,
                        const char* headers) {
   url_ = url;
-  if (!headers)
-    headers_.clear();
-  else
+  if (headers)
     headers_ = headers;
+  else
+    headers_.clear();
   return true;
 }
 
@@ -1013,13 +1016,11 @@ void PDFiumEngine::AppendPage(PDFEngine* engine, int index) {
   client_->Invalidate(GetPageScreenRect(index));
 }
 
-pp::Point PDFiumEngine::GetScrollPosition() {
-  return position_;
-}
-
+#if defined(PDF_ENABLE_XFA)
 void PDFiumEngine::SetScrollPosition(const pp::Point& position) {
   position_ = position;
 }
+#endif
 
 bool PDFiumEngine::IsProgressiveLoad() {
   return doc_loader_.is_partial_document();
@@ -1127,7 +1128,7 @@ void PDFiumEngine::FinishLoadingDocument() {
 void PDFiumEngine::UnsupportedFeature(int type) {
   std::string feature;
   switch (type) {
-#ifndef PDF_USE_XFA
+#if !defined(PDF_ENABLE_XFA)
     case FPDF_UNSP_DOC_XFAFORM:
       feature = "XFA";
       break;
@@ -1527,8 +1528,11 @@ bool PDFiumEngine::OnMouseDown(const pp::MouseInputEvent& event) {
     selection_.clear();
     return true;
   }
-  if (event.GetButton() != PP_INPUTEVENT_MOUSEBUTTON_LEFT)
+
+  if (event.GetButton() != PP_INPUTEVENT_MOUSEBUTTON_LEFT &&
+      event.GetButton() != PP_INPUTEVENT_MOUSEBUTTON_MIDDLE) {
     return false;
+  }
 
   SelectionChangeInvalidator selection_invalidator(this);
   selection_.clear();
@@ -1546,6 +1550,10 @@ bool PDFiumEngine::OnMouseDown(const pp::MouseInputEvent& event) {
   if (area == PDFiumPage::WEBLINK_AREA)
     return true;
 
+  // Prevent middle mouse button from selecting texts.
+  if (event.GetButton() == PP_INPUTEVENT_MOUSEBUTTON_MIDDLE)
+    return false;
+
   if (area == PDFiumPage::DOCLINK_AREA) {
     client_->ScrollToPage(target.page);
     client_->FormTextFieldFocusChange(false);
@@ -1563,7 +1571,7 @@ bool PDFiumEngine::OnMouseDown(const pp::MouseInputEvent& event) {
       mouse_down_state_.Set(PDFiumPage::NONSELECTABLE_AREA, target);
       bool is_valid_control = (form_type == FPDF_FORMFIELD_TEXTFIELD ||
                                form_type == FPDF_FORMFIELD_COMBOBOX);
-#ifdef PDF_USE_XFA
+#if defined(PDF_ENABLE_XFA)
       is_valid_control |= (form_type == FPDF_FORMFIELD_XFA);
 #endif
       client_->FormTextFieldFocusChange(is_valid_control);
@@ -1620,8 +1628,10 @@ void PDFiumEngine::OnMultipleClick(int click_count,
 }
 
 bool PDFiumEngine::OnMouseUp(const pp::MouseInputEvent& event) {
-  if (event.GetButton() != PP_INPUTEVENT_MOUSEBUTTON_LEFT)
+  if (event.GetButton() != PP_INPUTEVENT_MOUSEBUTTON_LEFT &&
+      event.GetButton() != PP_INPUTEVENT_MOUSEBUTTON_MIDDLE) {
     return false;
+  }
 
   int page_index = -1;
   int char_index = -1;
@@ -1633,13 +1643,28 @@ bool PDFiumEngine::OnMouseUp(const pp::MouseInputEvent& event) {
   // Open link on mouse up for same link for which mouse down happened earlier.
   if (mouse_down_state_.Matches(area, target)) {
     if (area == PDFiumPage::WEBLINK_AREA) {
-      bool open_in_new_tab = !!(event.GetModifiers() & kDefaultKeyModifier);
-      client_->NavigateTo(target.url, open_in_new_tab);
+      uint32_t modifiers = event.GetModifiers();
+      bool middle_button =
+          !!(modifiers & PP_INPUTEVENT_MODIFIER_MIDDLEBUTTONDOWN);
+      bool alt_key = !!(modifiers & PP_INPUTEVENT_MODIFIER_ALTKEY);
+      bool ctrl_key = !!(modifiers & PP_INPUTEVENT_MODIFIER_CONTROLKEY);
+      bool meta_key = !!(modifiers & PP_INPUTEVENT_MODIFIER_METAKEY);
+      bool shift_key = !!(modifiers & PP_INPUTEVENT_MODIFIER_SHIFTKEY);
+
+      WindowOpenDisposition disposition =
+          ui::DispositionFromClick(middle_button, alt_key, ctrl_key, meta_key,
+                                   shift_key);
+
+      client_->NavigateTo(target.url, disposition);
       client_->FormTextFieldFocusChange(false);
       return true;
     }
   }
 
+  // Prevent middle mouse button from selecting texts.
+  if (event.GetButton() == PP_INPUTEVENT_MOUSEBUTTON_MIDDLE)
+    return false;
+
   if (page_index != -1) {
     double page_x, page_y;
     pp::Point point = event.GetPosition();
@@ -1706,7 +1731,6 @@ bool PDFiumEngine::OnMouseMove(const pp::MouseInputEvent& event) {
     }
 
     client_->UpdateCursor(cursor);
-    pp::Point point = event.GetPosition();
     std::string url = GetLinkAtPosition(event.GetPosition());
     if (url != link_under_cursor_) {
       link_under_cursor_ = url;
@@ -2260,7 +2284,16 @@ int PDFiumEngine::GetNamedDestinationPage(const std::string& destination) {
 }
 
 int PDFiumEngine::GetMostVisiblePage() {
+  if (in_flight_visible_page_)
+    return *in_flight_visible_page_;
+
+  // We can call GetMostVisiblePage through a callback from PDFium. We have
+  // to defer the page deletion otherwise we could potentially delete the page
+  // that originated the calling JS request and destroy the objects that are
+  // currently being used.
+  defer_page_unload_ = true;
   CalculateVisiblePages();
+  defer_page_unload_ = false;
   return most_visible_page_;
 }
 
@@ -2279,6 +2312,10 @@ pp::Rect PDFiumEngine::GetPageContentsRect(int index) {
   return GetScreenRect(pages_[index]->rect());
 }
 
+int PDFiumEngine::GetVerticalScrollbarYPosition() {
+  return position_.y();
+}
+
 void PDFiumEngine::SetGrayscale(bool grayscale) {
   render_grayscale_ = grayscale;
 }
@@ -2511,7 +2548,7 @@ void PDFiumEngine::ContinueLoadingDocument(const std::string& password) {
 
     form_ = FPDFDOC_InitFormFillEnvironment(
         doc_, static_cast<FPDF_FORMFILLINFO*>(this));
-#ifdef PDF_USE_XFA
+#if defined(PDF_ENABLE_XFA)
     FPDF_LoadXFA(doc_);
 #endif
 
@@ -2647,7 +2684,12 @@ void PDFiumEngine::CalculateVisiblePages() {
 }
 
 bool PDFiumEngine::IsPageVisible(int index) const {
-  return ContainsValue(visible_pages_, index);
+  return base::ContainsValue(visible_pages_, index);
+}
+
+void PDFiumEngine::ScrollToPage(int page) {
+  in_flight_visible_page_ = page;
+  client_->ScrollToPage(page);
 }
 
 bool PDFiumEngine::CheckPageAvailable(int index, std::vector<int>* pending) {
@@ -2659,7 +2701,7 @@ bool PDFiumEngine::CheckPageAvailable(int index, std::vector<int>* pending) {
     return true;
 
   if (!FPDFAvail_IsPageAvail(fpdf_availability_, index, &download_hints_)) {
-    if (!ContainsValue(*pending, index))
+    if (!base::ContainsValue(*pending, index))
       pending->push_back(index);
     return false;
   }
@@ -2951,6 +2993,8 @@ int PDFiumEngine::GetRenderingFlags() const {
     flags |= FPDF_GRAYSCALE;
   if (client_->IsPrintPreview())
     flags |= FPDF_PRINTING;
+  if (render_annots_)
+    flags |= FPDF_ANNOT;
   return flags;
 }
 
@@ -3137,9 +3181,9 @@ void PDFiumEngine::DeviceToPage(int page_index,
                                 double* page_x,
                                 double* page_y) {
   *page_x = *page_y = 0;
-  int temp_x = static_cast<int>((device_x + position_.x())/ current_zoom_ -
+  int temp_x = static_cast<int>((device_x + position_.x()) / current_zoom_ -
       pages_[page_index]->rect().x());
-  int temp_y = static_cast<int>((device_y + position_.y())/ current_zoom_ -
+  int temp_y = static_cast<int>((device_y + position_.y()) / current_zoom_ -
       pages_[page_index]->rect().y());
   FPDF_DeviceToPage(
       pages_[page_index]->GetPage(), 0, 0,
@@ -3156,8 +3200,11 @@ int PDFiumEngine::GetVisiblePageIndex(FPDF_PAGE page) {
 }
 
 void PDFiumEngine::SetCurrentPage(int index) {
+  in_flight_visible_page_.reset();
+
   if (index == most_visible_page_ || !form_)
     return;
+
   if (most_visible_page_ != -1 && called_do_document_action_) {
     FPDF_PAGE old_page = pages_[most_visible_page_]->GetPage();
     FORM_DoPageAAction(old_page, form_, FPDFPAGE_AACTION_CLOSE);
@@ -3339,13 +3386,22 @@ void PDFiumEngine::RotateInternal() {
   else
     resume_find_index_.Invalidate();
 
+  // Save the current page.
+  int most_visible_page = most_visible_page_;
+
   InvalidateAllPages();
 
+  // Restore find results.
   if (!current_find_text.empty()) {
     // Clear the UI.
     client_->NotifyNumberOfFindResultsChanged(0, false);
     StartFind(current_find_text, false);
   }
+
+  // Restore current page. After a rotation, the page heights have changed but
+  // the scroll position has not. Re-adjust.
+  // TODO(thestig): It would be better to also restore the position on the page.
+  client_->ScrollToPage(most_visible_page);
 }
 
 void PDFiumEngine::SetSelecting(bool selecting) {
@@ -3489,13 +3545,13 @@ void PDFiumEngine::Form_ExecuteNamedAction(FPDF_FORMFILLINFO* param,
   // Reader supports more, like FitWidth, but since they're not part of the spec
   // and we haven't got bugs about them, no need to now.
   if (action == "NextPage") {
-    engine->client_->ScrollToPage(index + 1);
+    engine->ScrollToPage(index + 1);
   } else if (action == "PrevPage") {
-    engine->client_->ScrollToPage(index - 1);
+    engine->ScrollToPage(index - 1);
   } else if (action == "FirstPage") {
-    engine->client_->ScrollToPage(0);
+    engine->ScrollToPage(0);
   } else if (action == "LastPage") {
-    engine->client_->ScrollToPage(engine->pages_.size() - 1);
+    engine->ScrollToPage(engine->pages_.size() - 1);
   }
 }
 
@@ -3510,7 +3566,8 @@ void PDFiumEngine::Form_SetTextFieldFocus(FPDF_FORMFILLINFO* param,
 void PDFiumEngine::Form_DoURIAction(FPDF_FORMFILLINFO* param,
                                     FPDF_BYTESTRING uri) {
   PDFiumEngine* engine = static_cast<PDFiumEngine*>(param);
-  engine->client_->NavigateTo(std::string(uri), false);
+  engine->client_->NavigateTo(std::string(uri),
+                              WindowOpenDisposition::CURRENT_TAB);
 }
 
 void PDFiumEngine::Form_DoGoToAction(FPDF_FORMFILLINFO* param,
@@ -3519,7 +3576,7 @@ void PDFiumEngine::Form_DoGoToAction(FPDF_FORMFILLINFO* param,
                                      float* position_array,
                                      int size_of_array) {
   PDFiumEngine* engine = static_cast<PDFiumEngine*>(param);
-  engine->client_->ScrollToPage(page_index);
+  engine->ScrollToPage(page_index);
 }
 
 int PDFiumEngine::Form_Alert(IPDF_JSPLATFORM* param,
@@ -3648,7 +3705,7 @@ void PDFiumEngine::Form_SubmitForm(IPDF_JSPLATFORM* param,
 void PDFiumEngine::Form_GotoPage(IPDF_JSPLATFORM* param,
                                  int page_number) {
   PDFiumEngine* engine = static_cast<PDFiumEngine*>(param);
-  engine->client_->ScrollToPage(page_number);
+  engine->ScrollToPage(page_number);
 }
 
 int PDFiumEngine::Form_Browse(IPDF_JSPLATFORM* param,
@@ -3668,8 +3725,8 @@ FPDF_BOOL PDFiumEngine::Pause_NeedToPauseNow(IFSDK_PAUSE* param) {
 }
 
 ScopedUnsupportedFeature::ScopedUnsupportedFeature(PDFiumEngine* engine)
-    : engine_(engine), old_engine_(g_engine_for_unsupported) {
-  g_engine_for_unsupported = engine_;
+    : old_engine_(g_engine_for_unsupported) {
+  g_engine_for_unsupported = engine;
 }
 
 ScopedUnsupportedFeature::~ScopedUnsupportedFeature() {
@@ -3746,6 +3803,26 @@ int CalculatePosition(FPDF_PAGE page,
 
 }  // namespace
 
+PDFEngineExports::RenderingSettings::RenderingSettings(int dpi_x,
+                                                       int dpi_y,
+                                                       const pp::Rect& bounds,
+                                                       bool fit_to_bounds,
+                                                       bool stretch_to_bounds,
+                                                       bool keep_aspect_ratio,
+                                                       bool center_in_bounds,
+                                                       bool autorotate)
+    : dpi_x(dpi_x),
+      dpi_y(dpi_y),
+      bounds(bounds),
+      fit_to_bounds(fit_to_bounds),
+      stretch_to_bounds(stretch_to_bounds),
+      keep_aspect_ratio(keep_aspect_ratio),
+      center_in_bounds(center_in_bounds),
+      autorotate(autorotate) {}
+
+PDFEngineExports::RenderingSettings::RenderingSettings(
+    const RenderingSettings& that) = default;
+
 PDFEngineExports* PDFEngineExports::Get() {
   return g_pdf_engine_exports.Pointer();
 }
@@ -3820,6 +3897,16 @@ bool PDFiumEngineExports::RenderPDFPageToDC(const void* pdf_buffer,
   FPDF_CloseDocument(doc);
   return true;
 }
+
+void PDFiumEngineExports::SetPDFEnsureTypefaceCharactersAccessible(
+    PDFEnsureTypefaceCharactersAccessible func) {
+  FPDF_SetTypefaceAccessibleFunc(
+      reinterpret_cast<PDFiumEnsureTypefaceCharactersAccessible>(func));
+}
+
+void PDFiumEngineExports::SetPDFUseGDIPrinting(bool enable) {
+  FPDF_SetPrintTextWithGDI(enable);
+}
 #endif  // defined(OS_WIN)
 
 bool PDFiumEngineExports::RenderPDFPageToBitmap(
diff --git a/chromium/pdf/pdfium/pdfium_engine.h b/chromium/pdf/pdfium/pdfium_engine.h
index e6392b4a482..07c15b56e86 100644
--- a/chromium/pdf/pdfium/pdfium_engine.h
+++ b/chromium/pdf/pdfium/pdfium_engine.h
@@ -15,6 +15,7 @@
 #include <vector>
 
 #include "base/macros.h"
+#include "base/optional.h"
 #include "base/time/time.h"
 #include "pdf/document_loader.h"
 #include "pdf/pdf_engine.h"
@@ -87,7 +88,7 @@ class PDFiumEngine : public PDFEngine,
   pp::Rect GetPageBoundsRect(int index) override;
   pp::Rect GetPageContentsRect(int index) override;
   pp::Rect GetPageScreenRect(int page_index) const override;
-  int GetVerticalScrollbarYPosition() override { return position_.y(); }
+  int GetVerticalScrollbarYPosition() override;
   void SetGrayscale(bool grayscale) override;
   void OnCallback(int id) override;
   int GetCharCount(int page_index) override;
@@ -104,8 +105,9 @@ class PDFiumEngine : public PDFEngine,
   bool GetPageSizeAndUniformity(pp::Size* size) override;
   void AppendBlankPages(int num_pages) override;
   void AppendPage(PDFEngine* engine, int index) override;
-  pp::Point GetScrollPosition() override;
+#if defined(PDF_ENABLE_XFA)
   void SetScrollPosition(const pp::Point& position) override;
+#endif
   bool IsProgressiveLoad() override;
   std::string GetMetadata(const std::string& key) override;
 
@@ -248,6 +250,11 @@ class PDFiumEngine : public PDFEngine,
   // must have been called first.
   bool IsPageVisible(int index) const;
 
+  // Internal interface that caches the page index requested by PDFium to get
+  // scrolled to. The cache is to be be used during the interval the PDF
+  // plugin has not finished handling the scroll request.
+  void ScrollToPage(int page);
+
   // Checks if a page is now available, and if so marks it as such and returns
   // true.  Otherwise, it will return false and will add the index to the given
   // array if it's not already there.
@@ -513,7 +520,7 @@ class PDFiumEngine : public PDFEngine,
   static void Form_GotoPage(IPDF_JSPLATFORM* param, int page_number);
   static int Form_Browse(IPDF_JSPLATFORM* param, void* file_path, int length);
 
-#ifdef PDF_USE_XFA
+#if defined(PDF_ENABLE_XFA)
   static void Form_EmailTo(FPDF_FORMFILLINFO* param,
                            FPDF_FILEHANDLER* file_handler,
                            FPDF_WIDESTRING to,
@@ -575,7 +582,7 @@ class PDFiumEngine : public PDFEngine,
   static int Form_GetLanguage(FPDF_FORMFILLINFO* param,
                               void* language,
                               int length);
-#endif  // PDF_USE_XFA
+#endif  // defined(PDF_ENABLE_XFA)
 
   // IFSDK_PAUSE callbacks
   static FPDF_BOOL Pause_NeedToPauseNow(IFSDK_PAUSE* param);
@@ -670,13 +677,17 @@ class PDFiumEngine : public PDFEngine,
   std::map<int, std::pair<int, TimerCallback> > timers_;
   int next_timer_id_;
 
-  // Holds the page index of the last page that the mouse clicked on.
+  // Holds the zero-based page index of the last page that the mouse clicked on.
   int last_page_mouse_down_;
 
-  // Holds the page index of the most visible page; refreshed by calling
-  // CalculateVisiblePages()
+  // Holds the zero-based page index of the most visible page; refreshed by
+  // calling CalculateVisiblePages()
   int most_visible_page_;
 
+  // Holds the page index requested by PDFium while the scroll operation
+  // is being handled (asynchronously).
+  base::Optional<int> in_flight_visible_page_;
+
   // Set to true after FORM_DoDocumentJSAction/FORM_DoDocumentOpenAction have
   // been called. Only after that can we call FORM_DoPageAAction.
   bool called_do_document_action_;
@@ -688,6 +699,9 @@ class PDFiumEngine : public PDFEngine,
   // Whether to render in grayscale or in color.
   bool render_grayscale_;
 
+  // Whether to render PDF annotations.
+  bool render_annots_;
+
   // The link currently under the cursor.
   std::string link_under_cursor_;
 
@@ -725,9 +739,9 @@ class ScopedUnsupportedFeature {
  public:
   explicit ScopedUnsupportedFeature(PDFiumEngine* engine);
   ~ScopedUnsupportedFeature();
+
  private:
-  PDFiumEngine* engine_;
-  PDFiumEngine* old_engine_;
+  PDFiumEngine* const old_engine_;
 };
 
 class PDFiumEngineExports : public PDFEngineExports {
@@ -741,6 +755,10 @@ class PDFiumEngineExports : public PDFEngineExports {
                          int page_number,
                          const RenderingSettings& settings,
                          HDC dc) override;
+  void SetPDFEnsureTypefaceCharactersAccessible(
+      PDFEnsureTypefaceCharactersAccessible func) override;
+
+  void SetPDFUseGDIPrinting(bool enable) override;
 #endif  // defined(OS_WIN)
   bool RenderPDFPageToBitmap(const void* pdf_buffer,
                              int pdf_buffer_size,
diff --git a/chromium/pdf/pdfium/pdfium_page.cc b/chromium/pdf/pdfium/pdfium_page.cc
index e95296986d8..45724eedcd0 100644
--- a/chromium/pdf/pdfium/pdfium_page.cc
+++ b/chromium/pdf/pdfium/pdfium_page.cc
@@ -12,6 +12,7 @@
 #include <utility>
 
 #include "base/logging.h"
+#include "base/numerics/safe_math.h"
 #include "base/strings/string_number_conversions.h"
 #include "base/strings/string_util.h"
 #include "base/strings/utf_string_conversions.h"
@@ -82,14 +83,15 @@ PDFiumPage::PDFiumPage(PDFiumEngine* engine,
                        const pp::Rect& r,
                        bool available)
     : engine_(engine),
-      page_(NULL),
-      text_page_(NULL),
+      page_(nullptr),
+      text_page_(nullptr),
       index_(i),
       loading_count_(0),
       rect_(r),
       calculated_links_(false),
-      available_(available) {
-}
+      available_(available) {}
+
+PDFiumPage::PDFiumPage(const PDFiumPage& that) = default;
 
 PDFiumPage::~PDFiumPage() {
   DCHECK_EQ(0, loading_count_);
@@ -102,7 +104,7 @@ void PDFiumPage::Unload() {
 
   if (text_page_) {
     FPDFText_ClosePage(text_page_);
-    text_page_ = NULL;
+    text_page_ = nullptr;
   }
 
   if (page_) {
@@ -110,14 +112,14 @@ void PDFiumPage::Unload() {
       FORM_OnBeforeClosePage(page_, engine_->form());
     }
     FPDF_ClosePage(page_);
-    page_ = NULL;
+    page_ = nullptr;
   }
 }
 
 FPDF_PAGE PDFiumPage::GetPage() {
   ScopedUnsupportedFeature scoped_unsupported_feature(engine_);
   if (!available_)
-    return NULL;
+    return nullptr;
   if (!page_) {
     ScopedLoadCounter scoped_load(this);
     page_ = FPDF_LoadPage(engine_->doc(), index_);
@@ -131,7 +133,7 @@ FPDF_PAGE PDFiumPage::GetPage() {
 FPDF_PAGE PDFiumPage::GetPrintPage() {
   ScopedUnsupportedFeature scoped_unsupported_feature(engine_);
   if (!available_)
-    return NULL;
+    return nullptr;
   if (!page_) {
     ScopedLoadCounter scoped_load(this);
     page_ = FPDF_LoadPage(engine_->doc(), index_);
@@ -146,13 +148,13 @@ void PDFiumPage::ClosePrintPage() {
 
   if (page_) {
     FPDF_ClosePage(page_);
-    page_ = NULL;
+    page_ = nullptr;
   }
 }
 
 FPDF_TEXTPAGE PDFiumPage::GetTextPage() {
   if (!available_)
-    return NULL;
+    return nullptr;
   if (!text_page_) {
     ScopedLoadCounter scoped_load(this);
     text_page_ = FPDFText_LoadPage(GetPage());
@@ -319,7 +321,7 @@ PDFiumPage::Area PDFiumPage::GetLinkTarget(
       case PDFACTION_URI: {
           if (target) {
             size_t buffer_size =
-                FPDFAction_GetURIPath(engine_->doc(), action, NULL, 0);
+                FPDFAction_GetURIPath(engine_->doc(), action, nullptr, 0);
             if (buffer_size > 0) {
               PDFiumAPIStringBufferAdapter<std::string> api_string_adapter(
                   &target->url, buffer_size, true);
@@ -403,7 +405,7 @@ void PDFiumPage::CalculateLinks() {
   int count = FPDFLink_CountWebLinks(links);
   for (int i = 0; i < count; ++i) {
     base::string16 url;
-    int url_length = FPDFLink_GetURL(links, i, NULL, 0);
+    int url_length = FPDFLink_GetURL(links, i, nullptr, 0);
     if (url_length > 0) {
       PDFiumAPIStringBufferAdapter<base::string16> api_string_adapter(
           &url, url_length, true);
@@ -460,21 +462,29 @@ pp::Rect PDFiumPage::PageToScreen(const pp::Point& offset,
   if (!available_)
     return pp::Rect();
 
-  int new_left, new_top, new_right, new_bottom;
-  FPDF_PageToDevice(
-      page_,
-      static_cast<int>((rect_.x() - offset.x()) * zoom),
-      static_cast<int>((rect_.y() - offset.y()) * zoom),
-      static_cast<int>(ceil(rect_.width() * zoom)),
-      static_cast<int>(ceil(rect_.height() * zoom)),
-      rotation, left, top, &new_left, &new_top);
-  FPDF_PageToDevice(
-      page_,
-      static_cast<int>((rect_.x() - offset.x()) * zoom),
-      static_cast<int>((rect_.y() - offset.y()) * zoom),
-      static_cast<int>(ceil(rect_.width() * zoom)),
-      static_cast<int>(ceil(rect_.height() * zoom)),
-      rotation, right, bottom, &new_right, &new_bottom);
+  double start_x = (rect_.x() - offset.x()) * zoom;
+  double start_y = (rect_.y() - offset.y()) * zoom;
+  double size_x = rect_.width() * zoom;
+  double size_y = rect_.height() * zoom;
+  if (!base::IsValueInRangeForNumericType<int>(start_x) ||
+      !base::IsValueInRangeForNumericType<int>(start_y) ||
+      !base::IsValueInRangeForNumericType<int>(size_x) ||
+      !base::IsValueInRangeForNumericType<int>(size_y)) {
+    return pp::Rect();
+  }
+
+  int new_left;
+  int new_top;
+  int new_right;
+  int new_bottom;
+  FPDF_PageToDevice(page_, static_cast<int>(start_x), static_cast<int>(start_y),
+                    static_cast<int>(ceil(size_x)),
+                    static_cast<int>(ceil(size_y)), rotation, left, top,
+                    &new_left, &new_top);
+  FPDF_PageToDevice(page_, static_cast<int>(start_x), static_cast<int>(start_y),
+                    static_cast<int>(ceil(size_x)),
+                    static_cast<int>(ceil(size_y)), rotation, right, bottom,
+                    &new_right, &new_bottom);
 
   // If the PDF is rotated, the horizontal/vertical coordinates could be
   // flipped.  See
@@ -484,8 +494,17 @@ pp::Rect PDFiumPage::PageToScreen(const pp::Point& offset,
   if (new_bottom < new_top)
     std::swap(new_bottom, new_top);
 
-  return pp::Rect(
-      new_left, new_top, new_right - new_left + 1, new_bottom - new_top + 1);
+  base::CheckedNumeric<int32_t> new_size_x = new_right;
+  new_size_x -= new_left;
+  new_size_x += 1;
+  base::CheckedNumeric<int32_t> new_size_y = new_bottom;
+  new_size_y -= new_top;
+  new_size_y += 1;
+  if (!new_size_x.IsValid() || !new_size_y.IsValid())
+    return pp::Rect();
+
+  return pp::Rect(new_left, new_top, new_size_x.ValueOrDie(),
+                  new_size_y.ValueOrDie());
 }
 
 PDFiumPage::ScopedLoadCounter::ScopedLoadCounter(PDFiumPage* page)
@@ -497,10 +516,10 @@ PDFiumPage::ScopedLoadCounter::~ScopedLoadCounter() {
   page_->loading_count_--;
 }
 
-PDFiumPage::Link::Link() {
-}
+PDFiumPage::Link::Link() = default;
 
-PDFiumPage::Link::~Link() {
-}
+PDFiumPage::Link::Link(const Link& that) = default;
+
+PDFiumPage::Link::~Link() = default;
 
 }  // namespace chrome_pdf
diff --git a/chromium/pdf/pdfium/pdfium_page.h b/chromium/pdf/pdfium/pdfium_page.h
index fa94ed96a08..169b25a370a 100644
--- a/chromium/pdf/pdfium/pdfium_page.h
+++ b/chromium/pdf/pdfium/pdfium_page.h
@@ -25,6 +25,7 @@ class PDFiumPage {
              int i,
              const pp::Rect& r,
              bool available);
+  PDFiumPage(const PDFiumPage& that);
   ~PDFiumPage();
 
   // Unloads the PDFium data for this page from memory.
@@ -123,6 +124,7 @@ class PDFiumPage {
 
   struct Link {
     Link();
+    Link(const Link& that);
     ~Link();
 
     std::string url;
diff --git a/chromium/pdf/pdfium/pdfium_range.cc b/chromium/pdf/pdfium/pdfium_range.cc
index 3b8371f7f6c..398002959b8 100644
--- a/chromium/pdf/pdfium/pdfium_range.cc
+++ b/chromium/pdf/pdfium/pdfium_range.cc
@@ -17,8 +17,9 @@ PDFiumRange::PDFiumRange(PDFiumPage* page, int char_index, int char_count)
       cached_screen_rects_zoom_(0) {
 }
 
-PDFiumRange::~PDFiumRange() {
-}
+PDFiumRange::PDFiumRange(const PDFiumRange& that) = default;
+
+PDFiumRange::~PDFiumRange() = default;
 
 void PDFiumRange::SetCharCount(int char_count) {
   char_count_ = char_count;
diff --git a/chromium/pdf/pdfium/pdfium_range.h b/chromium/pdf/pdfium/pdfium_range.h
index a0f9ea13db8..6465848f4d3 100644
--- a/chromium/pdf/pdfium/pdfium_range.h
+++ b/chromium/pdf/pdfium/pdfium_range.h
@@ -18,6 +18,7 @@ namespace chrome_pdf {
 class PDFiumRange {
  public:
   PDFiumRange(PDFiumPage* page, int char_index, int char_count);
+  PDFiumRange(const PDFiumRange& that);
   ~PDFiumRange();
 
   // Update how many characters are in the selection.  Could be negative if
diff --git a/chromium/pdf/preview_mode_client.cc b/chromium/pdf/preview_mode_client.cc
index f1c3e4a4ff0..a371b08b591 100644
--- a/chromium/pdf/preview_mode_client.cc
+++ b/chromium/pdf/preview_mode_client.cc
@@ -38,7 +38,7 @@ void PreviewModeClient::ScrollToPage(int page) {
 }
 
 void PreviewModeClient::NavigateTo(const std::string& url,
-                                   bool open_in_new_tab) {
+                                   WindowOpenDisposition disposition) {
   NOTREACHED();
 }
 
diff --git a/chromium/pdf/preview_mode_client.h b/chromium/pdf/preview_mode_client.h
index 0127db9a3a5..6eda5f0d40c 100644
--- a/chromium/pdf/preview_mode_client.h
+++ b/chromium/pdf/preview_mode_client.h
@@ -33,7 +33,8 @@ class PreviewModeClient : public PDFEngine::Client {
   void ScrollToX(int position) override;
   void ScrollToY(int position) override;
   void ScrollToPage(int page) override;
-  void NavigateTo(const std::string& url, bool open_in_new_tab) override;
+  void NavigateTo(const std::string& url,
+                  WindowOpenDisposition disposition) override;
   void UpdateCursor(PP_CursorType_Dev cursor) override;
   void UpdateTickMarks(const std::vector<pp::Rect>& tickmarks) override;
   void NotifyNumberOfFindResultsChanged(int total, bool final_result) override;