BASELINE: Update Chromium to 53.0.2785.41

Also adds a few extra files for extensions.

Change-Id: Iccdd55d98660903331cf8b7b29188da781830af4
Reviewed-by: Michael Brüning <michael.bruning@qt.io>

51 files changed, 804 insertions, 75 deletions

diff --git a/chromium/ppapi/BUILD.gn b/chromium/ppapi/BUILD.gn
index 856308aea65..a338feda5d0 100644
--- a/chromium/ppapi/BUILD.gn
+++ b/chromium/ppapi/BUILD.gn
@@ -194,10 +194,10 @@ test("ppapi_unittests") {
   ]
 
   deps = [
-    "//base/test:run_all_unittests",
     "//base/test:test_support",
     "//gpu/ipc/common:command_buffer_traits",
     "//ipc",
+    "//ipc:run_all_unittests",
     "//ipc:test_support",
     "//media:shared_memory_support",
     "//ppapi/host",
@@ -220,6 +220,7 @@ test("ppapi_perftests") {
 
   deps = [
     "//base/test:test_support",
+    "//mojo/edk/system",
     "//ppapi/proxy",
     "//ppapi/proxy:test_support",
     "//ppapi/shared_impl",
diff --git a/chromium/ppapi/c/private/ppb_pdf.h b/chromium/ppapi/c/private/ppb_pdf.h
index a4c49c3e114..da85c45bebe 100644
--- a/chromium/ppapi/c/private/ppb_pdf.h
+++ b/chromium/ppapi/c/private/ppb_pdf.h
@@ -9,6 +9,8 @@
 
 #include "ppapi/c/pp_bool.h"
 #include "ppapi/c/pp_instance.h"
+#include "ppapi/c/pp_point.h"
+#include "ppapi/c/pp_rect.h"
 #include "ppapi/c/pp_resource.h"
 #include "ppapi/c/pp_var.h"
 #include "ppapi/c/private/pp_private_font_charset.h"
@@ -31,6 +33,46 @@ struct PP_PrivateFindResult {
   int length;
 };
 
+struct PP_PrivateAccessibilityViewportInfo {
+  double zoom;
+  struct PP_Point scroll;
+  struct PP_Point offset;
+};
+
+struct PP_PrivateAccessibilityDocInfo {
+  uint32_t page_count;
+  PP_Bool text_accessible;
+  PP_Bool text_copyable;
+};
+
+typedef enum {
+  PP_PRIVATEDIRECTION_NONE = 0,
+  PP_PRIVATEDIRECTION_LTR = 1,
+  PP_PRIVATEDIRECTION_RTL = 2,
+  PP_PRIVATEDIRECTION_TTB = 3,
+  PP_PRIVATEDIRECTION_BTT = 4,
+  PP_PRIVATEDIRECTION_LAST = PP_PRIVATEDIRECTION_BTT
+} PP_PrivateDirection;
+
+struct PP_PrivateAccessibilityPageInfo {
+  uint32_t page_index;
+  struct PP_Rect bounds;
+  uint32_t text_run_count;
+  uint32_t char_count;
+};
+
+struct PP_PrivateAccessibilityTextRunInfo {
+  uint32_t len;
+  double font_size;
+  struct PP_FloatRect bounds;
+  PP_PrivateDirection direction;
+};
+
+struct PP_PrivateAccessibilityCharInfo {
+  uint32_t unicode_character;
+  double char_width;
+};
+
 struct PPB_PDF {
   // Returns a resource identifying a font file corresponding to the given font
   // request after applying the browser-specific fallback.
@@ -95,6 +137,26 @@ struct PPB_PDF {
                                     int* natives_size_out,
                                     const char** snapshot_data_out,
                                     int* snapshot_size_out);
+
+  // Sends information about the viewport to the renderer for accessibility
+  // support.
+  void (*SetAccessibilityViewportInfo)(
+      PP_Instance instance,
+      struct PP_PrivateAccessibilityViewportInfo* viewport_info);
+
+  // Sends information about the PDF document to the renderer for accessibility
+  // support.
+  void (*SetAccessibilityDocInfo)(
+      PP_Instance instance,
+      struct PP_PrivateAccessibilityDocInfo* doc_info);
+
+  // Sends information about one page in a PDF document to the renderer for
+  // accessibility support.
+  void (*SetAccessibilityPageInfo)(
+      PP_Instance instance,
+      struct PP_PrivateAccessibilityPageInfo* page_info,
+      struct PP_PrivateAccessibilityTextRunInfo text_runs[],
+      struct PP_PrivateAccessibilityCharInfo chars[]);
 };
 
 #endif  // PPAPI_C_PRIVATE_PPB_PDF_H_
diff --git a/chromium/ppapi/c/private/ppp_pdf.h b/chromium/ppapi/c/private/ppp_pdf.h
index 01c1ac5129c..4dc3e7c4023 100644
--- a/chromium/ppapi/c/private/ppp_pdf.h
+++ b/chromium/ppapi/c/private/ppp_pdf.h
@@ -63,6 +63,8 @@ struct PPP_Pdf_1_1 {
   PP_Bool (*GetPrintPresetOptionsFromDocument)(
       PP_Instance instance,
       PP_PdfPrintPresetOptions_Dev* options);
+
+  void (*EnableAccessibility)(PP_Instance instance);
 };
 
 typedef PPP_Pdf_1_1 PPP_Pdf;
diff --git a/chromium/ppapi/cpp/private/pdf.cc b/chromium/ppapi/cpp/private/pdf.cc
index 350d8700544..d314d47b3ef 100644
--- a/chromium/ppapi/cpp/private/pdf.cc
+++ b/chromium/ppapi/cpp/private/pdf.cc
@@ -152,4 +152,35 @@ void PDF::GetV8ExternalSnapshotData(const InstanceHandle& instance,
   *snapshot_size_out = 0;
 }
 
+// static
+void PDF::SetAccessibilityViewportInfo(
+    const InstanceHandle& instance,
+    PP_PrivateAccessibilityViewportInfo* viewport_info) {
+  if (has_interface<PPB_PDF>()) {
+    get_interface<PPB_PDF>()->SetAccessibilityViewportInfo(
+        instance.pp_instance(), viewport_info);
+  }
+}
+
+// static
+void PDF::SetAccessibilityDocInfo(const InstanceHandle& instance,
+                                  PP_PrivateAccessibilityDocInfo* doc_info) {
+  if (has_interface<PPB_PDF>()) {
+    get_interface<PPB_PDF>()->SetAccessibilityDocInfo(instance.pp_instance(),
+                                                      doc_info);
+  }
+}
+
+// static
+void PDF::SetAccessibilityPageInfo(
+    const InstanceHandle& instance,
+    PP_PrivateAccessibilityPageInfo* page_info,
+    PP_PrivateAccessibilityTextRunInfo text_runs[],
+    PP_PrivateAccessibilityCharInfo chars[]) {
+  if (has_interface<PPB_PDF>()) {
+    get_interface<PPB_PDF>()->SetAccessibilityPageInfo(
+        instance.pp_instance(), page_info, text_runs, chars);
+  }
+}
+
 }  // namespace pp
diff --git a/chromium/ppapi/cpp/private/pdf.h b/chromium/ppapi/cpp/private/pdf.h
index 755c9c32faa..3cd7aeb3911 100644
--- a/chromium/ppapi/cpp/private/pdf.h
+++ b/chromium/ppapi/cpp/private/pdf.h
@@ -58,6 +58,17 @@ class PDF {
                                         int* natives_size_out,
                                         const char** snapshot_data_out,
                                         int* snapshot_size_out);
+  static void SetAccessibilityViewportInfo(
+      const InstanceHandle& instance,
+      PP_PrivateAccessibilityViewportInfo* viewport_info);
+  static void SetAccessibilityDocInfo(
+      const InstanceHandle& instance,
+      PP_PrivateAccessibilityDocInfo* doc_info);
+  static void SetAccessibilityPageInfo(
+      const InstanceHandle& instance,
+      PP_PrivateAccessibilityPageInfo* page_info,
+      PP_PrivateAccessibilityTextRunInfo text_runs[],
+      PP_PrivateAccessibilityCharInfo chars[]);
 };
 
 }  // namespace pp
diff --git a/chromium/ppapi/host/resource_message_filter_unittest.cc b/chromium/ppapi/host/resource_message_filter_unittest.cc
index f376a810a6d..951c6bf0837 100644
--- a/chromium/ppapi/host/resource_message_filter_unittest.cc
+++ b/chromium/ppapi/host/resource_message_filter_unittest.cc
@@ -22,7 +22,9 @@ namespace ppapi {
 namespace host {
 namespace {
 
-base::WaitableEvent g_handler_completion(true, false);
+base::WaitableEvent g_handler_completion(
+    base::WaitableEvent::ResetPolicy::MANUAL,
+    base::WaitableEvent::InitialState::NOT_SIGNALED);
 
 enum TestMessageTypes {
   MSG1_TYPE = 1,
diff --git a/chromium/ppapi/lib/gl/include/GLES2/gl2ext.h b/chromium/ppapi/lib/gl/include/GLES2/gl2ext.h
index 130eea20a8a..f222543bf6e 100644
--- a/chromium/ppapi/lib/gl/include/GLES2/gl2ext.h
+++ b/chromium/ppapi/lib/gl/include/GLES2/gl2ext.h
@@ -1894,25 +1894,6 @@ typedef void (GL_APIENTRYP PFNGLGETTRANSLATEDSHADERSOURCEANGLEPROC) (GLuint shad
 #endif
 #endif
 
-/* GL_CHROMIUM_iosurface */
-/* Exposes the Mac OS-specfic CGLTexImageIOSurface2D entry point as a
- * Chromium extension in the cross-platform API. Binds the IOSurface with
- * the given ID (an IOSurfaceID) to the texture bound to the given target.
- * To avoid needing to expose extraneous enums, assumes internal format
- * RGBA, format BGRA, and type UNSIGNED_INT_8_8_8_8_REV.
- */
-#ifndef GL_CHROMIUM_iosurface
-#define GL_CHROMIUM_iosurface 1
-#ifdef GL_GLEXT_PROTOTYPES
-#define glTexImageIOSurface2DCHROMIUM GLES2_GET_FUN(TexImageIOSurface2DCHROMIUM)
-#if !defined(GLES2_USE_CPP_BINDINGS)
-GL_APICALL void GL_APIENTRY glTexImageIOSurface2DCHROMIUM (GLenum target, GLsizei width, GLsizei height, GLuint ioSurfaceId, GLuint plane);
-#endif
-#else
-typedef void (GL_APIENTRYP PFNGLTEXIMAGEIOSURFACE2DCHROMIUM) (GLenum target, GLsizei width, GLsizei height, GLuint ioSurfaceId, GLuint plane);
-#endif
-#endif
-
 /* GL_CHROMIUM_copy_texture */
 #ifndef GL_CHROMIUM_copy_texture
 #ifndef GL_UNPACK_PREMULTIPLY_ALPHA_CHROMIUM
diff --git a/chromium/ppapi/nacl_irt/DEPS b/chromium/ppapi/nacl_irt/DEPS
index 18902448458..0cb57a5fe2f 100644
--- a/chromium/ppapi/nacl_irt/DEPS
+++ b/chromium/ppapi/nacl_irt/DEPS
@@ -5,6 +5,8 @@ include_rules = [
   # for plugins only.
   "-ppapi/cpp",
 
+  "+mojo/edk/embedder",
+
   # The untrusted build references the NaCl integrated runtime (IRT).
   "+native_client/src/public",
   "+native_client/src/untrusted/irt/irt.h",
diff --git a/chromium/ppapi/nacl_irt/manifest_service.cc b/chromium/ppapi/nacl_irt/manifest_service.cc
index 030cc4a9634..f045dbcb704 100644
--- a/chromium/ppapi/nacl_irt/manifest_service.cc
+++ b/chromium/ppapi/nacl_irt/manifest_service.cc
@@ -34,9 +34,8 @@ class ManifestMessageFilter : public IPC::SyncMessageFilter {
   ManifestMessageFilter(base::WaitableEvent* shutdown_event)
       : SyncMessageFilter(shutdown_event,
                           false /* is_channel_send_thread_safe */),
-        connected_event_(
-            true /* manual_reset */, false /* initially_signaled */) {
-  }
+        connected_event_(base::WaitableEvent::ResetPolicy::MANUAL,
+                         base::WaitableEvent::InitialState::NOT_SIGNALED) {}
 
   bool Send(IPC::Message* message) override {
     // Wait until set up is actually done.
diff --git a/chromium/ppapi/nacl_irt/plugin_startup.cc b/chromium/ppapi/nacl_irt/plugin_startup.cc
index 338f524608f..c7b818dd11a 100644
--- a/chromium/ppapi/nacl_irt/plugin_startup.cc
+++ b/chromium/ppapi/nacl_irt/plugin_startup.cc
@@ -12,6 +12,7 @@
 #include "base/synchronization/waitable_event.h"
 #include "base/threading/thread.h"
 #include "ipc/ipc_channel_handle.h"
+#include "mojo/edk/embedder/embedder.h"
 #include "ppapi/nacl_irt/manifest_service.h"
 #include "ppapi/shared_impl/ppb_audio_shared.h"
 
@@ -63,7 +64,12 @@ void StartUpPlugin() {
   DCHECK(!g_shutdown_event);
   DCHECK(!g_io_thread);
 
-  g_shutdown_event = new base::WaitableEvent(true, false);
+  // The Mojo EDK must be initialized before using IPC.
+  mojo::edk::Init();
+
+  g_shutdown_event =
+      new base::WaitableEvent(base::WaitableEvent::ResetPolicy::MANUAL,
+                              base::WaitableEvent::InitialState::NOT_SIGNALED);
   g_io_thread = new base::Thread("Chrome_NaClIOThread");
   g_io_thread->StartWithOptions(
       base::Thread::Options(base::MessageLoop::TYPE_IO, 0));
@@ -75,7 +81,8 @@ void StartUpPlugin() {
     // TODO(hidehiko,dmichael): This works, but is probably not well designed
     // usage. Once a better approach is made, replace this by that way.
     // (crbug.com/364241).
-    base::WaitableEvent event(true, false);
+    base::WaitableEvent event(base::WaitableEvent::ResetPolicy::MANUAL,
+                              base::WaitableEvent::InitialState::NOT_SIGNALED);
     g_io_thread->task_runner()->PostTask(
         FROM_HERE, base::Bind(StartUpManifestServiceOnIOThread, &event));
     event.Wait();
diff --git a/chromium/ppapi/nacl_irt/ppapi_dispatcher.cc b/chromium/ppapi/nacl_irt/ppapi_dispatcher.cc
index 3a28f985934..8fd69bc10b9 100644
--- a/chromium/ppapi/nacl_irt/ppapi_dispatcher.cc
+++ b/chromium/ppapi/nacl_irt/ppapi_dispatcher.cc
@@ -14,7 +14,7 @@
 #include "base/single_thread_task_runner.h"
 #include "base/synchronization/waitable_event.h"
 #include "build/build_config.h"
-#include "components/tracing/child_trace_message_filter.h"
+#include "components/tracing/child/child_trace_message_filter.h"
 #include "ipc/ipc_channel_handle.h"
 #include "ipc/ipc_logging.h"
 #include "ipc/ipc_message.h"
diff --git a/chromium/ppapi/native_client/native_client.gyp b/chromium/ppapi/native_client/native_client.gyp
index b5292f890ee..c4e5fae3fed 100644
--- a/chromium/ppapi/native_client/native_client.gyp
+++ b/chromium/ppapi/native_client/native_client.gyp
@@ -148,6 +148,10 @@
               '-limc_syscalls',
               '-lplatform',
               '-lgio',
+              '-lmojo_cpp_bindings_nacl',
+              '-lmojo_cpp_system_nacl',
+              '-lmojo_public_system_nacl',
+              '-lmojo_system_impl_nacl',
               '-Wl,--end-group',
               '-lm',
             ],
@@ -189,6 +193,10 @@
                   '>(tc_lib_dir_irt64)/libplatform.a',
                   '>(tc_lib_dir_irt64)/libimc_syscalls.a',
                   '>(tc_lib_dir_irt64)/libgio.a',
+                  '>(tc_lib_dir_irt64)/libmojo_cpp_bindings_nacl.a',
+                  '>(tc_lib_dir_irt64)/libmojo_cpp_system_nacl.a',
+                  '>(tc_lib_dir_irt64)/libmojo_public_system_nacl.a',
+                  '>(tc_lib_dir_irt64)/libmojo_system_impl_nacl.a',
                 ],
                 'extra_deps_newlib32': [
                   '>(tc_lib_dir_irt32)/libppapi_proxy_nacl.a',
@@ -209,6 +217,10 @@
                   '>(tc_lib_dir_irt32)/libplatform.a',
                   '>(tc_lib_dir_irt32)/libimc_syscalls.a',
                   '>(tc_lib_dir_irt32)/libgio.a',
+                  '>(tc_lib_dir_irt32)/libmojo_cpp_bindings_nacl.a',
+                  '>(tc_lib_dir_irt32)/libmojo_cpp_system_nacl.a',
+                  '>(tc_lib_dir_irt32)/libmojo_public_system_nacl.a',
+                  '>(tc_lib_dir_irt32)/libmojo_system_impl_nacl.a',
                 ],
               }],
               ['target_arch=="arm"', {
@@ -231,6 +243,10 @@
                   '>(tc_lib_dir_irt_arm)/libplatform.a',
                   '>(tc_lib_dir_irt_arm)/libimc_syscalls.a',
                   '>(tc_lib_dir_irt_arm)/libgio.a',
+                  '>(tc_lib_dir_irt_arm)/libmojo_cpp_bindings_nacl.a',
+                  '>(tc_lib_dir_irt_arm)/libmojo_cpp_system_nacl.a',
+                  '>(tc_lib_dir_irt_arm)/libmojo_public_system_nacl.a',
+                  '>(tc_lib_dir_irt_arm)/libmojo_system_impl_nacl.a',
                 ],
               }],
               ['target_arch=="mipsel"', {
@@ -253,6 +269,10 @@
                   '>(tc_lib_dir_irt_mips)/libplatform.a',
                   '>(tc_lib_dir_irt_mips)/libimc_syscalls.a',
                   '>(tc_lib_dir_irt_mips)/libgio.a',
+                  '>(tc_lib_dir_irt_mips)/libmojo_cpp_bindings_nacl.a',
+                  '>(tc_lib_dir_irt_mips)/libmojo_cpp_system_nacl.a',
+                  '>(tc_lib_dir_irt_mips)/libmojo_public_system_nacl.a',
+                  '>(tc_lib_dir_irt_mips)/libmojo_system_impl_nacl.a',
                 ],
               }],
             ],
@@ -272,6 +292,10 @@
             '../../ipc/ipc_nacl.gyp:ipc_nacl',
             '../../base/base_nacl.gyp:base_nacl',
             '../../media/media_nacl.gyp:shared_memory_support_nacl',
+            '../../mojo/mojo_edk_nacl.gyp:mojo_system_impl_nacl',
+            '../../mojo/mojo_public_nacl.gyp:mojo_cpp_bindings_nacl',
+            '../../mojo/mojo_public_nacl.gyp:mojo_cpp_system_nacl',
+            '../../mojo/mojo_public_nacl.gyp:mojo_public_system_nacl',
             '../../native_client/src/untrusted/irt/irt.gyp:irt_browser_lib',
             '../../native_client/src/shared/platform/platform.gyp:platform_lib',
             '../../native_client/src/tools/tls_edit/tls_edit.gyp:tls_edit#host',
diff --git a/chromium/ppapi/ppapi_internal.gyp b/chromium/ppapi/ppapi_internal.gyp
index 2d981b12f5c..c58423a8d8e 100644
--- a/chromium/ppapi/ppapi_internal.gyp
+++ b/chromium/ppapi/ppapi_internal.gyp
@@ -111,6 +111,7 @@
             '../gpu/gpu.gyp:command_buffer_traits',
             '../media/media.gyp:shared_memory_support',
             '../ipc/ipc.gyp:ipc',
+            '../mojo/mojo_edk.gyp:mojo_system_impl',
             '../skia/skia.gyp:skia',
             '../third_party/icu/icu.gyp:icuuc',
             '../third_party/icu/icu.gyp:icui18n',
@@ -158,6 +159,7 @@
             '../gpu/gpu.gyp:gles2_implementation',
             '../gpu/gpu.gyp:command_buffer_traits',
             '../media/media.gyp:shared_memory_support',
+            '../mojo/mojo_edk.gyp:mojo_system_impl',
             '../ipc/ipc.gyp:ipc',
             '../skia/skia.gyp:skia',
             '../third_party/icu/icu.gyp:icuuc',
diff --git a/chromium/ppapi/ppapi_proxy.gypi b/chromium/ppapi/ppapi_proxy.gypi
index 4e6b4cbdc44..6a1ccc453cb 100644
--- a/chromium/ppapi/ppapi_proxy.gypi
+++ b/chromium/ppapi/ppapi_proxy.gypi
@@ -243,6 +243,8 @@
           'proxy/video_frame_resource.h',
           'proxy/video_source_resource.cc',
           'proxy/video_source_resource.h',
+          'proxy/vpn_provider_resource.cc',
+          'proxy/vpn_provider_resource.h',
           'proxy/websocket_resource.cc',
           'proxy/websocket_resource.h',
         ],
diff --git a/chromium/ppapi/ppapi_proxy_nacl.gyp b/chromium/ppapi/ppapi_proxy_nacl.gyp
index e3ec08b4af7..1f194792059 100644
--- a/chromium/ppapi/ppapi_proxy_nacl.gyp
+++ b/chromium/ppapi/ppapi_proxy_nacl.gyp
@@ -41,6 +41,8 @@
             '../gpu/gpu_nacl.gyp:gpu_ipc_nacl',
             '../ipc/ipc_nacl.gyp:ipc_nacl',
             '../ipc/ipc_nacl.gyp:ipc_nacl_nonsfi',
+            '../mojo/mojo_edk_nacl.gyp:mojo_system_impl_nacl',
+            '../mojo/mojo_edk_nacl.gyp:mojo_system_impl_nacl_nonsfi',
             '../ppapi/ppapi_ipc_nacl.gyp:ppapi_ipc_nacl',
             '../ppapi/ppapi_shared_nacl.gyp:ppapi_shared_nacl',
             '../third_party/WebKit/public/blink_headers.gyp:blink_headers',
diff --git a/chromium/ppapi/ppapi_shared.gypi b/chromium/ppapi/ppapi_shared.gypi
index 16407af853d..fd9f1b3aa88 100644
--- a/chromium/ppapi/ppapi_shared.gypi
+++ b/chromium/ppapi/ppapi_shared.gypi
@@ -133,6 +133,8 @@
           'shared_impl/var.h',
           'shared_impl/var_tracker.cc',
           'shared_impl/var_tracker.h',
+          'shared_impl/vpn_provider_util.cc',
+          'shared_impl/vpn_provider_util.h',
 
           'shared_impl/private/ppb_char_set_shared.cc',
           'shared_impl/private/ppb_char_set_shared.h',
diff --git a/chromium/ppapi/ppapi_tests.gypi b/chromium/ppapi/ppapi_tests.gypi
index a2ee7f08057..9fdc8025b26 100644
--- a/chromium/ppapi/ppapi_tests.gypi
+++ b/chromium/ppapi/ppapi_tests.gypi
@@ -151,6 +151,7 @@
         '../base/base.gyp:test_support_base',
         '../ipc/ipc.gyp:ipc',
         '../ipc/ipc.gyp:test_support_ipc',
+        '../mojo/mojo_edk.gyp:mojo_system_impl',
         '../testing/gmock.gyp:gmock',
         '../testing/gtest.gyp:gtest',
       ],
@@ -179,6 +180,7 @@
         'ppapi_shared',
         'ppapi_unittest_shared',
         '../base/base.gyp:test_support_base',
+        '../mojo/mojo_edk.gyp:mojo_system_impl',
         '../testing/gtest.gyp:gtest',
       ],
       'sources': [
@@ -198,10 +200,10 @@
         'ppapi_proxy',
         'ppapi_shared',
         'ppapi_unittest_shared',
-        '../base/base.gyp:run_all_unittests',
         '../base/base.gyp:test_support_base',
         '../gpu/gpu.gyp:gpu_ipc_common',
         '../ipc/ipc.gyp:ipc',
+        '../ipc/ipc.gyp:ipc_run_all_unittests',
         '../ipc/ipc.gyp:test_support_ipc',
         '../media/media.gyp:shared_memory_support',
         '../skia/skia.gyp:skia',
diff --git a/chromium/ppapi/proxy/BUILD.gn b/chromium/ppapi/proxy/BUILD.gn
index 1e412087448..fd36af7bf36 100644
--- a/chromium/ppapi/proxy/BUILD.gn
+++ b/chromium/ppapi/proxy/BUILD.gn
@@ -194,6 +194,8 @@ component("proxy") {
     "video_frame_resource.h",
     "video_source_resource.cc",
     "video_source_resource.h",
+    "vpn_provider_resource.cc",
+    "vpn_provider_resource.h",
     "websocket_resource.cc",
     "websocket_resource.h",
   ]
@@ -278,9 +280,11 @@ component("proxy") {
 
   deps = [
     "//base",
-    "//gpu/command_buffer/client:client_sources_for_ppapi",
+    "//gpu/command_buffer/client:gles2_implementation",
+    "//gpu/ipc/common:command_buffer_traits",
     "//ipc",
     "//media:shared_memory_support",
+    "//mojo/edk/system",
     "//ppapi/c",
     "//ppapi/shared_impl",
   ]
diff --git a/chromium/ppapi/proxy/DEPS b/chromium/ppapi/proxy/DEPS
index 370216dfeba..4cf7a832494 100644
--- a/chromium/ppapi/proxy/DEPS
+++ b/chromium/ppapi/proxy/DEPS
@@ -16,3 +16,9 @@ include_rules = [
   "+ppapi/cpp/completion_callback.h",
   "+ppapi/cpp/output_traits.h",
 ]
+
+specific_include_rules = {
+  "ppapi_perftests\.cc": [
+    "+mojo/edk/embedder/embedder.h",
+  ]
+}
diff --git a/chromium/ppapi/proxy/OWNERS b/chromium/ppapi/proxy/OWNERS
index 8d323232836..172f398b888 100644
--- a/chromium/ppapi/proxy/OWNERS
+++ b/chromium/ppapi/proxy/OWNERS
@@ -1,27 +1,7 @@
 piman@chromium.org
 
-# Changes to IPC messages require a security review to avoid introducing
-# new sandbox escapes.
 per-file *_messages*.h=set noparent
-per-file *_messages*.h=dcheng@chromium.org
-per-file *_messages*.h=inferno@chromium.org
-per-file *_messages*.h=jln@chromium.org
-per-file *_messages*.h=jschuh@chromium.org
-per-file *_messages*.h=kenrb@chromium.org
-per-file *_messages*.h=mkwst@chromium.org
-per-file *_messages*.h=nasko@chromium.org
-per-file *_messages*.h=palmer@chromium.org
-per-file *_messages*.h=tsepez@chromium.org
-per-file *_messages*.h=wfh@chromium.org
+per-file *_messages*.h=file://ipc/SECURITY_OWNERS
 
-per-file *_param_traits.*=set noparent
-per-file *_param_traits.*=dcheng@chromium.org
-per-file *_param_traits.*=inferno@chromium.org
-per-file *_param_traits.*=jln@chromium.org
-per-file *_param_traits.*=jschuh@chromium.org
-per-file *_param_traits.*=kenrb@chromium.org
-per-file *_param_traits.*=mkwst@chromium.org
-per-file *_param_traits.*=nasko@chromium.org
-per-file *_param_traits.*=palmer@chromium.org
-per-file *_param_traits.*=tsepez@chromium.org
-per-file *_param_traits.*=wfh@chromium.org
+per-file *_param_traits*.*=set noparent
+per-file *_param_traits*.*=file://ipc/SECURITY_OWNERS
diff --git a/chromium/ppapi/proxy/pdf_resource.cc b/chromium/ppapi/proxy/pdf_resource.cc
index 914e6957e21..2fdf9e46bcc 100644
--- a/chromium/ppapi/proxy/pdf_resource.cc
+++ b/chromium/ppapi/proxy/pdf_resource.cc
@@ -168,5 +168,27 @@ void PDFResource::GetV8ExternalSnapshotData(const char** natives_data_out,
       natives_data_out, natives_size_out, snapshot_data_out, snapshot_size_out);
 }
 
+void PDFResource::SetAccessibilityDocInfo(
+    PP_PrivateAccessibilityDocInfo* doc_info) {
+  Post(RENDERER, PpapiHostMsg_PDF_SetAccessibilityDocInfo(*doc_info));
+}
+
+void PDFResource::SetAccessibilityViewportInfo(
+    PP_PrivateAccessibilityViewportInfo* viewport_info) {
+  Post(RENDERER, PpapiHostMsg_PDF_SetAccessibilityViewportInfo(*viewport_info));
+}
+
+void PDFResource::SetAccessibilityPageInfo(
+    PP_PrivateAccessibilityPageInfo* page_info,
+    PP_PrivateAccessibilityTextRunInfo text_runs[],
+    PP_PrivateAccessibilityCharInfo chars[]) {
+  std::vector<PP_PrivateAccessibilityTextRunInfo> text_run_vector(
+      text_runs, text_runs + page_info->text_run_count);
+  std::vector<PP_PrivateAccessibilityCharInfo> char_vector(
+      chars, chars + page_info->char_count);
+  Post(RENDERER, PpapiHostMsg_PDF_SetAccessibilityPageInfo(
+                     *page_info, text_run_vector, char_vector));
+}
+
 }  // namespace proxy
 }  // namespace ppapi
diff --git a/chromium/ppapi/proxy/pdf_resource.h b/chromium/ppapi/proxy/pdf_resource.h
index 4420cc70bd6..a08e4404950 100644
--- a/chromium/ppapi/proxy/pdf_resource.h
+++ b/chromium/ppapi/proxy/pdf_resource.h
@@ -54,6 +54,14 @@ class PPAPI_PROXY_EXPORT PDFResource
                                  int* natives_size_out,
                                  const char** snapshot_data_out,
                                  int* snapshot_size_out) override;
+  void SetAccessibilityViewportInfo(
+      PP_PrivateAccessibilityViewportInfo* viewport_info) override;
+  void SetAccessibilityDocInfo(
+      PP_PrivateAccessibilityDocInfo* doc_info) override;
+  void SetAccessibilityPageInfo(
+      PP_PrivateAccessibilityPageInfo* page_info,
+      PP_PrivateAccessibilityTextRunInfo text_runs[],
+      PP_PrivateAccessibilityCharInfo chars[]) override;
 
  private:
   std::string locale_;
diff --git a/chromium/ppapi/proxy/ppapi_command_buffer_proxy.cc b/chromium/ppapi/proxy/ppapi_command_buffer_proxy.cc
index 77ef28217f9..b7c526486ef 100644
--- a/chromium/ppapi/proxy/ppapi_command_buffer_proxy.cc
+++ b/chromium/ppapi/proxy/ppapi_command_buffer_proxy.cc
@@ -262,6 +262,11 @@ int32_t PpapiCommandBufferProxy::CreateGpuMemoryBufferImage(
   return -1;
 }
 
+int32_t PpapiCommandBufferProxy::GetImageGpuMemoryBufferId(unsigned image_id) {
+  NOTREACHED();
+  return -1;
+}
+
 bool PpapiCommandBufferProxy::Send(IPC::Message* msg) {
   DCHECK(last_state_.error == gpu::error::kNoError);
 
diff --git a/chromium/ppapi/proxy/ppapi_command_buffer_proxy.h b/chromium/ppapi/proxy/ppapi_command_buffer_proxy.h
index 3cb7f423250..cc4ef3720ca 100644
--- a/chromium/ppapi/proxy/ppapi_command_buffer_proxy.h
+++ b/chromium/ppapi/proxy/ppapi_command_buffer_proxy.h
@@ -64,6 +64,7 @@ class PPAPI_PROXY_EXPORT PpapiCommandBufferProxy : public gpu::CommandBuffer,
                                      size_t height,
                                      unsigned internalformat,
                                      unsigned usage) override;
+  int32_t GetImageGpuMemoryBufferId(unsigned image_id) override;
   void SignalQuery(uint32_t query, const base::Closure& callback) override;
   void SetLock(base::Lock*) override;
   void EnsureWorkVisible() override;
diff --git a/chromium/ppapi/proxy/ppapi_messages.h b/chromium/ppapi/proxy/ppapi_messages.h
index 92d6f50c4ba..4c0f0b53b84 100644
--- a/chromium/ppapi/proxy/ppapi_messages.h
+++ b/chromium/ppapi/proxy/ppapi_messages.h
@@ -136,6 +136,7 @@ IPC_ENUM_TRAITS_MAX_VALUE(PP_VideoFrame_Format, PP_VIDEOFRAME_FORMAT_LAST)
 IPC_ENUM_TRAITS_MAX_VALUE(PP_HardwareAcceleration, PP_HARDWAREACCELERATION_LAST)
 IPC_ENUM_TRAITS_MAX_VALUE(PP_AudioProfile, PP_AUDIOPROFILE_MAX)
 IPC_ENUM_TRAITS_MAX_VALUE(PP_VideoProfile, PP_VIDEOPROFILE_MAX)
+IPC_ENUM_TRAITS_MAX_VALUE(PP_PrivateDirection, PP_PRIVATEDIRECTION_LAST)
 
 IPC_STRUCT_TRAITS_BEGIN(PP_Point)
   IPC_STRUCT_TRAITS_MEMBER(x)
@@ -219,6 +220,37 @@ IPC_STRUCT_TRAITS_BEGIN(PP_PdfPrintPresetOptions_Dev)
   IPC_STRUCT_TRAITS_MEMBER(uniform_page_size)
 IPC_STRUCT_TRAITS_END()
 
+IPC_STRUCT_TRAITS_BEGIN(PP_PrivateAccessibilityViewportInfo)
+  IPC_STRUCT_TRAITS_MEMBER(zoom)
+  IPC_STRUCT_TRAITS_MEMBER(scroll)
+  IPC_STRUCT_TRAITS_MEMBER(offset)
+IPC_STRUCT_TRAITS_END()
+
+IPC_STRUCT_TRAITS_BEGIN(PP_PrivateAccessibilityDocInfo)
+  IPC_STRUCT_TRAITS_MEMBER(page_count)
+  IPC_STRUCT_TRAITS_MEMBER(text_accessible)
+  IPC_STRUCT_TRAITS_MEMBER(text_copyable)
+IPC_STRUCT_TRAITS_END()
+
+IPC_STRUCT_TRAITS_BEGIN(PP_PrivateAccessibilityCharInfo)
+  IPC_STRUCT_TRAITS_MEMBER(unicode_character)
+  IPC_STRUCT_TRAITS_MEMBER(char_width)
+IPC_STRUCT_TRAITS_END()
+
+IPC_STRUCT_TRAITS_BEGIN(PP_PrivateAccessibilityTextRunInfo)
+  IPC_STRUCT_TRAITS_MEMBER(len)
+  IPC_STRUCT_TRAITS_MEMBER(font_size)
+  IPC_STRUCT_TRAITS_MEMBER(bounds)
+  IPC_STRUCT_TRAITS_MEMBER(direction)
+IPC_STRUCT_TRAITS_END()
+
+IPC_STRUCT_TRAITS_BEGIN(PP_PrivateAccessibilityPageInfo)
+  IPC_STRUCT_TRAITS_MEMBER(page_index)
+  IPC_STRUCT_TRAITS_MEMBER(bounds)
+  IPC_STRUCT_TRAITS_MEMBER(text_run_count)
+  IPC_STRUCT_TRAITS_MEMBER(char_count)
+IPC_STRUCT_TRAITS_END()
+
 IPC_STRUCT_TRAITS_BEGIN(PP_URLComponent_Dev)
   IPC_STRUCT_TRAITS_MEMBER(begin)
   IPC_STRUCT_TRAITS_MEMBER(len)
@@ -748,6 +780,8 @@ IPC_SYNC_MESSAGE_ROUTED1_2(
     PP_Instance /* instance */,
     PP_PdfPrintPresetOptions_Dev /* print preset options */,
     PP_Bool /* result */)
+IPC_MESSAGE_ROUTED1(PpapiMsg_PPPPdf_EnableAccessibility,
+                    PP_Instance /* instance */)
 
 // Find
 IPC_MESSAGE_ROUTED2(PpapiPluginMsg_PPPFind_StartFind,
@@ -1045,11 +1079,18 @@ IPC_SYNC_MESSAGE_ROUTED2_2(PpapiHostMsg_PPBGraphics3D_CreateTransferBuffer,
 IPC_SYNC_MESSAGE_ROUTED2_0(PpapiHostMsg_PPBGraphics3D_DestroyTransferBuffer,
                            ppapi::HostResource /* context */,
                            int32_t /* id */)
+// The receiver of this message takes ownership of the front buffer of the GL
+// context. Each call to PpapiHostMsg_PPBGraphics3D_SwapBuffers must be preceded
+// by exactly one call to PpapiHostMsg_PPBGraphics3D_TakeFrontBuffer. The
+// SyncToken passed to PpapiHostMsg_PPBGraphics3D_SwapBuffers must be generated
+// after this message is sent.
+IPC_MESSAGE_ROUTED1(PpapiHostMsg_PPBGraphics3D_TakeFrontBuffer,
+                    ppapi::HostResource /* graphics_3d */)
 IPC_MESSAGE_ROUTED2(PpapiHostMsg_PPBGraphics3D_SwapBuffers,
                     ppapi::HostResource /* graphics_3d */,
                     gpu::SyncToken /* sync_token */)
-IPC_SYNC_MESSAGE_ROUTED1_0(PpapiHostMsg_PPBGraphics3D_EnsureWorkVisible,
-                           ppapi::HostResource /* context */)
+IPC_MESSAGE_ROUTED1(PpapiHostMsg_PPBGraphics3D_EnsureWorkVisible,
+                    ppapi::HostResource /* context */)
 
 // PPB_ImageData.
 IPC_SYNC_MESSAGE_ROUTED4_3(PpapiHostMsg_PPBImageData_CreatePlatform,
@@ -2413,6 +2454,23 @@ IPC_MESSAGE_CONTROL1(PpapiHostMsg_PDF_SetSelectedText,
 IPC_MESSAGE_CONTROL1(PpapiHostMsg_PDF_SetLinkUnderCursor,
                      std::string /* url */)
 
+// Called by the plugin to describe the viewport for accessibility support.
+IPC_MESSAGE_CONTROL1(
+    PpapiHostMsg_PDF_SetAccessibilityViewportInfo,
+    PP_PrivateAccessibilityViewportInfo /* viewport_info */)
+
+// Send information about the whole document for accessibility support.
+IPC_MESSAGE_CONTROL1(
+    PpapiHostMsg_PDF_SetAccessibilityDocInfo,
+    PP_PrivateAccessibilityDocInfo /* doc_info */)
+
+// Send information about one page for accessibility support.
+IPC_MESSAGE_CONTROL3(
+    PpapiHostMsg_PDF_SetAccessibilityPageInfo,
+    PP_PrivateAccessibilityPageInfo /* page_info */,
+    std::vector<PP_PrivateAccessibilityTextRunInfo> /* text_runs */,
+    std::vector<PP_PrivateAccessibilityCharInfo> /* chars */)
+
 // VideoCapture ----------------------------------------------------------------
 
 // VideoCapture_Dev, plugin -> host
diff --git a/chromium/ppapi/proxy/ppapi_perftests.cc b/chromium/ppapi/proxy/ppapi_perftests.cc
index a9138e6a2a2..45b84ee6d62 100644
--- a/chromium/ppapi/proxy/ppapi_perftests.cc
+++ b/chromium/ppapi/proxy/ppapi_perftests.cc
@@ -3,8 +3,10 @@
 // found in the LICENSE file.
 
 #include "base/test/perf_test_suite.h"
+#include "mojo/edk/embedder/embedder.h"
 
 int main(int argc, char** argv) {
+  mojo::edk::Init();
   return base::PerfTestSuite(argc, argv).Run();
 }
 
diff --git a/chromium/ppapi/proxy/ppapi_proxy_test.cc b/chromium/ppapi/proxy/ppapi_proxy_test.cc
index fab1e0c7187..46d7a4ada77 100644
--- a/chromium/ppapi/proxy/ppapi_proxy_test.cc
+++ b/chromium/ppapi/proxy/ppapi_proxy_test.cc
@@ -527,8 +527,10 @@ TwoWayTest::TwoWayTest(TwoWayTest::TwoWayTestMode test_mode)
       plugin_thread_("TwoWayTest_PluginThread"),
       remote_harness_(NULL),
       local_harness_(NULL),
-      channel_created_(true, false),
-      shutdown_event_(true, false) {
+      channel_created_(base::WaitableEvent::ResetPolicy::MANUAL,
+                       base::WaitableEvent::InitialState::NOT_SIGNALED),
+      shutdown_event_(base::WaitableEvent::ResetPolicy::MANUAL,
+                      base::WaitableEvent::InitialState::NOT_SIGNALED) {
   if (test_mode == TEST_PPP_INTERFACE) {
     remote_harness_ = &plugin_;
     local_harness_ = &host_;
@@ -553,7 +555,9 @@ void TwoWayTest::SetUp() {
   std::ostringstream handle_name;
   handle_name << "TwoWayTestChannel" << base::GetCurrentProcId();
   IPC::ChannelHandle handle(handle_name.str());
-  base::WaitableEvent remote_harness_set_up(true, false);
+  base::WaitableEvent remote_harness_set_up(
+      base::WaitableEvent::ResetPolicy::MANUAL,
+      base::WaitableEvent::InitialState::NOT_SIGNALED);
   plugin_thread_.task_runner()->PostTask(
       FROM_HERE, base::Bind(&SetUpRemoteHarness, remote_harness_, handle,
                             base::RetainedRef(io_thread_.task_runner()),
@@ -565,7 +569,9 @@ void TwoWayTest::SetUp() {
 }
 
 void TwoWayTest::TearDown() {
-  base::WaitableEvent remote_harness_torn_down(true, false);
+  base::WaitableEvent remote_harness_torn_down(
+      base::WaitableEvent::ResetPolicy::MANUAL,
+      base::WaitableEvent::InitialState::NOT_SIGNALED);
   plugin_thread_.task_runner()->PostTask(
       FROM_HERE, base::Bind(&TearDownRemoteHarness, remote_harness_,
                             &remote_harness_torn_down));
@@ -577,7 +583,9 @@ void TwoWayTest::TearDown() {
 }
 
 void TwoWayTest::PostTaskOnRemoteHarness(const base::Closure& task) {
-  base::WaitableEvent task_complete(true, false);
+  base::WaitableEvent task_complete(
+      base::WaitableEvent::ResetPolicy::MANUAL,
+      base::WaitableEvent::InitialState::NOT_SIGNALED);
   plugin_thread_.task_runner()->PostTask(
       FROM_HERE, base::Bind(&RunTaskOnRemoteHarness, task, &task_complete));
   task_complete.Wait();
diff --git a/chromium/ppapi/proxy/ppb_graphics_3d_proxy.cc b/chromium/ppapi/proxy/ppb_graphics_3d_proxy.cc
index ccb784b77f5..0c21e377733 100644
--- a/chromium/ppapi/proxy/ppb_graphics_3d_proxy.cc
+++ b/chromium/ppapi/proxy/ppb_graphics_3d_proxy.cc
@@ -105,6 +105,10 @@ void Graphics3D::EnsureWorkVisible() {
   NOTREACHED();
 }
 
+void Graphics3D::TakeFrontBuffer() {
+  NOTREACHED();
+}
+
 gpu::CommandBuffer* Graphics3D::GetCommandBuffer() {
   return command_buffer_.get();
 }
@@ -119,6 +123,11 @@ int32_t Graphics3D::DoSwapBuffers(const gpu::SyncToken& sync_token) {
 
   gpu::gles2::GLES2Implementation* gl = gles2_impl();
   gl->SwapBuffers();
+
+  PluginDispatcher::GetForResource(this)->Send(
+      new PpapiHostMsg_PPBGraphics3D_TakeFrontBuffer(API_ID_PPB_GRAPHICS_3D,
+                                                     host_resource()));
+
   const GLuint64 fence_sync = gl->InsertFenceSyncCHROMIUM();
   gl->ShallowFlushCHROMIUM();
 
@@ -212,6 +221,8 @@ bool PPB_Graphics3D_Proxy::OnMessageReceived(const IPC::Message& msg) {
                         OnMsgDestroyTransferBuffer)
     IPC_MESSAGE_HANDLER(PpapiHostMsg_PPBGraphics3D_SwapBuffers,
                         OnMsgSwapBuffers)
+    IPC_MESSAGE_HANDLER(PpapiHostMsg_PPBGraphics3D_TakeFrontBuffer,
+                        OnMsgTakeFrontBuffer)
     IPC_MESSAGE_HANDLER(PpapiHostMsg_PPBGraphics3D_EnsureWorkVisible,
                         OnMsgEnsureWorkVisible)
 #endif  // !defined(OS_NACL)
@@ -345,6 +356,12 @@ void PPB_Graphics3D_Proxy::OnMsgSwapBuffers(const HostResource& context,
         enter.object()->SwapBuffersWithSyncToken(enter.callback(), sync_token));
 }
 
+void PPB_Graphics3D_Proxy::OnMsgTakeFrontBuffer(const HostResource& context) {
+  EnterHostFromHostResource<PPB_Graphics3D_API> enter(context);
+  if (enter.succeeded())
+    enter.object()->TakeFrontBuffer();
+}
+
 void PPB_Graphics3D_Proxy::OnMsgEnsureWorkVisible(const HostResource& context) {
   EnterHostFromHostResource<PPB_Graphics3D_API> enter(context);
   if (enter.succeeded())
diff --git a/chromium/ppapi/proxy/ppb_graphics_3d_proxy.h b/chromium/ppapi/proxy/ppb_graphics_3d_proxy.h
index fab0122c647..2a28fce80b8 100644
--- a/chromium/ppapi/proxy/ppb_graphics_3d_proxy.h
+++ b/chromium/ppapi/proxy/ppb_graphics_3d_proxy.h
@@ -55,6 +55,7 @@ class PPAPI_PROXY_EXPORT Graphics3D : public PPB_Graphics3D_Shared {
   gpu::CommandBuffer::State WaitForGetOffsetInRange(int32_t start,
                                                     int32_t end) override;
   void EnsureWorkVisible() override;
+  void TakeFrontBuffer() override;
 
  private:
   // PPB_Graphics3D_Shared overrides.
@@ -110,6 +111,7 @@ class PPB_Graphics3D_Proxy : public InterfaceProxy {
   void OnMsgDestroyTransferBuffer(const HostResource& context, int32_t id);
   void OnMsgSwapBuffers(const HostResource& context,
                         const gpu::SyncToken& sync_token);
+  void OnMsgTakeFrontBuffer(const HostResource& context);
   void OnMsgEnsureWorkVisible(const HostResource& context);
   // Renderer->plugin message handlers.
   void OnMsgSwapBuffersACK(const HostResource& context,
diff --git a/chromium/ppapi/proxy/ppb_testing_proxy.cc b/chromium/ppapi/proxy/ppb_testing_proxy.cc
index 6ddbd7ea801..512bef9a4f8 100644
--- a/chromium/ppapi/proxy/ppb_testing_proxy.cc
+++ b/chromium/ppapi/proxy/ppb_testing_proxy.cc
@@ -7,6 +7,7 @@
 #include <stddef.h>
 
 #include "base/message_loop/message_loop.h"
+#include "base/run_loop.h"
 #include "ppapi/c/private/ppb_testing_private.h"
 #include "ppapi/proxy/enter_proxy.h"
 #include "ppapi/proxy/plugin_dispatcher.h"
@@ -57,7 +58,7 @@ void RunMessageLoop(PP_Instance instance) {
       base::MessageLoop::current());
   CHECK(PpapiGlobals::Get()->GetMainThreadMessageLoop()->
       BelongsToCurrentThread());
-  base::MessageLoop::current()->Run();
+  base::RunLoop().Run();
 }
 
 void QuitMessageLoop(PP_Instance instance) {
diff --git a/chromium/ppapi/proxy/ppp_instance_proxy_unittest.cc b/chromium/ppapi/proxy/ppp_instance_proxy_unittest.cc
index 755d83b8a02..6c696a786d3 100644
--- a/chromium/ppapi/proxy/ppp_instance_proxy_unittest.cc
+++ b/chromium/ppapi/proxy/ppp_instance_proxy_unittest.cc
@@ -49,7 +49,9 @@ PP_Rect received_position;
 PP_Rect received_clip;
 // DidChangeView is asynchronous. We wait until the call has completed before
 // proceeding on to the next test.
-base::WaitableEvent did_change_view_called(false, false);
+base::WaitableEvent did_change_view_called(
+    base::WaitableEvent::ResetPolicy::AUTOMATIC,
+    base::WaitableEvent::InitialState::NOT_SIGNALED);
 void DidChangeView(PP_Instance instance, const PP_Rect* position,
                    const PP_Rect* clip) {
   received_instance = instance;
@@ -59,7 +61,9 @@ void DidChangeView(PP_Instance instance, const PP_Rect* position,
 }
 
 PP_Bool received_has_focus;
-base::WaitableEvent did_change_focus_called(false, false);
+base::WaitableEvent did_change_focus_called(
+    base::WaitableEvent::ResetPolicy::AUTOMATIC,
+    base::WaitableEvent::InitialState::NOT_SIGNALED);
 void DidChangeFocus(PP_Instance instance, PP_Bool has_focus) {
   received_instance = instance;
   received_has_focus = has_focus;
diff --git a/chromium/ppapi/proxy/ppp_messaging_proxy_perftest.cc b/chromium/ppapi/proxy/ppp_messaging_proxy_perftest.cc
index b64434341a2..d3998b8a17c 100644
--- a/chromium/ppapi/proxy/ppp_messaging_proxy_perftest.cc
+++ b/chromium/ppapi/proxy/ppp_messaging_proxy_perftest.cc
@@ -18,7 +18,9 @@ namespace ppapi {
 namespace proxy {
 namespace {
 
-base::WaitableEvent handle_message_called(false, false);
+base::WaitableEvent handle_message_called(
+    base::WaitableEvent::ResetPolicy::AUTOMATIC,
+    base::WaitableEvent::InitialState::NOT_SIGNALED);
 
 void HandleMessage(PP_Instance /* instance */, PP_Var message_data) {
   ppapi::ProxyAutoLock lock;
diff --git a/chromium/ppapi/proxy/ppp_messaging_proxy_unittest.cc b/chromium/ppapi/proxy/ppp_messaging_proxy_unittest.cc
index d1fa9b60fde..703e43035e4 100644
--- a/chromium/ppapi/proxy/ppp_messaging_proxy_unittest.cc
+++ b/chromium/ppapi/proxy/ppp_messaging_proxy_unittest.cc
@@ -25,7 +25,9 @@ namespace {
 // template magic.
 PP_Instance received_instance;
 PP_Var received_var;
-base::WaitableEvent handle_message_called(false, false);
+base::WaitableEvent handle_message_called(
+    base::WaitableEvent::ResetPolicy::AUTOMATIC,
+    base::WaitableEvent::InitialState::NOT_SIGNALED);
 
 void HandleMessage(PP_Instance instance, PP_Var message_data) {
   received_instance = instance;
diff --git a/chromium/ppapi/proxy/ppp_pdf_proxy.cc b/chromium/ppapi/proxy/ppp_pdf_proxy.cc
index cafde231006..ef89438eaef 100644
--- a/chromium/ppapi/proxy/ppp_pdf_proxy.cc
+++ b/chromium/ppapi/proxy/ppp_pdf_proxy.cc
@@ -36,10 +36,16 @@ PP_Bool GetPrintPresetOptionsFromDocument(
   return ret;
 }
 
+void EnableAccessibility(PP_Instance instance) {
+  HostDispatcher::GetForInstance(instance)->Send(
+      new PpapiMsg_PPPPdf_EnableAccessibility(API_ID_PPP_PDF, instance));
+}
+
 const PPP_Pdf ppp_pdf_interface = {
   &GetLinkAtPosition,
   &Transform,
-  &GetPrintPresetOptionsFromDocument
+  &GetPrintPresetOptionsFromDocument,
+  &EnableAccessibility,
 };
 #else
 // The NaCl plugin doesn't need the host side interface - stub it out.
@@ -74,6 +80,8 @@ bool PPP_Pdf_Proxy::OnMessageReceived(const IPC::Message& msg) {
     IPC_MESSAGE_HANDLER(PpapiMsg_PPPPdf_Rotate, OnPluginMsgRotate)
     IPC_MESSAGE_HANDLER(PpapiMsg_PPPPdf_PrintPresetOptions,
                         OnPluginMsgPrintPresetOptions)
+    IPC_MESSAGE_HANDLER(PpapiMsg_PPPPdf_EnableAccessibility,
+                        OnPluginMsgEnableAccessibility)
     IPC_MESSAGE_UNHANDLED(handled = false)
   IPC_END_MESSAGE_MAP()
   return handled;
@@ -97,5 +105,10 @@ void PPP_Pdf_Proxy::OnPluginMsgPrintPresetOptions(
   }
 }
 
+void PPP_Pdf_Proxy::OnPluginMsgEnableAccessibility(PP_Instance instance) {
+  if (ppp_pdf_)
+    CallWhileUnlocked(ppp_pdf_->EnableAccessibility, instance);
+}
+
 }  // namespace proxy
 }  // namespace ppapi
diff --git a/chromium/ppapi/proxy/ppp_pdf_proxy.h b/chromium/ppapi/proxy/ppp_pdf_proxy.h
index 5cc27900ac1..40ba50c7bc3 100644
--- a/chromium/ppapi/proxy/ppp_pdf_proxy.h
+++ b/chromium/ppapi/proxy/ppp_pdf_proxy.h
@@ -29,6 +29,7 @@ class PPP_Pdf_Proxy : public InterfaceProxy {
   void OnPluginMsgPrintPresetOptions(PP_Instance instance,
                                      PP_PdfPrintPresetOptions_Dev* options,
                                      PP_Bool* result);
+  void OnPluginMsgEnableAccessibility(PP_Instance instance);
 
   // When this proxy is in the plugin side, this value caches the interface
   // pointer so we don't have to retrieve it from the dispatcher each time.
diff --git a/chromium/ppapi/proxy/resource_creation_proxy.cc b/chromium/ppapi/proxy/resource_creation_proxy.cc
index a6a7d049ce7..f86ffdbd8aa 100644
--- a/chromium/ppapi/proxy/resource_creation_proxy.cc
+++ b/chromium/ppapi/proxy/resource_creation_proxy.cc
@@ -54,6 +54,7 @@
 #include "ppapi/proxy/video_destination_resource.h"
 #include "ppapi/proxy/video_encoder_resource.h"
 #include "ppapi/proxy/video_source_resource.h"
+#include "ppapi/proxy/vpn_provider_resource.h"
 #include "ppapi/proxy/websocket_resource.h"
 #include "ppapi/shared_impl/api_id.h"
 #include "ppapi/shared_impl/host_resource.h"
@@ -410,7 +411,7 @@ PP_Resource ResourceCreationProxy::CreateVideoSource(
 }
 
 PP_Resource ResourceCreationProxy::CreateVpnProvider(PP_Instance instance) {
-  return 0;
+  return (new VpnProviderResource(GetConnection(), instance))->GetReference();
 }
 
 PP_Resource ResourceCreationProxy::CreateWebSocket(PP_Instance instance) {
diff --git a/chromium/ppapi/proxy/tracked_callback_unittest.cc b/chromium/ppapi/proxy/tracked_callback_unittest.cc
index 8b68b8e31dc..52a7723f4c3 100644
--- a/chromium/ppapi/proxy/tracked_callback_unittest.cc
+++ b/chromium/ppapi/proxy/tracked_callback_unittest.cc
@@ -104,7 +104,9 @@ struct CallbackRunInfo {
         completion_task_run_count_(0),
         completion_task_result_(kInitializedResultValue),
         thread_checker_(thread_checker),
-        callback_did_run_event_(true, false) {}
+        callback_did_run_event_(
+            base::WaitableEvent::ResetPolicy::MANUAL,
+            base::WaitableEvent::InitialState::NOT_SIGNALED) {}
   void CallbackDidRun(int32_t result) {
     CHECK(thread_checker_->CalledOnValidThread());
     if (!run_count_)
@@ -338,7 +340,9 @@ class CallbackMockResource : public Resource {
         info_did_run_with_completion_task_(&thread_checker_),
         info_did_abort_(&thread_checker_),
         info_didnt_run_(&thread_checker_),
-        callbacks_created_event_(true, false) {}
+        callbacks_created_event_(
+            base::WaitableEvent::ResetPolicy::MANUAL,
+            base::WaitableEvent::InitialState::NOT_SIGNALED) {}
   void CreateCallbacks() {
     // Bind thread_checker_ to the thread where we create the callbacks.
     // Later, when the callback runs, it will check that it was invoked on this
diff --git a/chromium/ppapi/proxy/video_encoder_resource_unittest.cc b/chromium/ppapi/proxy/video_encoder_resource_unittest.cc
index 3d7fe118bce..a49379b912d 100644
--- a/chromium/ppapi/proxy/video_encoder_resource_unittest.cc
+++ b/chromium/ppapi/proxy/video_encoder_resource_unittest.cc
@@ -33,7 +33,10 @@ namespace {
 
 class MockCompletionCallback {
  public:
-  MockCompletionCallback() : called_(false), call_event_(false, false) {}
+  MockCompletionCallback()
+      : called_(false),
+        call_event_(base::WaitableEvent::ResetPolicy::AUTOMATIC,
+                    base::WaitableEvent::InitialState::NOT_SIGNALED) {}
 
   bool called() { return called_; }
   int32_t result() { return result_; }
diff --git a/chromium/ppapi/proxy/vpn_provider_resource.cc b/chromium/ppapi/proxy/vpn_provider_resource.cc
new file mode 100644
index 00000000000..bf960bdf807
--- /dev/null
+++ b/chromium/ppapi/proxy/vpn_provider_resource.cc
@@ -0,0 +1,221 @@
+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "ppapi/proxy/vpn_provider_resource.h"
+
+#include "base/bind.h"
+#include "base/memory/ptr_util.h"
+#include "ppapi/c/pp_errors.h"
+#include "ppapi/proxy/dispatch_reply_message.h"
+#include "ppapi/proxy/ppapi_messages.h"
+#include "ppapi/shared_impl/array_var.h"
+#include "ppapi/shared_impl/ppapi_globals.h"
+#include "ppapi/shared_impl/var_tracker.h"
+
+namespace ppapi {
+namespace proxy {
+
+VpnProviderResource::VpnProviderResource(Connection connection,
+                                         PP_Instance instance)
+    : PluginResource(connection, instance),
+      bind_callback_(nullptr),
+      send_packet_callback_(nullptr),
+      receive_packet_callback_(nullptr),
+      receive_packet_callback_var_(nullptr),
+      bound_(false) {}
+
+VpnProviderResource::~VpnProviderResource() {}
+
+thunk::PPB_VpnProvider_API* VpnProviderResource::AsPPB_VpnProvider_API() {
+  return this;
+}
+
+void VpnProviderResource::OnReplyReceived(
+    const ResourceMessageReplyParams& params,
+    const IPC::Message& msg) {
+  PluginResource::OnReplyReceived(params, msg);
+}
+
+int32_t VpnProviderResource::Bind(
+    const PP_Var& configuration_id,
+    const PP_Var& configuration_name,
+    const scoped_refptr<TrackedCallback>& callback) {
+  if (TrackedCallback::IsPending(bind_callback_))
+    return PP_ERROR_INPROGRESS;
+
+  StringVar* configuration_id_var = StringVar::FromPPVar(configuration_id);
+  if (!configuration_id_var)
+    return PP_ERROR_BADARGUMENT;
+  StringVar* configuration_name_var = StringVar::FromPPVar(configuration_name);
+  if (!configuration_name_var)
+    return PP_ERROR_BADARGUMENT;
+
+  return PP_ERROR_NOTSUPPORTED;
+}
+
+int32_t VpnProviderResource::SendPacket(
+    const PP_Var& packet,
+    const scoped_refptr<TrackedCallback>& callback) {
+  if (!bound_)
+    return PP_ERROR_FAILED;
+  if (TrackedCallback::IsPending(send_packet_callback_))
+    return PP_ERROR_INPROGRESS;
+  if (!ArrayBufferVar::FromPPVar(packet))
+    return PP_ERROR_BADARGUMENT;
+
+  uint32_t id;
+  if (send_packet_buffer_.get() && send_packet_buffer_->GetAvailable(&id)) {
+    // Send packet immediately
+    send_packet_buffer_->SetAvailable(id, false);
+    return DoSendPacket(packet, id);
+  } else {
+    // Packet will be sent later
+    send_packet_callback_ = callback;
+    PpapiGlobals::Get()->GetVarTracker()->AddRefVar(packet);
+    send_packets_.push(packet);
+
+    return PP_OK_COMPLETIONPENDING;
+  }
+}
+
+int32_t VpnProviderResource::DoSendPacket(const PP_Var& packet, uint32_t id) {
+  // Convert packet to std::vector<char>, then send it.
+  scoped_refptr<ArrayBufferVar> packet_arraybuffer =
+      ArrayBufferVar::FromPPVar(packet);
+  if (!packet_arraybuffer.get())
+    return PP_ERROR_BADARGUMENT;
+
+  char* packet_pointer = static_cast<char*>(packet_arraybuffer->Map());
+  uint32_t packet_size = packet_arraybuffer->ByteLength();
+  memcpy(send_packet_buffer_->GetBuffer(id), packet_pointer, packet_size);
+  packet_arraybuffer->Unmap();
+
+  return PP_OK;
+}
+
+int32_t VpnProviderResource::ReceivePacket(
+    PP_Var* packet,
+    const scoped_refptr<TrackedCallback>& callback) {
+  if (TrackedCallback::IsPending(receive_packet_callback_))
+    return PP_ERROR_INPROGRESS;
+
+  // Return previously received packet.
+  if (!received_packets_.empty()) {
+    receive_packet_callback_var_ = packet;
+    WritePacket();
+    return PP_OK;
+  }
+
+  // Or retain packet var and install callback.
+  receive_packet_callback_var_ = packet;
+  receive_packet_callback_ = callback;
+
+  return PP_OK_COMPLETIONPENDING;
+}
+
+void VpnProviderResource::OnPluginMsgOnUnbindReceived(
+    const ResourceMessageReplyParams& params) {
+  bound_ = false;
+
+  // Cleanup in-flight packets.
+  while (!received_packets_.empty()) {
+    received_packets_.pop();
+  }
+  while (!send_packets_.empty()) {
+    PpapiGlobals::Get()->GetVarTracker()->ReleaseVar(send_packets_.front());
+    send_packets_.pop();
+  }
+}
+
+void VpnProviderResource::OnPluginMsgOnPacketReceived(
+    const ResourceMessageReplyParams& params,
+    uint32_t packet_size,
+    uint32_t id) {
+  if (!bound_) {
+    return;
+  }
+
+  // Append received packet to queue.
+  void* packet_pointer = receive_packet_buffer_->GetBuffer(id);
+  scoped_refptr<Var> packet_var(
+      PpapiGlobals::Get()->GetVarTracker()->MakeArrayBufferVar(packet_size,
+                                                               packet_pointer));
+  received_packets_.push(packet_var);
+
+  if (!TrackedCallback::IsPending(receive_packet_callback_) ||
+      TrackedCallback::IsScheduledToRun(receive_packet_callback_)) {
+    return;
+  }
+
+  scoped_refptr<TrackedCallback> callback;
+  callback.swap(receive_packet_callback_);
+  WritePacket();
+  callback->Run(PP_OK);
+}
+
+void VpnProviderResource::OnPluginMsgBindReply(
+    const ResourceMessageReplyParams& params,
+    uint32_t queue_size,
+    uint32_t max_packet_size,
+    int32_t result) {
+  if (!TrackedCallback::IsPending(bind_callback_))
+    return;
+
+  if (params.result() == PP_OK) {
+    std::vector<base::SharedMemoryHandle> shm_handles;
+    params.TakeAllSharedMemoryHandles(&shm_handles);
+    std::unique_ptr<base::SharedMemory> send_shm(
+        new base::SharedMemory(shm_handles[0], false));
+    std::unique_ptr<base::SharedMemory> receive_shm(
+        new base::SharedMemory(shm_handles[1], false));
+    size_t buffer_size = queue_size * max_packet_size;
+    if (!send_shm->Map(buffer_size) || !receive_shm->Map(buffer_size)) {
+      NOTREACHED();
+      return;
+    }
+    send_packet_buffer_ = base::WrapUnique(new ppapi::VpnProviderSharedBuffer(
+        queue_size, max_packet_size, std::move(send_shm)));
+    receive_packet_buffer_ =
+        base::WrapUnique(new ppapi::VpnProviderSharedBuffer(
+            queue_size, max_packet_size, std::move(receive_shm)));
+
+    bound_ = (result == PP_OK);
+  }
+
+  scoped_refptr<TrackedCallback> callback;
+  callback.swap(bind_callback_);
+  callback->Run(params.result() ? params.result() : result);
+}
+
+void VpnProviderResource::OnPluginMsgSendPacketReply(
+    const ResourceMessageReplyParams& params,
+    int32_t id) {
+  if (!send_packets_.empty() && bound_) {
+    // Process remaining packets
+    DoSendPacket(send_packets_.front(), id);
+    PpapiGlobals::Get()->GetVarTracker()->ReleaseVar(send_packets_.front());
+    send_packets_.pop();
+  } else {
+    send_packet_buffer_->SetAvailable(id, true);
+
+    // Available slots - Run callback to process new packets.
+    if (TrackedCallback::IsPending(send_packet_callback_)) {
+      scoped_refptr<TrackedCallback> callback;
+      callback.swap(send_packet_callback_);
+      callback->Run(PP_OK);
+    }
+  }
+}
+
+void VpnProviderResource::WritePacket() {
+  if (!receive_packet_callback_var_)
+    return;
+
+  *receive_packet_callback_var_ = received_packets_.front()->GetPPVar();
+  received_packets_.pop();
+  receive_packet_callback_var_ = nullptr;
+}
+
+}  // namespace proxy
+}  // namespace ppapi
diff --git a/chromium/ppapi/proxy/vpn_provider_resource.h b/chromium/ppapi/proxy/vpn_provider_resource.h
new file mode 100644
index 00000000000..ac43b62d36b
--- /dev/null
+++ b/chromium/ppapi/proxy/vpn_provider_resource.h
@@ -0,0 +1,93 @@
+// Copyright (c) 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef PPAPI_PROXY_VPN_PROVIDER_RESOURCE_H_
+#define PPAPI_PROXY_VPN_PROVIDER_RESOURCE_H_
+
+#include <memory>
+#include <queue>
+
+#include "ppapi/proxy/plugin_resource.h"
+#include "ppapi/shared_impl/tracked_callback.h"
+#include "ppapi/shared_impl/var.h"
+#include "ppapi/shared_impl/vpn_provider_util.h"
+#include "ppapi/thunk/ppb_vpn_provider_api.h"
+
+namespace ppapi {
+namespace proxy {
+
+class PPAPI_PROXY_EXPORT VpnProviderResource
+    : public PluginResource,
+      public NON_EXPORTED_BASE(thunk::PPB_VpnProvider_API) {
+ public:
+  VpnProviderResource(Connection connection, PP_Instance instance);
+  virtual ~VpnProviderResource();
+
+  // PluginResource implementation.
+  virtual thunk::PPB_VpnProvider_API* AsPPB_VpnProvider_API() override;
+
+  // PPB_VpnProvider_API implementation.
+  virtual int32_t Bind(const PP_Var& configuration_id,
+                       const PP_Var& configuration_name,
+                       const scoped_refptr<TrackedCallback>& callback) override;
+  virtual int32_t SendPacket(
+      const PP_Var& packet,
+      const scoped_refptr<TrackedCallback>& callback) override;
+  virtual int32_t ReceivePacket(
+      PP_Var* packet,
+      const scoped_refptr<TrackedCallback>& callback) override;
+
+ private:
+  // PluginResource overrides.
+  virtual void OnReplyReceived(const ResourceMessageReplyParams& params,
+                               const IPC::Message& msg) override;
+
+  // PPB_VpnProvider IPC Replies
+  void OnPluginMsgBindReply(const ResourceMessageReplyParams& params,
+                            uint32_t queue_size,
+                            uint32_t max_packet_size,
+                            int32_t result);
+  void OnPluginMsgSendPacketReply(const ResourceMessageReplyParams& params,
+                                  int32_t result);
+
+  // Browser callbacks
+  void OnPluginMsgOnUnbindReceived(const ResourceMessageReplyParams& params);
+  void OnPluginMsgOnPacketReceived(const ResourceMessageReplyParams& params,
+                                   uint32_t packet_size,
+                                   uint32_t id);
+
+  // Picks up a received packet and moves it to user buffer. This method is used
+  // in both ReceivePacket() for fast returning path, and in
+  // OnPluginMsgOnPacketReceived() for delayed callback invocations.
+  void WritePacket();
+
+  // Sends a packet to the browser. This method is used in both SendPacket() for
+  // fast path, and in OnPluginMsgSendPacketReply for processing previously
+  // queued packets.
+  int32_t DoSendPacket(const PP_Var& packet, uint32_t id);
+
+  scoped_refptr<TrackedCallback> bind_callback_;
+  scoped_refptr<TrackedCallback> send_packet_callback_;
+  scoped_refptr<TrackedCallback> receive_packet_callback_;
+
+  // Keeps a pointer to the provided callback variable. Received packet will be
+  // copied to this variable on ready.
+  PP_Var* receive_packet_callback_var_;
+
+  std::unique_ptr<ppapi::VpnProviderSharedBuffer> send_packet_buffer_;
+  std::unique_ptr<ppapi::VpnProviderSharedBuffer> receive_packet_buffer_;
+
+  std::queue<PP_Var> send_packets_;
+  std::queue<scoped_refptr<Var>> received_packets_;
+
+  // Connection bound state
+  bool bound_;
+
+  DISALLOW_COPY_AND_ASSIGN(VpnProviderResource);
+};
+
+}  // namespace proxy
+}  // namespace ppapi
+
+#endif  // PPAPI_PROXY_VPN_PROVIDER_RESOURCE_H_
diff --git a/chromium/ppapi/shared_impl/BUILD.gn b/chromium/ppapi/shared_impl/BUILD.gn
index 67bd069a863..8fc2795ed0f 100644
--- a/chromium/ppapi/shared_impl/BUILD.gn
+++ b/chromium/ppapi/shared_impl/BUILD.gn
@@ -118,6 +118,8 @@ component("shared_impl") {
     "var.h",
     "var_tracker.cc",
     "var_tracker.h",
+    "vpn_provider_util.cc",
+    "vpn_provider_util.h",
 
     # TODO(viettrungluu): Split these out; it won"t be used in NaCl.
     "private/net_address_private_impl.cc",
diff --git a/chromium/ppapi/shared_impl/file_system_util.cc b/chromium/ppapi/shared_impl/file_system_util.cc
index 25650d1c853..a8a52633319 100644
--- a/chromium/ppapi/shared_impl/file_system_util.cc
+++ b/chromium/ppapi/shared_impl/file_system_util.cc
@@ -5,6 +5,7 @@
 #include "ppapi/shared_impl/file_system_util.h"
 
 #include "base/logging.h"
+#include "ppapi/shared_impl/ppapi_constants.h"
 
 namespace ppapi {
 
@@ -26,7 +27,7 @@ std::string IsolatedFileSystemTypeToRootName(
     case PP_ISOLATEDFILESYSTEMTYPE_PRIVATE_CRX:
       return "crxfs";
     case PP_ISOLATEDFILESYSTEMTYPE_PRIVATE_PLUGINPRIVATE:
-      return "pluginprivate";
+      return kPluginPrivateRootName;
     default:
       NOTREACHED() << type;
       return std::string();
diff --git a/chromium/ppapi/shared_impl/ppapi_constants.h b/chromium/ppapi/shared_impl/ppapi_constants.h
index 118db2579c4..c26d9a7d01e 100644
--- a/chromium/ppapi/shared_impl/ppapi_constants.h
+++ b/chromium/ppapi/shared_impl/ppapi_constants.h
@@ -23,6 +23,9 @@ const char kPowerSaverTestPluginName[] = "power_saver_test_plugin.plugin";
 const char kPowerSaverTestPluginName[] = "libpower_saver_test_plugin.so";
 #endif
 
+// Name of the root directory in the plugin private file system.
+const char kPluginPrivateRootName[] = "pluginprivate";
+
 }  // namespace ppapi
 
 #endif  // PPAPI_SHARED_IMPL_PPAPI_CONSTANTS_H_
diff --git a/chromium/ppapi/shared_impl/private/ppb_x509_certificate_private_shared.cc b/chromium/ppapi/shared_impl/private/ppb_x509_certificate_private_shared.cc
index 9f429bd66ef..45283e323e0 100644
--- a/chromium/ppapi/shared_impl/private/ppb_x509_certificate_private_shared.cc
+++ b/chromium/ppapi/shared_impl/private/ppb_x509_certificate_private_shared.cc
@@ -4,6 +4,8 @@
 
 #include "ppapi/shared_impl/private/ppb_x509_certificate_private_shared.h"
 
+#include <utility>
+
 #include "base/logging.h"
 #include "ppapi/shared_impl/ppapi_globals.h"
 #include "ppapi/shared_impl/var.h"
@@ -21,9 +23,9 @@ PPB_X509Certificate_Fields::PPB_X509Certificate_Fields(
 
 void PPB_X509Certificate_Fields::SetField(
     PP_X509Certificate_Private_Field field,
-    base::Value* value) {
+    std::unique_ptr<base::Value> value) {
   uint32_t index = static_cast<uint32_t>(field);
-  bool success = values_.Set(index, value);
+  bool success = values_.Set(index, std::move(value));
   DCHECK(success);
 }
 
diff --git a/chromium/ppapi/shared_impl/private/ppb_x509_certificate_private_shared.h b/chromium/ppapi/shared_impl/private/ppb_x509_certificate_private_shared.h
index b68e091b18a..83122f6d3b9 100644
--- a/chromium/ppapi/shared_impl/private/ppb_x509_certificate_private_shared.h
+++ b/chromium/ppapi/shared_impl/private/ppb_x509_certificate_private_shared.h
@@ -29,7 +29,8 @@ class PPAPI_SHARED_EXPORT PPB_X509Certificate_Fields {
   PPB_X509Certificate_Fields(const PPB_X509Certificate_Fields& fields);
 
   // Takes ownership of |value|.
-  void SetField(PP_X509Certificate_Private_Field field, base::Value* value);
+  void SetField(PP_X509Certificate_Private_Field field,
+                std::unique_ptr<base::Value> value);
   PP_Var GetFieldAsPPVar(PP_X509Certificate_Private_Field field) const;
 
  private:
diff --git a/chromium/ppapi/shared_impl/vpn_provider_util.cc b/chromium/ppapi/shared_impl/vpn_provider_util.cc
new file mode 100644
index 00000000000..10da28aac4a
--- /dev/null
+++ b/chromium/ppapi/shared_impl/vpn_provider_util.cc
@@ -0,0 +1,54 @@
+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "ppapi/shared_impl/vpn_provider_util.h"
+
+namespace ppapi {
+
+VpnProviderSharedBuffer::VpnProviderSharedBuffer(
+    uint32_t capacity,
+    uint32_t packet_size,
+    std::unique_ptr<base::SharedMemory> shm)
+    : capacity_(capacity),
+      packet_size_(packet_size),
+      shm_(std::move(shm)),
+      available_(capacity, true) {
+  DCHECK(this->shm_);
+}
+
+VpnProviderSharedBuffer::~VpnProviderSharedBuffer() {}
+
+bool VpnProviderSharedBuffer::GetAvailable(uint32_t* id) {
+  for (uint32_t i = 0; i < capacity_; i++) {
+    if (available_[i]) {
+      if (id) {
+        *id = i;
+      }
+      return true;
+    }
+  }
+  return false;
+}
+
+void VpnProviderSharedBuffer::SetAvailable(uint32_t id, bool value) {
+  if (id >= capacity_) {
+    NOTREACHED();
+    return;
+  }
+  available_[id] = value;
+}
+
+void* VpnProviderSharedBuffer::GetBuffer(uint32_t id) {
+  if (id >= capacity_) {
+    NOTREACHED();
+    return nullptr;
+  }
+  return reinterpret_cast<char*>(shm_->memory()) + packet_size_ * id;
+}
+
+base::SharedMemoryHandle VpnProviderSharedBuffer::GetHandle() {
+  return shm_->handle();
+}
+
+}  // namespace ppapi
\ No newline at end of file
diff --git a/chromium/ppapi/shared_impl/vpn_provider_util.h b/chromium/ppapi/shared_impl/vpn_provider_util.h
new file mode 100644
index 00000000000..889bfaa7afc
--- /dev/null
+++ b/chromium/ppapi/shared_impl/vpn_provider_util.h
@@ -0,0 +1,36 @@
+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef PPAPI_SHAERD_IMPL_VPN_PROVIDER_UTIL_H_
+#define PPAPI_SHAERD_IMPL_VPN_PROVIDER_UTIL_H_
+
+#include <memory>
+
+#include "base/memory/shared_memory.h"
+#include "ppapi/shared_impl/ppapi_shared_export.h"
+
+namespace ppapi {
+
+class PPAPI_SHARED_EXPORT VpnProviderSharedBuffer {
+ public:
+  VpnProviderSharedBuffer(uint32_t capacity,
+                          uint32_t packet_size,
+                          std::unique_ptr<base::SharedMemory> shm);
+  ~VpnProviderSharedBuffer();
+
+  bool GetAvailable(uint32_t* id);
+  void SetAvailable(uint32_t id, bool value);
+  void* GetBuffer(uint32_t id);
+  base::SharedMemoryHandle GetHandle();
+
+ private:
+  uint32_t capacity_;
+  uint32_t packet_size_;
+  std::unique_ptr<base::SharedMemory> shm_;
+  std::vector<bool> available_;
+};
+
+}  // namespace ppapi
+
+#endif  // PPAPI_SHAERD_IMPL_VPN_PROVIDER_UTIL_H_
\ No newline at end of file
diff --git a/chromium/ppapi/thunk/ppb_graphics_3d_api.h b/chromium/ppapi/thunk/ppb_graphics_3d_api.h
index 05a28c929c1..845b35f5f4f 100644
--- a/chromium/ppapi/thunk/ppb_graphics_3d_api.h
+++ b/chromium/ppapi/thunk/ppb_graphics_3d_api.h
@@ -62,6 +62,7 @@ class PPAPI_THUNK_EXPORT PPB_Graphics3D_API {
   virtual void UnmapTexSubImage2DCHROMIUM(const void* mem) = 0;
 
   virtual void EnsureWorkVisible() = 0;
+  virtual void TakeFrontBuffer() = 0;
 };
 
 }  // namespace thunk
diff --git a/chromium/ppapi/thunk/ppb_pdf_api.h b/chromium/ppapi/thunk/ppb_pdf_api.h
index 928c8cdc9fe..4f24d52327b 100644
--- a/chromium/ppapi/thunk/ppb_pdf_api.h
+++ b/chromium/ppapi/thunk/ppb_pdf_api.h
@@ -32,7 +32,14 @@ class PPB_PDF_API {
                                          int* natives_size_out,
                                          const char** snapshot_data_out,
                                          int* snapshot_size_out) = 0;
-
+  virtual void SetAccessibilityViewportInfo(
+      PP_PrivateAccessibilityViewportInfo* viewport_info) = 0;
+  virtual void SetAccessibilityDocInfo(
+      PP_PrivateAccessibilityDocInfo* doc_info) = 0;
+  virtual void SetAccessibilityPageInfo(
+      PP_PrivateAccessibilityPageInfo* page_info,
+      PP_PrivateAccessibilityTextRunInfo text_runs[],
+      PP_PrivateAccessibilityCharInfo chars[]) = 0;
   static const SingletonResourceID kSingletonResourceID = PDF_SINGLETON_ID;
 };
 
diff --git a/chromium/ppapi/thunk/ppb_pdf_thunk.cc b/chromium/ppapi/thunk/ppb_pdf_thunk.cc
index 4966bd4dd69..fbf154a5dc5 100644
--- a/chromium/ppapi/thunk/ppb_pdf_thunk.cc
+++ b/chromium/ppapi/thunk/ppb_pdf_thunk.cc
@@ -131,6 +131,35 @@ void GetV8ExternalSnapshotData(PP_Instance instance,
       natives_size_out, snapshot_data_out, snapshot_size_out);
 }
 
+void SetAccessibilityViewportInfo(
+    PP_Instance instance,
+    PP_PrivateAccessibilityViewportInfo* viewport_info) {
+  EnterInstanceAPI<PPB_PDF_API> enter(instance);
+  if (enter.failed())
+    return;
+  enter.functions()->SetAccessibilityViewportInfo(viewport_info);
+}
+
+void SetAccessibilityDocInfo(
+    PP_Instance instance,
+    PP_PrivateAccessibilityDocInfo* doc_info) {
+  EnterInstanceAPI<PPB_PDF_API> enter(instance);
+  if (enter.failed())
+    return;
+  enter.functions()->SetAccessibilityDocInfo(doc_info);
+}
+
+void SetAccessibilityPageInfo(
+    PP_Instance instance,
+    PP_PrivateAccessibilityPageInfo* page_info,
+    PP_PrivateAccessibilityTextRunInfo text_runs[],
+    PP_PrivateAccessibilityCharInfo chars[]) {
+  EnterInstanceAPI<PPB_PDF_API> enter(instance);
+  if (enter.failed())
+    return;
+  enter.functions()->SetAccessibilityPageInfo(page_info, text_runs, chars);
+}
+
 const PPB_PDF g_ppb_pdf_thunk = {
   &GetFontFileWithFallback,
   &GetFontTableForPrivateFontFile,
@@ -146,6 +175,9 @@ const PPB_PDF g_ppb_pdf_thunk = {
   &SetSelectedText,
   &SetLinkUnderCursor,
   &GetV8ExternalSnapshotData,
+  &SetAccessibilityViewportInfo,
+  &SetAccessibilityDocInfo,
+  &SetAccessibilityPageInfo
 };
 
 }  // namespace
diff --git a/chromium/ppapi/utility/graphics/paint_aggregator.h b/chromium/ppapi/utility/graphics/paint_aggregator.h
index 74e24da6b06..ba214de4d91 100644
--- a/chromium/ppapi/utility/graphics/paint_aggregator.h
+++ b/chromium/ppapi/utility/graphics/paint_aggregator.h
@@ -125,7 +125,7 @@ class PaintAggregator {
   //    InvalidateRect. We need to know this distinction for some operations.
   //
   //  - The paint bounds union is computed on the fly so we don't have to keep
-  //    a rectangle up-to-date as we do different operations.
+  //    a rectangle up to date as we do different operations.
   class InternalPaintUpdate {
    public:
     InternalPaintUpdate();