BASELINE: Update Chromium to 69.0.3497.70

Change-Id: I2b7b56e4e7a8b26656930def0d4575dc32b900a0 Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>
author: Allan Sandfeld Jensen <allan.jensen@qt.io> 2018-08-28 15:28:34 +0200
committer: Allan Sandfeld Jensen <allan.jensen@qt.io> 2018-08-28 13:54:51 +0000
commit: 2a19c63448c84c1805fb1a585c3651318bb86ca7 (patch)
tree: eb17888e8531aa6ee5e85721bd553b832a7e5156 /chromium/ppapi
parent: b014812705fc80bff0a5c120dfcef88f349816dc (diff)
download: qtwebengine-chromium-2a19c63448c84c1805fb1a585c3651318bb86ca7.tar.gz
61 files changed, 525 insertions, 435 deletions
diff --git a/chromium/ppapi/BUILD.gn b/chromium/ppapi/BUILD.gn
index bbaaa45ebd9..7d41dff5e93 100644
--- a/chromium/ppapi/BUILD.gn
+++ b/chromium/ppapi/BUILD.gn
@@ -149,7 +149,11 @@ test_common_source_files = [
 copy("copy_test_files") {
   visibility = [ ":*" ]
   sources = [
-    # Keep "test_case.html.mock-http-headers" with "test_case.html".
+    # Keep "test_case.html.mock-http-headers" with "test_case.html"
+    # and "corb_eligible_resource.json.mock-http-headers" with
+    # "corb_eligible_resource.json".
+    "tests/corb_eligible_resource.json",
+    "tests/corb_eligible_resource.json.mock-http-headers",
     "tests/test_case.html",
     "tests/test_case.html.mock-http-headers",
     "tests/test_page.css",
@@ -231,7 +235,6 @@ source_set("ppapi_tests_sources") {
   deps = [
     ":copy_test_files",
     ":copy_test_files2",
-    "//build/config:exe_and_shlib_deps",
     "//ppapi/cpp",
     "//ppapi/shared_impl",
   ]
@@ -255,7 +258,6 @@ source_set("power_saver_test_plugin_sources") {
   ]
 
   deps = [
-    "//build/config:exe_and_shlib_deps",
     "//ppapi/cpp",
     "//ppapi/shared_impl",
   ]
@@ -282,7 +284,6 @@ source_set("blink_deprecated_test_plugin_sources") {
 
   deps = [
     "//base",
-    "//build/config:exe_and_shlib_deps",
     "//ppapi/cpp",
     "//ppapi/shared_impl",
   ]
@@ -309,7 +310,6 @@ source_set("blink_test_plugin_sources") {
 
   deps = [
     "//base",
-    "//build/config:exe_and_shlib_deps",
     "//ppapi/cpp",
     "//ppapi/shared_impl",
   ]
@@ -393,7 +393,7 @@ test("ppapi_perftests") {
 
   deps = [
     "//base/test:test_support",
-    "//mojo/edk",
+    "//mojo/core/embedder",
     "//ppapi/proxy",
     "//ppapi/proxy:test_support",
     "//ppapi/shared_impl",
@@ -409,7 +409,6 @@ executable("pepper_hash_for_uma") {
 
   deps = [
     "//base",
-    "//build/config:exe_and_shlib_deps",
     "//build/win:default_exe_manifest",
   ]
 }
diff --git a/chromium/ppapi/c/private/ppp_pdf.h b/chromium/ppapi/c/private/ppp_pdf.h
index 7fffc03e7bf..be820fb5186 100644
--- a/chromium/ppapi/c/private/ppp_pdf.h
+++ b/chromium/ppapi/c/private/ppp_pdf.h
@@ -53,7 +53,7 @@ PP_COMPILE_ASSERT_STRUCT_SIZE_IN_BYTES(PP_PdfPrintPresetOptions_Dev, 24);
 
 struct PP_PdfPrintSettings_Dev {
   // Used for N-up mode.
-  uint32_t num_pages_per_sheet;
+  uint32_t pages_per_sheet;
 
   // The scale factor percentage, where 100 indicates default scaling.
   uint32_t scale_factor;
diff --git a/chromium/ppapi/examples/ppapi_example.gni b/chromium/ppapi/examples/ppapi_example.gni
index cb24dcf4667..3cedcc027dc 100644
--- a/chromium/ppapi/examples/ppapi_example.gni
+++ b/chromium/ppapi/examples/ppapi_example.gni
@@ -18,7 +18,7 @@ template("ppapi_example") {
       }
 
       sources = invoker.sources
-      deps = invoker.deps + [ "//build/config:exe_and_shlib_deps" ]
+      deps = invoker.deps
     }
   } else {
     mac_plugin_bundle(target_name) {
diff --git a/chromium/ppapi/host/ppapi_host.cc b/chromium/ppapi/host/ppapi_host.cc
index f3c68fab3de..3f80e73535c 100644
--- a/chromium/ppapi/host/ppapi_host.cc
+++ b/chromium/ppapi/host/ppapi_host.cc
@@ -106,23 +106,21 @@ void PpapiHost::SendReply(const ReplyMessageContext& context,
 
 void PpapiHost::SendUnsolicitedReply(PP_Resource resource,
                                      const IPC::Message& msg) {
-  SendUnsolicitedReplyWithHandles(
-      resource, msg, std::vector<SerializedHandle>());
+  std::vector<SerializedHandle> empty;
+  SendUnsolicitedReplyWithHandles(resource, msg, &empty);
 }
 
 void PpapiHost::SendUnsolicitedReplyWithHandles(
     PP_Resource resource,
     const IPC::Message& msg,
-    const std::vector<SerializedHandle>& handles) {
+    std::vector<SerializedHandle>* handles) {
   TRACE_EVENT2("ppapi proxy", "PpapiHost::SendUnsolicitedReplyWithHandles",
                "Class", IPC_MESSAGE_ID_CLASS(msg.type()),
                "Line", IPC_MESSAGE_ID_LINE(msg.type()));
   DCHECK(resource);  // If this fails, host is probably pending.
   proxy::ResourceMessageReplyParams params(resource, 0);
-  for (std::vector<SerializedHandle>::const_iterator it = handles.begin();
-      it != handles.end(); ++it) {
-    params.AppendHandle(*it);
-  }
+  for (auto& handle : *handles)
+    params.AppendHandle(std::move(handle));
   Send(new PpapiPluginMsg_ResourceReply(params, msg));
 }
 
diff --git a/chromium/ppapi/host/ppapi_host.h b/chromium/ppapi/host/ppapi_host.h
index d170ec0ee6c..f806b46a201 100644
--- a/chromium/ppapi/host/ppapi_host.h
+++ b/chromium/ppapi/host/ppapi_host.h
@@ -65,7 +65,7 @@ class PPAPI_HOST_EXPORT PpapiHost : public IPC::Sender, public IPC::Listener {
   void SendUnsolicitedReplyWithHandles(
       PP_Resource resource,
       const IPC::Message& msg,
-      const std::vector<proxy::SerializedHandle>& handles);
+      std::vector<proxy::SerializedHandle>* handles);
 
   // Create a ResourceHost with the given |nested_msg|.
   std::unique_ptr<ResourceHost> CreateResourceHost(
diff --git a/chromium/ppapi/nacl_irt/DEPS b/chromium/ppapi/nacl_irt/DEPS
index 0cb57a5fe2f..c47b20f1bca 100644
--- a/chromium/ppapi/nacl_irt/DEPS
+++ b/chromium/ppapi/nacl_irt/DEPS
@@ -5,7 +5,7 @@ include_rules = [
   # for plugins only.
   "-ppapi/cpp",
 
-  "+mojo/edk/embedder",
+  "+mojo/core/embedder",
 
   # The untrusted build references the NaCl integrated runtime (IRT).
   "+native_client/src/public",
diff --git a/chromium/ppapi/nacl_irt/irt_start.cc b/chromium/ppapi/nacl_irt/irt_start.cc
index cce1c1d33bf..bf0c708ab8b 100644
--- a/chromium/ppapi/nacl_irt/irt_start.cc
+++ b/chromium/ppapi/nacl_irt/irt_start.cc
@@ -11,7 +11,7 @@
 #include <stdint.h>
 
 #include "base/at_exit.h"
-#include "mojo/edk/embedder/embedder.h"
+#include "mojo/core/embedder/embedder.h"
 #include "native_client/src/public/chrome_main.h"
 #include "native_client/src/public/irt_core.h"
 #include "ppapi/nacl_irt/irt_interfaces.h"
@@ -35,7 +35,7 @@ void nacl_irt_start(uint32_t* info) {
                               MakeIPCHandle(NACL_CHROME_DESC_BASE + 1),
                               MakeIPCHandle(NACL_CHROME_DESC_BASE + 2));
   // The Mojo EDK must be initialized before using IPC.
-  mojo::edk::Init();
+  mojo::core::Init();
   ppapi::StartUpPlugin();
 
   nacl_irt_enter_user_code(info, chrome_irt_query);
diff --git a/chromium/ppapi/nacl_irt/ppapi_dispatcher.cc b/chromium/ppapi/nacl_irt/ppapi_dispatcher.cc
index 604552634e2..b1ec3a916c6 100644
--- a/chromium/ppapi/nacl_irt/ppapi_dispatcher.cc
+++ b/chromium/ppapi/nacl_irt/ppapi_dispatcher.cc
@@ -80,6 +80,20 @@ base::SharedMemoryHandle PpapiDispatcher::ShareSharedMemoryHandleWithRemote(
   return base::SharedMemoryHandle();
 }
 
+base::UnsafeSharedMemoryRegion
+PpapiDispatcher::ShareUnsafeSharedMemoryRegionWithRemote(
+    const base::UnsafeSharedMemoryRegion& region,
+    base::ProcessId remote_pid) {
+  return base::UnsafeSharedMemoryRegion();
+}
+
+base::ReadOnlySharedMemoryRegion
+PpapiDispatcher::ShareReadOnlySharedMemoryRegionWithRemote(
+    const base::ReadOnlySharedMemoryRegion& region,
+    base::ProcessId remote_pid) {
+  return base::ReadOnlySharedMemoryRegion();
+}
+
 std::set<PP_Instance>* PpapiDispatcher::GetGloballySeenInstanceIDSet() {
   return &instances_;
 }
diff --git a/chromium/ppapi/nacl_irt/ppapi_dispatcher.h b/chromium/ppapi/nacl_irt/ppapi_dispatcher.h
index 953db41a450..03eac073d1a 100644
--- a/chromium/ppapi/nacl_irt/ppapi_dispatcher.h
+++ b/chromium/ppapi/nacl_irt/ppapi_dispatcher.h
@@ -64,6 +64,12 @@ class PpapiDispatcher : public proxy::PluginDispatcher::PluginDelegate,
   base::SharedMemoryHandle ShareSharedMemoryHandleWithRemote(
       const base::SharedMemoryHandle& handle,
       base::ProcessId remote_pid) override;
+  base::UnsafeSharedMemoryRegion ShareUnsafeSharedMemoryRegionWithRemote(
+      const base::UnsafeSharedMemoryRegion& region,
+      base::ProcessId remote_pid) override;
+  base::ReadOnlySharedMemoryRegion ShareReadOnlySharedMemoryRegionWithRemote(
+      const base::ReadOnlySharedMemoryRegion& region,
+      base::ProcessId remote_pid) override;
   std::set<PP_Instance>* GetGloballySeenInstanceIDSet() override;
   uint32_t Register(proxy::PluginDispatcher* plugin_dispatcher) override;
   void Unregister(uint32_t plugin_dispatcher_id) override;
diff --git a/chromium/ppapi/proxy/BUILD.gn b/chromium/ppapi/proxy/BUILD.gn
index 1f5e87cb4f2..2b8db741697 100644
--- a/chromium/ppapi/proxy/BUILD.gn
+++ b/chromium/ppapi/proxy/BUILD.gn
@@ -283,7 +283,7 @@ component("proxy") {
     "//gpu/command_buffer/common",
     "//gpu/ipc/common:command_buffer_traits",
     "//media:shared_memory_support",
-    "//mojo/edk",
+    "//mojo/core/embedder",
     "//ppapi/c",
     "//ppapi/shared_impl",
     "//ui/gfx/geometry",
diff --git a/chromium/ppapi/proxy/DEPS b/chromium/ppapi/proxy/DEPS
index 1d3692ea94f..06e0731a8a3 100644
--- a/chromium/ppapi/proxy/DEPS
+++ b/chromium/ppapi/proxy/DEPS
@@ -20,6 +20,6 @@ include_rules = [
 
 specific_include_rules = {
   "ppapi_perftests\.cc": [
-    "+mojo/edk/embedder/embedder.h",
+    "+mojo/core/embedder/embedder.h",
   ]
 }
diff --git a/chromium/ppapi/proxy/audio_input_resource.cc b/chromium/ppapi/proxy/audio_input_resource.cc
index 59b78bfd9bf..60db9b82653 100644
--- a/chromium/ppapi/proxy/audio_input_resource.cc
+++ b/chromium/ppapi/proxy/audio_input_resource.cc
@@ -163,12 +163,13 @@ void AudioInputResource::OnPluginMsgOpenReply(
     CHECK(socket_handle != base::SyncSocket::kInvalidHandle);
 
     SerializedHandle serialized_shared_memory_handle =
-        params.TakeHandleOfTypeAtIndex(1, SerializedHandle::SHARED_MEMORY);
+        params.TakeHandleOfTypeAtIndex(1,
+                                       SerializedHandle::SHARED_MEMORY_REGION);
     CHECK(serialized_shared_memory_handle.IsHandleValid());
 
     open_state_ = OPENED;
-    SetStreamInfo(serialized_shared_memory_handle.shmem(),
-                  serialized_shared_memory_handle.size(),
+    SetStreamInfo(base::ReadOnlySharedMemoryRegion::Deserialize(
+                      serialized_shared_memory_handle.TakeSharedMemoryRegion()),
                   socket_handle);
   } else {
     capturing_ = false;
@@ -180,13 +181,10 @@ void AudioInputResource::OnPluginMsgOpenReply(
 }
 
 void AudioInputResource::SetStreamInfo(
-    base::SharedMemoryHandle shared_memory_handle,
-    size_t shared_memory_size,
+    base::ReadOnlySharedMemoryRegion shared_memory_region,
     base::SyncSocket::Handle socket_handle) {
   socket_.reset(new base::CancelableSyncSocket(socket_handle));
-  shared_memory_.reset(
-      new base::SharedMemory(shared_memory_handle, /*read_only*/ true));
-  DCHECK(!shared_memory_->memory());
+  DCHECK(!shared_memory_mapping_.IsValid());
 
   // Ensure that the allocated memory is enough for the audio bus and buffer
   // parameters. Note that there might be slightly more allocated memory as
@@ -195,16 +193,18 @@ void AudioInputResource::SetStreamInfo(
   // Example: DCHECK_GE(8208, 8192 + 16) for |sample_frame_count_| = 2048.
   shared_memory_size_ = media::ComputeAudioInputBufferSize(
       kAudioInputChannels, sample_frame_count_, 1u);
-  DCHECK_GE(shared_memory_size, shared_memory_size_);
+  DCHECK_GE(shared_memory_region.GetSize(), shared_memory_size_);
 
   // If we fail to map the shared memory into the caller's address space we
   // might as well fail here since nothing will work if this is the case.
-  CHECK(shared_memory_->Map(shared_memory_size_));
+  shared_memory_mapping_ = shared_memory_region.MapAt(0, shared_memory_size_);
+  CHECK(shared_memory_mapping_.IsValid());
 
   // Create a new audio bus and wrap the audio data section in shared memory.
-  media::AudioInputBuffer* buffer =
-      static_cast<media::AudioInputBuffer*>(shared_memory_->memory());
-  audio_bus_ = media::AudioBus::WrapMemory(
+  const media::AudioInputBuffer* buffer =
+      static_cast<const media::AudioInputBuffer*>(
+          shared_memory_mapping_.memory());
+  audio_bus_ = media::AudioBus::WrapReadOnlyMemory(
       kAudioInputChannels, sample_frame_count_, buffer->audio);
 
   // Create an extra integer audio buffer for user audio data callbacks.
@@ -227,7 +227,7 @@ void AudioInputResource::SetStreamInfo(
 void AudioInputResource::StartThread() {
   // Don't start the thread unless all our state is set up correctly.
   if ((!audio_input_callback_0_3_ && !audio_input_callback_) ||
-      !socket_.get() || !capturing_ || !shared_memory_->memory() ||
+      !socket_.get() || !capturing_ || !shared_memory_mapping_.memory() ||
       !audio_bus_.get() || !client_buffer_.get()) {
     return;
   }
@@ -250,8 +250,9 @@ void AudioInputResource::StopThread() {
 void AudioInputResource::Run() {
   // The shared memory represents AudioInputBufferParameters and the actual data
   // buffer stored as an audio bus.
-  media::AudioInputBuffer* buffer =
-      static_cast<media::AudioInputBuffer*>(shared_memory_->memory());
+  const media::AudioInputBuffer* buffer =
+      static_cast<const media::AudioInputBuffer*>(
+          shared_memory_mapping_.memory());
   const uint32_t audio_bus_size_bytes =
       base::checked_cast<uint32_t>(shared_memory_size_ -
                                    sizeof(media::AudioInputBufferParameters));
diff --git a/chromium/ppapi/proxy/audio_input_resource.h b/chromium/ppapi/proxy/audio_input_resource.h
index 809c0dbe119..5c35ac7f7af 100644
--- a/chromium/ppapi/proxy/audio_input_resource.h
+++ b/chromium/ppapi/proxy/audio_input_resource.h
@@ -12,8 +12,8 @@
 
 #include "base/compiler_specific.h"
 #include "base/macros.h"
+#include "base/memory/read_only_shared_memory_region.h"
 #include "base/memory/ref_counted.h"
-#include "base/memory/shared_memory.h"
 #include "base/sync_socket.h"
 #include "base/threading/simple_thread.h"
 #include "ppapi/proxy/device_enumeration_resource_helper.h"
@@ -77,8 +77,7 @@ class AudioInputResource : public PluginResource,
 
   // Sets the shared memory and socket handles. This will automatically start
   // capture if we're currently set to capture.
-  void SetStreamInfo(base::SharedMemoryHandle shared_memory_handle,
-                     size_t shared_memory_size,
+  void SetStreamInfo(base::ReadOnlySharedMemoryRegion shared_memory_region,
                      base::SyncSocket::Handle socket_handle);
 
   // Starts execution of the audio input thread.
@@ -110,7 +109,7 @@ class AudioInputResource : public PluginResource,
   // Sample buffer in shared memory. This pointer is created in
   // SetStreamInfo(). The memory is only mapped when the audio thread is
   // created.
-  std::unique_ptr<base::SharedMemory> shared_memory_;
+  base::ReadOnlySharedMemoryMapping shared_memory_mapping_;
 
   // The size of the sample buffer in bytes.
   size_t shared_memory_size_;
@@ -140,7 +139,7 @@ class AudioInputResource : public PluginResource,
   size_t bytes_per_second_;
 
   // AudioBus for shuttling data across the shared memory.
-  std::unique_ptr<media::AudioBus> audio_bus_;
+  std::unique_ptr<const media::AudioBus> audio_bus_;
   int sample_frame_count_;
 
   // Internal buffer for client's integer audio data.
diff --git a/chromium/ppapi/proxy/audio_output_resource.cc b/chromium/ppapi/proxy/audio_output_resource.cc
index 16956ce4443..d8a85cd1520 100644
--- a/chromium/ppapi/proxy/audio_output_resource.cc
+++ b/chromium/ppapi/proxy/audio_output_resource.cc
@@ -147,12 +147,14 @@ void AudioOutputResource::OnPluginMsgOpenReply(
     CHECK(socket_handle != base::SyncSocket::kInvalidHandle);
 
     SerializedHandle serialized_shared_memory_handle =
-        params.TakeHandleOfTypeAtIndex(1, SerializedHandle::SHARED_MEMORY);
+        params.TakeHandleOfTypeAtIndex(1,
+                                       SerializedHandle::SHARED_MEMORY_REGION);
     CHECK(serialized_shared_memory_handle.IsHandleValid());
 
     open_state_ = OPENED;
-    SetStreamInfo(serialized_shared_memory_handle.shmem(),
-                  serialized_shared_memory_handle.size(), socket_handle);
+    SetStreamInfo(base::UnsafeSharedMemoryRegion::Deserialize(
+                      serialized_shared_memory_handle.TakeSharedMemoryRegion()),
+                  socket_handle);
   } else {
     playing_ = false;
   }
@@ -163,12 +165,9 @@ void AudioOutputResource::OnPluginMsgOpenReply(
 }
 
 void AudioOutputResource::SetStreamInfo(
-    base::SharedMemoryHandle shared_memory_handle,
-    size_t shared_memory_size,
+    base::UnsafeSharedMemoryRegion shared_memory_region,
     base::SyncSocket::Handle socket_handle) {
   socket_.reset(new base::CancelableSyncSocket(socket_handle));
-  shared_memory_.reset(new base::SharedMemory(shared_memory_handle, false));
-  DCHECK(!shared_memory_->memory());
 
   // Ensure that the allocated memory is enough for the audio bus and buffer
   // parameters. Note that there might be slightly more allocated memory as
@@ -177,15 +176,16 @@ void AudioOutputResource::SetStreamInfo(
   // Example: DCHECK_GE(8208, 8192 + 16) for |sample_frame_count_| = 2048.
   shared_memory_size_ = media::ComputeAudioOutputBufferSize(
       kAudioOutputChannels, sample_frame_count_);
-  DCHECK_GE(shared_memory_size, shared_memory_size_);
+  DCHECK_GE(shared_memory_region.GetSize(), shared_memory_size_);
 
   // If we fail to map the shared memory into the caller's address space we
   // might as well fail here since nothing will work if this is the case.
-  CHECK(shared_memory_->Map(shared_memory_size_));
+  shared_memory_mapping_ = shared_memory_region.MapAt(0, shared_memory_size_);
+  CHECK(shared_memory_mapping_.IsValid());
 
   // Create a new audio bus and wrap the audio data section in shared memory.
   media::AudioOutputBuffer* buffer =
-      static_cast<media::AudioOutputBuffer*>(shared_memory_->memory());
+      static_cast<media::AudioOutputBuffer*>(shared_memory_mapping_.memory());
   audio_bus_ = media::AudioBus::WrapMemory(kAudioOutputChannels,
                                            sample_frame_count_, buffer->audio);
 
@@ -197,14 +197,15 @@ void AudioOutputResource::SetStreamInfo(
 
 void AudioOutputResource::StartThread() {
   // Don't start the thread unless all our state is set up correctly.
-  if (!audio_output_callback_ || !socket_.get() || !shared_memory_->memory() ||
-      !audio_bus_.get() || !client_buffer_.get() || bytes_per_second_ == 0)
+  if (!audio_output_callback_ || !socket_.get() ||
+      !shared_memory_mapping_.memory() || !audio_bus_.get() ||
+      !client_buffer_.get() || bytes_per_second_ == 0)
     return;
 
   // Clear contents of shm buffer before starting audio thread. This will
   // prevent a burst of static if for some reason the audio thread doesn't
   // start up quickly enough.
-  memset(shared_memory_->memory(), 0, shared_memory_size_);
+  memset(shared_memory_mapping_.memory(), 0, shared_memory_size_);
   memset(client_buffer_.get(), 0, client_buffer_size_bytes_);
 
   DCHECK(!audio_output_thread_.get());
@@ -227,7 +228,7 @@ void AudioOutputResource::Run() {
   // The shared memory represents AudioOutputBufferParameters and the actual
   // data buffer stored as an audio bus.
   media::AudioOutputBuffer* buffer =
-      static_cast<media::AudioOutputBuffer*>(shared_memory_->memory());
+      static_cast<media::AudioOutputBuffer*>(shared_memory_mapping_.memory());
 
   // This is a constantly increasing counter that is used to verify on the
   // browser side that buffers are in sync.
diff --git a/chromium/ppapi/proxy/audio_output_resource.h b/chromium/ppapi/proxy/audio_output_resource.h
index ee654e1c2e0..3dc96ff4ce3 100644
--- a/chromium/ppapi/proxy/audio_output_resource.h
+++ b/chromium/ppapi/proxy/audio_output_resource.h
@@ -13,7 +13,7 @@
 #include "base/compiler_specific.h"
 #include "base/macros.h"
 #include "base/memory/ref_counted.h"
-#include "base/memory/shared_memory.h"
+#include "base/memory/unsafe_shared_memory_region.h"
 #include "base/sync_socket.h"
 #include "base/threading/simple_thread.h"
 #include "ppapi/c/ppb_audio_config.h"
@@ -72,8 +72,7 @@ class AudioOutputResource : public PluginResource,
   void OnPluginMsgOpenReply(const ResourceMessageReplyParams& params);
 
   // Sets the shared memory and socket handles.
-  void SetStreamInfo(base::SharedMemoryHandle shared_memory_handle,
-                     size_t shared_memory_size,
+  void SetStreamInfo(base::UnsafeSharedMemoryRegion shared_memory_region,
                      base::SyncSocket::Handle socket_handle);
 
   // Starts execution of the audio output thread.
@@ -104,7 +103,7 @@ class AudioOutputResource : public PluginResource,
   // Sample buffer in shared memory. This pointer is created in
   // SetStreamInfo(). The memory is only mapped when the audio thread is
   // created.
-  std::unique_ptr<base::SharedMemory> shared_memory_;
+  base::WritableSharedMemoryMapping shared_memory_mapping_;
 
   // The size of the sample buffer in bytes.
   size_t shared_memory_size_;
diff --git a/chromium/ppapi/proxy/compositor_layer_resource.cc b/chromium/ppapi/proxy/compositor_layer_resource.cc
index 72d6757c49f..6fa92524a73 100644
--- a/chromium/ppapi/proxy/compositor_layer_resource.cc
+++ b/chromium/ppapi/proxy/compositor_layer_resource.cc
@@ -161,10 +161,7 @@ int32_t CompositorLayerResource::SetTexture(
   GLES2Implementation* gl = graphics->gles2_impl();
 
   // Generate a Mailbox for the texture.
-  gl->GenMailboxCHROMIUM(
-      reinterpret_cast<GLbyte*>(data_.texture->mailbox.name));
-  gl->ProduceTextureDirectCHROMIUM(
-      texture, reinterpret_cast<const GLbyte*>(data_.texture->mailbox.name));
+  gl->ProduceTextureDirectCHROMIUM(texture, data_.texture->mailbox.name);
 
   // Set the source size to (1, 1). It will be used to verify the source_rect
   // passed to SetSourceRect().
diff --git a/chromium/ppapi/proxy/gamepad_resource.cc b/chromium/ppapi/proxy/gamepad_resource.cc
index 2ae1c934d56..6489d4e4ef8 100644
--- a/chromium/ppapi/proxy/gamepad_resource.cc
+++ b/chromium/ppapi/proxy/gamepad_resource.cc
@@ -7,7 +7,7 @@
 #include <string.h>
 
 #include "base/bind.h"
-#include "base/memory/shared_memory.h"
+#include "base/memory/read_only_shared_memory_region.h"
 #include "base/threading/platform_thread.h"
 #include "device/gamepad/public/cpp/gamepads.h"
 #include "ppapi/proxy/dispatch_reply_message.h"
@@ -77,13 +77,13 @@ void GamepadResource::Sample(PP_Instance /* instance */,
 void GamepadResource::OnPluginMsgSendMemory(
     const ResourceMessageReplyParams& params) {
   // On failure, the handle will be null and the CHECK below will be tripped.
-  base::SharedMemoryHandle handle;
-  params.TakeSharedMemoryHandleAtIndex(0, &handle);
+  base::ReadOnlySharedMemoryRegion region;
+  params.TakeReadOnlySharedMemoryRegionAtIndex(0, &region);
 
-  shared_memory_.reset(new base::SharedMemory(handle, true));
-  CHECK(shared_memory_->Map(sizeof(device::GamepadHardwareBuffer)));
+  shared_memory_mapping_ = region.Map();
+  CHECK(shared_memory_mapping_.IsValid());
   buffer_ = static_cast<const device::GamepadHardwareBuffer*>(
-      shared_memory_->memory());
+      shared_memory_mapping_.memory());
 }
 
 }  // namespace proxy
diff --git a/chromium/ppapi/proxy/gamepad_resource.h b/chromium/ppapi/proxy/gamepad_resource.h
index eceb908cbb2..957f058bd20 100644
--- a/chromium/ppapi/proxy/gamepad_resource.h
+++ b/chromium/ppapi/proxy/gamepad_resource.h
@@ -9,7 +9,8 @@
 
 #include "base/compiler_specific.h"
 #include "base/macros.h"
-#include "device/gamepad/gamepad_shared_buffer.h"
+#include "base/memory/shared_memory_mapping.h"
+#include "device/gamepad/public/mojom/gamepad_hardware_buffer.h"
 #include "ppapi/c/ppb_gamepad.h"
 #include "ppapi/proxy/plugin_resource.h"
 #include "ppapi/proxy/ppapi_proxy_export.h"
@@ -17,10 +18,6 @@
 
 struct PP_GamepadsSampleData;
 
-namespace base {
-class SharedMemory;
-}
-
 namespace ppapi {
 namespace proxy {
 
@@ -44,7 +41,7 @@ class PPAPI_PROXY_EXPORT GamepadResource
  private:
   void OnPluginMsgSendMemory(const ResourceMessageReplyParams& params);
 
-  std::unique_ptr<base::SharedMemory> shared_memory_;
+  base::ReadOnlySharedMemoryMapping shared_memory_mapping_;
   const device::GamepadHardwareBuffer* buffer_;
 
   // Last data returned so we can use this in the event of a read failure.
diff --git a/chromium/ppapi/proxy/nacl_message_scanner.cc b/chromium/ppapi/proxy/nacl_message_scanner.cc
index 8c31b831664..4fae6974ee6 100644
--- a/chromium/ppapi/proxy/nacl_message_scanner.cc
+++ b/chromium/ppapi/proxy/nacl_message_scanner.cc
@@ -62,17 +62,32 @@ void WriteHandle(int handle_index,
   if (handle.type() == SerializedHandle::SHARED_MEMORY) {
     // Now write the handle itself in POSIX style.
     // This serialization must be kept in sync with
-    // ParamTraits<SharedMemoryHandle>::Write and
-    // ParamTraits<UnguessableToken>::Write.
+    // ParamTraits<SharedMemoryHandle>::Write.
     if (handle.shmem().IsValid()) {
       msg->WriteBool(true);  // valid == true
       msg->WriteInt(handle_index);
-      msg->WriteUInt64(handle.shmem().GetGUID().GetHighForSerialization());
-      msg->WriteUInt64(handle.shmem().GetGUID().GetLowForSerialization());
+      IPC::WriteParam(msg, handle.shmem().GetGUID());
       msg->WriteUInt64(handle.shmem().GetSize());
     } else {
       msg->WriteBool(false);  // valid == false
     }
+  } else if (handle.type() == SerializedHandle::SHARED_MEMORY_REGION) {
+    // Write the region in POSIX style.
+    // This serialization must be kept in sync with
+    // ParamTraits<PlatformSharedMemoryRegion>::Write.
+    const auto& region = handle.shmem_region();
+    if (region.IsValid()) {
+      IPC::WriteParam(msg, true);  // valid == true
+      IPC::WriteParam(msg, region.GetMode());
+      IPC::WriteParam(msg, static_cast<uint64_t>(region.GetSize()));
+      IPC::WriteParam(msg, region.GetGUID());
+      // Writable regions are not supported, so write only one handle index.
+      DCHECK_NE(region.GetMode(),
+                base::subtle::PlatformSharedMemoryRegion::Mode::kWritable);
+      IPC::WriteParam(msg, handle_index);
+    } else {
+      msg->WriteBool(false);  // valid == false
+    }
   } else if (handle.type() != SerializedHandle::INVALID) {
     // Now write the handle itself in POSIX style.
     // This serialization must be kept in sync with
@@ -86,10 +101,10 @@ void WriteHandle(int handle_index,
 // handling. See ScanTuple for how these get used.
 
 // Overload to match SerializedHandle.
-void ScanParam(const SerializedHandle& handle, ScanningResults* results) {
-  results->handles.push_back(handle);
+void ScanParam(SerializedHandle&& handle, ScanningResults* results) {
   if (results->new_msg)
     WriteHandle(results->handle_index++, handle, results->new_msg.get());
+  results->handles.push_back(std::move(handle));
 }
 
 void HandleWriter(int* handle_index,
@@ -99,14 +114,13 @@ void HandleWriter(int* handle_index,
 }
 
 // Overload to match SerializedVar, which can contain handles.
-void ScanParam(const SerializedVar& var, ScanningResults* results) {
-  std::vector<SerializedHandle*> var_handles = var.GetHandles();
-  // Copy any handles and then rewrite the message.
-  for (size_t i = 0; i < var_handles.size(); ++i)
-    results->handles.push_back(*var_handles[i]);
+void ScanParam(SerializedVar&& var, ScanningResults* results) {
+  // Rewrite the message and then copy any handles.
   if (results->new_msg)
     var.WriteDataToMessage(results->new_msg.get(),
                            base::Bind(&HandleWriter, &results->handle_index));
+  for (SerializedHandle* var_handle : var.GetHandles())
+    results->handles.push_back(std::move(*var_handle));
 }
 
 // For PpapiMsg_ResourceReply and the reply to PpapiHostMsg_ResourceSyncCall,
@@ -114,8 +128,7 @@ void ScanParam(const SerializedVar& var, ScanningResults* results) {
 // NOTE: We only intercept handles from host->NaCl. The only kind of
 //       ResourceMessageParams that travels this direction is
 //       ResourceMessageReplyParams, so that's the only one we need to handle.
-void ScanParam(const ResourceMessageReplyParams& params,
-               ScanningResults* results) {
+void ScanParam(ResourceMessageReplyParams&& params, ScanningResults* results) {
   results->pp_resource = params.pp_resource();
   // If the resource reply params don't contain handles, NULL the new message
   // pointer to cancel further rewriting.
@@ -134,20 +147,17 @@ void ScanParam(const ResourceMessageReplyParams& params,
     // vector.
     results->new_msg->WriteInt(static_cast<int>(params.handles().size()));
   }
-  for (Handles::const_iterator iter = params.handles().begin();
-       iter != params.handles().end();
-       ++iter) {
+  std::vector<SerializedHandle> handles;
+  params.TakeAllHandles(&handles);
+  for (SerializedHandle& handle : handles) {
     // ScanParam will write each handle to the new message, if necessary.
-    ScanParam(*iter, results);
+    ScanParam(std::move(handle), results);
   }
-  // Tell ResourceMessageReplyParams that we have taken the handles, so it
-  // shouldn't close them. The NaCl runtime will take ownership of them.
-  params.ConsumeHandles();
 }
 
 // Overload to match nested messages. If we need to rewrite the message, write
 // the parameter.
-void ScanParam(const IPC::Message& param, ScanningResults* results) {
+void ScanParam(IPC::Message&& param, ScanningResults* results) {
   if (results->pp_resource && !results->nested_msg_callback.is_null()) {
     SerializedHandle* handle = NULL;
     if (results->handles.size() == 1)
@@ -159,18 +169,17 @@ void ScanParam(const IPC::Message& param, ScanningResults* results) {
 }
 
 template <class T>
-void ScanParam(const std::vector<T>& vec, ScanningResults* results) {
+void ScanParam(std::vector<T>&& vec, ScanningResults* results) {
   if (results->new_msg)
     IPC::WriteParam(results->new_msg.get(), static_cast<int>(vec.size()));
-  for (const T& element : vec) {
-    ScanParam(element, results);
-  }
+  for (T& element : vec)
+    ScanParam(std::move(element), results);
 }
 
 // Overload to match all other types. If we need to rewrite the message, write
 // the parameter.
 template <class T>
-void ScanParam(const T& param, ScanningResults* results) {
+void ScanParam(T&& param, ScanningResults* results) {
   if (results->new_msg)
     IPC::WriteParam(results->new_msg.get(), param);
 }
@@ -179,26 +188,26 @@ void ScanParam(const T& param, ScanningResults* results) {
 // The idea is to scan elements in the tuple which require special handling,
 // and write them into the |results| struct.
 template <class A>
-void ScanTuple(const std::tuple<A>& t1, ScanningResults* results) {
-  ScanParam(std::get<0>(t1), results);
+void ScanTuple(std::tuple<A>&& t1, ScanningResults* results) {
+  ScanParam(std::move(std::get<0>(t1)), results);
 }
 template <class A, class B>
-void ScanTuple(const std::tuple<A, B>& t1, ScanningResults* results) {
-  ScanParam(std::get<0>(t1), results);
-  ScanParam(std::get<1>(t1), results);
+void ScanTuple(std::tuple<A, B>&& t1, ScanningResults* results) {
+  ScanParam(std::move(std::get<0>(t1)), results);
+  ScanParam(std::move(std::get<1>(t1)), results);
 }
 template <class A, class B, class C>
-void ScanTuple(const std::tuple<A, B, C>& t1, ScanningResults* results) {
-  ScanParam(std::get<0>(t1), results);
-  ScanParam(std::get<1>(t1), results);
-  ScanParam(std::get<2>(t1), results);
+void ScanTuple(std::tuple<A, B, C>&& t1, ScanningResults* results) {
+  ScanParam(std::move(std::get<0>(t1)), results);
+  ScanParam(std::move(std::get<1>(t1)), results);
+  ScanParam(std::move(std::get<2>(t1)), results);
 }
 template <class A, class B, class C, class D>
-void ScanTuple(const std::tuple<A, B, C, D>& t1, ScanningResults* results) {
-  ScanParam(std::get<0>(t1), results);
-  ScanParam(std::get<1>(t1), results);
-  ScanParam(std::get<2>(t1), results);
-  ScanParam(std::get<3>(t1), results);
+void ScanTuple(std::tuple<A, B, C, D>&& t1, ScanningResults* results) {
+  ScanParam(std::move(std::get<0>(t1)), results);
+  ScanParam(std::move(std::get<1>(t1)), results);
+  ScanParam(std::move(std::get<2>(t1)), results);
+  ScanParam(std::move(std::get<3>(t1)), results);
 }
 
 template <class MessageType>
@@ -212,7 +221,7 @@ class MessageScannerImpl {
     typename MessageType::Param params;
     if (!MessageType::Read(msg_, &params))
       return false;
-    ScanTuple(params, results);
+    ScanTuple(std::move(params), results);
     return true;
   }
 
@@ -226,7 +235,7 @@ class MessageScannerImpl {
       int id = IPC::SyncMessage::GetMessageId(*msg_);
       results->new_msg->WriteInt(id);
     }
-    ScanTuple(params, results);
+    ScanTuple(std::move(params), results);
     return true;
   }
 
@@ -240,7 +249,7 @@ class MessageScannerImpl {
       int id = IPC::SyncMessage::GetMessageId(*msg_);
       results->new_msg->WriteInt(id);
     }
-    ScanTuple(params, results);
+    ScanTuple(std::move(params), results);
     return true;
   }
 
diff --git a/chromium/ppapi/proxy/plugin_dispatcher_unittest.cc b/chromium/ppapi/proxy/plugin_dispatcher_unittest.cc
index 2e3f058b043..1d7f2036d33 100644
--- a/chromium/ppapi/proxy/plugin_dispatcher_unittest.cc
+++ b/chromium/ppapi/proxy/plugin_dispatcher_unittest.cc
@@ -73,10 +73,9 @@ TEST_F(PluginDispatcherTest, PPBCreation) {
   EXPECT_FALSE(HasTargetProxy(API_ID_PPB_AUDIO));
   PpapiMsg_PPBAudio_NotifyAudioStreamCreated audio_msg(
       API_ID_PPB_AUDIO, HostResource(), 0,
+      ppapi::proxy::SerializedHandle(ppapi::proxy::SerializedHandle::SOCKET),
       ppapi::proxy::SerializedHandle(
-          ppapi::proxy::SerializedHandle::SOCKET),
-      ppapi::proxy::SerializedHandle(
-          ppapi::proxy::SerializedHandle::SHARED_MEMORY));
+          ppapi::proxy::SerializedHandle::SHARED_MEMORY_REGION));
   plugin_dispatcher()->OnMessageReceived(audio_msg);
   EXPECT_TRUE(HasTargetProxy(API_ID_PPB_AUDIO));
 }
diff --git a/chromium/ppapi/proxy/ppapi_command_buffer_proxy.cc b/chromium/ppapi/proxy/ppapi_command_buffer_proxy.cc
index a4d96e54654..90f4147bd1f 100644
--- a/chromium/ppapi/proxy/ppapi_command_buffer_proxy.cc
+++ b/chromium/ppapi/proxy/ppapi_command_buffer_proxy.cc
@@ -20,7 +20,7 @@ PpapiCommandBufferProxy::PpapiCommandBufferProxy(
     InstanceData::FlushInfo* flush_info,
     LockedSender* sender,
     const gpu::Capabilities& capabilities,
-    const SerializedHandle& shared_state,
+    SerializedHandle shared_state,
     gpu::CommandBufferId command_buffer_id)
     : command_buffer_id_(command_buffer_id),
       capabilities_(capabilities),
@@ -31,8 +31,10 @@ PpapiCommandBufferProxy::PpapiCommandBufferProxy(
       pending_fence_sync_release_(0),
       flushed_fence_sync_release_(0),
       validated_fence_sync_release_(0) {
-  shared_state_shm_.reset(new base::SharedMemory(shared_state.shmem(), false));
-  shared_state_shm_->Map(shared_state.size());
+  base::UnsafeSharedMemoryRegion shmem_region =
+      base::UnsafeSharedMemoryRegion::Deserialize(
+          shared_state.TakeSharedMemoryRegion());
+  shared_state_mapping_ = shmem_region.Map();
 }
 
 PpapiCommandBufferProxy::~PpapiCommandBufferProxy() {
@@ -125,7 +127,7 @@ scoped_refptr<gpu::Buffer> PpapiCommandBufferProxy::CreateTransferBuffer(
   // Assuming we are in the renderer process, the service is responsible for
   // duplicating the handle. This might not be true for NaCl.
   ppapi::proxy::SerializedHandle handle(
-      ppapi::proxy::SerializedHandle::SHARED_MEMORY);
+      ppapi::proxy::SerializedHandle::SHARED_MEMORY_REGION);
   if (!Send(new PpapiHostMsg_PPBGraphics3D_CreateTransferBuffer(
           ppapi::API_ID_PPB_GRAPHICS_3D, resource_,
           base::checked_cast<uint32_t>(size), id, &handle))) {
@@ -134,33 +136,36 @@ scoped_refptr<gpu::Buffer> PpapiCommandBufferProxy::CreateTransferBuffer(
     return NULL;
   }
 
-  if (*id <= 0 || !handle.is_shmem()) {
+  if (*id <= 0 || !handle.is_shmem_region()) {
     if (last_state_.error == gpu::error::kNoError)
       last_state_.error = gpu::error::kOutOfBounds;
     return NULL;
   }
 
-  std::unique_ptr<base::SharedMemory> shared_memory(
-      new base::SharedMemory(handle.shmem(), false));
+  base::UnsafeSharedMemoryRegion shared_memory_region =
+      base::UnsafeSharedMemoryRegion::Deserialize(
+          handle.TakeSharedMemoryRegion());
 
-  // Map the shared memory on demand.
-  if (!shared_memory->memory()) {
-    if (!shared_memory->Map(handle.size())) {
-      if (last_state_.error == gpu::error::kNoError)
-        last_state_.error = gpu::error::kOutOfBounds;
-      *id = -1;
-      return NULL;
-    }
+  base::WritableSharedMemoryMapping shared_memory_mapping =
+      shared_memory_region.Map();
+  if (!shared_memory_mapping.IsValid()) {
+    if (last_state_.error == gpu::error::kNoError)
+      last_state_.error = gpu::error::kOutOfBounds;
+    *id = -1;
+    return NULL;
   }
 
-  return gpu::MakeBufferFromSharedMemory(std::move(shared_memory),
-                                         handle.size());
+  return gpu::MakeBufferFromSharedMemory(std::move(shared_memory_region),
+                                         std::move(shared_memory_mapping));
 }
 
 void PpapiCommandBufferProxy::DestroyTransferBuffer(int32_t id) {
   if (last_state_.error != gpu::error::kNoError)
     return;
 
+  if (flush_info_->flush_pending)
+    FlushInternal();
+
   Send(new PpapiHostMsg_PPBGraphics3D_DestroyTransferBuffer(
       ppapi::API_ID_PPB_GRAPHICS_3D, resource_, id));
 }
@@ -220,8 +225,6 @@ bool PpapiCommandBufferProxy::CanWaitUnverifiedSyncToken(
   return false;
 }
 
-void PpapiCommandBufferProxy::SetSnapshotRequested() {}
-
 void PpapiCommandBufferProxy::SignalQuery(uint32_t query,
                                           base::OnceClosure callback) {
   NOTREACHED();
@@ -295,7 +298,7 @@ void PpapiCommandBufferProxy::TryUpdateState() {
 
 gpu::CommandBufferSharedState* PpapiCommandBufferProxy::shared_state() const {
   return reinterpret_cast<gpu::CommandBufferSharedState*>(
-      shared_state_shm_->memory());
+      shared_state_mapping_.memory());
 }
 
 void PpapiCommandBufferProxy::FlushInternal() {
diff --git a/chromium/ppapi/proxy/ppapi_command_buffer_proxy.h b/chromium/ppapi/proxy/ppapi_command_buffer_proxy.h
index e3b351fb46b..28588f265af 100644
--- a/chromium/ppapi/proxy/ppapi_command_buffer_proxy.h
+++ b/chromium/ppapi/proxy/ppapi_command_buffer_proxy.h
@@ -37,7 +37,7 @@ class PPAPI_PROXY_EXPORT PpapiCommandBufferProxy : public gpu::CommandBuffer,
                           InstanceData::FlushInfo* flush_info,
                           LockedSender* sender,
                           const gpu::Capabilities& capabilities,
-                          const SerializedHandle& shared_state,
+                          SerializedHandle shared_state,
                           gpu::CommandBufferId command_buffer_id);
   ~PpapiCommandBufferProxy() override;
 
@@ -78,7 +78,6 @@ class PPAPI_PROXY_EXPORT PpapiCommandBufferProxy : public gpu::CommandBuffer,
                        base::OnceClosure callback) override;
   void WaitSyncTokenHint(const gpu::SyncToken& sync_token) override;
   bool CanWaitUnverifiedSyncToken(const gpu::SyncToken& sync_token) override;
-  void SetSnapshotRequested() override;
 
  private:
   bool Send(IPC::Message* msg);
@@ -96,7 +95,7 @@ class PPAPI_PROXY_EXPORT PpapiCommandBufferProxy : public gpu::CommandBuffer,
 
   gpu::Capabilities capabilities_;
   State last_state_;
-  std::unique_ptr<base::SharedMemory> shared_state_shm_;
+  base::WritableSharedMemoryMapping shared_state_mapping_;
 
   HostResource resource_;
   InstanceData::FlushInfo* flush_info_;
diff --git a/chromium/ppapi/proxy/ppapi_command_buffer_proxy_unittest.cc b/chromium/ppapi/proxy/ppapi_command_buffer_proxy_unittest.cc
index 19ba9307732..5d1ce9b8fca 100644
--- a/chromium/ppapi/proxy/ppapi_command_buffer_proxy_unittest.cc
+++ b/chromium/ppapi/proxy/ppapi_command_buffer_proxy_unittest.cc
@@ -17,7 +17,8 @@ class PpapiCommandBufferProxyTest : public testing::Test,
                &flush_info_,
                this,
                gpu::Capabilities(),
-               proxy::SerializedHandle(proxy::SerializedHandle::SHARED_MEMORY),
+               proxy::SerializedHandle(
+                   proxy::SerializedHandle::SHARED_MEMORY_REGION),
                gpu::CommandBufferId()) {}
 
   ~PpapiCommandBufferProxyTest() override {}
diff --git a/chromium/ppapi/proxy/ppapi_messages.h b/chromium/ppapi/proxy/ppapi_messages.h
index 1ab15365734..0c492d4f92c 100644
--- a/chromium/ppapi/proxy/ppapi_messages.h
+++ b/chromium/ppapi/proxy/ppapi_messages.h
@@ -231,7 +231,7 @@ IPC_STRUCT_TRAITS_BEGIN(PP_PdfPrintPresetOptions_Dev)
 IPC_STRUCT_TRAITS_END()
 
 IPC_STRUCT_TRAITS_BEGIN(PP_PdfPrintSettings_Dev)
-  IPC_STRUCT_TRAITS_MEMBER(num_pages_per_sheet)
+  IPC_STRUCT_TRAITS_MEMBER(pages_per_sheet)
   IPC_STRUCT_TRAITS_MEMBER(scale_factor)
 IPC_STRUCT_TRAITS_END()
 
@@ -448,7 +448,6 @@ IPC_STRUCT_TRAITS_BEGIN(ppapi::URLRequestInfoData)
   IPC_STRUCT_TRAITS_MEMBER(url)
   IPC_STRUCT_TRAITS_MEMBER(method)
   IPC_STRUCT_TRAITS_MEMBER(headers)
-  IPC_STRUCT_TRAITS_MEMBER(stream_to_file)
   IPC_STRUCT_TRAITS_MEMBER(follow_redirects)
   IPC_STRUCT_TRAITS_MEMBER(record_download_progress)
   IPC_STRUCT_TRAITS_MEMBER(record_upload_progress)
@@ -480,7 +479,6 @@ IPC_STRUCT_TRAITS_BEGIN(ppapi::URLResponseInfoData)
   IPC_STRUCT_TRAITS_MEMBER(status_code)
   IPC_STRUCT_TRAITS_MEMBER(status_text)
   IPC_STRUCT_TRAITS_MEMBER(redirect_url)
-  IPC_STRUCT_TRAITS_MEMBER(body_as_file_ref)
 IPC_STRUCT_TRAITS_END()
 
 IPC_STRUCT_TRAITS_BEGIN(ppapi::proxy::SerializedNetworkInfo)
@@ -2077,14 +2075,14 @@ IPC_MESSAGE_CONTROL3(PpapiHostMsg_VideoDecoder_Decode,
                      int32_t /* decode_id */)
 IPC_MESSAGE_CONTROL1(PpapiPluginMsg_VideoDecoder_DecodeReply,
                      uint32_t /* shm_id */)
-IPC_MESSAGE_CONTROL4(PpapiPluginMsg_VideoDecoder_RequestTextures,
+IPC_MESSAGE_CONTROL3(PpapiPluginMsg_VideoDecoder_RequestTextures,
                      uint32_t /* num_textures */,
                      PP_Size /* size */,
-                     uint32_t /* texture_target */,
-                     std::vector<gpu::Mailbox> /* mailboxes*/)
-IPC_MESSAGE_CONTROL2(PpapiHostMsg_VideoDecoder_AssignTextures,
+                     uint32_t /* texture_target */)
+IPC_MESSAGE_CONTROL3(PpapiHostMsg_VideoDecoder_AssignTextures,
                      PP_Size /* size */,
-                     std::vector<uint32_t> /* texture_ids */)
+                     std::vector<uint32_t> /* texture_ids */,
+                     std::vector<gpu::Mailbox> /* mailboxes */)
 IPC_MESSAGE_CONTROL3(PpapiPluginMsg_VideoDecoder_PictureReady,
                      int32_t /* decode_id */,
                      uint32_t /* texture_id */,
diff --git a/chromium/ppapi/proxy/ppapi_param_traits.cc b/chromium/ppapi/proxy/ppapi_param_traits.cc
index 822c61faa59..b663e8200b9 100644
--- a/chromium/ppapi/proxy/ppapi_param_traits.cc
+++ b/chromium/ppapi/proxy/ppapi_param_traits.cc
@@ -238,6 +238,9 @@ void ParamTraits<ppapi::proxy::SerializedHandle>::Write(base::Pickle* m,
     case ppapi::proxy::SerializedHandle::SHARED_MEMORY:
       WriteParam(m, p.shmem());
       break;
+    case ppapi::proxy::SerializedHandle::SHARED_MEMORY_REGION:
+      WriteParam(m, const_cast<param_type&>(p).TakeSharedMemoryRegion());
+      break;
     case ppapi::proxy::SerializedHandle::SOCKET:
     case ppapi::proxy::SerializedHandle::FILE:
       WriteParam(m, p.descriptor());
@@ -259,33 +262,37 @@ bool ParamTraits<ppapi::proxy::SerializedHandle>::Read(
   switch (header.type) {
     case ppapi::proxy::SerializedHandle::SHARED_MEMORY: {
       base::SharedMemoryHandle handle;
-      if (ReadParam(m, iter, &handle)) {
-        r->set_shmem(handle, header.size);
-        return true;
-      }
+      if (!ReadParam(m, iter, &handle))
+        return false;
+      r->set_shmem(handle, header.size);
+      break;
+    }
+    case ppapi::proxy::SerializedHandle::SHARED_MEMORY_REGION: {
+      base::subtle::PlatformSharedMemoryRegion region;
+      if (!ReadParam(m, iter, &region))
+        return false;
+      r->set_shmem_region(std::move(region));
       break;
     }
     case ppapi::proxy::SerializedHandle::SOCKET: {
       IPC::PlatformFileForTransit socket;
-      if (ReadParam(m, iter, &socket)) {
-        r->set_socket(socket);
-        return true;
-      }
+      if (!ReadParam(m, iter, &socket))
+        return false;
+      r->set_socket(socket);
       break;
     }
     case ppapi::proxy::SerializedHandle::FILE: {
       IPC::PlatformFileForTransit desc;
-      if (ReadParam(m, iter, &desc)) {
-        r->set_file_handle(desc, header.open_flags, header.file_io);
-        return true;
-      }
+      if (!ReadParam(m, iter, &desc))
+        return false;
+      r->set_file_handle(desc, header.open_flags, header.file_io);
       break;
     }
     case ppapi::proxy::SerializedHandle::INVALID:
-      return true;
-    // No default so the compiler will warn us if a new type is added.
+      break;
+      // No default so the compiler will warn us if a new type is added.
   }
-  return false;
+  return true;
 }
 
 // static
diff --git a/chromium/ppapi/proxy/ppapi_perftests.cc b/chromium/ppapi/proxy/ppapi_perftests.cc
index 45b84ee6d62..589a2f87298 100644
--- a/chromium/ppapi/proxy/ppapi_perftests.cc
+++ b/chromium/ppapi/proxy/ppapi_perftests.cc
@@ -3,10 +3,10 @@
 // found in the LICENSE file.
 
 #include "base/test/perf_test_suite.h"
-#include "mojo/edk/embedder/embedder.h"
+#include "mojo/core/embedder/embedder.h"
 
 int main(int argc, char** argv) {
-  mojo::edk::Init();
+  mojo::core::Init();
   return base::PerfTestSuite(argc, argv).Run();
 }
 
diff --git a/chromium/ppapi/proxy/ppapi_proxy_test.cc b/chromium/ppapi/proxy/ppapi_proxy_test.cc
index 587d0de315d..bdb0173ced7 100644
--- a/chromium/ppapi/proxy/ppapi_proxy_test.cc
+++ b/chromium/ppapi/proxy/ppapi_proxy_test.cc
@@ -261,6 +261,20 @@ PluginProxyTestHarness::PluginDelegateMock::ShareSharedMemoryHandleWithRemote(
   return base::SharedMemory::DuplicateHandle(handle);
 }
 
+base::UnsafeSharedMemoryRegion PluginProxyTestHarness::PluginDelegateMock::
+    ShareUnsafeSharedMemoryRegionWithRemote(
+        const base::UnsafeSharedMemoryRegion& region,
+        base::ProcessId /* remote_pid */) {
+  return region.Duplicate();
+}
+
+base::ReadOnlySharedMemoryRegion PluginProxyTestHarness::PluginDelegateMock::
+    ShareReadOnlySharedMemoryRegionWithRemote(
+        const base::ReadOnlySharedMemoryRegion& region,
+        base::ProcessId /* remote_pid */) {
+  return region.Duplicate();
+}
+
 std::set<PP_Instance>*
 PluginProxyTestHarness::PluginDelegateMock::GetGloballySeenInstanceIDSet() {
   return &instance_id_set_;
@@ -498,6 +512,20 @@ HostProxyTestHarness::DelegateMock::ShareSharedMemoryHandleWithRemote(
   return base::SharedMemory::DuplicateHandle(handle);
 }
 
+base::UnsafeSharedMemoryRegion
+HostProxyTestHarness::DelegateMock::ShareUnsafeSharedMemoryRegionWithRemote(
+    const base::UnsafeSharedMemoryRegion& region,
+    base::ProcessId /*remote_pid*/) {
+  return region.Duplicate();
+}
+
+base::ReadOnlySharedMemoryRegion
+HostProxyTestHarness::DelegateMock::ShareReadOnlySharedMemoryRegionWithRemote(
+    const base::ReadOnlySharedMemoryRegion& region,
+    base::ProcessId /*remote_pid*/) {
+  return region.Duplicate();
+}
+
 // HostProxyTest ---------------------------------------------------------------
 
 HostProxyTest::HostProxyTest() : HostProxyTestHarness(SINGLETON_GLOBALS) {
diff --git a/chromium/ppapi/proxy/ppapi_proxy_test.h b/chromium/ppapi/proxy/ppapi_proxy_test.h
index fdb373c0d5d..01ac6a7108b 100644
--- a/chromium/ppapi/proxy/ppapi_proxy_test.h
+++ b/chromium/ppapi/proxy/ppapi_proxy_test.h
@@ -2,6 +2,9 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+#ifndef PPAPI_PROXY_PPAPI_PROXY_TEST_H_
+#define PPAPI_PROXY_PPAPI_PROXY_TEST_H_
+
 #include <stdint.h>
 
 #include <map>
@@ -147,6 +150,12 @@ class PluginProxyTestHarness : public ProxyTestHarnessBase {
     base::SharedMemoryHandle ShareSharedMemoryHandleWithRemote(
         const base::SharedMemoryHandle& handle,
         base::ProcessId remote_pid) override;
+    base::UnsafeSharedMemoryRegion ShareUnsafeSharedMemoryRegionWithRemote(
+        const base::UnsafeSharedMemoryRegion& region,
+        base::ProcessId remote_pid) override;
+    base::ReadOnlySharedMemoryRegion ShareReadOnlySharedMemoryRegionWithRemote(
+        const base::ReadOnlySharedMemoryRegion& region,
+        base::ProcessId remote_pid) override;
 
     // PluginDispatcher::PluginDelegate implementation.
     std::set<PP_Instance>* GetGloballySeenInstanceIDSet() override;
@@ -290,6 +299,12 @@ class HostProxyTestHarness : public ProxyTestHarnessBase {
     base::SharedMemoryHandle ShareSharedMemoryHandleWithRemote(
         const base::SharedMemoryHandle& handle,
         base::ProcessId remote_pid) override;
+    base::UnsafeSharedMemoryRegion ShareUnsafeSharedMemoryRegionWithRemote(
+        const base::UnsafeSharedMemoryRegion& region,
+        base::ProcessId remote_pid) override;
+    base::ReadOnlySharedMemoryRegion ShareReadOnlySharedMemoryRegionWithRemote(
+        const base::ReadOnlySharedMemoryRegion& region,
+        base::ProcessId remote_pid) override;
 
    private:
     base::SingleThreadTaskRunner* ipc_task_runner_;  // Weak
@@ -383,3 +398,5 @@ class TwoWayTest : public testing::Test {
 
 }  // namespace proxy
 }  // namespace ppapi
+
+#endif  // PPAPI_PROXY_PPAPI_PROXY_TEST_H_
diff --git a/chromium/ppapi/proxy/ppb_audio_proxy.cc b/chromium/ppapi/proxy/ppb_audio_proxy.cc
index 0682dc02811..26f7bf2c314 100644
--- a/chromium/ppapi/proxy/ppb_audio_proxy.cc
+++ b/chromium/ppapi/proxy/ppb_audio_proxy.cc
@@ -52,8 +52,7 @@ class Audio : public Resource, public PPB_Audio_Shared {
   int32_t Open(PP_Resource config_id,
                scoped_refptr<TrackedCallback> create_callback) override;
   int32_t GetSyncSocket(int* sync_socket) override;
-  int32_t GetSharedMemory(base::SharedMemory** shm,
-                          uint32_t* shm_size) override;
+  int32_t GetSharedMemory(base::UnsafeSharedMemoryRegion** shm) override;
 
  private:
   // Owning reference to the current config object. This isn't actually used,
@@ -125,7 +124,7 @@ int32_t Audio::GetSyncSocket(int* sync_socket) {
   return PP_ERROR_NOTSUPPORTED;  // Don't proxy the trusted interface.
 }
 
-int32_t Audio::GetSharedMemory(base::SharedMemory** shm, uint32_t* shm_size) {
+int32_t Audio::GetSharedMemory(base::UnsafeSharedMemoryRegion** shm) {
   return PP_ERROR_NOTSUPPORTED;  // Don't proxy the trusted interface.
 }
 
@@ -249,14 +248,12 @@ void PPB_Audio_Proxy::AudioChannelConnected(
     const HostResource& resource) {
   IPC::PlatformFileForTransit socket_handle =
       IPC::InvalidPlatformFileForTransit();
-  base::SharedMemoryHandle shared_memory;
-  uint32_t audio_buffer_length = 0;
+  base::UnsafeSharedMemoryRegion shared_memory_region;
 
   int32_t result_code = result;
   if (result_code == PP_OK) {
     result_code = GetAudioConnectedHandles(resource, &socket_handle,
-                                           &shared_memory,
-                                           &audio_buffer_length);
+                                           &shared_memory_region);
   }
 
   // Send all the values, even on error. This simplifies some of our cleanup
@@ -265,16 +262,18 @@ void PPB_Audio_Proxy::AudioChannelConnected(
   // us, as long as the remote side always closes the handles it receives
   // (in OnMsgNotifyAudioStreamCreated), even in the failure case.
   SerializedHandle fd_wrapper(SerializedHandle::SOCKET, socket_handle);
-  SerializedHandle handle_wrapper(shared_memory, audio_buffer_length);
+  SerializedHandle handle_wrapper(
+      base::UnsafeSharedMemoryRegion::TakeHandleForSerialization(
+          std::move(shared_memory_region)));
   dispatcher()->Send(new PpapiMsg_PPBAudio_NotifyAudioStreamCreated(
-      API_ID_PPB_AUDIO, resource, result_code, fd_wrapper, handle_wrapper));
+      API_ID_PPB_AUDIO, resource, result_code, std::move(fd_wrapper),
+      std::move(handle_wrapper)));
 }
 
 int32_t PPB_Audio_Proxy::GetAudioConnectedHandles(
     const HostResource& resource,
     IPC::PlatformFileForTransit* foreign_socket_handle,
-    base::SharedMemoryHandle* foreign_shared_memory_handle,
-    uint32_t* shared_memory_length) {
+    base::UnsafeSharedMemoryRegion* foreign_shared_memory_region) {
   // Get the audio interface which will give us the handles.
   EnterHostFromHostResource<PPB_Audio_API> enter(resource);
   if (enter.failed())
@@ -293,16 +292,16 @@ int32_t PPB_Audio_Proxy::GetAudioConnectedHandles(
     return PP_ERROR_FAILED;
 
   // Get the shared memory for the buffer.
-  base::SharedMemory* shared_memory;
-  result =
-      enter.object()->GetSharedMemory(&shared_memory, shared_memory_length);
+  base::UnsafeSharedMemoryRegion* shared_memory_region;
+  result = enter.object()->GetSharedMemory(&shared_memory_region);
   if (result != PP_OK)
     return result;
 
-  // shared_memory_handle doesn't belong to us: don't close it.
-  *foreign_shared_memory_handle =
-      dispatcher()->ShareSharedMemoryHandleWithRemote(shared_memory->handle());
-  if (!base::SharedMemory::IsHandleValid(*foreign_shared_memory_handle))
+  // shared_memory_region doesn't belong to us: don't close it.
+  *foreign_shared_memory_region =
+      dispatcher()->ShareUnsafeSharedMemoryRegionWithRemote(
+          *shared_memory_region);
+  if (!foreign_shared_memory_region->IsValid())
     return PP_ERROR_FAILED;
 
   return PP_OK;
@@ -316,23 +315,26 @@ void PPB_Audio_Proxy::OnMsgNotifyAudioStreamCreated(
     SerializedHandle socket_handle,
     SerializedHandle handle) {
   CHECK(socket_handle.is_socket());
-  CHECK(handle.is_shmem());
+  CHECK(handle.is_shmem_region());
   EnterPluginFromHostResource<PPB_Audio_API> enter(audio_id);
   if (enter.failed() || result_code != PP_OK) {
     // The caller may still have given us these handles in the failure case.
-    // The easiest way to clean these up is to just put them in the objects
-    // and then close them. This failure case is not performance critical.
+    // The easiest way to clean socket handle up is to just put them in the
+    // SyncSocket object and then close it. The shared memory region will be
+    // cleaned up automatically. This failure case is not performance critical.
     base::SyncSocket temp_socket(
         IPC::PlatformFileForTransitToPlatformFile(socket_handle.descriptor()));
-    base::SharedMemory temp_mem(handle.shmem(), false);
   } else {
     EnterResourceNoLock<PPB_AudioConfig_API> config(
         static_cast<Audio*>(enter.object())->GetCurrentConfig(), true);
-    static_cast<Audio*>(enter.object())->SetStreamInfo(
-        enter.resource()->pp_instance(), handle.shmem(), handle.size(),
-        IPC::PlatformFileForTransitToPlatformFile(socket_handle.descriptor()),
-        config.object()->GetSampleRate(),
-        config.object()->GetSampleFrameCount());
+    static_cast<Audio*>(enter.object())
+        ->SetStreamInfo(enter.resource()->pp_instance(),
+                        base::UnsafeSharedMemoryRegion::Deserialize(
+                            handle.TakeSharedMemoryRegion()),
+                        IPC::PlatformFileForTransitToPlatformFile(
+                            socket_handle.descriptor()),
+                        config.object()->GetSampleRate(),
+                        config.object()->GetSampleFrameCount());
   }
 }
 
diff --git a/chromium/ppapi/proxy/ppb_audio_proxy.h b/chromium/ppapi/proxy/ppb_audio_proxy.h
index b4d3091c869..2082c7e6ed1 100644
--- a/chromium/ppapi/proxy/ppb_audio_proxy.h
+++ b/chromium/ppapi/proxy/ppb_audio_proxy.h
@@ -10,7 +10,7 @@
 #include <utility>
 
 #include "base/macros.h"
-#include "base/memory/shared_memory.h"
+#include "base/memory/unsafe_shared_memory_region.h"
 #include "base/sync_socket.h"
 #include "ipc/ipc_platform_file.h"
 #include "ppapi/c/pp_instance.h"
@@ -76,8 +76,7 @@ class PPB_Audio_Proxy : public InterfaceProxy {
   int32_t GetAudioConnectedHandles(
       const ppapi::HostResource& resource,
       IPC::PlatformFileForTransit* foreign_socket_handle,
-      base::SharedMemoryHandle* foreign_shared_memory_handle,
-      uint32_t* shared_memory_length);
+      base::UnsafeSharedMemoryRegion* foreign_shared_memory_region);
 
   ProxyCompletionCallbackFactory<PPB_Audio_Proxy> callback_factory_;
 
diff --git a/chromium/ppapi/proxy/ppb_graphics_3d_proxy.cc b/chromium/ppapi/proxy/ppb_graphics_3d_proxy.cc
index 37627d573f7..f42220f6691 100644
--- a/chromium/ppapi/proxy/ppb_graphics_3d_proxy.cc
+++ b/chromium/ppapi/proxy/ppb_graphics_3d_proxy.cc
@@ -29,11 +29,10 @@ namespace proxy {
 namespace {
 
 #if !defined(OS_NACL)
-base::SharedMemoryHandle TransportSHMHandle(
+base::UnsafeSharedMemoryRegion TransportSHMHandle(
     Dispatcher* dispatcher,
-    const base::SharedMemoryHandle& handle) {
-  // Don't close the handle, it doesn't belong to us.
-  return dispatcher->ShareSharedMemoryHandleWithRemote(handle);
+    const base::UnsafeSharedMemoryRegion& region) {
+  return dispatcher->ShareUnsafeSharedMemoryRegionWithRemote(region);
 }
 #endif  // !defined(OS_NACL)
 
@@ -45,9 +44,10 @@ gpu::CommandBuffer::State GetErrorState() {
 
 }  // namespace
 
-Graphics3D::Graphics3D(const HostResource& resource, const gfx::Size& size)
-    : PPB_Graphics3D_Shared(resource, size) {
-}
+Graphics3D::Graphics3D(const HostResource& resource,
+                       const gfx::Size& size,
+                       const bool single_buffer)
+    : PPB_Graphics3D_Shared(resource, size), single_buffer(single_buffer) {}
 
 Graphics3D::~Graphics3D() {
   DestroyGLES2Impl();
@@ -55,7 +55,7 @@ Graphics3D::~Graphics3D() {
 
 bool Graphics3D::Init(gpu::gles2::GLES2Implementation* share_gles2,
                       const gpu::Capabilities& capabilities,
-                      const SerializedHandle& shared_state,
+                      SerializedHandle shared_state,
                       gpu::CommandBufferId command_buffer_id) {
   PluginDispatcher* dispatcher = PluginDispatcher::GetForResource(this);
   if (!dispatcher)
@@ -66,7 +66,7 @@ bool Graphics3D::Init(gpu::gles2::GLES2Implementation* share_gles2,
 
   command_buffer_.reset(new PpapiCommandBufferProxy(
       host_resource(), &data->flush_info, dispatcher, capabilities,
-      shared_state, command_buffer_id));
+      std::move(shared_state), command_buffer_id));
 
   return CreateGLES2Impl(share_gles2);
 }
@@ -126,9 +126,11 @@ int32_t Graphics3D::DoSwapBuffers(const gpu::SyncToken& sync_token,
   gpu::gles2::GLES2Implementation* gl = gles2_impl();
   gl->SwapBuffers(swap_id_++);
 
-  PluginDispatcher::GetForResource(this)->Send(
-      new PpapiHostMsg_PPBGraphics3D_TakeFrontBuffer(API_ID_PPB_GRAPHICS_3D,
-                                                     host_resource()));
+  if (!single_buffer || swap_id_ == 1) {
+    PluginDispatcher::GetForResource(this)->Send(
+        new PpapiHostMsg_PPBGraphics3D_TakeFrontBuffer(API_ID_PPB_GRAPHICS_3D,
+                                                       host_resource()));
+  }
 
   gpu::SyncToken new_sync_token;
   gl->GenSyncTokenCHROMIUM(new_sync_token.GetData());
@@ -240,8 +242,9 @@ PP_Resource PPB_Graphics3D_Proxy::CreateProxyResource(
     return 0;
 
   scoped_refptr<Graphics3D> graphics_3d(
-      new Graphics3D(result, attrib_helper.offscreen_framebuffer_size));
-  if (!graphics_3d->Init(share_gles2, capabilities, shared_state,
+      new Graphics3D(result, attrib_helper.offscreen_framebuffer_size,
+                     attrib_helper.single_buffer));
+  if (!graphics_3d->Init(share_gles2, capabilities, std::move(shared_state),
                          command_buffer_id)) {
     return 0;
   }
@@ -298,14 +301,15 @@ void PPB_Graphics3D_Proxy::OnMsgCreate(
   if (!enter.succeeded())
     return;
 
-  base::SharedMemoryHandle handle;
+  const base::UnsafeSharedMemoryRegion* region = nullptr;
   result->SetHostResource(
       instance, enter.functions()->CreateGraphics3DRaw(
                     instance, share_context.host_resource(), attrib_helper,
-                    capabilities, &handle, command_buffer_id));
+                    capabilities, &region, command_buffer_id));
   if (!result->is_null()) {
-    shared_state->set_shmem(TransportSHMHandle(dispatcher(), handle),
-                            sizeof(gpu::CommandBuffer::State));
+    shared_state->set_shmem_region(
+        base::UnsafeSharedMemoryRegion::TakeHandleForSerialization(
+            TransportSHMHandle(dispatcher(), *region)));
   }
 }
 
@@ -360,7 +364,7 @@ void PPB_Graphics3D_Proxy::OnMsgCreateTransferBuffer(
     uint32_t size,
     int32_t* id,
     SerializedHandle* transfer_buffer) {
-  transfer_buffer->set_null_shmem();
+  transfer_buffer->set_null_shmem_region();
   EnterHostFromHostResource<PPB_Graphics3D_API> enter(context);
   if (enter.succeeded()) {
     scoped_refptr<gpu::Buffer> buffer =
@@ -369,10 +373,10 @@ void PPB_Graphics3D_Proxy::OnMsgCreateTransferBuffer(
       return;
     gpu::SharedMemoryBufferBacking* backing =
         static_cast<gpu::SharedMemoryBufferBacking*>(buffer->backing());
-    DCHECK(backing && backing->shared_memory());
-    transfer_buffer->set_shmem(
-        TransportSHMHandle(dispatcher(), backing->shared_memory()->handle()),
-        base::checked_cast<uint32_t>(buffer->size()));
+    DCHECK(backing && backing->shared_memory_region().IsValid());
+    transfer_buffer->set_shmem_region(
+        base::UnsafeSharedMemoryRegion::TakeHandleForSerialization(
+            TransportSHMHandle(dispatcher(), backing->shared_memory_region())));
   } else {
     *id = -1;
   }
diff --git a/chromium/ppapi/proxy/ppb_graphics_3d_proxy.h b/chromium/ppapi/proxy/ppb_graphics_3d_proxy.h
index 09d7f63a2ee..8d2f636dc1a 100644
--- a/chromium/ppapi/proxy/ppb_graphics_3d_proxy.h
+++ b/chromium/ppapi/proxy/ppb_graphics_3d_proxy.h
@@ -37,12 +37,14 @@ class PpapiCommandBufferProxy;
 
 class PPAPI_PROXY_EXPORT Graphics3D : public PPB_Graphics3D_Shared {
  public:
-  Graphics3D(const HostResource& resource, const gfx::Size& size);
+  Graphics3D(const HostResource& resource,
+             const gfx::Size& size,
+             const bool single_buffer);
   ~Graphics3D() override;
 
   bool Init(gpu::gles2::GLES2Implementation* share_gles2,
             const gpu::Capabilities& capabilities,
-            const SerializedHandle& shared_state,
+            SerializedHandle shared_state,
             gpu::CommandBufferId command_buffer_id);
 
   // Graphics3DTrusted API. These are not implemented in the proxy.
@@ -70,6 +72,7 @@ class PPAPI_PROXY_EXPORT Graphics3D : public PPB_Graphics3D_Shared {
   std::unique_ptr<PpapiCommandBufferProxy> command_buffer_;
 
   uint64_t swap_id_ = 0;
+  bool single_buffer = false;
 
   DISALLOW_COPY_AND_ASSIGN(Graphics3D);
 };
@@ -137,4 +140,3 @@ class PPB_Graphics3D_Proxy : public InterfaceProxy {
 }  // namespace ppapi
 
 #endif  // PPAPI_PROXY_PPB_GRAPHICS_3D_PROXY_H_
-
diff --git a/chromium/ppapi/proxy/proxy_channel.cc b/chromium/ppapi/proxy/proxy_channel.cc
index 7a4c0aa0f99..6aa566fcd43 100644
--- a/chromium/ppapi/proxy/proxy_channel.cc
+++ b/chromium/ppapi/proxy/proxy_channel.cc
@@ -77,6 +77,27 @@ base::SharedMemoryHandle ProxyChannel::ShareSharedMemoryHandleWithRemote(
   return delegate_->ShareSharedMemoryHandleWithRemote(handle, peer_pid_);
 }
 
+base::UnsafeSharedMemoryRegion
+ProxyChannel::ShareUnsafeSharedMemoryRegionWithRemote(
+    const base::UnsafeSharedMemoryRegion& region) {
+  if (!channel_.get())
+    return base::UnsafeSharedMemoryRegion();
+
+  DCHECK(peer_pid_ != base::kNullProcessId);
+  return delegate_->ShareUnsafeSharedMemoryRegionWithRemote(region, peer_pid_);
+}
+
+base::ReadOnlySharedMemoryRegion
+ProxyChannel::ShareReadOnlySharedMemoryRegionWithRemote(
+    const base::ReadOnlySharedMemoryRegion& region) {
+  if (!channel_.get())
+    return base::ReadOnlySharedMemoryRegion();
+
+  DCHECK(peer_pid_ != base::kNullProcessId);
+  return delegate_->ShareReadOnlySharedMemoryRegionWithRemote(region,
+                                                              peer_pid_);
+}
+
 bool ProxyChannel::Send(IPC::Message* msg) {
   if (test_sink_)
     return test_sink_->Send(msg);
diff --git a/chromium/ppapi/proxy/proxy_channel.h b/chromium/ppapi/proxy/proxy_channel.h
index 8a6af71ebfa..ca41f58734f 100644
--- a/chromium/ppapi/proxy/proxy_channel.h
+++ b/chromium/ppapi/proxy/proxy_channel.h
@@ -9,7 +9,9 @@
 
 #include "base/files/scoped_file.h"
 #include "base/macros.h"
+#include "base/memory/read_only_shared_memory_region.h"
 #include "base/memory/shared_memory.h"
+#include "base/memory/unsafe_shared_memory_region.h"
 #include "base/process/process.h"
 #include "build/build_config.h"
 #include "ipc/ipc_listener.h"
@@ -63,6 +65,14 @@ class PPAPI_PROXY_EXPORT ProxyChannel
     virtual base::SharedMemoryHandle ShareSharedMemoryHandleWithRemote(
         const base::SharedMemoryHandle& handle,
         base::ProcessId remote_pid) = 0;
+    virtual base::UnsafeSharedMemoryRegion
+    ShareUnsafeSharedMemoryRegionWithRemote(
+        const base::UnsafeSharedMemoryRegion& region,
+        base::ProcessId remote_pid) = 0;
+    virtual base::ReadOnlySharedMemoryRegion
+    ShareReadOnlySharedMemoryRegionWithRemote(
+        const base::ReadOnlySharedMemoryRegion& region,
+        base::ProcessId remote_pid) = 0;
   };
 
   ~ProxyChannel() override;
@@ -90,6 +100,10 @@ class PPAPI_PROXY_EXPORT ProxyChannel
   // is not closed by this operation.
   base::SharedMemoryHandle ShareSharedMemoryHandleWithRemote(
       const base::SharedMemoryHandle& handle);
+  base::UnsafeSharedMemoryRegion ShareUnsafeSharedMemoryRegionWithRemote(
+      const base::UnsafeSharedMemoryRegion& region);
+  base::ReadOnlySharedMemoryRegion ShareReadOnlySharedMemoryRegionWithRemote(
+      const base::ReadOnlySharedMemoryRegion& region);
 
   // IPC::Sender implementation.
   bool Send(IPC::Message* msg) override;
diff --git a/chromium/ppapi/proxy/resource_creation_proxy.cc b/chromium/ppapi/proxy/resource_creation_proxy.cc
index 2586080f2f6..5fad2078b1c 100644
--- a/chromium/ppapi/proxy/resource_creation_proxy.cc
+++ b/chromium/ppapi/proxy/resource_creation_proxy.cc
@@ -266,7 +266,7 @@ PP_Resource ResourceCreationProxy::CreateGraphics3DRaw(
     PP_Resource share_context,
     const gpu::ContextCreationAttribs& attrib_helper,
     gpu::Capabilities* capabilities,
-    base::SharedMemoryHandle* shared_state,
+    const base::UnsafeSharedMemoryRegion** shared_state,
     gpu::CommandBufferId* command_buffer_id) {
   // Not proxied. The raw creation function is used only in the implementation
   // of the proxy on the host side.
diff --git a/chromium/ppapi/proxy/resource_creation_proxy.h b/chromium/ppapi/proxy/resource_creation_proxy.h
index 16c0c0b3113..777b516437b 100644
--- a/chromium/ppapi/proxy/resource_creation_proxy.h
+++ b/chromium/ppapi/proxy/resource_creation_proxy.h
@@ -123,7 +123,7 @@ class ResourceCreationProxy : public InterfaceProxy,
       PP_Resource share_context,
       const gpu::ContextCreationAttribs& attrib_helper,
       gpu::Capabilities* capabilities,
-      base::SharedMemoryHandle* shared_state,
+      const base::UnsafeSharedMemoryRegion** shared_state,
       gpu::CommandBufferId* command_buffer_id) override;
   PP_Resource CreateHostResolver(PP_Instance instance) override;
   PP_Resource CreateHostResolverPrivate(PP_Instance instance) override;
diff --git a/chromium/ppapi/proxy/resource_message_params.cc b/chromium/ppapi/proxy/resource_message_params.cc
index 9dd744ac19b..253ff367f63 100644
--- a/chromium/ppapi/proxy/resource_message_params.cc
+++ b/chromium/ppapi/proxy/resource_message_params.cc
@@ -5,6 +5,7 @@
 #include "ppapi/proxy/resource_message_params.h"
 
 #include "base/logging.h"
+#include "base/memory/read_only_shared_memory_region.h"
 #include "ppapi/c/pp_errors.h"
 #include "ppapi/proxy/ppapi_messages.h"
 
@@ -84,10 +85,8 @@ SerializedHandle ResourceMessageParams::TakeHandleOfTypeAtIndex(
     SerializedHandle::Type type) const {
   SerializedHandle handle;
   std::vector<SerializedHandle>& data = handles_->data();
-  if (index < data.size() && data[index].type() == type) {
-    handle = data[index];
-    data[index] = SerializedHandle();
-  }
+  if (index < data.size() && data[index].type() == type)
+    handle = std::move(data[index]);
   return handle;
 }
 
@@ -102,6 +101,18 @@ bool ResourceMessageParams::TakeSharedMemoryHandleAtIndex(
   return true;
 }
 
+bool ResourceMessageParams::TakeReadOnlySharedMemoryRegionAtIndex(
+    size_t index,
+    base::ReadOnlySharedMemoryRegion* region) const {
+  SerializedHandle serialized =
+      TakeHandleOfTypeAtIndex(index, SerializedHandle::SHARED_MEMORY_REGION);
+  if (!serialized.is_shmem_region())
+    return false;
+  *region = base::ReadOnlySharedMemoryRegion::Deserialize(
+      serialized.TakeSharedMemoryRegion());
+  return true;
+}
+
 bool ResourceMessageParams::TakeSocketHandleAtIndex(
     size_t index,
     IPC::PlatformFileForTransit* handle) const {
@@ -133,8 +144,15 @@ void ResourceMessageParams::TakeAllSharedMemoryHandles(
   }
 }
 
-void ResourceMessageParams::AppendHandle(const SerializedHandle& handle) const {
-  handles_->data().push_back(handle);
+void ResourceMessageParams::TakeAllHandles(
+    std::vector<SerializedHandle>* handles) const {
+  std::vector<SerializedHandle>& data = handles_->data();
+  for (size_t i = 0; i < data.size(); ++i)
+    handles->push_back(std::move(data[i]));
+}
+
+void ResourceMessageParams::AppendHandle(SerializedHandle handle) const {
+  handles_->data().push_back(std::move(handle));
 }
 
 ResourceMessageCallParams::ResourceMessageCallParams()
diff --git a/chromium/ppapi/proxy/resource_message_params.h b/chromium/ppapi/proxy/resource_message_params.h
index 098f7812dd7..c7d469b2a9a 100644
--- a/chromium/ppapi/proxy/resource_message_params.h
+++ b/chromium/ppapi/proxy/resource_message_params.h
@@ -16,6 +16,10 @@
 #include "ppapi/proxy/ppapi_proxy_export.h"
 #include "ppapi/proxy/serialized_handle.h"
 
+namespace base {
+class ReadOnlySharedMemoryRegion;
+}
+
 namespace ppapi {
 namespace proxy {
 
@@ -60,16 +64,20 @@ class PPAPI_PROXY_EXPORT ResourceMessageParams {
   //          is valid.
   bool TakeSharedMemoryHandleAtIndex(size_t index,
                                      base::SharedMemoryHandle* handle) const;
+  bool TakeReadOnlySharedMemoryRegionAtIndex(
+      size_t index,
+      base::ReadOnlySharedMemoryRegion* region) const;
   bool TakeSocketHandleAtIndex(size_t index,
                                IPC::PlatformFileForTransit* handle) const;
   bool TakeFileHandleAtIndex(size_t index,
                              IPC::PlatformFileForTransit* handle) const;
   void TakeAllSharedMemoryHandles(
       std::vector<base::SharedMemoryHandle>* handles) const;
+  void TakeAllHandles(std::vector<SerializedHandle>* handles) const;
 
   // Appends the given handle to the list of handles sent with the call or
   // reply.
-  void AppendHandle(const SerializedHandle& handle) const;
+  void AppendHandle(SerializedHandle handle) const;
 
  protected:
   ResourceMessageParams();
diff --git a/chromium/ppapi/proxy/resource_message_test_sink.cc b/chromium/ppapi/proxy/resource_message_test_sink.cc
index 71bff599865..b055f72f42e 100644
--- a/chromium/ppapi/proxy/resource_message_test_sink.cc
+++ b/chromium/ppapi/proxy/resource_message_test_sink.cc
@@ -10,7 +10,6 @@
 
 #include "ppapi/proxy/ppapi_messages.h"
 #include "ppapi/proxy/resource_message_params.h"
-#include "ppapi/proxy/serialized_handle.h"
 
 namespace ppapi {
 namespace proxy {
@@ -120,7 +119,6 @@ ResourceSyncCallHandler::ResourceSyncCallHandler(
     : test_sink_(test_sink),
       incoming_type_(incoming_type),
       result_(result),
-      serialized_handle_(NULL),
       reply_msg_(reply_msg) {}
 
 ResourceSyncCallHandler::~ResourceSyncCallHandler() {
@@ -142,7 +140,7 @@ bool ResourceSyncCallHandler::OnMessageReceived(const IPC::Message& msg) {
                                           call_params.sequence());
   reply_params.set_result(result_);
   if (serialized_handle_)
-    reply_params.AppendHandle(*serialized_handle_);
+    reply_params.AppendHandle(std::move(*serialized_handle_));
   PpapiHostMsg_ResourceSyncCall::WriteReplyParams(
       wrapper_reply_msg, reply_params, reply_msg_);
   test_sink_->SetSyncReplyMessage(wrapper_reply_msg);
@@ -152,5 +150,10 @@ bool ResourceSyncCallHandler::OnMessageReceived(const IPC::Message& msg) {
   return true;
 }
 
+void ResourceSyncCallHandler::set_serialized_handle(
+    std::unique_ptr<SerializedHandle> serialized_handle) {
+  serialized_handle_ = std::move(serialized_handle);
+}
+
 }  // namespace proxy
 }  // namespace ppapi
diff --git a/chromium/ppapi/proxy/resource_message_test_sink.h b/chromium/ppapi/proxy/resource_message_test_sink.h
index a2430606ec8..623268a98a5 100644
--- a/chromium/ppapi/proxy/resource_message_test_sink.h
+++ b/chromium/ppapi/proxy/resource_message_test_sink.h
@@ -87,17 +87,15 @@ class ResourceSyncCallHandler : public IPC::Listener {
 
   IPC::Message last_handled_msg() { return last_handled_msg_; }
 
-  // Sets a handle to be appended to the ReplyParams. The pointer is owned by
-  // the caller.
-  void set_serialized_handle(const SerializedHandle* serialized_handle) {
-    serialized_handle_ = serialized_handle;
-  }
+  // Sets a handle to be appended to the ReplyParams.
+  void set_serialized_handle(
+      std::unique_ptr<SerializedHandle> serialized_handle);
 
  private:
   ResourceMessageTestSink* test_sink_;
   uint32_t incoming_type_;
   int32_t result_;
-  const SerializedHandle* serialized_handle_;  // Non-owning pointer.
+  std::unique_ptr<SerializedHandle> serialized_handle_;
   IPC::Message reply_msg_;
   IPC::Message last_handled_msg_;
 };
diff --git a/chromium/ppapi/proxy/serialized_handle.cc b/chromium/ppapi/proxy/serialized_handle.cc
index 85595b318f3..92f945d1117 100644
--- a/chromium/ppapi/proxy/serialized_handle.cc
+++ b/chromium/ppapi/proxy/serialized_handle.cc
@@ -25,6 +25,30 @@ SerializedHandle::SerializedHandle()
       file_io_(0) {
 }
 
+SerializedHandle::SerializedHandle(SerializedHandle&& other)
+    : type_(other.type_),
+      shm_handle_(other.shm_handle_),
+      size_(other.size_),
+      shm_region_(std::move(other.shm_region_)),
+      descriptor_(other.descriptor_),
+      open_flags_(other.open_flags_),
+      file_io_(other.file_io_) {
+  other.set_null();
+}
+
+SerializedHandle& SerializedHandle::operator=(SerializedHandle&& other) {
+  Close();
+  type_ = other.type_;
+  shm_handle_ = other.shm_handle_;
+  size_ = other.size_;
+  shm_region_ = std::move(other.shm_region_);
+  descriptor_ = other.descriptor_;
+  open_flags_ = other.open_flags_;
+  file_io_ = other.file_io_;
+  other.set_null();
+  return *this;
+}
+
 SerializedHandle::SerializedHandle(Type type_param)
     : type_(type_param),
       size_(0),
@@ -43,6 +67,19 @@ SerializedHandle::SerializedHandle(const base::SharedMemoryHandle& handle,
       file_io_(0) {}
 
 SerializedHandle::SerializedHandle(
+    base::subtle::PlatformSharedMemoryRegion region)
+    : type_(SHARED_MEMORY_REGION),
+      size_(0),
+      shm_region_(std::move(region)),
+      descriptor_(IPC::InvalidPlatformFileForTransit()),
+      open_flags_(0),
+      file_io_(0) {
+  // Writable regions are not supported.
+  DCHECK_NE(shm_region_.GetMode(),
+            base::subtle::PlatformSharedMemoryRegion::Mode::kWritable);
+}
+
+SerializedHandle::SerializedHandle(
     Type type,
     const IPC::PlatformFileForTransit& socket_descriptor)
     : type_(type),
@@ -56,6 +93,8 @@ bool SerializedHandle::IsHandleValid() const {
   switch (type_) {
     case SHARED_MEMORY:
       return base::SharedMemory::IsHandleValid(shm_handle_);
+    case SHARED_MEMORY_REGION:
+      return shm_region_.IsValid();
     case SOCKET:
     case FILE:
       return !(IPC::InvalidPlatformFileForTransit() == descriptor_);
@@ -75,6 +114,9 @@ void SerializedHandle::Close() {
       case SHARED_MEMORY:
         base::SharedMemory::CloseHandle(shm_handle_);
         break;
+      case SHARED_MEMORY_REGION:
+        shm_region_ = base::subtle::PlatformSharedMemoryRegion();
+        break;
       case SOCKET:
       case FILE:
         base::File file_closer = IPC::PlatformFileForTransitToFile(descriptor_);
@@ -82,7 +124,7 @@ void SerializedHandle::Close() {
       // No default so the compiler will warn us if a new type is added.
     }
   }
-  *this = SerializedHandle();
+  set_null();
 }
 
 // static
@@ -122,6 +164,7 @@ bool SerializedHandle::ReadHeader(base::PickleIterator* iter, Header* hdr) {
       valid_type = true;
       break;
     }
+    case SHARED_MEMORY_REGION:
     case SOCKET:
     case INVALID:
       valid_type = true;
diff --git a/chromium/ppapi/proxy/serialized_handle.h b/chromium/ppapi/proxy/serialized_handle.h
index 0df012d1c84..825188312ee 100644
--- a/chromium/ppapi/proxy/serialized_handle.h
+++ b/chromium/ppapi/proxy/serialized_handle.h
@@ -12,6 +12,7 @@
 
 #include "base/atomicops.h"
 #include "base/logging.h"
+#include "base/memory/platform_shared_memory_region.h"
 #include "base/memory/ref_counted.h"
 #include "base/memory/shared_memory.h"
 #include "build/build_config.h"
@@ -32,7 +33,9 @@ namespace proxy {
 // NaClIPCAdapter for use in NaCl.
 class PPAPI_PROXY_EXPORT SerializedHandle {
  public:
-  enum Type { INVALID, SHARED_MEMORY, SOCKET, FILE };
+  // TODO(https://crbug.com/845985): Remove SHARED_MEMORY type after all clients
+  // will be converted to the SHARED_MEMORY_REGION.
+  enum Type { INVALID, SHARED_MEMORY, SHARED_MEMORY_REGION, SOCKET, FILE };
   // Header contains the fields that we send in IPC messages, apart from the
   // actual handle. See comments on the SerializedHandle fields below.
   struct Header {
@@ -53,18 +56,25 @@ class PPAPI_PROXY_EXPORT SerializedHandle {
   };
 
   SerializedHandle();
+  // Move operations are allowed.
+  SerializedHandle(SerializedHandle&&);
+  SerializedHandle& operator=(SerializedHandle&&);
   // Create an invalid handle of the given type.
   explicit SerializedHandle(Type type);
 
   // Create a shared memory handle.
   SerializedHandle(const base::SharedMemoryHandle& handle, uint32_t size);
 
+  // Create a shared memory region handle.
+  explicit SerializedHandle(base::subtle::PlatformSharedMemoryRegion region);
+
   // Create a socket or file handle.
   SerializedHandle(const Type type,
                    const IPC::PlatformFileForTransit& descriptor);
 
   Type type() const { return type_; }
   bool is_shmem() const { return type_ == SHARED_MEMORY; }
+  bool is_shmem_region() const { return type_ == SHARED_MEMORY_REGION; }
   bool is_socket() const { return type_ == SOCKET; }
   bool is_file() const { return type_ == FILE; }
   const base::SharedMemoryHandle& shmem() const {
@@ -75,6 +85,14 @@ class PPAPI_PROXY_EXPORT SerializedHandle {
     DCHECK(is_shmem());
     return size_;
   }
+  const base::subtle::PlatformSharedMemoryRegion& shmem_region() const {
+    DCHECK(is_shmem_region());
+    return shm_region_;
+  }
+  base::subtle::PlatformSharedMemoryRegion TakeSharedMemoryRegion() {
+    DCHECK(is_shmem_region());
+    return std::move(shm_region_);
+  }
   const IPC::PlatformFileForTransit& descriptor() const {
     DCHECK(is_socket() || is_file());
     return descriptor_;
@@ -89,11 +107,24 @@ class PPAPI_PROXY_EXPORT SerializedHandle {
     size_ = size;
 
     descriptor_ = IPC::InvalidPlatformFileForTransit();
+    shm_region_ = base::subtle::PlatformSharedMemoryRegion();
+  }
+  void set_shmem_region(base::subtle::PlatformSharedMemoryRegion region) {
+    type_ = SHARED_MEMORY_REGION;
+    shm_region_ = std::move(region);
+    // Writable regions are not supported.
+    DCHECK_NE(shm_region_.GetMode(),
+              base::subtle::PlatformSharedMemoryRegion::Mode::kWritable);
+
+    descriptor_ = IPC::InvalidPlatformFileForTransit();
+    shm_handle_ = base::SharedMemoryHandle();
+    size_ = 0;
   }
   void set_socket(const IPC::PlatformFileForTransit& socket) {
     type_ = SOCKET;
     descriptor_ = socket;
 
+    shm_region_ = base::subtle::PlatformSharedMemoryRegion();
     shm_handle_ = base::SharedMemoryHandle();
     size_ = 0;
   }
@@ -103,12 +134,24 @@ class PPAPI_PROXY_EXPORT SerializedHandle {
     type_ = FILE;
 
     descriptor_ = descriptor;
+    shm_region_ = base::subtle::PlatformSharedMemoryRegion();
     shm_handle_ = base::SharedMemoryHandle();
     size_ = 0;
     open_flags_ = open_flags;
     file_io_ = file_io;
   }
+  void set_null() {
+    type_ = INVALID;
+
+    shm_handle_ = base::SharedMemoryHandle();
+    shm_region_ = base::subtle::PlatformSharedMemoryRegion();
+    size_ = 0;
+    descriptor_ = IPC::InvalidPlatformFileForTransit();
+  }
   void set_null_shmem() { set_shmem(base::SharedMemoryHandle(), 0); }
+  void set_null_shmem_region() {
+    set_shmem_region(base::subtle::PlatformSharedMemoryRegion());
+  }
   void set_null_socket() {
     set_socket(IPC::InvalidPlatformFileForTransit());
   }
@@ -142,6 +185,9 @@ class PPAPI_PROXY_EXPORT SerializedHandle {
   base::SharedMemoryHandle shm_handle_;
   uint32_t size_;
 
+  // This is valid if type == SHARED_MEMORY_REGION.
+  base::subtle::PlatformSharedMemoryRegion shm_region_;
+
   // This is valid if type == SOCKET || type == FILE.
   IPC::PlatformFileForTransit descriptor_;
 
@@ -149,6 +195,8 @@ class PPAPI_PROXY_EXPORT SerializedHandle {
   int32_t open_flags_;
   // This is non-zero if file writes require quota checking.
   PP_Resource file_io_;
+
+  DISALLOW_COPY_AND_ASSIGN(SerializedHandle);
 };
 
 }  // namespace proxy
diff --git a/chromium/ppapi/proxy/url_loader_resource.cc b/chromium/ppapi/proxy/url_loader_resource.cc
index f64a464af02..af942eae436 100644
--- a/chromium/ppapi/proxy/url_loader_resource.cc
+++ b/chromium/ppapi/proxy/url_loader_resource.cc
@@ -16,7 +16,6 @@
 #include "ppapi/proxy/ppapi_messages.h"
 #include "ppapi/proxy/url_request_info_resource.h"
 #include "ppapi/proxy/url_response_info_resource.h"
-#include "ppapi/shared_impl/ppapi_features.h"
 #include "ppapi/shared_impl/ppapi_globals.h"
 #include "ppapi/shared_impl/url_response_info_data.h"
 #include "ppapi/thunk/enter.h"
@@ -160,11 +159,6 @@ int32_t URLLoaderResource::ReadResponseBody(
   if (!response_info_.get())
     return PP_ERROR_FAILED;
 
-  // Fail if we have a valid file ref.
-  // ReadResponseBody() is for reading to a user-provided buffer.
-  if (response_info_->data().body_as_file_ref.IsValid())
-    return PP_ERROR_FAILED;
-
   if (bytes_to_read <= 0 || !buffer)
     return PP_ERROR_BADARGUMENT;
 
@@ -187,30 +181,7 @@ int32_t URLLoaderResource::ReadResponseBody(
 
 int32_t URLLoaderResource::FinishStreamingToFile(
     scoped_refptr<TrackedCallback> callback) {
-  if (!base::FeatureList::IsEnabled(features::kStreamToFile))
-    return PP_ERROR_NOTSUPPORTED;
-
-  int32_t rv = ValidateCallback(callback);
-  if (rv != PP_OK)
-    return rv;
-  if (!response_info_.get())
-    return PP_ERROR_FAILED;
-
-  // Fail if we do not have a valid file ref.
-  if (!response_info_->data().body_as_file_ref.IsValid())
-    return PP_ERROR_FAILED;
-
-  // We may have already reached EOF.
-  if (done_status_ != PP_OK_COMPLETIONPENDING)
-    return done_status_;
-
-  is_streaming_to_file_ = true;
-  if (is_asynchronous_load_suspended_)
-    SetDefersLoading(false);
-
-  // Wait for didFinishLoading / didFail.
-  RegisterCallback(callback);
-  return PP_OK_COMPLETIONPENDING;
+  return PP_ERROR_NOTSUPPORTED;
 }
 
 void URLLoaderResource::Close() {
@@ -366,15 +337,8 @@ void URLLoaderResource::RunCallback(int32_t result) {
 }
 
 void URLLoaderResource::SaveResponseInfo(const URLResponseInfoData& data) {
-  // Create a proxy resource for the the file ref host resource if needed.
-  PP_Resource body_as_file_ref = 0;
-  if (data.body_as_file_ref.IsValid()) {
-    body_as_file_ref = FileRefResource::CreateFileRef(connection(),
-                                                      pp_instance(),
-                                                      data.body_as_file_ref);
-  }
-  response_info_ = new URLResponseInfoResource(
-      connection(), pp_instance(), data, body_as_file_ref);
+  response_info_ =
+      new URLResponseInfoResource(connection(), pp_instance(), data);
 }
 
 int32_t URLLoaderResource::FillUserBuffer() {
diff --git a/chromium/ppapi/proxy/url_request_info_resource.cc b/chromium/ppapi/proxy/url_request_info_resource.cc
index 9d554f4a304..77d20e0a2bb 100644
--- a/chromium/ppapi/proxy/url_request_info_resource.cc
+++ b/chromium/ppapi/proxy/url_request_info_resource.cc
@@ -5,7 +5,6 @@
 #include "ppapi/proxy/url_request_info_resource.h"
 
 #include "base/strings/string_number_conversions.h"
-#include "ppapi/shared_impl/ppapi_features.h"
 #include "ppapi/shared_impl/var.h"
 #include "ppapi/thunk/enter.h"
 #include "ppapi/thunk/ppb_file_ref_api.h"
@@ -147,11 +146,6 @@ bool URLRequestInfoResource::SetBooleanProperty(
   // without also adding them to PPB_URLRequestInfo_Impl::ValidateData. See
   // SetProperty() above for why.
   switch (property) {
-    case PP_URLREQUESTPROPERTY_STREAMTOFILE:
-      if (!base::FeatureList::IsEnabled(features::kStreamToFile))
-        return false;
-      data_.stream_to_file = value;
-      return true;
     case PP_URLREQUESTPROPERTY_FOLLOWREDIRECTS:
       data_.follow_redirects = value;
       return true;
diff --git a/chromium/ppapi/proxy/url_response_info_resource.cc b/chromium/ppapi/proxy/url_response_info_resource.cc
index 74370daffcd..a76ac493513 100644
--- a/chromium/ppapi/proxy/url_response_info_resource.cc
+++ b/chromium/ppapi/proxy/url_response_info_resource.cc
@@ -25,12 +25,8 @@ bool IsRedirect(int32_t status) {
 URLResponseInfoResource::URLResponseInfoResource(
     Connection connection,
     PP_Instance instance,
-    const URLResponseInfoData& data,
-    PP_Resource file_ref_resource)
-    : PluginResource(connection, instance),
-      data_(data),
-      body_as_file_ref_(ScopedPPResource::PassRef(), file_ref_resource) {
-}
+    const URLResponseInfoData& data)
+    : PluginResource(connection, instance), data_(data) {}
 
 URLResponseInfoResource::~URLResponseInfoResource() {
 }
@@ -64,11 +60,7 @@ PP_Var URLResponseInfoResource::GetProperty(PP_URLResponseProperty property) {
 }
 
 PP_Resource URLResponseInfoResource::GetBodyAsFileRef() {
-  if (!body_as_file_ref_.get())
-    return 0;
-  PpapiGlobals::Get()->GetResourceTracker()->AddRefResource(
-      body_as_file_ref_.get());
-  return body_as_file_ref_.get();
+  return 0;
 }
 
 }  // namespace proxy
diff --git a/chromium/ppapi/proxy/url_response_info_resource.h b/chromium/ppapi/proxy/url_response_info_resource.h
index 6b0678b7fd0..66f494927a3 100644
--- a/chromium/ppapi/proxy/url_response_info_resource.h
+++ b/chromium/ppapi/proxy/url_response_info_resource.h
@@ -20,14 +20,9 @@ class PPAPI_PROXY_EXPORT URLResponseInfoResource
     : public PluginResource,
       public thunk::PPB_URLResponseInfo_API {
  public:
-  // The file_ref_resource should be the body_as_file_ref host resource in the
-  // |data| converted to a resource valid in the current process (if we're
-  // downloading to a file; it will be 0 if we're not). A reference
-  // is passed from the caller and is taken over by this object.
   URLResponseInfoResource(Connection connection,
                           PP_Instance instance,
-                          const URLResponseInfoData& data,
-                          PP_Resource file_ref_resource);
+                          const URLResponseInfoData& data);
   ~URLResponseInfoResource() override;
 
   // Resource override.
@@ -42,9 +37,6 @@ class PPAPI_PROXY_EXPORT URLResponseInfoResource
  private:
   URLResponseInfoData data_;
 
-  // Non-zero when the load is being streamed to a file.
-  ScopedPPResource body_as_file_ref_;
-
   DISALLOW_COPY_AND_ASSIGN(URLResponseInfoResource);
 };
 
diff --git a/chromium/ppapi/proxy/video_decoder_resource.cc b/chromium/ppapi/proxy/video_decoder_resource.cc
index 2a212ce3376..bcd60561198 100644
--- a/chromium/ppapi/proxy/video_decoder_resource.cc
+++ b/chromium/ppapi/proxy/video_decoder_resource.cc
@@ -373,14 +373,13 @@ void VideoDecoderResource::OnPluginMsgRequestTextures(
     const ResourceMessageReplyParams& params,
     uint32_t num_textures,
     const PP_Size& size,
-    uint32_t texture_target,
-    const std::vector<gpu::Mailbox>& mailboxes) {
+    uint32_t texture_target) {
   DCHECK(num_textures);
   DCHECK(num_textures >= min_picture_count_);
-  DCHECK(mailboxes.empty() || mailboxes.size() == num_textures);
   std::vector<uint32_t> texture_ids(num_textures);
+  std::vector<gpu::Mailbox> mailboxes(num_textures);
   if (gles2_impl_) {
-    gles2_impl_->GenTextures(num_textures, &texture_ids.front());
+    gles2_impl_->GenTextures(num_textures, texture_ids.data());
     for (uint32_t i = 0; i < num_textures; ++i) {
       gles2_impl_->ActiveTexture(GL_TEXTURE0);
       gles2_impl_->BindTexture(texture_target, texture_ids[i]);
@@ -404,10 +403,8 @@ void VideoDecoderResource::OnPluginMsgRequestTextures(
                                 GL_UNSIGNED_BYTE,
                                 NULL);
       }
-      if (!mailboxes.empty()) {
-        gles2_impl_->ProduceTextureDirectCHROMIUM(
-            texture_ids[i], reinterpret_cast<const GLbyte*>(mailboxes[i].name));
-      }
+      gles2_impl_->ProduceTextureDirectCHROMIUM(texture_ids[i],
+                                                mailboxes[i].name);
 
       textures_.insert(
           std::make_pair(texture_ids[i], Texture(texture_target, size)));
@@ -423,7 +420,8 @@ void VideoDecoderResource::OnPluginMsgRequestTextures(
     }
   }
 
-  Post(RENDERER, PpapiHostMsg_VideoDecoder_AssignTextures(size, texture_ids));
+  Post(RENDERER, PpapiHostMsg_VideoDecoder_AssignTextures(
+                     size, std::move(texture_ids), std::move(mailboxes)));
 }
 
 void VideoDecoderResource::OnPluginMsgPictureReady(
diff --git a/chromium/ppapi/proxy/video_decoder_resource.h b/chromium/ppapi/proxy/video_decoder_resource.h
index 74a607499d5..2f6758763cd 100644
--- a/chromium/ppapi/proxy/video_decoder_resource.h
+++ b/chromium/ppapi/proxy/video_decoder_resource.h
@@ -22,7 +22,6 @@
 #include "ppapi/thunk/ppb_video_decoder_api.h"
 
 namespace gpu {
-struct Mailbox;
 namespace gles2 {
 class GLES2Implementation;
 }
@@ -121,8 +120,7 @@ class PPAPI_PROXY_EXPORT VideoDecoderResource
   void OnPluginMsgRequestTextures(const ResourceMessageReplyParams& params,
                                   uint32_t num_textures,
                                   const PP_Size& size,
-                                  uint32_t texture_target,
-                                  const std::vector<gpu::Mailbox>& mailboxes);
+                                  uint32_t texture_target);
   void OnPluginMsgPictureReady(const ResourceMessageReplyParams& params,
                                int32_t decode_id,
                                uint32_t texture_id,
diff --git a/chromium/ppapi/proxy/video_decoder_resource_unittest.cc b/chromium/ppapi/proxy/video_decoder_resource_unittest.cc
index f67b6224fd1..9b3efee82a7 100644
--- a/chromium/ppapi/proxy/video_decoder_resource_unittest.cc
+++ b/chromium/ppapi/proxy/video_decoder_resource_unittest.cc
@@ -76,18 +76,6 @@ class VideoDecoderResourceTest : public PluginProxyTest {
                                                       nested_message);
   }
 
-  void SendReplyWithHandle(const ResourceMessageCallParams& params,
-                           int32_t result,
-                           const IPC::Message& nested_message,
-                           const SerializedHandle& handle) {
-    ResourceMessageReplyParams reply_params(params.pp_resource(),
-                                            params.sequence());
-    reply_params.set_result(result);
-    reply_params.AppendHandle(handle);
-    PluginMessageFilter::DispatchResourceReplyForTest(reply_params,
-                                                      nested_message);
-  }
-
   PP_Resource CreateDecoder() {
     PP_Resource result = decoder_iface()->Create(pp_instance());
     if (result) {
@@ -108,7 +96,9 @@ class VideoDecoderResourceTest : public PluginProxyTest {
     HostResource host_resource;
     host_resource.SetHostResource(pp_instance(), kGraphics3D);
     scoped_refptr<ppapi::proxy::Graphics3D> graphics_3d(
-        new ppapi::proxy::Graphics3D(host_resource, gfx::Size(640, 480)));
+        new ppapi::proxy::Graphics3D(host_resource, gfx::Size(640, 480),
+                                     false));
+
     return graphics_3d->GetReference();
   }
 
@@ -146,13 +136,13 @@ class VideoDecoderResourceTest : public PluginProxyTest {
         &sink(), PpapiHostMsg_VideoDecoder_GetShm::ID, PP_OK, shm_msg_reply);
     sink().AddFilter(&shm_msg_handler);
 
-    std::unique_ptr<SerializedHandle> serialized_handle;
-    base::SharedMemory shm;
     if (expected_shm_msg) {
+      std::unique_ptr<SerializedHandle> serialized_handle;
+      base::SharedMemory shm;
       shm.CreateAnonymous(kShmSize);
       base::SharedMemoryHandle shm_handle = shm.handle().Duplicate();
       serialized_handle.reset(new SerializedHandle(shm_handle, kShmSize));
-      shm_msg_handler.set_serialized_handle(serialized_handle.get());
+      shm_msg_handler.set_serialized_handle(std::move(serialized_handle));
     }
 
     memset(decode_buffer_, 0x55, kDecodeBufferSize);
@@ -236,13 +226,9 @@ class VideoDecoderResourceTest : public PluginProxyTest {
   }
 
   void SendRequestTextures(const ResourceMessageCallParams& params) {
-    SendReply(params,
-              PP_OK,
+    SendReply(params, PP_OK,
               PpapiPluginMsg_VideoDecoder_RequestTextures(
-                  kNumRequestedTextures,
-                  PP_MakeSize(320, 240),
-                  GL_TEXTURE_2D,
-                  std::vector<gpu::Mailbox>()));
+                  kNumRequestedTextures, PP_MakeSize(320, 240), GL_TEXTURE_2D));
   }
 
   void SendNotifyError(const ResourceMessageCallParams& params, int32_t error) {
diff --git a/chromium/ppapi/proxy/video_encoder_resource_unittest.cc b/chromium/ppapi/proxy/video_encoder_resource_unittest.cc
index 447643cfa99..2ac19da3767 100644
--- a/chromium/ppapi/proxy/video_encoder_resource_unittest.cc
+++ b/chromium/ppapi/proxy/video_encoder_resource_unittest.cc
@@ -98,11 +98,11 @@ class VideoEncoderResourceTest : public PluginProxyTest,
   void SendReplyWithHandle(const ResourceMessageCallParams& params,
                            int32_t result,
                            const IPC::Message& nested_message,
-                           const SerializedHandle& handle) {
+                           SerializedHandle handle) {
     ResourceMessageReplyParams reply_params(params.pp_resource(),
                                             params.sequence());
     reply_params.set_result(result);
-    reply_params.AppendHandle(handle);
+    reply_params.AppendHandle(std::move(handle));
     PluginMessageFilter::DispatchResourceReplyForTest(reply_params,
                                                       nested_message);
   }
@@ -110,12 +110,12 @@ class VideoEncoderResourceTest : public PluginProxyTest,
   void SendReplyWithHandles(const ResourceMessageCallParams& params,
                             int32_t result,
                             const IPC::Message& nested_message,
-                            const std::vector<SerializedHandle>& handles) {
+                            std::vector<SerializedHandle> handles) {
     ResourceMessageReplyParams reply_params(params.pp_resource(),
                                             params.sequence());
     reply_params.set_result(result);
-    for (SerializedHandle handle : handles)
-      reply_params.AppendHandle(handle);
+    for (auto& handle : handles)
+      reply_params.AppendHandle(std::move(handle));
     PluginMessageFilter::DispatchResourceReplyForTest(reply_params,
                                                       nested_message);
   }
@@ -300,7 +300,8 @@ class VideoEncoderResourceTest : public PluginProxyTest,
     }
     SendReplyWithHandles(
         params, PP_OK,
-        PpapiPluginMsg_VideoEncoder_BitstreamBuffers(buffer_length), handles);
+        PpapiPluginMsg_VideoEncoder_BitstreamBuffers(buffer_length),
+        std::move(handles));
   }
 
   void SendGetVideoFramesReply(const ResourceMessageCallParams& params,
diff --git a/chromium/ppapi/shared_impl/BUILD.gn b/chromium/ppapi/shared_impl/BUILD.gn
index 22c87b27266..c60f43ad102 100644
--- a/chromium/ppapi/shared_impl/BUILD.gn
+++ b/chromium/ppapi/shared_impl/BUILD.gn
@@ -46,8 +46,6 @@ component("shared_impl") {
     "platform_file.cc",
     "platform_file.h",
     "ppapi_constants.h",
-    "ppapi_features.cc",
-    "ppapi_features.h",
     "ppapi_globals.cc",
     "ppapi_globals.h",
     "ppapi_nacl_plugin_args.cc",
diff --git a/chromium/ppapi/shared_impl/api_id.h b/chromium/ppapi/shared_impl/api_id.h
index 9e8176dcec7..553a1f424eb 100644
--- a/chromium/ppapi/shared_impl/api_id.h
+++ b/chromium/ppapi/shared_impl/api_id.h
@@ -13,35 +13,15 @@ enum ApiID {
   // Zero is reserved for control messages.
   API_ID_NONE = 0,
   API_ID_PPB_AUDIO = 1,
-  API_ID_PPB_AUDIO_CONFIG,
-  API_ID_PPB_AUDIO_INPUT_DEV,
-  API_ID_PPB_AUDIO_OUTPUT_DEV,
   API_ID_PPB_BROKER,
   API_ID_PPB_BUFFER,
-  API_ID_PPB_CONTEXT_3D,
   API_ID_PPB_CORE,
-  API_ID_PPB_CURSORCONTROL,
-  API_ID_PPB_FILE_CHOOSER,
-  API_ID_PPB_FILE_IO,
-  API_ID_PPB_FILE_REF,
-  API_ID_PPB_FILE_SYSTEM,
-  API_ID_PPB_FLASH_DEVICE_ID,
-  API_ID_PPB_FLASH_FONTFILE,
-  API_ID_PPB_FLASH_MENU,
   API_ID_PPB_FLASH_MESSAGELOOP,
-  API_ID_PPB_FONT,
-  API_ID_PPB_GRAPHICS_2D,
   API_ID_PPB_GRAPHICS_3D,
   API_ID_PPB_IMAGE_DATA,
   API_ID_PPB_INSTANCE,
   API_ID_PPB_INSTANCE_PRIVATE,
-  API_ID_PPB_OPENGLES2,
-  API_ID_PPB_PDF,
-  API_ID_PPB_SURFACE_3D,
-  API_ID_PPB_TALK,
   API_ID_PPB_TESTING,
-  API_ID_PPB_TEXT_INPUT,
-  API_ID_PPB_URL_RESPONSE_INFO,
   API_ID_PPB_VAR_ARRAY_BUFFER,
   API_ID_PPB_VAR_DEPRECATED,
   API_ID_PPB_VIDEO_CAPTURE_DEV,
@@ -58,7 +38,6 @@ enum ApiID {
   API_ID_PPP_PDF,
   API_ID_PPP_PRINTING,
   API_ID_PPP_TEXT_INPUT,
-  API_ID_PPP_VIDEO_CAPTURE_DEV,
   API_ID_PPP_VIDEO_DECODER_DEV,
   API_ID_RESOURCE_CREATION,
 
diff --git a/chromium/ppapi/shared_impl/ppapi_features.cc b/chromium/ppapi/shared_impl/ppapi_features.cc
deleted file mode 100644
index d77ae68fa7d..00000000000
--- a/chromium/ppapi/shared_impl/ppapi_features.cc
+++ /dev/null
@@ -1,17 +0,0 @@
-// Copyright 2018 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "ppapi/shared_impl/ppapi_features.h"
-
-namespace ppapi {
-namespace features {
-
-// With this feature you can turn back on the deprecated StreamToFile API (which
-// lets you stream a URL request directly to a file).
-// TODO(https://crbug.com/823522): Remove the feature and flag entirely.
-const base::Feature kStreamToFile{"PPAPIStreamToFile",
-                                  base::FEATURE_DISABLED_BY_DEFAULT};
-
-}  // namespace features
-}  // namespace ppapi
diff --git a/chromium/ppapi/shared_impl/ppapi_features.h b/chromium/ppapi/shared_impl/ppapi_features.h
deleted file mode 100644
index 02aca61395a..00000000000
--- a/chromium/ppapi/shared_impl/ppapi_features.h
+++ /dev/null
@@ -1,19 +0,0 @@
-// Copyright 2018 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef PPAPI_SHARED_IMPL_PPAPI_FEATURES_H_
-#define PPAPI_SHARED_IMPL_PPAPI_FEATURES_H_
-
-#include "base/feature_list.h"
-#include "ppapi/shared_impl/ppapi_shared_export.h"
-
-namespace ppapi {
-namespace features {
-
-PPAPI_SHARED_EXPORT extern const base::Feature kStreamToFile;
-
-}  // namespace features
-}  // namespace ppapi
-
-#endif  // PPAPI_SHARED_IMPL_PPAPI_FEATURES_H_
diff --git a/chromium/ppapi/shared_impl/ppb_audio_shared.cc b/chromium/ppapi/shared_impl/ppb_audio_shared.cc
index 636f2ee2f6e..710a25104d9 100644
--- a/chromium/ppapi/shared_impl/ppb_audio_shared.cc
+++ b/chromium/ppapi/shared_impl/ppb_audio_shared.cc
@@ -96,21 +96,20 @@ void PPB_Audio_Shared::SetStopPlaybackState() {
 
 void PPB_Audio_Shared::SetStreamInfo(
     PP_Instance instance,
-    base::SharedMemoryHandle shared_memory_handle,
-    size_t shared_memory_size,
+    base::UnsafeSharedMemoryRegion shared_memory_region,
     base::SyncSocket::Handle socket_handle,
     PP_AudioSampleRate sample_rate,
     int sample_frame_count) {
   socket_.reset(new base::CancelableSyncSocket(socket_handle));
-  shared_memory_.reset(new base::SharedMemory(shared_memory_handle, false));
   shared_memory_size_ = media::ComputeAudioOutputBufferSize(
       kAudioOutputChannels, sample_frame_count);
-  DCHECK_GE(shared_memory_size, shared_memory_size_);
+  DCHECK_GE(shared_memory_region.GetSize(), shared_memory_size_);
   bytes_per_second_ =
       kAudioOutputChannels * (kBitsPerAudioOutputSample / 8) * sample_rate;
   buffer_index_ = 0;
 
-  if (!shared_memory_->Map(shared_memory_size_)) {
+  shared_memory_ = shared_memory_region.MapAt(0, shared_memory_size_);
+  if (!shared_memory_.IsValid()) {
     PpapiGlobals::Get()->LogWithSource(
         instance,
         PP_LOGLEVEL_WARNING,
@@ -118,7 +117,7 @@ void PPB_Audio_Shared::SetStreamInfo(
         "Failed to map shared memory for PPB_Audio_Shared.");
   } else {
     media::AudioOutputBuffer* buffer =
-        reinterpret_cast<media::AudioOutputBuffer*>(shared_memory_->memory());
+        reinterpret_cast<media::AudioOutputBuffer*>(shared_memory_.memory());
     audio_bus_ = media::AudioBus::WrapMemory(kAudioOutputChannels,
                                              sample_frame_count, buffer->audio);
     // Setup integer audio buffer for user audio data.
@@ -133,13 +132,13 @@ void PPB_Audio_Shared::SetStreamInfo(
 void PPB_Audio_Shared::StartThread() {
   // Don't start the thread unless all our state is set up correctly.
   if (!playing_ || !callback_.IsValid() || !socket_.get() ||
-      !shared_memory_->memory() || !audio_bus_.get() || !client_buffer_.get() ||
+      !shared_memory_.memory() || !audio_bus_.get() || !client_buffer_.get() ||
       bytes_per_second_ == 0)
     return;
   // Clear contents of shm buffer before starting audio thread. This will
   // prevent a burst of static if for some reason the audio thread doesn't
   // start up quickly enough.
-  memset(shared_memory_->memory(), 0, shared_memory_size_);
+  memset(shared_memory_.memory(), 0, shared_memory_size_);
   memset(client_buffer_.get(), 0, client_buffer_size_bytes_);
 
   if (g_nacl_mode) {
@@ -227,7 +226,7 @@ void PPB_Audio_Shared::Run() {
     {
       TRACE_EVENT0("audio", "PPB_Audio_Shared::FireRenderCallback");
       media::AudioOutputBuffer* buffer =
-          reinterpret_cast<media::AudioOutputBuffer*>(shared_memory_->memory());
+          reinterpret_cast<media::AudioOutputBuffer*>(shared_memory_.memory());
       base::TimeDelta delay =
           base::TimeDelta::FromMicroseconds(buffer->params.delay_us);
 
diff --git a/chromium/ppapi/shared_impl/ppb_audio_shared.h b/chromium/ppapi/shared_impl/ppb_audio_shared.h
index 7f7995b3edb..657336fe0ad 100644
--- a/chromium/ppapi/shared_impl/ppb_audio_shared.h
+++ b/chromium/ppapi/shared_impl/ppb_audio_shared.h
@@ -11,7 +11,7 @@
 #include <memory>
 
 #include "base/macros.h"
-#include "base/memory/shared_memory.h"
+#include "base/memory/unsafe_shared_memory_region.h"
 #include "base/sync_socket.h"
 #include "base/threading/simple_thread.h"
 #include "media/base/audio_bus.h"
@@ -76,8 +76,7 @@ class PPAPI_SHARED_EXPORT PPB_Audio_Shared
   // Sets the shared memory and socket handles. This will automatically start
   // playback if we're currently set to play.
   void SetStreamInfo(PP_Instance instance,
-                     base::SharedMemoryHandle shared_memory_handle,
-                     size_t shared_memory_size,
+                     base::UnsafeSharedMemoryRegion shared_memory_region,
                      base::SyncSocket::Handle socket_handle,
                      PP_AudioSampleRate sample_rate,
                      int sample_frame_count);
@@ -117,7 +116,7 @@ class PPAPI_SHARED_EXPORT PPB_Audio_Shared
   // Sample buffer in shared memory. This pointer is created in
   // StreamCreated(). The memory is only mapped when the audio thread is
   // created.
-  std::unique_ptr<base::SharedMemory> shared_memory_;
+  base::WritableSharedMemoryMapping shared_memory_;
 
   // The size of the sample buffer in bytes.
   size_t shared_memory_size_;
diff --git a/chromium/ppapi/shared_impl/url_request_info_data.cc b/chromium/ppapi/shared_impl/url_request_info_data.cc
index bb77a43e242..afc9ac127e3 100644
--- a/chromium/ppapi/shared_impl/url_request_info_data.cc
+++ b/chromium/ppapi/shared_impl/url_request_info_data.cc
@@ -45,7 +45,6 @@ URLRequestInfoData::URLRequestInfoData()
     : url(),
       method(),
       headers(),
-      stream_to_file(false),
       follow_redirects(true),
       record_download_progress(false),
       record_upload_progress(false),
diff --git a/chromium/ppapi/shared_impl/url_request_info_data.h b/chromium/ppapi/shared_impl/url_request_info_data.h
index d0acf4ba515..1af721bb0c5 100644
--- a/chromium/ppapi/shared_impl/url_request_info_data.h
+++ b/chromium/ppapi/shared_impl/url_request_info_data.h
@@ -56,7 +56,6 @@ struct PPAPI_SHARED_EXPORT URLRequestInfoData {
   std::string method;
   std::string headers;
 
-  bool stream_to_file;
   bool follow_redirects;
   bool record_download_progress;
   bool record_upload_progress;
diff --git a/chromium/ppapi/shared_impl/url_response_info_data.h b/chromium/ppapi/shared_impl/url_response_info_data.h
index c6f7dbd197f..d49a644d2ba 100644
--- a/chromium/ppapi/shared_impl/url_response_info_data.h
+++ b/chromium/ppapi/shared_impl/url_response_info_data.h
@@ -22,9 +22,6 @@ struct PPAPI_SHARED_EXPORT URLResponseInfoData {
   int32_t status_code;
   std::string status_text;
   std::string redirect_url;
-
-  // Valid when streaming to a file.
-  FileRefCreateInfo body_as_file_ref;
 };
 
 }  // namespace ppapi
diff --git a/chromium/ppapi/thunk/ppb_audio_api.h b/chromium/ppapi/thunk/ppb_audio_api.h
index e73f0618e28..58d3d42ceb4 100644
--- a/chromium/ppapi/thunk/ppb_audio_api.h
+++ b/chromium/ppapi/thunk/ppb_audio_api.h
@@ -13,7 +13,7 @@
 #include "ppapi/thunk/ppapi_thunk_export.h"
 
 namespace base {
-class SharedMemory;
+class UnsafeSharedMemoryRegion;
 }  // namespace base
 
 namespace ppapi {
@@ -35,8 +35,7 @@ class PPAPI_THUNK_EXPORT PPB_Audio_API {
       PP_Resource config_id,
       scoped_refptr<TrackedCallback> create_callback) = 0;
   virtual int32_t GetSyncSocket(int* sync_socket) = 0;
-  virtual int32_t GetSharedMemory(base::SharedMemory** shm,
-                                  uint32_t* shm_size) = 0;
+  virtual int32_t GetSharedMemory(base::UnsafeSharedMemoryRegion** shm) = 0;
 };
 
 }  // namespace thunk
diff --git a/chromium/ppapi/thunk/resource_creation_api.h b/chromium/ppapi/thunk/resource_creation_api.h
index 3d4f60e07f1..637414acddd 100644
--- a/chromium/ppapi/thunk/resource_creation_api.h
+++ b/chromium/ppapi/thunk/resource_creation_api.h
@@ -7,7 +7,7 @@
 
 #include <stdint.h>
 
-#include "base/memory/shared_memory.h"
+#include "base/memory/unsafe_shared_memory_region.h"
 #include "build/build_config.h"
 #include "gpu/command_buffer/common/command_buffer_id.h"
 #include "ppapi/c/dev/pp_video_dev.h"
@@ -148,7 +148,7 @@ class ResourceCreationAPI {
       PP_Resource share_context,
       const gpu::ContextCreationAttribs& attrib_helper,
       gpu::Capabilities* capabilities,
-      base::SharedMemoryHandle* shared_state,
+      const base::UnsafeSharedMemoryRegion** shared_state,
       gpu::CommandBufferId* command_buffer_id) = 0;
   virtual PP_Resource CreateHostResolver(PP_Instance instance) = 0;
   virtual PP_Resource CreateHostResolverPrivate(PP_Instance instance) = 0;
author	Allan Sandfeld Jensen <allan.jensen@qt.io>	2018-08-28 15:28:34 +0200
committer	Allan Sandfeld Jensen <allan.jensen@qt.io>	2018-08-28 13:54:51 +0000
commit	2a19c63448c84c1805fb1a585c3651318bb86ca7 (patch)
tree	eb17888e8531aa6ee5e85721bd553b832a7e5156 /chromium/ppapi
parent	b014812705fc80bff0a5c120dfcef88f349816dc (diff)
download	qtwebengine-chromium-2a19c63448c84c1805fb1a585c3651318bb86ca7.tar.gz