BASELINE: Update Chromium to 77.0.3865.59

Change-Id: I1e89a5f3b009a9519a6705102ad65c92fe736f21
Reviewed-by: Michael Brüning <michael.bruning@qt.io>

26 files changed, 132 insertions, 75 deletions

diff --git a/chromium/ppapi/api/dev/pp_cursor_type_dev.idl b/chromium/ppapi/api/dev/pp_cursor_type_dev.idl
index 08abec3b224..6d02bc730a2 100644
--- a/chromium/ppapi/api/dev/pp_cursor_type_dev.idl
+++ b/chromium/ppapi/api/dev/pp_cursor_type_dev.idl
@@ -51,6 +51,8 @@
   PP_CURSORTYPE_ZOOMIN = 39,
   PP_CURSORTYPE_ZOOMOUT = 40,
   PP_CURSORTYPE_GRAB = 41,
-  PP_CURSORTYPE_GRABBING = 42
+  PP_CURSORTYPE_GRABBING = 42,
+  PP_CURSORTYPE_MIDDLEPANNINGVERTICAL = 43,
+  PP_CURSORTYPE_MIDDLEPANNINGHORIZONTAL = 44
 };
 
diff --git a/chromium/ppapi/api/ppb_mouse_cursor.idl b/chromium/ppapi/api/ppb_mouse_cursor.idl
index 9fba254195c..2dd76811483 100644
--- a/chromium/ppapi/api/ppb_mouse_cursor.idl
+++ b/chromium/ppapi/api/ppb_mouse_cursor.idl
@@ -63,7 +63,9 @@ enum PP_MouseCursor_Type {
   PP_MOUSECURSOR_TYPE_ZOOMIN = 39,
   PP_MOUSECURSOR_TYPE_ZOOMOUT = 40,
   PP_MOUSECURSOR_TYPE_GRAB = 41,
-  PP_MOUSECURSOR_TYPE_GRABBING = 42
+  PP_MOUSECURSOR_TYPE_GRABBING = 42,
+  PP_MOUSECURSOR_TYPE_MIDDLEPANNINGVERTICAL = 43,
+  PP_MOUSECURSOR_TYPE_MIDDLEPANNINGHORIZONTAL = 44
 };
 
 /**
diff --git a/chromium/ppapi/c/dev/pp_cursor_type_dev.h b/chromium/ppapi/c/dev/pp_cursor_type_dev.h
index 82967a77edd..68ca41c49ed 100644
--- a/chromium/ppapi/c/dev/pp_cursor_type_dev.h
+++ b/chromium/ppapi/c/dev/pp_cursor_type_dev.h
@@ -64,7 +64,9 @@ enum PP_CursorType_Dev {
   PP_CURSORTYPE_ZOOMIN = 39,
   PP_CURSORTYPE_ZOOMOUT = 40,
   PP_CURSORTYPE_GRAB = 41,
-  PP_CURSORTYPE_GRABBING = 42
+  PP_CURSORTYPE_GRABBING = 42,
+  PP_CURSORTYPE_MIDDLEPANNINGVERTICAL = 43,
+  PP_CURSORTYPE_MIDDLEPANNINGHORIZONTAL = 44
 };
 PP_COMPILE_ASSERT_ENUM_SIZE_IN_BYTES(PP_CursorType_Dev, 4);
 /**
diff --git a/chromium/ppapi/c/ppb_mouse_cursor.h b/chromium/ppapi/c/ppb_mouse_cursor.h
index bc6a5f542fa..e07bea3ff47 100644
--- a/chromium/ppapi/c/ppb_mouse_cursor.h
+++ b/chromium/ppapi/c/ppb_mouse_cursor.h
@@ -77,7 +77,9 @@ enum PP_MouseCursor_Type {
   PP_MOUSECURSOR_TYPE_ZOOMIN = 39,
   PP_MOUSECURSOR_TYPE_ZOOMOUT = 40,
   PP_MOUSECURSOR_TYPE_GRAB = 41,
-  PP_MOUSECURSOR_TYPE_GRABBING = 42
+  PP_MOUSECURSOR_TYPE_GRABBING = 42,
+  PP_MOUSECURSOR_TYPE_MIDDLEPANNINGVERTICAL = 43,
+  PP_MOUSECURSOR_TYPE_MIDDLEPANNINGHORIZONTAL = 44
 };
 PP_COMPILE_ASSERT_ENUM_SIZE_IN_BYTES(PP_MouseCursor_Type, 4);
 /**
diff --git a/chromium/ppapi/host/resource_message_filter_unittest.cc b/chromium/ppapi/host/resource_message_filter_unittest.cc
index d0688b5b306..c0abd5fea57 100644
--- a/chromium/ppapi/host/resource_message_filter_unittest.cc
+++ b/chromium/ppapi/host/resource_message_filter_unittest.cc
@@ -10,6 +10,7 @@
 #include "base/run_loop.h"
 #include "base/single_thread_task_runner.h"
 #include "base/synchronization/waitable_event.h"
+#include "base/test/scoped_task_environment.h"
 #include "base/threading/thread.h"
 #include "base/threading/thread_task_runner_handle.h"
 #include "ipc/ipc_message.h"
@@ -211,11 +212,11 @@ TEST_F(ResourceMessageFilterTest, TestHandleMessage) {
   // ResourceMessageFilter instances need to be created on a thread with message
   // loop. Therefore, we create a message loop and run the testing logic as a
   // task on it.
-  base::MessageLoop main_message_loop;
+  base::test::ScopedTaskEnvironment scoped_task_environment;
 
   // It should be safe to use base::Unretained() because the object won't be
   // destroyed before the task is run.
-  main_message_loop.task_runner()->PostTask(
+  scoped_task_environment.GetMainThreadTaskRunner()->PostTask(
       FROM_HERE,
       base::BindOnce(&ResourceMessageFilterTest::TestHandleMessageImpl,
                      base::Unretained(this)));
diff --git a/chromium/ppapi/nacl_irt/irt_pnacl_translator_compile.cc b/chromium/ppapi/nacl_irt/irt_pnacl_translator_compile.cc
index 116b3f3b152..a2db35b7c40 100644
--- a/chromium/ppapi/nacl_irt/irt_pnacl_translator_compile.cc
+++ b/chromium/ppapi/nacl_irt/irt_pnacl_translator_compile.cc
@@ -3,8 +3,8 @@
 // found in the LICENSE file.
 
 #include "base/macros.h"
-#include "base/message_loop/message_loop.h"
 #include "base/run_loop.h"
+#include "base/task/single_thread_task_executor.h"
 #include "build/build_config.h"
 #include "ipc/ipc_listener.h"
 #include "ipc/ipc_sync_channel.h"
@@ -101,7 +101,7 @@ class TranslatorCompileListener : public IPC::Listener {
 };
 
 void ServeTranslateRequest(const struct nacl_irt_pnacl_compile_funcs* funcs) {
-  base::MessageLoop loop;
+  base::SingleThreadTaskExecutor main_task_executor;
   new TranslatorCompileListener(ppapi::GetRendererIPCChannelHandle(), funcs);
   base::RunLoop().Run();
 }
diff --git a/chromium/ppapi/nacl_irt/irt_pnacl_translator_link.cc b/chromium/ppapi/nacl_irt/irt_pnacl_translator_link.cc
index ccd19190866..57073fb2203 100644
--- a/chromium/ppapi/nacl_irt/irt_pnacl_translator_link.cc
+++ b/chromium/ppapi/nacl_irt/irt_pnacl_translator_link.cc
@@ -3,8 +3,8 @@
 // found in the LICENSE file.
 
 #include "base/macros.h"
-#include "base/message_loop/message_loop.h"
 #include "base/run_loop.h"
+#include "base/task/single_thread_task_executor.h"
 #include "build/build_config.h"
 #include "ipc/ipc_listener.h"
 #include "ipc/ipc_sync_channel.h"
@@ -72,7 +72,7 @@ class TranslatorLinkListener : public IPC::Listener {
 };
 
 void ServeLinkRequest(CallbackFunc func) {
-  base::MessageLoop loop;
+  base::SingleThreadTaskExecutor main_task_executor;
   new TranslatorLinkListener(ppapi::GetRendererIPCChannelHandle(), func);
   base::RunLoop().Run();
 }
diff --git a/chromium/ppapi/nacl_irt/ppapi_dispatcher.cc b/chromium/ppapi/nacl_irt/ppapi_dispatcher.cc
index f70ca0646a7..3bf22ff764a 100644
--- a/chromium/ppapi/nacl_irt/ppapi_dispatcher.cc
+++ b/chromium/ppapi/nacl_irt/ppapi_dispatcher.cc
@@ -16,7 +16,6 @@
 #include "base/single_thread_task_runner.h"
 #include "base/synchronization/waitable_event.h"
 #include "build/build_config.h"
-#include "components/tracing/child/child_trace_message_filter.h"
 #include "ipc/ipc_channel_handle.h"
 #include "ipc/ipc_logging.h"
 #include "ipc/ipc_message.h"
@@ -55,7 +54,6 @@ PpapiDispatcher::PpapiDispatcher(
   channel_->AddFilter(plugin_filter.get());
   globals->RegisterResourceMessageFilters(plugin_filter.get());
 
-  channel_->AddFilter(new tracing::ChildTraceMessageFilter(task_runner_.get()));
   channel_->Init(browser_ipc_handle, IPC::Channel::MODE_SERVER, true);
 }
 
diff --git a/chromium/ppapi/proxy/file_system_resource.cc b/chromium/ppapi/proxy/file_system_resource.cc
index 37b2cc7275c..1e1508d4033 100644
--- a/chromium/ppapi/proxy/file_system_resource.cc
+++ b/chromium/ppapi/proxy/file_system_resource.cc
@@ -95,12 +95,12 @@ PP_FileSystemType FileSystemResource::GetType() {
 }
 
 void FileSystemResource::OpenQuotaFile(PP_Resource file_io) {
-  DCHECK(!base::ContainsKey(files_, file_io));
+  DCHECK(!base::Contains(files_, file_io));
   files_.insert(file_io);
 }
 
 void FileSystemResource::CloseQuotaFile(PP_Resource file_io) {
-  DCHECK(base::ContainsKey(files_, file_io));
+  DCHECK(base::Contains(files_, file_io));
   files_.erase(file_io);
 }
 
diff --git a/chromium/ppapi/proxy/ppapi_proxy_test.h b/chromium/ppapi/proxy/ppapi_proxy_test.h
index 01ac6a7108b..3f39598127e 100644
--- a/chromium/ppapi/proxy/ppapi_proxy_test.h
+++ b/chromium/ppapi/proxy/ppapi_proxy_test.h
@@ -14,9 +14,9 @@
 #include "base/compiler_specific.h"
 #include "base/macros.h"
 #include "base/memory/ref_counted.h"
-#include "base/message_loop/message_loop.h"
 #include "base/synchronization/waitable_event.h"
 #include "base/task_runner.h"
+#include "base/test/scoped_task_environment.h"
 #include "base/threading/simple_thread.h"
 #include "base/threading/thread.h"
 #include "ppapi/c/pp_instance.h"
@@ -202,7 +202,7 @@ class PluginProxyTest : public PluginProxyTestHarness, public testing::Test {
   virtual void SetUp();
   virtual void TearDown();
  private:
-  base::MessageLoop message_loop_;
+  base::test::ScopedTaskEnvironment scoped_task_environment_;
 };
 
 // This class provides support for multi-thread testing. A secondary thread is
@@ -334,7 +334,7 @@ class HostProxyTest : public HostProxyTestHarness, public testing::Test {
   virtual void SetUp();
   virtual void TearDown();
  private:
-  base::MessageLoop message_loop_;
+  base::test::ScopedTaskEnvironment scoped_task_environment_;
 };
 
 // Use this base class to test both sides of a proxy.
@@ -372,7 +372,7 @@ class TwoWayTest : public testing::Test {
   // The plugin side of the proxy runs on its own thread.
   base::Thread plugin_thread_;
   // The message loop for the main (host) thread.
-  base::MessageLoop message_loop_;
+  base::test::ScopedTaskEnvironment scoped_task_environment_;
 
   // Aliases for the host and plugin harnesses; if we're testing a PPP
   // interface, remote_harness will point to plugin_, and local_harness
diff --git a/chromium/ppapi/proxy/ppb_message_loop_proxy.cc b/chromium/ppapi/proxy/ppb_message_loop_proxy.cc
index a2a2bb88e28..b38212bb135 100644
--- a/chromium/ppapi/proxy/ppb_message_loop_proxy.cc
+++ b/chromium/ppapi/proxy/ppb_message_loop_proxy.cc
@@ -83,7 +83,7 @@ int32_t MessageLoopResource::AttachToCurrentThread() {
     if (slot->Get())
       return PP_ERROR_INPROGRESS;
   }
-  // TODO(dmichael) check that the current thread can support a message loop.
+  // TODO(dmichael) check that the current thread can support a task executor.
 
   // Take a ref to the MessageLoop on behalf of the TLS. Note that this is an
   // internal ref and not a plugin ref so the plugin can't accidentally
@@ -94,7 +94,7 @@ int32_t MessageLoopResource::AttachToCurrentThread() {
   single_thread_task_executor_.reset(new base::SingleThreadTaskExecutor);
   task_runner_ = base::ThreadTaskRunnerHandle::Get();
 
-  // Post all pending work to the message loop.
+  // Post all pending work to the task executor.
   for (size_t i = 0; i < pending_tasks_.size(); i++) {
     const TaskInfo& info = pending_tasks_[i];
     PostClosure(info.from_here, info.closure, info.delay_ms);
@@ -169,7 +169,7 @@ MessageLoopResource* MessageLoopResource::GetCurrent() {
 }
 
 void MessageLoopResource::DetachFromThread() {
-  // Note that the message loop must be destroyed on the thread it was created
+  // Note that the task executor must be destroyed on the thread it was created
   // on.
   task_runner_ = NULL;
   single_thread_task_executor_.reset();
diff --git a/chromium/ppapi/proxy/ppb_message_loop_proxy.h b/chromium/ppapi/proxy/ppb_message_loop_proxy.h
index 1a16bace800..eb90e068a1c 100644
--- a/chromium/ppapi/proxy/ppb_message_loop_proxy.h
+++ b/chromium/ppapi/proxy/ppb_message_loop_proxy.h
@@ -68,7 +68,7 @@ class PPAPI_PROXY_EXPORT MessageLoopResource : public MessageLoopShared {
 
   // MessageLoopShared implementation.
   //
-  // Handles posting to the message loop if there is one, or the pending queue
+  // Handles posting to the task executor if there is one, or the pending queue
   // if there isn't.
   // NOTE: The given closure will be run *WITHOUT* acquiring the Proxy lock.
   //       This only makes sense for user code and completely thread-safe
@@ -97,11 +97,11 @@ class PPAPI_PROXY_EXPORT MessageLoopResource : public MessageLoopShared {
   // Number of invocations of Run currently on the stack.
   int nested_invocations_;
 
-  // Set to true when the message loop is destroyed to prevent forther
+  // Set to true when the task executor is destroyed to prevent forther
   // posting of work.
   bool destroyed_;
 
-  // Set to true if all message loop invocations should exit and that the
+  // Set to true if all task executor invocations should exit and that the
   // loop should be destroyed once it reaches the outermost Run invocation.
   bool should_destroy_;
 
@@ -109,7 +109,7 @@ class PPAPI_PROXY_EXPORT MessageLoopResource : public MessageLoopShared {
 
   bool currently_handling_blocking_message_;
 
-  // Since we allow tasks to be posted before the message loop is actually
+  // Since we allow tasks to be posted before the task executor is actually
   // created (when it's associated with a thread), we keep tasks posted here
   // until that happens. Once the loop_ is created, this is unused.
   std::vector<TaskInfo> pending_tasks_;
diff --git a/chromium/ppapi/proxy/raw_var_data_unittest.cc b/chromium/ppapi/proxy/raw_var_data_unittest.cc
index 712ee67e6a0..59c56641495 100644
--- a/chromium/ppapi/proxy/raw_var_data_unittest.cc
+++ b/chromium/ppapi/proxy/raw_var_data_unittest.cc
@@ -12,7 +12,7 @@
 #include "base/bind.h"
 #include "base/logging.h"
 #include "base/memory/ref_counted.h"
-#include "base/message_loop/message_loop.h"
+#include "base/test/scoped_task_environment.h"
 #include "base/values.h"
 #include "ppapi/c/pp_bool.h"
 #include "ppapi/c/pp_var.h"
@@ -52,7 +52,8 @@ class RawVarDataTest : public testing::Test {
   }
 
  private:
-  base::MessageLoop message_loop_;  // Required to receive callbacks.
+  base::test::ScopedTaskEnvironment
+      scoped_task_environment_;  // Required to receive callbacks.
   TestGlobals globals_;
 };
 
diff --git a/chromium/ppapi/proxy/resource_message_params.cc b/chromium/ppapi/proxy/resource_message_params.cc
index 253ff367f63..fa4df107348 100644
--- a/chromium/ppapi/proxy/resource_message_params.cc
+++ b/chromium/ppapi/proxy/resource_message_params.cc
@@ -113,6 +113,18 @@ bool ResourceMessageParams::TakeReadOnlySharedMemoryRegionAtIndex(
   return true;
 }
 
+bool ResourceMessageParams::TakeUnsafeSharedMemoryRegionAtIndex(
+    size_t index,
+    base::UnsafeSharedMemoryRegion* region) const {
+  SerializedHandle serialized =
+      TakeHandleOfTypeAtIndex(index, SerializedHandle::SHARED_MEMORY_REGION);
+  if (!serialized.is_shmem_region())
+    return false;
+  *region = base::UnsafeSharedMemoryRegion::Deserialize(
+      serialized.TakeSharedMemoryRegion());
+  return true;
+}
+
 bool ResourceMessageParams::TakeSocketHandleAtIndex(
     size_t index,
     IPC::PlatformFileForTransit* handle) const {
diff --git a/chromium/ppapi/proxy/resource_message_params.h b/chromium/ppapi/proxy/resource_message_params.h
index c7d469b2a9a..db3fefc86fb 100644
--- a/chromium/ppapi/proxy/resource_message_params.h
+++ b/chromium/ppapi/proxy/resource_message_params.h
@@ -67,6 +67,9 @@ class PPAPI_PROXY_EXPORT ResourceMessageParams {
   bool TakeReadOnlySharedMemoryRegionAtIndex(
       size_t index,
       base::ReadOnlySharedMemoryRegion* region) const;
+  bool TakeUnsafeSharedMemoryRegionAtIndex(
+      size_t index,
+      base::UnsafeSharedMemoryRegion* region) const;
   bool TakeSocketHandleAtIndex(size_t index,
                                IPC::PlatformFileForTransit* handle) const;
   bool TakeFileHandleAtIndex(size_t index,
diff --git a/chromium/ppapi/proxy/serialized_handle.cc b/chromium/ppapi/proxy/serialized_handle.cc
index 92f945d1117..ee06d0a325f 100644
--- a/chromium/ppapi/proxy/serialized_handle.cc
+++ b/chromium/ppapi/proxy/serialized_handle.cc
@@ -66,6 +66,16 @@ SerializedHandle::SerializedHandle(const base::SharedMemoryHandle& handle,
       open_flags_(0),
       file_io_(0) {}
 
+SerializedHandle::SerializedHandle(base::ReadOnlySharedMemoryRegion region)
+    : SerializedHandle(
+          base::ReadOnlySharedMemoryRegion::TakeHandleForSerialization(
+              std::move(region))) {}
+
+SerializedHandle::SerializedHandle(base::UnsafeSharedMemoryRegion region)
+    : SerializedHandle(
+          base::UnsafeSharedMemoryRegion::TakeHandleForSerialization(
+              std::move(region))) {}
+
 SerializedHandle::SerializedHandle(
     base::subtle::PlatformSharedMemoryRegion region)
     : type_(SHARED_MEMORY_REGION),
diff --git a/chromium/ppapi/proxy/serialized_handle.h b/chromium/ppapi/proxy/serialized_handle.h
index 825188312ee..8829678f502 100644
--- a/chromium/ppapi/proxy/serialized_handle.h
+++ b/chromium/ppapi/proxy/serialized_handle.h
@@ -13,8 +13,10 @@
 #include "base/atomicops.h"
 #include "base/logging.h"
 #include "base/memory/platform_shared_memory_region.h"
+#include "base/memory/read_only_shared_memory_region.h"
 #include "base/memory/ref_counted.h"
 #include "base/memory/shared_memory.h"
+#include "base/memory/unsafe_shared_memory_region.h"
 #include "build/build_config.h"
 #include "ipc/ipc_platform_file.h"
 #include "ppapi/c/pp_resource.h"
@@ -66,6 +68,8 @@ class PPAPI_PROXY_EXPORT SerializedHandle {
   SerializedHandle(const base::SharedMemoryHandle& handle, uint32_t size);
 
   // Create a shared memory region handle.
+  explicit SerializedHandle(base::ReadOnlySharedMemoryRegion region);
+  explicit SerializedHandle(base::UnsafeSharedMemoryRegion region);
   explicit SerializedHandle(base::subtle::PlatformSharedMemoryRegion region);
 
   // Create a socket or file handle.
diff --git a/chromium/ppapi/proxy/video_decoder_resource.cc b/chromium/ppapi/proxy/video_decoder_resource.cc
index 94548e14d64..ad002556c47 100644
--- a/chromium/ppapi/proxy/video_decoder_resource.cc
+++ b/chromium/ppapi/proxy/video_decoder_resource.cc
@@ -32,12 +32,12 @@ namespace ppapi {
 namespace proxy {
 
 VideoDecoderResource::ShmBuffer::ShmBuffer(
-    std::unique_ptr<base::SharedMemory> shm_ptr,
-    uint32_t size,
+    base::UnsafeSharedMemoryRegion region,
     uint32_t shm_id)
-    : shm(std::move(shm_ptr)), addr(NULL), shm_id(shm_id) {
-  if (shm->Map(size))
-    addr = shm->memory();
+    : region(std::move(region)), shm_id(shm_id) {
+  mapping = this->region.Map();
+  if (mapping.IsValid())
+    addr = mapping.memory();
 }
 
 VideoDecoderResource::ShmBuffer::~ShmBuffer() {
@@ -199,7 +199,7 @@ int32_t VideoDecoderResource::Decode(uint32_t decode_id,
   decode_ids_[uid % kMaximumPictureDelay] = decode_id;
 
   if (available_shm_buffers_.empty() ||
-      available_shm_buffers_.back()->shm->mapped_size() < size) {
+      available_shm_buffers_.back()->mapping.size() < size) {
     uint32_t shm_id;
     if (shm_buffers_.size() < kMaximumPendingDecodes) {
       // Signal the host to create a new shm buffer by passing an index outside
@@ -227,13 +227,12 @@ int32_t VideoDecoderResource::Decode(uint32_t decode_id,
     if (!UnpackMessage<PpapiPluginMsg_VideoDecoder_GetShmReply>(reply,
                                                                 &shm_size))
       return PP_ERROR_FAILED;
-    base::SharedMemoryHandle shm_handle;
-    if (!reply_params.TakeSharedMemoryHandleAtIndex(0, &shm_handle))
+    base::UnsafeSharedMemoryRegion shm_region;
+    if (!reply_params.TakeUnsafeSharedMemoryRegionAtIndex(0, &shm_region) ||
+        !shm_region.IsValid() || shm_region.GetSize() != shm_size)
       return PP_ERROR_NOMEMORY;
-    std::unique_ptr<base::SharedMemory> shm(
-        new base::SharedMemory(shm_handle, false /* read_only */));
     std::unique_ptr<ShmBuffer> shm_buffer(
-        new ShmBuffer(std::move(shm), shm_size, shm_id));
+        new ShmBuffer(std::move(shm_region), shm_id));
     if (!shm_buffer->addr)
       return PP_ERROR_NOMEMORY;
 
@@ -246,7 +245,7 @@ int32_t VideoDecoderResource::Decode(uint32_t decode_id,
 
   // At this point we should have shared memory to hold the plugin's buffer.
   DCHECK(!available_shm_buffers_.empty() &&
-         available_shm_buffers_.back()->shm->mapped_size() >= size);
+         available_shm_buffers_.back()->mapping.size() >= size);
 
   ShmBuffer* shm_buffer = available_shm_buffers_.back();
   available_shm_buffers_.pop_back();
diff --git a/chromium/ppapi/proxy/video_decoder_resource.h b/chromium/ppapi/proxy/video_decoder_resource.h
index caa45a65ff8..29e6b307daf 100644
--- a/chromium/ppapi/proxy/video_decoder_resource.h
+++ b/chromium/ppapi/proxy/video_decoder_resource.h
@@ -83,13 +83,12 @@ class PPAPI_PROXY_EXPORT VideoDecoderResource
  private:
   // Struct to hold a shared memory buffer.
   struct ShmBuffer {
-    ShmBuffer(std::unique_ptr<base::SharedMemory> shm,
-              uint32_t size,
-              uint32_t shm_id);
+    ShmBuffer(base::UnsafeSharedMemoryRegion region, uint32_t shm_id);
     ~ShmBuffer();
 
-    const std::unique_ptr<base::SharedMemory> shm;
-    void* addr;
+    base::UnsafeSharedMemoryRegion region;
+    base::WritableSharedMemoryMapping mapping;
+    void* addr = nullptr;
     // Index into shm_buffers_ vector, used as an id. This should map 1:1 to
     // the index on the host side of the proxy.
     const uint32_t shm_id;
diff --git a/chromium/ppapi/proxy/video_decoder_resource_unittest.cc b/chromium/ppapi/proxy/video_decoder_resource_unittest.cc
index 9b3efee82a7..3d4e082c7c4 100644
--- a/chromium/ppapi/proxy/video_decoder_resource_unittest.cc
+++ b/chromium/ppapi/proxy/video_decoder_resource_unittest.cc
@@ -6,7 +6,7 @@
 #include <stddef.h>
 #include <stdint.h>
 
-#include "base/memory/shared_memory.h"
+#include "base/memory/unsafe_shared_memory_region.h"
 #include "build/build_config.h"
 #include "ppapi/c/pp_errors.h"
 #include "ppapi/c/ppb_video_decoder.h"
@@ -137,11 +137,10 @@ class VideoDecoderResourceTest : public PluginProxyTest {
     sink().AddFilter(&shm_msg_handler);
 
     if (expected_shm_msg) {
-      std::unique_ptr<SerializedHandle> serialized_handle;
-      base::SharedMemory shm;
-      shm.CreateAnonymous(kShmSize);
-      base::SharedMemoryHandle shm_handle = shm.handle().Duplicate();
-      serialized_handle.reset(new SerializedHandle(shm_handle, kShmSize));
+      auto region = base::UnsafeSharedMemoryRegion::Create(kShmSize);
+      auto serialized_handle = std::make_unique<SerializedHandle>(
+          base::UnsafeSharedMemoryRegion::TakeHandleForSerialization(
+              std::move(region)));
       shm_msg_handler.set_serialized_handle(std::move(serialized_handle));
     }
 
diff --git a/chromium/ppapi/proxy/vpn_provider_resource.cc b/chromium/ppapi/proxy/vpn_provider_resource.cc
index 1e65b0934e5..b6c529e8388 100644
--- a/chromium/ppapi/proxy/vpn_provider_resource.cc
+++ b/chromium/ppapi/proxy/vpn_provider_resource.cc
@@ -7,6 +7,7 @@
 #include <memory>
 
 #include "base/bind.h"
+#include "base/memory/unsafe_shared_memory_region.h"
 #include "ppapi/c/pp_errors.h"
 #include "ppapi/proxy/dispatch_reply_message.h"
 #include "ppapi/proxy/ppapi_messages.h"
@@ -197,21 +198,32 @@ void VpnProviderResource::OnPluginMsgBindReply(
     return;
 
   if (params.result() == PP_OK) {
-    std::vector<base::SharedMemoryHandle> shm_handles;
-    params.TakeAllSharedMemoryHandles(&shm_handles);
-    std::unique_ptr<base::SharedMemory> send_shm(
-        new base::SharedMemory(shm_handles[0], false));
-    std::unique_ptr<base::SharedMemory> receive_shm(
-        new base::SharedMemory(shm_handles[1], false));
+    base::UnsafeSharedMemoryRegion send_shm;
+    base::UnsafeSharedMemoryRegion recv_shm;
+    params.TakeUnsafeSharedMemoryRegionAtIndex(0, &send_shm);
+    params.TakeUnsafeSharedMemoryRegionAtIndex(1, &recv_shm);
+    if (!send_shm.IsValid() || !recv_shm.IsValid()) {
+      NOTREACHED();
+      return;
+    }
+    base::WritableSharedMemoryMapping send_mapping = send_shm.Map();
+    base::WritableSharedMemoryMapping recv_mapping = recv_shm.Map();
+    if (!send_mapping.IsValid() || !recv_mapping.IsValid()) {
+      NOTREACHED();
+      return;
+    }
+
     size_t buffer_size = queue_size * max_packet_size;
-    if (!send_shm->Map(buffer_size) || !receive_shm->Map(buffer_size)) {
+    if (send_shm.GetSize() < buffer_size || recv_shm.GetSize() < buffer_size) {
       NOTREACHED();
       return;
     }
     send_packet_buffer_ = std::make_unique<ppapi::VpnProviderSharedBuffer>(
-        queue_size, max_packet_size, std::move(send_shm));
+        queue_size, max_packet_size, std::move(send_shm),
+        std::move(send_mapping));
     recv_packet_buffer_ = std::make_unique<ppapi::VpnProviderSharedBuffer>(
-        queue_size, max_packet_size, std::move(receive_shm));
+        queue_size, max_packet_size, std::move(recv_shm),
+        std::move(recv_mapping));
 
     bound_ = (result == PP_OK);
   }
diff --git a/chromium/ppapi/shared_impl/proxy_lock_unittest.cc b/chromium/ppapi/shared_impl/proxy_lock_unittest.cc
index 02a8d4b4948..980bfe47808 100644
--- a/chromium/ppapi/shared_impl/proxy_lock_unittest.cc
+++ b/chromium/ppapi/shared_impl/proxy_lock_unittest.cc
@@ -10,7 +10,7 @@
 #include "base/logging.h"
 #include "base/macros.h"
 #include "base/memory/ref_counted.h"
-#include "base/message_loop/message_loop.h"
+#include "base/test/scoped_task_environment.h"
 #include "ppapi/shared_impl/proxy_lock.h"
 #include "ppapi/shared_impl/test_globals.h"
 #include "testing/gtest/include/gtest/gtest.h"
@@ -68,7 +68,8 @@ void TestCallback_3(int p1, const std::string& p2, Param p3) {
 }  // namespace
 
 class PpapiProxyLockTest : public testing::Test {
-  base::MessageLoop message_loop_;  // Required to receive callbacks.
+  base::test::ScopedTaskEnvironment
+      scoped_task_environment_;  // Required to receive callbacks.
 };
 
 TEST_F(PpapiProxyLockTest, Locking) {
diff --git a/chromium/ppapi/shared_impl/resource_tracker_unittest.cc b/chromium/ppapi/shared_impl/resource_tracker_unittest.cc
index c57b32d2d84..4044882e484 100644
--- a/chromium/ppapi/shared_impl/resource_tracker_unittest.cc
+++ b/chromium/ppapi/shared_impl/resource_tracker_unittest.cc
@@ -5,7 +5,7 @@
 #include "testing/gtest/include/gtest/gtest.h"
 
 #include "base/compiler_specific.h"
-#include "base/message_loop/message_loop.h"
+#include "base/test/scoped_task_environment.h"
 #include "ppapi/shared_impl/proxy_lock.h"
 #include "ppapi/shared_impl/resource.h"
 #include "ppapi/shared_impl/resource_tracker.h"
@@ -49,7 +49,8 @@ class ResourceTrackerTest : public testing::Test {
   ResourceTracker& resource_tracker() { return *globals_.GetResourceTracker(); }
 
  private:
-  base::MessageLoop message_loop_;  // Required to receive callbacks.
+  base::test::ScopedTaskEnvironment
+      scoped_task_environment_;  // Required to receive callbacks.
   TestGlobals globals_;
 };
 
diff --git a/chromium/ppapi/shared_impl/var_tracker_unittest.cc b/chromium/ppapi/shared_impl/var_tracker_unittest.cc
index f0408e79bb7..a31053f366e 100644
--- a/chromium/ppapi/shared_impl/var_tracker_unittest.cc
+++ b/chromium/ppapi/shared_impl/var_tracker_unittest.cc
@@ -5,11 +5,11 @@
 #include "testing/gtest/include/gtest/gtest.h"
 
 #include "base/compiler_specific.h"
-#include "base/message_loop/message_loop.h"
+#include "base/test/scoped_task_environment.h"
 #include "ppapi/shared_impl/proxy_lock.h"
+#include "ppapi/shared_impl/test_globals.h"
 #include "ppapi/shared_impl/var.h"
 #include "ppapi/shared_impl/var_tracker.h"
-#include "ppapi/shared_impl/test_globals.h"
 
 namespace ppapi {
 
@@ -49,7 +49,8 @@ class VarTrackerTest : public testing::Test {
   VarTracker& var_tracker() { return *globals_.GetVarTracker(); }
 
  private:
-  base::MessageLoop message_loop_;  // Required to receive callbacks.
+  base::test::ScopedTaskEnvironment
+      scoped_task_environment_;  // Required to receive callbacks.
   TestGlobals globals_;
 };
 
diff --git a/chromium/ppapi/shared_impl/vpn_provider_util.cc b/chromium/ppapi/shared_impl/vpn_provider_util.cc
index 8241aa42ed7..5b812d611ae 100644
--- a/chromium/ppapi/shared_impl/vpn_provider_util.cc
+++ b/chromium/ppapi/shared_impl/vpn_provider_util.cc
@@ -9,12 +9,14 @@ namespace ppapi {
 VpnProviderSharedBuffer::VpnProviderSharedBuffer(
     uint32_t capacity,
     uint32_t packet_size,
-    std::unique_ptr<base::SharedMemory> shm)
+    base::UnsafeSharedMemoryRegion shm,
+    base::WritableSharedMemoryMapping mapping)
     : capacity_(capacity),
       max_packet_size_(packet_size),
       shm_(std::move(shm)),
+      shm_mapping_(std::move(mapping)),
       available_(capacity, true) {
-  DCHECK(this->shm_);
+  DCHECK(shm_.IsValid() && shm_mapping_.IsValid());
 }
 
 VpnProviderSharedBuffer::~VpnProviderSharedBuffer() {}
@@ -44,11 +46,14 @@ void* VpnProviderSharedBuffer::GetBuffer(uint32_t id) {
     NOTREACHED();
     return nullptr;
   }
-  return reinterpret_cast<char*>(shm_->memory()) + max_packet_size_ * id;
+  return shm_mapping_.GetMemoryAsSpan<char>()
+      .subspan(max_packet_size_ * id)
+      .data();
 }
 
-base::SharedMemoryHandle VpnProviderSharedBuffer::GetHandle() {
-  return shm_->handle();
+base::UnsafeSharedMemoryRegion VpnProviderSharedBuffer::DuplicateRegion()
+    const {
+  return shm_.Duplicate();
 }
 
 }  // namespace ppapi
diff --git a/chromium/ppapi/shared_impl/vpn_provider_util.h b/chromium/ppapi/shared_impl/vpn_provider_util.h
index e5f9d3d8468..e8ac6bfd1d6 100644
--- a/chromium/ppapi/shared_impl/vpn_provider_util.h
+++ b/chromium/ppapi/shared_impl/vpn_provider_util.h
@@ -7,7 +7,8 @@
 
 #include <memory>
 
-#include "base/memory/shared_memory.h"
+#include "base/memory/shared_memory_mapping.h"
+#include "base/memory/unsafe_shared_memory_region.h"
 #include "ppapi/shared_impl/ppapi_shared_export.h"
 
 namespace ppapi {
@@ -16,19 +17,21 @@ class PPAPI_SHARED_EXPORT VpnProviderSharedBuffer {
  public:
   VpnProviderSharedBuffer(uint32_t capacity,
                           uint32_t packet_size,
-                          std::unique_ptr<base::SharedMemory> shm);
+                          base::UnsafeSharedMemoryRegion shm,
+                          base::WritableSharedMemoryMapping mapping);
   ~VpnProviderSharedBuffer();
 
   bool GetAvailable(uint32_t* id);
   void SetAvailable(uint32_t id, bool value);
   void* GetBuffer(uint32_t id);
-  base::SharedMemoryHandle GetHandle();
   uint32_t max_packet_size() { return max_packet_size_; }
+  base::UnsafeSharedMemoryRegion DuplicateRegion() const;
 
  private:
   uint32_t capacity_;
   uint32_t max_packet_size_;
-  std::unique_ptr<base::SharedMemory> shm_;
+  base::UnsafeSharedMemoryRegion shm_;
+  base::WritableSharedMemoryMapping shm_mapping_;
   std::vector<bool> available_;
 
   DISALLOW_COPY_AND_ASSIGN(VpnProviderSharedBuffer);