BASELINE: Update Chromium to 85.0.4183.14085-based

Change-Id: Iaa42f4680837c57725b1344f108c0196741f6057
Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>

155 files changed, 3332 insertions, 789 deletions

diff --git a/chromium/third_party/blink/public/BUILD.gn b/chromium/third_party/blink/public/BUILD.gn
index 59eb599ed2f..d2e930bc641 100644
--- a/chromium/third_party/blink/public/BUILD.gn
+++ b/chromium/third_party/blink/public/BUILD.gn
@@ -64,7 +64,6 @@ config("blink_headers_config") {
 buildflag_header("buildflags") {
   header = "public_buildflags.h"
   flags = [
-    "DEBUG_DEVTOOLS=$debug_devtools",
     "USE_MINIKIN_HYPHENATION=$use_minikin_hyphenation",
     "ENABLE_UNHANDLED_TAP=$enable_unhandled_tap",
   ]
@@ -157,7 +156,6 @@ source_set("blink_headers") {
     "platform/scheduler/web_scoped_virtual_time_pauser.h",
     "platform/scheduler/web_thread_scheduler.h",
     "platform/scheduler/web_widget_scheduler.h",
-    "platform/shape_properties.h",
     "platform/task_type.h",
     "platform/url_conversion.h",
     "platform/user_metrics_action.h",
@@ -194,7 +192,6 @@ source_set("blink_headers") {
     "platform/web_document_subresource_filter.h",
     "platform/web_double_size.h",
     "platform/web_drag_data.h",
-    "platform/web_drag_operation.h",
     "platform/web_effective_connection_type.h",
     "platform/web_encrypted_media_client.h",
     "platform/web_encrypted_media_key_information.h",
@@ -344,7 +341,6 @@ source_set("blink_headers") {
     "web/web_hit_test_result.h",
     "web/web_image.h",
     "web/web_image_cache.h",
-    "web/web_ime_text_span.h",
     "web/web_input_element.h",
     "web/web_input_method_controller.h",
     "web/web_label_element.h",
@@ -380,11 +376,11 @@ source_set("blink_headers") {
     "web/web_print_page_description.h",
     "web/web_print_params.h",
     "web/web_print_preset_options.h",
-    "web/web_print_scaling_option.h",
     "web/web_range.h",
     "web/web_remote_frame.h",
     "web/web_remote_frame_client.h",
     "web/web_render_theme.h",
+    "web/web_savable_resources_test_support.h",
     "web/web_scoped_window_focus_allowed_indicator.h",
     "web/web_script_controller.h",
     "web/web_script_execution_callback.h",
@@ -425,14 +421,15 @@ source_set("blink_headers") {
   ]
 
   public_deps = [
+    ":devtools_inspector_resources_grit",
     ":resources_grit",
     "//net",
     "//services/service_manager/public/cpp",
     "//skia",
     "//third_party/blink/public/common",
     "//ui/accessibility:ax_base",
-    "//ui/base/cursor",
-    "//ui/base/ime:text_input_types",
+    "//ui/base/cursor:cursor_base",
+    "//ui/base/ime",
     "//ui/base/ime/mojom",
     "//url",
   ]
@@ -464,6 +461,10 @@ group("blink_devtools_frontend_resources") {
   public_deps = [ "$devtools_frontend_path:devtools_frontend_resources" ]
 }
 
+group("blink_devtools_inspector_resources") {
+  public_deps = [ ":devtools_inspector_resources_grit" ]
+}
+
 group("blink_devtools_frontend_resources_files") {
   testonly = true
   data_deps = [ "$devtools_frontend_path:devtools_all_files" ]
@@ -484,6 +485,25 @@ grit("resources") {
   ]
 }
 
+grit("devtools_inspector_resources") {
+  # Required because the .grd is generated.
+  enable_input_discovery_for_gn_analyze = false
+
+  source = "$root_out_dir/resources/inspector_overlay/inspector_overlay_resources.grd"
+  output_dir = resources_out_dir
+  outputs = [
+    "grit/inspector_overlay_resources_map.h",
+    "inspector_overlay_resources.pak",
+  ]
+
+  defines =
+      [ "SHARED_INTERMEDIATE_DIR=" + rebase_path(root_out_dir, root_build_dir) ]
+
+  deps = [
+    "$devtools_frontend_path:generate_devtools_inspector_overlay_resources",
+  ]
+}
+
 grit("image_resources") {
   output_dir = resources_out_dir
   source = "blink_image_resources.grd"
diff --git a/chromium/third_party/blink/public/blink_resources.grd b/chromium/third_party/blink/public/blink_resources.grd
index d763f3cff50..62bb0c77650 100644
--- a/chromium/third_party/blink/public/blink_resources.grd
+++ b/chromium/third_party/blink/public/blink_resources.grd
@@ -24,6 +24,7 @@
       <include name="IDR_UASTYLE_THEME_CONTROLS_REFRESH_CSS" file="../renderer/core/html/resources/controls_refresh.css" flattenhtml="true" type="BINDATA" compress="gzip"/>
       <include name="IDR_UASTYLE_THEME_FORCED_COLORS_CSS" file="../renderer/core/html/resources/forced_colors.css" type="BINDATA" compress="gzip"/>
       <include name="IDR_UASTYLE_SVG_CSS" file="../renderer/core/css/svg.css" type="BINDATA" compress="gzip"/>
+      <include name="IDR_UASTYLE_MARKER_CSS" file="../renderer/core/css/marker.css" type="BINDATA" compress="gzip"/>
       <include name="IDR_UASTYLE_MATHML_CSS" file="../renderer/core/css/mathml.css" type="BINDATA" compress="gzip"/>
       <include name="IDR_UASTYLE_MATHML_FALLBACK_CSS" file="../renderer/core/css/mathml-fallback.css" type="BINDATA" compress="gzip"/>
       <include name="IDR_UASTYLE_FULLSCREEN_CSS" file="../renderer/core/css/fullscreen.css" type="BINDATA" compress="gzip"/>
@@ -31,13 +32,6 @@
       <include name="IDR_UASTYLE_XHTMLMP_CSS" file="../renderer/core/css/xhtmlmp.css" type="BINDATA" compress="gzip"/>
       <include name="IDR_UASTYLE_VIEWPORT_ANDROID_CSS" file="../renderer/core/css/viewportAndroid.css" type="BINDATA" compress="gzip"/>
       <include name="IDR_UASTYLE_VIEWPORT_TELEVISION_CSS" file="../renderer/core/css/viewportTelevision.css" type="BINDATA" compress="gzip"/>
-      <include name="IDR_INSPECT_TOOL_COMMON_JS" file="../renderer/core/inspector/inspect_tool_common.js" type="BINDATA" compress="gzip"/>
-      <include name="IDR_INSPECT_TOOL_COMMON_CSS" file="../renderer/core/inspector/inspect_tool_common.css" type="BINDATA" compress="gzip"/>
-      <include name="IDR_INSPECT_TOOL_DISTANCES_HTML" file="../renderer/core/inspector/inspect_tool_distances.html" type="BINDATA" compress="gzip"/>
-      <include name="IDR_INSPECT_TOOL_HIGHLIGHT_HTML" file="../renderer/core/inspector/inspect_tool_highlight.html" type="BINDATA" compress="gzip"/>
-      <include name="IDR_INSPECT_TOOL_PAUSED_HTML" file="../renderer/core/inspector/inspect_tool_paused.html" type="BINDATA" compress="gzip"/>
-      <include name="IDR_INSPECT_TOOL_VIEWPORT_SIZE_HTML" file="../renderer/core/inspector/inspect_tool_viewport_size.html" type="BINDATA" compress="gzip"/>
-      <include name="IDR_INSPECT_TOOL_SCREENSHOT_HTML" file="../renderer/core/inspector/inspect_tool_screenshot.html" type="BINDATA" compress="gzip"/>
       <include name="IDR_DOCUMENTXMLTREEVIEWER_CSS" file="../renderer/core/xml/DocumentXMLTreeViewer.css" type="BINDATA" compress="gzip"/>
       <include name="IDR_DOCUMENTXMLTREEVIEWER_JS" file="../renderer/core/xml/DocumentXMLTreeViewer.js" type="BINDATA" compress="gzip"/>
       <include name="IDR_VALIDATION_BUBBLE_ICON" file="../renderer/core/html/forms/resources/input_alert.svg" type="BINDATA" compress="gzip"/>
@@ -58,7 +52,7 @@
         <include name="IDR_COLOR_PICKER_COMMON_JS" file="../renderer/core/html/forms/resources/color_picker_common.js" type="BINDATA" compress="gzip"/>
         <include name="IDR_COLOR_SUGGESTION_PICKER_CSS" file="../renderer/core/html/forms/resources/colorSuggestionPicker.css" type="BINDATA" compress="gzip"/>
         <include name="IDR_COLOR_SUGGESTION_PICKER_JS" file="../renderer/core/html/forms/resources/colorSuggestionPicker.js" type="BINDATA" compress="gzip"/>
-        <include name="IDR_COLOR_PICKER_CSS" file="../renderer/core/html/forms/resources/color_picker.css" type="BINDATA" compress="gzip"/>
+        <include name="IDR_COLOR_PICKER_CSS" file="../renderer/core/html/forms/resources/color_picker.css" flattenhtml="true" type="BINDATA" compress="gzip"/>
         <include name="IDR_COLOR_PICKER_JS" file="../renderer/core/html/forms/resources/color_picker.js" type="BINDATA" compress="gzip"/>
         <include name="IDR_LIST_PICKER_CSS" file="../renderer/core/html/forms/resources/listPicker.css" type="BINDATA" compress="gzip"/>
         <include name="IDR_LIST_PICKER_JS" file="../renderer/core/html/forms/resources/listPicker.js" type="BINDATA" compress="gzip"/>
diff --git a/chromium/third_party/blink/public/common/BUILD.gn b/chromium/third_party/blink/public/common/BUILD.gn
index 64c1801272f..5e3396552aa 100644
--- a/chromium/third_party/blink/public/common/BUILD.gn
+++ b/chromium/third_party/blink/public/common/BUILD.gn
@@ -31,6 +31,11 @@ buildflag_header("buildflags") {
   flags = [ "RTC_USE_H264=$rtc_use_h264" ]
 }
 
+source_set("common_export") {
+  visibility = [ "//third_party/blink/public/common/*" ]
+  sources = [ "common_export.h" ]
+}
+
 source_set("headers") {
   visibility = [
     "//chrome/*",
@@ -52,7 +57,6 @@ source_set("headers") {
     "bluetooth/web_bluetooth_device_id_mojom_traits.h",
     "cache_storage/cache_storage_utils.h",
     "client_hints/client_hints.h",
-    "common_export.h",
     "context_menu_data/edit_flags.h",
     "context_menu_data/input_field_type.h",
     "context_menu_data/media_type.h",
@@ -84,7 +88,9 @@ source_set("headers") {
     "indexeddb/indexeddb_metadata.h",
     "indexeddb/web_idb_types.h",
     "input/pointer_id.h",
+    "input/synthetic_web_input_event_builders.h",
     "input/web_coalesced_input_event.h",
+    "input/web_coalesced_input_event_mojom_traits.h",
     "input/web_gesture_device.h",
     "input/web_gesture_event.h",
     "input/web_input_event.h",
@@ -134,15 +140,14 @@ source_set("headers") {
     "origin_trials/origin_trial_policy.h",
     "origin_trials/trial_token.h",
     "origin_trials/trial_token_validator.h",
+    "page/drag_mojom_traits.h",
     "page/launching_process_state.h",
     "page/page_zoom.h",
+    "page/web_drag_operation.h",
+    "peerconnection/peer_connection_tracker_mojom_traits.h",
     "peerconnection/webrtc_ip_handling_policy.h",
     "permissions/permission_utils.h",
     "prerender/prerender_rel_type.h",
-    "privacy_budget/identifiability_metric_builder.h",
-    "privacy_budget/identifiability_metrics.h",
-    "privacy_budget/identifiability_study_participation.h",
-    "privacy_budget/identifiable_surface.h",
     "scheduler/web_scheduler_tracked_feature.h",
     "screen_orientation/web_screen_orientation_lock_type.h",
     "screen_orientation/web_screen_orientation_type.h",
@@ -162,11 +167,14 @@ source_set("headers") {
   ]
 
   public_deps = [
+    "//mojo/public/cpp/bindings",
     "//services/metrics/public/cpp:metrics_cpp",
     "//services/network/public/cpp:cpp",
     "//skia",
     "//skia/public/mojom:shared_typemap_traits",
+    "//third_party/blink/public/common/privacy_budget",
     "//third_party/blink/public/mojom:mojom_modules_headers",
+    "//third_party/blink/public/mojom:mojom_platform_shared",
     "//third_party/blink/public/mojom:web_bluetooth_mojo_bindings_headers",
     "//ui/events:event_constants",
     "//ui/events/types:headers",
@@ -175,6 +183,7 @@ source_set("headers") {
 
   deps = [
     ":buildflags",
+    ":common_export",
     "//base",
     "//mojo/public/cpp/bindings",
     "//mojo/public/cpp/system",
@@ -208,10 +217,6 @@ source_set("headers") {
   if (is_win) {
     sources += [ "dwrite_rasterizer_support/dwrite_rasterizer_support.h" ]
   }
-
-  # common_export.h is an implementation detail of component builds,
-  # not part of the public API.
-  public = sources - [ "common_export.h" ]
 }
 
 if (is_android || is_win) {
diff --git a/chromium/third_party/blink/public/common/css/preferred_color_scheme.h b/chromium/third_party/blink/public/common/css/preferred_color_scheme.h
index d14dde56dff..09d793e0c7a 100644
--- a/chromium/third_party/blink/public/common/css/preferred_color_scheme.h
+++ b/chromium/third_party/blink/public/common/css/preferred_color_scheme.h
@@ -9,7 +9,6 @@ namespace blink {
 
 // Use for passing preferred color scheme from the OS to the renderer.
 enum class PreferredColorScheme {
-  kNoPreference,
   kDark,
   kLight,
   kMaxValue = kLight,
diff --git a/chromium/third_party/blink/public/common/feature_policy/document_policy.h b/chromium/third_party/blink/public/common/feature_policy/document_policy.h
index 8974fc791ac..fe85fbee711 100644
--- a/chromium/third_party/blink/public/common/feature_policy/document_policy.h
+++ b/chromium/third_party/blink/public/common/feature_policy/document_policy.h
@@ -88,11 +88,6 @@ class BLINK_COMMON_EXPORT DocumentPolicy {
   bool IsFeatureEnabled(mojom::DocumentPolicyFeature feature,
                         const PolicyValue& threshold_value) const;
 
-  // Returns true if the feature is being migrated to document policy
-  // TODO(iclelland): remove this method when those features are fully
-  // migrated to document policy.
-  bool IsFeatureSupported(mojom::DocumentPolicyFeature feature) const;
-
   // Returns the value of the given feature on the given origin.
   PolicyValue GetFeatureValue(mojom::DocumentPolicyFeature feature) const;
 
diff --git a/chromium/third_party/blink/public/common/feature_policy/feature_policy.h b/chromium/third_party/blink/public/common/feature_policy/feature_policy.h
index 3056bc65ab0..c85a2e6053d 100644
--- a/chromium/third_party/blink/public/common/feature_policy/feature_policy.h
+++ b/chromium/third_party/blink/public/common/feature_policy/feature_policy.h
@@ -5,13 +5,9 @@
 #ifndef THIRD_PARTY_BLINK_PUBLIC_COMMON_FEATURE_POLICY_FEATURE_POLICY_H_
 #define THIRD_PARTY_BLINK_PUBLIC_COMMON_FEATURE_POLICY_FEATURE_POLICY_H_
 
-#include <memory>
-#include <utility>
+#include <map>
 #include <vector>
 
-#include "base/containers/flat_map.h"
-#include "base/containers/flat_set.h"
-#include "base/gtest_prod_util.h"
 #include "base/macros.h"
 #include "services/network/public/mojom/web_sandbox_flags.mojom-shared.h"
 #include "third_party/blink/public/common/common_export.h"
@@ -229,7 +225,7 @@ class BLINK_COMMON_EXPORT FeaturePolicy {
   // the |inherited_policies_| as well as the header policies.
   FeatureState GetFeatureState() const;
 
-  const url::Origin& GetOriginForTest() { return origin_; }
+  const url::Origin& GetOriginForTest() const { return origin_; }
 
   // Returns the list of features which can be controlled by Feature Policy.
   const FeatureList& GetFeatureList() const;
diff --git a/chromium/third_party/blink/public/common/features.h b/chromium/third_party/blink/public/common/features.h
index 430b6d55d90..18f5e4a609e 100644
--- a/chromium/third_party/blink/public/common/features.h
+++ b/chromium/third_party/blink/public/common/features.h
@@ -18,6 +18,7 @@ namespace features {
 BLINK_COMMON_EXPORT extern const base::Feature
     kBlockingDownloadsInAdFrameWithoutUserActivation;
 BLINK_COMMON_EXPORT extern const base::Feature kPaintHolding;
+BLINK_COMMON_EXPORT extern const base::Feature kPaintHoldingCrossOrigin;
 BLINK_COMMON_EXPORT extern const base::Feature
     kEagerCacheStorageSetupForServiceWorkers;
 BLINK_COMMON_EXPORT extern const base::Feature kScriptStreaming;
@@ -30,8 +31,11 @@ BLINK_COMMON_EXPORT extern const base::Feature kCSSOMViewScrollCoordinates;
 BLINK_COMMON_EXPORT extern const base::Feature kDisplayLocking;
 BLINK_COMMON_EXPORT extern const base::Feature kMaxOverlapBoundsForFixed;
 BLINK_COMMON_EXPORT extern const base::Feature kJSONModules;
+BLINK_COMMON_EXPORT extern const base::Feature kForceSynchronousHTMLParsing;
 BLINK_COMMON_EXPORT extern const base::Feature kTopLevelAwait;
 BLINK_COMMON_EXPORT extern const base::Feature kLayoutNG;
+BLINK_COMMON_EXPORT extern const base::Feature kLayoutNGRuby;
+BLINK_COMMON_EXPORT extern const base::Feature kFragmentItem;
 BLINK_COMMON_EXPORT extern const base::Feature kMixedContentAutoupgrade;
 BLINK_COMMON_EXPORT extern const base::Feature kNavigationPredictor;
 BLINK_COMMON_EXPORT extern const base::Feature kPlzDedicatedWorker;
@@ -48,6 +52,9 @@ BLINK_COMMON_EXPORT extern const base::Feature kRTCOfferExtmapAllowMixed;
 BLINK_COMMON_EXPORT extern const base::Feature kV8OptimizeWorkersForPerformance;
 BLINK_COMMON_EXPORT extern const base::Feature kWebRtcMultiplexCodec;
 BLINK_COMMON_EXPORT extern const base::Feature kWebRtcHideLocalIpsWithMdns;
+BLINK_COMMON_EXPORT extern const base::Feature kIntensiveWakeUpThrottling;
+
+BLINK_COMMON_EXPORT extern const base::Feature kOptOutWebRTCFromAllThrottling;
 
 #if BUILDFLAG(RTC_USE_H264) && BUILDFLAG(ENABLE_FFMPEG_VIDEO_DECODERS)
 BLINK_COMMON_EXPORT extern const base::Feature kWebRtcH264WithOpenH264FFmpeg;
@@ -67,8 +74,6 @@ BLINK_COMMON_EXPORT extern const base::Feature kFileHandlingAPI;
 BLINK_COMMON_EXPORT extern const base::Feature kAllowSyncXHRInPageDismissal;
 BLINK_COMMON_EXPORT extern const base::Feature kPrefetchPrivacyChanges;
 
-BLINK_COMMON_EXPORT extern const base::Feature kWebComponentsV0Enabled;
-
 BLINK_COMMON_EXPORT extern const char kMixedContentAutoupgradeModeParamName[];
 BLINK_COMMON_EXPORT extern const char kMixedContentAutoupgradeModeAllPassive[];
 
@@ -83,8 +88,6 @@ BLINK_COMMON_EXPORT extern const base::Feature
 BLINK_COMMON_EXPORT extern const base::Feature kAudioWorkletRealtimeThread;
 
 BLINK_COMMON_EXPORT extern const base::Feature kLightweightNoStatePrefetch;
-BLINK_COMMON_EXPORT extern const base::Feature
-    kLightweightNoStatePrefetch_FetchFonts;
 
 BLINK_COMMON_EXPORT extern const base::Feature kSaveDataImgSrcset;
 
@@ -129,6 +132,8 @@ BLINK_COMMON_EXPORT extern const base::Feature kARIAAnnotations;
 
 BLINK_COMMON_EXPORT extern const base::Feature kCompositeCrossOriginIframes;
 
+BLINK_COMMON_EXPORT extern const base::Feature kTransformInterop;
+
 BLINK_COMMON_EXPORT extern const base::Feature kSubresourceRedirect;
 
 BLINK_COMMON_EXPORT extern const base::Feature kSetLowPriorityForBeacon;
@@ -146,18 +151,21 @@ BLINK_COMMON_EXPORT extern const base::Feature kLowLatencyWebGLSwapChain;
 BLINK_COMMON_EXPORT extern const base::Feature kDawn2dCanvas;
 
 BLINK_COMMON_EXPORT extern const base::Feature
-    kForceExtraRenderingToTrackStickyFrame;
-
-BLINK_COMMON_EXPORT extern const base::Feature
     kCSSReducedFontLoadingInvalidations;
+BLINK_COMMON_EXPORT extern const base::Feature
+    kCSSReducedFontLoadingLayoutInvalidations;
 
 BLINK_COMMON_EXPORT extern const base::Feature kDiscardCodeCacheAfterFirstUse;
 
 BLINK_COMMON_EXPORT extern const base::Feature
     kSuppressContentTypeForBeaconMadeWithArrayBufferView;
 
+BLINK_COMMON_EXPORT extern const base::Feature kBlockFlowHandlesWebkitLineClamp;
+
 BLINK_COMMON_EXPORT extern const base::Feature kBlockHTMLParserOnStyleSheets;
 
+BLINK_COMMON_EXPORT extern const base::Feature kLinkDisabledNewSpecBehavior;
+
 BLINK_COMMON_EXPORT extern const base::Feature kFontPreloadingDelaysRendering;
 BLINK_COMMON_EXPORT extern const base::FeatureParam<int>
     kFontPreloadingDelaysRenderingParam;
@@ -166,6 +174,13 @@ BLINK_COMMON_EXPORT extern const base::Feature kFlexGaps;
 BLINK_COMMON_EXPORT extern const base::Feature kFlexNG;
 
 BLINK_COMMON_EXPORT extern const base::Feature kKeepScriptResourceAlive;
+BLINK_COMMON_EXPORT extern const base::Feature kDelayAsyncScriptExecution;
+enum class DelayAsyncScriptDelayType {
+  kFinishedParsing,
+  kFirstPaintOrFinishedParsing,
+};
+BLINK_COMMON_EXPORT extern const base::FeatureParam<DelayAsyncScriptDelayType>
+    kDelayAsyncScriptExecutionDelayParam;
 
 BLINK_COMMON_EXPORT extern const base::Feature kAppCache;
 BLINK_COMMON_EXPORT extern const base::Feature kAppCacheRequireOriginTrial;
@@ -188,6 +203,16 @@ BLINK_COMMON_EXPORT extern const base::Feature kThrottleInstallingServiceWorker;
 BLINK_COMMON_EXPORT extern const base::FeatureParam<int>
     kInstallingServiceWorkerOutstandingThrottledLimit;
 
+// This flag is used to set field parameters to choose predictor we use when
+// kResamplingInputEvents is disabled. It's used for gatherig accuracy metrics
+// on finch and also for choosing predictor type for predictedEvents API without
+// enabling resampling. It does not have any effect when the resampling flag is
+// enabled.
+BLINK_COMMON_EXPORT extern const base::Feature kInputPredictorTypeChoice;
+
+// Enables resampling input events on main thread.
+BLINK_COMMON_EXPORT extern const base::Feature kResamplingInputEvents;
+
 // Enables resampling GestureScroll events on compositor thread.
 BLINK_COMMON_EXPORT extern const base::Feature kResamplingScrollEvents;
 
@@ -245,6 +270,12 @@ BLINK_COMMON_EXPORT
 extern const char
     kSkipTouchEventFilterFilteringProcessParamValueBrowserAndRenderer[];
 
+BLINK_COMMON_EXPORT extern const base::Feature kWebXrMultiGpu;
+BLINK_COMMON_EXPORT extern const base::Feature
+    kCSSMatchedPropertiesCacheDependencies;
+
+BLINK_COMMON_EXPORT extern const base::Feature kParkableStringsToDisk;
+
 }  // namespace features
 }  // namespace blink
 
diff --git a/chromium/third_party/blink/public/common/indexeddb/indexeddb_key.h b/chromium/third_party/blink/public/common/indexeddb/indexeddb_key.h
index 16159009d85..e58b215534d 100644
--- a/chromium/third_party/blink/public/common/indexeddb/indexeddb_key.h
+++ b/chromium/third_party/blink/public/common/indexeddb/indexeddb_key.h
@@ -10,7 +10,7 @@
 #include <string>
 #include <vector>
 
-#include "base/logging.h"
+#include "base/check_op.h"
 #include "base/strings/string16.h"
 #include "third_party/blink/public/common/common_export.h"
 #include "third_party/blink/public/common/indexeddb/web_idb_types.h"
diff --git a/chromium/third_party/blink/public/common/indexeddb/indexeddb_key_path.h b/chromium/third_party/blink/public/common/indexeddb/indexeddb_key_path.h
index 9f5422c88eb..973c4c4d38e 100644
--- a/chromium/third_party/blink/public/common/indexeddb/indexeddb_key_path.h
+++ b/chromium/third_party/blink/public/common/indexeddb/indexeddb_key_path.h
@@ -8,7 +8,6 @@
 #include <string>
 #include <vector>
 
-#include "base/logging.h"
 #include "base/strings/string16.h"
 #include "third_party/blink/public/common/common_export.h"
 #include "third_party/blink/public/common/indexeddb/web_idb_types.h"
diff --git a/chromium/third_party/blink/public/common/input/OWNERS b/chromium/third_party/blink/public/common/input/OWNERS
new file mode 100644
index 00000000000..d5fefd82012
--- /dev/null
+++ b/chromium/third_party/blink/public/common/input/OWNERS
@@ -0,0 +1,2 @@
+per-file *_mojom_traits*.*=set noparent
+per-file *_mojom_traits*.*=file://ipc/SECURITY_OWNERS
diff --git a/chromium/third_party/blink/public/common/input/synthetic_web_input_event_builders.h b/chromium/third_party/blink/public/common/input/synthetic_web_input_event_builders.h
new file mode 100644
index 00000000000..27201ad8e38
--- /dev/null
+++ b/chromium/third_party/blink/public/common/input/synthetic_web_input_event_builders.h
@@ -0,0 +1,116 @@
+// Copyright 2013 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef THIRD_PARTY_BLINK_PUBLIC_COMMON_INPUT_SYNTHETIC_WEB_INPUT_EVENT_BUILDERS_H_
+#define THIRD_PARTY_BLINK_PUBLIC_COMMON_INPUT_SYNTHETIC_WEB_INPUT_EVENT_BUILDERS_H_
+
+#include "base/time/time.h"
+#include "third_party/blink/public/common/common_export.h"
+#include "third_party/blink/public/common/input/web_gesture_event.h"
+#include "third_party/blink/public/common/input/web_input_event.h"
+#include "third_party/blink/public/common/input/web_keyboard_event.h"
+#include "third_party/blink/public/common/input/web_mouse_wheel_event.h"
+#include "third_party/blink/public/common/input/web_touch_event.h"
+#include "ui/events/types/scroll_types.h"
+
+// Provides sensible creation of default WebInputEvents for testing purposes.
+
+namespace blink {
+
+class BLINK_COMMON_EXPORT SyntheticWebMouseEventBuilder {
+ public:
+  static blink::WebMouseEvent Build(blink::WebInputEvent::Type type);
+  static blink::WebMouseEvent Build(
+      blink::WebInputEvent::Type type,
+      float window_x,
+      float window_y,
+      int modifiers,
+      blink::WebPointerProperties::PointerType pointer_type =
+          blink::WebPointerProperties::PointerType::kMouse);
+};
+
+class BLINK_COMMON_EXPORT SyntheticWebMouseWheelEventBuilder {
+ public:
+  static blink::WebMouseWheelEvent Build(
+      blink::WebMouseWheelEvent::Phase phase);
+  static blink::WebMouseWheelEvent Build(float x,
+                                         float y,
+                                         float dx,
+                                         float dy,
+                                         int modifiers,
+                                         ui::ScrollGranularity delta_units);
+  static blink::WebMouseWheelEvent Build(float x,
+                                         float y,
+                                         float global_x,
+                                         float global_y,
+                                         float dx,
+                                         float dy,
+                                         int modifiers,
+                                         ui::ScrollGranularity delta_units);
+};
+
+class BLINK_COMMON_EXPORT SyntheticWebGestureEventBuilder {
+ public:
+  static blink::WebGestureEvent Build(blink::WebInputEvent::Type type,
+                                      blink::WebGestureDevice source_device,
+                                      int modifiers = 0);
+  static blink::WebGestureEvent BuildScrollBegin(
+      float dx_hint,
+      float dy_hint,
+      blink::WebGestureDevice source_device,
+      int pointer_count = 1);
+  static blink::WebGestureEvent BuildScrollUpdate(
+      float dx,
+      float dy,
+      int modifiers,
+      blink::WebGestureDevice source_device);
+  static blink::WebGestureEvent BuildPinchUpdate(
+      float scale,
+      float anchor_x,
+      float anchor_y,
+      int modifiers,
+      blink::WebGestureDevice source_device);
+  static blink::WebGestureEvent BuildFling(
+      float velocity_x,
+      float velocity_y,
+      blink::WebGestureDevice source_device);
+};
+
+class BLINK_COMMON_EXPORT SyntheticWebTouchEvent : public blink::WebTouchEvent {
+ public:
+  SyntheticWebTouchEvent();
+
+  // Mark all the points as stationary, and remove any released points.
+  void ResetPoints();
+
+  // Adds an additional point to the touch list, returning the point's index.
+  int PressPoint(float x,
+                 float y,
+                 float radius_x = 20.f,
+                 float radius_y = 20.f,
+                 float rotation_angle = 0.f,
+                 float force = 1.f);
+  void MovePoint(int index,
+                 float x,
+                 float y,
+                 float radius_x = 20.f,
+                 float radius_y = 20.f,
+                 float rotation_angle = 0.f,
+                 float force = 1.f);
+  void ReleasePoint(int index);
+  void CancelPoint(int index);
+
+  void SetTimestamp(base::TimeTicks timestamp);
+
+  int FirstFreeIndex();
+
+ private:
+  // A pointer id of each touch pointer. Every time when a pointer is pressed
+  // the screen, it will be assigned to a new pointer id.
+  unsigned pointer_id_;
+};
+
+}  // namespace blink
+
+#endif  // THIRD_PARTY_BLINK_PUBLIC_COMMON_INPUT_SYNTHETIC_WEB_INPUT_EVENT_BUILDERS_H_
diff --git a/chromium/third_party/blink/public/common/input/web_coalesced_input_event.h b/chromium/third_party/blink/public/common/input/web_coalesced_input_event.h
index 2a3326373be..a33bef65575 100644
--- a/chromium/third_party/blink/public/common/input/web_coalesced_input_event.h
+++ b/chromium/third_party/blink/public/common/input/web_coalesced_input_event.h
@@ -29,6 +29,7 @@ class BLINK_COMMON_EXPORT WebCoalescedInputEvent {
                          const ui::LatencyInfo&);
   // Copy constructor to deep copy the event.
   WebCoalescedInputEvent(const WebCoalescedInputEvent&);
+  ~WebCoalescedInputEvent();
 
   WebInputEvent* EventPointer();
   void AddCoalescedEvent(const blink::WebInputEvent&);
@@ -45,6 +46,7 @@ class BLINK_COMMON_EXPORT WebCoalescedInputEvent {
   GetPredictedEventsPointers() const;
 
   const ui::LatencyInfo& latency_info() const { return latency_; }
+  ui::LatencyInfo& latency_info() { return latency_; }
 
   bool CanCoalesceWith(const WebCoalescedInputEvent& other) const
       WARN_UNUSED_RESULT;
@@ -64,8 +66,6 @@ class BLINK_COMMON_EXPORT WebCoalescedInputEvent {
   ui::LatencyInfo latency_;
 };
 
-using WebScopedCoalescedInputEvent = std::unique_ptr<WebCoalescedInputEvent>;
-
 }  // namespace blink
 
 #endif
diff --git a/chromium/third_party/blink/public/common/input/web_coalesced_input_event_mojom_traits.h b/chromium/third_party/blink/public/common/input/web_coalesced_input_event_mojom_traits.h
new file mode 100644
index 00000000000..48721be33eb
--- /dev/null
+++ b/chromium/third_party/blink/public/common/input/web_coalesced_input_event_mojom_traits.h
@@ -0,0 +1,53 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef THIRD_PARTY_BLINK_PUBLIC_COMMON_INPUT_WEB_COALESCED_INPUT_EVENT_MOJOM_TRAITS_H_
+#define THIRD_PARTY_BLINK_PUBLIC_COMMON_INPUT_WEB_COALESCED_INPUT_EVENT_MOJOM_TRAITS_H_
+
+#include "third_party/blink/public/common/common_export.h"
+#include "third_party/blink/public/common/input/web_coalesced_input_event.h"
+#include "third_party/blink/public/mojom/input/input_handler.mojom.h"
+
+namespace mojo {
+
+template <>
+struct BLINK_COMMON_EXPORT
+    StructTraits<blink::mojom::EventDataView,
+                 std::unique_ptr<blink::WebCoalescedInputEvent>> {
+  static blink::WebInputEvent::Type type(
+      const std::unique_ptr<blink::WebCoalescedInputEvent>& event) {
+    return event->Event().GetType();
+  }
+
+  static int32_t modifiers(
+      const std::unique_ptr<blink::WebCoalescedInputEvent>& event) {
+    return event->Event().GetModifiers();
+  }
+
+  static base::TimeTicks timestamp(
+      const std::unique_ptr<blink::WebCoalescedInputEvent>& event) {
+    return event->Event().TimeStamp();
+  }
+
+  static const ui::LatencyInfo& latency(
+      const std::unique_ptr<blink::WebCoalescedInputEvent>& event) {
+    return event->latency_info();
+  }
+
+  static blink::mojom::KeyDataPtr key_data(
+      const std::unique_ptr<blink::WebCoalescedInputEvent>& event);
+  static blink::mojom::PointerDataPtr pointer_data(
+      const std::unique_ptr<blink::WebCoalescedInputEvent>& event);
+  static blink::mojom::GestureDataPtr gesture_data(
+      const std::unique_ptr<blink::WebCoalescedInputEvent>& event);
+  static blink::mojom::TouchDataPtr touch_data(
+      const std::unique_ptr<blink::WebCoalescedInputEvent>& event);
+
+  static bool Read(blink::mojom::EventDataView r,
+                   std::unique_ptr<blink::WebCoalescedInputEvent>* out);
+};
+
+}  // namespace mojo
+
+#endif  // THIRD_PARTY_BLINK_PUBLIC_COMMON_INPUT_WEB_COALESCED_INPUT_EVENT_MOJOM_TRAITS_H_
diff --git a/chromium/third_party/blink/public/common/input/web_gesture_event.h b/chromium/third_party/blink/public/common/input/web_gesture_event.h
index 548defc2b6e..72ef59d1f06 100644
--- a/chromium/third_party/blink/public/common/input/web_gesture_event.h
+++ b/chromium/third_party/blink/public/common/input/web_gesture_event.h
@@ -5,7 +5,8 @@
 #ifndef THIRD_PARTY_BLINK_PUBLIC_COMMON_INPUT_WEB_GESTURE_EVENT_H_
 #define THIRD_PARTY_BLINK_PUBLIC_COMMON_INPUT_WEB_GESTURE_EVENT_H_
 
-#include "base/logging.h"
+#include "base/check.h"
+#include "base/notreached.h"
 #include "cc/paint/element_id.h"
 #include "third_party/blink/public/common/input/web_gesture_device.h"
 #include "third_party/blink/public/common/input/web_input_event.h"
@@ -76,7 +77,10 @@ class BLINK_COMMON_EXPORT WebGestureEvent : public WebInputEvent {
       // a hit-test. Should be used for gestures queued up internally within
       // the renderer process. This is an ElementIdType instead of ElementId
       // due to the fact that ElementId has a non-trivial constructor that
-      // can't easily participate in this union of structs.
+      // can't easily participate in this union of structs. Note that while
+      // this is used in scroll unification to perform a main thread hit test,
+      // in which case |main_thread_hit_tested| is true, it is also used in
+      // other cases like scroll events reinjected for scrollbar scrolling.
       cc::ElementIdType scrollable_area_element_id;
       // Initial motion that triggered the scroll.
       float delta_x_hint;
@@ -95,6 +99,11 @@ class BLINK_COMMON_EXPORT WebGestureEvent : public WebInputEvent {
       // True if this event is generated from a wheel event with synthetic
       // phase.
       bool synthetic;
+      // If true, this event has been hit tested by the main thread and the
+      // result is stored in scrollable_area_element_id. Used only in scroll
+      // unification when the event is sent back the the compositor for a
+      // second time after the main thread hit test is complete.
+      bool main_thread_hit_tested;
     } scroll_begin;
 
     struct {
diff --git a/chromium/third_party/blink/public/common/input/web_input_event.h b/chromium/third_party/blink/public/common/input/web_input_event.h
index 00f34eb7f30..c599513dd8f 100644
--- a/chromium/third_party/blink/public/common/input/web_input_event.h
+++ b/chromium/third_party/blink/public/common/input/web_input_event.h
@@ -35,7 +35,7 @@
 
 #include <memory>
 
-#include "base/logging.h"
+#include "base/notreached.h"
 #include "base/time/time.h"
 #include "third_party/blink/public/common/common_export.h"
 #include "third_party/blink/public/mojom/input/input_event.mojom-shared.h"
diff --git a/chromium/third_party/blink/public/common/input/web_mouse_wheel_event.h b/chromium/third_party/blink/public/common/input/web_mouse_wheel_event.h
index ce4f21f477c..2121b51c692 100644
--- a/chromium/third_party/blink/public/common/input/web_mouse_wheel_event.h
+++ b/chromium/third_party/blink/public/common/input/web_mouse_wheel_event.h
@@ -100,6 +100,11 @@ class BLINK_COMMON_EXPORT WebMouseWheelEvent : public WebMouseEvent {
   bool CanCoalesce(const WebInputEvent& event) const override;
   void Coalesce(const WebInputEvent& event) override;
 
+  // Return the platform specific default event action given the mouse wheel
+  // event. Can be used to determine the appropriate value for |event_action|.
+  static EventAction GetPlatformSpecificDefaultEventAction(
+      const WebMouseWheelEvent& event);
+
  private:
   bool HaveConsistentPhase(const WebMouseWheelEvent& event) const;
 };
diff --git a/chromium/third_party/blink/public/common/loader/throttling_url_loader.h b/chromium/third_party/blink/public/common/loader/throttling_url_loader.h
index 1ce0af505d8..ad5f8fc4e8c 100644
--- a/chromium/third_party/blink/public/common/loader/throttling_url_loader.h
+++ b/chromium/third_party/blink/public/common/loader/throttling_url_loader.h
@@ -10,6 +10,7 @@
 #include "base/callback.h"
 #include "base/memory/ref_counted.h"
 #include "base/memory/weak_ptr.h"
+#include "base/optional.h"
 #include "base/strings/string_piece.h"
 #include "base/threading/thread_task_runner_handle.h"
 #include "mojo/public/cpp/bindings/pending_receiver.h"
@@ -40,6 +41,9 @@ class BLINK_COMMON_EXPORT ThrottlingURLLoader
   // Reason used when resetting the URLLoader to follow a redirect.
   static const char kFollowRedirectReason[];
 
+  // |url_request| can be mutated by this function, and doesn't need to stay
+  // alive after calling this function.
+  //
   // |client| must stay alive during the lifetime of the returned object. Please
   // note that the request may not start immediately since it could be deferred
   // by throttles.
@@ -52,7 +56,9 @@ class BLINK_COMMON_EXPORT ThrottlingURLLoader
       network::ResourceRequest* url_request,
       network::mojom::URLLoaderClient* client,
       const net::NetworkTrafficAnnotationTag& traffic_annotation,
-      scoped_refptr<base::SingleThreadTaskRunner> task_runner);
+      scoped_refptr<base::SingleThreadTaskRunner> task_runner,
+      base::Optional<std::vector<std::string>> cors_exempt_header_list =
+          base::nullopt);
 
   ~ThrottlingURLLoader() override;
 
@@ -112,7 +118,8 @@ class BLINK_COMMON_EXPORT ThrottlingURLLoader
              int32_t request_id,
              uint32_t options,
              network::ResourceRequest* url_request,
-             scoped_refptr<base::SingleThreadTaskRunner> task_runner);
+             scoped_refptr<base::SingleThreadTaskRunner> task_runner,
+             base::Optional<std::vector<std::string>> cors_exempt_header_list);
 
   void StartNow();
   void RestartWithFlagsNow();
@@ -135,6 +142,9 @@ class BLINK_COMMON_EXPORT ThrottlingURLLoader
   // Restart the request using |original_url_|.
   void RestartWithURLResetAndFlags(int additional_load_flags);
 
+  // Restart the request immediately if the response has not started yet.
+  void RestartWithURLResetAndFlagsNow(int additional_load_flags);
+
   // network::mojom::URLLoaderClient implementation:
   void OnReceiveResponse(
       network::mojom::URLResponseHeadPtr response_head) override;
@@ -182,6 +192,7 @@ class BLINK_COMMON_EXPORT ThrottlingURLLoader
   };
   DeferredStage deferred_stage_ = DEFERRED_NONE;
   bool loader_completed_ = false;
+  bool did_receive_response_ = false;
 
   struct ThrottleEntry {
     ThrottleEntry(ThrottlingURLLoader* loader,
@@ -219,7 +230,8 @@ class BLINK_COMMON_EXPORT ThrottlingURLLoader
         int32_t in_request_id,
         uint32_t in_options,
         network::ResourceRequest* in_url_request,
-        scoped_refptr<base::SingleThreadTaskRunner> in_task_runner);
+        scoped_refptr<base::SingleThreadTaskRunner> in_task_runner,
+        base::Optional<std::vector<std::string>> in_cors_exempt_header_list);
     ~StartInfo();
 
     scoped_refptr<network::SharedURLLoaderFactory> url_loader_factory;
@@ -230,6 +242,7 @@ class BLINK_COMMON_EXPORT ThrottlingURLLoader
     network::ResourceRequest url_request;
     // |task_runner| is used to set up |client_receiver_|.
     scoped_refptr<base::SingleThreadTaskRunner> task_runner;
+    base::Optional<std::vector<std::string>> cors_exempt_header_list;
   };
   // Holds any info needed to start or restart the request. Used when start is
   // deferred or when FollowRedirectForcingRestart() is called.
diff --git a/chromium/third_party/blink/public/common/loader/url_loader_throttle.h b/chromium/third_party/blink/public/common/loader/url_loader_throttle.h
index dfeceaa30b0..cf2c1dcb9f1 100644
--- a/chromium/third_party/blink/public/common/loader/url_loader_throttle.h
+++ b/chromium/third_party/blink/public/common/loader/url_loader_throttle.h
@@ -121,6 +121,12 @@ class BLINK_COMMON_EXPORT URLLoaderThrottle {
     // using a combined value of all of the |additional_load_flags|.
     virtual void RestartWithURLResetAndFlags(int additional_load_flags);
 
+    // Restarts the URL loader immediately using |additional_load_flags| and the
+    // unmodified URL if it was changed in WillStartRequest().
+    //
+    // Restarting is only valid before BeforeWillProcessResponse() is called.
+    virtual void RestartWithURLResetAndFlagsNow(int additional_load_flags);
+
    protected:
     virtual ~Delegate();
   };
diff --git a/chromium/third_party/blink/public/common/manifest/manifest.h b/chromium/third_party/blink/public/common/manifest/manifest.h
index c0241781ebf..917736c1aa9 100644
--- a/chromium/third_party/blink/public/common/manifest/manifest.h
+++ b/chromium/third_party/blink/public/common/manifest/manifest.h
@@ -126,6 +126,12 @@ struct BLINK_COMMON_EXPORT Manifest {
     std::map<base::string16, std::vector<base::string16>> accept;
   };
 
+  // Structure representing a Protocol Handler.
+  struct BLINK_COMMON_EXPORT ProtocolHandler {
+    base::string16 protocol;
+    GURL url;
+  };
+
   // Structure representing a related application.
   struct BLINK_COMMON_EXPORT RelatedApplication {
     RelatedApplication();
@@ -188,6 +194,13 @@ struct BLINK_COMMON_EXPORT Manifest {
   // https://github.com/WICG/file-handling/blob/master/explainer.md
   std::vector<FileHandler> file_handlers;
 
+  // Empty if parsing failed or the field was not present.
+  // TODO(crbug.com/1019239): This is going into the mainline manifest spec,
+  // remove the TODO once that PR goes in.
+  // The URLProtocolHandler explainer can be found here:
+  // https://github.com/MicrosoftEdge/MSEdgeExplainers/blob/master/URLProtocolHandler/explainer.md
+  std::vector<ProtocolHandler> protocol_handlers;
+
   // Empty if the parsing failed, the field was not present, empty or all the
   // applications inside the array were invalid. The order of the array
   // indicates the priority of the application to use.
diff --git a/chromium/third_party/blink/public/common/manifest/manifest_mojom_traits.h b/chromium/third_party/blink/public/common/manifest/manifest_mojom_traits.h
index da4707058bd..b6476d35944 100644
--- a/chromium/third_party/blink/public/common/manifest/manifest_mojom_traits.h
+++ b/chromium/third_party/blink/public/common/manifest/manifest_mojom_traits.h
@@ -112,6 +112,11 @@ struct BLINK_COMMON_EXPORT
     return manifest.file_handlers;
   }
 
+  static const std::vector<::blink::Manifest::ProtocolHandler>&
+  protocol_handlers(const ::blink::Manifest& manifest) {
+    return manifest.protocol_handlers;
+  }
+
   static const std::vector<::blink::Manifest::RelatedApplication>&
   related_applications(const ::blink::Manifest& manifest) {
     return manifest.related_applications;
@@ -301,6 +306,21 @@ struct BLINK_COMMON_EXPORT
 
 template <>
 struct BLINK_COMMON_EXPORT
+    StructTraits<blink::mojom::ManifestProtocolHandlerDataView,
+                 ::blink::Manifest::ProtocolHandler> {
+  static base::StringPiece16 protocol(
+      const ::blink::Manifest::ProtocolHandler& protocol) {
+    return internal::TruncateString16(protocol.protocol);
+  }
+  static const GURL& url(const ::blink::Manifest::ProtocolHandler& protocol) {
+    return protocol.url;
+  }
+  static bool Read(blink::mojom::ManifestProtocolHandlerDataView data,
+                   ::blink::Manifest::ProtocolHandler* out);
+};
+
+template <>
+struct BLINK_COMMON_EXPORT
     EnumTraits<blink::mojom::ManifestImageResource_Purpose,
                ::blink::Manifest::ImageResource::Purpose> {
   static blink::mojom::ManifestImageResource_Purpose ToMojom(
diff --git a/chromium/third_party/blink/public/common/mediastream/media_devices.h b/chromium/third_party/blink/public/common/mediastream/media_devices.h
index d87affeb087..c0ba8bd3415 100644
--- a/chromium/third_party/blink/public/common/mediastream/media_devices.h
+++ b/chromium/third_party/blink/public/common/mediastream/media_devices.h
@@ -8,6 +8,7 @@
 #include <string>
 #include <vector>
 
+#include "base/optional.h"
 #include "media/base/video_facing.h"
 #include "third_party/blink/public/common/common_export.h"
 
@@ -32,7 +33,8 @@ struct BLINK_COMMON_EXPORT WebMediaDeviceInfo {
       const std::string& device_id,
       const std::string& label,
       const std::string& group_id,
-      media::VideoFacingMode video_facing = media::MEDIA_VIDEO_FACING_NONE);
+      media::VideoFacingMode video_facing = media::MEDIA_VIDEO_FACING_NONE,
+      const base::Optional<bool>& pan_tilt_zoom_supported = base::nullopt);
   explicit WebMediaDeviceInfo(
       const media::VideoCaptureDeviceDescriptor& descriptor);
   ~WebMediaDeviceInfo();
@@ -42,7 +44,9 @@ struct BLINK_COMMON_EXPORT WebMediaDeviceInfo {
   std::string device_id;
   std::string label;
   std::string group_id;
-  media::VideoFacingMode video_facing;
+  media::VideoFacingMode video_facing =
+      media::VideoFacingMode::MEDIA_VIDEO_FACING_NONE;
+  base::Optional<bool> pan_tilt_zoom_supported;
 };
 
 using WebMediaDeviceInfoArray = std::vector<WebMediaDeviceInfo>;
diff --git a/chromium/third_party/blink/public/common/mediastream/media_stream_request.h b/chromium/third_party/blink/public/common/mediastream/media_stream_request.h
index ee5e4073fa5..6c530625c4f 100644
--- a/chromium/third_party/blink/public/common/mediastream/media_stream_request.h
+++ b/chromium/third_party/blink/public/common/mediastream/media_stream_request.h
@@ -57,7 +57,8 @@ struct BLINK_COMMON_EXPORT MediaStreamDevice {
       const std::string& id,
       const std::string& name,
       media::VideoFacingMode facing,
-      const base::Optional<std::string>& group_id = base::nullopt);
+      const base::Optional<std::string>& group_id = base::nullopt,
+      const base::Optional<bool>& pan_tilt_zoom_supported = base::nullopt);
   MediaStreamDevice(mojom::MediaStreamType type,
                     const std::string& id,
                     const std::string& name,
@@ -98,6 +99,10 @@ struct BLINK_COMMON_EXPORT MediaStreamDevice {
   // The device's group ID.
   base::Optional<std::string> group_id;
 
+  // Whether the device supports pan-tilt-zoom.
+  // Only applicable to video devices.
+  base::Optional<bool> pan_tilt_zoom_supported;
+
   // The device id of a matched output device if any (otherwise empty).
   // Only applicable to audio devices.
   base::Optional<std::string> matched_output_device_id;
diff --git a/chromium/third_party/blink/public/common/origin_trials/origin_trial_policy.h b/chromium/third_party/blink/public/common/origin_trials/origin_trial_policy.h
index 905a7c7bdf2..879cea4267f 100644
--- a/chromium/third_party/blink/public/common/origin_trials/origin_trial_policy.h
+++ b/chromium/third_party/blink/public/common/origin_trials/origin_trial_policy.h
@@ -23,6 +23,9 @@ class OriginTrialPolicy {
   virtual bool IsFeatureDisabled(base::StringPiece feature) const {
     return false;
   }
+  virtual bool IsFeatureDisabledForUser(base::StringPiece feature) const {
+    return false;
+  }
   virtual bool IsTokenDisabled(base::StringPiece token_signature) const {
     return false;
   }
diff --git a/chromium/third_party/blink/public/common/origin_trials/trial_token.h b/chromium/third_party/blink/public/common/origin_trials/trial_token.h
index eccae423a79..001b10b6d27 100644
--- a/chromium/third_party/blink/public/common/origin_trials/trial_token.h
+++ b/chromium/third_party/blink/public/common/origin_trials/trial_token.h
@@ -30,7 +30,8 @@ enum class OriginTrialTokenStatus {
   kWrongVersion = 7,
   kFeatureDisabled = 8,
   kTokenDisabled = 9,
-  kMaxValue = kTokenDisabled
+  kFeatureDisabledForUser = 10,
+  kMaxValue = kFeatureDisabledForUser
 };
 
 // The Origin Trials Framework (OT) provides limited access to experimental
@@ -49,6 +50,8 @@ class BLINK_COMMON_EXPORT TrialToken {
  public:
   ~TrialToken();
 
+  enum class UsageRestriction { kNone, kSubset };
+
   // If the string represents a signed well-formed token, a token object is
   // returned, and success is returned in the |out_status| parameter. Otherwise,
   // the |out_status| parameter indicates what was wrong with the string, and
@@ -73,6 +76,7 @@ class BLINK_COMMON_EXPORT TrialToken {
   base::Time expiry_time() { return expiry_time_; }
   std::string signature() { return signature_; }
   bool is_third_party() const { return is_third_party_; }
+  UsageRestriction usage_restriction() { return usage_restriction_; }
 
  protected:
   // Tests can access the Parse method directly to validate it, and so are
@@ -112,7 +116,8 @@ class BLINK_COMMON_EXPORT TrialToken {
              bool match_subdomains,
              const std::string& feature_name,
              uint64_t expiry_timestamp,
-             bool is_third_party);
+             bool is_third_party,
+             UsageRestriction usage_restriction);
 
   // The origin for which this token is valid. Must be a secure origin.
   url::Origin origin_;
@@ -134,6 +139,12 @@ class BLINK_COMMON_EXPORT TrialToken {
   // https://docs.google.com/document/d/1xALH9W7rWmX0FpjudhDeS2TNTEOXuPn4Tlc9VmuPdHA
   // for more details.
   bool is_third_party_;
+
+  // Indicates the alternative usage restriction mode imposed on the token.
+  // See design doc
+  // https://docs.google.com/document/d/1xALH9W7rWmX0FpjudhDeS2TNTEOXuPn4Tlc9VmuPdHA
+  // for more details.
+  UsageRestriction usage_restriction_;
 };
 
 }  // namespace blink
diff --git a/chromium/third_party/blink/public/common/origin_trials/trial_token_validator.h b/chromium/third_party/blink/public/common/origin_trials/trial_token_validator.h
index 824e74a8250..aa27c9cff12 100644
--- a/chromium/third_party/blink/public/common/origin_trials/trial_token_validator.h
+++ b/chromium/third_party/blink/public/common/origin_trials/trial_token_validator.h
@@ -30,7 +30,8 @@ struct BLINK_COMMON_EXPORT TrialTokenResult {
   explicit TrialTokenResult(OriginTrialTokenStatus);
   TrialTokenResult(OriginTrialTokenStatus status,
                    std::string name,
-                   base::Time expiry);
+                   base::Time expiry,
+                   bool is_third_party);
   ~TrialTokenResult();
 
   OriginTrialTokenStatus status;
@@ -53,12 +54,23 @@ class BLINK_COMMON_EXPORT TrialTokenValidator {
       base::flat_map<std::string /* feature_name */,
                      std::vector<std::string /* token */>>;
 
-  // If the token validates, status is set to OriginTrialTokenStatus::kSuccess,
-  // feature_name is set to name of the feature this token enables, expiry_time
-  // is set to the expiry time of the token. This method is thread-safe.
+  // If the token validates, status will be set to
+  // OriginTrialTokenStatus::kSuccess, the rest will be populated with name of
+  // the feature this token enables, the expiry time of the token and whether it
+  // is a third-party token. Otherwise, only the status will be set.
+  // This method is thread-safe.
   virtual TrialTokenResult ValidateToken(base::StringPiece token,
                                          const url::Origin& origin,
                                          base::Time current_time) const;
+  // Validates a token for the given |origin|. If identified as a third-party
+  // token, instead validate for the given |third_party_origin|. Validation of a
+  // third-party token will fail if |third_party-origin| is not given. Returns
+  // the same result as ValidateToken() above.
+  // This method is thread-safe.
+  virtual TrialTokenResult ValidateToken(base::StringPiece token,
+                                         const url::Origin& origin,
+                                         const url::Origin* third_party_origin,
+                                         base::Time current_time) const;
 
   bool RequestEnablesFeature(const net::URLRequest* request,
                              base::StringPiece feature_name,
diff --git a/chromium/third_party/blink/public/common/page/OWNERS b/chromium/third_party/blink/public/common/page/OWNERS
index 08850f42120..d5fefd82012 100644
--- a/chromium/third_party/blink/public/common/page/OWNERS
+++ b/chromium/third_party/blink/public/common/page/OWNERS
@@ -1,2 +1,2 @@
-per-file *.mojom=set noparent
-per-file *.mojom=file://ipc/SECURITY_OWNERS
+per-file *_mojom_traits*.*=set noparent
+per-file *_mojom_traits*.*=file://ipc/SECURITY_OWNERS
diff --git a/chromium/third_party/blink/public/common/page/drag_mojom_traits.h b/chromium/third_party/blink/public/common/page/drag_mojom_traits.h
new file mode 100644
index 00000000000..c6334b4d7db
--- /dev/null
+++ b/chromium/third_party/blink/public/common/page/drag_mojom_traits.h
@@ -0,0 +1,52 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef THIRD_PARTY_BLINK_PUBLIC_COMMON_PAGE_DRAG_MOJOM_TRAITS_H_
+#define THIRD_PARTY_BLINK_PUBLIC_COMMON_PAGE_DRAG_MOJOM_TRAITS_H_
+
+#include "mojo/public/cpp/bindings/enum_traits.h"
+#include "mojo/public/cpp/bindings/struct_traits.h"
+#include "third_party/blink/public/common/common_export.h"
+#include "third_party/blink/public/common/page/web_drag_operation.h"
+#include "third_party/blink/public/mojom/page/widget.mojom-shared.h"
+
+namespace mojo {
+
+template <>
+struct BLINK_COMMON_EXPORT
+    EnumTraits<blink::mojom::DragOperation, blink::WebDragOperation> {
+  static blink::mojom::DragOperation ToMojom(blink::WebDragOperation op);
+  static bool FromMojom(blink::mojom::DragOperation op,
+                        blink::WebDragOperation* out);
+};
+
+template <>
+struct BLINK_COMMON_EXPORT
+    StructTraits<blink::mojom::AllowedDragOperationsDataView,
+                 blink::WebDragOperationsMask> {
+  static bool allow_copy(const blink::WebDragOperationsMask& op_mask) {
+    return op_mask & blink::kWebDragOperationCopy;
+  }
+  static bool allow_link(const blink::WebDragOperationsMask& op_mask) {
+    return op_mask & blink::kWebDragOperationLink;
+  }
+  static bool allow_generic(const blink::WebDragOperationsMask& op_mask) {
+    return op_mask & blink::kWebDragOperationGeneric;
+  }
+  static bool allow_private(const blink::WebDragOperationsMask& op_mask) {
+    return op_mask & blink::kWebDragOperationPrivate;
+  }
+  static bool allow_move(const blink::WebDragOperationsMask& op_mask) {
+    return op_mask & blink::kWebDragOperationMove;
+  }
+  static bool allow_delete(const blink::WebDragOperationsMask& op_mask) {
+    return op_mask & blink::kWebDragOperationDelete;
+  }
+  static bool Read(blink::mojom::AllowedDragOperationsDataView data,
+                   blink::WebDragOperationsMask* out);
+};
+
+}  // namespace mojo
+
+#endif  // THIRD_PARTY_BLINK_PUBLIC_COMMON_PAGE_DRAG_MOJOM_TRAITS_H_
diff --git a/chromium/third_party/blink/public/web/web_print_scaling_option.h b/chromium/third_party/blink/public/common/page/web_drag_operation.h
index 044bde7bb86..d68944b89e6 100644
--- a/chromium/third_party/blink/public/web/web_print_scaling_option.h
+++ b/chromium/third_party/blink/public/common/page/web_drag_operation.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2012 Google Inc. All rights reserved.
+ * Copyright (C) 2009 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -28,26 +28,34 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef THIRD_PARTY_BLINK_PUBLIC_WEB_WEB_PRINT_SCALING_OPTION_H_
-#define THIRD_PARTY_BLINK_PUBLIC_WEB_WEB_PRINT_SCALING_OPTION_H_
+#ifndef THIRD_PARTY_BLINK_PUBLIC_COMMON_PAGE_WEB_DRAG_OPERATION_H_
+#define THIRD_PARTY_BLINK_PUBLIC_COMMON_PAGE_WEB_DRAG_OPERATION_H_
+
+#include <limits.h>
 
 namespace blink {
 
-enum WebPrintScalingOption {
-  kWebPrintScalingOptionNone,  // Prints the upper left of a page without
-                               // scaling. Crop the page contents that don't fit
-                               // on the paper.
-  kWebPrintScalingOptionFitToPrintableArea,  // Reduces or enlarges each page to
-                                             // fit the printable area of the
-                                             // selected printer paper size.
-  kWebPrintScalingOptionSourceSize,  // Print output page size is same as the
-                                     // actual source page size. Do not
-                                     // scale/center/fit to printable area.
-  kWebPrintScalingOptionFitToPaper,  // Reduces or enlarges each page to fit the
-                                     // selected printer paper size.
-  kWebPrintScalingOptionLast = kWebPrintScalingOptionFitToPaper
+// "Verb" of a drag-and-drop operation as negotiated between the source and
+// destination.
+// (These constants match their equivalents in WebCore's DragActions.h and
+// should not be renumbered.)
+// TODO(hferreiro): replace this enum and the corresponding one in
+// drag_actions.h with blink::mojom::DragOperation.
+enum WebDragOperation {
+  kWebDragOperationNone = 0,
+  kWebDragOperationCopy = 1,
+  kWebDragOperationLink = 2,
+  kWebDragOperationGeneric = 4,
+  kWebDragOperationPrivate = 8,
+  kWebDragOperationMove = 16,
+  kWebDragOperationDelete = 32,
+  kWebDragOperationEvery = UINT_MAX
 };
 
+// Alternate typedef to make it clear when this is being used as a mask
+// with potentially multiple value bits set.
+typedef WebDragOperation WebDragOperationsMask;
+
 }  // namespace blink
 
-#endif
+#endif  // THIRD_PARTY_BLINK_PUBLIC_COMMON_PAGE_WEB_DRAG_OPERATION_H_
diff --git a/chromium/third_party/blink/public/common/peerconnection/OWNERS b/chromium/third_party/blink/public/common/peerconnection/OWNERS
new file mode 100644
index 00000000000..7f69766290a
--- /dev/null
+++ b/chromium/third_party/blink/public/common/peerconnection/OWNERS
@@ -0,0 +1,6 @@
+file://third_party/blink/renderer/modules/peerconnection/OWNERS
+
+per-file *_mojom_traits*.*=set noparent
+per-file *_mojom_traits*.*=file://ipc/SECURITY_OWNERS
+per-file *.typemap=set noparent
+per-file *.typemap=file://ipc/SECURITY_OWNERS
diff --git a/chromium/third_party/blink/public/common/peerconnection/peer_connection_tracker.typemap b/chromium/third_party/blink/public/common/peerconnection/peer_connection_tracker.typemap
new file mode 100644
index 00000000000..4edd7c77949
--- /dev/null
+++ b/chromium/third_party/blink/public/common/peerconnection/peer_connection_tracker.typemap
@@ -0,0 +1,16 @@
+# Copyright 2020 The Chromium Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+mojom = "//third_party/blink/public/mojom/peerconnection/peer_connection_tracker.mojom"
+
+public_headers = [
+  "//base/power_monitor/power_observer.h",
+  "//third_party/blink/public/common/common_export.h",
+]
+
+traits_headers = [ "//third_party/blink/public/common/peerconnection/peer_connection_tracker_mojom_traits.h" ]
+
+type_mappings = [
+  "blink.mojom.DeviceThermalState=::base::PowerObserver::DeviceThermalState",
+]
diff --git a/chromium/third_party/blink/public/common/peerconnection/peer_connection_tracker_mojom_traits.h b/chromium/third_party/blink/public/common/peerconnection/peer_connection_tracker_mojom_traits.h
new file mode 100644
index 00000000000..12191955e1a
--- /dev/null
+++ b/chromium/third_party/blink/public/common/peerconnection/peer_connection_tracker_mojom_traits.h
@@ -0,0 +1,26 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef THIRD_PARTY_BLINK_PUBLIC_COMMON_PEERCONNECTION_PEER_CONNECTION_TRACKER_MOJOM_TRAITS_H_
+#define THIRD_PARTY_BLINK_PUBLIC_COMMON_PEERCONNECTION_PEER_CONNECTION_TRACKER_MOJOM_TRAITS_H_
+
+#include "base/power_monitor/power_observer.h"
+#include "third_party/blink/public/common/common_export.h"
+#include "third_party/blink/public/mojom/peerconnection/peer_connection_tracker.mojom.h"
+
+namespace mojo {
+
+template <>
+struct BLINK_COMMON_EXPORT EnumTraits<blink::mojom::DeviceThermalState,
+                                      base::PowerObserver::DeviceThermalState> {
+  static blink::mojom::DeviceThermalState ToMojom(
+      base::PowerObserver::DeviceThermalState type);
+
+  static bool FromMojom(blink::mojom::DeviceThermalState input,
+                        base::PowerObserver::DeviceThermalState* out);
+};
+
+}  // namespace mojo
+
+#endif  // THIRD_PARTY_BLINK_PUBLIC_COMMON_PEERCONNECTION_PEER_CONNECTION_TRACKER_MOJOM_TRAITS_H_
diff --git a/chromium/third_party/blink/public/common/privacy_budget/BUILD.gn b/chromium/third_party/blink/public/common/privacy_budget/BUILD.gn
new file mode 100644
index 00000000000..2f35bb930b1
--- /dev/null
+++ b/chromium/third_party/blink/public/common/privacy_budget/BUILD.gn
@@ -0,0 +1,34 @@
+# Copyright 2020 The Chromium Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+source_set("internal") {
+  sources = [ "identifiability_internal_templates.h" ]
+
+  visibility = [
+    ":*",
+    "//third_party/blink/common/privacy_budget:*",
+  ]
+}
+
+source_set("privacy_budget") {
+  sources = [
+    "identifiability_metric_builder.h",
+    "identifiability_metrics.h",
+    "identifiability_study_participation.h",
+    "identifiability_study_settings.h",
+    "identifiability_study_settings_provider.h",
+    "identifiable_surface.h",
+    "identifiable_token.h",
+    "identifiable_token_builder.h",
+  ]
+
+  deps = [
+    ":internal",
+    "//base",
+    "//services/metrics/public/cpp:metrics_cpp",
+    "//services/network/public/cpp:cpp",
+    "//third_party/blink/public/common:common_export",
+    "//third_party/blink/public/mojom:web_feature_mojo_bindings",
+  ]
+}
diff --git a/chromium/third_party/blink/public/common/privacy_budget/README.md b/chromium/third_party/blink/public/common/privacy_budget/README.md
new file mode 100644
index 00000000000..1fdb8d801e7
--- /dev/null
+++ b/chromium/third_party/blink/public/common/privacy_budget/README.md
@@ -0,0 +1,6 @@
+# Privacy Budget: Core Metrics and Aggregation
+
+See [Privacy Budget: Code
+Locations](../../../../../docs/privacy_budget_code_locations.md) for
+details.
+
diff --git a/chromium/third_party/blink/public/common/privacy_budget/identifiability_internal_templates.h b/chromium/third_party/blink/public/common/privacy_budget/identifiability_internal_templates.h
new file mode 100644
index 00000000000..db6915d7522
--- /dev/null
+++ b/chromium/third_party/blink/public/common/privacy_budget/identifiability_internal_templates.h
@@ -0,0 +1,77 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef THIRD_PARTY_BLINK_PUBLIC_COMMON_PRIVACY_BUDGET_IDENTIFIABILITY_INTERNAL_TEMPLATES_H_
+#define THIRD_PARTY_BLINK_PUBLIC_COMMON_PRIVACY_BUDGET_IDENTIFIABILITY_INTERNAL_TEMPLATES_H_
+
+#include <cstdint>
+#include <cstring>
+#include <type_traits>
+
+namespace blink {
+
+namespace internal {
+
+// Handroll a remove_cv_t until we get to C++20.
+template <typename T>
+using remove_cvref_t = typename std::remove_cv_t<std::remove_reference_t<T>>;
+
+// Kinda conservative implementation of
+// std::has_unique_object_representations<>. Perhaps not as conservative as we'd
+// like.
+//
+// At a minimum, this predicate should require that the data type not contain
+// internal padding since uninitialized padding bytes defeat the uniqueness of
+// the representation. Trailing padding is allowed.
+//
+// Not checking <version> because we don't want to use the feature
+// automatically. We should wait until C++-17 library functionality is
+// explicitly allowed in Chromium.
+template <typename T>
+using has_unique_object_representations = std::is_arithmetic<T>;
+
+// Calculate a digest of an object with a unique representation.
+//
+// In a perfect world, we should also require that this representation be
+// portable or made to be portable. Such a transformation could be done, for
+// example, by adopting a consistent byte ordering on all platforms.
+//
+// This function should only be invoked on a bare (sans qualifiers and
+// references) type for the sake of simplicity.
+//
+// Should not be used as a primitive for manually constructing a unique
+// representation. For such cases, use the byte-wise digest functions instead.
+//
+// Should not be used outside of the narrow use cases in this file.
+//
+// This implementation does not work for x86 extended precision floating point
+// numbers. These are 80-bits wide, but in practice includes 6 bytes of padding
+// in order to extend the size to 16 bytes. The extra bytes are uninitialized
+// and will not contribute a stable digest.
+template <
+    typename T,
+    typename std::enable_if_t<std::is_same<T, remove_cvref_t<T>>::value &&
+                              std::is_trivially_copyable<T>::value &&
+                              has_unique_object_representations<T>::value &&
+                              sizeof(T) <= sizeof(int64_t)>* = nullptr>
+constexpr int64_t DigestOfObjectRepresentation(T in) {
+  // If |in| is small enough, the digest is itself. There's no point hashing
+  // this value since the identity has all the properties we are looking for
+  // in a digest.
+  if (std::is_integral<T>::value && std::is_signed<T>::value)
+    return in;
+
+  if (std::is_integral<T>::value && sizeof(T) < sizeof(int64_t))
+    return in;
+
+  int64_t result = 0;
+  std::memcpy(&result, &in, sizeof(in));
+  return result;
+}
+
+}  // namespace internal
+
+}  // namespace blink
+
+#endif  // THIRD_PARTY_BLINK_PUBLIC_COMMON_PRIVACY_BUDGET_IDENTIFIABILITY_INTERNAL_TEMPLATES_H_
diff --git a/chromium/third_party/blink/public/common/privacy_budget/identifiability_metric_builder.h b/chromium/third_party/blink/public/common/privacy_budget/identifiability_metric_builder.h
index 47678eec244..dc2fcc09555 100644
--- a/chromium/third_party/blink/public/common/privacy_budget/identifiability_metric_builder.h
+++ b/chromium/third_party/blink/public/common/privacy_budget/identifiability_metric_builder.h
@@ -12,6 +12,7 @@
 #include "services/metrics/public/cpp/ukm_source_id.h"
 #include "third_party/blink/public/common/common_export.h"
 #include "third_party/blink/public/common/privacy_budget/identifiable_surface.h"
+#include "third_party/blink/public/common/privacy_budget/identifiable_token.h"
 #include "third_party/blink/public/mojom/web_feature/web_feature.mojom-forward.h"
 
 namespace blink {
@@ -112,16 +113,21 @@ class BLINK_COMMON_EXPORT IdentifiabilityMetricBuilder
 
   // Set the metric using a previously constructed |IdentifiableSurface|.
   IdentifiabilityMetricBuilder& Set(IdentifiableSurface surface,
-                                    int64_t result);
+                                    IdentifiableToken sample);
+
+  // Set the metric using and IdentifiableSurface::Type and an |input|.
+  IdentifiabilityMetricBuilder& Set(IdentifiableSurface::Type type,
+                                    uint64_t input,
+                                    IdentifiableToken sample);
 
   // Convenience method for recording the result of invoking a simple API
-  // surface with a UseCounter.
+  // surface with a |UseCounter|.
   IdentifiabilityMetricBuilder& SetWebfeature(mojom::WebFeature feature,
-                                              int64_t result) {
+                                              IdentifiableToken sample) {
     return Set(IdentifiableSurface::FromTypeAndInput(
                    IdentifiableSurface::Type::kWebFeature,
                    static_cast<uint64_t>(feature)),
-               result);
+               sample);
   }
 
   // Shadow the underlying Record() implementation until the upstream pipeline
diff --git a/chromium/third_party/blink/public/common/privacy_budget/identifiability_metrics.h b/chromium/third_party/blink/public/common/privacy_budget/identifiability_metrics.h
index 8c9c3387181..48ddca2ffc2 100644
--- a/chromium/third_party/blink/public/common/privacy_budget/identifiability_metrics.h
+++ b/chromium/third_party/blink/public/common/privacy_budget/identifiability_metrics.h
@@ -5,8 +5,7 @@
 #ifndef THIRD_PARTY_BLINK_PUBLIC_COMMON_PRIVACY_BUDGET_IDENTIFIABILITY_METRICS_H_
 #define THIRD_PARTY_BLINK_PUBLIC_COMMON_PRIVACY_BUDGET_IDENTIFIABILITY_METRICS_H_
 
-#include <stdint.h>
-
+#include <cstdint>
 #include <cstring>
 #include <type_traits>
 
@@ -15,9 +14,9 @@
 
 namespace blink {
 
-// DigestForMetrics, which is NOT a cryptographic hash function, takes a span of
-// bytes as input and calculates a digest that can be used with identifiability
-// metric reporting functions.
+// IdentifiabilityDigestOfBytes, which is NOT a cryptographic hash function,
+// takes a span of bytes as input and calculates a digest that can be used with
+// identifiability metric reporting functions.
 //
 // The returned digest ...:
 //
@@ -46,6 +45,9 @@ IdentifiabilityDigestOfBytes(base::span<const uint8_t> in);
 // IdentifiabilityDigestHelper(); such declarations should be made in a header
 // included before this header so that they can be used by the span and
 // parameter pack overloads of IdentifiabilityDigestHelper.
+//
+// TODO(asanka): Remove once callers have been migrated to
+// IdentifiabilityToken().
 
 // Integer version.
 template <typename T,
diff --git a/chromium/third_party/blink/public/common/privacy_budget/identifiability_study_participation.h b/chromium/third_party/blink/public/common/privacy_budget/identifiability_study_participation.h
index c6e41d6db7d..9732bef4af2 100644
--- a/chromium/third_party/blink/public/common/privacy_budget/identifiability_study_participation.h
+++ b/chromium/third_party/blink/public/common/privacy_budget/identifiability_study_participation.h
@@ -15,6 +15,8 @@ namespace blink {
 // This method can be used to avoid computation that is only needed for the
 // study, such as complex digest calculation on canvas operations; for UKM
 // reporting, filtering should happen automatically.
+//
+// TODO(asanka): Migrate callers to IdentifiabilityStudySettings.
 bool BLINK_COMMON_EXPORT IsUserInIdentifiabilityStudy();
 
 }  // namespace blink
diff --git a/chromium/third_party/blink/public/common/privacy_budget/identifiability_study_settings.h b/chromium/third_party/blink/public/common/privacy_budget/identifiability_study_settings.h
new file mode 100644
index 00000000000..3cf8a1872da
--- /dev/null
+++ b/chromium/third_party/blink/public/common/privacy_budget/identifiability_study_settings.h
@@ -0,0 +1,92 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef THIRD_PARTY_BLINK_PUBLIC_COMMON_PRIVACY_BUDGET_IDENTIFIABILITY_STUDY_SETTINGS_H_
+#define THIRD_PARTY_BLINK_PUBLIC_COMMON_PRIVACY_BUDGET_IDENTIFIABILITY_STUDY_SETTINGS_H_
+
+#include <memory>
+
+#include "third_party/blink/public/common/common_export.h"
+#include "third_party/blink/public/common/privacy_budget/identifiability_study_settings_provider.h"
+#include "third_party/blink/public/common/privacy_budget/identifiable_surface.h"
+
+namespace blink {
+
+// Determines whether the identifiability study is active and if so whether a
+// given surface or surface type should be sampled.
+//
+// This class can used from multiple threads and does not require
+// synchronization.
+//
+// See documentation on individual methods for notes on thread safety.
+class BLINK_COMMON_EXPORT IdentifiabilityStudySettings {
+ public:
+  // Constructs a default IdentifiabilityStudySettings instance. By default the
+  // settings instance acts as if the study is disabled, and implicitly as if
+  // all surfaces and types are blocked.
+  IdentifiabilityStudySettings();
+
+  // Constructs a IdentifiabilityStudySettings instance which reflects the state
+  // specified by |provider|.
+  explicit IdentifiabilityStudySettings(
+      std::unique_ptr<IdentifiabilityStudySettingsProvider> provider);
+
+  ~IdentifiabilityStudySettings();
+
+  // Get a pointer to an instance of IdentifiabilityStudySettings for the
+  // process.
+  //
+  // This method and the returned object is safe to use from any thread and is
+  // never destroyed.
+  //
+  // On the browser process, the returned instance is authoritative. On all
+  // other processes the returned instance should be considered advisory. It's
+  // only meant as an optimization to avoid calculating things unnecessarily.
+  static const IdentifiabilityStudySettings* Get();
+
+  // Initialize the process-wide settings instance with the specified settings
+  // provider. Should only be called once per process and only from the main
+  // thread.
+  //
+  // For testing, you can use ResetStateForTesting().
+  static void SetGlobalProvider(
+      std::unique_ptr<IdentifiabilityStudySettingsProvider> provider);
+
+  // Returns true if the study is active for this client. Once if it returns
+  // true, it doesn't return false at any point after. The converse is not true.
+  bool IsActive() const;
+
+  // Returns true if |surface| is allowed.
+  //
+  // Will always return false if IsActive() is false. I.e. If the study is
+  // inactive, all surfaces are considered to be blocked. Hence it is sufficient
+  // to call this function directly instead of calling IsActive() before it.
+  bool IsSurfaceAllowed(IdentifiableSurface surface) const;
+
+  // Returns true if |type| is allowed.
+  //
+  // Will always return false if IsActive() is false. I.e. If the study is
+  // inactive, all surface types are considered to be blocked. Hence it is
+  // sufficient to call this function directly instead of calling IsActive()
+  // before it.
+  bool IsTypeAllowed(IdentifiableSurface::Type type) const;
+
+  // Only used for testing. Resets internal state and violates API contracts
+  // made above about the lifetime of IdentifiabilityStudySettings*.
+  static void ResetStateForTesting();
+
+  IdentifiabilityStudySettings(IdentifiabilityStudySettings&&) = delete;
+  IdentifiabilityStudySettings(const IdentifiabilityStudySettings&) = delete;
+  IdentifiabilityStudySettings& operator=(const IdentifiabilityStudySettings&) =
+      delete;
+
+ private:
+  const std::unique_ptr<IdentifiabilityStudySettingsProvider> provider_;
+  const bool is_enabled_ = false;
+  const bool is_any_surface_or_type_blocked_ = false;
+};
+
+}  // namespace blink
+
+#endif  // THIRD_PARTY_BLINK_PUBLIC_COMMON_PRIVACY_BUDGET_IDENTIFIABILITY_STUDY_SETTINGS_H_
diff --git a/chromium/third_party/blink/public/common/privacy_budget/identifiability_study_settings_provider.h b/chromium/third_party/blink/public/common/privacy_budget/identifiability_study_settings_provider.h
new file mode 100644
index 00000000000..1aa41a66676
--- /dev/null
+++ b/chromium/third_party/blink/public/common/privacy_budget/identifiability_study_settings_provider.h
@@ -0,0 +1,42 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef THIRD_PARTY_BLINK_PUBLIC_COMMON_PRIVACY_BUDGET_IDENTIFIABILITY_STUDY_SETTINGS_PROVIDER_H_
+#define THIRD_PARTY_BLINK_PUBLIC_COMMON_PRIVACY_BUDGET_IDENTIFIABILITY_STUDY_SETTINGS_PROVIDER_H_
+
+#include "third_party/blink/public/common/common_export.h"
+#include "third_party/blink/public/common/privacy_budget/identifiable_surface.h"
+
+namespace blink {
+
+class BLINK_COMMON_EXPORT IdentifiabilityStudySettingsProvider {
+ public:
+  virtual ~IdentifiabilityStudySettingsProvider();
+
+  // Returns true if the identifiability study is active. For any specific
+  // instance of IdentifiabilityStudySettings, this answer cannot change. It
+  // will only be queried once.
+  virtual bool IsActive() const = 0;
+
+  // Returns true if any specific surface or type is blocked. Otherwise it is
+  // assumed that neither IsSurfaceBlocked() nor IsTypeBlocked() will ever
+  // return true for anything.
+  //
+  // Only meaningful if IsActive() returns true.
+  virtual bool IsAnyTypeOrSurfaceBlocked() const = 0;
+
+  // Returns true if the given surface should be sampled.
+  //
+  // If IsActive() is false, this method will not be called.
+  virtual bool IsSurfaceAllowed(IdentifiableSurface surface) const = 0;
+
+  // Returns true if the given surface type should be sampled.
+  //
+  // If IsActive() is false, this method will not be called.
+  virtual bool IsTypeAllowed(IdentifiableSurface::Type type) const = 0;
+};
+
+}  // namespace blink
+
+#endif  // THIRD_PARTY_BLINK_PUBLIC_COMMON_PRIVACY_BUDGET_IDENTIFIABILITY_STUDY_SETTINGS_PROVIDER_H_
diff --git a/chromium/third_party/blink/public/common/privacy_budget/identifiable_surface.h b/chromium/third_party/blink/public/common/privacy_budget/identifiable_surface.h
index 8e159b0885a..4f74660be5a 100644
--- a/chromium/third_party/blink/public/common/privacy_budget/identifiable_surface.h
+++ b/chromium/third_party/blink/public/common/privacy_budget/identifiable_surface.h
@@ -24,13 +24,28 @@ namespace blink {
 //   * Immutable.
 //   * Efficient enough to pass by value.
 //
+// Internally, an identifiable surface is represented as a 64-bit unsigned
+// integer that can be used as the metric hash for reporting metrics via UKM.
+//
+// The least-significant |kTypeBits| of the value is used to store
+// a IdentifiableSurface::Type value. The remainder stores the 56
+// least-significant bits of an IdentifiableToken.
 class IdentifiableSurface {
  public:
+  // Number of bits used by Type.
+  static constexpr int kTypeBits = 8;
+
+  // Bitmask for extracting Type value from a surface hash.
+  static constexpr uint64_t kTypeMask = (1 << kTypeBits) - 1;
+
+  // Indicator for an uninitialized IdentifiableSurface. Maps to
+  // {Type::kReservedInternal, 0} which is not possible for a valid surface.
+  static constexpr uint64_t kInvalidHash = 0;
+
   // Type of identifiable surface.
   //
   // Even though the data type is uint64_t, we can only use 8 bits due to how we
-  // pack the surface type and a digest of the input into a 64 bits. See
-  // README.md in this directory for details on encoding.
+  // pack the surface type and a digest of the input into a 64 bits.
   //
   // These values are used for aggregation across versions. Entries should not
   // be renumbered and numeric values should never be reused.
@@ -47,9 +62,12 @@ class IdentifiableSurface {
     kCanvasReadback = 2,
 
     // We can use values up to and including |kMax|.
-    kMax = 0xff
+    kMax = (1 << kTypeBits) - 1
   };
 
+  // Default constructor is invalid.
+  IdentifiableSurface() : IdentifiableSurface(kInvalidHash) {}
+
   // Construct an IdentifiableSurface based on a precalculated metric hash. Can
   // also be used as the first step in decoding an encoded metric hash.
   static constexpr IdentifiableSurface FromMetricHash(uint64_t metric_hash) {
@@ -62,6 +80,11 @@ class IdentifiableSurface {
     return IdentifiableSurface(KeyFromSurfaceTypeAndInput(type, input));
   }
 
+  // Construct an invalid identifiable surface.
+  static constexpr IdentifiableSurface Invalid() {
+    return IdentifiableSurface(kInvalidHash);
+  }
+
   // Returns the UKM metric hash corresponding to this IdentifiableSurface.
   constexpr uint64_t ToUkmMetricHash() const { return metric_hash_; }
 
@@ -79,7 +102,12 @@ class IdentifiableSurface {
     return std::get<1>(SurfaceTypeAndInputFromMetricKey(metric_hash_));
   }
 
+  constexpr bool IsValid() const { return metric_hash_ != kInvalidHash; }
+
  private:
+  constexpr explicit IdentifiableSurface(uint64_t metric_hash)
+      : metric_hash_(metric_hash) {}
+
   // Returns a 64-bit metric key given an IdentifiableSurfaceType and a 64 bit
   // input digest.
   //
@@ -88,7 +116,7 @@ class IdentifiableSurface {
   static constexpr uint64_t KeyFromSurfaceTypeAndInput(Type type,
                                                        uint64_t input) {
     uint64_t type_as_int = static_cast<uint64_t>(type);
-    return type_as_int | (input << 8);
+    return type_as_int | (input << kTypeBits);
   }
 
   // Returns the IdentifiableSurfaceType and the input hash given a metric key.
@@ -98,12 +126,10 @@ class IdentifiableSurface {
   // from that used to construct this IdentifiableSurface.
   static constexpr std::tuple<Type, uint64_t> SurfaceTypeAndInputFromMetricKey(
       uint64_t metric) {
-    return std::make_tuple(static_cast<Type>(metric & 0xff), metric >> 8);
+    return std::make_tuple(static_cast<Type>(metric & kTypeMask),
+                           metric >> kTypeBits);
   }
 
- private:
-  constexpr explicit IdentifiableSurface(uint64_t metric_hash)
-      : metric_hash_(metric_hash) {}
   uint64_t metric_hash_;
 };
 
@@ -112,6 +138,21 @@ constexpr bool operator<(const IdentifiableSurface& left,
   return left.ToUkmMetricHash() < right.ToUkmMetricHash();
 }
 
+constexpr bool operator<=(const IdentifiableSurface& left,
+                          const IdentifiableSurface& right) {
+  return left.ToUkmMetricHash() <= right.ToUkmMetricHash();
+}
+
+constexpr bool operator>(const IdentifiableSurface& left,
+                         const IdentifiableSurface& right) {
+  return left.ToUkmMetricHash() > right.ToUkmMetricHash();
+}
+
+constexpr bool operator>=(const IdentifiableSurface& left,
+                          const IdentifiableSurface& right) {
+  return left.ToUkmMetricHash() >= right.ToUkmMetricHash();
+}
+
 constexpr bool operator==(const IdentifiableSurface& left,
                           const IdentifiableSurface& right) {
   return left.ToUkmMetricHash() == right.ToUkmMetricHash();
@@ -129,6 +170,14 @@ struct IdentifiableSurfaceHash {
   }
 };
 
+// Compare function compatible with std::less
+struct IdentifiableSurfaceCompLess {
+  bool operator()(const IdentifiableSurface& lhs,
+                  const IdentifiableSurface& rhs) const {
+    return lhs.ToUkmMetricHash() < rhs.ToUkmMetricHash();
+  }
+};
+
 }  // namespace blink
 
 #endif  // THIRD_PARTY_BLINK_PUBLIC_COMMON_PRIVACY_BUDGET_IDENTIFIABLE_SURFACE_H_
diff --git a/chromium/third_party/blink/public/common/privacy_budget/identifiable_token.h b/chromium/third_party/blink/public/common/privacy_budget/identifiable_token.h
new file mode 100644
index 00000000000..9c4b39250cc
--- /dev/null
+++ b/chromium/third_party/blink/public/common/privacy_budget/identifiable_token.h
@@ -0,0 +1,229 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef THIRD_PARTY_BLINK_PUBLIC_COMMON_PRIVACY_BUDGET_IDENTIFIABLE_TOKEN_H_
+#define THIRD_PARTY_BLINK_PUBLIC_COMMON_PRIVACY_BUDGET_IDENTIFIABLE_TOKEN_H_
+
+#include <cstdint>
+#include <type_traits>
+
+#include "base/containers/span.h"
+#include "base/numerics/safe_conversions.h"
+#include "base/strings/string_piece.h"
+#include "third_party/blink/public/common/privacy_budget/identifiability_internal_templates.h"
+#include "third_party/blink/public/common/privacy_budget/identifiability_metrics.h"
+
+namespace blink {
+
+// Constructs a token that can be used for reporting a metric or constructing an
+// identifiable surface.
+//
+// The token construction is a single step conversion that takes one of several
+// constrained inputs and emits a value. The method by which the value is
+// constructed intentionally cannot be chained. If such behavior is required,
+// then this class should be modified to accommodate the new use case rather
+// than implementing custom chaining schemes at call sites.
+//
+// Once constructed, a token can only be consumed by
+// IdentifiabiltyMetricsBuilder and IdentifiableSurface. For all others, it is a
+// copyable, opaque token.
+//
+// Reliance on implicit conversion imposes limitations on how
+// IdentifiableToken class is to be used. For example the following works:
+//
+//     std::string foo = ....;
+//     IdentifiableToken sample(foo);
+//
+// .. due to the following implicit conversion:
+//
+//    1. std::string -> const std::string&
+//             : lvalue -> lvalue reference + cv-qualification
+//    2. const std::string& -> base::StringPiece
+//             : user-defined conversion via constructor
+//               base::StringPiece(const std::string&)
+//
+// However, when used within a builder expression, the user-defined conversion
+// doesn't occur due to there not being a single user defined conversion from
+// std::string -> IdentifiableToken. I.e. the following does not work:
+//
+//     std::string foo = ....;
+//     IdentifiabilityMetricBuilder(...).Set(surface, foo);
+//                                                    ^^^
+//      The compiler can't deduce a two step user-defined conversion for |foo|.
+//
+// All overrides of the constructor should ensure that there exists a unique
+// representation of the data type being sampled, and that the sample value is
+// constructed based on this unique representation.
+//
+// TODO(asanka): Also require that the representation be portable.
+//
+// Extending IdentifiableToken to support more data types:
+// -----------------------------------------------------------
+//
+// This class is intentionally placed in blink/public/common due to the
+// requirement that these primitives be made available to both the renderer and
+// the browser. However, it would be desirable to have renderer or browser
+// specific functions for mapping common types in either domain into a sample.
+//
+// The recommended methods to do so are (one-of):
+//
+//   1. Use an existing byte span representation.
+//
+//      E.g.: Assuming |v| is a WTF::Vector
+//          IdentifiabilityMetricBuilder(...).Set(...,
+//              base::as_bytes(base::make_span(v.Data(), v.Size())));
+//
+//      Note again that serializing to a stream of bytes may not be sufficient
+//      if the underlying types don't have a unique representation.
+//
+//   2. Construct a byte-wise unique representation and invoke
+//      IdentifiableToken(ByteSpan) either explicitly or implicitly via
+//      user-defined conversions.
+//
+// Note: Avoid doing template magic. There's already too much here. Templates
+//       make it difficult to verify that the correct stable representation is
+//       the one getting ingested into the reporting workflow.
+//
+//       Instead, explicitly invoke some wrapper that emits a ByteSpan (a.k.a.
+//       base::span<const uint8_t>.
+class IdentifiableToken {
+ public:
+  // Generic buffer of bytes.
+  using ByteSpan = base::span<const uint8_t>;
+
+  // Representation type of the sample.
+  using TokenType = int64_t;
+
+  // A byte buffer specified as a span.
+  //
+  // This is essentially the base case. If it were the base case, then
+  // IdentifiableToken would be closer to a proper digest.
+  //
+  // NOLINTNEXTLINE(google-explicit-constructor)
+  IdentifiableToken(ByteSpan span)
+      : value_(IdentifiabilityDigestOfBytes(span)) {}
+
+  // Integers, big and small. Includes char.
+  template <typename T,
+            typename U = internal::remove_cvref_t<T>,
+            typename std::enable_if_t<std::is_integral<U>::value>* = nullptr>
+  constexpr IdentifiableToken(T in)  // NOLINT(google-explicit-constructor)
+      : value_(base::IsValueInRangeForNumericType<TokenType, U>(in)
+                   ? in
+                   : internal::DigestOfObjectRepresentation<U>(in)) {}
+
+  // Enums. Punt to the underlying type.
+  template <typename T,
+            typename U = typename std::underlying_type<T>::type,
+            typename std::enable_if_t<std::is_enum<T>::value>* = nullptr>
+  constexpr IdentifiableToken(T in)  // NOLINT(google-explicit-constructor)
+      : IdentifiableToken(static_cast<U>(in)) {}
+
+  // All floating point values get converted to double before encoding.
+  //
+  // Why? We'd like to minimize accidental divergence of values due to the data
+  // type that the callsite happened to be using at the time.
+  //
+  // On some platforms sizeof(long double) gives us 16 (i.e. 128 bits), while
+  // only 10 of those bytes are initialized. If the whole sizeof(long double)
+  // buffer were to be ingested, then the uninitialized memory will cause the
+  // resulting digest to be useless.
+  template <
+      typename T,
+      typename U = internal::remove_cvref_t<T>,
+      typename std::enable_if_t<std::is_floating_point<U>::value>* = nullptr>
+  constexpr IdentifiableToken(T in)  // NOLINT(google-explicit-constructor)
+      : value_(internal::DigestOfObjectRepresentation<double>(
+            static_cast<double>(in))) {}
+
+  // StringPiece. Decays to base::span<> but requires an explicit constructor
+  // invocation.
+  //
+  // Care must be taken when using string types with IdentifiableToken() since
+  // there's not privacy expectation in the resulting token value. If the string
+  // used as an input is privacy sensitive, it should not be passed in as-is.
+  explicit IdentifiableToken(base::StringPiece s)
+      : IdentifiableToken(base::as_bytes(base::make_span(s))) {
+    // The cart is before the horse, but it's a static_assert<>.
+    static_assert(
+        std::is_same<ByteSpan,
+                     decltype(base::as_bytes(base::make_span(s)))>::value,
+        "base::as_bytes() doesn't return ByteSpan");
+  }
+
+  // Span of known trivial types except for BytesSpan, which is the base case.
+  template <typename T,
+            size_t Extent,
+            typename U = internal::remove_cvref_t<T>,
+            typename std::enable_if_t<
+                std::is_arithmetic<U>::value &&
+                !std::is_same<ByteSpan::element_type, T>::value>* = nullptr>
+  // NOLINTNEXTLINE(google-explicit-constructor)
+  IdentifiableToken(base::span<T, Extent> span)
+      : IdentifiableToken(base::as_bytes(span)) {}
+
+  // A span of non-trivial things where each thing can be digested individually.
+  template <typename T,
+            size_t Extent,
+            typename std::enable_if_t<
+                !std::is_arithmetic<T>::value &&
+                !std::is_same<ByteSpan::element_type, T>::value>* = nullptr>
+  // NOLINTNEXTLINE(google-explicit-constructor)
+  IdentifiableToken(base::span<T, Extent> span) {
+    TokenType cur_digest = 0;
+    for (const auto& element : span) {
+      TokenType digests[2];
+      digests[0] = cur_digest;
+      digests[1] = IdentifiableToken(element).value_;
+      cur_digest = IdentifiabilityDigestOfBytes(
+          base::as_bytes(base::make_span(digests)));
+    }
+    value_ = cur_digest;
+  }
+
+  // Parameter pack where each parameter can be digested individually. Requires
+  // at least two parameters.
+  template <typename T1, typename T2, typename... Trest>
+  constexpr IdentifiableToken(T1 first, T2 second, Trest... rest) {
+    TokenType samples[] = {IdentifiableToken(first).value_,
+                           IdentifiableToken(second).value_,
+                           (IdentifiableToken(rest).value_)...};
+    value_ = IdentifiableToken(base::make_span(samples)).value_;
+  }
+
+  constexpr bool operator<(const IdentifiableToken& that) const {
+    return value_ < that.value_;
+  }
+
+  constexpr bool operator<=(const IdentifiableToken& that) const {
+    return value_ <= that.value_;
+  }
+
+  constexpr bool operator>(const IdentifiableToken& that) const {
+    return value_ > that.value_;
+  }
+
+  constexpr bool operator>=(const IdentifiableToken& that) const {
+    return value_ >= that.value_;
+  }
+
+  constexpr bool operator==(const IdentifiableToken& that) const {
+    return value_ == that.value_;
+  }
+
+  constexpr bool operator!=(const IdentifiableToken& that) const {
+    return value_ != that.value_;
+  }
+
+ private:
+  friend class IdentifiabilityMetricBuilder;
+  friend class IdentifiableSurface;
+
+  // TODO(asanka): This should be const. Switch over once the incremental digest
+  // functions land.
+  TokenType value_ = 0;
+};
+
+}  // namespace blink
+#endif  // THIRD_PARTY_BLINK_PUBLIC_COMMON_PRIVACY_BUDGET_IDENTIFIABLE_TOKEN_H_
diff --git a/chromium/third_party/blink/public/common/privacy_budget/identifiable_token_builder.h b/chromium/third_party/blink/public/common/privacy_budget/identifiable_token_builder.h
new file mode 100644
index 00000000000..616dc7f51f3
--- /dev/null
+++ b/chromium/third_party/blink/public/common/privacy_budget/identifiable_token_builder.h
@@ -0,0 +1,185 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef THIRD_PARTY_BLINK_PUBLIC_COMMON_PRIVACY_BUDGET_IDENTIFIABLE_TOKEN_BUILDER_H_
+#define THIRD_PARTY_BLINK_PUBLIC_COMMON_PRIVACY_BUDGET_IDENTIFIABLE_TOKEN_BUILDER_H_
+
+#include "base/containers/span.h"
+#include "base/sys_byteorder.h"
+#include "third_party/blink/public/common/common_export.h"
+#include "third_party/blink/public/common/privacy_budget/identifiability_internal_templates.h"
+#include "third_party/blink/public/common/privacy_budget/identifiable_token.h"
+
+namespace blink {
+
+// Builds an IdentifiableToken incrementally.
+//
+// Use this when the input to a sample is a bunch of disjoint objects, or the
+// sample needs to include objects that are incrementally encountered.
+//
+// Notes:
+//   * The digest returned by this class is *NOT* the same as the one
+//     IdentifiabilityDigestOfBytes for the same set of bytes. This is due to
+//     block based chaining of digests used by this class.
+//     IdentifiabilityDigestOfBytes and this class are *NOT* interchangeable.
+//
+//     TODO(asanka): IdentifiabilityDigestOfBytes() and this class should
+//     interop better. Perhaps by making the latter use the former.
+//
+//   * The digest returned by this class is *NOT* the same as what you would
+//     acquire by invoking IdentifiableToken() over the same object.
+//     IdentifiableToken() and this class are *NOT* interchangeable.
+//
+//   * The digest returned by this class only depends on the cumulative sequence
+//     of bytes that are fed to it. The partitioning thereof is irrelevant.
+//
+//   * This object never finalizes. Partial digests can be extracted at any
+//     point.
+class BLINK_COMMON_EXPORT IdentifiableTokenBuilder {
+ public:
+  // Convenient alias for a span of const uint8_t.
+  using ByteBuffer = base::span<const uint8_t>;
+
+  // Initializes an "empty" incremental digest for the purpose of constructing
+  // an identifiability sample.
+  IdentifiableTokenBuilder();
+
+  // Initializes an incremental digest and populates it with the data contained
+  // in |message|.
+  explicit IdentifiableTokenBuilder(ByteBuffer message);
+
+  // Copies the intermediate state.
+  IdentifiableTokenBuilder(const IdentifiableTokenBuilder&);
+
+  // Feeds data contained in |buffer| to the digest.
+  IdentifiableTokenBuilder& AddBytes(ByteBuffer buffer);
+
+  // Feeds data contained in |buffer| to the digest, but precedes the buffer
+  // contents with an integer indicating the length. Use this when:
+  //
+  //   * |buffer| is atomic. I.e. it will always be added as a single buffer.
+  //
+  //   * The boundary between |buffer| and adjacent objects cannot be uniquely
+  //     established based on content.
+  //
+  // E.g.: Ignoring NUL terminators, the pair of strings "abcd", "efgh" will be
+  //       assigned token as the strings "abcdefg", "h" if both are added
+  //       individually via AddBytes(). But they will have distinct digests if
+  //       added via AddAtomic().
+  //
+  // If the contents of the object cannot be specified in a contiguous span of
+  // memory, then consider adding a length directly via AddValue() prior to
+  // adding the contents of the buffer. Doing so will achieve the same ends as
+  // AddAtomic().
+  IdentifiableTokenBuilder& AddAtomic(ByteBuffer buffer);
+
+  // Helper for feeding primitive types by value efficiently. Anything more
+  // complicated than that should be passed in as a base::span<const uint8_t>.
+  //
+  // Adds eight bytes to the digest. If the type of the value doesn't consume
+  // all of the bytes, pads the remainder with NUL bytes.
+  template <typename T,
+            typename std::enable_if_t<
+                std::is_same<T, internal::remove_cvref_t<T>>::value &&
+                internal::has_unique_object_representations<T>::value &&
+                sizeof(T) <= sizeof(uint64_t)>* = nullptr>
+  IdentifiableTokenBuilder& AddValue(T in) {
+    AlignPartialBuffer();
+    int64_t clean_buffer =
+        base::ByteSwapToLE64(internal::DigestOfObjectRepresentation(in));
+    return AddBytes(base::make_span(
+        reinterpret_cast<const uint8_t*>(&clean_buffer), sizeof(clean_buffer)));
+  }
+
+  // Conversion operator captures an intermediate digest.
+  //
+  // The sample captures all the data that's been fed into the digest so far,
+  // but doesn't finalize the digest. It is valid to continue adding data after
+  // constructing an intermediate sample.
+  //
+  // (google-explicit-constructor also flags user-defined conversion operators.)
+  // NOLINTNEXTLINE(google-explicit-constructor)
+  operator IdentifiableToken() const;
+
+  // Captures an intermediate digest.
+  //
+  // The sample captures all the data that's been fed into the digest so far,
+  // but doesn't finalize the digest. It is valid to continue adding data after
+  // constructing an intermediate sample.
+  IdentifiableToken GetToken() const;
+
+  // No comparisons.
+  bool operator==(const IdentifiableTokenBuilder&) const = delete;
+  bool operator<(const IdentifiableTokenBuilder&) const = delete;
+
+ private:
+  // Block size. Must be a multiple of 64. Higher block sizes consume more
+  // memory. The extra cost is unlikely to be worth it.
+  //
+  // Under the covers we use CityHash64. It can pretty efficiently digest
+  // 64-byte blocks.
+  static constexpr size_t kBlockSizeInBytes = 64;
+
+  // Target alignment for new buffers. This is set to 8 for all platforms and
+  // must always stay constant across platforms.
+  static constexpr size_t kBlockAlignment = 8;
+
+  // A span of exactly |kBlockSizeInBytes| bytes.
+  using FullBlock = base::span<const uint8_t, kBlockSizeInBytes>;
+
+  // Returns true if the partial buffer is aligned on |kBlockAlignment|
+  // boundary.
+  bool IsAligned() const { return partial_size_ % kBlockAlignment == 0; }
+
+  // Appends enough NUL bytes to |partial_| until the next insertion point is
+  // aligned on a |kBlockAlignment| boundary.
+  //
+  // If the partial buffer is non-empty, its size is unlikely to be aligned at
+  // machine word boundary. This makes subsequent append operations slow for
+  // data types that are already aligned.
+  //
+  // This should only be called prior to adding an atomic buffer.
+  void AlignPartialBuffer();
+
+  // Captures the |kBlockSizeInBytes| bytes of data in |block| into the digest.
+  // |block| must be exactly this many bytes.
+  void DigestBlock(FullBlock block);
+
+  // Captures as many bytes as possible from |message| into the partial block in
+  // |partial_|. It captures a maximum of |kBlockSizeInBytes - 1| bytes.
+  //
+  // Returns a span covering the remainder of |message| that was not consumed.
+  ByteBuffer SkimIntoPartial(ByteBuffer message);
+
+  // Returns a span for the contents of the partial block.
+  //
+  // Can be called at any point. Does not change the state of the partial
+  // buffer.
+  ByteBuffer GetPartialBlock() const {
+    return base::make_span(&partial_[0], partial_size_);
+  }
+
+  // Returns a span that includes the contents of the partial block and backed
+  // by |partial_|.
+  //
+  // NOTE: Should only be called once |kBlockSizeInBytes| bytes have been
+  // accumulated. Resets |partial_size_| upon completion.
+  //
+  // NOTE: Any subsequent AddBytes(), AddValue(), AddAtomic() calls will
+  // invalidate the returned FullBlock.
+  FullBlock TakeCompletedBlock();
+
+  // Accumulates smaller pieces of data until we have a full block.
+  alignas(int64_t) uint8_t partial_[kBlockSizeInBytes];
+
+  // Count of bytes in |partial_|.
+  size_t partial_size_;
+
+  // Merkle-Damgård chaining.
+  uint64_t chaining_value_;
+};
+
+}  // namespace blink
+
+#endif  // THIRD_PARTY_BLINK_PUBLIC_COMMON_PRIVACY_BUDGET_IDENTIFIABLE_TOKEN_BUILDER_H_
diff --git a/chromium/third_party/blink/public/common/scheduler/web_scheduler_tracked_feature.h b/chromium/third_party/blink/public/common/scheduler/web_scheduler_tracked_feature.h
index 80d7addbfde..0816f730a63 100644
--- a/chromium/third_party/blink/public/common/scheduler/web_scheduler_tracked_feature.h
+++ b/chromium/third_party/blink/public/common/scheduler/web_scheduler_tracked_feature.h
@@ -88,9 +88,15 @@ enum class WebSchedulerTrackedFeature {
   kPrinting = 43,
   kWebDatabase = 44,
   kPictureInPicture = 45,
+  kPortal = 46,
+  kSpeechRecognizer = 47,
+  kIdleManager = 48,
+  kPaymentManager = 49,
+  kSpeechSynthesis = 50,
+  kKeyboardLock = 51,
 
   // NB: This enum is used in a bitmask, so kMaxValue must be less than 64.
-  kMaxValue = kPictureInPicture
+  kMaxValue = kKeyboardLock
 };
 
 static_assert(static_cast<uint32_t>(WebSchedulerTrackedFeature::kMaxValue) < 64,
diff --git a/chromium/third_party/blink/public/common/switches.h b/chromium/third_party/blink/public/common/switches.h
index fa70aa81117..12c6799b214 100644
--- a/chromium/third_party/blink/public/common/switches.h
+++ b/chromium/third_party/blink/public/common/switches.h
@@ -14,6 +14,31 @@ namespace switches {
 
 // All switches in alphabetical order. The switches should be documented
 // alongside the definition of their values in the .cc file.
+BLINK_COMMON_EXPORT extern const char kAllowPreCommitInput[];
+BLINK_COMMON_EXPORT extern const char kDefaultTileWidth[];
+BLINK_COMMON_EXPORT extern const char kDefaultTileHeight[];
+BLINK_COMMON_EXPORT extern const char kDisableImageAnimationResync[];
+BLINK_COMMON_EXPORT extern const char kDisableLowResTiling[];
+BLINK_COMMON_EXPORT extern const char kDisablePartialRaster[];
+BLINK_COMMON_EXPORT extern const char kDisableRGBA4444Textures[];
+BLINK_COMMON_EXPORT extern const char kDisableZeroCopy[];
+BLINK_COMMON_EXPORT extern const char
+    kEnableGpuMemoryBufferCompositorResources[];
+BLINK_COMMON_EXPORT extern const char kEnableLowResTiling[];
+BLINK_COMMON_EXPORT extern const char kEnableRGBA4444Textures[];
+BLINK_COMMON_EXPORT extern const char kEnableZeroCopy[];
+BLINK_COMMON_EXPORT extern const char kGpuRasterizationMSAASampleCount[];
+BLINK_COMMON_EXPORT extern const char kIntensiveWakeUpThrottlingPolicy[];
+BLINK_COMMON_EXPORT extern const char
+    kIntensiveWakeUpThrottlingPolicy_ForceDisable[];
+BLINK_COMMON_EXPORT extern const char
+    kIntensiveWakeUpThrottlingPolicy_ForceEnable[];
+BLINK_COMMON_EXPORT extern const char kMaxUntiledLayerHeight[];
+BLINK_COMMON_EXPORT extern const char kMaxUntiledLayerWidth[];
+BLINK_COMMON_EXPORT extern const char kMinHeightForGpuRasterTile[];
+BLINK_COMMON_EXPORT extern const char kShowLayoutShiftRegions[];
+BLINK_COMMON_EXPORT extern const char kShowPaintRects[];
+
 BLINK_COMMON_EXPORT extern const char kUserAgentClientHintDisable[];
 }  // namespace switches
 }  // namespace blink
diff --git a/chromium/third_party/blink/public/devtools_protocol/browser_protocol.pdl b/chromium/third_party/blink/public/devtools_protocol/browser_protocol.pdl
index 61c1ccfb667..a566425ac93 100644
--- a/chromium/third_party/blink/public/devtools_protocol/browser_protocol.pdl
+++ b/chromium/third_party/blink/public/devtools_protocol/browser_protocol.pdl
@@ -558,6 +558,45 @@ experimental domain Audits
       # Optional because not every mixed content issue is necessarily linked to a frame.
       optional AffectedFrame frame
 
+  # Enum indicating the reason a response has been blocked. These reasons are
+  # refinements of the net error BLOCKED_BY_RESPONSE.
+  type BlockedByResponseReason extends string
+    enum
+      CoepFrameResourceNeedsCoepHeader
+      CoopSandboxedIFrameCannotNavigateToCoopPage
+      CorpNotSameOrigin
+      CorpNotSameOriginAfterDefaultedToSameOriginByCoep
+      CorpNotSameSite
+
+  # Details for a request that has been blocked with the BLOCKED_BY_RESPONSE
+  # code. Currently only used for COEP/COOP, but may be extended to include
+  # some CSP errors in the future.
+  type BlockedByResponseIssueDetails extends object
+    properties
+      AffectedRequest request
+      optional AffectedFrame frame
+      BlockedByResponseReason reason
+
+  type HeavyAdResolutionStatus extends string
+    enum
+      HeavyAdBlocked
+      HeavyAdWarning
+
+  type HeavyAdReason extends string
+    enum
+      NetworkTotalLimit
+      CpuTotalLimit
+      CpuPeakLimit
+
+  type HeavyAdIssueDetails extends object
+    properties
+      # The resolution status, either blocking the content or warning.
+      HeavyAdResolutionStatus resolution
+      # The reason the ad was blocked, total network or cpu or peak cpu.
+      HeavyAdReason reason
+      # The frame that was blocked.
+      AffectedFrame frame
+
   # A unique identifier for the type of issue. Each type may use one of the
   # optional fields in InspectorIssueDetails to convey more specific
   # information about the kind of issue.
@@ -565,6 +604,8 @@ experimental domain Audits
     enum
       SameSiteCookieIssue
       MixedContentIssue
+      BlockedByResponseIssue
+      HeavyAdIssue
 
   # This struct holds a list of optional fields with additional information
   # specific to the kind of issue. When adding a new issue code, please also
@@ -573,6 +614,8 @@ experimental domain Audits
     properties
       optional SameSiteCookieIssueDetails sameSiteCookieIssueDetails
       optional MixedContentIssueDetails mixedContentIssueDetails
+      optional BlockedByResponseIssueDetails blockedByResponseIssueDetails
+      optional HeavyAdIssueDetails heavyAdIssueDetails
 
   # An inspector issue reported from the back-end.
   type InspectorIssue extends object
@@ -1003,6 +1046,11 @@ experimental domain CSS
       # Whether this stylesheet is created for STYLE tag by parser. This flag is not set for
       # document.written STYLE tags.
       boolean isInline
+      # Whether this stylesheet is mutable. Inline stylesheets become mutable
+      # after they have been modified via CSSOM API.
+      # <link> element's stylesheets are never mutable. Constructed stylesheets
+      # (new CSSStyleSheet()) are mutable immediately after creation.
+      boolean isMutable
       # Line offset of the stylesheet within the resource (zero based).
       number startLine
       # Column offset of the stylesheet within the resource (zero based).
@@ -3475,6 +3523,10 @@ domain Input
       # Whether the event was from the left or right side of the keyboard. 1=Left, 2=Right (default:
       # 0).
       optional integer location
+      # Editing commands to send with the key event (e.g., 'selectAll') (default: []).
+      # These are related to but not equal the command names used in `document.execCommand` and NSStandardKeyBindingResponding.
+      # See https://source.chromium.org/chromium/chromium/src/+/master:third_party/blink/renderer/core/editing/commands/editor_command_names.h for valid command names.
+      experimental optional array of string commands
 
   # This method emulates inserting text that doesn't come from a key press,
   # for example an emoji keyboard or an IME.
@@ -4118,6 +4170,10 @@ domain Network
       experimental number workerStart
       # Finished Starting ServiceWorker.
       experimental number workerReady
+      # Started fetch event.
+      experimental number workerFetchStart
+      # Settled fetch event respondWith promise.
+      experimental number workerRespondWithSettled
       # Started sending request.
       number sendStart
       # Finished sending request.
@@ -4244,6 +4300,14 @@ domain Network
       corp-not-same-origin-after-defaulted-to-same-origin-by-coep
       corp-not-same-site
 
+  # Source of serviceworker response.
+  type ServiceWorkerResponseSource extends string
+    enum
+      cache-storage
+      http-cache
+      fallback-code
+      network
+
   # HTTP response data.
   type Response extends object
     properties
@@ -4281,6 +4345,12 @@ domain Network
       number encodedDataLength
       # Timing information for the given request.
       optional ResourceTiming timing
+      # Response source of response from ServiceWorker.
+      optional ServiceWorkerResponseSource serviceWorkerResponseSource
+      # The time at which the returned response was generated.
+      optional TimeSinceEpoch responseTime
+      # Cache Storage Cache Name.
+      optional string cacheStorageCacheName
       # Protocol used to fetch this request.
       optional string protocol
       # Security state of the request resource.
@@ -5145,6 +5215,10 @@ experimental domain Overlay
     properties
       # Whether the extension lines from grid cells to the rulers should be shown (default: false).
       optional boolean showGridExtensionLines
+      # Show Positive line number labels (default: false).
+      optional boolean showPositiveLineNumbers
+      # Show Negative line number labels (default: false).
+      optional boolean showNegativeLineNumbers
       # The grid container border highlight color (default: transparent).
       optional DOM.RGBA gridBorderColor
       # The cell border color (default: transparent).
@@ -5171,6 +5245,8 @@ experimental domain Overlay
       optional boolean showStyles
       # Whether the rulers should be shown (default: false).
       optional boolean showRulers
+      # Whether the a11y info should be shown (default: true).
+      optional boolean showAccessibilityInfo
       # Whether the extension lines from node to the rulers should be shown (default: false).
       optional boolean showExtensionLines
       # The content box highlight fill color (default: transparent).
@@ -5233,8 +5309,10 @@ experimental domain Overlay
       optional boolean includeDistance
       # Whether to include style info.
       optional boolean includeStyle
-      # The color format to get config with (default: hex)
+      # The color format to get config with (default: hex).
       optional ColorFormat colorFormat
+      # Whether to show accessibility info (default: true).
+      optional boolean showAccessibilityInfo
     returns
       # Highlight data for the node.
       object highlight
@@ -7035,6 +7113,11 @@ domain Target
     parameters
       # If specified, disposes this context when debugging session disconnects.
       optional boolean disposeOnDetach
+      # Proxy server, similar to the one passed to --proxy-server
+      optional string proxyServer
+      # Proxy bypass list, similar to the one passed to --proxy-bypass-list
+      optional string proxyBypassList
+
     returns
       # The id of the context created.
       Browser.BrowserContextID browserContextId
diff --git a/chromium/third_party/blink/public/mojom/BUILD.gn b/chromium/third_party/blink/public/mojom/BUILD.gn
index 01bab750f63..0381b12be2f 100644
--- a/chromium/third_party/blink/public/mojom/BUILD.gn
+++ b/chromium/third_party/blink/public/mojom/BUILD.gn
@@ -45,6 +45,7 @@ mojom("mojom_platform") {
     "devtools/devtools_agent.mojom",
     "devtools/devtools_frontend.mojom",
     "devtools/inspector_issue.mojom",
+    "digital_goods/digital_goods.mojom",
     "disk_allocator.mojom",
     "favicon/favicon_url.mojom",
     "feature_observer/feature_observer.mojom",
@@ -70,6 +71,7 @@ mojom("mojom_platform") {
     "input/pointer_lock_context.mojom",
     "input/pointer_lock_result.mojom",
     "input/scroll_direction.mojom",
+    "input/synchronous_compositor.mojom",
     "input/touch_event.mojom",
     "insecure_input/insecure_input_service.mojom",
     "keyboard_lock/keyboard_lock.mojom",
@@ -165,7 +167,6 @@ mojom("mojom_platform") {
     "websockets/websocket_connector.mojom",
     "webtransport/quic_transport_connector.mojom",
     "window_features/window_features.mojom",
-    "worker/dedicated_worker_host.mojom",
     "worker/shared_worker_client.mojom",
     "worker/shared_worker_creation_context_type.mojom",
     "worker/shared_worker_host.mojom",
@@ -176,7 +177,10 @@ mojom("mojom_platform") {
     "worker/worker_options.mojom",
   ]
 
-  if (!is_android) {
+  if (is_android) {
+    # TODO(crbug.com/1080903): Figure out how to satisfy deps checker properly.
+    enable_bytecode_checks = false
+  } else {
     sources += [ "serial/serial.mojom" ]
   }
 
@@ -209,6 +213,7 @@ mojom("mojom_platform") {
     "//skia/public/mojom",
     "//third_party/blink/public/mojom/dom_storage",
     "//third_party/blink/public/mojom/frame",
+    "//third_party/blink/public/mojom/gpu",
     "//third_party/blink/public/mojom/usb",
     "//ui/base/cursor/mojom",
     "//ui/base/ime/mojom",
@@ -216,6 +221,7 @@ mojom("mojom_platform") {
     "//ui/events/mojom",
     "//ui/gfx/geometry/mojom",
     "//ui/gfx/mojom",
+    "//ui/gfx/range/mojom",
     "//url/mojom:url_mojom_gurl",
     "//url/mojom:url_mojom_origin",
   ]
@@ -236,6 +242,35 @@ mojom("mojom_platform") {
     enabled_features = [ "renderer_pref_system_font_family_name" ]
   }
 
+  shared_cpp_typemaps = [
+    {
+      types = [
+        {
+          mojom = "blink.mojom.DragOperation"
+          cpp = "::blink::WebDragOperation"
+          copyable_pass_by_value = true
+        },
+        {
+          mojom = "blink.mojom.AllowedDragOperations"
+          cpp = "::blink::WebDragOperationsMask"
+          copyable_pass_by_value = true
+        },
+      ]
+      traits_headers =
+          [ "//third_party/blink/public/common/page/drag_mojom_traits.h" ]
+      traits_public_deps = [ "//third_party/blink/public/common:headers" ]
+    },
+    {
+      types = [
+        {
+          mojom = "blink.mojom.Event"
+          cpp = "::std::unique_ptr<::blink::WebCoalescedInputEvent>"
+          move_only = true
+        },
+      ]
+      traits_headers = [ "//third_party/blink/public/common/input/web_coalesced_input_event_mojom_traits.h" ]
+    },
+  ]
   cpp_typemaps = [
     {
       types = [
@@ -248,6 +283,8 @@ mojom("mojom_platform") {
       traits_public_deps = [ "//ui/base/clipboard:clipboard_types" ]
     },
   ]
+  cpp_typemaps += shared_cpp_typemaps
+  blink_cpp_typemaps = shared_cpp_typemaps
 
   export_class_attribute = "BLINK_COMMON_EXPORT"
   export_define = "BLINK_COMMON_IMPLEMENTATION=1"
@@ -385,6 +422,10 @@ mojom("mojom_core") {
     "//url/mojom:url_mojom_origin",
   ]
 
+  if (is_android) {
+    # TODO(crbug.com/1080903): Figure out how to satisfy deps checker properly.
+    enable_bytecode_checks = false
+  }
   if (is_mac) {
     public_deps += [ "//ui/gfx/range/mojom" ]
   }
diff --git a/chromium/third_party/blink/public/mojom/app_banner/OWNERS b/chromium/third_party/blink/public/mojom/app_banner/OWNERS
index 393b01f11b5..7b66ad53dfd 100644
--- a/chromium/third_party/blink/public/mojom/app_banner/OWNERS
+++ b/chromium/third_party/blink/public/mojom/app_banner/OWNERS
@@ -1,4 +1,4 @@
-mlamouri@chromium.org
+file://third_party/blink/renderer/modules/app_banner/OWNERS
 
 per-file *.mojom=set noparent
 per-file *.mojom=file://ipc/SECURITY_OWNERS
diff --git a/chromium/third_party/blink/public/mojom/bluetooth/web_bluetooth.mojom b/chromium/third_party/blink/public/mojom/bluetooth/web_bluetooth.mojom
index 4c051a5ff4a..8c96988618d 100644
--- a/chromium/third_party/blink/public/mojom/bluetooth/web_bluetooth.mojom
+++ b/chromium/third_party/blink/public/mojom/bluetooth/web_bluetooth.mojom
@@ -46,6 +46,7 @@ import "device/bluetooth/public/mojom/uuid.mojom";
 enum WebBluetoothResult {
   SUCCESS,
   // AbortError:
+  WATCH_ADVERTISEMENTS_ABORTED,
   // InvalidModificationError:
   GATT_INVALID_ATTRIBUTE_LENGTH,
   // InvalidStateError:
@@ -168,6 +169,13 @@ struct WebBluetoothRemoteGATTDescriptor {
   bluetooth.mojom.UUID uuid;
 };
 
+// Parameter for WebBluetoothService.RemoteCharacteristicWriteValue
+enum WebBluetoothWriteType {
+  kWriteDefaultDeprecated,
+  kWriteWithResponse,
+  kWriteWithoutResponse,
+};
+
 // Web Bluetooth Interface that Blink can use to perform
 // Bluetooth GATT Operations on Bluetooth Devices.
 interface WebBluetoothService {
@@ -243,7 +251,8 @@ interface WebBluetoothService {
   // written.
   RemoteCharacteristicWriteValue(
     string characteristic_instance_id,
-    array<uint8> value) => (WebBluetoothResult result);
+    array<uint8> value,
+    WebBluetoothWriteType write_type) => (WebBluetoothResult result);
 
   // Starts notifications for the characteristic identified by
   // |characteristic_instance_id|.
@@ -294,6 +303,15 @@ interface WebBluetoothService {
     pending_associated_remote<WebBluetoothAdvertisementClient> client,
     WebBluetoothRequestLEScanOptions options) => (
     WebBluetoothResult result);
+
+  // Starts scanning for advertisements packets from the device associated with
+  // |device_id|. |client| will be notified when advertisement packets are
+  // detected for the device. The scan will be terminated if |client| is
+  // disconnected.
+  WatchAdvertisementsForDevice(
+    WebBluetoothDeviceId device_id,
+    pending_associated_remote<WebBluetoothAdvertisementClient> client)
+    => (WebBluetoothResult result);
 };
 
 // Classes that implement this interface will be notified of device events.
diff --git a/chromium/third_party/blink/public/mojom/devtools/inspector_issue.mojom b/chromium/third_party/blink/public/mojom/devtools/inspector_issue.mojom
index cfb0dfb2342..bcf01f02c17 100644
--- a/chromium/third_party/blink/public/mojom/devtools/inspector_issue.mojom
+++ b/chromium/third_party/blink/public/mojom/devtools/inspector_issue.mojom
@@ -6,6 +6,7 @@ module blink.mojom;
 
 import "url/mojom/url.mojom";
 import "services/network/public/mojom/cookie_manager.mojom";
+import "services/network/public/mojom/blocked_by_response_reason.mojom";
 import "third_party/blink/public/mojom/fetch/fetch_api_request.mojom";
 
 // A code that uniquely identifies an issue. This type should be descriptive
@@ -13,6 +14,7 @@ import "third_party/blink/public/mojom/fetch/fetch_api_request.mojom";
 enum InspectorIssueCode {
   kSameSiteCookieIssue,
   kMixedContentIssue,
+  kBlockedByResponseIssue,
 };
 
 // Information about a cookie that is affected by an issue.
@@ -31,10 +33,27 @@ struct AffectedFrame {
   string frame_id;
 };
 
+struct BlockedByResponseIssueDetails {
+  AffectedRequest request;
+  AffectedFrame? frame;
+  network.mojom.BlockedByResponseReason reason;
+};
+
+enum HeavyAdResolutionStatus {
+  kHeavyAdBlocked,
+  kHeavyAdWarning,
+};
+
+enum HeavyAdReason {
+  kNetworkTotalLimit,
+  kCpuTotalLimit,
+  kCpuPeakLimit,
+};
+
 enum MixedContentResolutionStatus {
-  MixedContentBlocked,
-  MixedContentAutomaticallyUpgraded,
-  MixedContentWarning,
+  kMixedContentBlocked,
+  kMixedContentAutomaticallyUpgraded,
+  kMixedContentWarning,
 };
 
 struct MixedContentIssueDetails {
@@ -47,30 +66,30 @@ struct MixedContentIssueDetails {
 };
 
 enum SameSiteCookieOperation {
-  SetCookie, ReadCookie
+  kSetCookie, kReadCookie
 };
 
 enum SameSiteCookieExclusionReason {
-  ExcludeSameSiteUnspecifiedTreatedAsLax,
-  ExcludeSameSiteNoneInsecure,
+  kExcludeSameSiteUnspecifiedTreatedAsLax,
+  kExcludeSameSiteNoneInsecure,
 };
 
 enum SameSiteCookieWarningReason {
-  WarnSameSiteUnspecifiedCrossSiteContext,
-  WarnSameSiteNoneInsecure,
-  WarnSameSiteUnspecifiedLaxAllowUnsafe,
-  WarnSameSiteStrictLaxDowngradeStrict,
-  WarnSameSiteStrictCrossDowngradeStrict,
-  WarnSameSiteStrictCrossDowngradeLax,
-  WarnSameSiteLaxCrossDowngradeStrict,
-  WarnSameSiteLaxCrossDowngradeLax,
+  kWarnSameSiteUnspecifiedCrossSiteContext,
+  kWarnSameSiteNoneInsecure,
+  kWarnSameSiteUnspecifiedLaxAllowUnsafe,
+  kWarnSameSiteStrictLaxDowngradeStrict,
+  kWarnSameSiteStrictCrossDowngradeStrict,
+  kWarnSameSiteStrictCrossDowngradeLax,
+  kWarnSameSiteLaxCrossDowngradeStrict,
+  kWarnSameSiteLaxCrossDowngradeLax,
 };
 
 // Specific information about |kSameSiteCookieIssue| type issues.
 struct SameSiteCookieIssueDetails {
   AffectedCookie cookie;
-  array<SameSiteCookieExclusionReason> exclusionReason;
-  array<SameSiteCookieWarningReason> warningReason;
+  array<SameSiteCookieExclusionReason> exclusion_reason;
+  array<SameSiteCookieWarningReason> warning_reason;
   SameSiteCookieOperation operation;
   url.mojom.Url? site_for_cookies;
   url.mojom.Url? cookie_url;
@@ -80,8 +99,9 @@ struct SameSiteCookieIssueDetails {
 // A collection of optional fields that may store additional data depending
 // on the issue code.
 struct InspectorIssueDetails {
-  SameSiteCookieIssueDetails? sameSiteCookieIssueDetails;
+  SameSiteCookieIssueDetails? samesite_cookie_issue_details;
   MixedContentIssueDetails? mixed_content_issue_details;
+  BlockedByResponseIssueDetails? blocked_by_response_issue_details;
 };
 
 struct InspectorIssueInfo {
diff --git a/chromium/third_party/blink/public/mojom/digital_goods/OWNERS b/chromium/third_party/blink/public/mojom/digital_goods/OWNERS
new file mode 100644
index 00000000000..bf8fcba2de0
--- /dev/null
+++ b/chromium/third_party/blink/public/mojom/digital_goods/OWNERS
@@ -0,0 +1,6 @@
+file://third_party/blink/renderer/modules/payments/goods/OWNERS
+
+per-file *.mojom=set noparent
+per-file *.mojom=file://ipc/SECURITY_OWNERS
+
+# COMPONENT: UI>Browser>WebAppInstalls>ChromeOS
diff --git a/chromium/third_party/blink/public/mojom/digital_goods/digital_goods.mojom b/chromium/third_party/blink/public/mojom/digital_goods/digital_goods.mojom
new file mode 100644
index 00000000000..ef162acb427
--- /dev/null
+++ b/chromium/third_party/blink/public/mojom/digital_goods/digital_goods.mojom
@@ -0,0 +1,50 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+module payments.mojom;
+
+import "components/payments/mojom/payment_request_data.mojom";
+
+// https://github.com/WICG/digital-goods/blob/master/explainer.md
+
+struct GetDetailsParams {
+  array<string> item_ids;
+};
+
+struct GetDetailsResponse {
+  BillingResponseCode code;
+  array<ItemDetails> item_details_list;
+};
+
+struct ConsumeParams {
+  string purchase_token;
+  bool make_available_again;
+};
+
+struct ConsumeResponse {
+  BillingResponseCode code;
+};
+
+// TODO(crbug.com/1061503): Narrow down this list as discussions settle on
+// https://github.com/WICG/digital-goods/blob/master/explainer.md
+enum BillingResponseCode {
+  kOk,
+  kError,
+  kBillingUnavailable,
+  kDeveloperError,
+  kFeatureNotSupported,
+  kItemAlreadyOwned,
+  kItemNotOwned,
+  kItemUnavailable,
+  kServiceDisconnected,
+  kServiceUnavailable,
+  kUserCancelled,
+};
+
+struct ItemDetails {
+  string item_id;
+  string title;
+  string description;
+  PaymentCurrencyAmount price;
+};
diff --git a/chromium/third_party/blink/public/mojom/feature_policy/PRESUBMIT.py b/chromium/third_party/blink/public/mojom/feature_policy/PRESUBMIT.py
index 9c30dd0f5a2..416880058cc 100644
--- a/chromium/third_party/blink/public/mojom/feature_policy/PRESUBMIT.py
+++ b/chromium/third_party/blink/public/mojom/feature_policy/PRESUBMIT.py
@@ -8,52 +8,179 @@ for more details about the presubmit API built into gcl.
 """
 
 
-def _RunUmaHistogramChecks(input_api, output_api):  # pylint: disable=C0103
+import os
+
+
+def _dynamic_import(module_dir, module_name):
     import sys
 
     original_sys_path = sys.path
     try:
-        sys.path = sys.path + [
-            input_api.os_path.join(input_api.PresubmitLocalPath(), '..', '..',
-                                   '..', '..', '..', 'tools', 'metrics',
-                                   'histograms')
-        ]
-        import update_histogram_enum
+        sys.path = sys.path + [module_dir]
+        return __import__(module_name)
     finally:
         sys.path = original_sys_path
 
-    source_path = ''
-    for f in input_api.AffectedFiles():
-        if f.LocalPath().endswith('feature_policy_feature.mojom'):
-            source_path = f.LocalPath()
-            break
-    else:
+
+def _import_update_histogram_enum(input_api):
+    return _dynamic_import(
+        input_api.os_path.join(input_api.PresubmitLocalPath(), '..', '..',
+                               '..', '..', '..', 'tools', 'metrics',
+                               'histograms'), 'update_histogram_enum')
+
+
+def _import_path_util(input_api):
+    return _dynamic_import(
+        input_api.os_path.join(input_api.PresubmitLocalPath(), '..', '..',
+                               '..', '..', '..', 'tools', 'metrics', 'common'),
+        'path_util')
+
+
+# Note: this function is copied from third_party/blink/renderer/build/scripts/json5_generator
+def _json5_load(lines):
+    import re
+    import ast
+    # Use json5.loads when json5 is available. Currently we use simple
+    # regexs to convert well-formed JSON5 to PYL format.
+    # Strip away comments and quote unquoted keys.
+    re_comment = re.compile(r"^\s*//.*$|//+ .*$", re.MULTILINE)
+    re_map_keys = re.compile(r"^\s*([$A-Za-z_][\w]*)\s*:", re.MULTILINE)
+    pyl = re.sub(re_map_keys, r"'\1':", re.sub(re_comment, "", lines))
+    # Convert map values of true/false to Python version True/False.
+    re_true = re.compile(r":\s*true\b")
+    re_false = re.compile(r":\s*false\b")
+    pyl = re.sub(re_true, ":True", re.sub(re_false, ":False", pyl))
+    return ast.literal_eval(pyl)
+
+
+def _json5_load_from_file(file_path):
+    with open(file_path, 'r') as f:
+        return _json5_load(f.read())
+
+
+def uma_histogram_checks_factory(mojom_file, enum_name, update_script_file):
+    """
+    :param mojom_file: str mojom_file name
+    :param enum_name: str enum name used in both mojom file and enums.xml
+    :param update_script_file: str update_script_file name
+    """
+
+    def run_uma_histogram_checks(input_api, output_api):
+        source_path = ''
+        for f in input_api.AffectedFiles():
+            if f.LocalPath().endswith(mojom_file):
+                source_path = f.LocalPath()
+                break
+        else:
+            return []
+
+        start_marker = '^enum {} {{'.format(enum_name)
+        end_marker = '^};'
+        presubmit_error = _import_update_histogram_enum(
+            input_api).CheckPresubmitErrors(
+                histogram_enum_name=enum_name,
+                update_script_name=update_script_file,
+                source_enum_path=source_path,
+                start_marker=start_marker,
+                end_marker=end_marker,
+                strip_k_prefix=True)
+        if presubmit_error:
+            return [
+                output_api.PresubmitPromptWarning(presubmit_error,
+                                                  items=[source_path])
+            ]
         return []
 
-    start_marker = '^enum FeaturePolicyFeature {'
-    end_marker = '^};'
-    presubmit_error = update_histogram_enum.CheckPresubmitErrors(
-        histogram_enum_name='FeaturePolicyFeature',
-        update_script_name='update_feature_policy_enum.py',
-        source_enum_path=source_path,
-        start_marker=start_marker,
-        end_marker=end_marker,
-        strip_k_prefix=True)
-    if presubmit_error:
-        return [
+    return run_uma_histogram_checks
+
+
+def json5_config_checks_factory(mojom_source_path, json5_config_path,
+                                enum_name, ignore_enums):
+    """
+    :param mojom_source_path: str a src based path to mojom source file
+    :param json5_config_path: str a src based path to json5 config file
+    :param enum_name: str enum name used in mojom file
+    :param ignore_enums: Set[str] enum names that should be ignored in mojom file.
+                                  Enum names should not have 'k' prefixes here.
+    """
+
+    def run_json5_config_checks(input_api, output_api):
+        affected_paths = {f.LocalPath() for f in input_api.AffectedFiles()}
+        if mojom_source_path not in affected_paths and json5_config_path not in affected_paths:
+            return []
+
+        mojom_enums = set(
+            _import_update_histogram_enum(input_api).ReadHistogramValues(
+                mojom_source_path,
+                start_marker='^enum {} {{'.format(enum_name),
+                end_marker='^};',
+                strip_k_prefix=True).values()) - ignore_enums
+
+        json5_enums = {
+            feature['name']
+            for feature in _json5_load_from_file(
+                _import_path_util(input_api).GetInputFile(json5_config_path))
+            ['data']
+        }
+
+        json5_missing_enums = mojom_enums - json5_enums
+        mojom_missing_enums = json5_enums - mojom_enums
+
+        json5_messages = "{} are missing in json5 config.\n".format(
+            list(json5_missing_enums)) if json5_missing_enums else ""
+        mojom_messages = "{} are missing in mojom file.\n".format(
+            list(mojom_missing_enums)) if mojom_missing_enums else ""
+
+        return [] if json5_enums == mojom_source_path else [
             output_api.PresubmitPromptWarning(
-                presubmit_error, items=[source_path])
+                "{} and {} are out of sync: {}{}".format(
+                    json5_config_path, mojom_source_path, json5_messages,
+                    mojom_messages),
+                items=[mojom_source_path, json5_config_path])
         ]
-    return []
+
+    return run_json5_config_checks
+
+
+checks = [
+    uma_histogram_checks_factory(
+        mojom_file="feature_policy_feature.mojom",
+        enum_name="FeaturePolicyFeature",
+        update_script_file="update_feature_policy_enum.py"),
+    uma_histogram_checks_factory(
+        mojom_file="document_policy_feature.mojom",
+        enum_name="DocumentPolicyFeature",
+        update_script_file="update_document_policy_enum.py"),
+    json5_config_checks_factory(
+        mojom_source_path=os.path.join('third_party', 'blink', 'public',
+                                       'mojom', 'feature_policy',
+                                       'feature_policy_feature.mojom'),
+        json5_config_path=os.path.join('third_party', 'blink', 'renderer',
+                                       'core', 'feature_policy',
+                                       'feature_policy_features.json5'),
+        enum_name="FeaturePolicyFeature",
+        ignore_enums={'NotFound'}),
+    json5_config_checks_factory(
+        mojom_source_path=os.path.join('third_party', 'blink', 'public',
+                                       'mojom', 'feature_policy',
+                                       'document_policy_feature.mojom'),
+        json5_config_path=os.path.join('third_party', 'blink', 'renderer',
+                                       'core', 'feature_policy',
+                                       'document_policy_features.json5'),
+        enum_name="DocumentPolicyFeature",
+        ignore_enums={'Default'}),
+]
 
 
 def CheckChangeOnUpload(input_api, output_api):  # pylint: disable=C0103
-    results = []
-    results.extend(_RunUmaHistogramChecks(input_api, output_api))
-    return results
+    return [
+        message for check in checks
+        for message in check(input_api, output_api)
+    ]
 
 
 def CheckChangeOnCommit(input_api, output_api):  # pylint: disable=C0103
-    results = []
-    results.extend(_RunUmaHistogramChecks(input_api, output_api))
-    return results
+    return [
+        message for check in checks
+        for message in check(input_api, output_api)
+    ]
diff --git a/chromium/third_party/blink/public/mojom/feature_policy/feature_policy_feature.mojom b/chromium/third_party/blink/public/mojom/feature_policy/feature_policy_feature.mojom
index adbeb995108..aafba2e37d9 100644
--- a/chromium/third_party/blink/public/mojom/feature_policy/feature_policy_feature.mojom
+++ b/chromium/third_party/blink/public/mojom/feature_policy/feature_policy_feature.mojom
@@ -29,8 +29,6 @@ enum FeaturePolicyFeature {
   kMidiFeature = 7,
   // Controls access to PaymentRequest interface.
   kPayment = 8,
-  // Controls access to document.cookie attribute.
-  kDocumentCookie = 10,
   // Controls access to document.domain attribute.
   kDocumentDomain = 11,
   // Controls whether synchronous script elements will run.
@@ -39,10 +37,6 @@ enum FeaturePolicyFeature {
   kSyncXHR = 13,
   // Controls access to the WebUSB API.
   kUsb = 14,
-  // Controls access to AOM event listeners.
-  kAccessibilityEvents = 15,
-  // Controls use of WebVR API.
-  kWebVr = 16,
   // The following features control access to the corresponding sensor classes.
   // Fusion sensor APIs (e.g. LinearAcceleration, OrientationSensor-based
   // classes)require all of the features that are inputs into that API to be
@@ -59,9 +53,6 @@ enum FeaturePolicyFeature {
   // which interfere with document's input stream (document.write(),
   // document.close(), etc.).
   kDocumentWrite = 28,
-  // TODO(ekaramad): kLazyLoad is deprecated; remove.
-  // Used to enforce lazyloading for a frame and any nested <iframe> or image.
-  kLazyLoad = 29,
   // Controls access to Screen Wake Lock
   kScreenWakeLock = 31,
   // These are the defined sandbox features implemented as policy-controlled
@@ -85,9 +76,6 @@ enum FeaturePolicyFeature {
   // Controls access to Idle Detection
   kIdleDetection = 44,
 
-  // Loading policies.
-  kLoadingFrameDefaultEager = 48,
-
   // Implements sandbox flag: allow-downloads.
   kDownloads = 49,
 
@@ -119,9 +107,6 @@ enum FeaturePolicyFeature {
   // Web Authentication (https://w3c.github.io/webauthn/#sctn-iframe-guidance)
   kPublicKeyCredentialsGet = 67,
 
-  // Controls use of Clipboard API.
-  kClipboard = 68,
-
   //Additional Client Hint
   kClientHintUAMobile = 69,
 
@@ -140,6 +125,12 @@ enum FeaturePolicyFeature {
   // Client Hint for UA platform version.
   kClientHintUAPlatformVersion = 74,
 
+  // Controls use of Clipboard API Read.
+  kClipboardRead = 76,
+
+  // Controls use of Clipboard API Write.
+  kClipboardWrite = 77,
+
   // Don't change assigned numbers of any item, and don't reuse removed slots.
   // Add new features at the end of the enum.
   // Also, run update_feature_policy_enum.py in
diff --git a/chromium/third_party/blink/public/mojom/fetch/fetch_api_response.mojom b/chromium/third_party/blink/public/mojom/fetch/fetch_api_response.mojom
index 0f85ff36c91..ec7f2752199 100644
--- a/chromium/third_party/blink/public/mojom/fetch/fetch_api_response.mojom
+++ b/chromium/third_party/blink/public/mojom/fetch/fetch_api_response.mojom
@@ -7,6 +7,7 @@ module blink.mojom;
 import "mojo/public/mojom/base/time.mojom";
 import "services/network/public/mojom/fetch_api.mojom";
 import "services/network/public/mojom/parsed_headers.mojom";
+import "services/network/public/mojom/network_types.mojom";
 import "third_party/blink/public/mojom/blob/serialized_blob.mojom";
 import "third_party/blink/public/mojom/service_worker/service_worker_error_type.mojom";
 import "url/mojom/url.mojom";
@@ -42,6 +43,9 @@ struct FetchAPIResponse {
   // The response headers. It's case insensitive for header name as key.
   map<string, string> headers;
 
+  // The mime type of the response, if one has been set.
+  string? mime_type;
+
   // Mojo interface to read the response payload.
   SerializedBlob? blob;
 
@@ -74,6 +78,13 @@ struct FetchAPIResponse {
   // output of blink::ParseHeaders(headers, url);
   network.mojom.ParsedHeaders? parsed_headers;
 
+  // Enumeration that describes the kind of connection originally used to
+  // fetch this request.
+  network.mojom.ConnectionInfo connection_info;
+
+  // ALPN negotiated protocol of the socket which fetched this resource.
+  string alpn_negotiated_protocol = "unknown";
+
   // True if the response was loaded with a Request where the credentials mode
   // would potentially send cookies to the server:
   //
@@ -86,4 +97,8 @@ struct FetchAPIResponse {
   // This field may be true even if there were no cookies actually available
   // to send.
   bool loaded_with_credentials = false;
+
+  // True if the response was originally loaded via a request fetched over a
+  // SPDY channel.
+  bool was_fetched_via_spdy = false;
 };
diff --git a/chromium/third_party/blink/public/mojom/frame/find_in_page.mojom b/chromium/third_party/blink/public/mojom/frame/find_in_page.mojom
index 553126cd2fd..5d0114a8dc2 100644
--- a/chromium/third_party/blink/public/mojom/frame/find_in_page.mojom
+++ b/chromium/third_party/blink/public/mojom/frame/find_in_page.mojom
@@ -7,9 +7,9 @@ module blink.mojom;
 import "ui/gfx/geometry/mojom/geometry.mojom";
 
 interface FindInPage {
-  // If |options.find_next| is false, this is a "Start Find" call.
+  // If |options.new_session| is true, this is a "Start Find" call.
   // It starts a new find-in-page session with id |request_id|.
-  // If |options.find_next| is true, this is a "Find Next" call.
+  // If |options.new_session| is false, this is a "Find Next" call.
   // It asks the active/highlighted match for session with id |request_id|
   // to be moved either forward if |options.forward| is true, or backwards
   // if |options.forward| is false.
@@ -106,12 +106,17 @@ struct FindOptions {
   bool match_case = false;
 
   // Whether this operation is the first request or a follow-up.
-  bool find_next = false;
+  bool new_session = true;
 
   // Force a re-search of the frame: typically used when forcing a re-search
   // after the frame navigates.
   bool force = false;
 
+  // Whether to keep searching if the result is an exact match of the selection.
+  // This should generally be set to true unless you're starting a new find
+  // based on the selection.
+  bool find_next_if_selection_matches = true;
+
   // Signifies whether we should force text scoping to happen immediately
   // or not. Only used for testing purposes.
   bool run_synchronously_for_testing = false;
diff --git a/chromium/third_party/blink/public/mojom/frame/frame.mojom b/chromium/third_party/blink/public/mojom/frame/frame.mojom
index 2038cd3af0e..713eca26909 100644
--- a/chromium/third_party/blink/public/mojom/frame/frame.mojom
+++ b/chromium/third_party/blink/public/mojom/frame/frame.mojom
@@ -15,6 +15,8 @@ import "services/network/public/mojom/fetch_api.mojom";
 import "services/network/public/mojom/web_sandbox_flags.mojom";
 import "skia/public/mojom/skcolor.mojom";
 import "third_party/blink/public/mojom/ad_tagging/ad_frame.mojom";
+import "third_party/blink/public/mojom/blob/blob.mojom";
+import "third_party/blink/public/mojom/blob/blob_url_store.mojom";
 import "third_party/blink/public/mojom/messaging/transferable_message.mojom";
 import "third_party/blink/public/mojom/choosers/popup_menu.mojom";
 import "third_party/blink/public/mojom/devtools/console_message.mojom";
@@ -46,6 +48,22 @@ import "url/mojom/url.mojom";
 [EnableIf=is_mac]
 import "ui/gfx/range/mojom/range.mojom";
 
+// Information about a subframe being saved as "complete html".
+struct SavableSubframe {
+  // Original url of the subframe (i.e. based the parent's html sources).
+  url.mojom.Url original_url;
+
+  // The unique identifier of the RenderFrameHost or RenderFrameProxy for the
+  // subframe.
+  mojo_base.mojom.UnguessableToken subframe_token;
+};
+
+struct GetSavableResourceLinksReply {
+  array<url.mojom.Url> resources_list;
+  blink.mojom.Referrer referrer;
+  array<SavableSubframe> subframes;
+};
+
 struct FindInPageResultAXParams {
   // The find in page request id.
   int32 request_id;
@@ -76,10 +94,10 @@ struct DownloadURLParams {
   network.mojom.RedirectMode cross_origin_redirects;
 
   // Non-null when |url| is for "blob:".
-  handle<message_pipe>? blob_url_token;
+  pending_remote<BlobURLToken>? blob_url_token;
 
   // Non-null when |url| is for "data:", eg. when saving an image.
-  handle<message_pipe>? data_url_blob;
+  pending_remote<Blob>? data_url_blob;
 };
 
 // Actions browser can ask renderer to perform on a Plugin.
@@ -159,9 +177,10 @@ interface LocalFrameHost {
   // in order to service IntersectionObserver's that track visibility.
   SetNeedsOcclusionTracking(bool needs_tracking);
 
-  // Notifies the browser that the current frame has changed its lifecycle
-  // state.
-  LifecycleStateChanged(blink.mojom.FrameLifecycleState state);
+  // Indication that the associated frame would like to change the policy on
+  // whether or not the virtual keyboard should overlay content (vs. default
+  // behavior of 'shifting' the content via insets and a scrollIntoView).
+  SetVirtualKeyboardOverlayPolicy(bool vk_overlays_content);
 
   // Evicts the page from the back/forward cache due to e.g., JavaScript
   // execution.
@@ -186,6 +205,10 @@ interface LocalFrameHost {
   // Sent by the renderer when the associated frame becomes focused.
   DidFocusFrame();
 
+  // Called to notify the browser process counterpart of this local frame that
+  // |window.focus()| on a page has been invoked in the renderer process.
+  DidCallFocus();
+
   // Notifies the browser process about a new Content Security Policy that needs
   // to be applies to the frame. This message is sent when a frame commits
   // navigation to a new location (reporting accumulated policies from HTTP
@@ -319,10 +342,6 @@ interface LocalFrameHost {
   [Sync]
   RunBeforeUnloadConfirm(bool is_reload) => (bool success);
 
-  // A request to check whether WebGL is explicitly blocked.
-  [Sync]
-  Are3DAPIsBlocked() => (bool blocked);
-
   // Notifies that the urls for the favicon of a site has been determined.
   UpdateFaviconURL(array<FaviconURL> favicon_urls);
 
@@ -371,6 +390,17 @@ interface LocalFrameHost {
   DidChangeFrameOwnerProperties(
     mojo_base.mojom.UnguessableToken child_frame_token,
     blink.mojom.FrameOwnerProperties frame_owner_properties);
+
+  // Sent when a local renderer frame either updates its opener to another
+  // frame identified by |opener_frame|, or, if |opener_frame| // is "empty",
+  // the frame disowns its opener for the lifetime of the window.
+  DidChangeOpener(mojo_base.mojom.UnguessableToken? opener_frame);
+
+  // Notifies the browser that sandbox flags or container policy have changed
+  // for a subframe of this frame.
+  DidChangeFramePolicy(
+      mojo_base.mojom.UnguessableToken child_frame_token,
+      blink.mojom.FramePolicy frame_policy);
 };
 
 // Implemented in Blink, this interface defines frame-specific methods that will
@@ -405,6 +435,10 @@ interface LocalFrame {
   // side (e.g. during Android voice search).
   NotifyUserActivation();
 
+  // Notifies the |LocalFrame| about the Virtual keyboard rectangle that is occluding the web
+  // content.
+  NotifyVirtualKeyboardOverlayRect(gfx.mojom.Rect keyboard_rect);
+
   // Add message to the frame console.
   AddMessageToConsole(ConsoleMessageLevel level, string message,
                     bool discard_duplicates);
@@ -529,6 +563,14 @@ interface LocalFrame {
   // Binds |receiver| to the document of this frame.
   BindReportingObserver(
       pending_receiver<blink.mojom.ReportingObserver> receiver);
+
+  // Requests that the blink::LocalFrame updates its opener to the specified
+  // frame. The frame token may be "empty" if the opener was disowned.
+  UpdateOpener(mojo_base.mojom.UnguessableToken? opener_frame_token);
+
+  // Request to enumerate and return links to all savable resources in the frame
+  // Note: this covers only the immediate frame / doesn't cover subframes.
+  GetSavableResourceLinks() => (GetSavableResourceLinksReply? reply);
 };
 
 // Implemented in Browser, this interface defines frame-specific methods that
@@ -579,6 +621,35 @@ interface RemoteFrameHost {
   //
   // https://html.spec.whatwg.org/multipage/interaction.html#inert
   SetIsInert(bool inert);
+
+  // Sent when a renderer remote frame either updates its opener to another
+  // frame identified by |opener_frame|, or, if |opener_frame| is "empty",
+  // the frame disowns its opener for the lifetime of the window.
+  DidChangeOpener(mojo_base.mojom.UnguessableToken? opener_frame);
+
+  // This message is sent from a RemoteFrame when sequential focus navigation
+  // needs to advance into its actual frame. |source_frame_token| identifies the
+  // frame that issued this request.  This is used when pressing <tab> or
+  // <shift-tab> hits an out-of-process iframe when searching for the next
+  // focusable element.
+  AdvanceFocus(blink.mojom.FocusType focus_type,
+               mojo_base.mojom.UnguessableToken source_frame_token);
+
+  // Sent to the browser to post a message to the frame's active renderer, which
+  // will receive the re-routed message from the browser process via the method
+  // PostMessageEvent(), from the blink.mojom.LocalFrame interface.
+  // |source_frame_token| is the frame token of the LocalFrame in the renderer
+  // process originating the request, which will be translated by the browser
+  // process to the frame token of the equivalent RemoteFrame in the target
+  // renderer process.
+  // |source_origin| is the origin of the source frame when the message was
+  // sent, |target_origin| specifies what the origin of the target frame must be
+  // for the message to be dispatched and |message| is the encoded data, plus
+  // any extra properties such as transferred ports or blobs.
+  RouteMessageEvent(mojo_base.mojom.UnguessableToken? source_frame_token,
+                    mojo_base.mojom.String16 source_origin,
+                    mojo_base.mojom.String16 target_origin,
+                    blink.mojom.TransferableMessage message);
 };
 
 // Implemented in Blink, this interface defines frame-specific methods that will
@@ -708,6 +779,14 @@ interface RemoteFrame {
   // Notifies the frame that its parent has changed the frame's sandbox flags or
   // container policy.
   DidUpdateFramePolicy(blink.mojom.FramePolicy frame_policy);
+
+  // Requests that the blink::RemoteFrame updates its opener to the specified
+  // frame. The frame token may be "empty" if the opener was disowned.
+  UpdateOpener(mojo_base.mojom.UnguessableToken? opener_frame_token);
+
+  // Transfers user activation state from the source frame to the current frame.
+  TransferUserActivationToRenderer(
+      mojo_base.mojom.UnguessableToken source_frame_token);
 };
 
 // Implemented in Blink, this interface defines main-frame-specific methods that
@@ -745,8 +824,8 @@ interface LocalMainFrame {
   ZoomToFindInPageRect(gfx.mojom.Rect rect_in_root_frame);
 };
 
-// Implemented in Browser, this interface defines main-frame-specific methods
-// that will be invoked from the renderer process (e.g. WebViewImpl).
+// Implemented in Browser, this interface defines local-main-frame-specific
+// methods that will be invoked from the renderer process (e.g. WebViewImpl).
 interface LocalMainFrameHost {
   // Indicates the scale of the view has changed.
   ScaleFactorChanged(float scale);
@@ -759,4 +838,14 @@ interface LocalMainFrameHost {
   // browser will share this information with other renderers that have frames
   // in the page.
   TextAutosizerPageInfoChanged(TextAutosizerPageInfo page_info);
+
+  // Asks the browser process to activate the page associated to the main frame.
+  FocusPage();
+};
+
+// Implemented in Browser, this interface defines remote-main-frame-specific
+// methods that will be invoked from the renderer process (e.g. WebViewImpl).
+interface RemoteMainFrameHost {
+  // Asks the browser process to activate the page associated to the main frame.
+  FocusPage();
 };
diff --git a/chromium/third_party/blink/public/mojom/gpu/BUILD.gn b/chromium/third_party/blink/public/mojom/gpu/BUILD.gn
new file mode 100644
index 00000000000..798334858d7
--- /dev/null
+++ b/chromium/third_party/blink/public/mojom/gpu/BUILD.gn
@@ -0,0 +1,21 @@
+# Copyright 2020 The Chromium Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+import("//mojo/public/tools/bindings/mojom.gni")
+
+mojom_component("gpu") {
+  output_prefix = "blink_gpu_mojom"
+  macro_prefix = "BLINK_GPU_MOJOM"
+
+  sources = [ "gpu.mojom" ]
+  public_deps = [ "//url/mojom:url_mojom_gurl" ]
+
+  # It's important to specify these settings for Blink bindings, because the
+  # URL dependency above requires direct linkage into the platform library.
+  export_class_attribute_blink = "PLATFORM_EXPORT"
+  export_define_blink = "BLINK_PLATFORM_IMPLEMENTATION=1"
+  export_header_blink = "third_party/blink/renderer/platform/platform_export.h"
+
+  generate_java = true
+}
diff --git a/chromium/third_party/blink/public/mojom/gpu/OWNERS b/chromium/third_party/blink/public/mojom/gpu/OWNERS
new file mode 100644
index 00000000000..08850f42120
--- /dev/null
+++ b/chromium/third_party/blink/public/mojom/gpu/OWNERS
@@ -0,0 +1,2 @@
+per-file *.mojom=set noparent
+per-file *.mojom=file://ipc/SECURITY_OWNERS
diff --git a/chromium/third_party/blink/public/mojom/gpu/gpu.mojom b/chromium/third_party/blink/public/mojom/gpu/gpu.mojom
new file mode 100644
index 00000000000..c3cbb8231dc
--- /dev/null
+++ b/chromium/third_party/blink/public/mojom/gpu/gpu.mojom
@@ -0,0 +1,18 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+module blink.mojom;
+
+import "url/mojom/url.mojom";
+
+// An interface used by frames to query the browser about tracked GPU state.
+interface GpuDataManager {
+  // Asks whether or not `url` is allowed to use 3D APIs.
+  //
+  // Note that the renderer can ignore the result of this check, so this is
+  // currently not considered security-sensitive. As a temporary exception, pass
+  // the URL rather than routing this method via the frame.
+  [Sync]
+  Are3DAPIsBlockedForUrl(url.mojom.Url url) => (bool blocked);
+};
diff --git a/chromium/third_party/blink/public/mojom/hid/hid.mojom b/chromium/third_party/blink/public/mojom/hid/hid.mojom
index 5f1c09d8e9e..75272a0354f 100644
--- a/chromium/third_party/blink/public/mojom/hid/hid.mojom
+++ b/chromium/third_party/blink/public/mojom/hid/hid.mojom
@@ -68,7 +68,13 @@ struct HidDeviceFilter {
 // peripherals from the render process. The implementation is responsible for
 // checking device access permissions and should not return information about a
 // device unless permission to access that device has already been granted.
+// Each HidService instance manages permissions and device access for a single
+// render frame, and must be destroyed when that render frame is destroyed.
 interface HidService {
+  // Registers a HidManagerClient to be notified when HID devices are added or
+  // removed.
+  RegisterClient(associated device.mojom.HidManagerClient client);
+
   // Retrieves information about all devices that this client has permission to
   // access.
   GetDevices() => (array<device.mojom.HidDeviceInfo> devices);
diff --git a/chromium/third_party/blink/public/mojom/input/input_handler.mojom b/chromium/third_party/blink/public/mojom/input/input_handler.mojom
index e213ab67cc1..8864e18d563 100644
--- a/chromium/third_party/blink/public/mojom/input/input_handler.mojom
+++ b/chromium/third_party/blink/public/mojom/input/input_handler.mojom
@@ -6,7 +6,164 @@ module blink.mojom;
 
 import "cc/mojom/overscroll_behavior.mojom";
 import "cc/mojom/touch_action.mojom";
+import "mojo/public/mojom/base/string16.mojom";
+import "mojo/public/mojom/base/time.mojom";
+import "third_party/blink/public/mojom/input/gesture_event.mojom";
+import "third_party/blink/public/mojom/input/input_event.mojom";
+import "third_party/blink/public/mojom/input/input_event_result.mojom";
+import "third_party/blink/public/mojom/input/pointer_lock_context.mojom";
+import "third_party/blink/public/mojom/input/pointer_lock_result.mojom";
+import "third_party/blink/public/mojom/input/synchronous_compositor.mojom";
+import "third_party/blink/public/mojom/input/touch_event.mojom";
+import "third_party/blink/public/mojom/selection_menu/selection_menu_behavior.mojom";
+import "ui/base/ime/mojom/ime_types.mojom";
+import "ui/events/mojom/event.mojom";
+import "ui/events/mojom/event_constants.mojom";
+import "ui/events/mojom/scroll_granularity.mojom";
 import "ui/gfx/geometry/mojom/geometry.mojom";
+import "ui/gfx/range/mojom/range.mojom";
+import "ui/latency/mojom/latency_info.mojom";
+
+// These structs are purposely duplicated from ui/events/mojom/event.mojom.
+// They map WebInputEvent <-> WebInputEvent across mojo.
+// We have to work at unifying them. The current problem is that the browser
+// uses WebInputEvents inside the render widget host and input router. Once
+// we move these to ui::Event's then we can get rid of these duplicated
+// mojom structs. Ideally the browser would use ui::Event up until we
+// pass the events into the renderer and just use a StructTraits to perform
+// conversion from ui::mojom::Event --> blink::WebInputEvent.
+struct KeyData {
+  int32 dom_key;
+  int32 dom_code;
+  int32 windows_key_code;
+  int32 native_key_code;
+  bool is_system_key;
+  bool is_browser_shortcut;
+  mojo_base.mojom.String16 text;
+  mojo_base.mojom.String16 unmodified_text;
+};
+
+struct PointerData {
+  int32 pointer_id;
+  float force;
+  int32 tilt_x;
+  int32 tilt_y;
+  float tangential_pressure;
+  int32 twist;
+  blink.mojom.Button button;
+  ui.mojom.EventPointerType pointer_type;
+  int32 movement_x;
+  int32 movement_y;
+  bool is_raw_movement_event;
+  gfx.mojom.PointF widget_position;
+  gfx.mojom.PointF screen_position;
+  MouseData? mouse_data;
+};
+
+struct WheelData {
+  float delta_x;
+  float delta_y;
+  float wheel_ticks_x;
+  float wheel_ticks_y;
+  float acceleration_ratio_x;
+  float acceleration_ratio_y;
+  uint8 phase;
+  uint8 momentum_phase;
+  blink.mojom.DispatchType cancelable;
+  uint8 event_action;
+  uint8 delta_units;
+};
+
+struct MouseData {
+  int32 click_count;
+  WheelData? wheel_data;
+};
+
+struct ScrollUpdate {
+  float velocity_x;
+  float velocity_y;
+};
+
+struct ScrollData {
+  float delta_x;
+  float delta_y;
+  ui.mojom.ScrollGranularity delta_units;
+  bool target_viewport;
+  blink.mojom.InertialPhaseState inertial_phase;
+  bool synthetic;
+  int32 pointer_count;
+  ScrollUpdate? update_details;
+};
+
+struct PinchBeginData {
+  bool needs_wheel_event;
+};
+
+struct PinchUpdateData {
+  float scale;
+  bool zoom_disabled;
+  bool needs_wheel_event;
+};
+
+struct PinchEndData {
+  bool needs_wheel_event;
+};
+
+struct FlingData {
+  float velocity_x;
+  float velocity_y;
+  bool target_viewport;
+  bool prevent_boosting;
+};
+
+struct TapData {
+  int32 tap_count;
+  bool needs_wheel_event;
+};
+
+struct GestureData {
+  gfx.mojom.PointF screen_position;
+  gfx.mojom.PointF widget_position;
+  blink.mojom.GestureDevice source_device;
+  bool is_source_touch_event_set_non_blocking;
+  ui.mojom.EventPointerType primary_pointer_type;
+  int32 unique_touch_event_id;
+  gfx.mojom.Size? contact_size;
+  ScrollData? scroll_data;
+  PinchBeginData? pinch_begin_data;
+  PinchUpdateData? pinch_update_data;
+  PinchEndData? pinch_end_data;
+  TapData? tap_data;
+  FlingData? fling_data;
+};
+
+struct TouchPoint {
+  blink.mojom.TouchState state;
+  float radius_x;
+  float radius_y;
+  float rotation_angle;
+  PointerData pointer_data;
+};
+
+struct TouchData {
+  blink.mojom.DispatchType cancelable;
+  bool moved_beyond_slop_region;
+  bool touch_start_or_first_move;
+  bool hovering;
+  uint32 unique_touch_event_id;
+  array<TouchPoint> touches;
+};
+
+struct Event {
+  blink.mojom.EventType type;
+  int32 modifiers;
+  mojo_base.mojom.TimeTicks timestamp;
+  ui.mojom.LatencyInfo latency;
+  KeyData? key_data;
+  PointerData? pointer_data;
+  GestureData? gesture_data;
+  TouchData? touch_data;
+};
 
 // Represents the current state of overscroll.
 struct DidOverscrollParams {
@@ -27,4 +184,234 @@ struct TouchActionOptional {
 struct EditCommand {
   string name;
   string value;
-};
\ No newline at end of file
+};
+
+// Interface exposed by the browser to the renderer.
+interface WidgetInputHandlerHost {
+  // When the renderer's main thread computes the touch action, send this to the
+  // browser.
+  SetTouchActionFromMain(cc.mojom.TouchAction touch_action);
+
+  // Sent by the compositor when input scroll events are dropped due to bounds
+  // restrictions on the root scroll offset.
+  DidOverscroll(DidOverscrollParams params);
+
+  // Sent by the compositor when a GSB has started scrolling the viewport.
+  DidStartScrollingViewport();
+
+  // Required for cancelling an ongoing input method composition.
+  ImeCancelComposition();
+
+  // Sends the character bounds after every composition change
+  // to always have correct bound info.
+  ImeCompositionRangeChanged(gfx.mojom.Range range,
+                             array<gfx.mojom.Rect> bounds);
+
+  // Updates the mouse capture state of this widget. While capture is enabled,
+  // all mouse events, including those that don't hittest to this widget, will
+  // be targeted to this widget. This enables Blink to behave correctly when
+  // a scrollbar is being dragged, or text is being drag-highlighted, even
+  // when the mouse passes across different RenderWidget areas.
+  SetMouseCapture(bool capture);
+
+  // Requests locking the target of mouse events to a single element and
+  // removing the cursor from view.  Mostly used by the Pointer Lock API.
+  // See https://www.w3.org/TR/pointerlock/ for more info. This call is
+  // also used by Pepper Flash.
+  // |from_user_gesture| indicates whether this request came from a user
+  // gesture or not.
+  // |privileged| is used by Pepper Flash. Privileged mouse lock is only
+  // allowed for fullscreen render widget, which is used to implement Pepper
+  // Flash fullscreen. If privileged is allowed and set to true, we
+  // won't pop up a bubble to ask for user permission or take mouse lock
+  // content into account. The mouse lock will be directly approved.
+  // |unadjusted_movement| indicates whether the request asked for raw mouse
+  // movement data or just what the operating system returns (often accelerated
+  // mouse movement).
+  // |result| kSuccess if the mouse has been locked or the appropriate error
+  // reason if not.
+  // |context| is one end of a mojo pipe that will stay connected as long as
+  // the mouse is locked. Is a NullRemote if |result| is not kSuccess.
+  RequestMouseLock(bool from_user_gesture,
+                   bool privileged,
+                   bool unadjusted_movement)
+      => (PointerLockResult result,
+          pending_remote<blink.mojom.PointerLockContext>? context);
+};
+
+// This interface provides the input actions associated with the FrameWidget.
+// Other input actions may also be dispatched via the WidgetInputHandler
+// interface. If frame input actions are dispatched the WidgetInputHandler
+// should be fetched via the associated interface request so that input calls
+// remain in order. See https://goo.gl/x4ee8A for more details.
+interface FrameWidgetInputHandler {
+  // Sets the text composition to be between the given start and end offsets in
+  // the currently focused editable field.
+  SetCompositionFromExistingText(
+      int32 start, int32 end, array<ui.mojom.ImeTextSpan> ime_text_spans);
+
+  // Deletes the current selection plus the specified number of characters
+  // before and after the selection or caret.
+  ExtendSelectionAndDelete(int32 before, int32 after);
+
+  // Deletes text before and after the current cursor position, excluding the
+  // selection. The lengths are supplied in Java chars (UTF-16 Code Unit),
+  // not in code points or in glyphs.
+  DeleteSurroundingText(int32 before, int32 after);
+
+  // Deletes text before and after the current cursor position, excluding the
+  // selection. The lengths are supplied in code points, not in Java chars
+  // (UTF-16 Code Unit) or in glyphs. Does nothing if there are one or more
+  // invalid surrogate pairs in the requested range
+  DeleteSurroundingTextInCodePoints(int32 before, int32 after);
+
+  // Selects between the given start and end offsets in the currently focused
+  // editable field.
+  SetEditableSelectionOffsets(int32 start, int32 end);
+
+  // Message payload is the name/value of a WebCore edit command to execute.
+  ExecuteEditCommand(string command, mojo_base.mojom.String16? value);
+
+  // These messages are typically generated from context menus and request the
+  // renderer to apply the specified operation to the current selection.
+  Undo();
+  Redo();
+  Cut();
+  Copy();
+  CopyToFindPboard();
+  Paste();
+  PasteAndMatchStyle();
+  Delete();
+  SelectAll();
+  CollapseSelection();
+
+  // Replaces the selected region or a word around the cursor with the
+  // specified string.
+  Replace(mojo_base.mojom.String16 word);
+
+  // Replaces the misspelling in the selected region with the specified string.
+  ReplaceMisspelling(mojo_base.mojom.String16 word);
+
+  // Requests the renderer to select the region between two points.
+  // Expects a SelectRange_ACK message when finished.
+  SelectRange(gfx.mojom.Point base, gfx.mojom.Point extent);
+
+  // Sent by the browser to ask the renderer to adjust the selection start and
+  // end points by the given amounts. A negative amount moves the selection
+  // towards the beginning of the document, a positive amount moves the
+  // selection towards the end of the document. Will send show selection menu
+  // event when needed.
+  AdjustSelectionByCharacterOffset(
+      int32 start, int32 end, SelectionMenuBehavior behavior);
+
+  // Requests the renderer to select word around caret.
+  // Expects ack with new selection information when finished. |start_adjust|
+  // and |end_adjust| are the start and end offset difference between the
+  // current selection and the previous selection (which is a caret).
+  [EnableIf=is_android]
+  SelectWordAroundCaret()
+      => (bool did_select, int32 start_adjust, int32 end_adjust);
+
+  // Requests the renderer to move the selection extent point to a new position.
+  // Expects a MoveRangeSelectionExtent_ACK message when finished.
+  MoveRangeSelectionExtent(gfx.mojom.Point extent);
+
+  // Tells the renderer to scroll the currently focused node into rect only if
+  // the currently focused node is a Text node (textfield, text area or content
+  // editable divs).
+  ScrollFocusedEditableNodeIntoRect(gfx.mojom.Rect rect);
+
+  // Requests the renderer to move the caret selection toward the point.
+  MoveCaret(gfx.mojom.Point point);
+};
+
+// Interface exposed by the renderer to the browser. This class represents
+// an input interface for an associated Widget object. See FrameWidgetInputHandler
+// for an interface at the frame level.
+interface WidgetInputHandler {
+  // Tells widget focus has been changed.
+  SetFocus(bool focused);
+
+  // Tells widget mouse capture has been lost.
+  MouseCaptureLost();
+
+  // This message notifies the renderer that the next key event is bound to one
+  // or more pre-defined edit commands. If the next key event is not handled
+  // by blink, the specified edit commands shall be executed against current
+  // focused frame.
+  // Parameters
+  // * edit_commands
+  //   See t_p/b/renderer/core/editing/commands/editing_command_type.h
+  //   Contains one or more edit commands.
+  // See t_p/b/renderer/core/editing/commands/editor_command.cc for
+  // detailed definition of webkit edit commands.
+  //
+  // This message must be sent just before sending a key event.
+  SetEditCommandsForNextKeyEvent(array<EditCommand> commands);
+
+  // Sends the cursor visibility state to the render widget.
+  CursorVisibilityChanged(bool visible);
+
+  // This message sends a string being composed with an input method.
+  ImeSetComposition(mojo_base.mojom.String16 text,
+                    array<ui.mojom.ImeTextSpan> ime_text_spans,
+                    gfx.mojom.Range range, int32 start, int32 end);
+
+  // This message deletes the current composition, inserts specified text, and
+  // moves the cursor.
+  ImeCommitText(mojo_base.mojom.String16 text,
+                array<ui.mojom.ImeTextSpan> ime_text_spans,
+                gfx.mojom.Range range, int32 relative_cursor_position) => ();
+
+  // This message inserts the ongoing composition.
+  ImeFinishComposingText(bool keep_selection);
+
+  // Request from browser to update text input state.
+  RequestTextInputStateUpdate();
+
+  // Request from browser to update the cursor and composition information which
+  // will be sent through ImeCompositionRangeChanged. Setting
+  // |immediate_request| to true  will lead to an immediate update. If
+  // |monitor_updates| is set to true then changes to text selection or regular
+  // updates in each compositor frame (when there is a change in composition
+  // info) will lead to updates being sent to the browser.
+  RequestCompositionUpdates(bool immediate_request, bool monitor_request);
+
+  // Sends an input event to the render widget. The browser should use this
+  // API if it wants to know about the result of the rendering handling
+  // the event. The callback may be delayed based on the event running on
+  // the main thread so DispatchNonBlockingEvent is always preferred if
+  // you don't require notification.
+  DispatchEvent(Event event)
+      => (blink.mojom.InputEventResultSource source,
+         ui.mojom.LatencyInfo updated_latency,
+         blink.mojom.InputEventResultState state,
+         DidOverscrollParams? overscroll,
+         TouchActionOptional? touch_action);
+
+  // Sends a non-blocking input event to the render widget. The behaviour
+  // of this API is the same as DispatchEvent just that there is no callback
+  // after the event is processed.
+  DispatchNonBlockingEvent(Event event);
+
+  // Forces input to be flushed and resolves the callback only once the input
+  // has been fully processed, meaning its effects are visible to the full
+  // system. In practice, this will force a redraw and wait until the new
+  // CompositorFrame (containing all changes caused by prior input) has been
+  // displayed.
+  WaitForInputProcessed() => ();
+
+  // Attach the synchronous compositor interface. This method only
+  // should be called for Android WebView.
+  AttachSynchronousCompositor(
+      pending_remote<SynchronousCompositorControlHost> control_host,
+      pending_associated_remote<SynchronousCompositorHost> host,
+      pending_associated_receiver<SynchronousCompositor> compositor_request);
+
+  // Return an associated FrameWidgetInputHandler interface so that input
+  // messages to the frame associated with this widget can be sent
+  // serially.
+  GetFrameWidgetInputHandler(
+      pending_associated_receiver<FrameWidgetInputHandler> interface_request);
+};
+
diff --git a/chromium/third_party/blink/public/mojom/input/synchronous_compositor.mojom b/chromium/third_party/blink/public/mojom/input/synchronous_compositor.mojom
new file mode 100644
index 00000000000..04f130f40ad
--- /dev/null
+++ b/chromium/third_party/blink/public/mojom/input/synchronous_compositor.mojom
@@ -0,0 +1,151 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+module blink.mojom;
+
+import "mojo/public/mojom/base/shared_memory.mojom";
+import "mojo/public/mojom/base/time.mojom";
+import "services/viz/public/mojom/compositing/begin_frame_args.mojom";
+import "services/viz/public/mojom/compositing/compositor_frame.mojom";
+import "services/viz/public/mojom/compositing/compositor_frame_metadata.mojom";
+import "services/viz/public/mojom/compositing/frame_timing_details.mojom";
+import "services/viz/public/mojom/compositing/returned_resource.mojom";
+import "services/viz/public/mojom/hit_test/hit_test_region_list.mojom";
+import "ui/gfx/geometry/mojom/geometry.mojom";
+import "ui/gfx/mojom/transform.mojom";
+
+struct SyncCompositorDemandDrawHwParams {
+  gfx.mojom.Size viewport_size;
+  gfx.mojom.Rect viewport_rect_for_tile_priority;
+  gfx.mojom.Transform transform_for_tile_priority;
+};
+
+struct SyncCompositorDemandDrawSwParams {
+  gfx.mojom.Size size;
+  gfx.mojom.Rect clip;
+  gfx.mojom.Transform transform;
+};
+
+struct SyncCompositorCommonRendererParams {
+  uint32 version = 0;
+  gfx.mojom.ScrollOffset total_scroll_offset;
+  gfx.mojom.ScrollOffset max_scroll_offset;
+  gfx.mojom.SizeF scrollable_size;
+  float page_scale_factor = 0;
+  float min_page_scale_factor = 0;
+  float max_page_scale_factor = 0;
+  uint32 need_invalidate_count = 0;
+  bool invalidate_needs_draw = true;
+  uint32 did_activate_pending_tree_count = 0;
+};
+
+// The SynchronousCompositor is an interface that is used by Android Webview
+// which must control the compositor synchronously. It does this so that
+// java UI is drawn in lock step with content renderer by the webview.
+// The SynchronousCompositor is an associated interface with WidgetInputHandler
+// because input must be delivered in order with the compositing events.
+interface SynchronousCompositor {
+  // Hardware draw asynchronously, ReturnFrame will return the result on
+  // the associated SynchronousCompositorControlHost.
+  DemandDrawHwAsync(SyncCompositorDemandDrawHwParams draw_params);
+
+  // Synchronously hardware draws.
+  [Sync]
+  DemandDrawHw(SyncCompositorDemandDrawHwParams draw_params) =>
+      (SyncCompositorCommonRendererParams result,
+       uint32 layer_tree_frame_sink_id,
+       uint32 metadata_version,
+       viz.mojom.CompositorFrame? frame,
+       viz.mojom.HitTestRegionList? hit_test_region_list);
+
+  // Synchronously sets the shared memory used for resourceless software
+  // drawing. This mode just has the renderer send over a single bitmap of the
+  // final frame, rather than sending over individual tiles (ie. resources)
+  // that are then composited by the browser.
+  [Sync]
+  SetSharedMemory(mojo_base.mojom.WritableSharedMemoryRegion shm_region) =>
+      (bool success, SyncCompositorCommonRendererParams result);
+
+  // Synchronously does a software based draw.
+  [Sync] DemandDrawSw(SyncCompositorDemandDrawSwParams draw_params) =>
+      (SyncCompositorCommonRendererParams result,
+       uint32 metadata_version,
+       viz.mojom.CompositorFrameMetadata? meta_data);
+
+  // Instead of drawing, allow the compositor to finish the frame and update
+  // tiles if needed.
+  WillSkipDraw();
+
+  // Zero out the shared memory. This is necessary since most of the time,
+  // viewport size doesn't change between draws, it's cheaper to zero out
+  // and reuse the shared memory, instead of allocating and mapping a new
+  // one each frame.
+  ZeroSharedMemory();
+
+  // Synchronously zoom by adjusting the page scale factor by delta around
+  // the anchor point.
+  [Sync] ZoomBy(float delta, gfx.mojom.Point anchor) =>
+      (SyncCompositorCommonRendererParams result);
+
+  // Adjust the memory policy of the compositor. Explicitly how much the
+  // compositor can use without changing visibility. ie. The limit on
+  // amount of memory used for caching tiles.
+  SetMemoryPolicy(uint32 bytes_limit);
+
+  // Attempt to reclaim resources.
+  ReclaimResources(uint32 layer_tree_frame_sink_id,
+                   array<viz.mojom.ReturnedResource> resources);
+
+  // Adjust the scroll to the given offset.
+  SetScroll(gfx.mojom.ScrollOffset offset);
+
+  // BeginFrame, update will be pushed via SynchronousCompositorControlHost
+  // BeginFrameResponse.
+  // |timing_details| is a map from frame token to FrameTimingDetails.
+  // Frame token is an incrementing id generated by untrusted viz client
+  // (renderer) and sent to viz service (browser) in a frame (see
+  // CompositorFrameMetadata). FrameTimingDetails contains info of viz server
+  // displaying frames, such as time of display. The index of the map is the
+  // frame token of the previously submitted frame that has been displayed.
+  // Note that the viz server might choose to skip display some of the
+  // previously submitted frames; however, feedback about all previously
+  // submitted frames will be sent back once a new frame is displayed.
+  BeginFrame(viz.mojom.BeginFrameArgs args,
+             map<uint32, viz.mojom.FrameTimingDetails> timing_details);
+
+  // Indicates BeginFrame messages are paused.
+  SetBeginFrameSourcePaused(bool paused);
+};
+
+// Interface that runs on the UI thread of the browser. To be used
+// for responses to most messages.
+interface SynchronousCompositorHost {
+  // Indicates the layer tree was created.
+  LayerTreeFrameSinkCreated();
+
+  // Notification of new compositor information.
+  UpdateState(SyncCompositorCommonRendererParams params);
+
+  // Notifies the that a begin frame is needed or not.
+  SetNeedsBeginFrames(bool needs_begin_frames);
+};
+
+// Interface that runs on the IO thread of the browser. To be used for responses
+// to messages that need to wait for the response to be available before
+// execution continues. Typically the browser UI thread will dispatch some
+// messages asynchronously via the SynchronousCompositor interface but then
+// reach a point at which a response must be available. For example the
+// BeginFrame is sent to all attached WebViews but before the Android VSync
+// execution flow (from java) returns the responses from BeginFrames must be
+// received.
+interface SynchronousCompositorControlHost {
+  // Response from DrawHwAsync.
+  ReturnFrame(uint32 layer_tree_frame_sink_id,
+              uint32 metadata_version,
+              viz.mojom.CompositorFrame? frame,
+              viz.mojom.HitTestRegionList? hit_test_region_list);
+
+  // Response from BeginFrame.
+  BeginFrameResponse(SyncCompositorCommonRendererParams params);
+};
diff --git a/chromium/third_party/blink/public/mojom/loader/previews_resource_loading_hints.mojom b/chromium/third_party/blink/public/mojom/loader/previews_resource_loading_hints.mojom
index 9500ba869ad..bc4c7689af6 100644
--- a/chromium/third_party/blink/public/mojom/loader/previews_resource_loading_hints.mojom
+++ b/chromium/third_party/blink/public/mojom/loader/previews_resource_loading_hints.mojom
@@ -4,34 +4,61 @@
 
 module blink.mojom;
 
+import "mojo/public/mojom/base/time.mojom";
+
 // Resource loading hints passed by the browser to renderers. Send at most once
 // per page load from browser to renderer as part of a preview treatment. The
 // hints are provided to the renderer and aid in optimizing the loading of
 // resources.
 struct PreviewsResourceLoadingHints {
-    // SourceId to use when recording UKM for the resource loading hints. This
-    // is based on the browser NavigationHandle's navigation id.
-    int64 ukm_source_id;
-    // List of subresources to block. The list contains the URL patterns of
-    // subresources to block.
-    // TODO(tbansal): https://crbug.com/856243. Update the mojom message below
-    // to match the updated resource loading hints proto.
-    array<string> subresources_to_block;
+  // SourceId to use when recording UKM for the resource loading hints. This
+  // is based on the browser NavigationHandle's navigation id.
+  int64 ukm_source_id;
+  // List of subresources to block. The list contains the URL patterns of
+  // subresources to block.
+  // TODO(tbansal): https://crbug.com/856243. Update the mojom message below
+  // to match the updated resource loading hints proto.
+  array<string> subresources_to_block;
 };
 
 // Image loading hints passed by the browser to renderers. Send at most once
 // per page load from browser to renderer. The hints are provided to the
 // renderer and aid in redirecting these public images to compressed versions.
 struct CompressPublicImagesHints {
-    array<string> image_urls;
+  array<string> image_urls;
+};
+
+// LiteVideo hints passed by the browser to renderers. Send at most once
+// per render frame from browser to renderer. The hints are provided to the
+// renderer and aid in optimizing media data use.
+struct LiteVideoHint {
+  // The number of kilobytes for media to be observed before starting to
+  // throttle requests.
+  int64 kilobytes_to_buffer_before_throttle;
+  // The network downlink bandwidth target in kilobytes per second used to
+  // calculate the throttling delay on media requests.
+  int64 target_downlink_bandwidth_kbps;
+  // The network downlink rtt target in milliseconds used to calculate the
+  // throttling delay on media requests.
+  mojo_base.mojom.TimeDelta  target_downlink_rtt_latency;
+  // The maximum delay a throttle can introduce for a media request.
+  mojo_base.mojom.TimeDelta max_throttling_delay;
 };
 
 // Render process implemented interface that receives hints from the browser
 // about how to load resources.
 interface PreviewsResourceLoadingHintsReceiver {
-    // Sends the resource loading hints from the browser to renderers.
-    SetResourceLoadingHints(PreviewsResourceLoadingHints previews_resource_loading_hints);
+  // Sends the resource loading hints from the browser to renderers.
+  SetResourceLoadingHints(PreviewsResourceLoadingHints previews_resource_loading_hints);
+
+  // Sends the public image URL hints from the browser to renderers.
+  SetCompressPublicImagesHints(CompressPublicImagesHints images_hints);
+
+  // Sends the hints for reducing the data-costs of streaming
+  // media/videos from the browser to renderers.
+  SetLiteVideoHint(LiteVideoHint lite_video_hint);
 
-    // Sends the public image URL hints from the browser to renderers.
-    SetCompressPublicImagesHints(CompressPublicImagesHints images_hints);
+  // Notifies the renderers that active media request throttles should be stopped
+  // and not allow any new throttles.
+  StopThrottlingMediaRequests();
 };
diff --git a/chromium/third_party/blink/public/mojom/loader/url_loader_factory_bundle.mojom b/chromium/third_party/blink/public/mojom/loader/url_loader_factory_bundle.mojom
index 024a5564095..82abe20de0c 100644
--- a/chromium/third_party/blink/public/mojom/loader/url_loader_factory_bundle.mojom
+++ b/chromium/third_party/blink/public/mojom/loader/url_loader_factory_bundle.mojom
@@ -20,18 +20,19 @@ struct URLLoaderFactoryBundle {
   //
   // TODO(jam): https://crbug.com/887109: Remove |default_factory| and put it
   // inside |scheme_specific_factories| instead.
-  network.mojom.URLLoaderFactory? default_factory;
+  pending_remote<network.mojom.URLLoaderFactory>? default_factory;
 
   // A mapping from URL scheme to factory interface.
-  map<string, network.mojom.URLLoaderFactory> scheme_specific_factories;
+  map<string, pending_remote<network.mojom.URLLoaderFactory>>
+      scheme_specific_factories;
 
   // A mapping from isolated world's origin to factory interface.
-  map<url.mojom.Origin, network.mojom.URLLoaderFactory>
+  map<url.mojom.Origin, pending_remote<network.mojom.URLLoaderFactory>>
       isolated_world_factories;
 
   // A special factory that is used for AppCache.
   // TODO(https://crbug.com/582750): Drop this when AppCache is deprecated.
-  network.mojom.URLLoaderFactory? appcache_factory;
+  pending_remote<network.mojom.URLLoaderFactory>? appcache_factory;
 
   // Whether redirect checks should be bypassed, since they are happening in the
   // browser.
diff --git a/chromium/third_party/blink/public/mojom/manifest/manifest.mojom b/chromium/third_party/blink/public/mojom/manifest/manifest.mojom
index 67be7279cc9..a14fa7ea7c3 100644
--- a/chromium/third_party/blink/public/mojom/manifest/manifest.mojom
+++ b/chromium/third_party/blink/public/mojom/manifest/manifest.mojom
@@ -38,6 +38,12 @@ struct Manifest {
   // As such, this field should not be exposed to the drive-by web.
   array<ManifestFileHandler> file_handlers;
 
+  // TODO(crbug.com/1019239): This is going into the mainline manifest spec,
+  // remove the TODO once that PR goes in.
+  // The URLProtocolHandler explainer can be found here:
+  // https://github.com/MicrosoftEdge/MSEdgeExplainers/blob/master/URLProtocolHandler/explainer.md
+  array<ManifestProtocolHandler> protocol_handlers;
+
   array<ManifestRelatedApplication> related_applications;
 
   // A boolean that is used as a hint for the user agent to say that related
@@ -110,6 +116,12 @@ struct ManifestFileFilter {
   array<mojo_base.mojom.String16> accept;
 };
 
+// Structure representing a URL protocol handler.
+struct ManifestProtocolHandler {
+  mojo_base.mojom.String16 protocol;
+  url.mojom.Url url;
+};
+
 // Structure representing a related application.
 struct ManifestRelatedApplication {
   // The platform on which the application can be found. This can be any
diff --git a/chromium/third_party/blink/public/mojom/mediastream/media_devices.mojom b/chromium/third_party/blink/public/mojom/mediastream/media_devices.mojom
index 7a0af779869..38e58926416 100644
--- a/chromium/third_party/blink/public/mojom/mediastream/media_devices.mojom
+++ b/chromium/third_party/blink/public/mojom/mediastream/media_devices.mojom
@@ -32,6 +32,7 @@ struct VideoInputDeviceCapabilities {
   string group_id;
   array<media.mojom.VideoCaptureFormat> formats;
   FacingMode facing_mode;
+  bool pan_tilt_zoom_supported;
 };
 
 struct AudioInputDeviceCapabilities {
diff --git a/chromium/third_party/blink/public/mojom/mediastream/media_stream.mojom b/chromium/third_party/blink/public/mojom/mediastream/media_stream.mojom
index 5f4592da87f..10b7e719f5f 100644
--- a/chromium/third_party/blink/public/mojom/mediastream/media_stream.mojom
+++ b/chromium/third_party/blink/public/mojom/mediastream/media_stream.mojom
@@ -137,7 +137,8 @@ interface MediaStreamDispatcherHost {
                  StreamSelectionInfo audio_stream_selection_info)
       => (MediaStreamRequestResult result, string label,
          array<MediaStreamDevice> audio_devices,
-         array<MediaStreamDevice> video_devices);
+         array<MediaStreamDevice> video_devices,
+         bool pan_tilt_zoom_allowed);
 
   // Cancels the request for a new media stream or opening a device.
   CancelRequest(int32 request_id);
diff --git a/chromium/third_party/blink/public/mojom/native_io/native_io.mojom b/chromium/third_party/blink/public/mojom/native_io/native_io.mojom
index 460936b310f..178b8a11ede 100644
--- a/chromium/third_party/blink/public/mojom/native_io/native_io.mojom
+++ b/chromium/third_party/blink/public/mojom/native_io/native_io.mojom
@@ -66,5 +66,12 @@ interface NativeIOHost {
   [Sync]
   GetAllFileNames() => (bool success, array<string> names);
 
+  // Renames a previously created file.
+  //
+  // Rename does not allow renaming any files that are currently open and does
+  // not override existing files.
+  [Sync]
+  RenameFile(string old_name, string new_name) => (bool success);
+
   // TODO(pwnall): Build quota integration before this API exits Dev Trials.
 };
diff --git a/chromium/third_party/blink/public/mojom/page/page.mojom b/chromium/third_party/blink/public/mojom/page/page.mojom
index 31d22617fbf..eabde32aab3 100644
--- a/chromium/third_party/blink/public/mojom/page/page.mojom
+++ b/chromium/third_party/blink/public/mojom/page/page.mojom
@@ -14,6 +14,7 @@ import "third_party/blink/public/mojom/page/page_visibility_state.mojom";
 struct PageLifecycleState {
   bool is_frozen;
   PageVisibilityState visibility;
+  bool is_in_back_forward_cache;
 };
 
 // Used for broadcast messages from browser to renderer for messages that need
@@ -21,5 +22,5 @@ struct PageLifecycleState {
 // be multiple blink::WebViewImpls when there are out-of-process iframes.
 interface PageBroadcast {
   // Notifies the renderer about a change in the lifecycle state of the page.
-  SetPageLifecycleState(PageLifecycleState state) => ();
+  SetPageLifecycleState(PageLifecycleState state, mojo_base.mojom.TimeTicks? navigation_start) => ();
 };
diff --git a/chromium/third_party/blink/public/mojom/page/widget.mojom b/chromium/third_party/blink/public/mojom/page/widget.mojom
index e1cc600aadc..5b297539bf7 100644
--- a/chromium/third_party/blink/public/mojom/page/widget.mojom
+++ b/chromium/third_party/blink/public/mojom/page/widget.mojom
@@ -4,20 +4,73 @@
 
 module blink.mojom;
 
-import "third_party/blink/public/mojom/frame/intrinsic_sizing_info.mojom";
-import "ui/gfx/geometry/mojom/geometry.mojom";
 import "cc/mojom/touch_action.mojom";
+import "mojo/public/mojom/base/string16.mojom";
+import "mojo/public/mojom/base/text_direction.mojom";
+import "third_party/blink/public/mojom/frame/intrinsic_sizing_info.mojom";
+import "third_party/blink/public/mojom/input/input_handler.mojom";
+import "ui/base/ime/mojom/text_input_state.mojom";
 import "ui/base/cursor/mojom/cursor.mojom";
+import "ui/gfx/geometry/mojom/geometry.mojom";
+
+// "Verb" of a drag-and-drop operation as negotiated between the source and
+// destination. It's typemapped to blink::WebDragOperation.
+enum DragOperation {
+  kNone,
+  kCopy,
+  kLink,
+  kGeneric,
+  kPrivate,
+  kMove,
+  kDelete,
+};
+
+// This struct encodes what drag-and-drop operations are allowed. It's
+// typemapped to blink::WebDragOperationsMask.
+// TODO(https://crbug.com/1082291): Change this to a bitset if/when mojom
+// supports bitset types.
+struct AllowedDragOperations {
+  bool allow_copy;
+  bool allow_link;
+  bool allow_generic;
+  bool allow_private;
+  bool allow_move;
+  bool allow_delete;
+};
 
 // Implemented in Blink, this interface defines frame-widget-specific methods that
 // will be invoked from the browser process (e.g. blink::WebFrameWidget).
 interface FrameWidget {
+  // Drag-and-drop methods:
+  // |point_in_viewport| is the position of the drag event in the viewport
+  // coordinates.
+  // |screen_point| is the absolute position of the mouse pointer.
+
+  // Notifies the Widget of a drag over operation.
+  DragTargetDragOver(gfx.mojom.PointF point_in_viewport,
+                     gfx.mojom.PointF screen_point,
+                     AllowedDragOperations operations_allowed,
+                     uint32 key_modifiers)
+      => (DragOperation operation);
+
+  // Notifies the Widget of a drag leave operation.
+  DragTargetDragLeave(gfx.mojom.PointF point_in_viewport,
+                      gfx.mojom.PointF screen_point);
+
+  // Notifies the Widget that a drag has terminated.
+  DragSourceEndedAt(gfx.mojom.PointF point_in_viewport,
+                    gfx.mojom.PointF screen_point,
+                    DragOperation drag_operation);
+
   // Notifies the Widget that the system drag and drop operation has ended.
   DragSourceSystemDragEnded();
 
   // Makes the Widget background transparent or opaque.
   SetBackgroundOpaque(bool opaque);
 
+  // Changes the text direction of the currently selected input field (if any).
+  SetTextDirection(mojo_base.mojom.TextDirection direction);
+
   // Only valid for sub frame local roots.
   //
   // Sets the inherited effective touch action on an out-of-process iframe.
@@ -73,12 +126,27 @@ interface FrameWidgetHost {
 
   // Sent by a widget to the browser to notify the end of the autoscroll.
   AutoscrollEnd();
+
+  // Sent once a paint happens after the first non empty layout. In other words,
+  // after the frame widget has painted something.
+  DidFirstVisuallyNonEmptyPaint();
 };
 
 // Implemented in Blink, this interface defines widget-specific methods that
 // will be invoked from the browser process (e.g. blink::WebWidget).
 interface Widget {
-  //TODO(dtapuska): Implement more methods.
+  // Sent by the browser to ask the renderer to redraw. Robust to events that
+  // can happen in renderer (abortion of the commit or draw, loss of output
+  // surface etc.).
+  ForceRedraw() => ();
+
+  // Setup the input channel for this widget. If the widget is a frame,
+  // then it can also obtain a FrameWidgetInputHandler from the
+  // WidgetInputHandler interface.
+  GetWidgetInputHandler(
+    pending_receiver<blink.mojom.WidgetInputHandler> request,
+    pending_remote<blink.mojom.WidgetInputHandlerHost> host);
+
 };
 
 // Implemented in Browser, this interface defines widget-specific methods that
@@ -87,4 +155,20 @@ interface WidgetHost {
   // Updates the current cursor to be used by the browser for indicating the
   // location of a pointing device.
   SetCursor(ui.mojom.Cursor cursor);
+
+  // Sent by a widget to the browser to set the tooltip text for the current
+  // mouse position. An empty |tooltip_text| will hide the tooltip view.
+  SetToolTipText(mojo_base.mojom.String16 tooltip_text,
+                 mojo_base.mojom.TextDirection text_direction_hint);
+
+  // Sent when the text input state is changed. This usually happens when
+  // a text input entry is focused.
+  TextInputStateChanged(ui.mojom.TextInputState state);
+
+  // Sent when the current selection bounds are changed.
+  SelectionBoundsChanged(gfx.mojom.Rect anchor_rect,
+             mojo_base.mojom.TextDirection anchor_dir,
+             gfx.mojom.Rect focus_rect,
+             mojo_base.mojom.TextDirection focus_dir,
+             bool is_anchor_first);
 };
diff --git a/chromium/third_party/blink/public/mojom/payments/payment_handler_host.mojom b/chromium/third_party/blink/public/mojom/payments/payment_handler_host.mojom
index 3fabc3e3bb2..5c44304cf4a 100644
--- a/chromium/third_party/blink/public/mojom/payments/payment_handler_host.mojom
+++ b/chromium/third_party/blink/public/mojom/payments/payment_handler_host.mojom
@@ -20,7 +20,7 @@ struct PaymentHandlerMethodData {
   // object, so more specific types cannot be used. A simple example:
   //
   // {"supportedNetworks": ["visa"]}
-  string stringified_data;
+  string? stringified_data;
 };
 
 struct PaymentHandlerModifier {
diff --git a/chromium/third_party/blink/public/mojom/peerconnection/peer_connection_tracker.mojom b/chromium/third_party/blink/public/mojom/peerconnection/peer_connection_tracker.mojom
index aa69be035d4..6e711e30396 100644
--- a/chromium/third_party/blink/public/mojom/peerconnection/peer_connection_tracker.mojom
+++ b/chromium/third_party/blink/public/mojom/peerconnection/peer_connection_tracker.mojom
@@ -6,6 +6,15 @@ module blink.mojom;
 
 import "mojo/public/mojom/base/values.mojom";
 
+// This enum is a typemap of base::PowerObserver::DeviceThermalState.
+enum DeviceThermalState {
+  kUnknown,
+  kNominal,
+  kFair,
+  kSerious,
+  kCritical,
+};
+
 struct PeerConnectionInfo {
   // ID of the peer connection. Unique only within the renderer process.
   int32 lid;
@@ -27,6 +36,9 @@ interface PeerConnectionManager {
     // Called when the browser process reports a suspend event from the OS.
     OnSuspend();
 
+    // Called when the browser process reports a new thermal state from the OS.
+    OnThermalStateChange(DeviceThermalState thermal_state);
+
     // Enable WebRtc event log output.
     StartEventLog(int32 peer_connection_local_id, int32 output_period_ms);
 
diff --git a/chromium/third_party/blink/public/mojom/portal/portal.mojom b/chromium/third_party/blink/public/mojom/portal/portal.mojom
index 2b06ccdfa31..731da408d1b 100644
--- a/chromium/third_party/blink/public/mojom/portal/portal.mojom
+++ b/chromium/third_party/blink/public/mojom/portal/portal.mojom
@@ -4,6 +4,7 @@
 
 module blink.mojom;
 
+import "mojo/public/mojom/base/time.mojom";
 import "mojo/public/mojom/base/unguessable_token.mojom";
 import "third_party/blink/public/mojom/messaging/transferable_message.mojom";
 import "third_party/blink/public/mojom/referrer.mojom";
@@ -50,7 +51,10 @@ interface Portal {
   Navigate(url.mojom.Url url, Referrer referrer) => ();
 
   // When a portal is activated, it'll replace the current tab with the portal.
-  Activate(TransferableMessage data) => (PortalActivateResult result);
+  // |activation_time| represents the time where HTMLPortalElement.activate()
+  // was called.
+  Activate(TransferableMessage data, mojo_base.mojom.TimeTicks activation_time)
+      => (PortalActivateResult result);
 
   // Sends message to the browser process, where it can be forwarded to the
   // portal's main frame. |targetOrigin| indicates which origin the message can
diff --git a/chromium/third_party/blink/public/mojom/serial/serial.mojom b/chromium/third_party/blink/public/mojom/serial/serial.mojom
index 7017262cfaa..daccaaf944d 100644
--- a/chromium/third_party/blink/public/mojom/serial/serial.mojom
+++ b/chromium/third_party/blink/public/mojom/serial/serial.mojom
@@ -11,11 +11,11 @@ struct SerialPortInfo {
   // Opaque identifier for this port.
   mojo_base.mojom.UnguessableToken token;
 
-  // USB or Bluetooth device vendor and product IDs.
-  uint32 vendor_id;
-  bool has_vendor_id;
-  uint16 product_id;
-  bool has_product_id;
+  // USB device properties.
+  uint16 usb_vendor_id;
+  bool has_usb_vendor_id = false;
+  uint16 usb_product_id;
+  bool has_usb_product_id = false;
 };
 
 struct SerialPortFilter {
diff --git a/chromium/third_party/blink/public/mojom/service_worker/service_worker_container.mojom b/chromium/third_party/blink/public/mojom/service_worker/service_worker_container.mojom
index 0d9ee01d3eb..14e6ea0a094 100644
--- a/chromium/third_party/blink/public/mojom/service_worker/service_worker_container.mojom
+++ b/chromium/third_party/blink/public/mojom/service_worker/service_worker_container.mojom
@@ -22,6 +22,14 @@ enum ControllerServiceWorkerPurpose {
   FETCH_SUB_RESOURCE
 };
 
+// Sent from the browser process to the renderer. Contains info needed
+// for a service worker client (window or web worker) to talk with the
+// ServiceWorkerContainerHost in the browser process.
+struct ServiceWorkerContainerInfoForClient {
+  pending_associated_remote<ServiceWorkerContainerHost> host_remote;
+  pending_associated_receiver<ServiceWorkerContainer> client_receiver;
+};
+
 // ServiceWorkerContainerHost is an interface implemented by the browser
 // process. The renderer process uses this interface to request the browser
 // process to do operations involving service worker registrations.
diff --git a/chromium/third_party/blink/public/mojom/service_worker/service_worker_provider.mojom b/chromium/third_party/blink/public/mojom/service_worker/service_worker_provider.mojom
index ea021fc4600..1f9f4ff9bba 100644
--- a/chromium/third_party/blink/public/mojom/service_worker/service_worker_provider.mojom
+++ b/chromium/third_party/blink/public/mojom/service_worker/service_worker_provider.mojom
@@ -17,14 +17,6 @@ import "third_party/blink/public/mojom/service_worker/service_worker_object.mojo
 // and browser.
 const string kNavigation_ServiceWorkerSpec = "navigation:service_worker";
 
-// Sent from the browser process to the renderer. Contains info needed
-// for a service worker client (window or web worker) to talk with the
-// ServiceWorkerContainerHost in the browser process.
-struct ServiceWorkerProviderInfoForClient {
-  pending_associated_remote<ServiceWorkerContainerHost> host_remote;
-  pending_associated_receiver<ServiceWorkerContainer> client_receiver;
-};
-
 // Sent from the browser process to the renderer. Contains parameters used for
 // starting a service worker.
 //
diff --git a/chromium/third_party/blink/public/mojom/speech/speech_synthesis.mojom b/chromium/third_party/blink/public/mojom/speech/speech_synthesis.mojom
index d809847fd85..b9ee56c268c 100644
--- a/chromium/third_party/blink/public/mojom/speech/speech_synthesis.mojom
+++ b/chromium/third_party/blink/public/mojom/speech/speech_synthesis.mojom
@@ -26,7 +26,7 @@ struct SpeechSynthesisVoice {
   bool is_default;
 };
 
-// This interface receives updates to the list of voices. See SpeechSythesis'
+// This interface receives updates to the list of voices. See SpeechSynthesis'
 // AddVoiceListObserver method.
 interface SpeechSynthesisVoiceListObserver {
   // Receives the list of voices that may be used.
diff --git a/chromium/third_party/blink/public/mojom/use_counter/css_property_id.mojom b/chromium/third_party/blink/public/mojom/use_counter/css_property_id.mojom
index 935d69b52dc..0ce2e2383db 100644
--- a/chromium/third_party/blink/public/mojom/use_counter/css_property_id.mojom
+++ b/chromium/third_party/blink/public/mojom/use_counter/css_property_id.mojom
@@ -16,6 +16,7 @@ enum CSSSampleId {
     // These internal properties exist but are mapped to 0 to ensure they don't get
     // reported in use counter.
     kInternalEmptyLineHeight = 0,
+    kInternalForcedBackgroundColorRgb = 0,
     kInternalVisitedBackgroundColor = 0,
     kInternalVisitedBorderBlockEndColor = 0,
     kInternalVisitedBorderBlockStartColor = 0,
@@ -707,6 +708,13 @@ enum CSSSampleId {
     kContentVisibility = 662,
     kTextDecorationThickness = 663,
     kPageOrientation = 664,
+    kAnimationTimeline = 665,
+    kCounterSet = 666,
+    kSource = 667,
+    kStart = 668,
+    kEnd = 669,
+    kTimeRange = 670,
+    kScrollbarGutter = 671,
     // 1. Add new features above this line (don't change the assigned numbers of
     //    the existing items).
     // 2. Run the src/tools/metrics/histograms/update_use_counter_css.py script
diff --git a/chromium/third_party/blink/public/mojom/web_feature/web_feature.mojom b/chromium/third_party/blink/public/mojom/web_feature/web_feature.mojom
index 3a68f6a5117..d97dacebf0b 100644
--- a/chromium/third_party/blink/public/mojom/web_feature/web_feature.mojom
+++ b/chromium/third_party/blink/public/mojom/web_feature/web_feature.mojom
@@ -1845,7 +1845,7 @@ enum WebFeature {
   kV8ExtendableCookieChangeEvent_Deleted_AttributeGetter = 2460,
   kShapeOutsideContentBoxDifferentFromMarginBox = 2461,
   kShapeOutsidePaddingBoxDifferentFromMarginBox = 2462,
-  kCSSContainLayoutPositionedDescendants = 2463,
+  kDeprecatedCSSContainLayoutPositionedDescendants = 2463,
   kCanvasConvertToBlob = 2465,
   kPolymerV1Detected = 2466,
   kPolymerV2Detected = 2467,
@@ -2643,6 +2643,41 @@ enum WebFeature {
   kWebBluetoothRemoteCharacteristicWriteValueWithoutResponse = 3306,
   kFlexGapSpecified = 3307,
   kFlexGapPositive = 3308,
+  kPluginInstanceAccessSuccessful = 3309,
+  kStorageAccessAPI_HasStorageAccess_Method = 3310,
+  kStorageAccessAPI_requestStorageAccess_Method = 3311,
+  kWebBluetoothWatchAdvertisements = 3312,
+  kRubyTextWithNonDefaultTextAlign = 3313,
+  kHTMLMetaElementReferrerPolicyOutsideHead = 3314,
+  kHTMLMetaElementReferrerPolicyMultipleTokens = 3315,
+  kFetchAPINonGetOrHeadOpaqueResponse = 3316,
+  kFetchAPINonGetOrHeadOpaqueResponseWithRedirect = 3317,
+  kDynamicImportModuleScriptRelativeClassicSameOrigin = 3318,
+  kDynamicImportModuleScriptRelativeClassicCrossOrigin = 3319,
+  kV8WasmBulkMemory = 3320,
+  kV8WasmRefTypes = 3321,
+  kV8WasmMultiValue = 3322,
+  kHiddenBackfaceWithPossible3D = 3323,
+  kHiddenBackfaceWithPreserve3D = 3324,
+  kCSSAtRuleScrollTimeline = 3325,
+  kFetchUploadStreaming = 3326,
+  kWebkitLineClampWithoutWebkitBox = 3327,
+  kWebBluetoothGetDevices = 3328,
+  kDialogWithNonZeroScrollOffset = 3329,
+  kDialogHeightLargerThanViewport = 3330,
+  kOverlayPopup = 3331,
+  kContentVisibilityAuto = 3332,
+  kContentVisibilityHidden = 3333,
+  kContentVisibilityHiddenMatchable = 3334,
+  kInlineOverflowAutoWithInlineEndPadding = 3335,
+  kInlineOverflowScrollWithInlineEndPadding = 3336,
+  kCSSSelectorPseudoWebKitDetailsMarker = 3337,
+  kSerialPortGetInfo = 3338,
+  kRTCAdaptivePtime = 3347,
+  kCommaSeparatorInAllowAttribute = 3355,
+  kConversionAPIAll = 3365,
+  kImpressionRegistration = 3366,
+  kConversionRegistration = 3367,
 
   // Add new features immediately above this line. Don't change assigned
   // numbers of any item, and don't reuse removed slots.
diff --git a/chromium/third_party/blink/public/mojom/webauthn/authenticator.mojom b/chromium/third_party/blink/public/mojom/webauthn/authenticator.mojom
index af8e5fea59c..db52c57b1f8 100644
--- a/chromium/third_party/blink/public/mojom/webauthn/authenticator.mojom
+++ b/chromium/third_party/blink/public/mojom/webauthn/authenticator.mojom
@@ -60,6 +60,9 @@ struct CommonCredentialInfo {
   // A blob of data containing the JSON serialization of client data passed
   // to the authenticator.
   array<uint8> client_data_json;
+
+  // A blob of data returned by the authenticator after generating an assertion.
+  array<uint8> authenticator_data;
 };
 
 // Content of user verification method extension returned by
@@ -91,6 +94,14 @@ struct MakeCredentialAuthenticatorResponse {
   bool echo_hmac_create_secret;
   bool hmac_create_secret;
 
+  // The DER-encoded, ASN.1 public key of the newly created credential. May be
+  // missing if the browser does not understand the public-key type.
+  array<uint8>? public_key_der;
+
+  // The COSE algorithm of the newly created credential.
+  // See https://www.iana.org/assignments/cose/cose.xhtml#algorithms
+  int32 public_key_algo;
+
   // Only supported by fido2 devices on android, will eventually supported by
   // other platform.
   // True if getClientExtensionResults() called on the returned
@@ -105,9 +116,6 @@ struct MakeCredentialAuthenticatorResponse {
 struct GetAssertionAuthenticatorResponse {
   CommonCredentialInfo info;
 
-  // A blob of data returned by the authenticator after generating an assertion.
-  array<uint8> authenticator_data;
-
   // Cryptographic signature proving possession of the credential private key.
   array<uint8> signature;
 
diff --git a/chromium/third_party/blink/public/mojom/webtransport/quic_transport_connector.mojom b/chromium/third_party/blink/public/mojom/webtransport/quic_transport_connector.mojom
index 1475cad7db8..569992cae4c 100644
--- a/chromium/third_party/blink/public/mojom/webtransport/quic_transport_connector.mojom
+++ b/chromium/third_party/blink/public/mojom/webtransport/quic_transport_connector.mojom
@@ -12,6 +12,8 @@ import "url/mojom/url.mojom";
 interface QuicTransportConnector {
   // Starts an opening handshake.
   // It is recommended to detect mojo connection errors on |client|.
-  Connect(url.mojom.Url url,
-          pending_remote<network.mojom.QuicTransportHandshakeClient> client);
+  Connect(
+    url.mojom.Url url,
+    array<network.mojom.QuicTransportCertificateFingerprint> fingerprints,
+    pending_remote<network.mojom.QuicTransportHandshakeClient> client);
 };
diff --git a/chromium/third_party/blink/public/mojom/worker/dedicated_worker_host.mojom b/chromium/third_party/blink/public/mojom/worker/dedicated_worker_host.mojom
deleted file mode 100644
index e51186259fd..00000000000
--- a/chromium/third_party/blink/public/mojom/worker/dedicated_worker_host.mojom
+++ /dev/null
@@ -1,15 +0,0 @@
-// Copyright 2019 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-module blink.mojom;
-
-import "third_party/blink/public/mojom/frame/lifecycle.mojom";
-
-// Each dedicated worker has a corresponding host that is implemented in
-// the browser process.
-interface DedicatedWorkerHost {
-  // A dedicated worker's lifecycle state changed because the owning document's
-  // lifecycle state changed as well.
-  LifecycleStateChanged(FrameLifecycleState state);
-};
\ No newline at end of file
diff --git a/chromium/third_party/blink/public/mojom/worker/dedicated_worker_host_factory.mojom b/chromium/third_party/blink/public/mojom/worker/dedicated_worker_host_factory.mojom
index f7f0d99f366..ed455c04e5c 100644
--- a/chromium/third_party/blink/public/mojom/worker/dedicated_worker_host_factory.mojom
+++ b/chromium/third_party/blink/public/mojom/worker/dedicated_worker_host_factory.mojom
@@ -11,10 +11,9 @@ import "third_party/blink/public/mojom/browser_interface_broker.mojom";
 import "third_party/blink/public/mojom/loader/fetch_client_settings_object.mojom";
 import "third_party/blink/public/mojom/worker/subresource_loader_updater.mojom";
 import "third_party/blink/public/mojom/loader/url_loader_factory_bundle.mojom";
-import "third_party/blink/public/mojom/worker/dedicated_worker_host.mojom";
 import "third_party/blink/public/mojom/worker/worker_main_script_load_params.mojom";
 import "third_party/blink/public/mojom/service_worker/controller_service_worker.mojom";
-import "third_party/blink/public/mojom/service_worker/service_worker_provider.mojom";
+import "third_party/blink/public/mojom/service_worker/service_worker_container.mojom";
 import "url/mojom/url.mojom";
 
 // The name of the InterfaceProviderSpec in service manifests used by the
@@ -36,13 +35,13 @@ interface DedicatedWorkerHostFactoryClient {
   // is called after OnWorkerHostCreated(). This is never called when
   // OnScriptLoadStartFailed() is called.
   OnScriptLoadStarted(
-      // The info about the service worker provider in the browser process that
-      // provides support for this worker to be a service worker client.
+      // The info about the service worker container host in the browser process
+      // that provides support for this worker to be a service worker client.
       //
       // This is null if the dedicated worker cannot be a service
       // worker client, because for example, the worker's URL is
       // not http(s) or another service worker supported scheme.
-      ServiceWorkerProviderInfoForClient? service_worker_provider_info,
+      ServiceWorkerContainerInfoForClient? service_worker_container_info,
 
       // Used for passing the main script pre-requested by the browser process
       // and its redirect information.
@@ -76,8 +75,7 @@ interface DedicatedWorkerHostFactory {
   // to provide the worker access to mojo interfaces.
   CreateWorkerHost(
       pending_receiver<blink.mojom.BrowserInterfaceBroker>
-          browser_interface_broker,
-      pending_receiver<DedicatedWorkerHost> host) =>
+          browser_interface_broker) =>
     (network.mojom.CrossOriginEmbedderPolicy parent_coep);
 
   // PlzDedicatedWorker:
@@ -96,6 +94,5 @@ interface DedicatedWorkerHostFactory {
       blink.mojom.FetchClientSettingsObject
           outside_fetch_client_settings_object,
       pending_remote<blink.mojom.BlobURLToken>? blob_url_token,
-      pending_remote<DedicatedWorkerHostFactoryClient> client,
-      pending_receiver<DedicatedWorkerHost> host);
+      pending_remote<DedicatedWorkerHostFactoryClient> client);
 };
diff --git a/chromium/third_party/blink/public/mojom/worker/shared_worker_factory.mojom b/chromium/third_party/blink/public/mojom/worker/shared_worker_factory.mojom
index 51e86217231..c99df95dd23 100644
--- a/chromium/third_party/blink/public/mojom/worker/shared_worker_factory.mojom
+++ b/chromium/third_party/blink/public/mojom/worker/shared_worker_factory.mojom
@@ -11,7 +11,7 @@ import "third_party/blink/public/mojom/loader/url_loader_factory_bundle.mojom";
 import "third_party/blink/public/mojom/renderer_preference_watcher.mojom";
 import "third_party/blink/public/mojom/renderer_preferences.mojom";
 import "third_party/blink/public/mojom/service_worker/controller_service_worker.mojom";
-import "third_party/blink/public/mojom/service_worker/service_worker_provider.mojom";
+import "third_party/blink/public/mojom/service_worker/service_worker_container.mojom";
 import "third_party/blink/public/mojom/worker/shared_worker.mojom";
 import "third_party/blink/public/mojom/worker/shared_worker_host.mojom";
 import "third_party/blink/public/mojom/worker/shared_worker_info.mojom";
@@ -50,13 +50,13 @@ interface SharedWorkerFactory {
       pending_receiver<RendererPreferenceWatcher> preference_watcher_receiver,
       pending_remote<WorkerContentSettingsProxy> content_settings,
 
-      // The info about the service worker provider in the browser process that
-      // provides support for this worker to be a service worker client.
+      // The info about the service worker container host in the browser process
+      // that provides support for this worker to be a service worker client.
       //
       // This is null if the shared worker cannot be a service
       // worker client, because for example, the worker's URL is
       // not http(s) or another service worker supported scheme.
-      ServiceWorkerProviderInfoForClient? service_worker_provider_info,
+      ServiceWorkerContainerInfoForClient? service_worker_container_info,
 
       // The ID of the AppCacheHost in the browser process that serves resources
       // for this shared worker. This is not specified when AppCache doesn't
diff --git a/chromium/third_party/blink/public/platform/DEPS b/chromium/third_party/blink/public/platform/DEPS
index 95d41b2560d..82a64c84b99 100644
--- a/chromium/third_party/blink/public/platform/DEPS
+++ b/chromium/third_party/blink/public/platform/DEPS
@@ -1,7 +1,7 @@
 include_rules = [
     "+base/atomicops.h",
-    "+base/callback.h",
-    "+base/callback_forward.h",
+    "+base/check.h",
+    "+base/check_op.h",
     "+base/containers/flat_set.h",
     "+base/containers/span.h",
     "+base/files/file.h",
@@ -13,6 +13,7 @@ include_rules = [
     "+base/memory/scoped_refptr.h",
     "+base/memory/weak_ptr.h",
     "+base/metrics",
+    "+base/notreached.h",
     "+base/optional.h",
     "+base/single_thread_task_runner.h",
     "+base/strings",
@@ -43,9 +44,11 @@ include_rules = [
     "+services/network/public/mojom/blocked_by_response_reason.mojom-shared.h",
     "+services/network/public/mojom/content_security_policy.mojom-shared.h",
     "+services/network/public/mojom/cors.mojom-shared.h",
+    "+services/network/public/mojom/data_pipe_getter.mojom-shared.h",
     "+services/network/public/mojom/fetch_api.mojom-shared.h",
     "+services/network/public/mojom/referrer_policy.mojom-shared.h",
     "+services/network/public/mojom/trust_tokens.mojom-shared.h",
+    "+services/network/public/mojom/url_loader_factory.mojom-shared.h",
     "+services/network/public/mojom/web_client_hints_types.mojom-shared.h",
 
     "+services/service_manager/public/mojom",
@@ -55,6 +58,7 @@ include_rules = [
     "-third_party/blink/renderer/bindings",
     "+third_party/skia",
     "+ui/base/ime/text_input_action.h",
+    "+ui/base/ime/mojom/virtual_keyboard_types.mojom-shared.h",
     "+ui/base/page_transition_types.h",
     "+ui/base/resource/scale_factor.h",
     "+ui/events/types",
diff --git a/chromium/third_party/blink/public/platform/cross_variant_mojo_util.h b/chromium/third_party/blink/public/platform/cross_variant_mojo_util.h
index a3a6d80875d..89a84911648 100644
--- a/chromium/third_party/blink/public/platform/cross_variant_mojo_util.h
+++ b/chromium/third_party/blink/public/platform/cross_variant_mojo_util.h
@@ -46,7 +46,6 @@
 #include <type_traits>
 #include <utility>
 
-#include "base/logging.h"
 #include "mojo/public/cpp/bindings/pending_associated_receiver.h"
 #include "mojo/public/cpp/bindings/pending_associated_remote.h"
 #include "mojo/public/cpp/bindings/pending_receiver.h"
@@ -81,6 +80,8 @@ class CrossVariantMojoReceiver {
 
   CrossVariantMojoReceiver(const mojo::NullReceiver&) {}
 
+  explicit operator bool() const { return pipe_.is_valid(); }
+
  private:
   friend struct mojo::PendingReceiverConverter<CrossVariantMojoReceiver>;
 
@@ -109,6 +110,8 @@ class CrossVariantMojoRemote {
 
   CrossVariantMojoRemote(const mojo::NullRemote&) {}
 
+  explicit operator bool() const { return pipe_.is_valid(); }
+
  private:
   friend struct mojo::PendingRemoteConverter<CrossVariantMojoRemote>;
 
@@ -127,10 +130,10 @@ class CrossVariantMojoAssociatedReceiver {
   CrossVariantMojoAssociatedReceiver() = default;
   ~CrossVariantMojoAssociatedReceiver() = default;
 
-  CrossVariantMojoAssociatedReceiver(
-      CrossVariantMojoAssociatedReceiver&&) noexcept = default;
+  CrossVariantMojoAssociatedReceiver(CrossVariantMojoAssociatedReceiver&&) =
+      default;
   CrossVariantMojoAssociatedReceiver& operator=(
-      CrossVariantMojoAssociatedReceiver&&) noexcept = default;
+      CrossVariantMojoAssociatedReceiver&&) = default;
 
   CrossVariantMojoAssociatedReceiver(
       const CrossVariantMojoAssociatedReceiver&) = delete;
@@ -147,6 +150,8 @@ class CrossVariantMojoAssociatedReceiver {
 
   CrossVariantMojoAssociatedReceiver(const mojo::NullAssociatedReceiver&) {}
 
+  explicit operator bool() const { return handle_.is_valid(); }
+
  private:
   friend struct mojo::PendingAssociatedReceiverConverter<
       CrossVariantMojoAssociatedReceiver>;
@@ -160,10 +165,10 @@ class CrossVariantMojoAssociatedRemote {
   CrossVariantMojoAssociatedRemote() = default;
   ~CrossVariantMojoAssociatedRemote() = default;
 
-  CrossVariantMojoAssociatedRemote(
-      CrossVariantMojoAssociatedRemote&&) noexcept = default;
+  CrossVariantMojoAssociatedRemote(CrossVariantMojoAssociatedRemote&&) =
+      default;
   CrossVariantMojoAssociatedRemote& operator=(
-      CrossVariantMojoAssociatedRemote&&) noexcept = default;
+      CrossVariantMojoAssociatedRemote&&) = default;
 
   CrossVariantMojoAssociatedRemote(const CrossVariantMojoAssociatedRemote&) =
       delete;
@@ -180,6 +185,8 @@ class CrossVariantMojoAssociatedRemote {
 
   CrossVariantMojoAssociatedRemote(const mojo::NullAssociatedRemote&) {}
 
+  explicit operator bool() const { return handle_.is_valid(); }
+
  private:
   friend struct mojo::PendingAssociatedRemoteConverter<
       CrossVariantMojoAssociatedRemote>;
diff --git a/chromium/third_party/blink/public/platform/input/input_handler_proxy.h b/chromium/third_party/blink/public/platform/input/input_handler_proxy.h
index 0c98a0dad18..f0483ade089 100644
--- a/chromium/third_party/blink/public/platform/input/input_handler_proxy.h
+++ b/chromium/third_party/blink/public/platform/input/input_handler_proxy.h
@@ -10,6 +10,8 @@
 #include "base/macros.h"
 #include "cc/input/input_handler.h"
 #include "cc/input/snap_fling_controller.h"
+#include "cc/paint/element_id.h"
+#include "third_party/blink/public/common/input/web_coalesced_input_event.h"
 #include "third_party/blink/public/common/input/web_gesture_event.h"
 #include "third_party/blink/public/platform/input/elastic_overscroll_controller.h"
 #include "third_party/blink/public/platform/input/synchronous_input_handler_proxy.h"
@@ -36,6 +38,7 @@ class InputHandlerProxyTest;
 class InputHandlerProxyEventQueueTest;
 class InputHandlerProxyMomentumScrollJankTest;
 class TestInputHandlerProxy;
+class UnifiedScrollingInputHandlerProxyTest;
 }  // namespace test
 
 class CompositorThreadEventQueue;
@@ -124,16 +127,31 @@ class BLINK_PLATFORM_EXPORT InputHandlerProxy
     // pass it to the next consumer (either overscrolling or bubbling the event
     // to the next renderer).
     DID_HANDLE_SHOULD_BUBBLE,
+
+    // Used only in scroll unification; the compositor couldn't determine the
+    // scroll node to handle the event and requires a second try with an
+    // ElementId provided by a hit test in Blink.
+    REQUIRES_MAIN_THREAD_HIT_TEST,
   };
-  using EventDispositionCallback =
-      base::OnceCallback<void(EventDisposition,
-                              WebScopedInputEvent WebInputEvent,
-                              const ui::LatencyInfo&,
-                              std::unique_ptr<DidOverscrollParams>,
-                              const blink::WebInputEventAttribution&)>;
-  void HandleInputEventWithLatencyInfo(WebScopedInputEvent event,
-                                       const ui::LatencyInfo& latency_info,
-                                       EventDispositionCallback callback);
+  using EventDispositionCallback = base::OnceCallback<void(
+      EventDisposition,
+      std::unique_ptr<blink::WebCoalescedInputEvent> event,
+      std::unique_ptr<DidOverscrollParams>,
+      const blink::WebInputEventAttribution&)>;
+  void HandleInputEventWithLatencyInfo(
+      std::unique_ptr<blink::WebCoalescedInputEvent> event,
+      EventDispositionCallback callback);
+
+  // In scroll unification, a scroll begin event may initially return unhandled
+  // due to requiring the main thread to perform a hit test. In that case, the
+  // client will perform the hit test by calling into Blink. When it has a
+  // result, it can try handling the event again by calling back through this
+  // method.
+  void ContinueScrollBeginAfterMainThreadHitTest(
+      std::unique_ptr<blink::WebCoalescedInputEvent> event,
+      EventDispositionCallback callback,
+      cc::ElementIdType hit_tests_result);
+
   void InjectScrollbarGestureScroll(
       const blink::WebInputEvent::Type type,
       const gfx::PointF& position_in_widget,
@@ -194,6 +212,7 @@ class BLINK_PLATFORM_EXPORT InputHandlerProxy
  private:
   friend class test::TestInputHandlerProxy;
   friend class test::InputHandlerProxyTest;
+  friend class test::UnifiedScrollingInputHandlerProxyTest;
   friend class test::InputHandlerProxyEventQueueTest;
   friend class test::InputHandlerProxyMomentumScrollJankTest;
 
@@ -235,13 +254,11 @@ class BLINK_PLATFORM_EXPORT InputHandlerProxy
   void SetTickClockForTesting(const base::TickClock* tick_clock);
 
   // |is_touching_scrolling_layer| indicates if one of the points that has
-  // been touched hits a currently scrolling layer.
-  // |white_listed_touch_action| is the touch_action we are sure will be
-  // allowed for the given touch event.
-  EventDisposition HitTestTouchEvent(
-      const blink::WebTouchEvent& touch_event,
-      bool* is_touching_scrolling_layer,
-      cc::TouchAction* white_listed_touch_action);
+  // been touched hits a currently scrolling layer. |allowed_touch_action| is
+  // the touch_action we are sure will be allowed for the given touch event.
+  EventDisposition HitTestTouchEvent(const blink::WebTouchEvent& touch_event,
+                                     bool* is_touching_scrolling_layer,
+                                     cc::TouchAction* allowed_touch_action);
 
   EventDisposition RouteToTypeSpecificHandler(
       EventWithCallback* event_with_callback,
@@ -316,6 +333,14 @@ class BLINK_PLATFORM_EXPORT InputHandlerProxy
   bool skip_touch_filter_discrete_ = false;
   bool skip_touch_filter_all_ = false;
 
+  // This bit is set when the input handler proxy has requested that the client
+  // perform a hit test for a scroll begin on the main thread. During that
+  // time, scroll updates need to be queued. The reply from the main thread
+  // will come by calling ContinueScrollBeginAfterMainThreadHitTest where the
+  // queue will be flushed and this bit cleared. Used only in scroll
+  // unification.
+  bool hit_testing_scroll_begin_on_main_thread_ = false;
+
   // Helpers for the momentum scroll jank UMAs.
   std::unique_ptr<MomentumScrollJankTracker> momentum_scroll_jank_tracker_;
 
diff --git a/chromium/third_party/blink/public/platform/input/input_handler_proxy_client.h b/chromium/third_party/blink/public/platform/input/input_handler_proxy_client.h
index 3df11514323..db45659f4a2 100644
--- a/chromium/third_party/blink/public/platform/input/input_handler_proxy_client.h
+++ b/chromium/third_party/blink/public/platform/input/input_handler_proxy_client.h
@@ -5,19 +5,13 @@
 #ifndef THIRD_PARTY_BLINK_PUBLIC_PLATFORM_INPUT_INPUT_HANDLER_PROXY_CLIENT_H_
 #define THIRD_PARTY_BLINK_PUBLIC_PLATFORM_INPUT_INPUT_HANDLER_PROXY_CLIENT_H_
 
-namespace ui {
-class LatencyInfo;
-}
-
 namespace blink {
-class WebInputEvent;
+class WebCoalescedInputEvent;
 class WebGestureEvent;
 
 // All callbacks invoked from the compositor thread.
 class InputHandlerProxyClient {
  public:
-  using WebScopedInputEvent = std::unique_ptr<blink::WebInputEvent>;
-
   // Called just before the InputHandlerProxy shuts down.
   virtual void WillShutdown() = 0;
 
@@ -25,8 +19,7 @@ class InputHandlerProxyClient {
   // gesture fling from a touchpad is processed and the target only has
   // passive event listeners.
   virtual void DispatchNonBlockingEventToMainThread(
-      WebScopedInputEvent event,
-      const ui::LatencyInfo& latency_info,
+      std::unique_ptr<WebCoalescedInputEvent> event,
       const blink::WebInputEventAttribution& attribution) = 0;
 
   virtual void DidAnimateForInput() = 0;
@@ -39,7 +32,7 @@ class InputHandlerProxyClient {
       const blink::WebGestureEvent& update_event,
       const blink::WebInputEventAttribution& attribution) = 0;
 
-  virtual void SetWhiteListedTouchAction(
+  virtual void SetAllowedTouchAction(
       cc::TouchAction touch_action,
       uint32_t unique_touch_event_id,
       InputHandlerProxy::EventDisposition event_disposition) = 0;
diff --git a/chromium/third_party/blink/public/platform/interface_registry.h b/chromium/third_party/blink/public/platform/interface_registry.h
index 98ec80f2071..73c378e9f6e 100644
--- a/chromium/third_party/blink/public/platform/interface_registry.h
+++ b/chromium/third_party/blink/public/platform/interface_registry.h
@@ -56,15 +56,16 @@ class BLINK_PLATFORM_EXPORT InterfaceRegistry {
   }
 
   template <typename Interface>
-  void AddInterface(WTF::CrossThreadRepeatingFunction<
-                        void(mojo::PendingReceiver<Interface>)> factory,
-                    scoped_refptr<base::SingleThreadTaskRunner> task_runner) {
-    AddInterface(Interface::Name_,
-                 ConvertToBaseRepeatingCallback(CrossThreadBind(
-                     &InterfaceRegistry::ForwardToCrossThreadInterfaceFactory<
-                         mojo::PendingReceiver<Interface>>,
-                     std::move(factory))),
-                 std::move(task_runner));
+  void AddInterface(
+      base::RepeatingCallback<void(mojo::PendingReceiver<Interface>)> factory,
+      scoped_refptr<base::SingleThreadTaskRunner> task_runner) {
+    DCHECK(task_runner->RunsTasksInCurrentSequence());
+    AddInterface(
+        Interface::Name_,
+        WTF::BindRepeating(&InterfaceRegistry::ForwardToInterfaceFactory<
+                               mojo::PendingReceiver<Interface>>,
+                           std::move(factory)),
+        std::move(task_runner));
   }
 
   template <typename Interface>
@@ -88,13 +89,6 @@ class BLINK_PLATFORM_EXPORT InterfaceRegistry {
   }
 
   template <typename MojoType>
-  static void ForwardToCrossThreadInterfaceFactory(
-      const WTF::CrossThreadRepeatingFunction<void(MojoType)>& factory,
-      mojo::ScopedMessagePipeHandle handle) {
-    factory.Run(MojoType(std::move(handle)));
-  }
-
-  template <typename MojoType>
   static void ForwardToAssociatedInterfaceFactory(
       base::RepeatingCallback<void(MojoType)> factory,
       mojo::ScopedInterfaceEndpointHandle handle) {
diff --git a/chromium/third_party/blink/public/platform/media/webmediaplayer_delegate.h b/chromium/third_party/blink/public/platform/media/webmediaplayer_delegate.h
index 3dffdc08621..ff7a2a7cfbe 100644
--- a/chromium/third_party/blink/public/platform/media/webmediaplayer_delegate.h
+++ b/chromium/third_party/blink/public/platform/media/webmediaplayer_delegate.h
@@ -125,6 +125,9 @@ class BLINK_PLATFORM_EXPORT WebMediaPlayerDelegate {
   virtual void DidPictureInPictureAvailabilityChange(int delegate_id,
                                                      bool available) = 0;
 
+  // Notify that a buffer underflow event happened for the media player.
+  virtual void DidBufferUnderflow(int player_id) = 0;
+
   // Notify that playback is stopped. This will drop wake locks and remove any
   // external controls.
   //
diff --git a/chromium/third_party/blink/public/platform/modules/installedapp/OWNERS b/chromium/third_party/blink/public/platform/modules/installedapp/OWNERS
deleted file mode 100644
index 065b1322ca1..00000000000
--- a/chromium/third_party/blink/public/platform/modules/installedapp/OWNERS
+++ /dev/null
@@ -1,3 +0,0 @@
-mgiuca@chromium.org
-
-# COMPONENT: Platform>Apps>AppLauncher>Install
diff --git a/chromium/third_party/blink/public/platform/modules/service_worker/web_service_worker_network_provider.h b/chromium/third_party/blink/public/platform/modules/service_worker/web_service_worker_network_provider.h
index 672e14d0f07..77a772db19c 100644
--- a/chromium/third_party/blink/public/platform/modules/service_worker/web_service_worker_network_provider.h
+++ b/chromium/third_party/blink/public/platform/modules/service_worker/web_service_worker_network_provider.h
@@ -34,8 +34,9 @@
 #include <memory>
 
 #include "base/memory/scoped_refptr.h"
-#include "mojo/public/cpp/system/message_pipe.h"
 #include "third_party/blink/public/mojom/service_worker/controller_service_worker_mode.mojom-shared.h"
+#include "third_party/blink/public/mojom/timing/worker_timing_container.mojom-shared.h"
+#include "third_party/blink/public/platform/cross_variant_mojo_util.h"
 #include "third_party/blink/public/platform/scheduler/web_resource_loading_task_runner_handle.h"
 #include "third_party/blink/public/platform/web_url_loader.h"
 
@@ -78,11 +79,11 @@ class WebServiceWorkerNetworkProvider {
   // idle signal.
   virtual void DispatchNetworkQuiet() = 0;
 
-  // Returns mojo::PendingReceiver<blink::mojom::blink::WorkerTimingContainer>
-  // for the blink::ResourceResponse with the given |request_id|. Null if the
-  // request has not been intercepted by a service worker.
-  virtual mojo::ScopedMessagePipeHandle TakePendingWorkerTimingReceiver(
-      int request_id) = 0;
+  // Returns the blink::mojom::WorkerTimingContainer receiver for the
+  // blink::ResourceResponse with the given |request_id|. Null if the request
+  // has not been intercepted by a service worker.
+  virtual CrossVariantMojoReceiver<mojom::WorkerTimingContainerInterfaceBase>
+  TakePendingWorkerTimingReceiver(int request_id) = 0;
 };
 
 }  // namespace blink
diff --git a/chromium/third_party/blink/public/platform/platform.h b/chromium/third_party/blink/public/platform/platform.h
index 6c813f0484f..3278250b6d3 100644
--- a/chromium/third_party/blink/public/platform/platform.h
+++ b/chromium/third_party/blink/public/platform/platform.h
@@ -44,15 +44,16 @@
 #include "media/base/audio_renderer_sink.h"
 #include "mojo/public/cpp/base/big_buffer.h"
 #include "mojo/public/cpp/bindings/generic_pending_receiver.h"
-#include "mojo/public/cpp/system/data_pipe.h"
 #include "mojo/public/cpp/system/message_pipe.h"
 #include "services/network/public/cpp/shared_url_loader_factory.h"
+#include "services/network/public/mojom/url_loader_factory.mojom-shared.h"
 #include "third_party/blink/public/common/feature_policy/feature_policy.h"
 #include "third_party/blink/public/common/user_agent/user_agent_metadata.h"
 #include "third_party/blink/public/mojom/loader/code_cache.mojom-shared.h"
 #include "third_party/blink/public/platform/audio/web_audio_device_source_type.h"
 #include "third_party/blink/public/platform/blame_context.h"
 #include "third_party/blink/public/platform/code_cache_loader.h"
+#include "third_party/blink/public/platform/cross_variant_mojo_util.h"
 #include "third_party/blink/public/platform/user_metrics_action.h"
 #include "third_party/blink/public/platform/web_audio_device.h"
 #include "third_party/blink/public/platform/web_common.h"
@@ -108,7 +109,6 @@ class WebPublicSuffixList;
 class WebSandboxSupport;
 class WebSecurityOrigin;
 class WebThemeEngine;
-class WebURLLoaderMockFactory;
 class WebURLResponse;
 class WebURLResponse;
 class WebVideoCaptureImplManager;
@@ -181,6 +181,12 @@ class BLINK_PLATFORM_EXPORT Platform {
   virtual size_t AudioHardwareBufferSize() { return 0; }
   virtual unsigned AudioHardwareOutputChannels() { return 0; }
 
+  // SavableResource ----------------------------------------------------
+
+  virtual bool IsURLSavableForSavableResource(const WebURL& url) {
+    return false;
+  }
+
   // Creates a device for audio I/O.
   // Pass in (number_of_input_channels > 0) if live/local audio input is
   // desired.
@@ -275,7 +281,8 @@ class BLINK_PLATFORM_EXPORT Platform {
   // Returns a new WebURLLoaderFactory that wraps the given
   // network::mojom::URLLoaderFactory.
   virtual std::unique_ptr<WebURLLoaderFactory> WrapURLLoaderFactory(
-      mojo::ScopedMessagePipeHandle url_loader_factory_handle) {
+      CrossVariantMojoRemote<network::mojom::URLLoaderFactoryInterfaceBase>
+          url_loader_factory) {
     return nullptr;
   }
 
@@ -429,11 +436,6 @@ class BLINK_PLATFORM_EXPORT Platform {
   }
   // Testing -------------------------------------------------------------
 
-  // Gets a pointer to URLLoaderMockFactory for testing. Will not be available
-  // in production builds.
-  // TODO(kinuko,toyoshim): Deprecate this one. (crbug.com/751425)
-  virtual WebURLLoaderMockFactory* GetURLLoaderMockFactory() { return nullptr; }
-
   // Record a UMA sequence action.  The UserMetricsAction construction must
   // be on a single line for extract_actions.py to find it.  Please see
   // that script for more details.  Intended use is:
diff --git a/chromium/third_party/blink/public/platform/scheduler/DEPS b/chromium/third_party/blink/public/platform/scheduler/DEPS
index e4bbc967b96..27297648267 100644
--- a/chromium/third_party/blink/public/platform/scheduler/DEPS
+++ b/chromium/third_party/blink/public/platform/scheduler/DEPS
@@ -1,6 +1,5 @@
 include_rules = [
     "+base/bind.h",
-    "+base/callback.h",
     "+base/location.h",
     "+base/macros.h",
     "+base/memory/ptr_util.h",
diff --git a/chromium/third_party/blink/public/platform/shape_properties.h b/chromium/third_party/blink/public/platform/shape_properties.h
deleted file mode 100644
index 8edf737f11e..00000000000
--- a/chromium/third_party/blink/public/platform/shape_properties.h
+++ /dev/null
@@ -1,18 +0,0 @@
-// Copyright 2016 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef THIRD_PARTY_BLINK_PUBLIC_PLATFORM_SHAPE_PROPERTIES_H_
-#define THIRD_PARTY_BLINK_PUBLIC_PLATFORM_SHAPE_PROPERTIES_H_
-
-namespace blink {
-
-// Bit field values indicating available display shapes.
-enum DisplayShape {
-  kDisplayShapeRect = 1 << 0,
-  kDisplayShapeRound = 1 << 1,
-};
-
-}  // namespace blink
-
-#endif
diff --git a/chromium/third_party/blink/public/platform/viewport_intersection_state.h b/chromium/third_party/blink/public/platform/viewport_intersection_state.h
index 16f04bddcef..071ac5f1e3f 100644
--- a/chromium/third_party/blink/public/platform/viewport_intersection_state.h
+++ b/chromium/third_party/blink/public/platform/viewport_intersection_state.h
@@ -39,9 +39,7 @@ struct BLINK_PLATFORM_EXPORT ViewportIntersectionState {
            compositor_visible_rect == other.compositor_visible_rect &&
            occlusion_state == other.occlusion_state &&
            main_frame_viewport_size == other.main_frame_viewport_size &&
-           main_frame_scroll_offset == other.main_frame_scroll_offset &&
-           can_skip_sticky_frame_tracking ==
-               other.can_skip_sticky_frame_tracking;
+           main_frame_scroll_offset == other.main_frame_scroll_offset;
   }
   bool operator!=(const ViewportIntersectionState& other) const {
     return !(*this == other);
@@ -63,10 +61,6 @@ struct BLINK_PLATFORM_EXPORT ViewportIntersectionState {
   WebSize main_frame_viewport_size;
   // Main frame's scrolling offset.
   gfx::Point main_frame_scroll_offset;
-  // Indicates whether to force an intersection observation update in
-  // LocalFrame::SetViewportIntersectionFromParent in order to track sticky
-  // frames, or whether we could skip it.
-  bool can_skip_sticky_frame_tracking = false;
 };
 
 }  // namespace blink
diff --git a/chromium/third_party/blink/public/platform/web_audio_latency_hint.h b/chromium/third_party/blink/public/platform/web_audio_latency_hint.h
index df3201bdd4b..cb72273e223 100644
--- a/chromium/third_party/blink/public/platform/web_audio_latency_hint.h
+++ b/chromium/third_party/blink/public/platform/web_audio_latency_hint.h
@@ -5,7 +5,8 @@
 #ifndef THIRD_PARTY_BLINK_PUBLIC_PLATFORM_WEB_AUDIO_LATENCY_HINT_H_
 #define THIRD_PARTY_BLINK_PUBLIC_PLATFORM_WEB_AUDIO_LATENCY_HINT_H_
 
-#include "base/logging.h"
+#include "base/check_op.h"
+#include "base/notreached.h"
 #include "third_party/blink/public/platform/web_string.h"
 
 namespace blink {
diff --git a/chromium/third_party/blink/public/platform/web_blob_info.h b/chromium/third_party/blink/public/platform/web_blob_info.h
index 82f59c0c195..5d864206928 100644
--- a/chromium/third_party/blink/public/platform/web_blob_info.h
+++ b/chromium/third_party/blink/public/platform/web_blob_info.h
@@ -5,7 +5,8 @@
 #ifndef THIRD_PARTY_BLINK_PUBLIC_PLATFORM_WEB_BLOB_INFO_H_
 #define THIRD_PARTY_BLINK_PUBLIC_PLATFORM_WEB_BLOB_INFO_H_
 
-#include "mojo/public/cpp/system/message_pipe.h"
+#include "third_party/blink/public/mojom/blob/blob.mojom-shared.h"
+#include "third_party/blink/public/platform/cross_variant_mojo_util.h"
 #include "third_party/blink/public/platform/web_common.h"
 #include "third_party/blink/public/platform/web_private_ptr.h"
 #include "third_party/blink/public/platform/web_string.h"
@@ -21,13 +22,13 @@ class WebBlobInfo {
   BLINK_EXPORT WebBlobInfo(const WebString& uuid,
                            const WebString& type,
                            uint64_t size,
-                           mojo::ScopedMessagePipeHandle);
+                           CrossVariantMojoRemote<mojom::BlobInterfaceBase>);
   BLINK_EXPORT WebBlobInfo(const WebString& uuid,
                            const WebString& file_name,
                            const WebString& type,
                            const base::Optional<base::Time>& last_modified,
                            uint64_t size,
-                           mojo::ScopedMessagePipeHandle);
+                           CrossVariantMojoRemote<mojom::BlobInterfaceBase>);
 
   // For testing purposes, these two methods create a WebBlobInfo connected to a
   // dangling mojo message pipe. This means that any operations that actually
@@ -51,7 +52,8 @@ class WebBlobInfo {
   uint64_t size() const { return size_; }
   const WebString& FileName() const { return file_name_; }
   base::Optional<base::Time> LastModified() const { return last_modified_; }
-  BLINK_EXPORT mojo::ScopedMessagePipeHandle CloneBlobHandle() const;
+  BLINK_EXPORT CrossVariantMojoRemote<mojom::BlobInterfaceBase>
+  CloneBlobRemote() const;
 
 #if INSIDE_BLINK
   BLINK_EXPORT WebBlobInfo(scoped_refptr<BlobDataHandle>);
diff --git a/chromium/third_party/blink/public/platform/web_content_decryption_module.h b/chromium/third_party/blink/public/platform/web_content_decryption_module.h
index 7c941495302..4fbfe76a8f9 100644
--- a/chromium/third_party/blink/public/platform/web_content_decryption_module.h
+++ b/chromium/third_party/blink/public/platform/web_content_decryption_module.h
@@ -43,8 +43,8 @@ class BLINK_PLATFORM_EXPORT WebContentDecryptionModule {
   virtual ~WebContentDecryptionModule();
 
   // Must return non-null.
-  virtual std::unique_ptr<WebContentDecryptionModuleSession>
-  CreateSession() = 0;
+  virtual std::unique_ptr<WebContentDecryptionModuleSession> CreateSession(
+      WebEncryptedMediaSessionType session_type) = 0;
 
   virtual void SetServerCertificate(const unsigned char* certificate,
                                     size_t certificate_length,
diff --git a/chromium/third_party/blink/public/platform/web_content_decryption_module_session.h b/chromium/third_party/blink/public/platform/web_content_decryption_module_session.h
index c88d5e541a0..609d7c34d78 100644
--- a/chromium/third_party/blink/public/platform/web_content_decryption_module_session.h
+++ b/chromium/third_party/blink/public/platform/web_content_decryption_module_session.h
@@ -88,7 +88,6 @@ class BLINK_PLATFORM_EXPORT WebContentDecryptionModuleSession {
   virtual void InitializeNewSession(media::EmeInitDataType,
                                     const unsigned char* init_data,
                                     size_t init_data_length,
-                                    WebEncryptedMediaSessionType,
                                     WebContentDecryptionModuleResult) = 0;
   virtual void Load(const WebString& session_id,
                     WebContentDecryptionModuleResult) = 0;
diff --git a/chromium/third_party/blink/public/platform/web_crypto_algorithm_params.h b/chromium/third_party/blink/public/platform/web_crypto_algorithm_params.h
index c8acc9bd586..1a0fbb1a0e8 100644
--- a/chromium/third_party/blink/public/platform/web_crypto_algorithm_params.h
+++ b/chromium/third_party/blink/public/platform/web_crypto_algorithm_params.h
@@ -31,7 +31,7 @@
 #ifndef THIRD_PARTY_BLINK_PUBLIC_PLATFORM_WEB_CRYPTO_ALGORITHM_PARAMS_H_
 #define THIRD_PARTY_BLINK_PUBLIC_PLATFORM_WEB_CRYPTO_ALGORITHM_PARAMS_H_
 
-#include "base/logging.h"
+#include "base/check.h"
 #include "third_party/blink/public/platform/web_common.h"
 #include "third_party/blink/public/platform/web_crypto_algorithm.h"
 #include "third_party/blink/public/platform/web_crypto_key.h"
diff --git a/chromium/third_party/blink/public/platform/web_dedicated_worker.h b/chromium/third_party/blink/public/platform/web_dedicated_worker.h
index 67eb7dd8993..5cfebb221c7 100644
--- a/chromium/third_party/blink/public/platform/web_dedicated_worker.h
+++ b/chromium/third_party/blink/public/platform/web_dedicated_worker.h
@@ -5,7 +5,8 @@
 #ifndef THIRD_PARTY_BLINK_PUBLIC_PLATFORM_WEB_DEDICATED_WORKER_H_
 #define THIRD_PARTY_BLINK_PUBLIC_PLATFORM_WEB_DEDICATED_WORKER_H_
 
-#include "mojo/public/cpp/system/message_pipe.h"
+#include "third_party/blink/public/mojom/browser_interface_broker.mojom-shared.h"
+#include "third_party/blink/public/platform/cross_variant_mojo_util.h"
 
 namespace blink {
 
@@ -18,7 +19,8 @@ class WebDedicatedWorker {
 
   // Called when content::DedicatedWorkerHost is created in the browser process.
   virtual void OnWorkerHostCreated(
-      mojo::ScopedMessagePipeHandle browser_interface_broker) = 0;
+      CrossVariantMojoRemote<mojom::BrowserInterfaceBrokerInterfaceBase>
+          browser_interface_broker) = 0;
 
   // Called when content::DedicatedWorkerHost started loading the main worker
   // script in the browser process, and the script information is sent back to
diff --git a/chromium/third_party/blink/public/platform/web_dedicated_worker_host_factory_client.h b/chromium/third_party/blink/public/platform/web_dedicated_worker_host_factory_client.h
index 3f87adbeb48..fa8c65f74f1 100644
--- a/chromium/third_party/blink/public/platform/web_dedicated_worker_host_factory_client.h
+++ b/chromium/third_party/blink/public/platform/web_dedicated_worker_host_factory_client.h
@@ -9,7 +9,9 @@
 #include "mojo/public/cpp/system/message_pipe.h"
 #include "services/network/public/mojom/fetch_api.mojom-shared.h"
 #include "services/network/public/mojom/referrer_policy.mojom-shared.h"
+#include "third_party/blink/public/mojom/blob/blob_url_store.mojom-shared.h"
 #include "third_party/blink/public/mojom/frame/lifecycle.mojom-shared.h"
+#include "third_party/blink/public/platform/cross_variant_mojo_util.h"
 #include "third_party/blink/public/platform/web_fetch_client_settings_object.h"
 
 namespace base {
@@ -42,16 +44,13 @@ class WebDedicatedWorkerHostFactoryClient {
       const blink::WebURL& script_url,
       network::mojom::CredentialsMode credentials_mode,
       const blink::WebFetchClientSettingsObject& fetch_client_settings_object,
-      mojo::ScopedMessagePipeHandle blob_url_token) = 0;
+      CrossVariantMojoRemote<mojom::BlobURLTokenInterfaceBase>
+          blob_url_token) = 0;
 
   // Clones the given WebWorkerFetchContext for nested workers.
   virtual scoped_refptr<WebWorkerFetchContext> CloneWorkerFetchContext(
       WebWorkerFetchContext*,
       scoped_refptr<base::SingleThreadTaskRunner>) = 0;
-
-  // Called when a dedicated worker's lifecycle will change.
-  virtual void LifecycleStateChanged(
-      blink::mojom::FrameLifecycleState state) = 0;
 };
 
 }  // namespace blink
diff --git a/chromium/third_party/blink/public/platform/web_drag_data.h b/chromium/third_party/blink/public/platform/web_drag_data.h
index 2b4dcbae081..28fcc8ef358 100644
--- a/chromium/third_party/blink/public/platform/web_drag_data.h
+++ b/chromium/third_party/blink/public/platform/web_drag_data.h
@@ -90,7 +90,7 @@ class WebDragData {
     WebString file_system_id;
   };
 
-  WebDragData() : valid_(false), modifier_key_state_(0) {}
+  WebDragData() : modifier_key_state_(0) {}
 
   WebDragData(const WebDragData& object) = default;
 
@@ -105,13 +105,6 @@ class WebDragData {
   // Instead, use SwapItems.
   void SwapItems(WebVector<Item>& item_list) { item_list_.Swap(item_list); }
 
-  void Initialize() { valid_ = true; }
-  bool IsNull() const { return !valid_; }
-  void Reset() {
-    item_list_ = WebVector<Item>();
-    valid_ = false;
-  }
-
   BLINK_PLATFORM_EXPORT void AddItem(const Item&);
 
   WebString FilesystemId() const { return filesystem_id_; }
@@ -126,7 +119,6 @@ class WebDragData {
   void SetModifierKeyState(int state) { modifier_key_state_ = state; }
 
  private:
-  bool valid_;
   WebVector<Item> item_list_;
   int modifier_key_state_;  // State of Shift/Ctrl/Alt/Meta keys.
   WebString filesystem_id_;
diff --git a/chromium/third_party/blink/public/platform/web_drag_operation.h b/chromium/third_party/blink/public/platform/web_drag_operation.h
deleted file mode 100644
index c309d63af96..00000000000
--- a/chromium/third_party/blink/public/platform/web_drag_operation.h
+++ /dev/null
@@ -1,59 +0,0 @@
-/*
-* Copyright (C) 2009 Google Inc. All rights reserved.
-*
-* Redistribution and use in source and binary forms, with or without
-* modification, are permitted provided that the following conditions are
-* met:
-*
-*     * Redistributions of source code must retain the above copyright
-* notice, this list of conditions and the following disclaimer.
-*     * Redistributions in binary form must reproduce the above
-* copyright notice, this list of conditions and the following disclaimer
-* in the documentation and/or other materials provided with the
-* distribution.
-*     * Neither the name of Google Inc. nor the names of its
-* contributors may be used to endorse or promote products derived from
-* this software without specific prior written permission.
-*
-* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-* A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-* OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-* LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-*/
-
-#ifndef THIRD_PARTY_BLINK_PUBLIC_PLATFORM_WEB_DRAG_OPERATION_H_
-#define THIRD_PARTY_BLINK_PUBLIC_PLATFORM_WEB_DRAG_OPERATION_H_
-
-#include <limits.h>
-
-namespace blink {
-
-// "Verb" of a drag-and-drop operation as negotiated between the source and
-// destination.
-// (These constants match their equivalents in WebCore's DragActions.h and
-// should not be renumbered.)
-enum WebDragOperation {
-  kWebDragOperationNone = 0,
-  kWebDragOperationCopy = 1,
-  kWebDragOperationLink = 2,
-  kWebDragOperationGeneric = 4,
-  kWebDragOperationPrivate = 8,
-  kWebDragOperationMove = 16,
-  kWebDragOperationDelete = 32,
-  kWebDragOperationEvery = UINT_MAX
-};
-
-// Alternate typedef to make it clear when this is being used as a mask
-// with potentially multiple value bits set.
-typedef WebDragOperation WebDragOperationsMask;
-
-}  // namespace blink
-
-#endif
diff --git a/chromium/third_party/blink/public/platform/web_http_body.h b/chromium/third_party/blink/public/platform/web_http_body.h
index 738b7e2161d..b2c0c3599d0 100644
--- a/chromium/third_party/blink/public/platform/web_http_body.h
+++ b/chromium/third_party/blink/public/platform/web_http_body.h
@@ -33,7 +33,9 @@
 
 #include "base/optional.h"
 #include "base/time/time.h"
-#include "mojo/public/cpp/system/message_pipe.h"
+#include "services/network/public/mojom/data_pipe_getter.mojom-shared.h"
+#include "third_party/blink/public/mojom/blob/blob.mojom-shared.h"
+#include "third_party/blink/public/platform/cross_variant_mojo_util.h"
 #include "third_party/blink/public/platform/web_data.h"
 #include "third_party/blink/public/platform/web_string.h"
 #include "third_party/blink/public/platform/web_url.h"
@@ -62,12 +64,9 @@ class WebHTTPBody {
     base::Optional<base::Time> modification_time;
     WebString blob_uuid;
     uint64_t blob_length;
-    mojo::ScopedMessagePipeHandle optional_blob_handle;
-    // |data_pipe_getter| is a
-    // mojo::PendingRemote<network::mojom::DataPipeGetter>. It's declared as a
-    // generic ScopedMessagePipeHandle so it can be "cast" between Blink and
-    // non-Blink variant types.
-    mojo::ScopedMessagePipeHandle data_pipe_getter;
+    CrossVariantMojoRemote<mojom::BlobInterfaceBase> optional_blob;
+    CrossVariantMojoRemote<network::mojom::DataPipeGetterInterfaceBase>
+        data_pipe_getter;
   };
 
   ~WebHTTPBody() { Reset(); }
@@ -105,13 +104,10 @@ class WebHTTPBody {
   BLINK_PLATFORM_EXPORT void AppendBlob(
       const WebString& uuid,
       uint64_t length,
-      mojo::ScopedMessagePipeHandle blob_handle);
-  // |data_pipe_getter| is a
-  // mojo::PendingRemote<network::mojom::DataPipeGetter>. It's declared as a
-  // generic ScopedMessagePipeHandle so it can be "cast" between Blink and
-  // non-Blink variant types.
+      CrossVariantMojoRemote<mojom::BlobInterfaceBase> blob);
   BLINK_PLATFORM_EXPORT void AppendDataPipe(
-      mojo::ScopedMessagePipeHandle data_pipe_getter);
+      CrossVariantMojoRemote<network::mojom::DataPipeGetterInterfaceBase>
+          data_pipe_getter);
 
   BLINK_PLATFORM_EXPORT void SetUniqueBoundary();
 
diff --git a/chromium/third_party/blink/public/platform/web_isolated_world_info.h b/chromium/third_party/blink/public/platform/web_isolated_world_info.h
index 8cdb4d9cead..71c66ecbd9c 100644
--- a/chromium/third_party/blink/public/platform/web_isolated_world_info.h
+++ b/chromium/third_party/blink/public/platform/web_isolated_world_info.h
@@ -38,6 +38,15 @@ struct WebIsolatedWorldInfo {
   // Associates an isolated world with human-readable name which is useful for
   // extension debugging.
   WebString human_readable_name;
+
+  // Associates an isolated world with an optional tag that does not vary
+  // between browser sessions or between renderers, unlike the world ID which
+  // can be randomly assigned. The exact meaning will depend on the embedder
+  // and the type of isolated world. For example Chrome extensions use the
+  // host ID, as per extensions::ScriptInjection::GetHostIdForIsolatedWorld.
+  // Some types of isolated world will not have a suitable tag so will leave
+  // this empty.
+  WebString stable_id;
 };
 
 }  // namespace blink
diff --git a/chromium/third_party/blink/public/platform/web_media_player.h b/chromium/third_party/blink/public/platform/web_media_player.h
index 7f659d780b8..6c7a05700d1 100644
--- a/chromium/third_party/blink/public/platform/web_media_player.h
+++ b/chromium/third_party/blink/public/platform/web_media_player.h
@@ -128,7 +128,7 @@ class WebMediaPlayer {
   };
 
   // TODO(crbug.com/639174): Attempt to merge this with VideoFrameUploadMetadata
-  // For video.requestVideoFrameCallback(). https://wicg.github.io/video-raf/
+  // For video.requestVideoFrameCallback(). https://wicg.github.io/video-rvfc/
   struct VideoFramePresentationMetadata {
     uint32_t presented_frames;
     base::TimeTicks presentation_time;
@@ -167,6 +167,10 @@ class WebMediaPlayer {
   // value if the hint is cleared.
   virtual void SetLatencyHint(double seconds) = 0;
 
+  // Sets a flag indicating that the WebMediaPlayer should apply pitch
+  // adjustments when using a playback rate other than 1.0.
+  virtual void SetPreservesPitch(bool preserves_pitch) = 0;
+
   // The associated media element is going to enter Picture-in-Picture. This
   // method should make sure the player is set up for this and has a SurfaceId
   // as it will be needed.
@@ -174,6 +178,11 @@ class WebMediaPlayer {
 
   virtual void OnPictureInPictureAvailabilityChanged(bool available) = 0;
 
+  // Called to notify about changes of the associated media element's media
+  // time, playback rate, and duration. During uninterrupted playback, the
+  // calls are still made periodically.
+  virtual void OnTimeUpdate() {}
+
   virtual void RequestRemotePlayback() {}
   virtual void RequestRemotePlaybackControl() {}
   virtual void RequestRemotePlaybackStop() {}
@@ -455,7 +464,7 @@ class WebMediaPlayer {
   // to the compositor. The request will be completed via
   // WebMediaPlayerClient::OnRequestVideoFrameCallback(). The frame info can be
   // retrieved via GetVideoFramePresentationMetadata().
-  // See https://wicg.github.io/video-raf/.
+  // See https://wicg.github.io/video-rvfc/.
   virtual void RequestVideoFrameCallback() {}
   virtual std::unique_ptr<VideoFramePresentationMetadata>
   GetVideoFramePresentationMetadata() {
diff --git a/chromium/third_party/blink/public/platform/web_media_player_client.h b/chromium/third_party/blink/public/platform/web_media_player_client.h
index f47c293418a..b2616e6925c 100644
--- a/chromium/third_party/blink/public/platform/web_media_player_client.h
+++ b/chromium/third_party/blink/public/platform/web_media_player_client.h
@@ -181,7 +181,7 @@ class BLINK_PLATFORM_EXPORT WebMediaPlayerClient {
 
   // Called when a video frame has been presented to the compositor, after a
   // request was initiated via WebMediaPlayer::RequestVideoFrameCallback().
-  // See https://wicg.github.io/video-raf/.
+  // See https://wicg.github.io/video-rvfc/.
   virtual void OnRequestVideoFrameCallback() {}
 
   struct Features {
diff --git a/chromium/third_party/blink/public/platform/web_private_ptr.h b/chromium/third_party/blink/public/platform/web_private_ptr.h
index 2403f6ced04..099b9d2261b 100644
--- a/chromium/third_party/blink/public/platform/web_private_ptr.h
+++ b/chromium/third_party/blink/public/platform/web_private_ptr.h
@@ -31,7 +31,7 @@
 #ifndef THIRD_PARTY_BLINK_PUBLIC_PLATFORM_WEB_PRIVATE_PTR_H_
 #define THIRD_PARTY_BLINK_PUBLIC_PLATFORM_WEB_PRIVATE_PTR_H_
 
-#include "base/logging.h"
+#include "base/check.h"
 #include "third_party/blink/public/platform/web_common.h"
 
 #if INSIDE_BLINK
@@ -203,11 +203,11 @@ class PtrStorageImpl<T,
 
   void Assign(const PtrStorageImpl& other) { Assign(other.Get()); }
 
-  T* Get() const { return handle_ ? handle_->Get() : 0; }
+  T* Get() const { return handle_ ? handle_->Get() : nullptr; }
 
   void Release() {
     delete handle_;
-    handle_ = 0;
+    handle_ = nullptr;
   }
 
  private:
@@ -283,7 +283,7 @@ template <typename T,
           WebPrivatePtrStrength strongOrWeak = WebPrivatePtrStrength::kNormal>
 class WebPrivatePtr {
  public:
-  WebPrivatePtr() : storage_(0) {}
+  WebPrivatePtr() : storage_(nullptr) {}
   ~WebPrivatePtr() {
     // We don't destruct the object pointed by storage_ here because we don't
     // want to expose destructors of core classes to embedders. We should
@@ -297,7 +297,7 @@ class WebPrivatePtr {
 
 #if INSIDE_BLINK
   template <typename U>
-  WebPrivatePtr(U&& ptr) : storage_(0) {
+  WebPrivatePtr(U&& ptr) : storage_(nullptr) {
     Storage().Assign(std::forward<U>(ptr));
   }
 
diff --git a/chromium/third_party/blink/public/platform/web_runtime_features.h b/chromium/third_party/blink/public/platform/web_runtime_features.h
index 91a482658cf..0256e624c46 100644
--- a/chromium/third_party/blink/public/platform/web_runtime_features.h
+++ b/chromium/third_party/blink/public/platform/web_runtime_features.h
@@ -90,6 +90,7 @@ class WebRuntimeFeatures {
   BLINK_PLATFORM_EXPORT static void EnableBlockingFocusWithoutUserActivation(
       bool);
   BLINK_PLATFORM_EXPORT static void EnableCacheInlineScriptCode(bool);
+  BLINK_PLATFORM_EXPORT static void EnableClickPointerEvent(bool enable);
   BLINK_PLATFORM_EXPORT static void EnableCookieDeprecationMessages(bool);
   BLINK_PLATFORM_EXPORT static void EnableCookiesWithoutSameSiteMustBeSecure(
       bool);
@@ -118,6 +119,7 @@ class WebRuntimeFeatures {
   BLINK_PLATFORM_EXPORT static void EnableLazyImageLoading(bool);
   BLINK_PLATFORM_EXPORT static void EnableLazyImageVisibleLoadTimeMetrics(bool);
   BLINK_PLATFORM_EXPORT static void EnableMediaCapture(bool);
+  BLINK_PLATFORM_EXPORT static void EnableMediaFeeds(bool);
   BLINK_PLATFORM_EXPORT static void EnableMediaSession(bool);
   BLINK_PLATFORM_EXPORT static void EnableMiddleClickAutoscroll(bool);
   BLINK_PLATFORM_EXPORT static void EnableNavigatorContentUtils(bool);
@@ -172,6 +174,8 @@ class WebRuntimeFeatures {
   BLINK_PLATFORM_EXPORT static void
   EnableWebAuthenticationGetAssertionFeaturePolicy(bool);
   BLINK_PLATFORM_EXPORT static void EnableWebBluetooth(bool);
+  BLINK_PLATFORM_EXPORT static void
+  EnableWebBluetoothRemoteCharacteristicNewWriteValue(bool);
   BLINK_PLATFORM_EXPORT static void EnableWebBluetoothScanning(bool);
   BLINK_PLATFORM_EXPORT static void EnableWebGL2ComputeContext(bool);
   BLINK_PLATFORM_EXPORT static void EnableWebGLDraftExtensions(bool);
@@ -184,9 +188,11 @@ class WebRuntimeFeatures {
   BLINK_PLATFORM_EXPORT static void EnableWebXR(bool);
   BLINK_PLATFORM_EXPORT static void EnableWebXRAnchors(bool);
   BLINK_PLATFORM_EXPORT static void EnableWebXRARModule(bool);
+  BLINK_PLATFORM_EXPORT static void EnableWebXRCameraAccess(bool);
   BLINK_PLATFORM_EXPORT static void EnableWebXRHitTest(bool);
-  BLINK_PLATFORM_EXPORT static void EnableWebXRIncubations(bool);
   BLINK_PLATFORM_EXPORT static void EnableWebXRLightEstimation(bool);
+  BLINK_PLATFORM_EXPORT static void EnableWebXRPlaneDetection(bool);
+  BLINK_PLATFORM_EXPORT static void EnableWebXRReflectionEstimation(bool);
   BLINK_PLATFORM_EXPORT static void EnableXSLT(bool);
   BLINK_PLATFORM_EXPORT static void ForceOverlayFullscreenVideo(bool);
   BLINK_PLATFORM_EXPORT static void EnableTimerThrottlingForBackgroundTabs(
@@ -224,6 +230,7 @@ class WebRuntimeFeatures {
   EnableSignedExchangePrefetchCacheForNavigations(bool);
   BLINK_PLATFORM_EXPORT static void EnableSignedExchangeSubresourcePrefetch(
       bool);
+  BLINK_PLATFORM_EXPORT static void EnableSubresourceWebBundles(bool);
   BLINK_PLATFORM_EXPORT static void EnableIdleDetection(bool);
   BLINK_PLATFORM_EXPORT static void EnableSkipTouchEventFilter(bool);
   BLINK_PLATFORM_EXPORT static void EnableSmsReceiver(bool);
@@ -238,8 +245,10 @@ class WebRuntimeFeatures {
   BLINK_PLATFORM_EXPORT static void EnableTrustTokensAlwaysAllowIssuance(bool);
 
   BLINK_PLATFORM_EXPORT static void EnableInstalledApp(bool);
+  BLINK_PLATFORM_EXPORT static void EnableTransformInterop(bool);
   BLINK_PLATFORM_EXPORT static void EnableVideoWakeLockOptimisationHiddenMuted(
       bool);
+  BLINK_PLATFORM_EXPORT static void EnableContentIndex(bool);
 
  private:
   WebRuntimeFeatures();
diff --git a/chromium/third_party/blink/public/platform/web_screen_info.h b/chromium/third_party/blink/public/platform/web_screen_info.h
index 9ee35387bb9..10ec99da5df 100644
--- a/chromium/third_party/blink/public/platform/web_screen_info.h
+++ b/chromium/third_party/blink/public/platform/web_screen_info.h
@@ -32,7 +32,6 @@
 #define THIRD_PARTY_BLINK_PUBLIC_PLATFORM_WEB_SCREEN_INFO_H_
 
 #include "third_party/blink/public/common/screen_orientation/web_screen_orientation_type.h"
-#include "third_party/blink/public/platform/shape_properties.h"
 #include "third_party/blink/public/platform/web_rect.h"
 #include "ui/gfx/color_space.h"
 
@@ -83,9 +82,6 @@ struct WebScreenInfo {
   // TODO(crbug.com/840189): we should use an enum rather than a number here.
   uint16_t orientation_angle = 0;
 
-  // This is the shape of display.
-  DisplayShape display_shape = kDisplayShapeRect;
-
   WebScreenInfo() = default;
 
   bool operator==(const WebScreenInfo& other) const {
@@ -97,8 +93,7 @@ struct WebScreenInfo {
            this->rect == other.rect &&
            this->available_rect == other.available_rect &&
            this->orientation_type == other.orientation_type &&
-           this->orientation_angle == other.orientation_angle &&
-           this->display_shape == other.display_shape;
+           this->orientation_angle == other.orientation_angle;
   }
 
   bool operator!=(const WebScreenInfo& other) const {
diff --git a/chromium/third_party/blink/public/platform/web_string.h b/chromium/third_party/blink/public/platform/web_string.h
index ffd1da0bc8e..b9f774c190c 100644
--- a/chromium/third_party/blink/public/platform/web_string.h
+++ b/chromium/third_party/blink/public/platform/web_string.h
@@ -31,11 +31,12 @@
 #ifndef THIRD_PARTY_BLINK_PUBLIC_PLATFORM_WEB_STRING_H_
 #define THIRD_PARTY_BLINK_PUBLIC_PLATFORM_WEB_STRING_H_
 
+#include <cstring>
 #include <string>
+
 #include "base/memory/scoped_refptr.h"
 #include "base/optional.h"
 #include "base/strings/latin1_string_conversions.h"
-#include "base/strings/nullable_string16.h"
 #include "base/strings/string16.h"
 #include "third_party/blink/public/platform/web_common.h"
 
@@ -56,7 +57,6 @@ namespace blink {
 // * WebString::FromLatin1(const std::string& latin1)
 // * WebString::FromUTF8(const std::string& utf8)
 // * WebString::FromUTF16(const base::string16& utf16)
-// * WebString::FromUTF16(const base::NullableString16& utf16)
 // * WebString::FromUTF16(const base::Optional<base::string16>& utf16)
 //
 // Similarly, use either of following methods to convert WebString to
@@ -66,7 +66,6 @@ namespace blink {
 // * webstring.Latin1()
 // * webstring.Utf8()
 // * webstring.Utf16()
-// * WebString::ToNullableString16(webstring)
 // * WebString::ToOptionalString16(webstring)
 //
 // Note that if you need to convert the UTF8 string converted from WebString
@@ -112,7 +111,7 @@ class WebString {
   BLINK_PLATFORM_EXPORT bool Equals(const WebString&) const;
   BLINK_PLATFORM_EXPORT bool Equals(const char* characters, size_t len) const;
   bool Equals(const char* characters) const {
-    return Equals(characters, characters ? strlen(characters) : 0);
+    return Equals(characters, characters ? std::strlen(characters) : 0);
   }
 
   BLINK_PLATFORM_EXPORT size_t length() const;
@@ -135,14 +134,8 @@ class WebString {
 
   BLINK_PLATFORM_EXPORT static WebString FromUTF16(const base::string16&);
   BLINK_PLATFORM_EXPORT static WebString FromUTF16(
-      const base::NullableString16&);
-  BLINK_PLATFORM_EXPORT static WebString FromUTF16(
       const base::Optional<base::string16>&);
 
-  static base::NullableString16 ToNullableString16(const WebString& s) {
-    return base::NullableString16(ToOptionalString16(s));
-  }
-
   static base::Optional<base::string16> ToOptionalString16(const WebString& s) {
     return s.IsNull() ? base::nullopt : base::make_optional(s.Utf16());
   }
diff --git a/chromium/third_party/blink/public/platform/web_text_input_info.h b/chromium/third_party/blink/public/platform/web_text_input_info.h
index 7ccc7aa72e5..58a89160fb5 100644
--- a/chromium/third_party/blink/public/platform/web_text_input_info.h
+++ b/chromium/third_party/blink/public/platform/web_text_input_info.h
@@ -30,6 +30,7 @@
 #include "third_party/blink/public/platform/web_string.h"
 #include "third_party/blink/public/platform/web_text_input_mode.h"
 #include "third_party/blink/public/platform/web_text_input_type.h"
+#include "ui/base/ime/mojom/virtual_keyboard_types.mojom-shared.h"
 #include "ui/base/ime/text_input_action.h"
 
 namespace blink {
@@ -61,6 +62,11 @@ struct WebTextInputInfo {
   // The enterkeyhint attribute value of the currently focused input field.
   ui::TextInputAction action;
 
+  // The virtualkeyboardpolicy attribute value of the currently focused editable
+  // element.
+  ui::mojom::VirtualKeyboardPolicy virtual_keyboard_policy =
+      ui::mojom::VirtualKeyboardPolicy::AUTO;
+
   BLINK_PLATFORM_EXPORT bool Equals(const WebTextInputInfo&) const;
 
   WebTextInputInfo()
diff --git a/chromium/third_party/blink/public/platform/web_theme_engine.h b/chromium/third_party/blink/public/platform/web_theme_engine.h
index 19523a879db..721e50be9c5 100644
--- a/chromium/third_party/blink/public/platform/web_theme_engine.h
+++ b/chromium/third_party/blink/public/platform/web_theme_engine.h
@@ -33,6 +33,7 @@
 
 #include "base/optional.h"
 #include "base/time/time.h"
+#include "build/build_config.h"
 #include "third_party/blink/public/common/css/forced_colors.h"
 #include "third_party/blink/public/platform/web_color_scheme.h"
 #include "third_party/blink/public/platform/web_rect.h"
@@ -147,6 +148,7 @@ class WebThemeEngine {
     int thumb_x;
     int thumb_y;
     float zoom;
+    bool right_to_left;
   };
 
   // Extra parameters for PartInnerSpinButton
@@ -174,6 +176,24 @@ class WebThemeEngine {
     bool right_to_left;
   };
 
+#if defined(OS_MACOSX)
+  enum ScrollbarOrientation {
+    // Vertical scrollbar on the right side of content.
+    kVerticalOnRight,
+    // Vertical scrollbar on the left side of content.
+    kVerticalOnLeft,
+    // Horizontal scrollbar (on the bottom of content).
+    kHorizontal,
+  };
+
+  struct ScrollbarExtraParams {
+    bool is_hovering;
+    bool is_overlay;
+    WebColorScheme scrollbar_theme;
+    ScrollbarOrientation orientation;
+  };
+#endif
+
   union ExtraParams {
     ScrollbarTrackExtraParams scrollbar_track;
     ButtonExtraParams button;
@@ -184,6 +204,9 @@ class WebThemeEngine {
     ProgressBarExtraParams progress_bar;
     ScrollbarThumbExtraParams scrollbar_thumb;
     ScrollbarButtonExtraParams scrollbar_button;
+#if defined(OS_MACOSX)
+    ScrollbarExtraParams scrollbar_extra;
+#endif
   };
 
   virtual ~WebThemeEngine() {}
diff --git a/chromium/third_party/blink/public/platform/web_url_error.h b/chromium/third_party/blink/public/platform/web_url_error.h
index 069c965583b..136f20688b4 100644
--- a/chromium/third_party/blink/public/platform/web_url_error.h
+++ b/chromium/third_party/blink/public/platform/web_url_error.h
@@ -31,7 +31,6 @@
 #ifndef THIRD_PARTY_BLINK_PUBLIC_PLATFORM_WEB_URL_ERROR_H_
 #define THIRD_PARTY_BLINK_PUBLIC_PLATFORM_WEB_URL_ERROR_H_
 
-#include "base/logging.h"
 #include "base/optional.h"
 #include "net/dns/public/resolve_error_info.h"
 #include "services/network/public/cpp/cors/cors_error_status.h"
diff --git a/chromium/third_party/blink/public/platform/web_url_loader_mock_factory.h b/chromium/third_party/blink/public/platform/web_url_loader_mock_factory.h
index d4ebb0c01d8..7650a4c16b4 100644
--- a/chromium/third_party/blink/public/platform/web_url_loader_mock_factory.h
+++ b/chromium/third_party/blink/public/platform/web_url_loader_mock_factory.h
@@ -22,7 +22,7 @@ struct WebURLError;
 
 class WebURLLoaderMockFactory {
  public:
-  static std::unique_ptr<WebURLLoaderMockFactory> Create();
+  static WebURLLoaderMockFactory* GetSingletonInstance();
 
   virtual ~WebURLLoaderMockFactory() = default;
 
diff --git a/chromium/third_party/blink/public/platform/web_url_response.h b/chromium/third_party/blink/public/platform/web_url_response.h
index d283ccb3e85..e709819a3b9 100644
--- a/chromium/third_party/blink/public/platform/web_url_response.h
+++ b/chromium/third_party/blink/public/platform/web_url_response.h
@@ -44,6 +44,7 @@
 
 namespace network {
 namespace mojom {
+enum class FetchResponseSource;
 enum class FetchResponseType : int32_t;
 class LoadTimingInfo;
 }
@@ -178,6 +179,7 @@ class WebURLResponse {
 
   BLINK_PLATFORM_EXPORT void SetHTTPLoadInfo(const WebHTTPLoadInfo&);
 
+  BLINK_PLATFORM_EXPORT base::Time ResponseTime() const;
   BLINK_PLATFORM_EXPORT void SetResponseTime(base::Time);
 
   BLINK_PLATFORM_EXPORT WebString MimeType() const;
@@ -245,6 +247,13 @@ class WebURLResponse {
   BLINK_PLATFORM_EXPORT bool WasFetchedViaServiceWorker() const;
   BLINK_PLATFORM_EXPORT void SetWasFetchedViaServiceWorker(bool);
 
+  // Set when this request was loaded via a ServiceWorker. See
+  // network::ResourceResponseInfo::service_worker_response_source for details.
+  BLINK_PLATFORM_EXPORT network::mojom::FetchResponseSource
+  GetServiceWorkerResponseSource() const;
+  BLINK_PLATFORM_EXPORT void SetServiceWorkerResponseSource(
+      network::mojom::FetchResponseSource);
+
   // See network::ResourceResponseInfo::was_fallback_required_by_service_worker.
   BLINK_PLATFORM_EXPORT void SetWasFallbackRequiredByServiceWorker(bool);
 
@@ -262,6 +271,7 @@ class WebURLResponse {
 
   // The cache name of the CacheStorage from where the response is served via
   // the ServiceWorker. Null if the response isn't from the CacheStorage.
+  BLINK_PLATFORM_EXPORT WebString CacheStorageCacheName() const;
   BLINK_PLATFORM_EXPORT void SetCacheStorageCacheName(const WebString&);
 
   // The headers that should be exposed according to CORS. Only guaranteed
diff --git a/chromium/third_party/blink/public/platform/web_vector.h b/chromium/third_party/blink/public/platform/web_vector.h
index 7f2818c785f..2cc291d94c5 100644
--- a/chromium/third_party/blink/public/platform/web_vector.h
+++ b/chromium/third_party/blink/public/platform/web_vector.h
@@ -31,7 +31,7 @@
 #ifndef THIRD_PARTY_BLINK_PUBLIC_PLATFORM_WEB_VECTOR_H_
 #define THIRD_PARTY_BLINK_PUBLIC_PLATFORM_WEB_VECTOR_H_
 
-#include "base/logging.h"
+#include "base/check_op.h"
 #include "build/build_config.h"
 #include "third_party/blink/public/platform/web_common.h"
 
@@ -184,6 +184,8 @@ class WebVector {
     data_.insert(begin() + index, value);
   }
 
+  bool Equals(const WebVector<T>& other) const { return data_ == other.data_; }
+
  private:
   std::vector<T> data_;
 };
diff --git a/chromium/third_party/blink/public/platform/web_worker_fetch_context.h b/chromium/third_party/blink/public/platform/web_worker_fetch_context.h
index 0632a030caa..db6c05b7f85 100644
--- a/chromium/third_party/blink/public/platform/web_worker_fetch_context.h
+++ b/chromium/third_party/blink/public/platform/web_worker_fetch_context.h
@@ -10,9 +10,11 @@
 
 #include "base/memory/ref_counted.h"
 #include "base/memory/scoped_refptr.h"
-#include "base/unguessable_token.h"
+#include "services/network/public/mojom/url_loader_factory.mojom-shared.h"
 #include "third_party/blink/public/mojom/service_worker/controller_service_worker_mode.mojom-shared.h"
+#include "third_party/blink/public/mojom/timing/worker_timing_container.mojom-shared.h"
 #include "third_party/blink/public/platform/code_cache_loader.h"
+#include "third_party/blink/public/platform/cross_variant_mojo_util.h"
 #include "third_party/blink/public/platform/web_document_subresource_filter.h"
 #include "third_party/blink/public/platform/web_security_origin.h"
 #include "third_party/blink/public/platform/web_string.h"
@@ -75,7 +77,8 @@ class WebWorkerFetchContext : public base::RefCounted<WebWorkerFetchContext> {
   // Returns a new WebURLLoaderFactory that wraps the given
   // network::mojom::URLLoaderFactory.
   virtual std::unique_ptr<WebURLLoaderFactory> WrapURLLoaderFactory(
-      mojo::ScopedMessagePipeHandle url_loader_factory_handle) = 0;
+      CrossVariantMojoRemote<network::mojom::URLLoaderFactoryInterfaceBase>
+          url_loader_factory) = 0;
 
   // Returns a CodeCacheLoader that fetches data from code caches. If
   // a nullptr is returned then data would not be fetched from the code
@@ -149,11 +152,11 @@ class WebWorkerFetchContext : public base::RefCounted<WebWorkerFetchContext> {
   // Returns the current list of user prefered languages.
   virtual blink::WebString GetAcceptLanguages() const = 0;
 
-  // Returns mojo::PendingReceiver<blink::mojom::blink::WorkerTimingContainer>
-  // for the blink::ResourceResponse with the given |request_id|. Null if the
+  // Returns the blink::mojom::WorkerTimingContainer receiver for the
+  // blink::ResourceResponse with the given |request_id|. Null if the
   // request has not been intercepted by a service worker.
-  virtual mojo::ScopedMessagePipeHandle TakePendingWorkerTimingReceiver(
-      int request_id) = 0;
+  virtual CrossVariantMojoReceiver<mojom::WorkerTimingContainerInterfaceBase>
+  TakePendingWorkerTimingReceiver(int request_id) = 0;
 
   // This flag is set to disallow all network accesses in the context. Used for
   // offline capability detection in service workers.
diff --git a/chromium/third_party/blink/public/public_features.gni b/chromium/third_party/blink/public/public_features.gni
index 4037acd6df8..45096cb2ba8 100644
--- a/chromium/third_party/blink/public/public_features.gni
+++ b/chromium/third_party/blink/public/public_features.gni
@@ -5,12 +5,6 @@
 import("//build/config/ui.gni")
 
 declare_args() {
-  # If debug_devtools is set to true, JavaScript files for DevTools are stored
-  # as is and loaded from disk. Otherwise, a concatenated file is stored in
-  # resources.pak. It is still possible to load JS files from disk by passing
-  # --debug-devtools cmdline switch.
-  debug_devtools = false
-
   # Enables additional Oilpan heap verification instrumentation.
   enable_blink_heap_verification = false
 
diff --git a/chromium/third_party/blink/public/public_typemaps.gni b/chromium/third_party/blink/public/public_typemaps.gni
index 0a428d85b8f..0b492445953 100644
--- a/chromium/third_party/blink/public/public_typemaps.gni
+++ b/chromium/third_party/blink/public/public_typemaps.gni
@@ -13,6 +13,7 @@ typemaps = [
   "//third_party/blink/public/common/mediastream/media_stream.typemap",
   "//third_party/blink/public/common/messaging/message_port_descriptor.typemap",
   "//third_party/blink/public/common/notifications/notification_types.typemap",
+  "//third_party/blink/public/common/peerconnection/peer_connection_tracker.typemap",
   "//third_party/blink/public/common/screen_orientation/screen_orientation_lock_types.typemap",
   "//third_party/blink/public/common/user_agent/user_agent_metadata.typemap",
 ]
diff --git a/chromium/third_party/blink/public/web/DEPS b/chromium/third_party/blink/public/web/DEPS
index f7bd2da76b9..1876ad2f492 100644
--- a/chromium/third_party/blink/public/web/DEPS
+++ b/chromium/third_party/blink/public/web/DEPS
@@ -1,5 +1,4 @@
 include_rules = [
-    "+base/callback.h",
     "+base/containers/span.h",
     "+base/files/file_path.h",
     "+base/i18n/rtl.h",
@@ -24,6 +23,7 @@ include_rules = [
     "+cc/trees/layer_tree_host_client.h",
     "+cc/trees/viewport_layers.h",
     "+components/viz/common/surfaces/frame_sink_id.h",
+    "+media/base",
     "+mojo/public",
     "+net/cookies/site_for_cookies.h",
     "+printing/mojom/print.mojom-shared.h",
@@ -38,7 +38,9 @@ include_rules = [
     "+services/network/public/mojom/ip_address_space.mojom-shared.h",
     "+services/network/public/mojom/referrer_policy.mojom-shared.h",
     "+services/network/public/mojom/url_loader.mojom-shared.h",
+    "+services/network/public/mojom/url_loader_factory.mojom-shared.h",
     "+services/service_manager/public",
+    "+ui/base/ime/ime_text_span.h",
     "+ui/events/types",
     "+ui/gfx/geometry",
     # Enforce to use mojom-shared.h in blink/public so that it can compile
@@ -48,6 +50,7 @@ include_rules = [
     "+ui/accessibility/ax_enums.mojom-shared.h",
     "+ui/accessibility/ax_event.h",
     "+ui/base/ime/mojom/ime_types.mojom-shared.h",
+    "+ui/base/ime/mojom/virtual_keyboard_types.mojom-shared.h",
 
     # Allowed only inside INSIDE_BLINK
     "+third_party/blink/renderer/core",
diff --git a/chromium/third_party/blink/public/web/blink.h b/chromium/third_party/blink/public/web/blink.h
index f2572a4d3f8..00de4f8d68f 100644
--- a/chromium/third_party/blink/public/web/blink.h
+++ b/chromium/third_party/blink/public/web/blink.h
@@ -104,6 +104,15 @@ BLINK_EXPORT void ForceNextWebGLContextCreationToFailForTest();
 // context's ability to deal with that failure gracefully can be tested.
 BLINK_EXPORT void ForceNextDrawingBufferCreationToFailForTest();
 
+// Set whether this renderer process is "cross-origin isolated". This
+// corresponds to agent cluster's "cross-origin isolated" concept.
+// TODO(yhirano): Have the spec URL.
+// This property is process global because we ensure that a renderer process
+// host only cross-origin isolated agents or only non-cross-origin isolated
+// agents, not both.
+// This is called at most once. This is called earlier than any frame commit.
+BLINK_EXPORT void SetIsCrossOriginIsolated(bool value);
+
 }  // namespace blink
 
 #endif
diff --git a/chromium/third_party/blink/public/web/modules/mediastream/media_stream_video_source.h b/chromium/third_party/blink/public/web/modules/mediastream/media_stream_video_source.h
index 48b0a365ae0..90967a518f4 100644
--- a/chromium/third_party/blink/public/web/modules/mediastream/media_stream_video_source.h
+++ b/chromium/third_party/blink/public/web/modules/mediastream/media_stream_video_source.h
@@ -64,9 +64,16 @@ class BLINK_MODULES_EXPORT MediaStreamVideoSource
   ~MediaStreamVideoSource() override;
 
   // Returns the MediaStreamVideoSource object owned by |source|.
+  //
+  // TODO(https://crbug.com/714136): Replace uses of this method in favor of
+  // the variant below.
   static MediaStreamVideoSource* GetVideoSource(
       const WebMediaStreamSource& source);
 
+#if INSIDE_BLINK
+  static MediaStreamVideoSource* GetVideoSource(MediaStreamSource* source);
+#endif
+
   // Puts |track| in the registered tracks list.
   void AddTrack(MediaStreamVideoTrack* track,
                 const VideoTrackAdapterSettings& track_adapter_settings,
diff --git a/chromium/third_party/blink/public/web/modules/mediastream/media_stream_video_track.h b/chromium/third_party/blink/public/web/modules/mediastream/media_stream_video_track.h
index ccf2179b2c1..c859d75f7b0 100644
--- a/chromium/third_party/blink/public/web/modules/mediastream/media_stream_video_track.h
+++ b/chromium/third_party/blink/public/web/modules/mediastream/media_stream_video_track.h
@@ -45,11 +45,6 @@ class BLINK_MODULES_EXPORT MediaStreamVideoTrack
       MediaStreamVideoSource::ConstraintsOnceCallback callback,
       bool enabled);
   static blink::WebMediaStreamTrack CreateVideoTrack(
-      const blink::WebString& id,
-      MediaStreamVideoSource* source,
-      MediaStreamVideoSource::ConstraintsOnceCallback callback,
-      bool enabled);
-  static blink::WebMediaStreamTrack CreateVideoTrack(
       MediaStreamVideoSource* source,
       const VideoTrackAdapterSettings& adapter_settings,
       const base::Optional<bool>& noise_reduction,
diff --git a/chromium/third_party/blink/public/web/modules/mediastream/webmediaplayer_ms.h b/chromium/third_party/blink/public/web/modules/mediastream/webmediaplayer_ms.h
index 68b07295f9b..c2c9efba4d7 100644
--- a/chromium/third_party/blink/public/web/modules/mediastream/webmediaplayer_ms.h
+++ b/chromium/third_party/blink/public/web/modules/mediastream/webmediaplayer_ms.h
@@ -114,6 +114,7 @@ class BLINK_MODULES_EXPORT WebMediaPlayerMS
   void SetRate(double rate) override;
   void SetVolume(double volume) override;
   void SetLatencyHint(double seconds) override;
+  void SetPreservesPitch(bool preserves_pitch) override;
   void OnRequestPictureInPicture() override;
   void OnPictureInPictureAvailabilityChanged(bool available) override;
   void SetSinkId(const WebString& sink_id,
@@ -277,7 +278,7 @@ class BLINK_MODULES_EXPORT WebMediaPlayerMS
   void SetGpuMemoryBufferVideoForTesting(
       media::GpuMemoryBufferVideoFramePool* gpu_memory_buffer_pool);
 
-  // Callback used to fulfill video.requestAnimationFrame() requests.
+  // Callback used to fulfill video.requestVideoFrameCallback() requests.
   void OnNewFramePresentedCallback();
 
   // Callback used to detect and propagate a render error.
diff --git a/chromium/third_party/blink/public/web/modules/service_worker/web_service_worker_context_client.h b/chromium/third_party/blink/public/web/modules/service_worker/web_service_worker_context_client.h
index cedb7e23cc0..48e3e7ecec6 100644
--- a/chromium/third_party/blink/public/web/modules/service_worker/web_service_worker_context_client.h
+++ b/chromium/third_party/blink/public/web/modules/service_worker/web_service_worker_context_client.h
@@ -35,9 +35,9 @@
 
 #include "base/memory/scoped_refptr.h"
 #include "base/time/time.h"
-#include "mojo/public/cpp/system/message_pipe.h"
 #include "services/network/public/mojom/url_loader.mojom-shared.h"
 #include "third_party/blink/public/mojom/devtools/console_message.mojom-shared.h"
+#include "third_party/blink/public/mojom/devtools/devtools_agent.mojom-shared.h"
 #include "third_party/blink/public/mojom/service_worker/service_worker_event_status.mojom-shared.h"
 #include "third_party/blink/public/mojom/web_feature/web_feature.mojom-shared.h"
 #include "third_party/blink/public/platform/cross_variant_mojo_util.h"
@@ -79,8 +79,10 @@ class WebServiceWorkerContextClient {
   // ServiceWorker has prepared everything for script loading and is now ready
   // for DevTools inspection. Called on the initiator thread.
   virtual void WorkerReadyForInspectionOnInitiatorThread(
-      mojo::ScopedMessagePipeHandle devtools_agent_ptr_info,
-      mojo::ScopedMessagePipeHandle devtools_agent_host_request) {}
+      CrossVariantMojoRemote<mojom::DevToolsAgentInterfaceBase>
+          devtools_agent_remote,
+      CrossVariantMojoReceiver<mojom::DevToolsAgentHostInterfaceBase>
+          devtools_agent_host_receiver) {}
 
   // The worker started but it could not execute because fetching the classic
   // script failed on the worker thread.
diff --git a/chromium/third_party/blink/public/web/modules/service_worker/web_service_worker_context_proxy.h b/chromium/third_party/blink/public/web/modules/service_worker/web_service_worker_context_proxy.h
index 225b4165d2b..c9ef9dfc95e 100644
--- a/chromium/third_party/blink/public/web/modules/service_worker/web_service_worker_context_proxy.h
+++ b/chromium/third_party/blink/public/web/modules/service_worker/web_service_worker_context_proxy.h
@@ -33,7 +33,9 @@
 
 #include "base/time/time.h"
 #include "mojo/public/cpp/system/data_pipe.h"
-#include "mojo/public/cpp/system/message_pipe.h"
+#include "third_party/blink/public/mojom/service_worker/controller_service_worker.mojom-shared.h"
+#include "third_party/blink/public/mojom/service_worker/service_worker.mojom-shared.h"
+#include "third_party/blink/public/platform/cross_variant_mojo_util.h"
 
 #include <memory>
 
@@ -49,11 +51,10 @@ class WebServiceWorkerContextProxy {
   virtual ~WebServiceWorkerContextProxy() = default;
 
   virtual void BindServiceWorker(
-      // A handle for mojo::PendingReceiver<mojom::ServiceWorker>.
-      mojo::ScopedMessagePipeHandle receiver_pipe) = 0;
+      CrossVariantMojoReceiver<mojom::ServiceWorkerInterfaceBase> receiver) = 0;
   virtual void BindControllerServiceWorker(
-      // A handle for mojo::PendingReceiver<mojom::ControllerServiceWorker>.
-      mojo::ScopedMessagePipeHandle receiver_pipe) = 0;
+      CrossVariantMojoReceiver<mojom::ControllerServiceWorkerInterfaceBase>
+          receiver) = 0;
 
   virtual void OnNavigationPreloadResponse(
       int fetch_event_id,
diff --git a/chromium/third_party/blink/public/web/web_ax_object.h b/chromium/third_party/blink/public/web/web_ax_object.h
index 653bc7a751c..b9bf20f29b2 100644
--- a/chromium/third_party/blink/public/web/web_ax_object.h
+++ b/chromium/third_party/blink/public/web/web_ax_object.h
@@ -146,6 +146,9 @@ class WebAXObject {
   BLINK_EXPORT bool IsLineBreakingObject() const;
   BLINK_EXPORT bool IsLinked() const;
   BLINK_EXPORT bool IsModal() const;
+  // Returns true if this object is an input element of a text field type, such
+  // as type="text" or type="tel", or a textarea.
+  BLINK_EXPORT bool IsNativeTextControl() const;
   BLINK_EXPORT bool IsOffScreen() const;
   BLINK_EXPORT bool IsSelectedOptionActive() const;
   BLINK_EXPORT bool IsVisited() const;
diff --git a/chromium/third_party/blink/public/web/web_dom_message_event.h b/chromium/third_party/blink/public/web/web_dom_message_event.h
index 7088f17d96a..b43c6db061c 100644
--- a/chromium/third_party/blink/public/web/web_dom_message_event.h
+++ b/chromium/third_party/blink/public/web/web_dom_message_event.h
@@ -58,11 +58,6 @@ class WebDOMMessageEvent : public WebDOMEvent {
       const WebFrame* source_frame = nullptr,
       const WebDocument& target_document = WebDocument(),
       WebVector<MessagePortChannel> ports = WebVector<MessagePortChannel>());
-  BLINK_EXPORT WebDOMMessageEvent(
-      TransferableMessage,
-      const WebString& origin = WebString(),
-      const WebFrame* source_frame = nullptr,
-      const WebDocument& target_document = WebDocument());
   WebDOMMessageEvent() = default;
 
   BLINK_EXPORT WebString Origin() const;
@@ -71,11 +66,6 @@ class WebDOMMessageEvent : public WebDOMEvent {
     return locked_agent_cluster_id_;
   }
 
-  // The |encoded_message| in the returned message is only valid as long as this
-  // WebDOMMessageEvent is still valid, unless EnsureDataIsOwned is called on
-  // the returned message.
-  BLINK_EXPORT TransferableMessage AsMessage();
-
 #if INSIDE_BLINK
   explicit WebDOMMessageEvent(
       MessageEvent* e,
diff --git a/chromium/third_party/blink/public/web/web_embedded_worker.h b/chromium/third_party/blink/public/web/web_embedded_worker.h
index 06ba08c9475..2e9162a6cd1 100644
--- a/chromium/third_party/blink/public/web/web_embedded_worker.h
+++ b/chromium/third_party/blink/public/web/web_embedded_worker.h
@@ -33,7 +33,11 @@
 
 #include <memory>
 
-#include "mojo/public/cpp/system/message_pipe.h"
+#include "third_party/blink/public/mojom/browser_interface_broker.mojom-shared.h"
+#include "third_party/blink/public/mojom/cache_storage/cache_storage.mojom-shared.h"
+#include "third_party/blink/public/mojom/service_worker/service_worker_installed_scripts_manager.mojom-shared.h"
+#include "third_party/blink/public/mojom/worker/worker_content_settings_proxy.mojom-shared.h"
+#include "third_party/blink/public/platform/cross_variant_mojo_util.h"
 #include "third_party/blink/public/platform/web_common.h"
 #include "third_party/blink/public/platform/web_vector.h"
 
@@ -43,23 +47,25 @@ class WebServiceWorkerContextClient;
 class WebURL;
 struct WebEmbeddedWorkerStartData;
 
-// As we're on the border line between non-Blink and Blink variants, we need
-// to use mojo::ScopedMessagePipeHandle to pass Mojo types.
 struct BLINK_EXPORT WebServiceWorkerInstalledScriptsManagerParams {
   WebServiceWorkerInstalledScriptsManagerParams() = delete;
   WebServiceWorkerInstalledScriptsManagerParams(
       WebVector<WebURL> installed_scripts_urls,
-      mojo::ScopedMessagePipeHandle manager_receiver,
-      mojo::ScopedMessagePipeHandle manager_host_remote);
+      CrossVariantMojoReceiver<
+          mojom::ServiceWorkerInstalledScriptsManagerInterfaceBase>
+          manager_receiver,
+      CrossVariantMojoRemote<
+          mojom::ServiceWorkerInstalledScriptsManagerHostInterfaceBase>
+          manager_host_remote);
   ~WebServiceWorkerInstalledScriptsManagerParams() = default;
 
   WebVector<WebURL> installed_scripts_urls;
-  // A handle for
-  // mojo::PendingReceiver<mojom::blink::ServiceWorkerInstalledScriptsManager>.
-  mojo::ScopedMessagePipeHandle manager_receiver;
-  // A handle for
-  // mojo::PendingRemote<mojom::blink::ServiceWorkerInstalledScriptsManagerHost>.
-  mojo::ScopedMessagePipeHandle manager_host_remote;
+  CrossVariantMojoReceiver<
+      mojom::ServiceWorkerInstalledScriptsManagerInterfaceBase>
+      manager_receiver;
+  CrossVariantMojoRemote<
+      mojom::ServiceWorkerInstalledScriptsManagerHostInterfaceBase>
+      manager_host_remote;
 };
 
 // An interface to start and terminate an embedded worker.
@@ -78,9 +84,11 @@ class BLINK_EXPORT WebEmbeddedWorker {
   virtual void StartWorkerContext(
       std::unique_ptr<WebEmbeddedWorkerStartData>,
       std::unique_ptr<WebServiceWorkerInstalledScriptsManagerParams>,
-      mojo::ScopedMessagePipeHandle content_settings_handle,
-      mojo::ScopedMessagePipeHandle cache_storage,
-      mojo::ScopedMessagePipeHandle browser_interface_broker,
+      CrossVariantMojoRemote<mojom::WorkerContentSettingsProxyInterfaceBase>
+          content_settings,
+      CrossVariantMojoRemote<mojom::CacheStorageInterfaceBase> cache_storage,
+      CrossVariantMojoRemote<mojom::BrowserInterfaceBrokerInterfaceBase>
+          browser_interface_broker,
       scoped_refptr<base::SingleThreadTaskRunner>
           initiator_thread_task_runner) = 0;
   virtual void TerminateWorkerContext() = 0;
diff --git a/chromium/third_party/blink/public/web/web_external_widget_client.h b/chromium/third_party/blink/public/web/web_external_widget_client.h
index 8e5c214bac6..4d63d0fbb59 100644
--- a/chromium/third_party/blink/public/web/web_external_widget_client.h
+++ b/chromium/third_party/blink/public/web/web_external_widget_client.h
@@ -5,12 +5,15 @@
 #ifndef THIRD_PARTY_BLINK_PUBLIC_WEB_WEB_EXTERNAL_WIDGET_CLIENT_H_
 #define THIRD_PARTY_BLINK_PUBLIC_WEB_WEB_EXTERNAL_WIDGET_CLIENT_H_
 
+#include <vector>
+
 #include "cc/trees/layer_tree_host.h"
 #include "third_party/blink/public/platform/web_input_event_result.h"
 #include "ui/gfx/geometry/size.h"
 
 namespace blink {
 class WebCoalescedInputEvent;
+class WebGestureEvent;
 
 // The interface from blink to Widgets with implementations outside of blink.
 class WebExternalWidgetClient {
@@ -49,6 +52,49 @@ class WebExternalWidgetClient {
   // Notification that the BeginMainFrame completed, was committed into the
   // compositor (thread) and submitted to the display compositor.
   virtual void DidCommitAndDrawCompositorFrame() = 0;
+
+  // Called before gesture events are processed and allows the
+  // client to handle the event itself. Return true if event was handled
+  // and further processing should stop.
+  virtual bool WillHandleGestureEvent(const WebGestureEvent& event) {
+    return false;
+  }
+
+  virtual bool SupportsBufferedTouchEvents() { return false; }
+
+  // Returns whether we handled a GestureScrollEvent.
+  virtual void DidHandleGestureScrollEvent(
+      const WebGestureEvent& gesture_event,
+      const gfx::Vector2dF& unused_delta,
+      const cc::OverscrollBehavior& overscroll_behavior,
+      bool event_processed) {}
+
+  // Connect the Widget Input Handler to the channels provided.
+  virtual void GetWidgetInputHandler(
+      CrossVariantMojoReceiver<mojom::WidgetInputHandlerInterfaceBase>
+          widget_input_receiver,
+      CrossVariantMojoRemote<mojom::WidgetInputHandlerHostInterfaceBase>
+          widget_input_host_remote) {}
+
+  // Since the widget input IPC channel is still on the content side send this
+  // message back to the embedder to then send it on that channel. All bounds
+  // are in window coordinates.
+  virtual void SendCompositionRangeChanged(
+      const gfx::Range& range,
+      const std::vector<gfx::Rect>& character_bounds) {}
+
+  // The IME guard prevents sending IPC messages while messages are being
+  // processed. Returns true if there is a current guard.
+  // |request_to_show_virtual_keyboard| is whether the message that would have
+  // been sent would have requested the keyboard. This method will eventually be
+  // removed when all input handling is moved into blink.
+  virtual bool HasCurrentImeGuard(bool request_to_show_virtual_keyboard) {
+    return false;
+  }
+
+  // The state of the focus has changed for the WebWidget. |enabled|
+  // is the new state.
+  virtual void FocusChanged(bool enabled) {}
 };
 
 }  // namespace blink
diff --git a/chromium/third_party/blink/public/web/web_frame.h b/chromium/third_party/blink/public/web/web_frame.h
index 0750d402b12..1fd3970fcbd 100644
--- a/chromium/third_party/blink/public/web/web_frame.h
+++ b/chromium/third_party/blink/public/web/web_frame.h
@@ -73,6 +73,8 @@ class BLINK_EXPORT WebFrame {
   // Returns the number of live WebFrame objects, used for leak checking.
   static int InstanceCount();
 
+  static WebFrame* FromFrameToken(const base::UnguessableToken&);
+
   virtual bool IsWebLocalFrame() const = 0;
   virtual WebLocalFrame* ToWebLocalFrame() = 0;
   virtual bool IsWebRemoteFrame() const = 0;
diff --git a/chromium/third_party/blink/public/web/web_frame_widget.h b/chromium/third_party/blink/public/web/web_frame_widget.h
index 6cc634179f6..af3d39a107e 100644
--- a/chromium/third_party/blink/public/web/web_frame_widget.h
+++ b/chromium/third_party/blink/public/web/web_frame_widget.h
@@ -31,11 +31,14 @@
 #ifndef THIRD_PARTY_BLINK_PUBLIC_WEB_WEB_FRAME_WIDGET_H_
 #define THIRD_PARTY_BLINK_PUBLIC_WEB_WEB_FRAME_WIDGET_H_
 
+#include <stdint.h>
+
+#include "base/callback_forward.h"
+#include "third_party/blink/public/common/page/web_drag_operation.h"
 #include "third_party/blink/public/mojom/page/widget.mojom-shared.h"
 #include "third_party/blink/public/platform/cross_variant_mojo_util.h"
 #include "third_party/blink/public/platform/viewport_intersection_state.h"
 #include "third_party/blink/public/platform/web_common.h"
-#include "third_party/blink/public/platform/web_drag_operation.h"
 #include "third_party/blink/public/platform/web_touch_action.h"
 #include "third_party/blink/public/web/web_swap_result.h"
 #include "third_party/blink/public/web/web_widget.h"
@@ -97,11 +100,12 @@ class WebFrameWidget : public WebWidget {
       const gfx::PointF& screen_point,
       WebDragOperationsMask operations_allowed,
       int modifiers) = 0;
-  virtual WebDragOperation DragTargetDragOver(
+  virtual void DragTargetDragOver(
       const gfx::PointF& point_in_viewport,
       const gfx::PointF& screen_point,
       WebDragOperationsMask operations_allowed,
-      int modifiers) = 0;
+      uint32_t modifiers,
+      base::OnceCallback<void(blink::WebDragOperation)> callback) = 0;
   virtual void DragTargetDragLeave(const gfx::PointF& point_in_viewport,
                                    const gfx::PointF& screen_point) = 0;
   virtual void DragTargetDrop(const WebDragData&,
@@ -154,6 +158,28 @@ class WebFrameWidget : public WebWidget {
       WebReportTimeCallback swap_callback,
       WebReportTimeCallback presentation_callback) = 0;
 
+  // Instructs devtools to pause loading of the frame as soon as it's shown
+  // until explicit command from the devtools client.
+  virtual void WaitForDebuggerWhenShown() = 0;
+
+  // Scales the text in the frame by a factor of text_zoom_factor.
+  virtual void SetTextZoomFactor(float text_zoom_factor) = 0;
+  // Returns the current text zoom factor, where 1.0 is the normal size, > 1.0
+  // is scaled up and < 1.0 is scaled down.
+  virtual float TextZoomFactor() = 0;
+
+  // Overlay this frame with a solid color. Only valid for the main frame's
+  // widget.
+  virtual void SetMainFrameOverlayColor(SkColor) = 0;
+
+  // Add an edit command to be processed as the default action if the next
+  // keyboard event is unhandled.
+  virtual void AddEditCommandForNextKeyEvent(const WebString& name,
+                                             const WebString& value) = 0;
+
+  // Clear any active edit commands that are pending.
+  virtual void ClearEditCommands() = 0;
+
  private:
   // This private constructor and the class/friend declaration ensures that
   // WebFrameWidgetBase is the only concrete subclass that implements
diff --git a/chromium/third_party/blink/public/web/web_ime_text_span.h b/chromium/third_party/blink/public/web/web_ime_text_span.h
deleted file mode 100644
index bf1db07dad3..00000000000
--- a/chromium/third_party/blink/public/web/web_ime_text_span.h
+++ /dev/null
@@ -1,108 +0,0 @@
-/*
- * Copyright (C) 2010 Google Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions are
- * met:
- *
- *     * Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- *     * Redistributions in binary form must reproduce the above
- * copyright notice, this list of conditions and the following disclaimer
- * in the documentation and/or other materials provided with the
- * distribution.
- *     * Neither the name of Google Inc. nor the names of its
- * contributors may be used to endorse or promote products derived from
- * this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
- * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#ifndef THIRD_PARTY_BLINK_PUBLIC_WEB_WEB_IME_TEXT_SPAN_H_
-#define THIRD_PARTY_BLINK_PUBLIC_WEB_WEB_IME_TEXT_SPAN_H_
-
-#include <string>
-#include <vector>
-
-#include "third_party/skia/include/core/SkColor.h"
-#include "ui/base/ime/mojom/ime_types.mojom-shared.h"
-
-namespace blink {
-
-// Class WebImeTextSpan is intended to be used with WebWidget's
-// setComposition() method.
-struct WebImeTextSpan {
-  enum class Type {
-    // Creates a composition marker.
-    kComposition,
-    // Creates a suggestion marker that isn't cleared after the user picks a
-    // replacement.
-    kSuggestion,
-    // Creates a suggestion marker that is cleared after the user picks a
-    // replacement, and will be ignored if added to an element with spell
-    // checking disabled.
-    kMisspellingSuggestion,
-  };
-
-  WebImeTextSpan()
-      : type(Type::kComposition),
-        start_offset(0),
-        end_offset(0),
-        thickness(ui::mojom::ImeTextSpanThickness::kThin),
-        underline_style(ui::mojom::ImeTextSpanUnderlineStyle::kSolid),
-        background_color(0),
-        suggestion_highlight_color(0),
-        suggestions(std::vector<std::string>()) {}
-
-  WebImeTextSpan(
-      Type ty,
-      unsigned s,
-      unsigned e,
-      ui::mojom::ImeTextSpanThickness th,
-      ui::mojom::ImeTextSpanUnderlineStyle us,
-      SkColor bc,
-      SkColor shc = 0,
-      const std::vector<std::string>& su = std::vector<std::string>())
-      : type(ty),
-        start_offset(s),
-        end_offset(e),
-        thickness(th),
-        underline_style(us),
-        background_color(bc),
-        suggestion_highlight_color(shc),
-        suggestions(su) {}
-
-  bool operator<(const WebImeTextSpan& other) const {
-    return start_offset != other.start_offset
-               ? start_offset < other.start_offset
-               : end_offset < other.end_offset;
-  }
-
-  // Need to update IPC_STRUCT_TRAITS_BEGIN(blink::WebImeTextSpan)
-  // if members change.
-  Type type;
-  unsigned start_offset;
-  unsigned end_offset;
-  SkColor underline_color = SK_ColorTRANSPARENT;
-  ui::mojom::ImeTextSpanThickness thickness;
-  ui::mojom::ImeTextSpanUnderlineStyle underline_style;
-  SkColor text_color = SK_ColorTRANSPARENT;
-  SkColor background_color;
-  SkColor suggestion_highlight_color;
-  bool remove_on_finish_composing;
-  std::vector<std::string> suggestions;
-};
-
-}  // namespace blink
-
-#endif
diff --git a/chromium/third_party/blink/public/web/web_input_method_controller.h b/chromium/third_party/blink/public/web/web_input_method_controller.h
index f06ec0bfe7b..6686cfdc229 100644
--- a/chromium/third_party/blink/public/web/web_input_method_controller.h
+++ b/chromium/third_party/blink/public/web/web_input_method_controller.h
@@ -6,8 +6,8 @@
 #define THIRD_PARTY_BLINK_PUBLIC_WEB_WEB_INPUT_METHOD_CONTROLLER_H_
 
 #include "third_party/blink/public/platform/web_text_input_info.h"
-#include "third_party/blink/public/web/web_ime_text_span.h"
 #include "third_party/blink/public/web/web_widget.h"
+#include "ui/base/ime/ime_text_span.h"
 
 namespace blink {
 
@@ -33,7 +33,7 @@ class WebInputMethodController {
   // current text which should be replaced by |text|. Returns true if the
   // composition text was set successfully.
   virtual bool SetComposition(const WebString& text,
-                              const WebVector<WebImeTextSpan>& ime_text_spans,
+                              const WebVector<ui::ImeTextSpan>& ime_text_spans,
                               const WebRange& replacement_range,
                               int selection_start,
                               int selection_end) = 0;
@@ -43,7 +43,7 @@ class WebInputMethodController {
   // |replacementRange| (when not null) is the range in current text which
   // should be replaced by |text|.
   virtual bool CommitText(const WebString& text,
-                          const WebVector<WebImeTextSpan>& ime_text_spans,
+                          const WebVector<ui::ImeTextSpan>& ime_text_spans,
                           const WebRange& replacement_range,
                           int relative_caret_position) = 0;
 
@@ -89,9 +89,16 @@ class WebInputMethodController {
   // Returns true if the inputPanelPolicy flag is set as manual in
   // |EditContext|, which indicates that the software input panel(Virtual
   // Keyboard) shouldn't come up on focus of the EditControl.
-  virtual bool IsInputPanelPolicyManual() const = 0;
+  virtual bool IsVirtualKeyboardPolicyManual() const = 0;
   // Returns true if there is an active |EditContext|.
   virtual bool IsEditContextActive() const = 0;
+
+  // Returns whether show()/hide() API is called from virtualkeyboard or not.
+  virtual ui::mojom::VirtualKeyboardVisibilityRequest
+  GetLastVirtualKeyboardVisibilityRequest() const = 0;
+  // Sets the VirtualKeyboard visibility request(show/hide/none).
+  virtual void SetVirtualKeyboardVisibilityRequest(
+      ui::mojom::VirtualKeyboardVisibilityRequest vk_visibility_request) = 0;
 };
 
 }  // namespace blink
diff --git a/chromium/third_party/blink/public/web/web_local_frame.h b/chromium/third_party/blink/public/web/web_local_frame.h
index 19a7338c005..2b6ac1ab437 100644
--- a/chromium/third_party/blink/public/web/web_local_frame.h
+++ b/chromium/third_party/blink/public/web/web_local_frame.h
@@ -19,6 +19,7 @@
 #include "third_party/blink/public/common/frame/user_activation_update_source.h"
 #include "third_party/blink/public/common/messaging/transferable_message.h"
 #include "third_party/blink/public/mojom/ad_tagging/ad_frame.mojom-shared.h"
+#include "third_party/blink/public/mojom/blob/blob_url_store.mojom-shared.h"
 #include "third_party/blink/public/mojom/commit_result/commit_result.mojom-shared.h"
 #include "third_party/blink/public/mojom/devtools/devtools_agent.mojom-shared.h"
 #include "third_party/blink/public/mojom/devtools/inspector_issue.mojom-shared.h"
@@ -37,7 +38,6 @@
 #include "third_party/blink/public/web/web_document_loader.h"
 #include "third_party/blink/public/web/web_frame.h"
 #include "third_party/blink/public/web/web_frame_load_type.h"
-#include "third_party/blink/public/web/web_ime_text_span.h"
 #include "third_party/blink/public/web/web_navigation_params.h"
 #include "v8/include/v8.h"
 
@@ -45,6 +45,10 @@ namespace gfx {
 class Point;
 }  // namespace gfx
 
+namespace ui {
+struct ImeTextSpan;
+}  // namespace ui
+
 namespace blink {
 
 class FrameScheduler;
@@ -58,6 +62,7 @@ class WebLocalFrameClient;
 class WebFrameWidget;
 class WebInputMethodController;
 class WebPerformance;
+class WebPlugin;
 class WebRange;
 class WebSecurityOrigin;
 class WebScriptExecutionCallback;
@@ -200,9 +205,9 @@ class WebLocalFrame : public WebFrame {
   virtual void SetEmbeddingToken(
       const base::UnguessableToken& embedding_token) = 0;
 
-  // Returns the embedding token for this frame or nullopt if it isn't embedded.
-  // This is the token that the remote parent of this frame uses to uniquely
-  // identify it.
+  // Returns the embedding token for this frame or nullopt if the frame hasn't
+  // committed a navigation. This token changes when a new document is committed
+  // in this WebLocalFrame.
   virtual const base::Optional<base::UnguessableToken>& GetEmbeddingToken() = 0;
 
   // Navigation Ping --------------------------------------------------------
@@ -239,7 +244,8 @@ class WebLocalFrame : public WebFrame {
   virtual void DownloadURL(
       const WebURLRequest& request,
       network::mojom::RedirectMode cross_origin_redirect_behavior,
-      mojo::ScopedMessagePipeHandle blob_url_token) = 0;
+      CrossVariantMojoRemote<mojom::BlobURLTokenInterfaceBase>
+          blob_url_token) = 0;
 
   // Navigation State -------------------------------------------------------
 
@@ -264,6 +270,7 @@ class WebLocalFrame : public WebFrame {
                                  const WebURL& mixed_content_url,
                                  mojom::RequestContextType,
                                  bool was_allowed,
+                                 const WebURL& url_before_redirects,
                                  bool had_redirect,
                                  const WebSourceLocation&) = 0;
 
@@ -312,9 +319,18 @@ class WebLocalFrame : public WebFrame {
   // Sets up an isolated world by associating a |world_id| with |info|.
   // worldID must be > 0 (as 0 represents the main world).
   // worldID must be < kEmbedderWorldIdLimit, high number used internally.
+  // TODO(karandeepb): This modifies the global isolated world info and hence
+  // should ideally be moved out of WebLocalFrame.
   virtual void SetIsolatedWorldInfo(int32_t world_id,
                                     const WebIsolatedWorldInfo& info) = 0;
 
+  // Returns the stable ID that was set with SetIsolatedWorldInfo.
+  virtual WebString GetIsolatedWorldStableId(v8::Local<v8::Context>) const = 0;
+
+  // Returns the human readable name that was set with SetIsolatedWorldInfo.
+  virtual WebString GetIsolatedWorldHumanReadableName(
+      v8::Local<v8::Context>) const = 0;
+
   // Executes script in the context of the current page and returns the value
   // that the script evaluated to.
   // DEPRECATED: Use WebLocalFrame::requestExecuteScriptAndReturnValue.
@@ -336,6 +352,10 @@ class WebLocalFrame : public WebFrame {
   // be calling this API.
   virtual v8::Local<v8::Context> MainWorldScriptContext() const = 0;
 
+  // Returns the world ID associated with |script_context|.
+  virtual int32_t GetScriptContextWorldId(
+      v8::Local<v8::Context> script_context) const = 0;
+
   // Executes script in the context of the current page and returns the value
   // that the script evaluated to with callback. Script execution can be
   // suspend.
@@ -425,7 +445,8 @@ class WebLocalFrame : public WebFrame {
   // (i.e its anchor is its start).
   virtual bool IsSelectionAnchorFirst() const = 0;
   // Changes the text direction of the selected input node.
-  virtual void SetTextDirection(base::i18n::TextDirection) = 0;
+  virtual void SetTextDirectionForTesting(
+      base::i18n::TextDirection direction) = 0;
 
   // Selection -----------------------------------------------------------
 
@@ -475,7 +496,7 @@ class WebLocalFrame : public WebFrame {
   virtual bool SetCompositionFromExistingText(
       int composition_start,
       int composition_end,
-      const WebVector<WebImeTextSpan>& ime_text_spans) = 0;
+      const WebVector<ui::ImeTextSpan>& ime_text_spans) = 0;
   virtual void ExtendSelectionAndDelete(int before, int after) = 0;
 
   // Moves the selection extent point. This function does not allow the
@@ -549,7 +570,7 @@ class WebLocalFrame : public WebFrame {
                               const WebString& search_text,
                               bool match_case,
                               bool forward,
-                              bool find_next,
+                              bool new_session,
                               bool force,
                               bool wrap_within_frame) = 0;
 
@@ -650,13 +671,16 @@ class WebLocalFrame : public WebFrame {
   // This function should be called before pairs of PrintBegin() and PrintEnd().
   virtual void DispatchBeforePrintEvent() = 0;
 
+  // Get the plugin to print, if any. The |constrain_to_node| parameter is the
+  // same as the one for PrintBegin() below.
+  virtual WebPlugin* GetPluginToPrint(const WebNode& constrain_to_node) = 0;
+
   // Reformats the WebFrame for printing. WebPrintParams specifies the printable
   // content size, paper size, printable area size, printer DPI and print
-  // scaling option. If constrainToNode node is specified, then only the given
+  // scaling option. If |constrain_to_node| is specified, then only the given
   // node is printed (for now only plugins are supported), instead of the entire
   // frame.
-  // Returns the number of pages that can be printed at the given
-  // page size.
+  // Returns the number of pages that can be printed at the given page size.
   virtual int PrintBegin(const WebPrintParams&,
                          const WebNode& constrain_to_node = WebNode()) = 0;
 
@@ -685,14 +709,12 @@ class WebLocalFrame : public WebFrame {
 
   // Paint Preview ------------------------------------------------------------
 
-  // Captures a full frame paint preview of the WebFrame including subframes.
+  // Captures a full frame paint preview of the WebFrame including subframes. If
+  // |include_linked_destinations| is true, the capture will include annotations
+  // about linked destinations within the document.
   virtual bool CapturePaintPreview(const WebRect& bounds,
-                                   cc::PaintCanvas* canvas) = 0;
-
-  // FrameOverlay ----------------------------------------------------------
-
-  // Overlay this frame with a solid color. Only valid for the main frame.
-  virtual void SetMainFrameOverlayColor(SkColor) = 0;
+                                   cc::PaintCanvas* canvas,
+                                   bool include_linked_destinations) = 0;
 
   // Focus --------------------------------------------------------------
 
@@ -730,17 +752,21 @@ class WebLocalFrame : public WebFrame {
       UserActivationUpdateSource update_source =
           UserActivationUpdateSource::kRenderer) = 0;
 
-  // DevTools -----------------------------------------------------------------
-
-  // Instructs devtools to pause loading of the frame as soon as it's shown
-  // until explicit command from the devtools client.
-  virtual void WaitForDebuggerWhenShown() = 0;
-
   // Testing ------------------------------------------------------------------
 
+  // Get the total spool size (the bounding box of all the pages placed after
+  // oneanother vertically), when printing for testing. Even if we still only
+  // support a uniform page size, some pages may be rotated using
+  // page-orientation.
+  virtual WebSize SpoolSizeInPixelsForTesting(
+      const WebSize& page_size_in_pixels,
+      int page_count) = 0;
+
   // Prints the frame into the canvas, with page boundaries drawn as one pixel
   // wide blue lines. This method exists to support web tests.
-  virtual void PrintPagesForTesting(cc::PaintCanvas*, const WebSize&) = 0;
+  virtual void PrintPagesForTesting(cc::PaintCanvas*,
+                                    const WebSize& page_size_in_pixels,
+                                    const WebSize& spool_size_in_pixels) = 0;
 
   // Returns the bounds rect for current selection. If selection is performed
   // on transformed text, the rect will still bound the selection but will
@@ -752,8 +778,6 @@ class WebLocalFrame : public WebFrame {
   // local root).
   virtual gfx::Point GetPositionInViewportForTesting() const = 0;
 
-  virtual void SetLifecycleState(mojom::FrameLifecycleState state) = 0;
-
   virtual void WasHidden() = 0;
   virtual void WasShown() = 0;
 
diff --git a/chromium/third_party/blink/public/web/web_local_frame_client.h b/chromium/third_party/blink/public/web/web_local_frame_client.h
index 772f7242ff4..f0a05ead42b 100644
--- a/chromium/third_party/blink/public/web/web_local_frame_client.h
+++ b/chromium/third_party/blink/public/web/web_local_frame_client.h
@@ -37,6 +37,7 @@
 #include "base/i18n/rtl.h"
 #include "base/optional.h"
 #include "base/unguessable_token.h"
+#include "media/base/speech_recognition_client.h"
 #include "services/network/public/mojom/web_sandbox_flags.mojom-shared.h"
 #include "third_party/blink/public/common/feature_policy/feature_policy.h"
 #include "third_party/blink/public/common/loader/loading_behavior_flag.h"
@@ -155,6 +156,13 @@ class BLINK_EXPORT WebLocalFrameClient {
     return nullptr;
   }
 
+  // May return null.
+  virtual std::unique_ptr<media::SpeechRecognitionClient>
+  CreateSpeechRecognitionClient(
+      media::SpeechRecognitionClient::OnReadyCallback callback) {
+    return nullptr;
+  }
+
   // Returns a new WebWorkerFetchContext for a dedicated worker (in the
   // non-PlzDedicatedWorker case) or worklet.
   virtual scoped_refptr<WebWorkerFetchContext> CreateWorkerFetchContext() {
@@ -229,10 +237,6 @@ class BLINK_EXPORT WebLocalFrameClient {
   // from outside of the browsing instance.
   virtual WebFrame* FindFrame(const WebString& name) { return nullptr; }
 
-  // This frame has set its opener to another frame, or disowned the opener
-  // if opener is null. See http://html.spec.whatwg.org/#dom-opener.
-  virtual void DidChangeOpener(WebFrame*) {}
-
   // Specifies the reason for the detachment.
   enum class DetachType { kRemove, kSwap };
 
@@ -245,11 +249,6 @@ class BLINK_EXPORT WebLocalFrameClient {
   // This frame's name has changed.
   virtual void DidChangeName(const WebString& name) {}
 
-  // The sandbox flags or container policy have changed for a child frame of
-  // this frame.
-  virtual void DidChangeFramePolicy(WebFrame* child_frame, const FramePolicy&) {
-  }
-
   // Called when a Feature-Policy or Document-Policy or Content-Security-Policy
   // HTTP header (for sandbox flags) is encountered while loading the frame's
   // document.
@@ -430,15 +429,6 @@ class BLINK_EXPORT WebLocalFrameClient {
   virtual void DidChangeSelection(bool is_selection_empty) {}
   virtual void DidChangeContents() {}
 
-  // This method is called in response to handleInputEvent() when the
-  // default action for the current keyboard event is not suppressed by the
-  // page, to give the embedder a chance to handle the keyboard event
-  // specially.
-  //
-  // Returns true if the keyboard event was handled by the embedder,
-  // indicating that the default action should be suppressed.
-  virtual bool HandleCurrentKeyboardEvent() { return false; }
-
   // UI ------------------------------------------------------------------
 
   // Shows a context menu with commands relevant to a specific element on
@@ -490,6 +480,14 @@ class BLINK_EXPORT WebLocalFrameClient {
   // An Input Event observed.
   virtual void DidObserveInputDelay(base::TimeDelta input_delay) {}
 
+  // The first scroll delay, which measures the time between the user's first
+  // scrolling and the resultant display update, has been observed.
+  // The first scroll timestamp is when the first scroll event was created which
+  // is the hardware timestamp provided by the host OS.
+  virtual void DidObserveFirstScrollDelay(
+      base::TimeDelta first_scroll_delay,
+      base::TimeTicks first_scroll_timestamp) {}
+
   // A cpu task or tasks completed.  Triggered when at least 100ms of wall time
   // was spent in tasks on the frame.
   virtual void DidChangeCpuTiming(base::TimeDelta time) {}
@@ -676,6 +674,14 @@ class BLINK_EXPORT WebLocalFrameClient {
   virtual bool GetCaretBoundsFromFocusedPlugin(gfx::Rect& rect) {
     return false;
   }
+
+  // Called by WebFrameWidgetBase, it submits throughput data to the browser
+  // process. The browser process aggregates the data and eventually reports to
+  // the UKM.
+  virtual void SubmitThroughputData(ukm::SourceId source_id,
+                                    int aggregated_percent,
+                                    int impl_percent,
+                                    base::Optional<int> main_percent) {}
 };
 
 }  // namespace blink
diff --git a/chromium/third_party/blink/public/web/web_navigation_control.h b/chromium/third_party/blink/public/web/web_navigation_control.h
index 0591ac71993..5f15979d36c 100644
--- a/chromium/third_party/blink/public/web/web_navigation_control.h
+++ b/chromium/third_party/blink/public/web/web_navigation_control.h
@@ -82,23 +82,12 @@ class WebNavigationControl : public WebLocalFrame {
   // This runs some JavaScript event listeners, which may cancel the navigation
   // or detach the frame. In this case the method returns false and client
   // should not proceed with the navigation.
-  virtual bool WillStartNavigation(
-      const WebNavigationInfo&,
-      bool is_history_navigation_in_new_child_frame) = 0;
+  virtual bool WillStartNavigation(const WebNavigationInfo&) = 0;
 
   // Informs the frame that the navigation it asked the client to do was
   // dropped.
   virtual void DidDropNavigation() = 0;
 
-  // Marks the frame as loading, without performing any loading. Used for
-  // initial history navigations in child frames, which may actually happen
-  // in another process.
-  virtual void MarkAsLoading() = 0;
-
-  // TODO(ahemery): Remove all IsClientNavigationInitialHistoryLoad functions
-  // when IsPerNavigationMojoInterface is enabled.
-  virtual bool IsClientNavigationInitialHistoryLoad() = 0;
-
  protected:
   explicit WebNavigationControl(mojom::TreeScopeType scope,
                                 const base::UnguessableToken& frame_token)
diff --git a/chromium/third_party/blink/public/web/web_navigation_params.h b/chromium/third_party/blink/public/web/web_navigation_params.h
index 3f21cf93092..62d8c3d12fe 100644
--- a/chromium/third_party/blink/public/web/web_navigation_params.h
+++ b/chromium/third_party/blink/public/web/web_navigation_params.h
@@ -11,11 +11,12 @@
 #include "base/optional.h"
 #include "base/time/time.h"
 #include "base/unguessable_token.h"
-#include "mojo/public/cpp/system/message_pipe.h"
 #include "services/network/public/mojom/ip_address_space.mojom-shared.h"
 #include "services/network/public/mojom/referrer_policy.mojom-shared.h"
+#include "services/network/public/mojom/url_loader_factory.mojom-shared.h"
 #include "third_party/blink/public/common/frame/frame_policy.h"
 #include "third_party/blink/public/common/navigation/triggering_event_info.h"
+#include "third_party/blink/public/mojom/blob/blob_url_store.mojom-shared.h"
 #include "third_party/blink/public/mojom/fetch/fetch_api_request.mojom-shared.h"
 #include "third_party/blink/public/mojom/frame/navigation_initiator.mojom-shared.h"
 #include "third_party/blink/public/platform/cross_variant_mojo_util.h"
@@ -128,7 +129,7 @@ struct BLINK_EXPORT WebNavigationInfo {
           network::mojom::CSPDisposition::CHECK;
 
   // When navigating to a blob url, this token specifies the blob.
-  mojo::ScopedMessagePipeHandle blob_url_token;
+  CrossVariantMojoRemote<mojom::BlobURLTokenInterfaceBase> blob_url_token;
 
   // When navigation initiated from the user input, this tracks
   // the input start time.
@@ -352,14 +353,16 @@ struct BLINK_EXPORT WebNavigationParams {
         const WebString& header_integrity,
         const WebURL& inner_url,
         const WebURLResponse& inner_response,
-        mojo::ScopedMessagePipeHandle loader_factory_handle);
+        CrossVariantMojoRemote<network::mojom::URLLoaderFactoryInterfaceBase>
+            loader_factory);
     ~PrefetchedSignedExchange();
 
     WebURL outer_url;
     WebString header_integrity;
     WebURL inner_url;
     WebURLResponse inner_response;
-    mojo::ScopedMessagePipeHandle loader_factory_handle;
+    CrossVariantMojoRemote<network::mojom::URLLoaderFactoryInterfaceBase>
+        loader_factory;
   };
   WebVector<std::unique_ptr<PrefetchedSignedExchange>>
       prefetched_signed_exchanges;
@@ -387,6 +390,9 @@ struct BLINK_EXPORT WebNavigationParams {
 
   // A list of origin trial names to enable for the document being loaded.
   WebVector<WebString> force_enabled_origin_trials;
+
+  // Whether origin isolation is restricting certain cross-origin web APIs.
+  bool origin_isolation_restricted = false;
 };
 
 }  // namespace blink
diff --git a/chromium/third_party/blink/public/web/web_performance.h b/chromium/third_party/blink/public/web/web_performance.h
index ab7c1b2fb32..2da8d142046 100644
--- a/chromium/third_party/blink/public/web/web_performance.h
+++ b/chromium/third_party/blink/public/web/web_performance.h
@@ -34,6 +34,7 @@
 #include "base/time/time.h"
 #include "third_party/blink/public/platform/web_common.h"
 #include "third_party/blink/public/platform/web_private_ptr.h"
+#include "third_party/blink/public/platform/web_vector.h"
 #include "third_party/blink/public/web/web_navigation_type.h"
 
 #if INSIDE_BLINK
@@ -46,6 +47,15 @@ class WindowPerformance;
 
 class WebPerformance {
  public:
+  struct BackForwardCacheRestoreTiming {
+    double navigation_start = 0;
+    double first_paint = 0;
+    base::Optional<base::TimeDelta> first_input_delay;
+  };
+
+  using BackForwardCacheRestoreTimings =
+      WebVector<BackForwardCacheRestoreTiming>;
+
   ~WebPerformance() { Reset(); }
 
   WebPerformance() = default;
@@ -68,6 +78,7 @@ class WebPerformance {
   BLINK_EXPORT double InputForNavigationStart() const;
   BLINK_EXPORT double NavigationStart() const;
   BLINK_EXPORT base::TimeTicks NavigationStartAsMonotonicTime() const;
+  BLINK_EXPORT BackForwardCacheRestoreTimings BackForwardCacheRestore() const;
   BLINK_EXPORT double UnloadEventEnd() const;
   BLINK_EXPORT double RedirectStart() const;
   BLINK_EXPORT double RedirectEnd() const;
@@ -97,11 +108,19 @@ class WebPerformance {
   BLINK_EXPORT uint64_t LargestImagePaintSize() const;
   BLINK_EXPORT double LargestTextPaint() const;
   BLINK_EXPORT uint64_t LargestTextPaintSize() const;
+  BLINK_EXPORT double ExperimentalLargestImagePaint() const;
+  BLINK_EXPORT uint64_t ExperimentalLargestImagePaintSize() const;
+  BLINK_EXPORT double ExperimentalLargestTextPaint() const;
+  BLINK_EXPORT uint64_t ExperimentalLargestTextPaintSize() const;
+  BLINK_EXPORT double FirstEligibleToPaint() const;
   BLINK_EXPORT double FirstInputOrScrollNotifiedTimestamp() const;
   BLINK_EXPORT base::Optional<base::TimeDelta> FirstInputDelay() const;
   BLINK_EXPORT base::Optional<base::TimeDelta> FirstInputTimestamp() const;
   BLINK_EXPORT base::Optional<base::TimeDelta> LongestInputDelay() const;
   BLINK_EXPORT base::Optional<base::TimeDelta> LongestInputTimestamp() const;
+  BLINK_EXPORT base::Optional<base::TimeDelta> FirstInputProcessingTime() const;
+  BLINK_EXPORT base::Optional<base::TimeDelta> FirstScrollDelay() const;
+  BLINK_EXPORT base::Optional<base::TimeDelta> FirstScrollTimestamp() const;
   BLINK_EXPORT double ParseStart() const;
   BLINK_EXPORT double ParseStop() const;
   BLINK_EXPORT double ParseBlockedOnScriptLoadDuration() const;
@@ -109,6 +128,7 @@ class WebPerformance {
   BLINK_EXPORT double ParseBlockedOnScriptExecutionDuration() const;
   BLINK_EXPORT double ParseBlockedOnScriptExecutionFromDocumentWriteDuration()
       const;
+  BLINK_EXPORT base::Optional<base::TimeTicks> LastPortalActivatedPaint() const;
 
 #if INSIDE_BLINK
   BLINK_EXPORT WebPerformance(WindowPerformance*);
diff --git a/chromium/third_party/blink/public/web/web_plugin.h b/chromium/third_party/blink/public/web/web_plugin.h
index dc1ac534d4c..5fc43caba29 100644
--- a/chromium/third_party/blink/public/web/web_plugin.h
+++ b/chromium/third_party/blink/public/web/web_plugin.h
@@ -33,8 +33,8 @@
 #define THIRD_PARTY_BLINK_PUBLIC_WEB_WEB_PLUGIN_H_
 
 #include "cc/paint/paint_canvas.h"
+#include "third_party/blink/public/common/page/web_drag_operation.h"
 #include "third_party/blink/public/mojom/input/focus_type.mojom-shared.h"
-#include "third_party/blink/public/platform/web_drag_operation.h"
 #include "third_party/blink/public/platform/web_string.h"
 #include "third_party/blink/public/platform/web_url.h"
 #include "third_party/blink/public/web/web_drag_status.h"
@@ -47,6 +47,7 @@ class PointF;
 
 namespace ui {
 class Cursor;
+struct ImeTextSpan;
 }
 
 namespace blink {
@@ -55,7 +56,6 @@ class WebCoalescedInputEvent;
 class WebDragData;
 class WebPluginContainer;
 class WebURLResponse;
-struct WebImeTextSpan;
 struct WebPrintParams;
 struct WebPrintPresetOptions;
 struct WebRect;
@@ -103,7 +103,6 @@ class WebPlugin {
   }
 
   virtual bool SupportsKeyboardFocus() const { return false; }
-  virtual bool SupportsEditCommands() const { return false; }
   // Returns true if this plugin supports input method, which implements
   // setComposition(), commitText() and finishComposingText() below.
   virtual bool SupportsInputMethod() const { return false; }
@@ -180,7 +179,7 @@ class WebPlugin {
   // composition is set successfully. If |replacementRange| is not null, the
   // text inside |replacementRange| will be replaced by |text|
   virtual bool SetComposition(const WebString& text,
-                              const WebVector<WebImeTextSpan>& ime_text_spans,
+                              const WebVector<ui::ImeTextSpan>& ime_text_spans,
                               const WebRange& replacement_range,
                               int selection_start,
                               int selection_end) {
@@ -191,7 +190,7 @@ class WebPlugin {
   // moves the caret according to relativeCaretPosition. If |replacementRange|
   // is not null, the text inside |replacementRange| will be replaced by |text|.
   virtual bool CommitText(const WebString& text,
-                          const WebVector<WebImeTextSpan>& ime_text_spans,
+                          const WebVector<ui::ImeTextSpan>& ime_text_spans,
                           const WebRange& replacement_range,
                           int relative_caret_position) {
     return false;
diff --git a/chromium/third_party/blink/public/web/web_print_page_description.h b/chromium/third_party/blink/public/web/web_print_page_description.h
index e7447bd9966..5b8b0c50a41 100644
--- a/chromium/third_party/blink/public/web/web_print_page_description.h
+++ b/chromium/third_party/blink/public/web/web_print_page_description.h
@@ -5,6 +5,7 @@
 #ifndef THIRD_PARTY_BLINK_PUBLIC_WEB_WEB_PRINT_PAGE_DESCRIPTION_H_
 #define THIRD_PARTY_BLINK_PUBLIC_WEB_WEB_PRINT_PAGE_DESCRIPTION_H_
 
+#include "third_party/blink/public/common/css/page_orientation.h"
 #include "third_party/blink/public/platform/web_double_size.h"
 
 namespace blink {
@@ -16,6 +17,7 @@ struct WebPrintPageDescription {
   int margin_right = 0;
   int margin_bottom = 0;
   int margin_left = 0;
+  PageOrientation orientation = PageOrientation::kUpright;
 };
 
 }  // namespace blink
diff --git a/chromium/third_party/blink/public/web/web_print_params.h b/chromium/third_party/blink/public/web/web_print_params.h
index 1809e2574e3..5ecbff4d4b4 100644
--- a/chromium/third_party/blink/public/web/web_print_params.h
+++ b/chromium/third_party/blink/public/web/web_print_params.h
@@ -31,9 +31,9 @@
 #ifndef THIRD_PARTY_BLINK_PUBLIC_WEB_WEB_PRINT_PARAMS_H_
 #define THIRD_PARTY_BLINK_PUBLIC_WEB_WEB_PRINT_PARAMS_H_
 
+#include "printing/mojom/print.mojom-shared.h"
 #include "third_party/blink/public/platform/web_rect.h"
 #include "third_party/blink/public/platform/web_size.h"
-#include "third_party/blink/public/web/web_print_scaling_option.h"
 
 namespace blink {
 
@@ -59,8 +59,8 @@ struct WebPrintParams {
 
   // Specifies whether to reduce/enlarge/retain the print contents to fit the
   // printable area. (This is used only by plugin printing).
-  WebPrintScalingOption print_scaling_option =
-      kWebPrintScalingOptionFitToPrintableArea;
+  printing::mojom::PrintScalingOption print_scaling_option =
+      printing::mojom::PrintScalingOption::kFitToPrintableArea;
 
   // Specifies whether printing layout needs to be applied.
   bool use_printing_layout = true;
@@ -77,7 +77,7 @@ struct WebPrintParams {
       : print_content_area(WebRect(0, 0, paper_size.width, paper_size.height)),
         printable_area(print_content_area),
         paper_size(paper_size),
-        print_scaling_option(kWebPrintScalingOptionSourceSize),
+        print_scaling_option(printing::mojom::PrintScalingOption::kSourceSize),
         use_printing_layout(use_printing_layout) {}
 };
 
diff --git a/chromium/third_party/blink/public/web/web_remote_frame.h b/chromium/third_party/blink/public/web/web_remote_frame.h
index 6854f0d9254..818a048b585 100644
--- a/chromium/third_party/blink/public/web/web_remote_frame.h
+++ b/chromium/third_party/blink/public/web/web_remote_frame.h
@@ -146,11 +146,6 @@ class WebRemoteFrame : public WebFrame {
   // "local" frame tree (ancestors-only vs all-nodes).
   virtual void UpdateUserActivationState(mojom::UserActivationUpdateType) = 0;
 
-  // Transfers user activation state from |source_frame| to this frame, which
-  // must be in the same frame tree as |source_frame|.
-  virtual void TransferUserActivationFrom(
-      blink::WebRemoteFrame* source_frame) = 0;
-
   virtual void SetHadStickyUserActivationBeforeNavigation(bool value) = 0;
 
   virtual WebRect GetCompositingRect() = 0;
diff --git a/chromium/third_party/blink/public/web/web_remote_frame_client.h b/chromium/third_party/blink/public/web/web_remote_frame_client.h
index c3ae4ec21a0..99f3495ec6f 100644
--- a/chromium/third_party/blink/public/web/web_remote_frame_client.h
+++ b/chromium/third_party/blink/public/web/web_remote_frame_client.h
@@ -7,8 +7,11 @@
 
 #include "base/optional.h"
 #include "cc/paint/paint_canvas.h"
+#include "third_party/blink/public/common/associated_interfaces/associated_interface_provider.h"
+#include "third_party/blink/public/mojom/blob/blob_url_store.mojom-shared.h"
 #include "third_party/blink/public/mojom/frame/lifecycle.mojom-shared.h"
 #include "third_party/blink/public/mojom/input/focus_type.mojom-shared.h"
+#include "third_party/blink/public/platform/cross_variant_mojo_util.h"
 #include "third_party/blink/public/platform/viewport_intersection_state.h"
 #include "third_party/blink/public/platform/web_impression.h"
 #include "third_party/blink/public/platform/web_security_origin.h"
@@ -29,22 +32,17 @@ class WebRemoteFrameClient {
   // and release any resources associated with it.
   virtual void FrameDetached(DetachType) {}
 
-  // Notifies the embedder that a postMessage was issued to a remote frame.
-  virtual void ForwardPostMessage(WebLocalFrame* source_frame,
-                                  WebRemoteFrame* target_frame,
-                                  WebSecurityOrigin target_origin,
-                                  WebDOMMessageEvent) {}
-
   // A remote frame was asked to start a navigation.
-  virtual void Navigate(const WebURLRequest& request,
-                        blink::WebLocalFrame* initiator_frame,
-                        bool should_replace_current_entry,
-                        bool is_opener_navigation,
-                        bool initiator_frame_has_download_sandbox_flag,
-                        bool blocking_downloads_in_sandbox_enabled,
-                        bool initiator_frame_is_ad,
-                        mojo::ScopedMessagePipeHandle blob_url_token,
-                        const base::Optional<WebImpression>& impression) {}
+  virtual void Navigate(
+      const WebURLRequest& request,
+      blink::WebLocalFrame* initiator_frame,
+      bool should_replace_current_entry,
+      bool is_opener_navigation,
+      bool initiator_frame_has_download_sandbox_flag,
+      bool blocking_downloads_in_sandbox_enabled,
+      bool initiator_frame_is_ad,
+      CrossVariantMojoRemote<mojom::BlobURLTokenInterfaceBase> blob_url_token,
+      const base::Optional<WebImpression>& impression) {}
 
   virtual void FrameRectsChanged(const WebRect& local_frame_rect,
                                  const WebRect& screen_space_rect) {}
@@ -52,13 +50,9 @@ class WebRemoteFrameClient {
   virtual void UpdateRemoteViewportIntersection(
       const ViewportIntersectionState& intersection_state) {}
 
-  // This frame updated its opener to another frame.
-  virtual void DidChangeOpener(WebFrame* opener) {}
-
-  // Continue sequential focus navigation in this frame.  This is called when
-  // the |source| frame is searching for the next focusable element (e.g., in
-  // response to <tab>) and encounters a remote frame.
-  virtual void AdvanceFocus(mojom::FocusType type, WebLocalFrame* source) {}
+  // Returns an AssociatedInterfaceProvider the frame can use to request
+  // associated interfaces from the browser.
+  virtual AssociatedInterfaceProvider* GetRemoteAssociatedInterfaces() = 0;
 
   // Returns token to be used as a frame id in the devtools protocol.
   // It is derived from the content's devtools_frame_token, is
diff --git a/chromium/third_party/blink/public/web/web_savable_resources_test_support.h b/chromium/third_party/blink/public/web/web_savable_resources_test_support.h
new file mode 100644
index 00000000000..8281f5c4359
--- /dev/null
+++ b/chromium/third_party/blink/public/web/web_savable_resources_test_support.h
@@ -0,0 +1,21 @@
+// Copyright (c) 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef THIRD_PARTY_BLINK_PUBLIC_WEB_WEB_SAVABLE_RESOURCES_TEST_SUPPORT_H_
+#define THIRD_PARTY_BLINK_PUBLIC_WEB_WEB_SAVABLE_RESOURCES_TEST_SUPPORT_H_
+
+#include "base/macros.h"
+#include "third_party/blink/public/platform/web_common.h"
+
+namespace blink {
+
+class WebString;
+class WebElement;
+
+BLINK_EXPORT WebString
+GetSubResourceLinkFromElementForTesting(const WebElement& element);
+
+}  // namespace blink
+
+#endif  // THIRD_PARTY_BLINK_PUBLIC_WEB_WEB_SAVABLE_RESOURCES_TEST_SUPPORT_H_
diff --git a/chromium/third_party/blink/public/web/web_settings.h b/chromium/third_party/blink/public/web/web_settings.h
index 51ec819969e..b3a40076827 100644
--- a/chromium/third_party/blink/public/web/web_settings.h
+++ b/chromium/third_party/blink/public/web/web_settings.h
@@ -219,7 +219,6 @@ class WebSettings {
                                   UScriptCode = USCRIPT_COMMON) = 0;
   virtual void SetShouldPrintBackgrounds(bool) = 0;
   virtual void SetShouldClearDocumentBackground(bool) = 0;
-  virtual void SetShouldRespectImageOrientation(bool) = 0;
   virtual void SetShowContextMenuOnMouseUp(bool) = 0;
   virtual void SetShrinksViewportContentToFit(bool) = 0;
   virtual void SetSmartInsertDeleteEnabled(bool) = 0;
@@ -297,6 +296,7 @@ class WebSettings {
   virtual void SetForceDarkModeEnabled(bool) = 0;
   virtual void SetPreferredColorScheme(PreferredColorScheme) = 0;
   virtual void SetNavigationControls(NavigationControls) = 0;
+  virtual void SetAriaModalPrunesAXTree(bool) = 0;
 
  protected:
   ~WebSettings() = default;
diff --git a/chromium/third_party/blink/public/web/web_shared_worker.h b/chromium/third_party/blink/public/web/web_shared_worker.h
index c2dd48dca42..a9f68c0f90f 100644
--- a/chromium/third_party/blink/public/web/web_shared_worker.h
+++ b/chromium/third_party/blink/public/web/web_shared_worker.h
@@ -34,12 +34,14 @@
 #include <memory>
 
 #include "base/unguessable_token.h"
-#include "mojo/public/cpp/system/message_pipe.h"
 #include "services/network/public/mojom/content_security_policy.mojom-shared.h"
 #include "services/network/public/mojom/fetch_api.mojom-shared.h"
 #include "services/network/public/mojom/ip_address_space.mojom-shared.h"
 #include "third_party/blink/public/common/user_agent/user_agent_metadata.h"
+#include "third_party/blink/public/mojom/browser_interface_broker.mojom-shared.h"
 #include "third_party/blink/public/mojom/script/script_type.mojom-shared.h"
+#include "third_party/blink/public/mojom/worker/worker_content_settings_proxy.mojom-shared.h"
+#include "third_party/blink/public/platform/cross_variant_mojo_util.h"
 #include "third_party/blink/public/platform/task_type.h"
 #include "third_party/blink/public/platform/web_common.h"
 #include "third_party/blink/public/platform/web_security_origin.h"
@@ -75,8 +77,10 @@ class BLINK_EXPORT WebSharedWorker {
       const WebFetchClientSettingsObject& outside_fetch_client_settings_object,
       const base::UnguessableToken& appcache_host_id,
       const base::UnguessableToken& devtools_worker_token,
-      mojo::ScopedMessagePipeHandle content_settings_handle,
-      mojo::ScopedMessagePipeHandle browser_interface_broker,
+      CrossVariantMojoRemote<mojom::WorkerContentSettingsProxyInterfaceBase>
+          content_settings,
+      CrossVariantMojoRemote<mojom::BrowserInterfaceBrokerInterfaceBase>
+          browser_interface_broker,
       bool pause_worker_context_on_start) = 0;
 
   // Sends a connect event to the SharedWorker context.
diff --git a/chromium/third_party/blink/public/web/web_shared_worker_client.h b/chromium/third_party/blink/public/web/web_shared_worker_client.h
index 1c520965cdf..81f8fabd133 100644
--- a/chromium/third_party/blink/public/web/web_shared_worker_client.h
+++ b/chromium/third_party/blink/public/web/web_shared_worker_client.h
@@ -31,8 +31,9 @@
 #ifndef THIRD_PARTY_BLINK_PUBLIC_WEB_WEB_SHARED_WORKER_CLIENT_H_
 #define THIRD_PARTY_BLINK_PUBLIC_WEB_WEB_SHARED_WORKER_CLIENT_H_
 
-#include "mojo/public/cpp/system/message_pipe.h"
+#include "third_party/blink/public/mojom/devtools/devtools_agent.mojom-shared.h"
 #include "third_party/blink/public/mojom/web_feature/web_feature.mojom-shared.h"
+#include "third_party/blink/public/platform/cross_variant_mojo_util.h"
 #include "third_party/blink/public/platform/web_content_settings_client.h"
 #include "third_party/blink/public/platform/web_worker_fetch_context.h"
 
@@ -50,8 +51,10 @@ class WebSharedWorkerClient {
   virtual void WorkerContextClosed() = 0;
   virtual void WorkerContextDestroyed() = 0;
   virtual void WorkerReadyForInspection(
-      mojo::ScopedMessagePipeHandle devtools_agent_ptr_info,
-      mojo::ScopedMessagePipeHandle devtools_agent_host_request) {}
+      CrossVariantMojoRemote<mojom::DevToolsAgentInterfaceBase>
+          devtools_agent_remote,
+      CrossVariantMojoReceiver<mojom::DevToolsAgentHostInterfaceBase>
+          devtools_agent_host_receiver) {}
   virtual void WorkerScriptLoadFailed(const std::string& error_message) = 0;
   virtual void WorkerScriptEvaluated(bool success) = 0;
 
diff --git a/chromium/third_party/blink/public/web/web_view.h b/chromium/third_party/blink/public/web/web_view.h
index 18ecf7968a4..baa1cec0752 100644
--- a/chromium/third_party/blink/public/web/web_view.h
+++ b/chromium/third_party/blink/public/web/web_view.h
@@ -32,11 +32,11 @@
 #define THIRD_PARTY_BLINK_PUBLIC_WEB_WEB_VIEW_H_
 
 #include "base/time/time.h"
+#include "third_party/blink/public/common/page/web_drag_operation.h"
 #include "third_party/blink/public/mojom/input/focus_type.mojom-shared.h"
 #include "third_party/blink/public/mojom/page/page.mojom-shared.h"
 #include "third_party/blink/public/mojom/page/page_visibility_state.mojom-shared.h"
 #include "third_party/blink/public/platform/cross_variant_mojo_util.h"
-#include "third_party/blink/public/platform/web_drag_operation.h"
 #include "third_party/blink/public/platform/web_string.h"
 #include "third_party/skia/include/core/SkColor.h"
 #include "ui/gfx/geometry/size.h"
@@ -120,6 +120,16 @@ class WebView {
   // detached.
   virtual void DidAttachLocalMainFrame() = 0;
 
+  // Called while the main LocalFrame is being detached. The MainFrameImpl() is
+  // still valid until after this method is called.
+  virtual void DidDetachLocalMainFrame() = 0;
+
+  // Called to inform WebViewImpl that a remote main frame has been attached.
+  virtual void DidAttachRemoteMainFrame() = 0;
+
+  // Called to inform WebViewImpl that a remote main frame has been detached.
+  virtual void DidDetachRemoteMainFrame() = 0;
+
   // Initializes the various client interfaces.
   virtual void SetPrerendererClient(WebPrerendererClient*) = 0;
 
@@ -195,14 +205,6 @@ class WebView {
   // change.
   virtual double SetZoomLevel(double) = 0;
 
-  // Returns the current text zoom factor, where 1.0 is the normal size, > 1.0
-  // is scaled up and < 1.0 is scaled down.
-  virtual float TextZoomFactor() = 0;
-
-  // Scales the text in the page by a factor of textZoomFactor.
-  // Note: this has no effect on plugins.
-  virtual float SetTextZoomFactor(float) = 0;
-
   // Gets the scale factor of the page, where 1.0 is the normal size, > 1.0
   // is scaled up, < 1.0 is scaled down.
   virtual float PageScaleFactor() const = 0;
@@ -268,6 +270,9 @@ class WebView {
   // Indicates that view's preferred size changes will be sent to the browser.
   virtual void EnablePreferredSizeChangedMode() = 0;
 
+  // Asks the browser process to activate this web view.
+  virtual void Focus() = 0;
+
   // Sets the ratio as computed by computePageScaleConstraints.
   // TODO(oshima): Remove this once the device scale factor implementation is
   // fully migrated to use zooming mechanism.
@@ -412,13 +417,6 @@ class WebView {
   // Freezes or unfreezes the page and all the local frames.
   virtual void SetPageFrozen(bool frozen) = 0;
 
-  // Dispatches a pagehide event, freezes a page and hooks page eviction.
-  virtual void PutPageIntoBackForwardCache() = 0;
-
-  // Unhooks eviction, resumes a page and dispatches a pageshow event.
-  virtual void RestorePageFromBackForwardCache(
-      base::TimeTicks navigation_start) = 0;
-
   // Autoplay configuration -----------------------------------------------
 
   // Sets the autoplay flags for this webview's page.
diff --git a/chromium/third_party/blink/public/web/web_view_client.h b/chromium/third_party/blink/public/web/web_view_client.h
index e33c483ab33..c799a401d45 100644
--- a/chromium/third_party/blink/public/web/web_view_client.h
+++ b/chromium/third_party/blink/public/web/web_view_client.h
@@ -146,7 +146,7 @@ class WebViewClient {
   virtual void DidAutoResize(const WebSize& new_size) {}
 
   // Called when the View acquires focus.
-  virtual void DidFocus(WebLocalFrame* calling_frame) {}
+  virtual void DidFocus() {}
 
   // Session history -----------------------------------------------------
 
diff --git a/chromium/third_party/blink/public/web/web_widget.h b/chromium/third_party/blink/public/web/web_widget.h
index 4c719cd0405..aad9e1d1c71 100644
--- a/chromium/third_party/blink/public/web/web_widget.h
+++ b/chromium/third_party/blink/public/web/web_widget.h
@@ -39,14 +39,16 @@
 #include "cc/trees/layer_tree_host_client.h"
 #include "third_party/blink/public/common/input/web_menu_source_type.h"
 #include "third_party/blink/public/common/metrics/document_update_reason.h"
+#include "third_party/blink/public/mojom/input/input_event_result.mojom-shared.h"
 #include "third_party/blink/public/mojom/manifest/display_mode.mojom-shared.h"
+#include "third_party/blink/public/platform/input/input_handler_proxy.h"
 #include "third_party/blink/public/platform/web_common.h"
 #include "third_party/blink/public/platform/web_input_event_result.h"
 #include "third_party/blink/public/platform/web_rect.h"
 #include "third_party/blink/public/platform/web_size.h"
 #include "third_party/blink/public/platform/web_text_input_info.h"
+#include "third_party/blink/public/platform/web_vector.h"
 #include "third_party/blink/public/web/web_hit_test_result.h"
-#include "third_party/blink/public/web/web_ime_text_span.h"
 #include "third_party/blink/public/web/web_lifecycle_update.h"
 #include "third_party/blink/public/web/web_range.h"
 #include "third_party/blink/public/web/web_swap_result.h"
@@ -60,6 +62,7 @@ class LayerTreeSettings;
 
 namespace ui {
 class Cursor;
+class LatencyInfo;
 }
 
 namespace blink {
@@ -148,10 +151,16 @@ class WebWidget {
   // Called to inform the WebWidget that it has gained or lost keyboard focus.
   virtual void SetFocus(bool) {}
 
+  // Returns the state of focus for the WebWidget.
+  virtual bool HasFocus() { return false; }
+
   // Sets the display mode, which comes from the top-level browsing context and
   // is applied to all widgets.
   virtual void SetDisplayMode(mojom::DisplayMode) {}
 
+  // Sets the root widget's window segments.
+  virtual void SetWindowSegments(WebVector<WebRect> window_segments) {}
+
   // Returns the anchor and focus bounds of the current selection.
   // If the selection range is empty, it returns the caret bounds.
   virtual bool SelectionBounds(WebRect& anchor, WebRect& focus) const {
@@ -186,6 +195,56 @@ class WebWidget {
 
   virtual void SetCursor(const ui::Cursor& cursor) = 0;
 
+  // Get the current tooltip text.
+  virtual WebString GetLastToolTipTextForTesting() const { return WebString(); }
+
+  // Whether or not the widget is in the process of handling input events.
+  virtual bool HandlingInputEvent() = 0;
+
+  // Set state that the widget is in the process of handling input events.
+  virtual void SetHandlingInputEvent(bool handling) = 0;
+
+  using HandledEventCallback = base::OnceCallback<void(
+      mojom::InputEventResultState ack_state,
+      const ui::LatencyInfo& latency_info,
+      std::unique_ptr<InputHandlerProxy::DidOverscrollParams>,
+      base::Optional<cc::TouchAction>)>;
+
+  // Process the input event, invoking the callback when complete. This
+  // method will call the callback synchronously.
+  virtual void ProcessInputEventSynchronously(const WebCoalescedInputEvent&,
+                                              HandledEventCallback) = 0;
+
+  virtual void DidOverscrollForTesting(
+      const gfx::Vector2dF& overscroll_delta,
+      const gfx::Vector2dF& accumulated_overscroll,
+      const gfx::PointF& position_in_viewport,
+      const gfx::Vector2dF& velocity_in_viewport) {}
+
+  // Requests the text input state be updated. If anything has changed the
+  // updated state will be sent to the browser.
+  virtual void UpdateTextInputState() = 0;
+
+  // Requests the text input state be updated. An updated state will always be
+  // sent to the browser.
+  virtual void ForceTextInputStateUpdate() = 0;
+
+  // Checks if the composition range or composition character bounds have been
+  // changed. If they are changed, the new value will be sent to the browser
+  // process. This method does nothing when the browser process is not able to
+  // handle composition range and composition character bounds.
+  virtual void UpdateCompositionInfo() = 0;
+
+  // Requests the selection bounds be updated.
+  virtual void UpdateSelectionBounds() = 0;
+
+  // Request the virtual keyboard be shown.
+  virtual void ShowVirtualKeyboard() = 0;
+
+  // Request composition updates be sent to the browser.
+  virtual void RequestCompositionUpdates(bool immediate_request,
+                                         bool monitor_updates) = 0;
+
  protected:
   ~WebWidget() = default;
 };
diff --git a/chromium/third_party/blink/public/web/web_widget_client.h b/chromium/third_party/blink/public/web/web_widget_client.h
index 7af0397662f..b7b4802e63c 100644
--- a/chromium/third_party/blink/public/web/web_widget_client.h
+++ b/chromium/third_party/blink/public/web/web_widget_client.h
@@ -32,6 +32,7 @@
 #define THIRD_PARTY_BLINK_PUBLIC_WEB_WEB_WIDGET_CLIENT_H_
 
 #include <memory>
+#include <vector>
 
 #include "base/callback.h"
 #include "base/i18n/rtl.h"
@@ -39,12 +40,16 @@
 #include "cc/trees/layer_tree_host.h"
 #include "components/viz/common/surfaces/frame_sink_id.h"
 #include "services/network/public/mojom/referrer_policy.mojom-shared.h"
+#include "third_party/blink/public/common/input/web_coalesced_input_event.h"
 #include "third_party/blink/public/common/input/web_gesture_event.h"
+#include "third_party/blink/public/common/page/web_drag_operation.h"
+#include "third_party/blink/public/mojom/input/input_handler.mojom-shared.h"
 #include "third_party/blink/public/mojom/input/pointer_lock_result.mojom-forward.h"
+#include "third_party/blink/public/platform/cross_variant_mojo_util.h"
 #include "third_party/blink/public/platform/web_common.h"
-#include "third_party/blink/public/platform/web_drag_operation.h"
 #include "third_party/blink/public/platform/web_rect.h"
 #include "third_party/blink/public/platform/web_screen_info.h"
+#include "third_party/blink/public/platform/web_text_input_type.h"
 #include "third_party/blink/public/platform/web_touch_action.h"
 #include "third_party/blink/public/web/web_meaningful_layout.h"
 #include "third_party/blink/public/web/web_navigation_policy.h"
@@ -52,7 +57,6 @@
 class SkBitmap;
 
 namespace cc {
-struct ElementId;
 class PaintImage;
 }
 
@@ -67,9 +71,9 @@ class Cursor;
 
 namespace blink {
 class WebDragData;
+class WebMouseEvent;
 class WebGestureEvent;
 struct WebFloatRect;
-class WebString;
 class WebWidget;
 class WebLocalFrame;
 
@@ -82,6 +86,12 @@ class WebWidgetClient {
   // a synchronous composite.
   virtual void ScheduleAnimation() {}
 
+  // Called to request a BeginMainFrame from the compositor, meant to be used
+  // for web tests only, where commits must be explicitly scheduled. Contrary to
+  // ScheduleAnimation() this will be a no-op on multi-threaded environments and
+  // will unconditionally ensure that the compositor is actually run.
+  virtual void ScheduleAnimationForWebTests() {}
+
   // Called immediately following the first compositor-driven (frame-generating)
   // layout that happened after an interesting document lifecyle change (see
   // WebMeaningfulLayout for details.)
@@ -107,10 +117,6 @@ class WebWidgetClient {
   // content view area, i.e. doesn't include any window decorations.
   virtual WebRect ViewRect() { return WebRect(); }
 
-  // Called when a tooltip should be shown at the current cursor position.
-  virtual void SetToolTipText(const WebString&,
-                              base::i18n::TextDirection hint) {}
-
   // Requests to lock the mouse cursor for the |requester_frame| in the
   // widget. If true is returned, the success result will be asynchronously
   // returned via a single call to WebWidget::didAcquirePointerLock() or
@@ -138,28 +144,13 @@ class WebWidgetClient {
   // Returns true iff the pointer is locked to this widget.
   virtual bool IsPointerLocked() { return false; }
 
-  // Called when a gesture event is handled.
-  virtual void DidHandleGestureEvent(const WebGestureEvent& event,
-                                     bool event_cancelled) {}
-
   // Called when overscrolled on main thread. All parameters are in
   // viewport-space.
   virtual void DidOverscroll(const gfx::Vector2dF& overscroll_delta,
                              const gfx::Vector2dF& accumulated_overscroll,
                              const gfx::PointF& position_in_viewport,
-                             const gfx::Vector2dF& velocity_in_viewport) {}
-
-  // Requests that a gesture of |injected_type| be reissued at a later point in
-  // time. |injected_type| is required to be one of
-  // GestureScroll{Begin,Update,End}. The dispatched gesture will scroll the
-  // ScrollableArea identified by |scrollable_area_element_id| by the given
-  // delta + granularity.
-  virtual void InjectGestureScrollEvent(
-      WebGestureDevice device,
-      const gfx::Vector2dF& delta,
-      ui::ScrollGranularity granularity,
-      cc::ElementId scrollable_area_element_id,
-      WebInputEvent::Type injected_type) {}
+                             const gfx::Vector2dF& velocity_in_viewport,
+                             cc::OverscrollBehavior overscroll_behavior) {}
 
   // Called to update if pointerrawupdate events should be sent.
   virtual void SetHasPointerRawUpdateEventHandlers(bool) {}
@@ -179,9 +170,6 @@ class WebWidgetClient {
   // the embedder of the touch actions that are permitted for this touch.
   virtual void SetTouchAction(WebTouchAction touch_action) {}
 
-  // Request the browser to show virtual keyboard for current input type.
-  virtual void ShowVirtualKeyboardOnElementFocus() {}
-
   // Converts the |rect| from Blink's Viewport coordinates to the
   // coordinates in the native window used to display the content, in
   // DIP.  They're identical in tradional world, but will differ when
@@ -279,6 +267,74 @@ class WebWidgetClient {
 
   // Returns a scale of the device emulator from the widget.
   virtual float GetEmulatorScale() const { return 1.0f; }
+
+  // Returns whether we handled a GestureScrollEvent.
+  virtual void DidHandleGestureScrollEvent(
+      const WebGestureEvent& gesture_event,
+      const gfx::Vector2dF& unused_delta,
+      const cc::OverscrollBehavior& overscroll_behavior,
+      bool event_processed) {}
+
+  // Called before gesture events are processed and allows the
+  // client to handle the event itself. Return true if event was handled
+  // and further processing should stop.
+  virtual bool WillHandleGestureEvent(const WebGestureEvent& event) {
+    return false;
+  }
+
+  // Called before mouse events are processed and allows the
+  // client to handle the event itself. Return true if event was handled
+  // and further processing should stop.
+  virtual bool WillHandleMouseEvent(const WebMouseEvent& event) {
+    return false;
+  }
+
+  // Queue a sythentic event in the MainThreadEventQueue. This is called
+  // for when handling scrollbars.
+  virtual void QueueSyntheticEvent(
+      std::unique_ptr<blink::WebCoalescedInputEvent>) {}
+
+  // Connect the Widget Input Handler to the channels provided.
+  virtual void GetWidgetInputHandler(
+      CrossVariantMojoReceiver<mojom::WidgetInputHandlerInterfaceBase>
+          widget_input_receiver,
+      CrossVariantMojoRemote<mojom::WidgetInputHandlerHostInterfaceBase>
+          widget_input_host_remote) {}
+
+  // Since the widget input IPC channel is still on the content side send this
+  // message back to the embedder to then send it on that channel. All bounds
+  // are in window coordinates.
+  virtual void SendCompositionRangeChanged(
+      const gfx::Range& range,
+      const std::vector<gfx::Rect>& character_bounds) {}
+
+  // The IME guard prevents sending IPC messages while messages are being
+  // processed. Returns true if there is a current guard.
+  // |request_to_show_virtual_keyboard| is whether the message that would have
+  // been sent would have requested the keyboard. This method will eventually be
+  // removed when all input handling is moved into blink.
+  virtual bool HasCurrentImeGuard(bool request_to_show_virtual_keyboard) {
+    return false;
+  }
+
+  // Determines whether composition can happen inline.
+  virtual bool CanComposeInline() { return false; }
+
+  // Determines if IME events should be sent to Pepper instead of processed to
+  // the currently focused frame.
+  virtual bool ShouldDispatchImeEventsToPepper() { return false; }
+
+  // Returns the current pepper text input type.
+  virtual WebTextInputType GetPepperTextInputType() {
+    return WebTextInputType::kWebTextInputTypeNone;
+  }
+
+  // Returns the current pepper caret bounds in window coordinates.
+  virtual gfx::Rect GetPepperCaretBounds() { return gfx::Rect(); }
+
+  // The state of the focus has changed for the WebWidget. |enabled|
+  // is the new state.
+  virtual void FocusChanged(bool enabled) {}
 };
 
 }  // namespace blink