BASELINE: Update Chromium to 84.0.4147.141

Change-Id: Ib85eb4cfa1cbe2b2b81e5022c8cad5c493969535 Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>
author: Allan Sandfeld Jensen <allan.jensen@qt.io> 2020-10-06 12:48:11 +0200
committer: Allan Sandfeld Jensen <allan.jensen@qt.io> 2020-10-13 09:33:43 +0000
commit: 7b5b123ac58f58ffde0f4f6e488bcd09aa4decd3 (patch)
tree: fa14ba0ca8d2683ba2efdabd246dc9b18a1229c6 /chromium/third_party/blink/renderer/core/frame
parent: 79b4f909db1049fca459c07cca55af56a9b54fe3 (diff)
download: qtwebengine-chromium-7b5b123ac58f58ffde0f4f6e488bcd09aa4decd3.tar.gz
123 files changed, 3499 insertions, 1776 deletions
diff --git a/chromium/third_party/blink/renderer/core/frame/BUILD.gn b/chromium/third_party/blink/renderer/core/frame/BUILD.gn
index f6c78c5dde4..bf09a36ee47 100644
--- a/chromium/third_party/blink/renderer/core/frame/BUILD.gn
+++ b/chromium/third_party/blink/renderer/core/frame/BUILD.gn
@@ -92,6 +92,8 @@ blink_core_sources("frame") {
     "intervention.h",
     "intervention_report_body.cc",
     "intervention_report_body.h",
+    "is_input_pending_options.cc",
+    "is_input_pending_options.h",
     "layout_subtree_root_list.cc",
     "layout_subtree_root_list.h",
     "local_dom_window.cc",
@@ -177,8 +179,6 @@ blink_core_sources("frame") {
     "scheduling.h",
     "screen.cc",
     "screen.h",
-    "screen_orientation_controller.cc",
-    "screen_orientation_controller.h",
     "settings.cc",
     "settings.h",
     "settings_delegate.cc",
@@ -217,6 +217,6 @@ blink_core_sources("frame") {
   deps = [
     "//skia",
     "//ui/base/cursor",
-    "//ui/base/mojom:cursor_type_blink",
+    "//ui/base/cursor/mojom:cursor_type_blink",
   ]
 }
diff --git a/chromium/third_party/blink/renderer/core/frame/DEPS b/chromium/third_party/blink/renderer/core/frame/DEPS
index 2bc0bcb5041..9ca14d95bb6 100644
--- a/chromium/third_party/blink/renderer/core/frame/DEPS
+++ b/chromium/third_party/blink/renderer/core/frame/DEPS
@@ -11,6 +11,9 @@ specific_include_rules = {
   "remote_frame_view.cc": [
     "+components/paint_preview/common/paint_preview_tracker.h",
   ],
+  "visual_viewport.cc": [
+    "+cc/layers/solid_color_scrollbar_layer.h",
+  ],
   "web_frame_widget_base.cc": [
     "+cc/trees/swap_promise.h",
   ],
diff --git a/chromium/third_party/blink/renderer/core/frame/ad_tracker.cc b/chromium/third_party/blink/renderer/core/frame/ad_tracker.cc
index 9476585d36b..3d57716273c 100644
--- a/chromium/third_party/blink/renderer/core/frame/ad_tracker.cc
+++ b/chromium/third_party/blink/renderer/core/frame/ad_tracker.cc
@@ -10,9 +10,11 @@
 #include "third_party/blink/renderer/bindings/core/v8/source_location.h"
 #include "third_party/blink/renderer/bindings/core/v8/v8_binding_for_core.h"
 #include "third_party/blink/renderer/core/core_probe_sink.h"
-#include "third_party/blink/renderer/core/dom/document.h"
+#include "third_party/blink/renderer/core/execution_context/execution_context.h"
+#include "third_party/blink/renderer/core/frame/local_dom_window.h"
 #include "third_party/blink/renderer/core/frame/local_frame.h"
 #include "third_party/blink/renderer/core/probe/core_probes.h"
+#include "third_party/blink/renderer/platform/loader/fetch/fetch_initiator_type_names.h"
 #include "third_party/blink/renderer/platform/loader/fetch/resource_request.h"
 #include "third_party/blink/renderer/platform/weborigin/kurl.h"
 #include "third_party/blink/renderer/platform/wtf/casting.h"
@@ -24,8 +26,8 @@ namespace {
 
 bool IsKnownAdExecutionContext(ExecutionContext* execution_context) {
   // TODO(jkarlin): Do the same check for worker contexts.
-  if (auto* document = Document::DynamicFrom(execution_context)) {
-    LocalFrame* frame = document->GetFrame();
+  if (auto* window = DynamicTo<LocalDOMWindow>(execution_context)) {
+    LocalFrame* frame = window->GetFrame();
     if (frame && frame->IsAdSubframe())
       return true;
   }
@@ -51,15 +53,22 @@ AdTracker* AdTracker::FromExecutionContext(
     ExecutionContext* execution_context) {
   if (!execution_context)
     return nullptr;
-  if (auto* document = Document::DynamicFrom(execution_context)) {
-    LocalFrame* frame = document->GetFrame();
-    if (frame) {
+  if (auto* window = DynamicTo<LocalDOMWindow>(execution_context)) {
+    if (LocalFrame* frame = window->GetFrame()) {
       return frame->GetAdTracker();
     }
   }
   return nullptr;
 }
 
+// static
+bool AdTracker::IsAdScriptExecutingInDocument(Document* document,
+                                              StackType stack_type) {
+  AdTracker* ad_tracker =
+      document->GetFrame() ? document->GetFrame()->GetAdTracker() : nullptr;
+  return ad_tracker && ad_tracker->IsAdScriptInStack(stack_type);
+}
+
 AdTracker::AdTracker(LocalFrame* local_root)
     : local_root_(local_root),
       async_stack_enabled_(
@@ -163,14 +172,26 @@ void AdTracker::Did(const probe::CallFunction& probe) {
   DidExecuteScript();
 }
 
-bool AdTracker::CalculateIfAdSubresource(ExecutionContext* execution_context,
-                                         const ResourceRequest& request,
-                                         ResourceType resource_type,
-                                         bool known_ad) {
-  // Check if the document loading the resource is an ad or if any executing
-  // script is an ad.
-  known_ad = known_ad || IsKnownAdExecutionContext(execution_context) ||
-             IsAdScriptInStack(StackType::kBottomAndTop);
+bool AdTracker::CalculateIfAdSubresource(
+    ExecutionContext* execution_context,
+    const ResourceRequest& request,
+    ResourceType resource_type,
+    const FetchInitiatorInfo& initiator_info,
+    bool known_ad) {
+  // Check if the document loading the resource is an ad.
+  known_ad = known_ad || IsKnownAdExecutionContext(execution_context);
+
+  // We skip script checking for stylesheet-initiated resource requests as the
+  // stack may represent the cause of a style recalculation rather than the
+  // actual resources themselves. Instead, the ad bit is set according to the
+  // CSSParserContext when the request is made. See crbug.com/1051605.
+  if (initiator_info.name == fetch_initiator_type_names::kCSS ||
+      initiator_info.name == fetch_initiator_type_names::kUacss) {
+    return known_ad;
+  }
+
+  // Check if any executing script is an ad.
+  known_ad = known_ad || IsAdScriptInStack(StackType::kBottomAndTop);
 
   // If it is a script marked as an ad and it's not in an ad context, append it
   // to the known ad script set. We don't need to keep track of ad scripts in ad
diff --git a/chromium/third_party/blink/renderer/core/frame/ad_tracker.h b/chromium/third_party/blink/renderer/core/frame/ad_tracker.h
index 04e15e4221a..10be17661e4 100644
--- a/chromium/third_party/blink/renderer/core/frame/ad_tracker.h
+++ b/chromium/third_party/blink/renderer/core/frame/ad_tracker.h
@@ -10,6 +10,7 @@
 #include "third_party/blink/renderer/core/frame/local_frame.h"
 #include "third_party/blink/renderer/core/probe/async_task_id.h"
 #include "third_party/blink/renderer/platform/heap/member.h"
+#include "third_party/blink/renderer/platform/loader/fetch/fetch_initiator_info.h"
 #include "third_party/blink/renderer/platform/weborigin/kurl.h"
 #include "third_party/blink/renderer/platform/wtf/hash_map.h"
 #include "third_party/blink/renderer/platform/wtf/hash_set.h"
@@ -39,6 +40,10 @@ class CORE_EXPORT AdTracker : public GarbageCollected<AdTracker> {
   // Finds an AdTracker for a given ExecutionContext.
   static AdTracker* FromExecutionContext(ExecutionContext*);
 
+  static bool IsAdScriptExecutingInDocument(
+      Document* document,
+      StackType stack_type = StackType::kBottomAndTop);
+
   // Instrumenting methods.
   // Called when a script module or script gets executed from native code.
   void Will(const probe::ExecuteScript&);
@@ -49,15 +54,17 @@ class CORE_EXPORT AdTracker : public GarbageCollected<AdTracker> {
   void Did(const probe::CallFunction&);
 
   // Called when a subresource request is about to be sent or is redirected.
-  // Returns true if:
-  // - If the resource is loaded in an ad iframe
-  // - If ad script is in the v8 stack
+  // Returns true if any of the following are true:
+  // - the resource is loaded in an ad iframe
   // - |known_ad| is true
+  // - ad script is in the v8 stack and the resource was not requested by CSS.
   // Virtual for testing.
-  virtual bool CalculateIfAdSubresource(ExecutionContext* execution_context,
-                                        const ResourceRequest& request,
-                                        ResourceType resource_type,
-                                        bool known_ad);
+  virtual bool CalculateIfAdSubresource(
+      ExecutionContext* execution_context,
+      const ResourceRequest& request,
+      ResourceType resource_type,
+      const FetchInitiatorInfo& initiator_info,
+      bool known_ad);
 
   // Called when an async task is created. Check at this point for ad script on
   // the stack and annotate the task if so.
diff --git a/chromium/third_party/blink/renderer/core/frame/ad_tracker_test.cc b/chromium/third_party/blink/renderer/core/frame/ad_tracker_test.cc
index 8f86535abab..1b8bcca9fd8 100644
--- a/chromium/third_party/blink/renderer/core/frame/ad_tracker_test.cc
+++ b/chromium/third_party/blink/renderer/core/frame/ad_tracker_test.cc
@@ -11,6 +11,7 @@
 #include "testing/gtest/include/gtest/gtest.h"
 #include "third_party/blink/public/common/features.h"
 #include "third_party/blink/renderer/core/dom/element_traversal.h"
+#include "third_party/blink/renderer/core/frame/local_dom_window.h"
 #include "third_party/blink/renderer/core/frame/local_frame.h"
 #include "third_party/blink/renderer/core/html/html_image_element.h"
 #include "third_party/blink/renderer/core/probe/async_task_id.h"
@@ -30,6 +31,77 @@ const unsigned char kSmallGifData[] = {0x47, 0x49, 0x46, 0x38, 0x39, 0x61, 0x01,
                                        0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x01,
                                        0x00, 0x00, 0x02, 0x00, 0x3b};
 
+const char kFrameURL[] = "https://example.com/frame.html";
+
+const char kVanillaFontURL[] = "https://example.com/font.woff2";
+const char kVanillaImageURL[] = "https://example.com/pixel.png";
+const char kVanillaScriptURL[] = "https://example.com/script.js";
+const char kVanillaStylesheetURL[] = "https://example.com/style.css";
+const char kVanillaImportedStylesheetURL[] = "https://example.com/imported.css";
+
+String ConvertToAdURL(String vanilla_url) {
+  return vanilla_url + "?ad=true";
+}
+
+// The pages include a div with class="test" to ensure the resources in the
+// stylesheet are loaded.
+const char kPageWithVanillaExternalStylesheet[] = R"HTML(
+    <head><link rel="stylesheet" href="style.css"></head>
+    <body><div class="test">Test</div></body>
+    )HTML";
+const char kPageWithAdExternalStylesheet[] = R"HTML(
+    <head><link rel="stylesheet" href="style.css?ad=true"></head>
+    <body><div class="test">Test</div></body>
+    )HTML";
+const char kPageWithVanillaScript[] = R"HTML(
+    <head><script defer src="script.js"></script></head>
+    <body><div class="test">Test</div></body>
+    )HTML";
+const char kPageWithAdScript[] = R"HTML(
+    <head><script defer src="script.js?ad=true"></script></head>
+    <body><div class="test">Test</div></body>
+    )HTML";
+const char kPageWithStyleTagLoadingVanillaResources[] = R"HTML(
+    <head><style>
+      @font-face {
+        font-family: "Vanilla";
+        src: url("font.woff2") format("woff2");
+      }
+      .test {
+        font-family: "Vanilla";
+        background-image: url("pixel.png");
+      }
+    </style></head>
+    <body><div class="test">Test</div></body>
+    )HTML";
+
+const char kScriptToCreateFrame[] = R"SCRIPT(
+    let iframe = document.createElement("iframe");
+    iframe.src = "frame.html";
+    document.body.appendChild(iframe);
+    )SCRIPT";
+
+const char kStylesheetWithVanillaResources[] = R"CSS(
+    @font-face {
+      font-family: "Vanilla";
+      src: url("font.woff2") format("woff2");
+    }
+    .test {
+      font-family: "Vanilla";
+      background-image: url("pixel.png");
+    }
+    )CSS";
+const char kStylesheetWithAdResources[] = R"CSS(
+    @font-face {
+      font-family: "Ad";
+      src: url("font.woff2?ad=true") format("woff2");
+    }
+    .test {
+      font-family: "Ad";
+      background-image: url("pixel.png?ad=true");
+    }
+    )CSS";
+
 class TestAdTracker : public AdTracker {
  public:
   explicit TestAdTracker(LocalFrame* frame) : AdTracker(frame) {}
@@ -51,11 +123,25 @@ class TestAdTracker : public AdTracker {
     return is_ad_.at(url);
   }
 
+  bool UrlHasBeenRequested(const String& url) const {
+    return is_ad_.Contains(url);
+  }
+
   void SetSimTest() { sim_test_ = true; }
 
+  void WaitForSubresource(const String& url) {
+    if (base::Contains(is_ad_, url)) {
+      return;
+    }
+    url_to_wait_for_ = url;
+    base::RunLoop run_loop;
+    quit_closure_ = run_loop.QuitClosure();
+    run_loop.Run();
+  }
+
  protected:
   String ScriptAtTopOfStack() override {
-    if (sim_test_)
+    if (sim_test_ && !script_at_top_)
       return AdTracker::ScriptAtTopOfStack();
     return script_at_top_;
   }
@@ -70,6 +156,7 @@ class TestAdTracker : public AdTracker {
   bool CalculateIfAdSubresource(ExecutionContext* execution_context,
                                 const ResourceRequest& resource_request,
                                 ResourceType resource_type,
+                                const FetchInitiatorInfo& initiator_info,
                                 bool ad_request) override {
     if (!ad_suffix_.IsEmpty() &&
         resource_request.Url().GetString().EndsWith(ad_suffix_)) {
@@ -77,9 +164,15 @@ class TestAdTracker : public AdTracker {
     }
 
     ad_request = AdTracker::CalculateIfAdSubresource(
-        execution_context, resource_request, resource_type, ad_request);
+        execution_context, resource_request, resource_type, initiator_info,
+        ad_request);
+
+    String resource_url = resource_request.Url().GetString();
+    is_ad_.insert(resource_url, ad_request);
 
-    is_ad_.insert(resource_request.Url().GetString(), ad_request);
+    if (quit_closure_ && url_to_wait_for_ == resource_url) {
+      std::move(quit_closure_).Run();
+    }
     return ad_request;
   }
 
@@ -89,6 +182,9 @@ class TestAdTracker : public AdTracker {
   Member<ExecutionContext> execution_context_;
   String ad_suffix_;
   bool sim_test_ = false;
+
+  base::OnceClosure quit_closure_;
+  String url_to_wait_for_;
 };
 
 }  // namespace
@@ -105,13 +201,15 @@ class AdTrackerTest : public testing::Test {
     if (ad_tracker_)
       ad_tracker_->Shutdown();
     ad_tracker_ = MakeGarbageCollected<TestAdTracker>(GetFrame());
-    ad_tracker_->SetExecutionContext(
-        page_holder_->GetDocument().ToExecutionContext());
+    ad_tracker_->SetExecutionContext(ExecutionContext());
   }
 
   void WillExecuteScript(const String& script_url) {
-    ad_tracker_->WillExecuteScript(
-        page_holder_->GetDocument().ToExecutionContext(), String(script_url));
+    ad_tracker_->WillExecuteScript(ExecutionContext(), String(script_url));
+  }
+
+  ExecutionContext* ExecutionContext() {
+    return page_holder_->GetFrame().DomWindow();
   }
 
   void DidExecuteScript() { ad_tracker_->DidExecuteScript(); }
@@ -127,8 +225,7 @@ class AdTrackerTest : public testing::Test {
   }
 
   void AppendToKnownAdScripts(const String& url) {
-    ad_tracker_->AppendToKnownAdScripts(
-        *page_holder_->GetDocument().ToExecutionContext(), url);
+    ad_tracker_->AppendToKnownAdScripts(*ExecutionContext(), url);
   }
 
   Persistent<TestAdTracker> ad_tracker_;
@@ -368,8 +465,9 @@ TEST_F(AdTrackerSimTest, ScriptLoadedWhileExecutingAdScript) {
 
   vanilla_script.Complete("");
 
-  EXPECT_TRUE(IsKnownAdScript(GetDocument().ToExecutionContext(), kAdUrl));
-  EXPECT_TRUE(IsKnownAdScript(GetDocument().ToExecutionContext(), kVanillaUrl));
+  EXPECT_TRUE(IsKnownAdScript(GetDocument().GetExecutionContext(), kAdUrl));
+  EXPECT_TRUE(
+      IsKnownAdScript(GetDocument().GetExecutionContext(), kVanillaUrl));
   EXPECT_TRUE(ad_tracker_->RequestWithUrlTaggedAsAd(kAdUrl));
   EXPECT_TRUE(ad_tracker_->RequestWithUrlTaggedAsAd(kVanillaUrl));
 }
@@ -398,8 +496,7 @@ TEST_F(AdTrackerSimTest, ScriptDetectedByContext) {
 
   // Now run unknown script in the child's context. It should be considered an
   // ad based on context alone.
-  ad_tracker_->SetExecutionContext(
-      child_frame->GetDocument()->ToExecutionContext());
+  ad_tracker_->SetExecutionContext(child_frame->DomWindow());
   ad_tracker_->SetScriptAtTopOfStack("foo.js");
   EXPECT_TRUE(
       ad_tracker_->IsAdScriptInStack(AdTracker::StackType::kBottomAndTop));
@@ -534,7 +631,7 @@ TEST_F(AdTrackerSimTest, ImageLoadedWhileExecutingAdScriptAsyncEnabled) {
 
   vanilla_image.Complete(gif);
 
-  EXPECT_TRUE(IsKnownAdScript(GetDocument().ToExecutionContext(), kAdUrl));
+  EXPECT_TRUE(IsKnownAdScript(GetDocument().GetExecutionContext(), kAdUrl));
   EXPECT_TRUE(ad_tracker_->RequestWithUrlTaggedAsAd(kAdUrl));
 
   // Image loading is async, so we should catch this when async stacks are
@@ -588,7 +685,7 @@ TEST_F(AdTrackerSimTest, ImageLoadedWhileExecutingAdScriptAsyncDisabled) {
 
   vanilla_image.Complete(gif);
 
-  EXPECT_TRUE(IsKnownAdScript(GetDocument().ToExecutionContext(), kAdUrl));
+  EXPECT_TRUE(IsKnownAdScript(GetDocument().GetExecutionContext(), kAdUrl));
   EXPECT_TRUE(ad_tracker_->RequestWithUrlTaggedAsAd(kAdUrl));
 
   // Image loading is async, so we won't catch this when async stacks aren't
@@ -633,7 +730,7 @@ TEST_F(AdTrackerSimTest, DataURLImageLoadedWhileExecutingAdScriptAsyncEnabled) {
   // Wait for script to run.
   base::RunLoop().RunUntilIdle();
 
-  EXPECT_TRUE(IsKnownAdScript(GetDocument().ToExecutionContext(), kAdUrl));
+  EXPECT_TRUE(IsKnownAdScript(GetDocument().GetExecutionContext(), kAdUrl));
   EXPECT_TRUE(ad_tracker_->RequestWithUrlTaggedAsAd(kAdUrl));
 
   // Walk through the DOM to get the image element.
@@ -673,7 +770,7 @@ TEST_F(AdTrackerSimTest, FrameLoadedWhileExecutingAdScript) {
   vanilla_page.Complete("<img src=vanilla_img.jpg></img>");
   vanilla_image.Complete("");
 
-  EXPECT_TRUE(IsKnownAdScript(GetDocument().ToExecutionContext(), kAdUrl));
+  EXPECT_TRUE(IsKnownAdScript(GetDocument().GetExecutionContext(), kAdUrl));
   EXPECT_TRUE(ad_tracker_->RequestWithUrlTaggedAsAd(kAdUrl));
   Frame* child_frame = GetDocument().GetFrame()->Tree().FirstChild();
   EXPECT_TRUE(To<LocalFrame>(child_frame)->IsAdSubframe());
@@ -715,10 +812,10 @@ TEST_F(AdTrackerSimTest, Contexts) {
   Frame* subframe = GetDocument().GetFrame()->Tree().FirstChild();
   auto* local_subframe = To<LocalFrame>(subframe);
   EXPECT_TRUE(
-      IsKnownAdScript(local_subframe->GetDocument()->ToExecutionContext(),
+      IsKnownAdScript(local_subframe->GetDocument()->GetExecutionContext(),
                       String("https://example.com/library.js")));
 
-  EXPECT_FALSE(IsKnownAdScript(GetDocument().ToExecutionContext(),
+  EXPECT_FALSE(IsKnownAdScript(GetDocument().GetExecutionContext(),
                                String("https://example.com/library.js")));
 }
 
@@ -772,6 +869,421 @@ TEST_F(AdTrackerSimTest, SameOriginDocWrittenSubframeFromAdScript) {
   EXPECT_TRUE(local_subframe->IsAdSubframe());
 }
 
+// This test class allows easy running of tests that only differ by whether
+// one resource (or a set of resources) is vanilla or an ad.
+class AdTrackerVanillaOrAdSimTest : public AdTrackerSimTest,
+                                    public ::testing::WithParamInterface<bool> {
+ public:
+  bool IsAdRun() { return GetParam(); }
+
+  String FlipURLOnAdRun(String vanilla_url) {
+    return IsAdRun() ? ConvertToAdURL(vanilla_url) : vanilla_url;
+  }
+};
+
+TEST_P(AdTrackerVanillaOrAdSimTest, VanillaExternalStylesheetLoadsResources) {
+  String font_url = FlipURLOnAdRun(kVanillaFontURL);
+  String image_url = FlipURLOnAdRun(kVanillaImageURL);
+  SimSubresourceRequest stylesheet(kVanillaStylesheetURL, "text/css");
+  SimSubresourceRequest font(font_url, "font/woff2");
+  SimSubresourceRequest image(image_url, "image/png");
+
+  ad_tracker_->SetAdSuffix("ad=true");
+
+  main_resource_->Complete(kPageWithVanillaExternalStylesheet);
+  stylesheet.Complete(IsAdRun() ? kStylesheetWithAdResources
+                                : kStylesheetWithVanillaResources);
+
+  // Wait for stylesheet to fetch resources.
+  ad_tracker_->WaitForSubresource(font_url);
+  ad_tracker_->WaitForSubresource(image_url);
+
+  font.Complete();
+  image.Complete();
+
+  EXPECT_FALSE(ad_tracker_->RequestWithUrlTaggedAsAd(kVanillaStylesheetURL));
+  EXPECT_EQ(ad_tracker_->RequestWithUrlTaggedAsAd(font_url), IsAdRun());
+  EXPECT_EQ(ad_tracker_->RequestWithUrlTaggedAsAd(image_url), IsAdRun());
+}
+
+TEST_P(AdTrackerVanillaOrAdSimTest, AdExternalStylesheetLoadsResources) {
+  String font_url = FlipURLOnAdRun(kVanillaFontURL);
+  String image_url = FlipURLOnAdRun(kVanillaImageURL);
+  String ad_stylesheet_url = ConvertToAdURL(kVanillaStylesheetURL);
+  SimSubresourceRequest stylesheet(ad_stylesheet_url, "text/css");
+  SimSubresourceRequest font(font_url, "font/woff2");
+  SimSubresourceRequest image(image_url, "image/png");
+
+  ad_tracker_->SetAdSuffix("ad=true");
+
+  main_resource_->Complete(kPageWithAdExternalStylesheet);
+  stylesheet.Complete(IsAdRun() ? kStylesheetWithAdResources
+                                : kStylesheetWithVanillaResources);
+
+  // Wait for stylesheet to fetch resources.
+  ad_tracker_->WaitForSubresource(font_url);
+  ad_tracker_->WaitForSubresource(image_url);
+
+  font.Complete();
+  image.Complete();
+
+  EXPECT_TRUE(ad_tracker_->RequestWithUrlTaggedAsAd(ad_stylesheet_url));
+  EXPECT_TRUE(ad_tracker_->RequestWithUrlTaggedAsAd(font_url));
+  EXPECT_TRUE(ad_tracker_->RequestWithUrlTaggedAsAd(image_url));
+}
+
+TEST_P(AdTrackerVanillaOrAdSimTest, LinkRelStylesheetAddedByScript) {
+  String script_url = FlipURLOnAdRun(kVanillaScriptURL);
+  SimSubresourceRequest script(script_url, "text/javascript");
+  SimSubresourceRequest stylesheet(kVanillaStylesheetURL, "text/css");
+  SimSubresourceRequest font(kVanillaFontURL, "font/woff2");
+  SimSubresourceRequest image(kVanillaImageURL, "image/png");
+
+  ad_tracker_->SetAdSuffix("ad=true");
+
+  main_resource_->Complete(IsAdRun() ? kPageWithAdScript
+                                     : kPageWithVanillaScript);
+  script.Complete(R"SCRIPT(
+    let link = document.createElement("link");
+    link.rel = "stylesheet";
+    link.href = "style.css";
+    document.head.appendChild(link);
+    )SCRIPT");
+
+  // Wait for script to run.
+  ad_tracker_->WaitForSubresource(kVanillaStylesheetURL);
+
+  stylesheet.Complete(kStylesheetWithVanillaResources);
+
+  // Wait for stylesheet to fetch resources.
+  ad_tracker_->WaitForSubresource(kVanillaFontURL);
+  ad_tracker_->WaitForSubresource(kVanillaImageURL);
+
+  font.Complete();
+  image.Complete();
+
+  EXPECT_EQ(ad_tracker_->RequestWithUrlTaggedAsAd(script_url), IsAdRun());
+  EXPECT_EQ(ad_tracker_->RequestWithUrlTaggedAsAd(kVanillaStylesheetURL),
+            IsAdRun());
+  EXPECT_EQ(ad_tracker_->RequestWithUrlTaggedAsAd(kVanillaFontURL), IsAdRun());
+  EXPECT_EQ(ad_tracker_->RequestWithUrlTaggedAsAd(kVanillaImageURL), IsAdRun());
+}
+
+TEST_P(AdTrackerVanillaOrAdSimTest, ExternalStylesheetInFrame) {
+  String script_url = FlipURLOnAdRun(kVanillaScriptURL);
+  SimRequest frame(kFrameURL, "text/html");
+  SimSubresourceRequest script(script_url, "text/javascript");
+  SimSubresourceRequest stylesheet(kVanillaStylesheetURL, "text/css");
+  SimSubresourceRequest font(kVanillaFontURL, "font/woff2");
+  SimSubresourceRequest image(kVanillaImageURL, "image/png");
+
+  ad_tracker_->SetAdSuffix("ad=true");
+
+  main_resource_->Complete(IsAdRun() ? kPageWithAdScript
+                                     : kPageWithVanillaScript);
+  script.Complete(kScriptToCreateFrame);
+  frame.Complete(kPageWithVanillaExternalStylesheet);
+  stylesheet.Complete(kStylesheetWithVanillaResources);
+
+  // Wait for stylesheet to fetch resources.
+  ad_tracker_->WaitForSubresource(kVanillaFontURL);
+  ad_tracker_->WaitForSubresource(kVanillaImageURL);
+
+  font.Complete();
+  image.Complete();
+
+  Frame* subframe = GetDocument().GetFrame()->Tree().FirstChild();
+  auto* local_subframe = To<LocalFrame>(subframe);
+  EXPECT_EQ(local_subframe->IsAdSubframe(), IsAdRun());
+
+  EXPECT_EQ(ad_tracker_->RequestWithUrlTaggedAsAd(script_url), IsAdRun());
+  EXPECT_EQ(ad_tracker_->RequestWithUrlTaggedAsAd(kVanillaStylesheetURL),
+            IsAdRun());
+  EXPECT_EQ(ad_tracker_->RequestWithUrlTaggedAsAd(kVanillaFontURL), IsAdRun());
+  EXPECT_EQ(ad_tracker_->RequestWithUrlTaggedAsAd(kVanillaImageURL), IsAdRun());
+}
+
+// Note that we skip fonts as at rules aren't valid in inline CSS.
+TEST_P(AdTrackerVanillaOrAdSimTest, InlineCSSSetByScript) {
+  String script_url = FlipURLOnAdRun(kVanillaScriptURL);
+  SimSubresourceRequest script(script_url, "text/javascript");
+  SimSubresourceRequest image(kVanillaImageURL, "image/png");
+
+  ad_tracker_->SetAdSuffix("ad=true");
+
+  main_resource_->Complete(IsAdRun() ? kPageWithAdScript
+                                     : kPageWithVanillaScript);
+  script.Complete(R"SCRIPT(
+    let div = document.getElementsByClassName("test")[0];
+    div.style = "background-image: url('pixel.png');";
+    )SCRIPT");
+
+  ad_tracker_->WaitForSubresource(kVanillaImageURL);
+
+  image.Complete();
+
+  EXPECT_EQ(ad_tracker_->RequestWithUrlTaggedAsAd(script_url), IsAdRun());
+  EXPECT_EQ(ad_tracker_->RequestWithUrlTaggedAsAd(kVanillaImageURL), IsAdRun());
+}
+
+TEST_F(AdTrackerSimTest, StyleTagInMainframe) {
+  SimSubresourceRequest font(kVanillaFontURL, "font/woff2");
+  SimSubresourceRequest image(kVanillaImageURL, "image/png");
+
+  ad_tracker_->SetAdSuffix("ad=true");
+
+  main_resource_->Complete(kPageWithStyleTagLoadingVanillaResources);
+
+  // Wait for stylesheet to fetch resources.
+  ad_tracker_->WaitForSubresource(kVanillaFontURL);
+  ad_tracker_->WaitForSubresource(kVanillaImageURL);
+
+  font.Complete();
+  image.Complete();
+
+  EXPECT_FALSE(ad_tracker_->RequestWithUrlTaggedAsAd(kVanillaFontURL));
+  EXPECT_FALSE(ad_tracker_->RequestWithUrlTaggedAsAd(kVanillaImageURL));
+}
+
+// This verifies that style tag resources in ad frames are correctly tagged
+// according to the heuristic that all requests from an ad frame should also be
+// tagged as ads.
+TEST_P(AdTrackerVanillaOrAdSimTest, StyleTagInSubframe) {
+  String script_url = FlipURLOnAdRun(kVanillaScriptURL);
+  SimRequest frame(kFrameURL, "text/html");
+  SimSubresourceRequest script(script_url, "text/javascript");
+  SimSubresourceRequest font(kVanillaFontURL, "font/woff2");
+  SimSubresourceRequest image(kVanillaImageURL, "image/png");
+
+  ad_tracker_->SetAdSuffix("ad=true");
+
+  main_resource_->Complete(IsAdRun() ? kPageWithAdScript
+                                     : kPageWithVanillaScript);
+  script.Complete(kScriptToCreateFrame);
+  frame.Complete(kPageWithStyleTagLoadingVanillaResources);
+
+  // Wait for stylesheet to fetch resources.
+  ad_tracker_->WaitForSubresource(kVanillaFontURL);
+  ad_tracker_->WaitForSubresource(kVanillaImageURL);
+
+  font.Complete();
+  image.Complete();
+
+  Frame* subframe = GetDocument().GetFrame()->Tree().FirstChild();
+  auto* local_subframe = To<LocalFrame>(subframe);
+  EXPECT_EQ(local_subframe->IsAdSubframe(), IsAdRun());
+
+  EXPECT_EQ(ad_tracker_->RequestWithUrlTaggedAsAd(script_url), IsAdRun());
+  EXPECT_EQ(ad_tracker_->RequestWithUrlTaggedAsAd(kVanillaFontURL), IsAdRun());
+  EXPECT_EQ(ad_tracker_->RequestWithUrlTaggedAsAd(kVanillaImageURL), IsAdRun());
+}
+
+TEST_P(AdTrackerVanillaOrAdSimTest, StyleTagAddedByScript) {
+  String script_url = FlipURLOnAdRun(kVanillaScriptURL);
+  SimSubresourceRequest script(script_url, "text/javascript");
+  SimSubresourceRequest font(kVanillaFontURL, "font/woff2");
+  SimSubresourceRequest image(kVanillaImageURL, "image/png");
+
+  ad_tracker_->SetAdSuffix("ad=true");
+
+  main_resource_->Complete(IsAdRun() ? kPageWithAdScript
+                                     : kPageWithVanillaScript);
+  script.Complete(String::Format(
+      R"SCRIPT(
+        let style = document.createElement("style");
+        let text = document.createTextNode(`%s`);
+        style.appendChild(text);
+        document.head.appendChild(style);
+      )SCRIPT",
+      kStylesheetWithVanillaResources));
+
+  // Wait for stylesheet to fetch resources.
+  ad_tracker_->WaitForSubresource(kVanillaFontURL);
+  ad_tracker_->WaitForSubresource(kVanillaImageURL);
+
+  font.Complete();
+  image.Complete();
+
+  EXPECT_EQ(ad_tracker_->RequestWithUrlTaggedAsAd(script_url), IsAdRun());
+  EXPECT_EQ(ad_tracker_->RequestWithUrlTaggedAsAd(kVanillaFontURL), IsAdRun());
+  EXPECT_EQ(ad_tracker_->RequestWithUrlTaggedAsAd(kVanillaImageURL), IsAdRun());
+}
+
+TEST_P(AdTrackerVanillaOrAdSimTest, VanillaImportInStylesheet) {
+  String stylesheet_url = FlipURLOnAdRun(kVanillaStylesheetURL);
+  SimSubresourceRequest stylesheet(stylesheet_url, "text/css");
+  SimSubresourceRequest imported_stylesheet(kVanillaImportedStylesheetURL,
+                                            "text/css");
+  SimSubresourceRequest font(kVanillaFontURL, "font/woff2");
+  SimSubresourceRequest image(kVanillaImageURL, "image/png");
+
+  ad_tracker_->SetAdSuffix("ad=true");
+
+  main_resource_->Complete(IsAdRun() ? kPageWithAdExternalStylesheet
+                                     : kPageWithVanillaExternalStylesheet);
+  stylesheet.Complete(R"CSS(
+    @import url(imported.css);
+  )CSS");
+  imported_stylesheet.Complete(kStylesheetWithVanillaResources);
+
+  // Wait for stylesheets to fetch resources.
+  ad_tracker_->WaitForSubresource(kVanillaFontURL);
+  ad_tracker_->WaitForSubresource(kVanillaImageURL);
+
+  font.Complete();
+  image.Complete();
+
+  EXPECT_EQ(ad_tracker_->RequestWithUrlTaggedAsAd(stylesheet_url), IsAdRun());
+  EXPECT_EQ(
+      ad_tracker_->RequestWithUrlTaggedAsAd(kVanillaImportedStylesheetURL),
+      IsAdRun());
+  EXPECT_EQ(ad_tracker_->RequestWithUrlTaggedAsAd(kVanillaFontURL), IsAdRun());
+  EXPECT_EQ(ad_tracker_->RequestWithUrlTaggedAsAd(kVanillaImageURL), IsAdRun());
+}
+
+TEST_P(AdTrackerVanillaOrAdSimTest, AdImportInStylesheet) {
+  String stylesheet_url = FlipURLOnAdRun(kVanillaStylesheetURL);
+  String ad_imported_stylesheet_url =
+      ConvertToAdURL(kVanillaImportedStylesheetURL);
+  SimSubresourceRequest stylesheet(stylesheet_url, "text/css");
+  SimSubresourceRequest imported_stylesheet(ad_imported_stylesheet_url,
+                                            "text/css");
+  SimSubresourceRequest font(kVanillaFontURL, "font/woff2");
+  SimSubresourceRequest image(kVanillaImageURL, "image/png");
+
+  ad_tracker_->SetAdSuffix("ad=true");
+
+  main_resource_->Complete(IsAdRun() ? kPageWithAdExternalStylesheet
+                                     : kPageWithVanillaExternalStylesheet);
+  stylesheet.Complete(R"CSS(
+    @import url(imported.css?ad=true);
+  )CSS");
+  imported_stylesheet.Complete(kStylesheetWithVanillaResources);
+
+  // Wait for stylesheets to fetch resources.
+  ad_tracker_->WaitForSubresource(kVanillaFontURL);
+  ad_tracker_->WaitForSubresource(kVanillaImageURL);
+
+  font.Complete();
+  image.Complete();
+
+  EXPECT_EQ(ad_tracker_->RequestWithUrlTaggedAsAd(stylesheet_url), IsAdRun());
+  EXPECT_TRUE(
+      ad_tracker_->RequestWithUrlTaggedAsAd(ad_imported_stylesheet_url));
+  EXPECT_TRUE(ad_tracker_->RequestWithUrlTaggedAsAd(kVanillaFontURL));
+  EXPECT_TRUE(ad_tracker_->RequestWithUrlTaggedAsAd(kVanillaImageURL));
+}
+
+TEST_P(AdTrackerVanillaOrAdSimTest, ImageSetInStylesheet) {
+  String stylesheet_url = FlipURLOnAdRun(kVanillaStylesheetURL);
+  SimSubresourceRequest stylesheet(stylesheet_url, "text/css");
+  SimSubresourceRequest image(kVanillaImageURL, "image/png");
+
+  ad_tracker_->SetAdSuffix("ad=true");
+
+  main_resource_->Complete(IsAdRun() ? kPageWithAdExternalStylesheet
+                                     : kPageWithVanillaExternalStylesheet);
+
+  // The image with the lowest scale factor that is still larger than the
+  // device's scale factor is used.
+  stylesheet.Complete(R"CSS(
+    .test {
+      background-image: -webkit-image-set( url("pixel.png") 100x,
+                                           url("too_high.png") 999x);
+    }
+  )CSS");
+
+  // Wait for stylesheet to fetch resource.
+  ad_tracker_->WaitForSubresource(kVanillaImageURL);
+
+  image.Complete();
+
+  EXPECT_EQ(ad_tracker_->RequestWithUrlTaggedAsAd(stylesheet_url), IsAdRun());
+  EXPECT_EQ(ad_tracker_->RequestWithUrlTaggedAsAd(kVanillaImageURL), IsAdRun());
+}
+
+TEST_P(AdTrackerVanillaOrAdSimTest, ConstructableCSSCreatedByScript) {
+  String script_url = FlipURLOnAdRun(kVanillaScriptURL);
+  SimSubresourceRequest script(script_url, "text/javascript");
+  SimSubresourceRequest font(kVanillaFontURL, "font/woff2");
+  SimSubresourceRequest image(kVanillaImageURL, "image/png");
+
+  ad_tracker_->SetAdSuffix("ad=true");
+
+  main_resource_->Complete(IsAdRun() ? kPageWithAdScript
+                                     : kPageWithVanillaScript);
+  script.Complete(R"SCRIPT(
+    const sheet = new CSSStyleSheet();
+    sheet.insertRule(`
+      @font-face {
+        font-family: "Vanilla";
+        src: url("font.woff2") format("woff2");
+      }`);
+    sheet.insertRule(`
+      .test {
+        font-family: "Vanilla";
+        background-image: url("pixel.png");
+      }`);
+    document.adoptedStyleSheets = [sheet];
+  )SCRIPT");
+
+  // Wait for stylesheet to fetch resources.
+  ad_tracker_->WaitForSubresource(kVanillaFontURL);
+  ad_tracker_->WaitForSubresource(kVanillaImageURL);
+
+  font.Complete();
+  image.Complete();
+
+  EXPECT_EQ(ad_tracker_->RequestWithUrlTaggedAsAd(script_url), IsAdRun());
+  EXPECT_EQ(ad_tracker_->RequestWithUrlTaggedAsAd(kVanillaFontURL), IsAdRun());
+  EXPECT_EQ(ad_tracker_->RequestWithUrlTaggedAsAd(kVanillaImageURL), IsAdRun());
+}
+
+// Vanilla resources loaded due to an ad's script's style recalculation
+// shouldn't be tagged.
+TEST_F(AdTrackerSimTest, StyleRecalcCausedByAdScript) {
+  String ad_script_url = ConvertToAdURL(kVanillaScriptURL);
+  SimSubresourceRequest script(ad_script_url, "text/javascript");
+  SimSubresourceRequest stylesheet(kVanillaStylesheetURL, "text/css");
+  SimSubresourceRequest font(kVanillaFontURL, "font/woff2");
+  SimSubresourceRequest image(kVanillaImageURL, "image/png");
+
+  ad_tracker_->SetAdSuffix("ad=true");
+
+  main_resource_->Complete(R"HTML(
+    <head><link rel="stylesheet" href="style.css">
+        <script async src="script.js?ad=true"></script></head>
+    <body><div>Test</div></body>
+  )HTML");
+  stylesheet.Complete(kStylesheetWithVanillaResources);
+
+  base::RunLoop().RunUntilIdle();
+  EXPECT_FALSE(ad_tracker_->UrlHasBeenRequested(kVanillaFontURL));
+  EXPECT_FALSE(ad_tracker_->UrlHasBeenRequested(kVanillaImageURL));
+
+  // We override these to ensure the ad script appears on top of the stack when
+  // the requests are made.
+  ad_tracker_->SetExecutionContext(GetDocument().GetExecutionContext());
+  ad_tracker_->SetScriptAtTopOfStack(ad_script_url);
+
+  script.Complete(R"SCRIPT(
+    let div = document.getElementsByTagName("div")[0];
+    div.className = "test";
+  )SCRIPT");
+
+  // Wait for stylesheets to fetch resources.
+  ad_tracker_->WaitForSubresource(kVanillaFontURL);
+  ad_tracker_->WaitForSubresource(kVanillaImageURL);
+
+  font.Complete();
+  image.Complete();
+
+  EXPECT_TRUE(ad_tracker_->RequestWithUrlTaggedAsAd(ad_script_url));
+  EXPECT_FALSE(ad_tracker_->RequestWithUrlTaggedAsAd(kVanillaStylesheetURL));
+  EXPECT_FALSE(ad_tracker_->RequestWithUrlTaggedAsAd(kVanillaFontURL));
+  EXPECT_FALSE(ad_tracker_->RequestWithUrlTaggedAsAd(kVanillaImageURL));
+}
+
 class AdTrackerDisabledSimTest : public SimTest,
                                  private ScopedAdTaggingForTest {
  protected:
@@ -793,4 +1305,8 @@ TEST_F(AdTrackerDisabledSimTest, VerifyAdTrackingDisabled) {
   EXPECT_FALSE(GetDocument().GetFrame()->IsAdSubframe());
 }
 
+INSTANTIATE_TEST_SUITE_P(All,
+                         AdTrackerVanillaOrAdSimTest,
+                         ::testing::Values(true, false));
+
 }  // namespace blink
diff --git a/chromium/third_party/blink/renderer/core/frame/bar_prop.cc b/chromium/third_party/blink/renderer/core/frame/bar_prop.cc
index 85dc13c2646..e1c3b2ba5d1 100644
--- a/chromium/third_party/blink/renderer/core/frame/bar_prop.cc
+++ b/chromium/third_party/blink/renderer/core/frame/bar_prop.cc
@@ -35,11 +35,11 @@
 namespace blink {
 
 BarProp::BarProp(LocalFrame* frame, Type type)
-    : DOMWindowClient(frame), type_(type) {}
+    : ExecutionContextClient(frame), type_(type) {}
 
 void BarProp::Trace(Visitor* visitor) {
   ScriptWrappable::Trace(visitor);
-  DOMWindowClient::Trace(visitor);
+  ExecutionContextClient::Trace(visitor);
 }
 
 bool BarProp::visible() const {
diff --git a/chromium/third_party/blink/renderer/core/frame/bar_prop.h b/chromium/third_party/blink/renderer/core/frame/bar_prop.h
index 5f1d7148259..8ddf97912d0 100644
--- a/chromium/third_party/blink/renderer/core/frame/bar_prop.h
+++ b/chromium/third_party/blink/renderer/core/frame/bar_prop.h
@@ -37,7 +37,7 @@ namespace blink {
 
 class LocalFrame;
 
-class BarProp final : public ScriptWrappable, public DOMWindowClient {
+class BarProp final : public ScriptWrappable, public ExecutionContextClient {
   DEFINE_WRAPPERTYPEINFO();
   USING_GARBAGE_COLLECTED_MIXIN(BarProp);
 
diff --git a/chromium/third_party/blink/renderer/core/frame/browser_controls_test.cc b/chromium/third_party/blink/renderer/core/frame/browser_controls_test.cc
index a42014e9d50..5bb535b1c29 100644
--- a/chromium/third_party/blink/renderer/core/frame/browser_controls_test.cc
+++ b/chromium/third_party/blink/renderer/core/frame/browser_controls_test.cc
@@ -32,7 +32,7 @@
 #include "build/build_config.h"
 #include "testing/gmock/include/gmock/gmock.h"
 #include "testing/gtest/include/gtest/gtest.h"
-#include "third_party/blink/public/platform/web_coalesced_input_event.h"
+#include "third_party/blink/public/common/input/web_coalesced_input_event.h"
 #include "third_party/blink/public/platform/web_url_loader_mock_factory.h"
 #include "third_party/blink/public/web/web_element.h"
 #include "third_party/blink/public/web/web_settings.h"
@@ -113,23 +113,23 @@ class BrowserControlsTest : public testing::Test,
                           WebInputEvent::GetStaticTimeStampForTests(),
                           WebGestureDevice::kTouchscreen);
     event.SetPositionInWidget(FloatPoint(100, 100));
-    if (type == WebInputEvent::kGestureScrollUpdate) {
+    if (type == WebInputEvent::Type::kGestureScrollUpdate) {
       event.data.scroll_update.delta_x = delta_x;
       event.data.scroll_update.delta_y = delta_y;
-    } else if (type == WebInputEvent::kGestureScrollBegin) {
+    } else if (type == WebInputEvent::Type::kGestureScrollBegin) {
       event.data.scroll_begin.delta_x_hint = delta_x;
       event.data.scroll_begin.delta_y_hint = delta_y;
     }
-    return WebCoalescedInputEvent(event);
+    return WebCoalescedInputEvent(event, ui::LatencyInfo());
   }
 
   void VerticalScroll(float delta_y) {
     GetWebView()->MainFrameWidget()->HandleInputEvent(
-        GenerateEvent(WebInputEvent::kGestureScrollBegin, 0, delta_y));
+        GenerateEvent(WebInputEvent::Type::kGestureScrollBegin, 0, delta_y));
     GetWebView()->MainFrameWidget()->HandleInputEvent(
-        GenerateEvent(WebInputEvent::kGestureScrollUpdate, 0, delta_y));
+        GenerateEvent(WebInputEvent::Type::kGestureScrollUpdate, 0, delta_y));
     GetWebView()->MainFrameWidget()->HandleInputEvent(
-        GenerateEvent(WebInputEvent::kGestureScrollEnd));
+        GenerateEvent(WebInputEvent::Type::kGestureScrollEnd));
   }
 
   Element* GetElementById(const WebString& id) {
@@ -182,23 +182,23 @@ class BrowserControlsSimTest : public SimTest {
                           WebInputEvent::GetStaticTimeStampForTests(),
                           WebGestureDevice::kTouchscreen);
     event.SetPositionInWidget(FloatPoint(100, 100));
-    if (type == WebInputEvent::kGestureScrollUpdate) {
+    if (type == WebInputEvent::Type::kGestureScrollUpdate) {
       event.data.scroll_update.delta_x = delta_x;
       event.data.scroll_update.delta_y = delta_y;
-    } else if (type == WebInputEvent::kGestureScrollBegin) {
+    } else if (type == WebInputEvent::Type::kGestureScrollBegin) {
       event.data.scroll_begin.delta_x_hint = delta_x;
       event.data.scroll_begin.delta_y_hint = delta_y;
     }
-    return WebCoalescedInputEvent(event);
+    return WebCoalescedInputEvent(event, ui::LatencyInfo());
   }
 
   void VerticalScroll(float delta_y) {
     WebView().MainFrameWidget()->HandleInputEvent(
-        GenerateEvent(WebInputEvent::kGestureScrollBegin, 0, delta_y));
+        GenerateEvent(WebInputEvent::Type::kGestureScrollBegin, 0, delta_y));
     WebView().MainFrameWidget()->HandleInputEvent(
-        GenerateEvent(WebInputEvent::kGestureScrollUpdate, 0, delta_y));
+        GenerateEvent(WebInputEvent::Type::kGestureScrollUpdate, 0, delta_y));
     WebView().MainFrameWidget()->HandleInputEvent(
-        GenerateEvent(WebInputEvent::kGestureScrollEnd));
+        GenerateEvent(WebInputEvent::Type::kGestureScrollEnd));
   }
 };
 
@@ -220,12 +220,12 @@ TEST_F(BrowserControlsTest, MAYBE(HideOnScrollDown)) {
   web_view->GetBrowserControls().SetShownRatio(1, 1);
 
   web_view->MainFrameWidget()->HandleInputEvent(
-      GenerateEvent(WebInputEvent::kGestureScrollBegin));
+      GenerateEvent(WebInputEvent::Type::kGestureScrollBegin));
   EXPECT_FLOAT_EQ(50.f, web_view->GetBrowserControls().ContentOffset());
 
   // Browser controls should be scrolled partially and page should not scroll.
   web_view->MainFrameWidget()->HandleInputEvent(
-      GenerateEvent(WebInputEvent::kGestureScrollUpdate, 0, -25.f));
+      GenerateEvent(WebInputEvent::Type::kGestureScrollUpdate, 0, -25.f));
   EXPECT_FLOAT_EQ(25.f, web_view->GetBrowserControls().ContentOffset());
   EXPECT_EQ(ScrollOffset(0, 0),
             GetFrame()->View()->LayoutViewport()->GetScrollOffset());
@@ -234,14 +234,14 @@ TEST_F(BrowserControlsTest, MAYBE(HideOnScrollDown)) {
   // should be
   // consumed by the page.
   web_view->MainFrameWidget()->HandleInputEvent(
-      GenerateEvent(WebInputEvent::kGestureScrollUpdate, 0, -40.f));
+      GenerateEvent(WebInputEvent::Type::kGestureScrollUpdate, 0, -40.f));
   EXPECT_FLOAT_EQ(0.f, web_view->GetBrowserControls().ContentOffset());
   EXPECT_EQ(ScrollOffset(0, 15),
             GetFrame()->View()->LayoutViewport()->GetScrollOffset());
 
   // Only page should consume scroll
   web_view->MainFrameWidget()->HandleInputEvent(
-      GenerateEvent(WebInputEvent::kGestureScrollUpdate, 0, -20.f));
+      GenerateEvent(WebInputEvent::Type::kGestureScrollUpdate, 0, -20.f));
   EXPECT_FLOAT_EQ(0.f, web_view->GetBrowserControls().ContentOffset());
   EXPECT_EQ(ScrollOffset(0, 35),
             GetFrame()->View()->LayoutViewport()->GetScrollOffset());
@@ -256,13 +256,13 @@ TEST_F(BrowserControlsTest, MAYBE(HideBottomControlsOnScrollDown)) {
   web_view->GetBrowserControls().SetShownRatio(0.0, 1);
 
   web_view->MainFrameWidget()->HandleInputEvent(
-      GenerateEvent(WebInputEvent::kGestureScrollBegin));
+      GenerateEvent(WebInputEvent::Type::kGestureScrollBegin));
   EXPECT_FLOAT_EQ(0.f, web_view->GetBrowserControls().ContentOffset());
 
   // Bottom controls and page content should both scroll and there should be
   // no content offset.
   web_view->MainFrameWidget()->HandleInputEvent(
-      GenerateEvent(WebInputEvent::kGestureScrollUpdate, 0, -25.f));
+      GenerateEvent(WebInputEvent::Type::kGestureScrollUpdate, 0, -25.f));
   EXPECT_FLOAT_EQ(0.f, web_view->GetBrowserControls().ContentOffset());
   EXPECT_FLOAT_EQ(0.5f, web_view->GetBrowserControls().BottomShownRatio());
   EXPECT_EQ(ScrollOffset(0, 25.f),
@@ -270,11 +270,11 @@ TEST_F(BrowserControlsTest, MAYBE(HideBottomControlsOnScrollDown)) {
 
   // Browser controls should become completely hidden.
   web_view->MainFrameWidget()->HandleInputEvent(
-      GenerateEvent(WebInputEvent::kGestureScrollBegin));
+      GenerateEvent(WebInputEvent::Type::kGestureScrollBegin));
   web_view->MainFrameWidget()->HandleInputEvent(
-      GenerateEvent(WebInputEvent::kGestureScrollUpdate, 0, -40.f));
+      GenerateEvent(WebInputEvent::Type::kGestureScrollUpdate, 0, -40.f));
   web_view->MainFrameWidget()->HandleInputEvent(
-      GenerateEvent(WebInputEvent::kGestureScrollEnd));
+      GenerateEvent(WebInputEvent::Type::kGestureScrollEnd));
   EXPECT_FLOAT_EQ(0.f, web_view->GetBrowserControls().ContentOffset());
   EXPECT_FLOAT_EQ(0.f, web_view->GetBrowserControls().BottomShownRatio());
   EXPECT_EQ(ScrollOffset(0, 65.f),
@@ -290,17 +290,17 @@ TEST_F(BrowserControlsTest, MAYBE(ShowOnScrollUp)) {
   web_view->GetBrowserControls().SetShownRatio(0, 0);
 
   web_view->MainFrameWidget()->HandleInputEvent(
-      GenerateEvent(WebInputEvent::kGestureScrollBegin));
+      GenerateEvent(WebInputEvent::Type::kGestureScrollBegin));
   EXPECT_FLOAT_EQ(0.f, web_view->GetBrowserControls().ContentOffset());
 
   web_view->MainFrameWidget()->HandleInputEvent(
-      GenerateEvent(WebInputEvent::kGestureScrollUpdate, 0, 10.f));
+      GenerateEvent(WebInputEvent::Type::kGestureScrollUpdate, 0, 10.f));
   EXPECT_FLOAT_EQ(10.f, web_view->GetBrowserControls().ContentOffset());
   EXPECT_EQ(ScrollOffset(0, 0),
             GetFrame()->View()->LayoutViewport()->GetScrollOffset());
 
   web_view->MainFrameWidget()->HandleInputEvent(
-      GenerateEvent(WebInputEvent::kGestureScrollUpdate, 0, 50.f));
+      GenerateEvent(WebInputEvent::Type::kGestureScrollUpdate, 0, 50.f));
   EXPECT_FLOAT_EQ(50.f, web_view->GetBrowserControls().ContentOffset());
   EXPECT_EQ(ScrollOffset(0, 0),
             GetFrame()->View()->LayoutViewport()->GetScrollOffset());
@@ -315,25 +315,25 @@ TEST_F(BrowserControlsTest, MAYBE(ShowBottomControlsOnScrollUp)) {
   web_view->GetBrowserControls().SetShownRatio(0, 0);
 
   web_view->MainFrameWidget()->HandleInputEvent(
-      GenerateEvent(WebInputEvent::kGestureScrollBegin));
+      GenerateEvent(WebInputEvent::Type::kGestureScrollBegin));
   EXPECT_FLOAT_EQ(0.f, web_view->GetBrowserControls().ContentOffset());
 
   // Allow some space to scroll up.
   web_view->MainFrameWidget()->HandleInputEvent(
-      GenerateEvent(WebInputEvent::kGestureScrollBegin));
+      GenerateEvent(WebInputEvent::Type::kGestureScrollBegin));
   web_view->MainFrameWidget()->HandleInputEvent(
-      GenerateEvent(WebInputEvent::kGestureScrollUpdate, 0, -50.f));
+      GenerateEvent(WebInputEvent::Type::kGestureScrollUpdate, 0, -50.f));
   web_view->MainFrameWidget()->HandleInputEvent(
-      GenerateEvent(WebInputEvent::kGestureScrollEnd));
+      GenerateEvent(WebInputEvent::Type::kGestureScrollEnd));
 
   web_view->MainFrameWidget()->HandleInputEvent(
-      GenerateEvent(WebInputEvent::kGestureScrollBegin));
+      GenerateEvent(WebInputEvent::Type::kGestureScrollBegin));
   web_view->MainFrameWidget()->HandleInputEvent(
-      GenerateEvent(WebInputEvent::kGestureScrollUpdate, 0, 25.f));
+      GenerateEvent(WebInputEvent::Type::kGestureScrollUpdate, 0, 25.f));
   EXPECT_FLOAT_EQ(0.5f, web_view->GetBrowserControls().BottomShownRatio());
 
   web_view->MainFrameWidget()->HandleInputEvent(
-      GenerateEvent(WebInputEvent::kGestureScrollEnd));
+      GenerateEvent(WebInputEvent::Type::kGestureScrollEnd));
   EXPECT_FLOAT_EQ(0.f, web_view->GetBrowserControls().ContentOffset());
   EXPECT_FLOAT_EQ(1.f, web_view->GetBrowserControls().BottomShownRatio());
   EXPECT_EQ(ScrollOffset(0, 25),
@@ -352,13 +352,13 @@ TEST_F(BrowserControlsTest, MAYBE(ScrollDownThenUp)) {
       ScrollOffset(0, 100), mojom::blink::ScrollType::kProgrammatic);
 
   web_view->MainFrameWidget()->HandleInputEvent(
-      GenerateEvent(WebInputEvent::kGestureScrollBegin));
+      GenerateEvent(WebInputEvent::Type::kGestureScrollBegin));
   EXPECT_FLOAT_EQ(50.f, web_view->GetBrowserControls().ContentOffset());
 
   // Scroll down to completely hide browser controls. Excess deltaY (100px)
   // should be consumed by the page.
   web_view->MainFrameWidget()->HandleInputEvent(
-      GenerateEvent(WebInputEvent::kGestureScrollUpdate, 0, -150.f));
+      GenerateEvent(WebInputEvent::Type::kGestureScrollUpdate, 0, -150.f));
   EXPECT_FLOAT_EQ(0.f, web_view->GetBrowserControls().ContentOffset());
   EXPECT_EQ(ScrollOffset(0, 200),
             GetFrame()->View()->LayoutViewport()->GetScrollOffset());
@@ -366,13 +366,13 @@ TEST_F(BrowserControlsTest, MAYBE(ScrollDownThenUp)) {
   // Scroll up and ensure the browser controls does not move until we recover
   // 100px previously scrolled.
   web_view->MainFrameWidget()->HandleInputEvent(
-      GenerateEvent(WebInputEvent::kGestureScrollUpdate, 0, 40.f));
+      GenerateEvent(WebInputEvent::Type::kGestureScrollUpdate, 0, 40.f));
   EXPECT_FLOAT_EQ(0.f, web_view->GetBrowserControls().ContentOffset());
   EXPECT_EQ(ScrollOffset(0, 160),
             GetFrame()->View()->LayoutViewport()->GetScrollOffset());
 
   web_view->MainFrameWidget()->HandleInputEvent(
-      GenerateEvent(WebInputEvent::kGestureScrollUpdate, 0, 60.f));
+      GenerateEvent(WebInputEvent::Type::kGestureScrollUpdate, 0, 60.f));
   EXPECT_FLOAT_EQ(0.f, web_view->GetBrowserControls().ContentOffset());
   EXPECT_EQ(ScrollOffset(0, 100),
             GetFrame()->View()->LayoutViewport()->GetScrollOffset());
@@ -380,14 +380,14 @@ TEST_F(BrowserControlsTest, MAYBE(ScrollDownThenUp)) {
   // Now we have hit the threshold so further scroll up should be consumed by
   // browser controls.
   web_view->MainFrameWidget()->HandleInputEvent(
-      GenerateEvent(WebInputEvent::kGestureScrollUpdate, 0, 30.f));
+      GenerateEvent(WebInputEvent::Type::kGestureScrollUpdate, 0, 30.f));
   EXPECT_FLOAT_EQ(30.f, web_view->GetBrowserControls().ContentOffset());
   EXPECT_EQ(ScrollOffset(0, 100),
             GetFrame()->View()->LayoutViewport()->GetScrollOffset());
 
   // Once top control is fully shown then page should consume any excess scroll.
   web_view->MainFrameWidget()->HandleInputEvent(
-      GenerateEvent(WebInputEvent::kGestureScrollUpdate, 0, 70.f));
+      GenerateEvent(WebInputEvent::Type::kGestureScrollUpdate, 0, 70.f));
   EXPECT_FLOAT_EQ(50.f, web_view->GetBrowserControls().ContentOffset());
   EXPECT_EQ(ScrollOffset(0, 50),
             GetFrame()->View()->LayoutViewport()->GetScrollOffset());
@@ -405,26 +405,26 @@ TEST_F(BrowserControlsTest, MAYBE(ScrollUpThenDown)) {
       ScrollOffset(0, 100), mojom::blink::ScrollType::kProgrammatic);
 
   web_view->MainFrameWidget()->HandleInputEvent(
-      GenerateEvent(WebInputEvent::kGestureScrollBegin));
+      GenerateEvent(WebInputEvent::Type::kGestureScrollBegin));
   EXPECT_FLOAT_EQ(0.f, web_view->GetBrowserControls().ContentOffset());
 
   // Scroll up to completely show browser controls. Excess deltaY (50px) should
   // be consumed by the page.
   web_view->MainFrameWidget()->HandleInputEvent(
-      GenerateEvent(WebInputEvent::kGestureScrollUpdate, 0, 100.f));
+      GenerateEvent(WebInputEvent::Type::kGestureScrollUpdate, 0, 100.f));
   EXPECT_FLOAT_EQ(50.f, web_view->GetBrowserControls().ContentOffset());
   EXPECT_EQ(ScrollOffset(0, 50),
             GetFrame()->View()->LayoutViewport()->GetScrollOffset());
 
   // Scroll down and ensure only browser controls is scrolled
   web_view->MainFrameWidget()->HandleInputEvent(
-      GenerateEvent(WebInputEvent::kGestureScrollUpdate, 0, -40.f));
+      GenerateEvent(WebInputEvent::Type::kGestureScrollUpdate, 0, -40.f));
   EXPECT_FLOAT_EQ(10.f, web_view->GetBrowserControls().ContentOffset());
   EXPECT_EQ(ScrollOffset(0, 50),
             GetFrame()->View()->LayoutViewport()->GetScrollOffset());
 
   web_view->MainFrameWidget()->HandleInputEvent(
-      GenerateEvent(WebInputEvent::kGestureScrollUpdate, 0, -60.f));
+      GenerateEvent(WebInputEvent::Type::kGestureScrollUpdate, 0, -60.f));
   EXPECT_FLOAT_EQ(0.f, web_view->GetBrowserControls().ContentOffset());
   EXPECT_EQ(ScrollOffset(0, 100),
             GetFrame()->View()->LayoutViewport()->GetScrollOffset());
@@ -439,18 +439,18 @@ TEST_F(BrowserControlsTest, MAYBE(HorizontalScroll)) {
   web_view->GetBrowserControls().SetShownRatio(1, 1);
 
   web_view->MainFrameWidget()->HandleInputEvent(
-      GenerateEvent(WebInputEvent::kGestureScrollBegin));
+      GenerateEvent(WebInputEvent::Type::kGestureScrollBegin));
   EXPECT_FLOAT_EQ(50.f, web_view->GetBrowserControls().ContentOffset());
 
   // Browser controls should not consume horizontal scroll.
   web_view->MainFrameWidget()->HandleInputEvent(
-      GenerateEvent(WebInputEvent::kGestureScrollUpdate, -110.f, -100.f));
+      GenerateEvent(WebInputEvent::Type::kGestureScrollUpdate, -110.f, -100.f));
   EXPECT_FLOAT_EQ(0.f, web_view->GetBrowserControls().ContentOffset());
   EXPECT_EQ(ScrollOffset(110, 50),
             GetFrame()->View()->LayoutViewport()->GetScrollOffset());
 
   web_view->MainFrameWidget()->HandleInputEvent(
-      GenerateEvent(WebInputEvent::kGestureScrollUpdate, -40.f, 0));
+      GenerateEvent(WebInputEvent::Type::kGestureScrollUpdate, -40.f, 0));
   EXPECT_FLOAT_EQ(0.f, web_view->GetBrowserControls().ContentOffset());
   EXPECT_EQ(ScrollOffset(150, 50),
             GetFrame()->View()->LayoutViewport()->GetScrollOffset());
@@ -468,12 +468,12 @@ TEST_F(BrowserControlsTest, MAYBE(PageScaleHasNoImpact)) {
   web_view->GetBrowserControls().SetShownRatio(1, 1);
 
   web_view->MainFrameWidget()->HandleInputEvent(
-      GenerateEvent(WebInputEvent::kGestureScrollBegin));
+      GenerateEvent(WebInputEvent::Type::kGestureScrollBegin));
   EXPECT_FLOAT_EQ(50.f, web_view->GetBrowserControls().ContentOffset());
 
   // Browser controls should be scrolled partially and page should not scroll.
   web_view->MainFrameWidget()->HandleInputEvent(
-      GenerateEvent(WebInputEvent::kGestureScrollUpdate, 0, -20.f));
+      GenerateEvent(WebInputEvent::Type::kGestureScrollUpdate, 0, -20.f));
   EXPECT_FLOAT_EQ(30.f, web_view->GetBrowserControls().ContentOffset());
   EXPECT_EQ(ScrollOffset(0, 0),
             GetFrame()->View()->GetScrollableArea()->GetScrollOffset());
@@ -481,32 +481,32 @@ TEST_F(BrowserControlsTest, MAYBE(PageScaleHasNoImpact)) {
   // Browser controls should consume 30px and become hidden. Excess scroll
   // should be consumed by the page at 2x scale.
   web_view->MainFrameWidget()->HandleInputEvent(
-      GenerateEvent(WebInputEvent::kGestureScrollUpdate, 0, -70.f));
+      GenerateEvent(WebInputEvent::Type::kGestureScrollUpdate, 0, -70.f));
   EXPECT_FLOAT_EQ(0.f, web_view->GetBrowserControls().ContentOffset());
   EXPECT_EQ(ScrollOffset(0, 20),
             GetFrame()->View()->GetScrollableArea()->GetScrollOffset());
 
   web_view->MainFrameWidget()->HandleInputEvent(
-      GenerateEvent(WebInputEvent::kGestureScrollEnd));
+      GenerateEvent(WebInputEvent::Type::kGestureScrollEnd));
 
   // Change page scale and test.
   web_view->SetPageScaleFactor(0.5);
 
   web_view->MainFrameWidget()->HandleInputEvent(
-      GenerateEvent(WebInputEvent::kGestureScrollBegin));
+      GenerateEvent(WebInputEvent::Type::kGestureScrollBegin));
   EXPECT_FLOAT_EQ(0.f, web_view->GetBrowserControls().ContentOffset());
   EXPECT_EQ(ScrollOffset(0, 20),
             GetFrame()->View()->GetScrollableArea()->GetScrollOffset());
 
   web_view->MainFrameWidget()->HandleInputEvent(
-      GenerateEvent(WebInputEvent::kGestureScrollUpdate, 0, 50.f));
+      GenerateEvent(WebInputEvent::Type::kGestureScrollUpdate, 0, 50.f));
   EXPECT_FLOAT_EQ(50.f, web_view->GetBrowserControls().ContentOffset());
   EXPECT_EQ(ScrollOffset(0, 20),
             GetFrame()->View()->GetScrollableArea()->GetScrollOffset());
 
   // At 0.5x scale scrolling 10px should take us to the top of the page.
   web_view->MainFrameWidget()->HandleInputEvent(
-      GenerateEvent(WebInputEvent::kGestureScrollUpdate, 0, 10.f));
+      GenerateEvent(WebInputEvent::Type::kGestureScrollUpdate, 0, 10.f));
   EXPECT_FLOAT_EQ(50.f, web_view->GetBrowserControls().ContentOffset());
   EXPECT_EQ(ScrollOffset(0, 0),
             GetFrame()->View()->GetScrollableArea()->GetScrollOffset());
@@ -557,18 +557,18 @@ TEST_F(BrowserControlsTest, MAYBE(ScrollableSubregionScrollFirst)) {
   // Now scroll down should start hiding browser controls but main frame
   // should not scroll.
   GetWebView()->MainFrameWidget()->HandleInputEvent(
-      GenerateEvent(WebInputEvent::kGestureScrollBegin, 0, -40.f));
+      GenerateEvent(WebInputEvent::Type::kGestureScrollBegin, 0, -40.f));
   GetWebView()->MainFrameWidget()->HandleInputEvent(
-      GenerateEvent(WebInputEvent::kGestureScrollUpdate, 0, -40.f));
+      GenerateEvent(WebInputEvent::Type::kGestureScrollUpdate, 0, -40.f));
   EXPECT_FLOAT_EQ(10.f, web_view->GetBrowserControls().ContentOffset());
   EXPECT_EQ(ScrollOffset(0, 50),
             GetFrame()->View()->LayoutViewport()->GetScrollOffset());
 
   // Continued scroll down should scroll down the main frame
   GetWebView()->MainFrameWidget()->HandleInputEvent(
-      GenerateEvent(WebInputEvent::kGestureScrollUpdate, 0, -40.f));
+      GenerateEvent(WebInputEvent::Type::kGestureScrollUpdate, 0, -40.f));
   GetWebView()->MainFrameWidget()->HandleInputEvent(
-      GenerateEvent(WebInputEvent::kGestureScrollEnd));
+      GenerateEvent(WebInputEvent::Type::kGestureScrollEnd));
   EXPECT_FLOAT_EQ(0.f, web_view->GetBrowserControls().ContentOffset());
   EXPECT_EQ(ScrollOffset(0, 80),
             GetFrame()->View()->LayoutViewport()->GetScrollOffset());
@@ -583,18 +583,18 @@ TEST_F(BrowserControlsTest, MAYBE(ScrollableSubregionScrollFirst)) {
   // Now scroll up should start showing browser controls but main frame
   // should not scroll.
   GetWebView()->MainFrameWidget()->HandleInputEvent(
-      GenerateEvent(WebInputEvent::kGestureScrollBegin, 0, 40.f));
+      GenerateEvent(WebInputEvent::Type::kGestureScrollBegin, 0, 40.f));
   GetWebView()->MainFrameWidget()->HandleInputEvent(
-      GenerateEvent(WebInputEvent::kGestureScrollUpdate, 0, 40.f));
+      GenerateEvent(WebInputEvent::Type::kGestureScrollUpdate, 0, 40.f));
   EXPECT_FLOAT_EQ(40.f, web_view->GetBrowserControls().ContentOffset());
   EXPECT_EQ(ScrollOffset(0, 80),
             GetFrame()->View()->LayoutViewport()->GetScrollOffset());
 
   // Continued scroll up scroll up the main frame
   GetWebView()->MainFrameWidget()->HandleInputEvent(
-      GenerateEvent(WebInputEvent::kGestureScrollUpdate, 0, 40.f));
+      GenerateEvent(WebInputEvent::Type::kGestureScrollUpdate, 0, 40.f));
   GetWebView()->MainFrameWidget()->HandleInputEvent(
-      GenerateEvent(WebInputEvent::kGestureScrollEnd));
+      GenerateEvent(WebInputEvent::Type::kGestureScrollEnd));
   EXPECT_FLOAT_EQ(50.f, web_view->GetBrowserControls().ContentOffset());
   EXPECT_EQ(ScrollOffset(0, 50),
             GetFrame()->View()->LayoutViewport()->GetScrollOffset());
@@ -620,18 +620,18 @@ TEST_F(BrowserControlsTest, MAYBE(ScrollableIframeScrollFirst)) {
   // Now scroll down should start hiding browser controls but main frame
   // should not scroll.
   GetWebView()->MainFrameWidget()->HandleInputEvent(
-      GenerateEvent(WebInputEvent::kGestureScrollBegin, 0, -40.f));
+      GenerateEvent(WebInputEvent::Type::kGestureScrollBegin, 0, -40.f));
   GetWebView()->MainFrameWidget()->HandleInputEvent(
-      GenerateEvent(WebInputEvent::kGestureScrollUpdate, 0, -40.f));
+      GenerateEvent(WebInputEvent::Type::kGestureScrollUpdate, 0, -40.f));
   EXPECT_FLOAT_EQ(10.f, web_view->GetBrowserControls().ContentOffset());
   EXPECT_EQ(ScrollOffset(0, 50),
             GetFrame()->View()->LayoutViewport()->GetScrollOffset());
 
   // Continued scroll down should scroll down the main frame
   GetWebView()->MainFrameWidget()->HandleInputEvent(
-      GenerateEvent(WebInputEvent::kGestureScrollUpdate, 0, -40.f));
+      GenerateEvent(WebInputEvent::Type::kGestureScrollUpdate, 0, -40.f));
   GetWebView()->MainFrameWidget()->HandleInputEvent(
-      GenerateEvent(WebInputEvent::kGestureScrollEnd));
+      GenerateEvent(WebInputEvent::Type::kGestureScrollEnd));
   EXPECT_FLOAT_EQ(0.f, web_view->GetBrowserControls().ContentOffset());
   EXPECT_EQ(ScrollOffset(0, 80),
             GetFrame()->View()->LayoutViewport()->GetScrollOffset());
@@ -646,18 +646,18 @@ TEST_F(BrowserControlsTest, MAYBE(ScrollableIframeScrollFirst)) {
   // Now scroll up should start showing browser controls but main frame
   // should not scroll.
   GetWebView()->MainFrameWidget()->HandleInputEvent(
-      GenerateEvent(WebInputEvent::kGestureScrollBegin, 0, 40.f));
+      GenerateEvent(WebInputEvent::Type::kGestureScrollBegin, 0, 40.f));
   GetWebView()->MainFrameWidget()->HandleInputEvent(
-      GenerateEvent(WebInputEvent::kGestureScrollUpdate, 0, 40.f));
+      GenerateEvent(WebInputEvent::Type::kGestureScrollUpdate, 0, 40.f));
   EXPECT_FLOAT_EQ(40.f, web_view->GetBrowserControls().ContentOffset());
   EXPECT_EQ(ScrollOffset(0, 80),
             GetFrame()->View()->LayoutViewport()->GetScrollOffset());
 
   // Continued scroll up scroll up the main frame
   GetWebView()->MainFrameWidget()->HandleInputEvent(
-      GenerateEvent(WebInputEvent::kGestureScrollUpdate, 0, 40.f));
+      GenerateEvent(WebInputEvent::Type::kGestureScrollUpdate, 0, 40.f));
   GetWebView()->MainFrameWidget()->HandleInputEvent(
-      GenerateEvent(WebInputEvent::kGestureScrollEnd));
+      GenerateEvent(WebInputEvent::Type::kGestureScrollEnd));
   EXPECT_FLOAT_EQ(50.f, web_view->GetBrowserControls().ContentOffset());
   EXPECT_EQ(ScrollOffset(0, 50),
             GetFrame()->View()->LayoutViewport()->GetScrollOffset());
@@ -728,13 +728,13 @@ TEST_F(BrowserControlsTest, MAYBE(ScrollUpPastLimitDoesNotHide)) {
   web_view->MainFrameImpl()->SetScrollOffset(WebSize(0, 10000));
   GetVisualViewport().SetLocation(FloatPoint(0, 0));
   GetWebView()->MainFrameWidget()->HandleInputEvent(
-      GenerateEvent(WebInputEvent::kGestureScrollBegin, 0, -10.f));
+      GenerateEvent(WebInputEvent::Type::kGestureScrollBegin, 0, -10.f));
   GetWebView()->MainFrameWidget()->HandleInputEvent(
-      GenerateEvent(WebInputEvent::kGestureScrollUpdate, 0, -10.f));
+      GenerateEvent(WebInputEvent::Type::kGestureScrollUpdate, 0, -10.f));
   EXPECT_FLOAT_EQ(40, web_view->GetBrowserControls().ContentOffset());
 
   GetWebView()->MainFrameWidget()->HandleInputEvent(
-      GenerateEvent(WebInputEvent::kGestureScrollEnd));
+      GenerateEvent(WebInputEvent::Type::kGestureScrollEnd));
   EXPECT_FLOAT_EQ(50, web_view->GetBrowserControls().ContentOffset());
 
   web_view->GetBrowserControls().SetShownRatio(1, 1);
@@ -742,13 +742,13 @@ TEST_F(BrowserControlsTest, MAYBE(ScrollUpPastLimitDoesNotHide)) {
   web_view->MainFrameImpl()->SetScrollOffset(WebSize(0, 0));
   GetVisualViewport().SetLocation(FloatPoint(0, 10000));
   GetWebView()->MainFrameWidget()->HandleInputEvent(
-      GenerateEvent(WebInputEvent::kGestureScrollBegin, 0, -20.f));
+      GenerateEvent(WebInputEvent::Type::kGestureScrollBegin, 0, -20.f));
   GetWebView()->MainFrameWidget()->HandleInputEvent(
-      GenerateEvent(WebInputEvent::kGestureScrollUpdate, 0, -20.f));
+      GenerateEvent(WebInputEvent::Type::kGestureScrollUpdate, 0, -20.f));
   EXPECT_FLOAT_EQ(30, web_view->GetBrowserControls().ContentOffset());
 
   GetWebView()->MainFrameWidget()->HandleInputEvent(
-      GenerateEvent(WebInputEvent::kGestureScrollEnd));
+      GenerateEvent(WebInputEvent::Type::kGestureScrollEnd));
   EXPECT_FLOAT_EQ(50, web_view->GetBrowserControls().ContentOffset());
 
   web_view->GetBrowserControls().SetShownRatio(1, 1);
@@ -835,13 +835,13 @@ TEST_F(BrowserControlsSimTest, MAYBE(StateConstraints)) {
 
   // Setting permitted state to "both" should not change an in-flight offset.
   WebView().MainFrameWidget()->HandleInputEvent(
-      GenerateEvent(WebInputEvent::kGestureScrollBegin, 0, 20.f));
+      GenerateEvent(WebInputEvent::Type::kGestureScrollBegin, 0, 20.f));
   WebView().MainFrameWidget()->HandleInputEvent(
-      GenerateEvent(WebInputEvent::kGestureScrollUpdate, 0, 20.f));
+      GenerateEvent(WebInputEvent::Type::kGestureScrollUpdate, 0, 20.f));
   EXPECT_FLOAT_EQ(20, WebView().GetBrowserControls().ContentOffset());
 
   WebView().MainFrameWidget()->HandleInputEvent(
-      GenerateEvent(WebInputEvent::kGestureScrollEnd));
+      GenerateEvent(WebInputEvent::Type::kGestureScrollEnd));
   EXPECT_FLOAT_EQ(0, WebView().GetBrowserControls().ContentOffset());
   Compositor().layer_tree_host()->UpdateBrowserControlsState(
       cc::BrowserControlsState::kBoth, cc::BrowserControlsState::kBoth, false);
@@ -1310,9 +1310,9 @@ TEST_F(BrowserControlsTest,
   web_view->SetPageScaleFactor(page_scale);
   {
     web_view->MainFrameWidget()->HandleInputEvent(
-        GenerateEvent(WebInputEvent::kGestureScrollBegin));
+        GenerateEvent(WebInputEvent::Type::kGestureScrollBegin));
     web_view->MainFrameWidget()->HandleInputEvent(
-        GenerateEvent(WebInputEvent::kGestureScrollUpdate, 0, -10000));
+        GenerateEvent(WebInputEvent::Type::kGestureScrollUpdate, 0, -10000));
 
     ASSERT_EQ(0.f, web_view->GetBrowserControls().ContentOffset());
 
@@ -1323,7 +1323,7 @@ TEST_F(BrowserControlsTest,
     EXPECT_EQ(expected_root_offset, root_viewport->GetScrollOffset().Height());
 
     web_view->MainFrameWidget()->HandleInputEvent(
-        GenerateEvent(WebInputEvent::kGestureScrollEnd));
+        GenerateEvent(WebInputEvent::Type::kGestureScrollEnd));
   }
 
   // Commit the browser controls resize so that the browser controls do not
@@ -1346,9 +1346,9 @@ TEST_F(BrowserControlsTest,
   // to the document (i.e. the user shouldn't see a movement).
   {
     web_view->MainFrameWidget()->HandleInputEvent(
-        GenerateEvent(WebInputEvent::kGestureScrollBegin));
+        GenerateEvent(WebInputEvent::Type::kGestureScrollBegin));
     web_view->MainFrameWidget()->HandleInputEvent(
-        GenerateEvent(WebInputEvent::kGestureScrollUpdate, 0, 80));
+        GenerateEvent(WebInputEvent::Type::kGestureScrollUpdate, 0, 80));
 
     GetVisualViewport().ClampToBoundaries();
     view->LayoutViewport()->SetScrollOffset(
@@ -1359,7 +1359,7 @@ TEST_F(BrowserControlsTest,
     EXPECT_EQ(expected_root_offset, root_viewport->GetScrollOffset().Height());
 
     web_view->MainFrameWidget()->HandleInputEvent(
-        GenerateEvent(WebInputEvent::kGestureScrollEnd));
+        GenerateEvent(WebInputEvent::Type::kGestureScrollEnd));
   }
 }
 
@@ -1557,9 +1557,9 @@ TEST_F(BrowserControlsTest, MAYBE(ScrollWithMinHeightSetForTopControlsOnly)) {
       {top_height, 20, bottom_height, 0, false, true});
   // Scroll down to hide the controls.
   web_view->MainFrameWidget()->HandleInputEvent(
-      GenerateEvent(WebInputEvent::kGestureScrollBegin));
+      GenerateEvent(WebInputEvent::Type::kGestureScrollBegin));
   web_view->MainFrameWidget()->HandleInputEvent(
-      GenerateEvent(WebInputEvent::kGestureScrollUpdate, 0, -100));
+      GenerateEvent(WebInputEvent::Type::kGestureScrollUpdate, 0, -100));
 
   // The bottom controls should be completely hidden while the top controls are
   // at the minimum height.
@@ -1569,7 +1569,7 @@ TEST_F(BrowserControlsTest, MAYBE(ScrollWithMinHeightSetForTopControlsOnly)) {
 
   // Scrolling back up should bring the browser controls shown ratios back to 1.
   web_view->MainFrameWidget()->HandleInputEvent(
-      GenerateEvent(WebInputEvent::kGestureScrollUpdate, 0, 100));
+      GenerateEvent(WebInputEvent::Type::kGestureScrollUpdate, 0, 100));
   EXPECT_EQ(1.f, web_view->GetBrowserControls().BottomShownRatio());
   EXPECT_EQ(1.f, web_view->GetBrowserControls().TopShownRatio());
   EXPECT_EQ(top_height, web_view->GetBrowserControls().ContentOffset());
@@ -1587,11 +1587,11 @@ TEST_F(BrowserControlsTest, MAYBE(ScrollWithMinHeightSet)) {
       {top_height, 20, bottom_height, 10, false, true});
 
   web_view->MainFrameWidget()->HandleInputEvent(
-      GenerateEvent(WebInputEvent::kGestureScrollBegin));
+      GenerateEvent(WebInputEvent::Type::kGestureScrollBegin));
   web_view->MainFrameWidget()->HandleInputEvent(
-      GenerateEvent(WebInputEvent::kGestureScrollUpdate, 0, -100));
+      GenerateEvent(WebInputEvent::Type::kGestureScrollUpdate, 0, -100));
   web_view->MainFrameWidget()->HandleInputEvent(
-      GenerateEvent(WebInputEvent::kGestureScrollEnd));
+      GenerateEvent(WebInputEvent::Type::kGestureScrollEnd));
 
   // Browser controls don't scroll off completely, and stop scrolling at the min
   // height.
@@ -1600,19 +1600,19 @@ TEST_F(BrowserControlsTest, MAYBE(ScrollWithMinHeightSet)) {
 
   // Ending the scroll then scrolling again shouldn't make any difference.
   web_view->MainFrameWidget()->HandleInputEvent(
-      GenerateEvent(WebInputEvent::kGestureScrollBegin));
+      GenerateEvent(WebInputEvent::Type::kGestureScrollBegin));
   web_view->MainFrameWidget()->HandleInputEvent(
-      GenerateEvent(WebInputEvent::kGestureScrollUpdate, 0, -50));
+      GenerateEvent(WebInputEvent::Type::kGestureScrollUpdate, 0, -50));
   web_view->MainFrameWidget()->HandleInputEvent(
-      GenerateEvent(WebInputEvent::kGestureScrollEnd));
+      GenerateEvent(WebInputEvent::Type::kGestureScrollEnd));
   EXPECT_EQ(20, web_view->GetBrowserControls().ContentOffset());
   EXPECT_EQ(10, web_view->GetBrowserControls().BottomContentOffset());
 
   // Finally, scroll back up to show the controls completely.
   web_view->MainFrameWidget()->HandleInputEvent(
-      GenerateEvent(WebInputEvent::kGestureScrollBegin));
+      GenerateEvent(WebInputEvent::Type::kGestureScrollBegin));
   web_view->MainFrameWidget()->HandleInputEvent(
-      GenerateEvent(WebInputEvent::kGestureScrollUpdate, 0, 100));
+      GenerateEvent(WebInputEvent::Type::kGestureScrollUpdate, 0, 100));
   EXPECT_EQ(top_height, web_view->GetBrowserControls().ContentOffset());
   EXPECT_EQ(bottom_height,
             web_view->GetBrowserControls().BottomContentOffset());
diff --git a/chromium/third_party/blink/renderer/core/frame/csp/content_security_policy.cc b/chromium/third_party/blink/renderer/core/frame/csp/content_security_policy.cc
index 80d48328047..5c8a945baf9 100644
--- a/chromium/third_party/blink/renderer/core/frame/csp/content_security_policy.cc
+++ b/chromium/third_party/blink/renderer/core/frame/csp/content_security_policy.cc
@@ -29,6 +29,8 @@
 #include <utility>
 
 #include "base/debug/dump_without_crashing.h"
+#include "services/network/public/cpp/web_sandbox_flags.h"
+#include "services/network/public/mojom/web_sandbox_flags.mojom-blink.h"
 #include "third_party/blink/public/mojom/security_context/insecure_request_policy.mojom-blink.h"
 #include "third_party/blink/public/platform/platform.h"
 #include "third_party/blink/public/platform/task_type.h"
@@ -50,7 +52,6 @@
 #include "third_party/blink/renderer/core/frame/local_frame.h"
 #include "third_party/blink/renderer/core/frame/local_frame_client.h"
 #include "third_party/blink/renderer/core/frame/location.h"
-#include "third_party/blink/renderer/core/frame/sandbox_flags.h"
 #include "third_party/blink/renderer/core/html/html_script_element.h"
 #include "third_party/blink/renderer/core/inspector/console_message.h"
 #include "third_party/blink/renderer/platform/bindings/dom_wrapper_world.h"
@@ -156,7 +157,7 @@ ContentSecurityPolicy::ContentSecurityPolicy()
       override_inline_style_allowed_(false),
       script_hash_algorithms_used_(kContentSecurityPolicyHashAlgorithmNone),
       style_hash_algorithms_used_(kContentSecurityPolicyHashAlgorithmNone),
-      sandbox_mask_(mojom::blink::WebSandboxFlags::kNone),
+      sandbox_mask_(network::mojom::blink::WebSandboxFlags::kNone),
       require_trusted_types_(false),
       insecure_request_policy_(
           mojom::blink::InsecureRequestPolicy::kLeaveInsecureRequestsAlone) {}
@@ -200,19 +201,14 @@ void ContentSecurityPolicy::ApplyPolicySideEffectsToDelegate() {
 
   // Set mixed content checking and sandbox flags, then dump all the parsing
   // error messages, then poke at histograms.
-  if (sandbox_mask_ != mojom::blink::WebSandboxFlags::kNone) {
+  if (sandbox_mask_ != network::mojom::blink::WebSandboxFlags::kNone) {
     Count(WebFeature::kSandboxViaCSP);
     delegate_->SetSandboxFlags(sandbox_mask_);
   }
 
   if (require_trusted_types_) {
-    if (delegate_->GetSecureContextMode() ==
-        SecureContextMode::kSecureContext) {
-      delegate_->SetRequireTrustedTypes();
-      Count(WebFeature::kTrustedTypesEnabled);
-    } else {
-      ReportNonsecureTrustedTypes();
-    }
+    delegate_->SetRequireTrustedTypes();
+    Count(WebFeature::kTrustedTypesEnabled);
   }
 
   delegate_->AddInsecureRequestPolicy(insecure_request_policy_);
@@ -649,13 +645,15 @@ bool ContentSecurityPolicy::AllowPluginTypeForDocument(
 
 bool ContentSecurityPolicy::AllowRequestWithoutIntegrity(
     mojom::RequestContextType context,
+    network::mojom::RequestDestination request_destination,
     const KURL& url,
     RedirectStatus redirect_status,
     ReportingDisposition reporting_disposition,
     CheckHeaderType check_header_type) const {
   for (const auto& policy : policies_) {
     if (CheckHeaderTypeMatches(check_header_type, policy->HeaderType()) &&
-        !policy->AllowRequestWithoutIntegrity(context, url, redirect_status,
+        !policy->AllowRequestWithoutIntegrity(context, request_destination, url,
+                                              redirect_status,
                                               reporting_disposition))
       return false;
   }
@@ -729,6 +727,7 @@ GetDirectiveTypeFromRequestContextType(mojom::RequestContextType context) {
 
 bool ContentSecurityPolicy::AllowRequest(
     mojom::RequestContextType context,
+    network::mojom::RequestDestination request_destination,
     const KURL& url,
     const String& nonce,
     const IntegrityMetadataSet& integrity_metadata,
@@ -737,13 +736,15 @@ bool ContentSecurityPolicy::AllowRequest(
     ReportingDisposition reporting_disposition,
     CheckHeaderType check_header_type) const {
   if (integrity_metadata.IsEmpty() &&
-      !AllowRequestWithoutIntegrity(context, url, redirect_status,
-                                    reporting_disposition, check_header_type)) {
+      !AllowRequestWithoutIntegrity(context, request_destination, url,
+                                    redirect_status, reporting_disposition,
+                                    check_header_type)) {
     return false;
   }
 
   base::Optional<ContentSecurityPolicy::DirectiveType> type =
       GetDirectiveTypeFromRequestContextType(context);
+
   if (!type)
     return true;
   return AllowFromSource(*type, url, redirect_status, reporting_disposition,
@@ -928,7 +929,8 @@ const KURL ContentSecurityPolicy::FallbackUrlForPlugin() const {
   return delegate_ ? delegate_->Url() : KURL();
 }
 
-void ContentSecurityPolicy::EnforceSandboxFlags(SandboxFlags mask) {
+void ContentSecurityPolicy::EnforceSandboxFlags(
+    network::mojom::blink::WebSandboxFlags mask) {
   sandbox_mask_ |= mask;
 }
 
@@ -1058,10 +1060,25 @@ static void GatherSecurityPolicyViolationEventData(
   if (!source_location)
     source_location = delegate->GetSourceLocation();
   if (source_location && source_location->LineNumber()) {
-    KURL source = KURL(source_location->Url());
-    init->setSourceFile(StripURLForUseInReport(delegate->GetSecurityOrigin(),
-                                               source, redirect_status,
-                                               effective_type));
+    KURL source_url = KURL(source_location->Url());
+    // The source file might be a script loaded from a redirect. Web browser
+    // usually tries to hide post-redirect information. The script might be
+    // cross-origin with the document, but also with other scripts. As a result,
+    // everything is cleared no matter the |source_url| origin.
+    // See https://crbug.com/1074317
+    //
+    // Note: The username, password and ref are stripped later below by
+    // StripURLForUseInReport(..)
+    source_url.SetQuery(String());
+
+    // TODO(arthursonzogni): |redirect_status| refers to the redirect status of
+    // the |blocked_url|. This is unrelated to |source_url|. Why using it in
+    // this case? This is obviously wrong:
+    String source_file =
+        StripURLForUseInReport(delegate->GetSecurityOrigin(), source_url,
+                               redirect_status, effective_type);
+
+    init->setSourceFile(source_file);
     init->setLineNumber(source_location->LineNumber());
     init->setColumnNumber(source_location->ColumnNumber());
   } else {
@@ -1248,11 +1265,12 @@ void ContentSecurityPolicy::ReportValueForEmptyDirective(const String& name,
                "'. The directive has been applied, and the value ignored.");
 }
 
-void ContentSecurityPolicy::ReportNonsecureTrustedTypes() {
-  LogToConsole(
-      "The Content Security Policy directive "
-      "'require-trusted-types-for' only has an effect in a secure "
-      "context. The directive has been ignored.");
+void ContentSecurityPolicy::ReportMixedContentReportURI(
+    const String& endpoint) {
+  LogToConsole("The Content Security Policy directive specifies as endpoint '" +
+               endpoint +
+               "'. This endpoint will be ignored since it violates the policy "
+               "for Mixed Content.");
 }
 
 void ContentSecurityPolicy::ReportInvalidInReportOnly(const String& name) {
@@ -1397,12 +1415,11 @@ void ContentSecurityPolicy::ReportInvalidSourceExpression(
   LogToConsole(message);
 }
 
-void ContentSecurityPolicy::ReportMissingReportURI(const String& policy) {
-  LogToConsole("The Content Security Policy '" + policy +
-               "' was delivered in report-only mode, but does not specify a "
-               "'report-uri'; the policy will have no effect. Please either "
-               "add a 'report-uri' directive, or deliver the policy via the "
-               "'Content-Security-Policy' header.");
+void ContentSecurityPolicy::ReportMultipleReportToEndpoints() {
+  LogToConsole(
+      "The Content Security Policy directive 'report-to' contains more than "
+      "one endpoint. Only the first one will be used, the other ones will be "
+      "ignored.");
 }
 
 void ContentSecurityPolicy::LogToConsole(const String& message,
diff --git a/chromium/third_party/blink/renderer/core/frame/csp/content_security_policy.h b/chromium/third_party/blink/renderer/core/frame/csp/content_security_policy.h
index 54d3b7c35e7..29fe4bae016 100644
--- a/chromium/third_party/blink/renderer/core/frame/csp/content_security_policy.h
+++ b/chromium/third_party/blink/renderer/core/frame/csp/content_security_policy.h
@@ -30,6 +30,7 @@
 #include <utility>
 
 #include "services/network/public/mojom/content_security_policy.mojom-blink.h"
+#include "services/network/public/mojom/web_sandbox_flags.mojom-blink-forward.h"
 #include "third_party/blink/public/mojom/devtools/console_message.mojom-blink.h"
 #include "third_party/blink/public/mojom/security_context/insecure_request_policy.mojom-blink-forward.h"
 #include "third_party/blink/public/platform/web_content_security_policy_struct.h"
@@ -73,7 +74,6 @@ class SecurityPolicyViolationEventInit;
 class SourceLocation;
 enum class ResourceType : uint8_t;
 
-using SandboxFlags = mojom::blink::WebSandboxFlags;
 typedef HeapVector<Member<CSPDirectiveList>> CSPDirectiveListVector;
 typedef HeapVector<Member<ConsoleMessage>> ConsoleMessageVector;
 typedef std::pair<String, network::mojom::ContentSecurityPolicyType>
@@ -89,10 +89,6 @@ class CORE_EXPORT ContentSecurityPolicyDelegate : public GarbageCollectedMixin {
   // See https://w3c.github.io/webappsec-csp/#policy-self-origin.
   virtual const SecurityOrigin* GetSecurityOrigin() = 0;
 
-  // Returns the SecureContextMode for the context to which the delegate is
-  // bound.
-  virtual SecureContextMode GetSecureContextMode() = 0;
-
   // Returns the URL this content security policy is bound to.
   // Used for https://w3c.github.io/webappsec-csp/#violation-url and so.
   // Note: Url() is used for several purposes that are specced slightly
@@ -101,7 +97,7 @@ class CORE_EXPORT ContentSecurityPolicyDelegate : public GarbageCollectedMixin {
   virtual const KURL& Url() const = 0;
 
   // Directives support.
-  virtual void SetSandboxFlags(SandboxFlags) = 0;
+  virtual void SetSandboxFlags(network::mojom::blink::WebSandboxFlags) = 0;
   virtual void SetRequireTrustedTypes() = 0;
   virtual void AddInsecureRequestPolicy(
       mojom::blink::InsecureRequestPolicy) = 0;
@@ -332,14 +328,20 @@ class CORE_EXPORT ContentSecurityPolicy final
       ReportingDisposition = ReportingDisposition::kReport) const;
   bool IsFrameAncestorsEnforced() const;
 
+  // TODO(crbug.com/889751): Remove "mojom::RequestContextType" once
+  // all the code migrates.
   bool AllowRequestWithoutIntegrity(
       mojom::RequestContextType,
+      network::mojom::RequestDestination,
       const KURL&,
       RedirectStatus = RedirectStatus::kNoRedirect,
       ReportingDisposition = ReportingDisposition::kReport,
       CheckHeaderType = CheckHeaderType::kCheckAll) const;
 
+  // TODO(crbug.com/889751): Remove "mojom::RequestContextType" once
+  // all the code migrates.
   bool AllowRequest(mojom::RequestContextType,
+                    network::mojom::RequestDestination,
                     const KURL&,
                     const String& nonce,
                     const IntegrityMetadataSet&,
@@ -382,7 +384,7 @@ class CORE_EXPORT ContentSecurityPolicy final
   void ReportInvalidSandboxFlags(const String&);
   void ReportInvalidSourceExpression(const String& directive_name,
                                      const String& source);
-  void ReportMissingReportURI(const String&);
+  void ReportMultipleReportToEndpoints();
   void ReportUnsupportedDirective(const String&);
   void ReportInvalidInReportOnly(const String&);
   void ReportInvalidDirectiveInMeta(const String& directive_name);
@@ -390,7 +392,7 @@ class CORE_EXPORT ContentSecurityPolicy final
   void ReportMetaOutsideHead(const String&);
   void ReportValueForEmptyDirective(const String& directive_name,
                                     const String& value);
-  void ReportNonsecureTrustedTypes();
+  void ReportMixedContentReportURI(const String& endpoint);
 
   // If a frame is passed in, the report will be sent using it as a context. If
   // no frame is passed in, the report will be sent via this object's
@@ -425,7 +427,7 @@ class CORE_EXPORT ContentSecurityPolicy final
   // Used as <object>'s URL when there is no `src` attribute.
   const KURL FallbackUrlForPlugin() const;
 
-  void EnforceSandboxFlags(SandboxFlags);
+  void EnforceSandboxFlags(network::mojom::blink::WebSandboxFlags);
   void RequireTrustedTypes();
   bool IsRequireTrustedTypes() const { return require_trusted_types_; }
   String EvalDisabledErrorMessage() const;
@@ -474,6 +476,7 @@ class CORE_EXPORT ContentSecurityPolicy final
 
   // Returns the 'wasm-eval' source is supported.
   bool SupportsWasmEval() const { return supports_wasm_eval_; }
+  void SetSupportsWasmEval(bool value) { supports_wasm_eval_ = value; }
 
   // Sometimes we don't know the initiator or it might be destroyed already
   // for certain navigational checks. We create a string version of the relevant
@@ -486,7 +489,9 @@ class CORE_EXPORT ContentSecurityPolicy final
   // context will be used for all sandbox checks but there are situations
   // (before installing the document that this CSP will bind to) when
   // there is no execution context to enforce the sandbox flags.
-  SandboxFlags GetSandboxMask() const { return sandbox_mask_; }
+  network::mojom::blink::WebSandboxFlags GetSandboxMask() const {
+    return sandbox_mask_;
+  }
 
   bool HasPolicyFromSource(network::mojom::ContentSecurityPolicySource) const;
 
@@ -577,7 +582,7 @@ class CORE_EXPORT ContentSecurityPolicy final
   uint8_t style_hash_algorithms_used_;
 
   // State flags used to configure the environment after parsing a policy.
-  SandboxFlags sandbox_mask_;
+  network::mojom::blink::WebSandboxFlags sandbox_mask_;
   bool require_trusted_types_;
   String disable_eval_error_message_;
   mojom::blink::InsecureRequestPolicy insecure_request_policy_;
diff --git a/chromium/third_party/blink/renderer/core/frame/csp/content_security_policy_fuzzer.cc b/chromium/third_party/blink/renderer/core/frame/csp/content_security_policy_fuzzer.cc
index b6d50a9e7a0..00bef2f4c04 100644
--- a/chromium/third_party/blink/renderer/core/frame/csp/content_security_policy_fuzzer.cc
+++ b/chromium/third_party/blink/renderer/core/frame/csp/content_security_policy_fuzzer.cc
@@ -30,7 +30,7 @@ int LLVMFuzzerInitialize(int* argc, char*** argv) {
   // CSP is bound.
   scoped_refptr<SharedBuffer> empty_document_data = SharedBuffer::Create();
   g_page_holder->GetFrame().Loader().ForceSandboxFlags(
-      mojom::blink::WebSandboxFlags::kAll);
+      network::mojom::blink::WebSandboxFlags::kAll);
   g_page_holder->GetFrame().ForceSynchronousDocumentInstall(
       "text/html", empty_document_data);
   return 0;
diff --git a/chromium/third_party/blink/renderer/core/frame/csp/content_security_policy_test.cc b/chromium/third_party/blink/renderer/core/frame/csp/content_security_policy_test.cc
index e6206ef33ec..b3e0efc8097 100644
--- a/chromium/third_party/blink/renderer/core/frame/csp/content_security_policy_test.cc
+++ b/chromium/third_party/blink/renderer/core/frame/csp/content_security_policy_test.cc
@@ -235,15 +235,18 @@ TEST_F(ContentSecurityPolicyTest, FrameAncestorsInMeta) {
 // delivered in <meta> elements.
 TEST_F(ContentSecurityPolicyTest, SandboxInMeta) {
   csp->BindToDelegate(execution_context->GetContentSecurityPolicyDelegate());
-  EXPECT_EQ(mojom::blink::WebSandboxFlags::kNone, csp->GetSandboxMask());
+  EXPECT_EQ(network::mojom::blink::WebSandboxFlags::kNone,
+            csp->GetSandboxMask());
   csp->DidReceiveHeader("sandbox;", ContentSecurityPolicyType::kEnforce,
                         ContentSecurityPolicySource::kMeta);
-  EXPECT_EQ(mojom::blink::WebSandboxFlags::kNone, csp->GetSandboxMask());
+  EXPECT_EQ(network::mojom::blink::WebSandboxFlags::kNone,
+            csp->GetSandboxMask());
   execution_context->GetSecurityContext().ApplySandboxFlags(
-      mojom::blink::WebSandboxFlags::kAll);
+      network::mojom::blink::WebSandboxFlags::kAll);
   csp->DidReceiveHeader("sandbox;", ContentSecurityPolicyType::kEnforce,
                         ContentSecurityPolicySource::kHTTP);
-  EXPECT_EQ(mojom::blink::WebSandboxFlags::kAll, csp->GetSandboxMask());
+  EXPECT_EQ(network::mojom::blink::WebSandboxFlags::kAll,
+            csp->GetSandboxMask());
 }
 
 // Tests that report-uri directives are discarded from policies
@@ -273,18 +276,24 @@ TEST_F(ContentSecurityPolicyTest, ObjectSrc) {
   csp->DidReceiveHeader("object-src 'none';",
                         ContentSecurityPolicyType::kEnforce,
                         ContentSecurityPolicySource::kMeta);
-  EXPECT_FALSE(csp->AllowRequest(
-      mojom::RequestContextType::OBJECT, url, String(), IntegrityMetadataSet(),
-      kParserInserted, ResourceRequest::RedirectStatus::kNoRedirect,
-      ReportingDisposition::kSuppressReporting));
-  EXPECT_FALSE(csp->AllowRequest(
-      mojom::RequestContextType::EMBED, url, String(), IntegrityMetadataSet(),
-      kParserInserted, ResourceRequest::RedirectStatus::kNoRedirect,
-      ReportingDisposition::kSuppressReporting));
-  EXPECT_TRUE(csp->AllowRequest(
-      mojom::RequestContextType::PLUGIN, url, String(), IntegrityMetadataSet(),
-      kParserInserted, ResourceRequest::RedirectStatus::kNoRedirect,
-      ReportingDisposition::kSuppressReporting));
+  EXPECT_FALSE(csp->AllowRequest(mojom::RequestContextType::OBJECT,
+                                 network::mojom::RequestDestination::kEmpty,
+                                 url, String(), IntegrityMetadataSet(),
+                                 kParserInserted,
+                                 ResourceRequest::RedirectStatus::kNoRedirect,
+                                 ReportingDisposition::kSuppressReporting));
+  EXPECT_FALSE(csp->AllowRequest(mojom::RequestContextType::EMBED,
+                                 network::mojom::RequestDestination::kEmbed,
+                                 url, String(), IntegrityMetadataSet(),
+                                 kParserInserted,
+                                 ResourceRequest::RedirectStatus::kNoRedirect,
+                                 ReportingDisposition::kSuppressReporting));
+  EXPECT_TRUE(csp->AllowRequest(mojom::RequestContextType::PLUGIN,
+                                network::mojom::RequestDestination::kEmpty, url,
+                                String(), IntegrityMetadataSet(),
+                                kParserInserted,
+                                ResourceRequest::RedirectStatus::kNoRedirect,
+                                ReportingDisposition::kSuppressReporting));
 }
 
 TEST_F(ContentSecurityPolicyTest, ConnectSrc) {
@@ -293,28 +302,36 @@ TEST_F(ContentSecurityPolicyTest, ConnectSrc) {
   csp->DidReceiveHeader("connect-src 'none';",
                         ContentSecurityPolicyType::kEnforce,
                         ContentSecurityPolicySource::kMeta);
-  EXPECT_FALSE(csp->AllowRequest(mojom::RequestContextType::SUBRESOURCE, url,
-                                 String(), IntegrityMetadataSet(),
+  EXPECT_FALSE(csp->AllowRequest(mojom::RequestContextType::SUBRESOURCE,
+                                 network::mojom::RequestDestination::kEmpty,
+                                 url, String(), IntegrityMetadataSet(),
                                  kParserInserted,
                                  ResourceRequest::RedirectStatus::kNoRedirect,
                                  ReportingDisposition::kSuppressReporting));
   EXPECT_FALSE(csp->AllowRequest(mojom::RequestContextType::XML_HTTP_REQUEST,
+                                 network::mojom::RequestDestination::kEmpty,
                                  url, String(), IntegrityMetadataSet(),
                                  kParserInserted,
                                  ResourceRequest::RedirectStatus::kNoRedirect,
                                  ReportingDisposition::kSuppressReporting));
-  EXPECT_FALSE(csp->AllowRequest(
-      mojom::RequestContextType::BEACON, url, String(), IntegrityMetadataSet(),
-      kParserInserted, ResourceRequest::RedirectStatus::kNoRedirect,
-      ReportingDisposition::kSuppressReporting));
-  EXPECT_FALSE(csp->AllowRequest(
-      mojom::RequestContextType::FETCH, url, String(), IntegrityMetadataSet(),
-      kParserInserted, ResourceRequest::RedirectStatus::kNoRedirect,
-      ReportingDisposition::kSuppressReporting));
-  EXPECT_TRUE(csp->AllowRequest(
-      mojom::RequestContextType::PLUGIN, url, String(), IntegrityMetadataSet(),
-      kParserInserted, ResourceRequest::RedirectStatus::kNoRedirect,
-      ReportingDisposition::kSuppressReporting));
+  EXPECT_FALSE(csp->AllowRequest(mojom::RequestContextType::BEACON,
+                                 network::mojom::RequestDestination::kEmpty,
+                                 url, String(), IntegrityMetadataSet(),
+                                 kParserInserted,
+                                 ResourceRequest::RedirectStatus::kNoRedirect,
+                                 ReportingDisposition::kSuppressReporting));
+  EXPECT_FALSE(csp->AllowRequest(mojom::RequestContextType::FETCH,
+                                 network::mojom::RequestDestination::kEmpty,
+                                 url, String(), IntegrityMetadataSet(),
+                                 kParserInserted,
+                                 ResourceRequest::RedirectStatus::kNoRedirect,
+                                 ReportingDisposition::kSuppressReporting));
+  EXPECT_TRUE(csp->AllowRequest(mojom::RequestContextType::PLUGIN,
+                                network::mojom::RequestDestination::kEmpty, url,
+                                String(), IntegrityMetadataSet(),
+                                kParserInserted,
+                                ResourceRequest::RedirectStatus::kNoRedirect,
+                                ReportingDisposition::kSuppressReporting));
 }
 // Tests that requests for scripts and styles are blocked
 // if `require-sri-for` delivered in HTTP header requires integrity be present
@@ -327,72 +344,96 @@ TEST_F(ContentSecurityPolicyTest, RequireSRIForInHeaderMissingIntegrity) {
   policy->DidReceiveHeader("require-sri-for script style",
                            ContentSecurityPolicyType::kEnforce,
                            ContentSecurityPolicySource::kHTTP);
-  EXPECT_FALSE(policy->AllowRequest(
-      mojom::RequestContextType::SCRIPT, url, String(), IntegrityMetadataSet(),
-      kParserInserted, ResourceRequest::RedirectStatus::kNoRedirect,
-      ReportingDisposition::kSuppressReporting));
-  EXPECT_FALSE(policy->AllowRequest(
-      mojom::RequestContextType::IMPORT, url, String(), IntegrityMetadataSet(),
-      kParserInserted, ResourceRequest::RedirectStatus::kNoRedirect,
-      ReportingDisposition::kSuppressReporting));
-  EXPECT_FALSE(policy->AllowRequest(
-      mojom::RequestContextType::STYLE, url, String(), IntegrityMetadataSet(),
-      kParserInserted, ResourceRequest::RedirectStatus::kNoRedirect,
-      ReportingDisposition::kSuppressReporting));
   EXPECT_FALSE(
-      policy->AllowRequest(mojom::RequestContextType::SERVICE_WORKER, url,
+      policy->AllowRequest(mojom::RequestContextType::SCRIPT,
+                           network::mojom::RequestDestination::kScript, url,
                            String(), IntegrityMetadataSet(), kParserInserted,
                            ResourceRequest::RedirectStatus::kNoRedirect,
                            ReportingDisposition::kSuppressReporting));
   EXPECT_FALSE(
-      policy->AllowRequest(mojom::RequestContextType::SHARED_WORKER, url,
+      policy->AllowRequest(mojom::RequestContextType::IMPORT,
+                           network::mojom::RequestDestination::kEmpty, url,
+                           String(), IntegrityMetadataSet(), kParserInserted,
+                           ResourceRequest::RedirectStatus::kNoRedirect,
+                           ReportingDisposition::kSuppressReporting));
+  EXPECT_FALSE(
+      policy->AllowRequest(mojom::RequestContextType::STYLE,
+                           network::mojom::RequestDestination::kStyle, url,
                            String(), IntegrityMetadataSet(), kParserInserted,
                            ResourceRequest::RedirectStatus::kNoRedirect,
                            ReportingDisposition::kSuppressReporting));
   EXPECT_FALSE(policy->AllowRequest(
-      mojom::RequestContextType::WORKER, url, String(), IntegrityMetadataSet(),
-      kParserInserted, ResourceRequest::RedirectStatus::kNoRedirect,
+      mojom::RequestContextType::SERVICE_WORKER,
+      network::mojom::RequestDestination::kServiceWorker, url, String(),
+      IntegrityMetadataSet(), kParserInserted,
+      ResourceRequest::RedirectStatus::kNoRedirect,
       ReportingDisposition::kSuppressReporting));
-  EXPECT_TRUE(policy->AllowRequest(
-      mojom::RequestContextType::IMAGE, url, String(), IntegrityMetadataSet(),
-      kParserInserted, ResourceRequest::RedirectStatus::kNoRedirect,
+  EXPECT_FALSE(policy->AllowRequest(
+      mojom::RequestContextType::SHARED_WORKER,
+      network::mojom::RequestDestination::kSharedWorker, url, String(),
+      IntegrityMetadataSet(), kParserInserted,
+      ResourceRequest::RedirectStatus::kNoRedirect,
       ReportingDisposition::kSuppressReporting));
+  EXPECT_FALSE(
+      policy->AllowRequest(mojom::RequestContextType::WORKER,
+                           network::mojom::RequestDestination::kWorker, url,
+                           String(), IntegrityMetadataSet(), kParserInserted,
+                           ResourceRequest::RedirectStatus::kNoRedirect,
+                           ReportingDisposition::kSuppressReporting));
+  EXPECT_TRUE(policy->AllowRequest(mojom::RequestContextType::IMAGE,
+                                   network::mojom::RequestDestination::kImage,
+                                   url, String(), IntegrityMetadataSet(),
+                                   kParserInserted,
+                                   ResourceRequest::RedirectStatus::kNoRedirect,
+                                   ReportingDisposition::kSuppressReporting));
   // Report
   policy = MakeGarbageCollected<ContentSecurityPolicy>();
   policy->BindToDelegate(execution_context->GetContentSecurityPolicyDelegate());
   policy->DidReceiveHeader("require-sri-for script style",
                            ContentSecurityPolicyType::kReport,
                            ContentSecurityPolicySource::kHTTP);
-  EXPECT_TRUE(policy->AllowRequest(
-      mojom::RequestContextType::SCRIPT, url, String(), IntegrityMetadataSet(),
-      kParserInserted, ResourceRequest::RedirectStatus::kNoRedirect,
-      ReportingDisposition::kSuppressReporting));
-  EXPECT_TRUE(policy->AllowRequest(
-      mojom::RequestContextType::IMPORT, url, String(), IntegrityMetadataSet(),
-      kParserInserted, ResourceRequest::RedirectStatus::kNoRedirect,
-      ReportingDisposition::kSuppressReporting));
-  EXPECT_TRUE(policy->AllowRequest(
-      mojom::RequestContextType::STYLE, url, String(), IntegrityMetadataSet(),
-      kParserInserted, ResourceRequest::RedirectStatus::kNoRedirect,
-      ReportingDisposition::kSuppressReporting));
-  EXPECT_TRUE(policy->AllowRequest(mojom::RequestContextType::SERVICE_WORKER,
+  EXPECT_TRUE(policy->AllowRequest(mojom::RequestContextType::SCRIPT,
+                                   network::mojom::RequestDestination::kScript,
                                    url, String(), IntegrityMetadataSet(),
                                    kParserInserted,
                                    ResourceRequest::RedirectStatus::kNoRedirect,
                                    ReportingDisposition::kSuppressReporting));
-  EXPECT_TRUE(policy->AllowRequest(mojom::RequestContextType::SHARED_WORKER,
+  EXPECT_TRUE(policy->AllowRequest(mojom::RequestContextType::IMPORT,
+                                   network::mojom::RequestDestination::kEmpty,
+                                   url, String(), IntegrityMetadataSet(),
+                                   kParserInserted,
+                                   ResourceRequest::RedirectStatus::kNoRedirect,
+                                   ReportingDisposition::kSuppressReporting));
+  EXPECT_TRUE(policy->AllowRequest(mojom::RequestContextType::STYLE,
+                                   network::mojom::RequestDestination::kStyle,
                                    url, String(), IntegrityMetadataSet(),
                                    kParserInserted,
                                    ResourceRequest::RedirectStatus::kNoRedirect,
                                    ReportingDisposition::kSuppressReporting));
   EXPECT_TRUE(policy->AllowRequest(
-      mojom::RequestContextType::WORKER, url, String(), IntegrityMetadataSet(),
-      kParserInserted, ResourceRequest::RedirectStatus::kNoRedirect,
+      mojom::RequestContextType::SERVICE_WORKER,
+      network::mojom::RequestDestination::kServiceWorker, url, String(),
+      IntegrityMetadataSet(), kParserInserted,
+      ResourceRequest::RedirectStatus::kNoRedirect,
       ReportingDisposition::kSuppressReporting));
   EXPECT_TRUE(policy->AllowRequest(
-      mojom::RequestContextType::IMAGE, url, String(), IntegrityMetadataSet(),
-      kParserInserted, ResourceRequest::RedirectStatus::kNoRedirect,
+      mojom::RequestContextType::SHARED_WORKER,
+      network::mojom::RequestDestination::kSharedWorker, url, String(),
+      IntegrityMetadataSet(), kParserInserted,
+      ResourceRequest::RedirectStatus::kNoRedirect,
       ReportingDisposition::kSuppressReporting));
+  EXPECT_TRUE(policy->AllowRequest(mojom::RequestContextType::WORKER,
+                                   network::mojom::RequestDestination::kWorker,
+                                   url, String(), IntegrityMetadataSet(),
+                                   kParserInserted,
+                                   ResourceRequest::RedirectStatus::kNoRedirect,
+                                   ReportingDisposition::kSuppressReporting));
+  EXPECT_TRUE(policy->AllowRequest(mojom::RequestContextType::IMAGE,
+                                   network::mojom::RequestDestination::kImage,
+                                   url, String(), IntegrityMetadataSet(),
+                                   kParserInserted,
+                                   ResourceRequest::RedirectStatus::kNoRedirect,
+                                   ReportingDisposition::kSuppressReporting));
 }
 
 // Tests that requests for scripts and styles are allowed
@@ -410,36 +451,48 @@ TEST_F(ContentSecurityPolicyTest, RequireSRIForInHeaderPresentIntegrity) {
   policy->DidReceiveHeader("require-sri-for script style",
                            ContentSecurityPolicyType::kEnforce,
                            ContentSecurityPolicySource::kHTTP);
-  EXPECT_TRUE(policy->AllowRequest(
-      mojom::RequestContextType::SCRIPT, url, String(), integrity_metadata,
-      kParserInserted, ResourceRequest::RedirectStatus::kNoRedirect,
-      ReportingDisposition::kSuppressReporting));
-  EXPECT_TRUE(policy->AllowRequest(
-      mojom::RequestContextType::IMPORT, url, String(), integrity_metadata,
-      kParserInserted, ResourceRequest::RedirectStatus::kNoRedirect,
-      ReportingDisposition::kSuppressReporting));
-  EXPECT_TRUE(policy->AllowRequest(
-      mojom::RequestContextType::STYLE, url, String(), integrity_metadata,
-      kParserInserted, ResourceRequest::RedirectStatus::kNoRedirect,
-      ReportingDisposition::kSuppressReporting));
-  EXPECT_TRUE(policy->AllowRequest(mojom::RequestContextType::SERVICE_WORKER,
+  EXPECT_TRUE(policy->AllowRequest(mojom::RequestContextType::SCRIPT,
+                                   network::mojom::RequestDestination::kScript,
                                    url, String(), integrity_metadata,
                                    kParserInserted,
                                    ResourceRequest::RedirectStatus::kNoRedirect,
                                    ReportingDisposition::kSuppressReporting));
-  EXPECT_TRUE(policy->AllowRequest(mojom::RequestContextType::SHARED_WORKER,
+  EXPECT_TRUE(policy->AllowRequest(mojom::RequestContextType::IMPORT,
+                                   network::mojom::RequestDestination::kEmpty,
+                                   url, String(), integrity_metadata,
+                                   kParserInserted,
+                                   ResourceRequest::RedirectStatus::kNoRedirect,
+                                   ReportingDisposition::kSuppressReporting));
+  EXPECT_TRUE(policy->AllowRequest(mojom::RequestContextType::STYLE,
+                                   network::mojom::RequestDestination::kStyle,
+                                   url, String(), integrity_metadata,
+                                   kParserInserted,
+                                   ResourceRequest::RedirectStatus::kNoRedirect,
+                                   ReportingDisposition::kSuppressReporting));
+  EXPECT_TRUE(
+      policy->AllowRequest(mojom::RequestContextType::SERVICE_WORKER,
+                           network::mojom::RequestDestination::kServiceWorker,
+                           url, String(), integrity_metadata, kParserInserted,
+                           ResourceRequest::RedirectStatus::kNoRedirect,
+                           ReportingDisposition::kSuppressReporting));
+  EXPECT_TRUE(
+      policy->AllowRequest(mojom::RequestContextType::SHARED_WORKER,
+                           network::mojom::RequestDestination::kSharedWorker,
+                           url, String(), integrity_metadata, kParserInserted,
+                           ResourceRequest::RedirectStatus::kNoRedirect,
+                           ReportingDisposition::kSuppressReporting));
+  EXPECT_TRUE(policy->AllowRequest(mojom::RequestContextType::WORKER,
+                                   network::mojom::RequestDestination::kWorker,
+                                   url, String(), integrity_metadata,
+                                   kParserInserted,
+                                   ResourceRequest::RedirectStatus::kNoRedirect,
+                                   ReportingDisposition::kSuppressReporting));
+  EXPECT_TRUE(policy->AllowRequest(mojom::RequestContextType::IMAGE,
+                                   network::mojom::RequestDestination::kImage,
                                    url, String(), integrity_metadata,
                                    kParserInserted,
                                    ResourceRequest::RedirectStatus::kNoRedirect,
                                    ReportingDisposition::kSuppressReporting));
-  EXPECT_TRUE(policy->AllowRequest(
-      mojom::RequestContextType::WORKER, url, String(), integrity_metadata,
-      kParserInserted, ResourceRequest::RedirectStatus::kNoRedirect,
-      ReportingDisposition::kSuppressReporting));
-  EXPECT_TRUE(policy->AllowRequest(
-      mojom::RequestContextType::IMAGE, url, String(), integrity_metadata,
-      kParserInserted, ResourceRequest::RedirectStatus::kNoRedirect,
-      ReportingDisposition::kSuppressReporting));
   // Content-Security-Policy-Report-Only is not supported in meta element,
   // so nothing should be blocked
   policy = MakeGarbageCollected<ContentSecurityPolicy>();
@@ -447,36 +500,48 @@ TEST_F(ContentSecurityPolicyTest, RequireSRIForInHeaderPresentIntegrity) {
   policy->DidReceiveHeader("require-sri-for script style",
                            ContentSecurityPolicyType::kReport,
                            ContentSecurityPolicySource::kHTTP);
-  EXPECT_TRUE(policy->AllowRequest(
-      mojom::RequestContextType::SCRIPT, url, String(), integrity_metadata,
-      kParserInserted, ResourceRequest::RedirectStatus::kNoRedirect,
-      ReportingDisposition::kSuppressReporting));
-  EXPECT_TRUE(policy->AllowRequest(
-      mojom::RequestContextType::IMPORT, url, String(), integrity_metadata,
-      kParserInserted, ResourceRequest::RedirectStatus::kNoRedirect,
-      ReportingDisposition::kSuppressReporting));
-  EXPECT_TRUE(policy->AllowRequest(
-      mojom::RequestContextType::STYLE, url, String(), integrity_metadata,
-      kParserInserted, ResourceRequest::RedirectStatus::kNoRedirect,
-      ReportingDisposition::kSuppressReporting));
-  EXPECT_TRUE(policy->AllowRequest(mojom::RequestContextType::SERVICE_WORKER,
+  EXPECT_TRUE(policy->AllowRequest(mojom::RequestContextType::SCRIPT,
+                                   network::mojom::RequestDestination::kScript,
                                    url, String(), integrity_metadata,
                                    kParserInserted,
                                    ResourceRequest::RedirectStatus::kNoRedirect,
                                    ReportingDisposition::kSuppressReporting));
-  EXPECT_TRUE(policy->AllowRequest(mojom::RequestContextType::SHARED_WORKER,
+  EXPECT_TRUE(policy->AllowRequest(mojom::RequestContextType::IMPORT,
+                                   network::mojom::RequestDestination::kEmpty,
+                                   url, String(), integrity_metadata,
+                                   kParserInserted,
+                                   ResourceRequest::RedirectStatus::kNoRedirect,
+                                   ReportingDisposition::kSuppressReporting));
+  EXPECT_TRUE(policy->AllowRequest(mojom::RequestContextType::STYLE,
+                                   network::mojom::RequestDestination::kStyle,
+                                   url, String(), integrity_metadata,
+                                   kParserInserted,
+                                   ResourceRequest::RedirectStatus::kNoRedirect,
+                                   ReportingDisposition::kSuppressReporting));
+  EXPECT_TRUE(
+      policy->AllowRequest(mojom::RequestContextType::SERVICE_WORKER,
+                           network::mojom::RequestDestination::kServiceWorker,
+                           url, String(), integrity_metadata, kParserInserted,
+                           ResourceRequest::RedirectStatus::kNoRedirect,
+                           ReportingDisposition::kSuppressReporting));
+  EXPECT_TRUE(
+      policy->AllowRequest(mojom::RequestContextType::SHARED_WORKER,
+                           network::mojom::RequestDestination::kSharedWorker,
+                           url, String(), integrity_metadata, kParserInserted,
+                           ResourceRequest::RedirectStatus::kNoRedirect,
+                           ReportingDisposition::kSuppressReporting));
+  EXPECT_TRUE(policy->AllowRequest(mojom::RequestContextType::WORKER,
+                                   network::mojom::RequestDestination::kWorker,
+                                   url, String(), integrity_metadata,
+                                   kParserInserted,
+                                   ResourceRequest::RedirectStatus::kNoRedirect,
+                                   ReportingDisposition::kSuppressReporting));
+  EXPECT_TRUE(policy->AllowRequest(mojom::RequestContextType::IMAGE,
+                                   network::mojom::RequestDestination::kImage,
                                    url, String(), integrity_metadata,
                                    kParserInserted,
                                    ResourceRequest::RedirectStatus::kNoRedirect,
                                    ReportingDisposition::kSuppressReporting));
-  EXPECT_TRUE(policy->AllowRequest(
-      mojom::RequestContextType::WORKER, url, String(), integrity_metadata,
-      kParserInserted, ResourceRequest::RedirectStatus::kNoRedirect,
-      ReportingDisposition::kSuppressReporting));
-  EXPECT_TRUE(policy->AllowRequest(
-      mojom::RequestContextType::IMAGE, url, String(), integrity_metadata,
-      kParserInserted, ResourceRequest::RedirectStatus::kNoRedirect,
-      ReportingDisposition::kSuppressReporting));
 }
 
 // Tests that requests for scripts and styles are blocked
@@ -490,36 +555,48 @@ TEST_F(ContentSecurityPolicyTest, RequireSRIForInMetaMissingIntegrity) {
   policy->DidReceiveHeader("require-sri-for script style",
                            ContentSecurityPolicyType::kEnforce,
                            ContentSecurityPolicySource::kMeta);
-  EXPECT_FALSE(policy->AllowRequest(
-      mojom::RequestContextType::SCRIPT, url, String(), IntegrityMetadataSet(),
-      kParserInserted, ResourceRequest::RedirectStatus::kNoRedirect,
-      ReportingDisposition::kSuppressReporting));
-  EXPECT_FALSE(policy->AllowRequest(
-      mojom::RequestContextType::IMPORT, url, String(), IntegrityMetadataSet(),
-      kParserInserted, ResourceRequest::RedirectStatus::kNoRedirect,
-      ReportingDisposition::kSuppressReporting));
-  EXPECT_FALSE(policy->AllowRequest(
-      mojom::RequestContextType::STYLE, url, String(), IntegrityMetadataSet(),
-      kParserInserted, ResourceRequest::RedirectStatus::kNoRedirect,
-      ReportingDisposition::kSuppressReporting));
   EXPECT_FALSE(
-      policy->AllowRequest(mojom::RequestContextType::SERVICE_WORKER, url,
+      policy->AllowRequest(mojom::RequestContextType::SCRIPT,
+                           network::mojom::RequestDestination::kScript, url,
                            String(), IntegrityMetadataSet(), kParserInserted,
                            ResourceRequest::RedirectStatus::kNoRedirect,
                            ReportingDisposition::kSuppressReporting));
   EXPECT_FALSE(
-      policy->AllowRequest(mojom::RequestContextType::SHARED_WORKER, url,
+      policy->AllowRequest(mojom::RequestContextType::IMPORT,
+                           network::mojom::RequestDestination::kEmpty, url,
+                           String(), IntegrityMetadataSet(), kParserInserted,
+                           ResourceRequest::RedirectStatus::kNoRedirect,
+                           ReportingDisposition::kSuppressReporting));
+  EXPECT_FALSE(
+      policy->AllowRequest(mojom::RequestContextType::STYLE,
+                           network::mojom::RequestDestination::kStyle, url,
                            String(), IntegrityMetadataSet(), kParserInserted,
                            ResourceRequest::RedirectStatus::kNoRedirect,
                            ReportingDisposition::kSuppressReporting));
   EXPECT_FALSE(policy->AllowRequest(
-      mojom::RequestContextType::WORKER, url, String(), IntegrityMetadataSet(),
-      kParserInserted, ResourceRequest::RedirectStatus::kNoRedirect,
+      mojom::RequestContextType::SERVICE_WORKER,
+      network::mojom::RequestDestination::kServiceWorker, url, String(),
+      IntegrityMetadataSet(), kParserInserted,
+      ResourceRequest::RedirectStatus::kNoRedirect,
       ReportingDisposition::kSuppressReporting));
-  EXPECT_TRUE(policy->AllowRequest(
-      mojom::RequestContextType::IMAGE, url, String(), IntegrityMetadataSet(),
-      kParserInserted, ResourceRequest::RedirectStatus::kNoRedirect,
+  EXPECT_FALSE(policy->AllowRequest(
+      mojom::RequestContextType::SHARED_WORKER,
+      network::mojom::RequestDestination::kSharedWorker, url, String(),
+      IntegrityMetadataSet(), kParserInserted,
+      ResourceRequest::RedirectStatus::kNoRedirect,
       ReportingDisposition::kSuppressReporting));
+  EXPECT_FALSE(
+      policy->AllowRequest(mojom::RequestContextType::WORKER,
+                           network::mojom::RequestDestination::kWorker, url,
+                           String(), IntegrityMetadataSet(), kParserInserted,
+                           ResourceRequest::RedirectStatus::kNoRedirect,
+                           ReportingDisposition::kSuppressReporting));
+  EXPECT_TRUE(policy->AllowRequest(mojom::RequestContextType::IMAGE,
+                                   network::mojom::RequestDestination::kImage,
+                                   url, String(), IntegrityMetadataSet(),
+                                   kParserInserted,
+                                   ResourceRequest::RedirectStatus::kNoRedirect,
+                                   ReportingDisposition::kSuppressReporting));
   // Content-Security-Policy-Report-Only is not supported in meta element,
   // so nothing should be blocked
   policy = MakeGarbageCollected<ContentSecurityPolicy>();
@@ -527,36 +604,48 @@ TEST_F(ContentSecurityPolicyTest, RequireSRIForInMetaMissingIntegrity) {
   policy->DidReceiveHeader("require-sri-for script style",
                            ContentSecurityPolicyType::kReport,
                            ContentSecurityPolicySource::kMeta);
-  EXPECT_TRUE(policy->AllowRequest(
-      mojom::RequestContextType::SCRIPT, url, String(), IntegrityMetadataSet(),
-      kParserInserted, ResourceRequest::RedirectStatus::kNoRedirect,
-      ReportingDisposition::kSuppressReporting));
-  EXPECT_TRUE(policy->AllowRequest(
-      mojom::RequestContextType::IMPORT, url, String(), IntegrityMetadataSet(),
-      kParserInserted, ResourceRequest::RedirectStatus::kNoRedirect,
-      ReportingDisposition::kSuppressReporting));
-  EXPECT_TRUE(policy->AllowRequest(
-      mojom::RequestContextType::STYLE, url, String(), IntegrityMetadataSet(),
-      kParserInserted, ResourceRequest::RedirectStatus::kNoRedirect,
-      ReportingDisposition::kSuppressReporting));
-  EXPECT_TRUE(policy->AllowRequest(mojom::RequestContextType::SERVICE_WORKER,
+  EXPECT_TRUE(policy->AllowRequest(mojom::RequestContextType::SCRIPT,
+                                   network::mojom::RequestDestination::kScript,
+                                   url, String(), IntegrityMetadataSet(),
+                                   kParserInserted,
+                                   ResourceRequest::RedirectStatus::kNoRedirect,
+                                   ReportingDisposition::kSuppressReporting));
+  EXPECT_TRUE(policy->AllowRequest(mojom::RequestContextType::IMPORT,
+                                   network::mojom::RequestDestination::kEmpty,
                                    url, String(), IntegrityMetadataSet(),
                                    kParserInserted,
                                    ResourceRequest::RedirectStatus::kNoRedirect,
                                    ReportingDisposition::kSuppressReporting));
-  EXPECT_TRUE(policy->AllowRequest(mojom::RequestContextType::SHARED_WORKER,
+  EXPECT_TRUE(policy->AllowRequest(mojom::RequestContextType::STYLE,
+                                   network::mojom::RequestDestination::kStyle,
                                    url, String(), IntegrityMetadataSet(),
                                    kParserInserted,
                                    ResourceRequest::RedirectStatus::kNoRedirect,
                                    ReportingDisposition::kSuppressReporting));
   EXPECT_TRUE(policy->AllowRequest(
-      mojom::RequestContextType::WORKER, url, String(), IntegrityMetadataSet(),
-      kParserInserted, ResourceRequest::RedirectStatus::kNoRedirect,
+      mojom::RequestContextType::SERVICE_WORKER,
+      network::mojom::RequestDestination::kServiceWorker, url, String(),
+      IntegrityMetadataSet(), kParserInserted,
+      ResourceRequest::RedirectStatus::kNoRedirect,
       ReportingDisposition::kSuppressReporting));
   EXPECT_TRUE(policy->AllowRequest(
-      mojom::RequestContextType::IMAGE, url, String(), IntegrityMetadataSet(),
-      kParserInserted, ResourceRequest::RedirectStatus::kNoRedirect,
+      mojom::RequestContextType::SHARED_WORKER,
+      network::mojom::RequestDestination::kSharedWorker, url, String(),
+      IntegrityMetadataSet(), kParserInserted,
+      ResourceRequest::RedirectStatus::kNoRedirect,
       ReportingDisposition::kSuppressReporting));
+  EXPECT_TRUE(policy->AllowRequest(mojom::RequestContextType::WORKER,
+                                   network::mojom::RequestDestination::kWorker,
+                                   url, String(), IntegrityMetadataSet(),
+                                   kParserInserted,
+                                   ResourceRequest::RedirectStatus::kNoRedirect,
+                                   ReportingDisposition::kSuppressReporting));
+  EXPECT_TRUE(policy->AllowRequest(mojom::RequestContextType::IMAGE,
+                                   network::mojom::RequestDestination::kImage,
+                                   url, String(), IntegrityMetadataSet(),
+                                   kParserInserted,
+                                   ResourceRequest::RedirectStatus::kNoRedirect,
+                                   ReportingDisposition::kSuppressReporting));
 }
 
 // Tests that requests for scripts and styles are allowed
@@ -574,36 +663,48 @@ TEST_F(ContentSecurityPolicyTest, RequireSRIForInMetaPresentIntegrity) {
   policy->DidReceiveHeader("require-sri-for script style",
                            ContentSecurityPolicyType::kEnforce,
                            ContentSecurityPolicySource::kMeta);
-  EXPECT_TRUE(policy->AllowRequest(
-      mojom::RequestContextType::SCRIPT, url, String(), integrity_metadata,
-      kParserInserted, ResourceRequest::RedirectStatus::kNoRedirect,
-      ReportingDisposition::kSuppressReporting));
-  EXPECT_TRUE(policy->AllowRequest(
-      mojom::RequestContextType::IMPORT, url, String(), integrity_metadata,
-      kParserInserted, ResourceRequest::RedirectStatus::kNoRedirect,
-      ReportingDisposition::kSuppressReporting));
-  EXPECT_TRUE(policy->AllowRequest(
-      mojom::RequestContextType::STYLE, url, String(), integrity_metadata,
-      kParserInserted, ResourceRequest::RedirectStatus::kNoRedirect,
-      ReportingDisposition::kSuppressReporting));
-  EXPECT_TRUE(policy->AllowRequest(mojom::RequestContextType::SERVICE_WORKER,
+  EXPECT_TRUE(policy->AllowRequest(mojom::RequestContextType::SCRIPT,
+                                   network::mojom::RequestDestination::kScript,
                                    url, String(), integrity_metadata,
                                    kParserInserted,
                                    ResourceRequest::RedirectStatus::kNoRedirect,
                                    ReportingDisposition::kSuppressReporting));
-  EXPECT_TRUE(policy->AllowRequest(mojom::RequestContextType::SHARED_WORKER,
+  EXPECT_TRUE(policy->AllowRequest(mojom::RequestContextType::IMPORT,
+                                   network::mojom::RequestDestination::kEmpty,
+                                   url, String(), integrity_metadata,
+                                   kParserInserted,
+                                   ResourceRequest::RedirectStatus::kNoRedirect,
+                                   ReportingDisposition::kSuppressReporting));
+  EXPECT_TRUE(policy->AllowRequest(mojom::RequestContextType::STYLE,
+                                   network::mojom::RequestDestination::kStyle,
+                                   url, String(), integrity_metadata,
+                                   kParserInserted,
+                                   ResourceRequest::RedirectStatus::kNoRedirect,
+                                   ReportingDisposition::kSuppressReporting));
+  EXPECT_TRUE(
+      policy->AllowRequest(mojom::RequestContextType::SERVICE_WORKER,
+                           network::mojom::RequestDestination::kServiceWorker,
+                           url, String(), integrity_metadata, kParserInserted,
+                           ResourceRequest::RedirectStatus::kNoRedirect,
+                           ReportingDisposition::kSuppressReporting));
+  EXPECT_TRUE(
+      policy->AllowRequest(mojom::RequestContextType::SHARED_WORKER,
+                           network::mojom::RequestDestination::kSharedWorker,
+                           url, String(), integrity_metadata, kParserInserted,
+                           ResourceRequest::RedirectStatus::kNoRedirect,
+                           ReportingDisposition::kSuppressReporting));
+  EXPECT_TRUE(policy->AllowRequest(mojom::RequestContextType::WORKER,
+                                   network::mojom::RequestDestination::kWorker,
+                                   url, String(), integrity_metadata,
+                                   kParserInserted,
+                                   ResourceRequest::RedirectStatus::kNoRedirect,
+                                   ReportingDisposition::kSuppressReporting));
+  EXPECT_TRUE(policy->AllowRequest(mojom::RequestContextType::IMAGE,
+                                   network::mojom::RequestDestination::kImage,
                                    url, String(), integrity_metadata,
                                    kParserInserted,
                                    ResourceRequest::RedirectStatus::kNoRedirect,
                                    ReportingDisposition::kSuppressReporting));
-  EXPECT_TRUE(policy->AllowRequest(
-      mojom::RequestContextType::WORKER, url, String(), integrity_metadata,
-      kParserInserted, ResourceRequest::RedirectStatus::kNoRedirect,
-      ReportingDisposition::kSuppressReporting));
-  EXPECT_TRUE(policy->AllowRequest(
-      mojom::RequestContextType::IMAGE, url, String(), integrity_metadata,
-      kParserInserted, ResourceRequest::RedirectStatus::kNoRedirect,
-      ReportingDisposition::kSuppressReporting));
   // Content-Security-Policy-Report-Only is not supported in meta element,
   // so nothing should be blocked
   policy = MakeGarbageCollected<ContentSecurityPolicy>();
@@ -611,36 +712,48 @@ TEST_F(ContentSecurityPolicyTest, RequireSRIForInMetaPresentIntegrity) {
   policy->DidReceiveHeader("require-sri-for script style",
                            ContentSecurityPolicyType::kReport,
                            ContentSecurityPolicySource::kMeta);
-  EXPECT_TRUE(policy->AllowRequest(
-      mojom::RequestContextType::SCRIPT, url, String(), integrity_metadata,
-      kParserInserted, ResourceRequest::RedirectStatus::kNoRedirect,
-      ReportingDisposition::kSuppressReporting));
-  EXPECT_TRUE(policy->AllowRequest(
-      mojom::RequestContextType::IMPORT, url, String(), integrity_metadata,
-      kParserInserted, ResourceRequest::RedirectStatus::kNoRedirect,
-      ReportingDisposition::kSuppressReporting));
-  EXPECT_TRUE(policy->AllowRequest(
-      mojom::RequestContextType::STYLE, url, String(), integrity_metadata,
-      kParserInserted, ResourceRequest::RedirectStatus::kNoRedirect,
-      ReportingDisposition::kSuppressReporting));
-  EXPECT_TRUE(policy->AllowRequest(mojom::RequestContextType::SERVICE_WORKER,
+  EXPECT_TRUE(policy->AllowRequest(mojom::RequestContextType::SCRIPT,
+                                   network::mojom::RequestDestination::kScript,
                                    url, String(), integrity_metadata,
                                    kParserInserted,
                                    ResourceRequest::RedirectStatus::kNoRedirect,
                                    ReportingDisposition::kSuppressReporting));
-  EXPECT_TRUE(policy->AllowRequest(mojom::RequestContextType::SHARED_WORKER,
+  EXPECT_TRUE(policy->AllowRequest(mojom::RequestContextType::IMPORT,
+                                   network::mojom::RequestDestination::kEmpty,
+                                   url, String(), integrity_metadata,
+                                   kParserInserted,
+                                   ResourceRequest::RedirectStatus::kNoRedirect,
+                                   ReportingDisposition::kSuppressReporting));
+  EXPECT_TRUE(policy->AllowRequest(mojom::RequestContextType::STYLE,
+                                   network::mojom::RequestDestination::kStyle,
+                                   url, String(), integrity_metadata,
+                                   kParserInserted,
+                                   ResourceRequest::RedirectStatus::kNoRedirect,
+                                   ReportingDisposition::kSuppressReporting));
+  EXPECT_TRUE(
+      policy->AllowRequest(mojom::RequestContextType::SERVICE_WORKER,
+                           network::mojom::RequestDestination::kServiceWorker,
+                           url, String(), integrity_metadata, kParserInserted,
+                           ResourceRequest::RedirectStatus::kNoRedirect,
+                           ReportingDisposition::kSuppressReporting));
+  EXPECT_TRUE(
+      policy->AllowRequest(mojom::RequestContextType::SHARED_WORKER,
+                           network::mojom::RequestDestination::kSharedWorker,
+                           url, String(), integrity_metadata, kParserInserted,
+                           ResourceRequest::RedirectStatus::kNoRedirect,
+                           ReportingDisposition::kSuppressReporting));
+  EXPECT_TRUE(policy->AllowRequest(mojom::RequestContextType::WORKER,
+                                   network::mojom::RequestDestination::kWorker,
+                                   url, String(), integrity_metadata,
+                                   kParserInserted,
+                                   ResourceRequest::RedirectStatus::kNoRedirect,
+                                   ReportingDisposition::kSuppressReporting));
+  EXPECT_TRUE(policy->AllowRequest(mojom::RequestContextType::IMAGE,
+                                   network::mojom::RequestDestination::kImage,
                                    url, String(), integrity_metadata,
                                    kParserInserted,
                                    ResourceRequest::RedirectStatus::kNoRedirect,
                                    ReportingDisposition::kSuppressReporting));
-  EXPECT_TRUE(policy->AllowRequest(
-      mojom::RequestContextType::WORKER, url, String(), integrity_metadata,
-      kParserInserted, ResourceRequest::RedirectStatus::kNoRedirect,
-      ReportingDisposition::kSuppressReporting));
-  EXPECT_TRUE(policy->AllowRequest(
-      mojom::RequestContextType::IMAGE, url, String(), integrity_metadata,
-      kParserInserted, ResourceRequest::RedirectStatus::kNoRedirect,
-      ReportingDisposition::kSuppressReporting));
 }
 
 TEST_F(ContentSecurityPolicyTest, NonceSinglePolicy) {
@@ -1059,30 +1172,34 @@ TEST_F(ContentSecurityPolicyTest, RequestsAllowedWhenBypassingCSP) {
                         ContentSecurityPolicySource::kHTTP);
 
   EXPECT_TRUE(csp->AllowRequest(mojom::RequestContextType::OBJECT,
+                                network::mojom::RequestDestination::kEmpty,
                                 KURL(base, "https://example.com/"), String(),
                                 IntegrityMetadataSet(), kParserInserted,
                                 ResourceRequest::RedirectStatus::kNoRedirect,
                                 ReportingDisposition::kSuppressReporting));
 
   EXPECT_FALSE(csp->AllowRequest(
-      mojom::RequestContextType::OBJECT, KURL(base, "https://not-example.com/"),
-      String(), IntegrityMetadataSet(), kParserInserted,
-      ResourceRequest::RedirectStatus::kNoRedirect,
+      mojom::RequestContextType::OBJECT,
+      network::mojom::RequestDestination::kEmpty,
+      KURL(base, "https://not-example.com/"), String(), IntegrityMetadataSet(),
+      kParserInserted, ResourceRequest::RedirectStatus::kNoRedirect,
       ReportingDisposition::kSuppressReporting));
 
   // Register "https" as bypassing CSP, which should now bypass it entirely
   SchemeRegistry::RegisterURLSchemeAsBypassingContentSecurityPolicy("https");
 
   EXPECT_TRUE(csp->AllowRequest(mojom::RequestContextType::OBJECT,
+                                network::mojom::RequestDestination::kEmpty,
                                 KURL(base, "https://example.com/"), String(),
                                 IntegrityMetadataSet(), kParserInserted,
                                 ResourceRequest::RedirectStatus::kNoRedirect,
                                 ReportingDisposition::kSuppressReporting));
 
   EXPECT_TRUE(csp->AllowRequest(
-      mojom::RequestContextType::OBJECT, KURL(base, "https://not-example.com/"),
-      String(), IntegrityMetadataSet(), kParserInserted,
-      ResourceRequest::RedirectStatus::kNoRedirect,
+      mojom::RequestContextType::OBJECT,
+      network::mojom::RequestDestination::kEmpty,
+      KURL(base, "https://not-example.com/"), String(), IntegrityMetadataSet(),
+      kParserInserted, ResourceRequest::RedirectStatus::kNoRedirect,
       ReportingDisposition::kSuppressReporting));
 
   SchemeRegistry::RemoveURLSchemeRegisteredAsBypassingContentSecurityPolicy(
@@ -1101,6 +1218,7 @@ TEST_F(ContentSecurityPolicyTest, FilesystemAllowedWhenBypassingCSP) {
 
   EXPECT_FALSE(
       csp->AllowRequest(mojom::RequestContextType::OBJECT,
+                        network::mojom::RequestDestination::kEmpty,
                         KURL(base, "filesystem:https://example.com/file.txt"),
                         String(), IntegrityMetadataSet(), kParserInserted,
                         ResourceRequest::RedirectStatus::kNoRedirect,
@@ -1108,6 +1226,7 @@ TEST_F(ContentSecurityPolicyTest, FilesystemAllowedWhenBypassingCSP) {
 
   EXPECT_FALSE(csp->AllowRequest(
       mojom::RequestContextType::OBJECT,
+      network::mojom::RequestDestination::kEmpty,
       KURL(base, "filesystem:https://not-example.com/file.txt"), String(),
       IntegrityMetadataSet(), kParserInserted,
       ResourceRequest::RedirectStatus::kNoRedirect,
@@ -1118,6 +1237,7 @@ TEST_F(ContentSecurityPolicyTest, FilesystemAllowedWhenBypassingCSP) {
 
   EXPECT_TRUE(
       csp->AllowRequest(mojom::RequestContextType::OBJECT,
+                        network::mojom::RequestDestination::kEmpty,
                         KURL(base, "filesystem:https://example.com/file.txt"),
                         String(), IntegrityMetadataSet(), kParserInserted,
                         ResourceRequest::RedirectStatus::kNoRedirect,
@@ -1125,6 +1245,7 @@ TEST_F(ContentSecurityPolicyTest, FilesystemAllowedWhenBypassingCSP) {
 
   EXPECT_TRUE(csp->AllowRequest(
       mojom::RequestContextType::OBJECT,
+      network::mojom::RequestDestination::kEmpty,
       KURL(base, "filesystem:https://not-example.com/file.txt"), String(),
       IntegrityMetadataSet(), kParserInserted,
       ResourceRequest::RedirectStatus::kNoRedirect,
@@ -1147,11 +1268,13 @@ TEST_F(ContentSecurityPolicyTest, BlobAllowedWhenBypassingCSP) {
 
   EXPECT_FALSE(csp->AllowRequest(
       mojom::RequestContextType::OBJECT,
+      network::mojom::RequestDestination::kEmpty,
       KURL(base, "blob:https://example.com/"), String(), IntegrityMetadataSet(),
       kParserInserted, ResourceRequest::RedirectStatus::kNoRedirect,
       ReportingDisposition::kSuppressReporting));
 
   EXPECT_FALSE(csp->AllowRequest(mojom::RequestContextType::OBJECT,
+                                 network::mojom::RequestDestination::kEmpty,
                                  KURL(base, "blob:https://not-example.com/"),
                                  String(), IntegrityMetadataSet(),
                                  kParserInserted,
@@ -1163,11 +1286,13 @@ TEST_F(ContentSecurityPolicyTest, BlobAllowedWhenBypassingCSP) {
 
   EXPECT_TRUE(csp->AllowRequest(
       mojom::RequestContextType::OBJECT,
+      network::mojom::RequestDestination::kEmpty,
       KURL(base, "blob:https://example.com/"), String(), IntegrityMetadataSet(),
       kParserInserted, ResourceRequest::RedirectStatus::kNoRedirect,
       ReportingDisposition::kSuppressReporting));
 
   EXPECT_TRUE(csp->AllowRequest(mojom::RequestContextType::OBJECT,
+                                network::mojom::RequestDestination::kEmpty,
                                 KURL(base, "blob:https://not-example.com/"),
                                 String(), IntegrityMetadataSet(),
                                 kParserInserted,
@@ -1646,9 +1771,11 @@ TEST_F(ContentSecurityPolicyTest, EmptyCSPIsNoOp) {
   EXPECT_TRUE(csp->AllowAncestors(document->GetFrame(), example_url));
   EXPECT_FALSE(csp->IsFrameAncestorsEnforced());
   EXPECT_TRUE(csp->AllowRequestWithoutIntegrity(
-      mojom::RequestContextType::SCRIPT, example_url));
-  EXPECT_TRUE(csp->AllowRequest(mojom::RequestContextType::SCRIPT, example_url,
-                                nonce, IntegrityMetadataSet(),
+      mojom::RequestContextType::SCRIPT,
+      network::mojom::RequestDestination::kScript, example_url));
+  EXPECT_TRUE(csp->AllowRequest(mojom::RequestContextType::SCRIPT,
+                                network::mojom::RequestDestination::kScript,
+                                example_url, nonce, IntegrityMetadataSet(),
                                 kParserInserted));
   EXPECT_FALSE(csp->IsActive());
   EXPECT_FALSE(csp->IsActiveForConnections());
@@ -1657,7 +1784,8 @@ TEST_F(ContentSecurityPolicyTest, EmptyCSPIsNoOp) {
             csp->GetInsecureRequestPolicy());
   EXPECT_FALSE(csp->HasHeaderDeliveredPolicy());
   EXPECT_FALSE(csp->SupportsWasmEval());
-  EXPECT_EQ(mojom::blink::WebSandboxFlags::kNone, csp->GetSandboxMask());
+  EXPECT_EQ(network::mojom::blink::WebSandboxFlags::kNone,
+            csp->GetSandboxMask());
   EXPECT_FALSE(csp->HasPolicyFromSource(ContentSecurityPolicySource::kHTTP));
 }
 
@@ -1673,7 +1801,8 @@ TEST_F(ContentSecurityPolicyTest, OpaqueOriginBeforeBind) {
   csp->DidReceiveHeader("default-src 'self';",
                         ContentSecurityPolicyType::kEnforce,
                         ContentSecurityPolicySource::kMeta);
-  EXPECT_TRUE(csp->AllowRequest(mojom::RequestContextType::SUBRESOURCE, url,
+  EXPECT_TRUE(csp->AllowRequest(mojom::RequestContextType::SUBRESOURCE,
+                                network::mojom::RequestDestination::kEmpty, url,
                                 String(), IntegrityMetadataSet(),
                                 kParserInserted,
                                 ResourceRequest::RedirectStatus::kNoRedirect,
diff --git a/chromium/third_party/blink/renderer/core/frame/csp/csp_directive_list.cc b/chromium/third_party/blink/renderer/core/frame/csp/csp_directive_list.cc
index faa75575624..93b36d543ab 100644
--- a/chromium/third_party/blink/renderer/core/frame/csp/csp_directive_list.cc
+++ b/chromium/third_party/blink/renderer/core/frame/csp/csp_directive_list.cc
@@ -8,6 +8,7 @@
 #include <utility>
 
 #include "services/network/public/cpp/features.h"
+#include "services/network/public/cpp/web_sandbox_flags.h"
 #include "services/network/public/mojom/content_security_policy.mojom-shared.h"
 #include "third_party/blink/renderer/bindings/core/v8/source_location.h"
 #include "third_party/blink/renderer/core/dom/document.h"
@@ -15,12 +16,15 @@
 #include "third_party/blink/renderer/core/execution_context/security_context.h"
 #include "third_party/blink/renderer/core/frame/deprecation.h"
 #include "third_party/blink/renderer/core/frame/local_frame.h"
+#include "third_party/blink/renderer/core/frame/sandbox_flags.h"
 #include "third_party/blink/renderer/core/html/html_script_element.h"
 #include "third_party/blink/renderer/core/inspector/console_message.h"
+#include "third_party/blink/renderer/core/loader/mixed_content_checker.h"
 #include "third_party/blink/renderer/platform/crypto.h"
 #include "third_party/blink/renderer/platform/heap/heap.h"
 #include "third_party/blink/renderer/platform/instrumentation/use_counter.h"
 #include "third_party/blink/renderer/platform/network/content_security_policy_parsers.h"
+#include "third_party/blink/renderer/platform/runtime_enabled_features.h"
 #include "third_party/blink/renderer/platform/weborigin/kurl.h"
 #include "third_party/blink/renderer/platform/wtf/text/base64.h"
 #include "third_party/blink/renderer/platform/wtf/text/parsing_utilities.h"
@@ -170,13 +174,6 @@ CSPDirectiveList* CSPDirectiveList::Create(ContentSecurityPolicy* policy,
     directives->SetEvalDisabledErrorMessage(message);
   }
 
-  if (directives->IsReportOnly() &&
-      source != ContentSecurityPolicySource::kMeta &&
-      directives->ReportEndpoints().IsEmpty()) {
-    policy->ReportMissingReportURI(
-        String(begin, static_cast<wtf_size_t>(end - begin)));
-  }
-
   return directives;
 }
 
@@ -383,7 +380,8 @@ bool CSPDirectiveList::CheckAncestors(SourceListDirective* directive,
 }
 
 bool CSPDirectiveList::CheckRequestWithoutIntegrity(
-    mojom::RequestContextType context) const {
+    mojom::RequestContextType context,
+    network::mojom::RequestDestination request_destination) const {
   if (require_sri_for_ == RequireSRIForToken::kNone)
     return true;
   // SRI specification
@@ -395,7 +393,13 @@ bool CSPDirectiveList::CheckRequestWithoutIntegrity(
        context == mojom::RequestContextType::IMPORT ||
        context == mojom::RequestContextType::SERVICE_WORKER ||
        context == mojom::RequestContextType::SHARED_WORKER ||
-       context == mojom::RequestContextType::WORKER)) {
+       context == mojom::RequestContextType::WORKER ||
+       request_destination == network::mojom::RequestDestination::kScript ||
+       request_destination ==
+           network::mojom::RequestDestination::kServiceWorker ||
+       request_destination ==
+           network::mojom::RequestDestination::kSharedWorker ||
+       request_destination == network::mojom::RequestDestination::kWorker)) {
     return false;
   }
   if ((require_sri_for_ & RequireSRIForToken::kStyle) &&
@@ -406,9 +410,10 @@ bool CSPDirectiveList::CheckRequestWithoutIntegrity(
 
 bool CSPDirectiveList::CheckRequestWithoutIntegrityAndReportViolation(
     mojom::RequestContextType context,
+    network::mojom::RequestDestination request_destination,
     const KURL& url,
     ResourceRequest::RedirectStatus redirect_status) const {
-  if (CheckRequestWithoutIntegrity(context))
+  if (CheckRequestWithoutIntegrity(context, request_destination))
     return true;
   String resource_type;
   switch (context) {
@@ -446,13 +451,16 @@ bool CSPDirectiveList::CheckRequestWithoutIntegrityAndReportViolation(
 
 bool CSPDirectiveList::AllowRequestWithoutIntegrity(
     mojom::RequestContextType context,
+    network::mojom::RequestDestination request_destination,
     const KURL& url,
     ResourceRequest::RedirectStatus redirect_status,
     ReportingDisposition reporting_disposition) const {
-  if (reporting_disposition == ReportingDisposition::kReport)
-    return CheckRequestWithoutIntegrityAndReportViolation(context, url,
-                                                          redirect_status);
-  return DenyIfEnforcingPolicy() || CheckRequestWithoutIntegrity(context);
+  if (reporting_disposition == ReportingDisposition::kReport) {
+    return CheckRequestWithoutIntegrityAndReportViolation(
+        context, request_destination, url, redirect_status);
+  }
+  return DenyIfEnforcingPolicy() ||
+         CheckRequestWithoutIntegrity(context, request_destination);
 }
 
 bool CSPDirectiveList::CheckMediaType(MediaListDirective* directive,
@@ -1118,6 +1126,12 @@ void CSPDirectiveList::ParseReportTo(const String& name, const String& value) {
   }
 
   ParseAndAppendReportEndpoints(value);
+
+  if (report_endpoints_.size() > 1) {
+    // The directive "report-to" only accepts one endpoint.
+    report_endpoints_.Shrink(1);
+    policy_->ReportMultipleReportToEndpoints();
+  }
 }
 
 void CSPDirectiveList::ParseReportURI(const String& name, const String& value) {
@@ -1138,6 +1152,30 @@ void CSPDirectiveList::ParseReportURI(const String& name, const String& value) {
   }
 
   ParseAndAppendReportEndpoints(value);
+
+  // Ignore right away report-uri endpoints which would be blocked later when
+  // reporting because of Mixed Content and report a warning.
+  if (!policy_->GetSelfSource()) {
+    return;
+  }
+  report_endpoints_.erase(
+      std::remove_if(report_endpoints_.begin(), report_endpoints_.end(),
+                     [this](const String& endpoint) {
+                       KURL parsed_endpoint = KURL(endpoint);
+                       if (!parsed_endpoint.IsValid()) {
+                         // endpoint is not absolute, so it cannot violate
+                         // MixedContent
+                         return false;
+                       }
+                       if (MixedContentChecker::IsMixedContent(
+                               policy_->GetSelfSource()->GetScheme(),
+                               parsed_endpoint)) {
+                         policy_->ReportMixedContentReportURI(endpoint);
+                         return true;
+                       }
+                       return false;
+                     }),
+      report_endpoints_.end());
 }
 
 // For "report-uri" directive, this method corresponds to:
@@ -1147,10 +1185,9 @@ void CSPDirectiveList::ParseReportURI(const String& name, const String& value) {
 
 // For "report-to" directive, the spec says |value| is a single token
 // but we use the same logic as "report-uri" and thus we split |value| by
-// ASCII whitespaces.
+// ASCII whitespaces. The tokens after the first one are discarded in
+// CSPDirectiveList::ParseReportTo.
 // https://w3c.github.io/webappsec-csp/#directive-report-to
-//
-// TODO(https://crbug.com/916265): Fix this inconsistency.
 void CSPDirectiveList::ParseAndAppendReportEndpoints(const String& value) {
   Vector<UChar> characters;
   value.AppendTo(characters);
@@ -1230,14 +1267,21 @@ void CSPDirectiveList::ApplySandboxPolicy(const String& name,
     policy_->ReportDuplicateDirective(name);
     return;
   }
+
+  using network::mojom::blink::WebSandboxFlags;
+  WebSandboxFlags ignored_flags =
+      !RuntimeEnabledFeatures::StorageAccessAPIEnabled()
+          ? WebSandboxFlags::kStorageAccessByUserActivation
+          : WebSandboxFlags::kNone;
+
   has_sandbox_policy_ = true;
-  String invalid_tokens;
-  SpaceSplitString policy_tokens =
-      SpaceSplitString(AtomicString(sandbox_policy));
-  policy_->EnforceSandboxFlags(
-      ParseSandboxPolicy(policy_tokens, invalid_tokens));
-  if (!invalid_tokens.IsNull())
-    policy_->ReportInvalidSandboxFlags(invalid_tokens);
+  network::WebSandboxFlagsParsingResult parsed =
+      network::ParseWebSandboxPolicy(sandbox_policy.Utf8(), ignored_flags);
+  policy_->EnforceSandboxFlags(parsed.flags);
+  if (!parsed.error_message.empty()) {
+    policy_->ReportInvalidSandboxFlags(
+        WebString::FromUTF8(parsed.error_message));
+  }
 }
 
 void CSPDirectiveList::AddTrustedTypes(const String& name,
@@ -1627,13 +1671,7 @@ CSPDirectiveList::ExposeForNavigationalChecks() const {
                            navigate_to_->ExposeForNavigationalChecks());
   }
 
-  if (upgrade_insecure_requests_) {
-    auto empty_source_list = network::mojom::blink::CSPSourceList::New(
-        WTF::Vector<network::mojom::blink::CSPSourcePtr>(), false, false,
-        false);
-    policy->directives.Set(CSPDirectiveName::UpgradeInsecureRequests,
-                           std::move(empty_source_list));
-  }
+  policy->upgrade_insecure_requests = upgrade_insecure_requests_;
 
   return policy;
 }
diff --git a/chromium/third_party/blink/renderer/core/frame/csp/csp_directive_list.h b/chromium/third_party/blink/renderer/core/frame/csp/csp_directive_list.h
index 6bf18836d1d..0b176a4f801 100644
--- a/chromium/third_party/blink/renderer/core/frame/csp/csp_directive_list.h
+++ b/chromium/third_party/blink/renderer/core/frame/csp/csp_directive_list.h
@@ -99,6 +99,7 @@ class CORE_EXPORT CSPDirectiveList final
   bool AllowDynamicWorker() const;
 
   bool AllowRequestWithoutIntegrity(mojom::RequestContextType,
+                                    network::mojom::RequestDestination,
                                     const KURL&,
                                     ResourceRequest::RedirectStatus,
                                     ReportingDisposition) const;
@@ -265,7 +266,8 @@ class CORE_EXPORT CSPDirectiveList final
                       const String& type,
                       const String& type_attribute) const;
   bool CheckAncestors(SourceListDirective*, LocalFrame*) const;
-  bool CheckRequestWithoutIntegrity(mojom::RequestContextType) const;
+  bool CheckRequestWithoutIntegrity(mojom::RequestContextType,
+                                    network::mojom::RequestDestination) const;
 
   void SetEvalDisabledErrorMessage(const String& error_message) {
     eval_disabled_error_message_ = error_message;
@@ -303,6 +305,7 @@ class CORE_EXPORT CSPDirectiveList final
                                         const KURL&) const;
   bool CheckRequestWithoutIntegrityAndReportViolation(
       mojom::RequestContextType,
+      network::mojom::RequestDestination,
       const KURL&,
       ResourceRequest::RedirectStatus) const;
 
diff --git a/chromium/third_party/blink/renderer/core/frame/csp/csp_directive_list_test.cc b/chromium/third_party/blink/renderer/core/frame/csp/csp_directive_list_test.cc
index 67855995a13..73efdbb4fc1 100644
--- a/chromium/third_party/blink/renderer/core/frame/csp/csp_directive_list_test.cc
+++ b/chromium/third_party/blink/renderer/core/frame/csp/csp_directive_list_test.cc
@@ -446,101 +446,141 @@ TEST_F(CSPDirectiveListTest, allowRequestWithoutIntegrity) {
     const char* list;
     const char* url;
     const mojom::RequestContextType context;
+    const network::mojom::RequestDestination request_destination;
     bool expected;
   } cases[] = {
       {"require-sri-for script", "https://example.com/file",
-       mojom::RequestContextType::SCRIPT, false},
+       mojom::RequestContextType::SCRIPT,
+       network::mojom::RequestDestination::kScript, false},
 
       // Extra WSP
       {"require-sri-for  script     script  ", "https://example.com/file",
-       mojom::RequestContextType::SCRIPT, false},
+       mojom::RequestContextType::SCRIPT,
+       network::mojom::RequestDestination::kScript, false},
       {"require-sri-for      style    script", "https://example.com/file",
-       mojom::RequestContextType::STYLE, false},
+       mojom::RequestContextType::STYLE,
+       network::mojom::RequestDestination::kStyle, false},
 
       {"require-sri-for style script", "https://example.com/file",
-       mojom::RequestContextType::SCRIPT, false},
+       mojom::RequestContextType::SCRIPT,
+       network::mojom::RequestDestination::kScript, false},
       {"require-sri-for style script", "https://example.com/file",
-       mojom::RequestContextType::IMPORT, false},
+       mojom::RequestContextType::IMPORT,
+       network::mojom::RequestDestination::kEmpty, false},
       {"require-sri-for style script", "https://example.com/file",
-       mojom::RequestContextType::IMAGE, true},
+       mojom::RequestContextType::IMAGE,
+       network::mojom::RequestDestination::kImage, true},
 
       {"require-sri-for script", "https://example.com/file",
-       mojom::RequestContextType::AUDIO, true},
+       mojom::RequestContextType::AUDIO,
+       network::mojom::RequestDestination::kAudio, true},
       {"require-sri-for script", "https://example.com/file",
-       mojom::RequestContextType::SCRIPT, false},
+       mojom::RequestContextType::SCRIPT,
+       network::mojom::RequestDestination::kScript, false},
       {"require-sri-for script", "https://example.com/file",
-       mojom::RequestContextType::IMPORT, false},
+       mojom::RequestContextType::IMPORT,
+       network::mojom::RequestDestination::kEmpty, false},
       {"require-sri-for script", "https://example.com/file",
-       mojom::RequestContextType::SERVICE_WORKER, false},
+       mojom::RequestContextType::SERVICE_WORKER,
+       network::mojom::RequestDestination::kServiceWorker, false},
       {"require-sri-for script", "https://example.com/file",
-       mojom::RequestContextType::SHARED_WORKER, false},
+       mojom::RequestContextType::SHARED_WORKER,
+       network::mojom::RequestDestination::kSharedWorker, false},
       {"require-sri-for script", "https://example.com/file",
-       mojom::RequestContextType::WORKER, false},
+       mojom::RequestContextType::WORKER,
+       network::mojom::RequestDestination::kWorker, false},
       {"require-sri-for script", "https://example.com/file",
-       mojom::RequestContextType::STYLE, true},
+       mojom::RequestContextType::STYLE,
+       network::mojom::RequestDestination::kStyle, true},
 
       {"require-sri-for style", "https://example.com/file",
-       mojom::RequestContextType::AUDIO, true},
+       mojom::RequestContextType::AUDIO,
+       network::mojom::RequestDestination::kAudio, true},
       {"require-sri-for style", "https://example.com/file",
-       mojom::RequestContextType::SCRIPT, true},
+       mojom::RequestContextType::SCRIPT,
+       network::mojom::RequestDestination::kScript, true},
       {"require-sri-for style", "https://example.com/file",
-       mojom::RequestContextType::IMPORT, true},
+       mojom::RequestContextType::IMPORT,
+       network::mojom::RequestDestination::kEmpty, true},
       {"require-sri-for style", "https://example.com/file",
-       mojom::RequestContextType::SERVICE_WORKER, true},
+       mojom::RequestContextType::SERVICE_WORKER,
+       network::mojom::RequestDestination::kServiceWorker, true},
       {"require-sri-for style", "https://example.com/file",
-       mojom::RequestContextType::SHARED_WORKER, true},
+       mojom::RequestContextType::SHARED_WORKER,
+       network::mojom::RequestDestination::kSharedWorker, true},
       {"require-sri-for style", "https://example.com/file",
-       mojom::RequestContextType::WORKER, true},
+       mojom::RequestContextType::WORKER,
+       network::mojom::RequestDestination::kWorker, true},
       {"require-sri-for style", "https://example.com/file",
-       mojom::RequestContextType::STYLE, false},
+       mojom::RequestContextType::STYLE,
+       network::mojom::RequestDestination::kStyle, false},
 
       // Multiple tokens
       {"require-sri-for script style", "https://example.com/file",
-       mojom::RequestContextType::STYLE, false},
+       mojom::RequestContextType::STYLE,
+       network::mojom::RequestDestination::kStyle, false},
       {"require-sri-for script style", "https://example.com/file",
-       mojom::RequestContextType::SCRIPT, false},
+       mojom::RequestContextType::SCRIPT,
+       network::mojom::RequestDestination::kScript, false},
       {"require-sri-for script style", "https://example.com/file",
-       mojom::RequestContextType::IMPORT, false},
+       mojom::RequestContextType::IMPORT,
+       network::mojom::RequestDestination::kEmpty, false},
       {"require-sri-for script style", "https://example.com/file",
-       mojom::RequestContextType::IMAGE, true},
+       mojom::RequestContextType::IMAGE,
+       network::mojom::RequestDestination::kImage, true},
 
       // Matching is case-insensitive
       {"require-sri-for Script", "https://example.com/file",
-       mojom::RequestContextType::SCRIPT, false},
+       mojom::RequestContextType::SCRIPT,
+       network::mojom::RequestDestination::kScript, false},
 
       // Unknown tokens do not affect result
       {"require-sri-for blabla12 as", "https://example.com/file",
-       mojom::RequestContextType::SCRIPT, true},
+       mojom::RequestContextType::SCRIPT,
+       network::mojom::RequestDestination::kScript, true},
       {"require-sri-for blabla12 as  script", "https://example.com/file",
-       mojom::RequestContextType::SCRIPT, false},
+       mojom::RequestContextType::SCRIPT,
+       network::mojom::RequestDestination::kScript, false},
       {"require-sri-for script style img", "https://example.com/file",
-       mojom::RequestContextType::SCRIPT, false},
+       mojom::RequestContextType::SCRIPT,
+       network::mojom::RequestDestination::kScript, false},
       {"require-sri-for script style img", "https://example.com/file",
-       mojom::RequestContextType::IMPORT, false},
+       mojom::RequestContextType::IMPORT,
+       network::mojom::RequestDestination::kEmpty, false},
       {"require-sri-for script style img", "https://example.com/file",
-       mojom::RequestContextType::STYLE, false},
+       mojom::RequestContextType::STYLE,
+       network::mojom::RequestDestination::kStyle, false},
       {"require-sri-for script style img", "https://example.com/file",
-       mojom::RequestContextType::IMAGE, true},
+       mojom::RequestContextType::IMAGE,
+       network::mojom::RequestDestination::kImage, true},
 
       // Empty token list has no effect
       {"require-sri-for      ", "https://example.com/file",
-       mojom::RequestContextType::SCRIPT, true},
+       mojom::RequestContextType::SCRIPT,
+       network::mojom::RequestDestination::kScript, true},
       {"require-sri-for      ", "https://example.com/file",
-       mojom::RequestContextType::IMPORT, true},
+       mojom::RequestContextType::IMPORT,
+       network::mojom::RequestDestination::kEmpty, true},
       {"require-sri-for      ", "https://example.com/file",
-       mojom::RequestContextType::STYLE, true},
+       mojom::RequestContextType::STYLE,
+       network::mojom::RequestDestination::kStyle, true},
       {"require-sri-for      ", "https://example.com/file",
-       mojom::RequestContextType::SERVICE_WORKER, true},
+       mojom::RequestContextType::SERVICE_WORKER,
+       network::mojom::RequestDestination::kServiceWorker, true},
       {"require-sri-for      ", "https://example.com/file",
-       mojom::RequestContextType::SHARED_WORKER, true},
+       mojom::RequestContextType::SHARED_WORKER,
+       network::mojom::RequestDestination::kSharedWorker, true},
       {"require-sri-for      ", "https://example.com/file",
-       mojom::RequestContextType::WORKER, true},
+       mojom::RequestContextType::WORKER,
+       network::mojom::RequestDestination::kWorker, true},
 
       // Order does not matter
       {"require-sri-for a b script", "https://example.com/file",
-       mojom::RequestContextType::SCRIPT, false},
+       mojom::RequestContextType::SCRIPT,
+       network::mojom::RequestDestination::kScript, false},
       {"require-sri-for a script b", "https://example.com/file",
-       mojom::RequestContextType::SCRIPT, false},
+       mojom::RequestContextType::SCRIPT,
+       network::mojom::RequestDestination::kScript, false},
   };
 
   for (const auto& test : cases) {
@@ -549,16 +589,17 @@ TEST_F(CSPDirectiveListTest, allowRequestWithoutIntegrity) {
     Member<CSPDirectiveList> directive_list =
         CreateList(test.list, ContentSecurityPolicyType::kReport);
     EXPECT_EQ(true, directive_list->AllowRequestWithoutIntegrity(
-                        test.context, resource,
+                        test.context, test.request_destination, resource,
                         ResourceRequest::RedirectStatus::kNoRedirect,
                         ReportingDisposition::kSuppressReporting));
 
     // Enforce
     directive_list = CreateList(test.list, ContentSecurityPolicyType::kEnforce);
-    EXPECT_EQ(test.expected, directive_list->AllowRequestWithoutIntegrity(
-                                 test.context, resource,
-                                 ResourceRequest::RedirectStatus::kNoRedirect,
-                                 ReportingDisposition::kSuppressReporting));
+    EXPECT_EQ(test.expected,
+              directive_list->AllowRequestWithoutIntegrity(
+                  test.context, test.request_destination, resource,
+                  ResourceRequest::RedirectStatus::kNoRedirect,
+                  ReportingDisposition::kSuppressReporting));
   }
 }
 
@@ -1198,6 +1239,12 @@ TEST_F(CSPDirectiveListTest, ReportEndpointsProperlyParsed) {
        ContentSecurityPolicySource::kHTTP,
        {"https://example.com", "https://example2.com"},
        false},
+      {"script-src 'self'; report-uri https://example.com "
+       "http://example2.com /relative/path",
+       // Mixed Content report-uri endpoint is ignored.
+       ContentSecurityPolicySource::kHTTP,
+       {"https://example.com", "/relative/path"},
+       false},
       {"script-src 'self'; report-uri https://example.com",
        ContentSecurityPolicySource::kMeta,
        {},
@@ -1215,6 +1262,11 @@ TEST_F(CSPDirectiveListTest, ReportEndpointsProperlyParsed) {
        ContentSecurityPolicySource::kMeta,
        {"group"},
        true},
+      {"script-src 'self'; report-to group group2",
+       ContentSecurityPolicySource::kHTTP,
+       // Only the first report-to endpoint is used. The other ones are ignored.
+       {"group"},
+       true},
       {"script-src 'self'; report-to group; report-to group2;",
        ContentSecurityPolicySource::kHTTP,
        {"group"},
diff --git a/chromium/third_party/blink/renderer/core/frame/csp/csp_violation_report_body.h b/chromium/third_party/blink/renderer/core/frame/csp/csp_violation_report_body.h
index b0b2393b5c5..3511ff48ca7 100644
--- a/chromium/third_party/blink/renderer/core/frame/csp/csp_violation_report_body.h
+++ b/chromium/third_party/blink/renderer/core/frame/csp/csp_violation_report_body.h
@@ -16,11 +16,11 @@ class CORE_EXPORT CSPViolationReportBody : public LocationReportBody {
   DEFINE_WRAPPERTYPEINFO();
 
  public:
-  CSPViolationReportBody(const SecurityPolicyViolationEventInit& violation_data)
-      : LocationReportBody(
-            SourceLocation::Capture(violation_data.sourceFile(),
-                                    violation_data.lineNumber(),
-                                    violation_data.columnNumber())),
+  explicit CSPViolationReportBody(
+      const SecurityPolicyViolationEventInit& violation_data)
+      : LocationReportBody(violation_data.sourceFile(),
+                           violation_data.lineNumber(),
+                           violation_data.columnNumber()),
         document_url_(violation_data.documentURI()),
         referrer_(violation_data.referrer()),
         blocked_url_(violation_data.blockedURI()),
diff --git a/chromium/third_party/blink/renderer/core/frame/csp/execution_context_csp_delegate.cc b/chromium/third_party/blink/renderer/core/frame/csp/execution_context_csp_delegate.cc
index 151bb266e1b..8e61fb6093c 100644
--- a/chromium/third_party/blink/renderer/core/frame/csp/execution_context_csp_delegate.cc
+++ b/chromium/third_party/blink/renderer/core/frame/csp/execution_context_csp_delegate.cc
@@ -4,6 +4,8 @@
 
 #include "third_party/blink/renderer/core/frame/csp/execution_context_csp_delegate.h"
 
+#include "services/network/public/cpp/web_sandbox_flags.h"
+#include "services/network/public/mojom/web_sandbox_flags.mojom-blink.h"
 #include "third_party/blink/public/common/security_context/insecure_request_policy.h"
 #include "third_party/blink/public/mojom/security_context/insecure_request_policy.mojom-blink.h"
 #include "third_party/blink/renderer/bindings/core/v8/source_location.h"
@@ -41,15 +43,12 @@ const SecurityOrigin* ExecutionContextCSPDelegate::GetSecurityOrigin() {
   return execution_context_->GetSecurityOrigin();
 }
 
-SecureContextMode ExecutionContextCSPDelegate::GetSecureContextMode() {
-  return GetSecurityContext().GetSecureContextMode();
-}
-
 const KURL& ExecutionContextCSPDelegate::Url() const {
   return execution_context_->Url();
 }
 
-void ExecutionContextCSPDelegate::SetSandboxFlags(SandboxFlags mask) {
+void ExecutionContextCSPDelegate::SetSandboxFlags(
+    network::mojom::blink::WebSandboxFlags mask) {
   // Ideally sandbox flags are determined at construction time since
   // sandbox flags influence the security origin and that influences
   // the Agent that is assigned for the ExecutionContext. Changing
@@ -67,7 +66,8 @@ void ExecutionContextCSPDelegate::SetSandboxFlags(SandboxFlags mask) {
   // already been set on the security context. Meta tags can't set them
   // and we should have already constructed the document with the correct
   // sandbox flags from CSP already.
-  mojom::blink::WebSandboxFlags flags = GetSecurityContext().GetSandboxFlags();
+  network::mojom::blink::WebSandboxFlags flags =
+      GetSecurityContext().GetSandboxFlags();
   CHECK_EQ(flags | mask, flags);
 }
 
@@ -180,7 +180,7 @@ void ExecutionContextCSPDelegate::PostViolationReport(
   auto* body = MakeGarbageCollected<CSPViolationReportBody>(violation_data);
   Report* observed_report = MakeGarbageCollected<Report>(
       ReportType::kCSPViolation, Url().GetString(), body);
-  ReportingContext::From(document->ToExecutionContext())
+  ReportingContext::From(execution_context_.Get())
       ->QueueReport(observed_report,
                     use_reporting_api ? report_endpoints : Vector<String>());
 
@@ -229,11 +229,11 @@ void ExecutionContextCSPDelegate::ReportBlockedScriptExecutionToInspector(
 
 void ExecutionContextCSPDelegate::DidAddContentSecurityPolicies(
     WTF::Vector<network::mojom::blink::ContentSecurityPolicyPtr> policies) {
-  Document* document = GetDocument();
-  if (!document)
+  auto* window = DynamicTo<LocalDOMWindow>(execution_context_.Get());
+  if (!window)
     return;
 
-  LocalFrame* frame = document->GetFrame();
+  LocalFrame* frame = window->GetFrame();
   if (!frame)
     return;
 
diff --git a/chromium/third_party/blink/renderer/core/frame/csp/execution_context_csp_delegate.h b/chromium/third_party/blink/renderer/core/frame/csp/execution_context_csp_delegate.h
index 426ee795c37..221dcd6038f 100644
--- a/chromium/third_party/blink/renderer/core/frame/csp/execution_context_csp_delegate.h
+++ b/chromium/third_party/blink/renderer/core/frame/csp/execution_context_csp_delegate.h
@@ -26,9 +26,8 @@ class ExecutionContextCSPDelegate final
 
   // ContentSecurityPolicyDelegate overrides:
   const SecurityOrigin* GetSecurityOrigin() override;
-  SecureContextMode GetSecureContextMode() override;
   const KURL& Url() const override;
-  void SetSandboxFlags(SandboxFlags) override;
+  void SetSandboxFlags(network::mojom::blink::WebSandboxFlags) override;
   void SetRequireTrustedTypes() override;
   void AddInsecureRequestPolicy(mojom::blink::InsecureRequestPolicy) override;
   std::unique_ptr<SourceLocation> GetSourceLocation() override;
diff --git a/chromium/third_party/blink/renderer/core/frame/csp/navigation_initiator_impl.cc b/chromium/third_party/blink/renderer/core/frame/csp/navigation_initiator_impl.cc
index bce1d06fba9..c9bdc143404 100644
--- a/chromium/third_party/blink/renderer/core/frame/csp/navigation_initiator_impl.cc
+++ b/chromium/third_party/blink/renderer/core/frame/csp/navigation_initiator_impl.cc
@@ -14,7 +14,7 @@
 namespace blink {
 
 NavigationInitiatorImpl::NavigationInitiatorImpl(Document& document)
-    : navigation_initiator_receivers_(document.GetExecutionContext()),
+    : navigation_initiator_receivers_(this, document.GetExecutionContext()),
       document_(document) {
   DCHECK(document.GetExecutionContext());
 }
@@ -50,8 +50,7 @@ void NavigationInitiatorImpl::SendViolationReport(
 void NavigationInitiatorImpl::BindReceiver(
     mojo::PendingReceiver<mojom::blink::NavigationInitiator> receiver) {
   navigation_initiator_receivers_.Add(
-      this, std::move(receiver),
-      document_->GetTaskRunner(TaskType::kNetworking));
+      std::move(receiver), document_->GetTaskRunner(TaskType::kNetworking));
 }
 
 }  // namespace blink
diff --git a/chromium/third_party/blink/renderer/core/frame/csp/navigation_initiator_impl.h b/chromium/third_party/blink/renderer/core/frame/csp/navigation_initiator_impl.h
index 7a9e2f7c8f5..5516abd9505 100644
--- a/chromium/third_party/blink/renderer/core/frame/csp/navigation_initiator_impl.h
+++ b/chromium/third_party/blink/renderer/core/frame/csp/navigation_initiator_impl.h
@@ -35,6 +35,7 @@ class NavigationInitiatorImpl
   // document. Used to report CSP violations that result from CSP blocking
   // navigation requests that were initiated by the owner document.
   HeapMojoReceiverSet<mojom::blink::NavigationInitiator,
+                      NavigationInitiatorImpl,
                       HeapMojoWrapperMode::kWithoutContextObserver>
       navigation_initiator_receivers_;
 
diff --git a/chromium/third_party/blink/renderer/core/frame/dactyloscoper.cc b/chromium/third_party/blink/renderer/core/frame/dactyloscoper.cc
index 380a735ecf8..b5c9d54e2ab 100644
--- a/chromium/third_party/blink/renderer/core/frame/dactyloscoper.cc
+++ b/chromium/third_party/blink/renderer/core/frame/dactyloscoper.cc
@@ -4,7 +4,8 @@
 
 #include "third_party/blink/renderer/core/frame/dactyloscoper.h"
 
-#include "third_party/blink/renderer/core/dom/document.h"
+#include "third_party/blink/renderer/core/frame/local_dom_window.h"
+#include "third_party/blink/renderer/core/frame/local_frame.h"
 #include "third_party/blink/renderer/core/loader/document_loader.h"
 
 namespace blink {
@@ -21,9 +22,9 @@ void Dactyloscoper::Record(ExecutionContext* context, WebFeature feature) {
   // TODO: Workers.
   if (!context)
     return;
-  if (auto* document = Document::DynamicFrom(context)) {
-    if (DocumentLoader* loader = document->Loader())
-      loader->GetDactyloscoper().Record(feature);
+  if (auto* window = DynamicTo<LocalDOMWindow>(context)) {
+    if (auto* frame = window->GetFrame())
+      frame->Loader().GetDocumentLoader()->GetDactyloscoper().Record(feature);
   }
 }
 
diff --git a/chromium/third_party/blink/renderer/core/frame/deprecation.cc b/chromium/third_party/blink/renderer/core/frame/deprecation.cc
index 62e4ed0ee68..8e50dac623d 100644
--- a/chromium/third_party/blink/renderer/core/frame/deprecation.cc
+++ b/chromium/third_party/blink/renderer/core/frame/deprecation.cc
@@ -4,7 +4,6 @@
 
 #include "third_party/blink/renderer/core/frame/deprecation.h"
 
-#include <bitset>
 #include "base/time/time.h"
 #include "build/build_config.h"
 #include "third_party/blink/public/mojom/feature_policy/feature_policy.mojom-blink.h"
@@ -14,6 +13,7 @@
 #include "third_party/blink/renderer/core/execution_context/execution_context.h"
 #include "third_party/blink/renderer/core/frame/deprecation_report_body.h"
 #include "third_party/blink/renderer/core/frame/frame_console.h"
+#include "third_party/blink/renderer/core/frame/local_dom_window.h"
 #include "third_party/blink/renderer/core/frame/local_frame.h"
 #include "third_party/blink/renderer/core/frame/local_frame_client.h"
 #include "third_party/blink/renderer/core/frame/report.h"
@@ -26,7 +26,7 @@
 #include "third_party/blink/renderer/platform/runtime_enabled_features.h"
 #include "third_party/blink/renderer/platform/wtf/date_math.h"
 
-using blink::WebFeature;
+namespace blink {
 
 namespace {
 
@@ -63,6 +63,7 @@ enum Milestone {
   kM82 = 82,
   kM83 = 83,
   kM84 = 84,
+  kM85 = 85,
 };
 
 // Returns estimated milestone dates as milliseconds since January 1, 1970.
@@ -110,7 +111,11 @@ base::Time::Exploded MilestoneDate(Milestone milestone) {
     case kM84:
       // This release is not yet scheduled, so this date is a guess.
       // https://groups.google.com/a/chromium.org/d/msg/chromium-dev/N1NxbSVOZas/ySlEKDKkBgAJ
-      return {2020, 6, 0, 29, 4};
+      return {2020, 7, 0, 14, 4};
+    case kM85:
+      // This release is not yet scheduled, so this date is a guess.
+      // https://groups.google.com/a/chromium.org/d/msg/chromium-dev/N1NxbSVOZas/ySlEKDKkBgAJ
+      return {2020, 8, 0, 25, 4};
   }
 
   NOTREACHED();
@@ -302,12 +307,12 @@ DeprecationInfo GetDeprecationInfo(WebFeature feature) {
 
     case WebFeature::kApplicationCacheAPISecureOrigin:
       return {
-          "ApplicationCacheAPISecureOrigin", kM82,
-          WillBeRemoved("Application Cache API use", kM82, "6192449487634432")};
+          "ApplicationCacheAPISecureOrigin", kM85,
+          WillBeRemoved("Application Cache API use", kM85, "6192449487634432")};
 
     case WebFeature::kApplicationCacheManifestSelectSecureOrigin:
-      return {"ApplicationCacheAPISecureOrigin", kM82,
-              WillBeRemoved("Application Cache API manifest selection", kM82,
+      return {"ApplicationCacheAPISecureOrigin", kM85,
+              WillBeRemoved("Application Cache API manifest selection", kM85,
                             "6192449487634432")};
 
     case WebFeature::kNotificationInsecureOrigin:
@@ -527,18 +532,69 @@ DeprecationInfo GetDeprecationInfo(WebFeature feature) {
               "details.",
               MilestoneString(kM84).Ascii().c_str())};
 
+    case WebFeature::kV8RTCRtpSender_CreateEncodedAudioStreams_Method:
+      return {"V8RTCRtpSender_CreateEncodedAudioStreams_Method", kM85,
+              ReplacedWillBeRemoved("RTCRtpSender.createEncodedAudioStreams",
+                                    "RTCRtpSender.createEncodedStreams", kM85,
+                                    "6321945865879552")};
+
+    case WebFeature::kV8RTCRtpSender_CreateEncodedVideoStreams_Method:
+      return {"V8RTCRtpSender_CreateEncodedVideoStreams_Method", kM85,
+              ReplacedWillBeRemoved("RTCRtpSender.createEncodedVideoStreams",
+                                    "RTCRtpSender.createEncodedStreams", kM85,
+                                    "6321945865879552")};
+
+    case WebFeature::kV8RTCRtpReceiver_CreateEncodedAudioStreams_Method:
+      return {"V8RTCRtpReceiver_CreateEncodedAudioStreams_Method", kM85,
+              ReplacedWillBeRemoved("RTCRtpReceiver.createEncodedAudioStreams",
+                                    "RTCRtpReceiver.createEncodedStreams", kM85,
+                                    "6321945865879552")};
+
+    case WebFeature::kV8RTCRtpReceiver_CreateEncodedVideoStreams_Method:
+      return {"V8RTCRtpReceiver_CreateEncodedVideoStreams_Method", kM85,
+              ReplacedWillBeRemoved("RTCRtpReceiver.createEncodedVideoStreams",
+                                    "RTCRtpReceiver.createEncodedStreams", kM85,
+                                    "6321945865879552")};
+
+    case WebFeature::kForceEncodedAudioInsertableStreams:
+      return {"ForceEncodedAudioInsertableStreams", kM85,
+              ReplacedWillBeRemoved(
+                  "RTCConfiguration.forceEncodedAudioInsertableStreams",
+                  "RTCConfiguration.encodedInsertableStreams", kM85,
+                  "6321945865879552")};
+
+    case WebFeature::kForceEncodedVideoInsertableStreams:
+      return {"ForceEncodedVideoInsertableStreams", kM85,
+              ReplacedWillBeRemoved(
+                  "RTCConfiguration.forceEncodedVideoInsertableStreams",
+                  "RTCConfiguration.encodedInsertableStreams", kM85,
+                  "6321945865879552")};
+
     // Features that aren't deprecated don't have a deprecation message.
     default:
       return {"NotDeprecated", kUnknown, ""};
   }
 }
 
-}  // anonymous namespace
+Report* CreateReportInternal(const KURL& context_url,
+                             const DeprecationInfo& info) {
+  base::Optional<base::Time> optional_removal_date;
+  if (info.anticipated_removal != kUnknown) {
+    base::Time removal_date;
+    bool result = base::Time::FromUTCExploded(
+        MilestoneDate(info.anticipated_removal), &removal_date);
+    DCHECK(result);
+    optional_removal_date = removal_date;
+  }
+  DeprecationReportBody* body = MakeGarbageCollected<DeprecationReportBody>(
+      info.id, optional_removal_date, info.message);
+  return MakeGarbageCollected<Report>(ReportType::kDeprecation, context_url,
+                                      body);
+}
 
-namespace blink {
+}  // anonymous namespace
 
-Deprecation::Deprecation() : mute_count_(0) {
-}
+Deprecation::Deprecation() : mute_count_(0) {}
 
 void Deprecation::ClearSuppression() {
   css_property_deprecation_bits_.reset();
@@ -614,7 +670,7 @@ void Deprecation::CountDeprecation(Document* document, WebFeature feature) {
   if (!document)
     return;
 
-  Deprecation::CountDeprecation(document->ToExecutionContext(), feature);
+  Deprecation::CountDeprecation(document->GetExecutionContext(), feature);
 }
 
 void Deprecation::CountDeprecation(DocumentLoader* loader, WebFeature feature) {
@@ -661,7 +717,10 @@ void Deprecation::CountDeprecationCrossOriginIframe(const Document& document,
 }
 
 void Deprecation::GenerateReport(const LocalFrame* frame, WebFeature feature) {
-  DeprecationInfo info = GetDeprecationInfo(feature);
+  if (!frame || !frame->Client())
+    return;
+
+  const DeprecationInfo info = GetDeprecationInfo(feature);
 
   // Send the deprecation message to the console as a warning.
   DCHECK(!info.message.IsEmpty());
@@ -670,28 +729,17 @@ void Deprecation::GenerateReport(const LocalFrame* frame, WebFeature feature) {
       mojom::ConsoleMessageLevel::kWarning, info.message);
   frame->Console().AddMessage(console_message);
 
-  if (!frame || !frame->Client())
-    return;
-
-  Document* document = frame->GetDocument();
-
-  // Construct the deprecation report.
-  base::Optional<base::Time> optional_removal_date;
-  if (info.anticipated_removal != kUnknown) {
-    base::Time removal_date;
-    bool result = base::Time::FromUTCExploded(
-        MilestoneDate(info.anticipated_removal), &removal_date);
-    DCHECK(result);
-    optional_removal_date = removal_date;
-  }
-  DeprecationReportBody* body = MakeGarbageCollected<DeprecationReportBody>(
-      info.id, optional_removal_date, info.message);
-  Report* report = MakeGarbageCollected<Report>(
-      ReportType::kDeprecation, document->Url().GetString(), body);
+  auto* window = frame->DomWindow();
+  Report* report = CreateReportInternal(window->Url(), info);
 
   // Send the deprecation report to the Reporting API and any
   // ReportingObservers.
-  ReportingContext::From(document->ToExecutionContext())->QueueReport(report);
+  ReportingContext::From(window)->QueueReport(report);
+}
+
+// static
+Report* Deprecation::CreateReport(const KURL& context_url, WebFeature feature) {
+  return CreateReportInternal(context_url, GetDeprecationInfo(feature));
 }
 
 // static
diff --git a/chromium/third_party/blink/renderer/core/frame/deprecation.h b/chromium/third_party/blink/renderer/core/frame/deprecation.h
index eaf82b6c67b..50c2b489c78 100644
--- a/chromium/third_party/blink/renderer/core/frame/deprecation.h
+++ b/chromium/third_party/blink/renderer/core/frame/deprecation.h
@@ -6,6 +6,7 @@
 #define THIRD_PARTY_BLINK_RENDERER_CORE_FRAME_DEPRECATION_H_
 
 #include <bitset>
+
 #include "base/macros.h"
 #include "third_party/blink/renderer/core/core_export.h"
 #include "third_party/blink/renderer/core/css/css_property_names.h"
@@ -20,7 +21,9 @@ enum class FeaturePolicyFeature;
 class Document;
 class DocumentLoader;
 class ExecutionContext;
+class KURL;
 class LocalFrame;
+class Report;
 
 class CORE_EXPORT Deprecation final {
   DISALLOW_NEW();
@@ -56,6 +59,8 @@ class CORE_EXPORT Deprecation final {
 
   static String DeprecationMessage(WebFeature);
 
+  static Report* CreateReport(const KURL& context_url, WebFeature);
+
   // Note: this is only public for tests.
   bool IsSuppressed(CSSPropertyID unresolved_property);
 
diff --git a/chromium/third_party/blink/renderer/core/frame/device_single_window_event_controller.cc b/chromium/third_party/blink/renderer/core/frame/device_single_window_event_controller.cc
index 325ef998a3d..d6f4996103c 100644
--- a/chromium/third_party/blink/renderer/core/frame/device_single_window_event_controller.cc
+++ b/chromium/third_party/blink/renderer/core/frame/device_single_window_event_controller.cc
@@ -4,7 +4,6 @@
 
 #include "third_party/blink/renderer/core/frame/device_single_window_event_controller.h"
 
-#include "third_party/blink/renderer/core/dom/document.h"
 #include "third_party/blink/renderer/core/dom/events/event.h"
 #include "third_party/blink/renderer/core/page/page.h"
 #include "third_party/blink/renderer/platform/weborigin/security_origin.h"
@@ -12,11 +11,9 @@
 namespace blink {
 
 DeviceSingleWindowEventController::DeviceSingleWindowEventController(
-    Document& document)
-    : PlatformEventController(&document),
-      needs_checking_null_events_(true),
-      document_(document) {
-  document.domWindow()->RegisterEventListenerObserver(this);
+    LocalDOMWindow& window)
+    : PlatformEventController(window), needs_checking_null_events_(true) {
+  window.RegisterEventListenerObserver(this);
 }
 
 DeviceSingleWindowEventController::~DeviceSingleWindowEventController() =
@@ -27,11 +24,10 @@ void DeviceSingleWindowEventController::DidUpdateData() {
 }
 
 void DeviceSingleWindowEventController::DispatchDeviceEvent(Event* event) {
-  if (!GetDocument().domWindow() || GetDocument().IsContextPaused() ||
-      GetDocument().IsContextDestroyed())
+  if (GetWindow().IsContextPaused() || GetWindow().IsContextDestroyed())
     return;
 
-  GetDocument().domWindow()->DispatchEvent(*event);
+  GetWindow().DispatchEvent(*event);
 
   if (needs_checking_null_events_) {
     if (IsNullEvent(event))
@@ -72,20 +68,18 @@ void DeviceSingleWindowEventController::DidRemoveAllEventListeners(
 
 bool DeviceSingleWindowEventController::IsSameSecurityOriginAsMainFrame()
     const {
-  if (!GetDocument().GetFrame() || !GetDocument().GetPage())
+  LocalFrame* frame = GetWindow().GetFrame();
+  if (!frame)
     return false;
 
-  if (GetDocument().GetFrame()->IsMainFrame())
+  if (frame->IsMainFrame())
     return true;
 
-  const SecurityOrigin* main_security_origin = GetDocument()
-                                                   .GetPage()
-                                                   ->MainFrame()
-                                                   ->GetSecurityContext()
-                                                   ->GetSecurityOrigin();
+  const SecurityOrigin* main_security_origin =
+      frame->GetPage()->MainFrame()->GetSecurityContext()->GetSecurityOrigin();
 
   if (main_security_origin &&
-      GetDocument().GetSecurityOrigin()->CanAccess(main_security_origin))
+      GetWindow().GetSecurityOrigin()->CanAccess(main_security_origin))
     return true;
 
   return false;
@@ -93,16 +87,15 @@ bool DeviceSingleWindowEventController::IsSameSecurityOriginAsMainFrame()
 
 bool DeviceSingleWindowEventController::CheckPolicyFeatures(
     const Vector<mojom::blink::FeaturePolicyFeature>& features) const {
-  const Document& document = GetDocument();
+  const LocalDOMWindow& window = GetWindow();
   return std::all_of(features.begin(), features.end(),
-                     [&document](mojom::blink::FeaturePolicyFeature feature) {
-                       return document.IsFeatureEnabled(
+                     [&window](mojom::blink::FeaturePolicyFeature feature) {
+                       return window.IsFeatureEnabled(
                            feature, ReportOptions::kReportOnFailure);
                      });
 }
 
 void DeviceSingleWindowEventController::Trace(Visitor* visitor) {
-  visitor->Trace(document_);
   PlatformEventController::Trace(visitor);
 }
 
diff --git a/chromium/third_party/blink/renderer/core/frame/device_single_window_event_controller.h b/chromium/third_party/blink/renderer/core/frame/device_single_window_event_controller.h
index b32550afba1..990e573e107 100644
--- a/chromium/third_party/blink/renderer/core/frame/device_single_window_event_controller.h
+++ b/chromium/third_party/blink/renderer/core/frame/device_single_window_event_controller.h
@@ -12,7 +12,6 @@
 
 namespace blink {
 
-class Document;
 class Event;
 
 class CORE_EXPORT DeviceSingleWindowEventController
@@ -32,9 +31,8 @@ class CORE_EXPORT DeviceSingleWindowEventController
   void DidRemoveAllEventListeners(LocalDOMWindow*) override;
 
  protected:
-  explicit DeviceSingleWindowEventController(Document&);
+  explicit DeviceSingleWindowEventController(LocalDOMWindow&);
 
-  Document& GetDocument() const { return *document_; }
   bool IsSameSecurityOriginAsMainFrame() const;
   bool CheckPolicyFeatures(
       const Vector<mojom::blink::FeaturePolicyFeature>& features) const;
@@ -47,7 +45,6 @@ class CORE_EXPORT DeviceSingleWindowEventController
 
  private:
   bool needs_checking_null_events_;
-  Member<Document> document_;
 };
 
 }  // namespace blink
diff --git a/chromium/third_party/blink/renderer/core/frame/document_policy_violation_report_body.h b/chromium/third_party/blink/renderer/core/frame/document_policy_violation_report_body.h
index 12d84653edf..e6364be65cb 100644
--- a/chromium/third_party/blink/renderer/core/frame/document_policy_violation_report_body.h
+++ b/chromium/third_party/blink/renderer/core/frame/document_policy_violation_report_body.h
@@ -16,11 +16,6 @@ class CORE_EXPORT DocumentPolicyViolationReportBody
   DEFINE_WRAPPERTYPEINFO();
 
  public:
-  DocumentPolicyViolationReportBody(const String& feature_id,
-                                    const String& message,
-                                    const String& disposition)
-      : feature_id_(feature_id), message_(message), disposition_(disposition) {}
-
   DocumentPolicyViolationReportBody(
       const String& feature_id,
       const String& message,
@@ -29,12 +24,16 @@ class CORE_EXPORT DocumentPolicyViolationReportBody
       const String& resource_url)
       : LocationReportBody(resource_url),
         feature_id_(feature_id),
-        message_(message),
+        message_("Document policy violation: " +
+                 (message.IsEmpty()
+                      ? feature_id + " is not allowed in this document."
+                      : message)),
         disposition_(disposition) {}
 
   const String& featureId() const { return feature_id_; }
   const String& disposition() const { return disposition_; }
   const String& message() const { return message_; }
+
   void BuildJSONValue(V8ObjectBuilder& builder) const override;
 
   ~DocumentPolicyViolationReportBody() override = default;
diff --git a/chromium/third_party/blink/renderer/core/frame/dom_timer_test.cc b/chromium/third_party/blink/renderer/core/frame/dom_timer_test.cc
index 9f982ed49e4..d174fb71d52 100644
--- a/chromium/third_party/blink/renderer/core/frame/dom_timer_test.cc
+++ b/chromium/third_party/blink/renderer/core/frame/dom_timer_test.cc
@@ -51,9 +51,7 @@ class DOMTimerTest : public RenderingTest {
     auto* mock_clock = test_task_runner->GetMockClock();
     auto* mock_tick_clock = test_task_runner->GetMockTickClock();
     auto now_ticks = test_task_runner->NowTicks();
-    unified_clock_ = std::make_unique<Performance::UnifiedClock>(
-        mock_clock, mock_tick_clock);
-    window_performance->SetClocksForTesting(unified_clock_.get());
+    window_performance->SetClocksForTesting(mock_clock, mock_tick_clock);
     window_performance->ResetTimeOriginForTesting(now_ticks);
     GetDocument().GetSettings()->SetScriptEnabled(true);
     auto* loader = GetDocument().Loader();
@@ -88,9 +86,6 @@ class DOMTimerTest : public RenderingTest {
         script, KURL(), SanitizeScriptErrors::kSanitize);
     platform()->RunUntilIdle();
   }
-
- private:
-  std::unique_ptr<Performance::UnifiedClock> unified_clock_;
 };
 
 const char* const kSetTimeout0ScriptText =
diff --git a/chromium/third_party/blink/renderer/core/frame/dom_window.cc b/chromium/third_party/blink/renderer/core/frame/dom_window.cc
index 0bf6a7d15ad..f0981e2ce1b 100644
--- a/chromium/third_party/blink/renderer/core/frame/dom_window.cc
+++ b/chromium/third_party/blink/renderer/core/frame/dom_window.cc
@@ -6,6 +6,7 @@
 
 #include <memory>
 
+#include "services/network/public/mojom/web_sandbox_flags.mojom-blink.h"
 #include "third_party/blink/renderer/bindings/core/v8/serialization/post_message_helper.h"
 #include "third_party/blink/renderer/bindings/core/v8/v8_window_post_message_options.h"
 #include "third_party/blink/renderer/bindings/core/v8/window_proxy_manager.h"
@@ -245,26 +246,27 @@ String DOMWindow::CrossDomainAccessErrorMessage(
   KURL target_url = local_dom_window
                         ? local_dom_window->document()->Url()
                         : KURL(NullURL(), target_origin->ToString());
-  if (GetFrame()->GetSecurityContext()->IsSandboxed(
-          mojom::blink::WebSandboxFlags::kOrigin) ||
-      accessing_window->document()->IsSandboxed(
-          mojom::blink::WebSandboxFlags::kOrigin)) {
+  using SandboxFlags = network::mojom::blink::WebSandboxFlags;
+  if (GetFrame()->GetSecurityContext()->IsSandboxed(SandboxFlags::kOrigin) ||
+      accessing_window->document()->IsSandboxed(SandboxFlags::kOrigin)) {
     message = "Blocked a frame at \"" +
               SecurityOrigin::Create(active_url)->ToString() +
               "\" from accessing a frame at \"" +
               SecurityOrigin::Create(target_url)->ToString() + "\". ";
-    if (GetFrame()->GetSecurityContext()->IsSandboxed(
-            mojom::blink::WebSandboxFlags::kOrigin) &&
-        accessing_window->document()->IsSandboxed(
-            mojom::blink::WebSandboxFlags::kOrigin))
+
+    if (GetFrame()->GetSecurityContext()->IsSandboxed(SandboxFlags::kOrigin) &&
+        accessing_window->document()->IsSandboxed(SandboxFlags::kOrigin)) {
       return "Sandbox access violation: " + message +
              " Both frames are sandboxed and lack the \"allow-same-origin\" "
              "flag.";
-    if (GetFrame()->GetSecurityContext()->IsSandboxed(
-            mojom::blink::WebSandboxFlags::kOrigin))
+    }
+
+    if (GetFrame()->GetSecurityContext()->IsSandboxed(SandboxFlags::kOrigin)) {
       return "Sandbox access violation: " + message +
              " The frame being accessed is sandboxed and lacks the "
              "\"allow-same-origin\" flag.";
+    }
+
     return "Sandbox access violation: " + message +
            " The frame requesting access is sandboxed and lacks the "
            "\"allow-same-origin\" flag.";
@@ -374,19 +376,15 @@ void DOMWindow::focus(v8::Isolate* isolate) {
   // https://html.spec.whatwg.org/C/#dom-window-focus
   // https://html.spec.whatwg.org/C/#focusing-steps
   LocalDOMWindow* incumbent_window = IncumbentDOMWindow(isolate);
-  ExecutionContext* incumbent_execution_context =
-      incumbent_window->GetExecutionContext();
 
   // TODO(mustaq): Use of |allow_focus| and consuming the activation here seems
   // suspicious (https://crbug.com/959815).
-  bool allow_focus = incumbent_execution_context->IsWindowInteractionAllowed();
+  bool allow_focus = incumbent_window->IsWindowInteractionAllowed();
   if (allow_focus) {
-    incumbent_execution_context->ConsumeWindowInteraction();
+    incumbent_window->ConsumeWindowInteraction();
   } else {
     DCHECK(IsMainThread());
-    allow_focus =
-        opener() && (opener() != this) &&
-        (Document::From(incumbent_execution_context)->domWindow() == opener());
+    allow_focus = opener() && opener() != this && incumbent_window == opener();
   }
 
   // If we're a top level window, bring the window to the front.
diff --git a/chromium/third_party/blink/renderer/core/frame/event_handler_registry.cc b/chromium/third_party/blink/renderer/core/frame/event_handler_registry.cc
index b331361c7da..08d723da0be 100644
--- a/chromium/third_party/blink/renderer/core/frame/event_handler_registry.cc
+++ b/chromium/third_party/blink/renderer/core/frame/event_handler_registry.cc
@@ -248,6 +248,11 @@ void EventHandlerRegistry::NotifyHandlersChanged(
     bool has_active_handlers) {
   LocalFrame* frame = GetLocalFrameForTarget(target);
 
+  // TODO(keishi): Added for crbug.com/1090687. Change to CHECK once bug is
+  // fixed.
+  if (!GetPage())
+    return;
+
   switch (handler_class) {
     case kScrollEvent:
       GetPage()->GetChromeClient().SetHasScrollEventHandlers(
@@ -324,6 +329,10 @@ void EventHandlerRegistry::NotifyHandlersChanged(
 void EventHandlerRegistry::NotifyDidAddOrRemoveEventHandlerTarget(
     LocalFrame* frame,
     EventHandlerClass handler_class) {
+  // TODO(keishi): Added for crbug.com/1090687. Change to CHECK once bug is
+  // fixed.
+  if (!GetPage())
+    return;
   ScrollingCoordinator* scrolling_coordinator =
       GetPage()->GetScrollingCoordinator();
   if (scrolling_coordinator &&
@@ -341,7 +350,9 @@ void EventHandlerRegistry::Trace(Visitor* visitor) {
       EventHandlerRegistry, &EventHandlerRegistry::ProcessCustomWeakness>(this);
 }
 
-void EventHandlerRegistry::ProcessCustomWeakness(const WeakCallbackInfo& info) {
+void EventHandlerRegistry::ProcessCustomWeakness(const LivenessBroker& info) {
+  // We use Vector<UntracedMember<>> here to avoid BlinkGC allocation in a
+  // custom weak callback.
   Vector<UntracedMember<EventTarget>> dead_targets;
   for (int i = 0; i < kEventHandlerClassCount; ++i) {
     EventHandlerClass handler_class = static_cast<EventHandlerClass>(i);
@@ -366,7 +377,7 @@ void EventHandlerRegistry::DocumentDetached(Document& document) {
        handler_class_index < kEventHandlerClassCount; ++handler_class_index) {
     EventHandlerClass handler_class =
         static_cast<EventHandlerClass>(handler_class_index);
-    Vector<UntracedMember<EventTarget>> targets_to_remove;
+    HeapVector<Member<EventTarget>> targets_to_remove;
     const EventTargetSet* targets = &targets_[handler_class];
     for (const auto& event_target : *targets) {
       if (Node* node = event_target.key->ToNode()) {
diff --git a/chromium/third_party/blink/renderer/core/frame/event_handler_registry.h b/chromium/third_party/blink/renderer/core/frame/event_handler_registry.h
index ad606b7719d..d41ca26df6d 100644
--- a/chromium/third_party/blink/renderer/core/frame/event_handler_registry.h
+++ b/chromium/third_party/blink/renderer/core/frame/event_handler_registry.h
@@ -16,6 +16,7 @@ class Document;
 class EventTarget;
 class LocalFrame;
 
+// We use UntracedMember<> here to do custom weak processing.
 typedef HashCountedSet<UntracedMember<EventTarget>> EventTargetSet;
 
 // Registry for keeping track of event handlers. Note that only handlers on
@@ -129,7 +130,7 @@ class CORE_EXPORT EventHandlerRegistry final
 
   Page* GetPage() const;
 
-  void ProcessCustomWeakness(const WeakCallbackInfo&);
+  void ProcessCustomWeakness(const LivenessBroker&);
 
   Member<LocalFrame> frame_;
   EventTargetSet targets_[kEventHandlerClassCount];
diff --git a/chromium/third_party/blink/renderer/core/frame/feature_policy_violation_report_body.h b/chromium/third_party/blink/renderer/core/frame/feature_policy_violation_report_body.h
index 3e8fa482cbb..7b810fa1f40 100644
--- a/chromium/third_party/blink/renderer/core/frame/feature_policy_violation_report_body.h
+++ b/chromium/third_party/blink/renderer/core/frame/feature_policy_violation_report_body.h
@@ -18,22 +18,17 @@ class CORE_EXPORT FeaturePolicyViolationReportBody : public LocationReportBody {
   FeaturePolicyViolationReportBody(const String& feature_id,
                                    const String& message,
                                    const String& disposition)
-      : feature_id_(feature_id), message_(message), disposition_(disposition) {}
-
-  FeaturePolicyViolationReportBody(
-      const String& feature_id,
-      const String& message,
-      const String& disposition,
-      // url of the resource that violate the feature policy.
-      const String& resource_url)
-      : LocationReportBody(resource_url),
-        feature_id_(feature_id),
-        message_(message),
+      : feature_id_(feature_id),
+        message_("Feature policy violation: " +
+                 (message.IsEmpty()
+                      ? feature_id + " is not allowed in this document."
+                      : message)),
         disposition_(disposition) {}
 
   const String& featureId() const { return feature_id_; }
   const String& disposition() const { return disposition_; }
   const String& message() const { return message_; }
+
   void BuildJSONValue(V8ObjectBuilder& builder) const override;
 
   ~FeaturePolicyViolationReportBody() override = default;
diff --git a/chromium/third_party/blink/renderer/core/frame/find_in_page.cc b/chromium/third_party/blink/renderer/core/frame/find_in_page.cc
index f020300af2d..8f65b9cb858 100644
--- a/chromium/third_party/blink/renderer/core/frame/find_in_page.cc
+++ b/chromium/third_party/blink/renderer/core/frame/find_in_page.cc
@@ -37,6 +37,7 @@
 #include "third_party/blink/public/web/web_plugin.h"
 #include "third_party/blink/public/web/web_plugin_document.h"
 #include "third_party/blink/public/web/web_widget_client.h"
+#include "third_party/blink/renderer/core/display_lock/display_lock_document_state.h"
 #include "third_party/blink/renderer/core/editing/finder/text_finder.h"
 #include "third_party/blink/renderer/core/frame/web_local_frame_impl.h"
 #include "third_party/blink/renderer/core/layout/layout_view.h"
@@ -176,8 +177,10 @@ bool FindInPage::FindInternal(int identifier,
   // Unlikely, but just in case we try to find-in-page on a detached frame.
   DCHECK(frame_->GetFrame()->GetPage());
 
-  auto forced_activatable_locks =
-      frame_->GetFrame()->GetDocument()->GetScopedForceActivatableLocks();
+  auto forced_activatable_locks = frame_->GetFrame()
+                                      ->GetDocument()
+                                      ->GetDisplayLockDocumentState()
+                                      .GetScopedForceActivatableLocks();
 
   // Up-to-date, clean tree is required for finding text in page, since it
   // relies on TextIterator to look over the text.
diff --git a/chromium/third_party/blink/renderer/core/frame/fragment_directive.idl b/chromium/third_party/blink/renderer/core/frame/fragment_directive.idl
index 3f91db948fd..ecf07ad5bf8 100644
--- a/chromium/third_party/blink/renderer/core/frame/fragment_directive.idl
+++ b/chromium/third_party/blink/renderer/core/frame/fragment_directive.idl
@@ -3,6 +3,8 @@
 // found in the LICENSE file.
 
 // https://github.com/WICG/ScrollToTextFragment
-[RuntimeEnabled=TextFragmentIdentifiers]
-interface FragmentDirective {
+[
+    Exposed=Window,
+    RuntimeEnabled=TextFragmentIdentifiers
+] interface FragmentDirective {
 };
diff --git a/chromium/third_party/blink/renderer/core/frame/frame.cc b/chromium/third_party/blink/renderer/core/frame/frame.cc
index 4f85a218063..e7f1f74c95a 100644
--- a/chromium/third_party/blink/renderer/core/frame/frame.cc
+++ b/chromium/third_party/blink/renderer/core/frame/frame.cc
@@ -308,6 +308,7 @@ const std::string& Frame::ToTraceValue() {
 Frame::Frame(FrameClient* client,
              Page& page,
              FrameOwner* owner,
+             const base::UnguessableToken& frame_token,
              WindowProxyManager* window_proxy_manager,
              WindowAgentFactory* inheriting_agent_factory)
     : tree_node_(this),
@@ -321,7 +322,8 @@ Frame::Frame(FrameClient* client,
                                 ? inheriting_agent_factory
                                 : MakeGarbageCollected<WindowAgentFactory>()),
       is_loading_(false),
-      devtools_frame_token_(client->GetDevToolsFrameToken()) {
+      devtools_frame_token_(client->GetDevToolsFrameToken()),
+      frame_token_(frame_token) {
   InstanceCounters::IncrementCounter(InstanceCounters::kFrameCounter);
 }
 
diff --git a/chromium/third_party/blink/renderer/core/frame/frame.h b/chromium/third_party/blink/renderer/core/frame/frame.h
index d36fb54eb17..bcf52f149d9 100644
--- a/chromium/third_party/blink/renderer/core/frame/frame.h
+++ b/chromium/third_party/blink/renderer/core/frame/frame.h
@@ -271,6 +271,11 @@ class CORE_EXPORT Frame : public GarbageCollected<Frame> {
     return *window_agent_factory_;
   }
 
+  // This identifier represents the stable identifier between a
+  // LocalFrame  <--> RenderFrameHostImpl or a
+  // RemoteFrame <--> RenderFrameProxyHost in the browser process.
+  const base::UnguessableToken& GetFrameToken() const { return frame_token_; }
+
   bool GetVisibleToHitTesting() const { return visible_to_hit_testing_; }
   void UpdateVisibleToHitTesting();
 
@@ -293,6 +298,7 @@ class CORE_EXPORT Frame : public GarbageCollected<Frame> {
   Frame(FrameClient*,
         Page&,
         FrameOwner*,
+        const base::UnguessableToken& frame_token,
         WindowProxyManager*,
         WindowAgentFactory* inheriting_agent_factory);
 
@@ -377,6 +383,19 @@ class CORE_EXPORT Frame : public GarbageCollected<Frame> {
   // navigation.  This is used in autoplay.
   bool had_sticky_user_activation_before_nav_ = false;
 
+  // This identifier represents the stable identifier between a
+  // LocalFrame  <--> RenderFrameHostImpl or a
+  // RemoteFrame <--> RenderFrameProxyHost in the browser process.
+  // Note that this identifier is unique per render process and
+  // browser relationship. ie. If this is a LocalFrame, RemoteFrames that
+  // represent this frame node in other processes will *not* have the same
+  // identifier. Similarly, if this is a RemoteFrame, the LocalFrame and
+  // other RemoteFrames that represent this frame node in other processes
+  // will *not* have the same identifier. This is different than the
+  // |devtools_frame_token_| in which all representations of this frame node
+  // have the same value in all processes.
+  base::UnguessableToken frame_token_;
+
   // This task is used for the async step in form submission when a form is
   // targeting this frame. http://html.spec.whatwg.org/C/#plan-to-navigate
   // The reason it is stored here is so that it can handle both LocalFrames and
diff --git a/chromium/third_party/blink/renderer/core/frame/frame_console.cc b/chromium/third_party/blink/renderer/core/frame/frame_console.cc
index 25d8991f8dd..9c14e3a9bd1 100644
--- a/chromium/third_party/blink/renderer/core/frame/frame_console.cc
+++ b/chromium/third_party/blink/renderer/core/frame/frame_console.cc
@@ -31,6 +31,7 @@
 #include <memory>
 
 #include "third_party/blink/renderer/bindings/core/v8/source_location.h"
+#include "third_party/blink/renderer/core/frame/local_dom_window.h"
 #include "third_party/blink/renderer/core/frame/local_frame.h"
 #include "third_party/blink/renderer/core/inspector/console_message.h"
 #include "third_party/blink/renderer/core/inspector/console_message_storage.h"
@@ -57,11 +58,10 @@ void FrameConsole::AddMessage(ConsoleMessage* console_message,
 
 bool FrameConsole::AddMessageToStorage(ConsoleMessage* console_message,
                                        bool discard_duplicates) {
-  if (!frame_->GetDocument() || !frame_->GetPage())
+  if (!frame_->DomWindow())
     return false;
   return frame_->GetPage()->GetConsoleMessageStorage().AddConsoleMessage(
-      frame_->GetDocument()->ToExecutionContext(), console_message,
-      discard_duplicates);
+      frame_->DomWindow(), console_message, discard_duplicates);
 }
 
 void FrameConsole::ReportMessageToClient(mojom::ConsoleMessageSource source,
@@ -118,8 +118,10 @@ void FrameConsole::ReportResourceResponseReceived(
 void FrameConsole::DidFailLoading(DocumentLoader* loader,
                                   uint64_t request_identifier,
                                   const ResourceError& error) {
-  if (error.IsCancellation())  // Report failures only.
+  // Report failures only.
+  if (error.IsCancellation() || error.IsTrustTokenCacheHit())
     return;
+
   StringBuilder message;
   message.Append("Failed to load resource");
   if (!error.LocalizedDescription().IsEmpty()) {
diff --git a/chromium/third_party/blink/renderer/core/frame/frame_overlay.cc b/chromium/third_party/blink/renderer/core/frame/frame_overlay.cc
index 058f16d4b5c..79834d7f276 100644
--- a/chromium/third_party/blink/renderer/core/frame/frame_overlay.cc
+++ b/chromium/third_party/blink/renderer/core/frame/frame_overlay.cc
@@ -75,7 +75,9 @@ void FrameOverlay::UpdatePrePaint() {
   }
 
   DCHECK(parent_layer);
-  if (layer_->Parent() != parent_layer)
+  if (layer_->Parent() != parent_layer ||
+      // Keep the layer the last child of parent to make it topmost.
+      parent_layer->Children().back() != layer_.get())
     parent_layer->AddChild(layer_.get());
   layer_->SetLayerState(DefaultPropertyTreeState(), IntPoint());
   layer_->SetSize(gfx::Size(Size()));
diff --git a/chromium/third_party/blink/renderer/core/frame/frame_overlay_test.cc b/chromium/third_party/blink/renderer/core/frame/frame_overlay_test.cc
index 62132d741d5..19d9efcc421 100644
--- a/chromium/third_party/blink/renderer/core/frame/frame_overlay_test.cc
+++ b/chromium/third_party/blink/renderer/core/frame/frame_overlay_test.cc
@@ -14,8 +14,10 @@
 #include "third_party/blink/renderer/core/frame/local_frame_view.h"
 #include "third_party/blink/renderer/core/frame/visual_viewport.h"
 #include "third_party/blink/renderer/core/frame/web_local_frame_impl.h"
+#include "third_party/blink/renderer/core/layout/layout_view.h"
 #include "third_party/blink/renderer/platform/graphics/color.h"
 #include "third_party/blink/renderer/platform/graphics/graphics_context.h"
+#include "third_party/blink/renderer/platform/graphics/graphics_layer.h"
 #include "third_party/blink/renderer/platform/graphics/paint/drawing_recorder.h"
 #include "third_party/blink/renderer/platform/graphics/paint/paint_controller.h"
 #include "third_party/blink/renderer/platform/graphics/paint/paint_controller_test.h"
@@ -162,6 +164,40 @@ TEST_P(FrameOverlayTest, DeviceEmulationScale) {
   }
 }
 
+TEST_P(FrameOverlayTest, LayerOrder) {
+  // This test doesn't apply in CompositeAfterPaint.
+  if (RuntimeEnabledFeatures::CompositeAfterPaintEnabled())
+    return;
+
+  auto frame_overlay1 = CreateSolidYellowOverlay();
+  auto frame_overlay2 = CreateSolidYellowOverlay();
+  frame_overlay1->UpdatePrePaint();
+  frame_overlay2->UpdatePrePaint();
+
+  auto* parent_layer = GetWebView()
+                           ->MainFrameImpl()
+                           ->GetFrameView()
+                           ->GetLayoutView()
+                           ->Compositor()
+                           ->PaintRootGraphicsLayer();
+  ASSERT_EQ(3u, parent_layer->Children().size());
+  EXPECT_EQ(parent_layer, frame_overlay1->GetGraphicsLayer()->Parent());
+  EXPECT_EQ(parent_layer->Children()[1], frame_overlay1->GetGraphicsLayer());
+  EXPECT_EQ(parent_layer, frame_overlay2->GetGraphicsLayer()->Parent());
+  EXPECT_EQ(parent_layer->Children()[2], frame_overlay2->GetGraphicsLayer());
+
+  auto extra_layer = std::make_unique<GraphicsLayer>(parent_layer->Client());
+  parent_layer->AddChild(extra_layer.get());
+
+  frame_overlay1->UpdatePrePaint();
+  frame_overlay2->UpdatePrePaint();
+  ASSERT_EQ(4u, parent_layer->Children().size());
+  EXPECT_EQ(parent_layer, frame_overlay1->GetGraphicsLayer()->Parent());
+  EXPECT_EQ(parent_layer->Children()[2], frame_overlay1->GetGraphicsLayer());
+  EXPECT_EQ(parent_layer, frame_overlay2->GetGraphicsLayer()->Parent());
+  EXPECT_EQ(parent_layer->Children()[3], frame_overlay2->GetGraphicsLayer());
+}
+
 TEST_P(FrameOverlayTest, VisualRect) {
   std::unique_ptr<FrameOverlay> frame_overlay = CreateSolidYellowOverlay();
   frame_overlay->UpdatePrePaint();
diff --git a/chromium/third_party/blink/renderer/core/frame/frame_serializer.cc b/chromium/third_party/blink/renderer/core/frame/frame_serializer.cc
index eabf1e156b3..9b434d7397d 100644
--- a/chromium/third_party/blink/renderer/core/frame/frame_serializer.cc
+++ b/chromium/third_party/blink/renderer/core/frame/frame_serializer.cc
@@ -620,19 +620,8 @@ void FrameSerializer::RetrieveResourcesForCSSValue(const CSSValue& css_value,
     if (font_face_src_value->IsLocal())
       return;
 
-    if (document.ImportsController()) {
-      if (Document* context_document = document.ContextDocument()) {
-        // For @imports from HTML imported Documents, we use the
-        // context document for getting origin and ResourceFetcher to use the
-        // main Document's origin, while using the element document for
-        // CompleteURL() to use imported Documents' base URLs.
-        AddFontToResources(font_face_src_value->Fetch(
-            context_document->ToExecutionContext(), nullptr));
-      }
-    } else {
-      AddFontToResources(
-          font_face_src_value->Fetch(document.ToExecutionContext(), nullptr));
-    }
+    AddFontToResources(
+        font_face_src_value->Fetch(document.GetExecutionContext(), nullptr));
   } else if (const auto* css_value_list = DynamicTo<CSSValueList>(css_value)) {
     for (unsigned i = 0; i < css_value_list->length(); i++)
       RetrieveResourcesForCSSValue(css_value_list->Item(i), document);
diff --git a/chromium/third_party/blink/renderer/core/frame/frame_serializer_test.cc b/chromium/third_party/blink/renderer/core/frame/frame_serializer_test.cc
index 9ba3b657096..00c020825e2 100644
--- a/chromium/third_party/blink/renderer/core/frame/frame_serializer_test.cc
+++ b/chromium/third_party/blink/renderer/core/frame/frame_serializer_test.cc
@@ -100,7 +100,7 @@ class FrameSerializerTest : public testing::Test,
     response.SetHttpStatusCode(status_code);
 
     platform_->GetURLLoaderMockFactory()->RegisterErrorURL(
-        KURL(base_url_, file), response, error);
+        KURL(base_url_, file), response, WebURLError(error));
   }
 
   void RegisterRewriteURL(const char* from_url, const char* to_url) {
diff --git a/chromium/third_party/blink/renderer/core/frame/frame_test_helpers.cc b/chromium/third_party/blink/renderer/core/frame/frame_test_helpers.cc
index e3a9ffc405a..1800471a1a3 100644
--- a/chromium/third_party/blink/renderer/core/frame/frame_test_helpers.cc
+++ b/chromium/third_party/blink/renderer/core/frame/frame_test_helpers.cc
@@ -40,9 +40,11 @@
 #include "cc/trees/layer_tree_host.h"
 #include "cc/trees/layer_tree_settings.h"
 #include "cc/trees/render_frame_metadata_observer.h"
+#include "mojo/public/cpp/bindings/pending_associated_receiver.h"
 #include "mojo/public/cpp/bindings/pending_remote.h"
 #include "third_party/blink/public/common/associated_interfaces/associated_interface_provider.h"
 #include "third_party/blink/public/common/frame/frame_policy.h"
+#include "third_party/blink/public/mojom/frame/tree_scope_type.mojom-blink.h"
 #include "third_party/blink/public/platform/interface_registry.h"
 #include "third_party/blink/public/platform/platform.h"
 #include "third_party/blink/public/platform/web_data.h"
@@ -54,7 +56,6 @@
 #include "third_party/blink/public/web/web_frame_widget.h"
 #include "third_party/blink/public/web/web_navigation_params.h"
 #include "third_party/blink/public/web/web_settings.h"
-#include "third_party/blink/public/web/web_tree_scope_type.h"
 #include "third_party/blink/public/web/web_view_client.h"
 #include "third_party/blink/renderer/core/exported/web_remote_frame_impl.h"
 #include "third_party/blink/renderer/core/frame/web_local_frame_impl.h"
@@ -115,6 +116,15 @@ T* CreateDefaultClientIfNeeded(T* client, std::unique_ptr<T>& owned_client) {
 
 }  // namespace
 
+cc::LayerTreeSettings GetSynchronousSingleThreadLayerTreeSettings() {
+  cc::LayerTreeSettings settings;
+  // Use synchronous compositing so that the MessageLoop becomes idle and the
+  // test makes progress.
+  settings.single_thread_proxy_scheduler = false;
+  settings.use_layer_lists = true;
+  return settings;
+}
+
 void LoadFrameDontWait(WebLocalFrame* frame, const WebURL& url) {
   auto* impl = To<WebLocalFrameImpl>(frame);
   if (url.ProtocolIs("javascript")) {
@@ -206,24 +216,24 @@ WebMouseEvent CreateMouseEvent(WebInputEvent::Type type,
 }
 
 WebLocalFrameImpl* CreateLocalChild(WebLocalFrame& parent,
-                                    WebTreeScopeType scope,
+                                    mojom::blink::TreeScopeType scope,
                                     TestWebFrameClient* client) {
   std::unique_ptr<TestWebFrameClient> owned_client;
   client = CreateDefaultClientIfNeeded(client, owned_client);
-  auto* frame =
-      To<WebLocalFrameImpl>(parent.CreateLocalChild(scope, client, nullptr));
+  auto* frame = To<WebLocalFrameImpl>(parent.CreateLocalChild(
+      scope, client, nullptr, base::UnguessableToken::Create()));
   client->Bind(frame, std::move(owned_client));
   return frame;
 }
 
 WebLocalFrameImpl* CreateLocalChild(
     WebLocalFrame& parent,
-    WebTreeScopeType scope,
+    mojom::blink::TreeScopeType scope,
     std::unique_ptr<TestWebFrameClient> self_owned) {
   DCHECK(self_owned);
   TestWebFrameClient* client = self_owned.get();
-  auto* frame =
-      To<WebLocalFrameImpl>(parent.CreateLocalChild(scope, client, nullptr));
+  auto* frame = To<WebLocalFrameImpl>(parent.CreateLocalChild(
+      scope, client, nullptr, base::UnguessableToken::Create()));
   client->Bind(frame, std::move(self_owned));
   return frame;
 }
@@ -233,37 +243,54 @@ WebLocalFrameImpl* CreateProvisional(WebRemoteFrame& old_frame,
   std::unique_ptr<TestWebFrameClient> owned_client;
   client = CreateDefaultClientIfNeeded(client, owned_client);
   auto* frame = To<WebLocalFrameImpl>(WebLocalFrame::CreateProvisional(
-      client, nullptr, &old_frame, FramePolicy(),
-      WebFrame::ToCoreFrame(old_frame)->Tree().GetName()));
+      client, nullptr, base::UnguessableToken::Create(), &old_frame,
+      FramePolicy(), WebFrame::ToCoreFrame(old_frame)->Tree().GetName()));
   client->Bind(frame, std::move(owned_client));
   std::unique_ptr<TestWebWidgetClient> widget_client;
+
+  mojo::AssociatedRemote<mojom::blink::FrameWidget> frame_widget_remote;
+  mojo::PendingAssociatedReceiver<mojom::blink::FrameWidget>
+      frame_widget_receiver =
+          frame_widget_remote
+              .BindNewEndpointAndPassDedicatedReceiverForTesting();
+
+  mojo::AssociatedRemote<mojom::blink::FrameWidgetHost> frame_widget_host;
+  mojo::PendingAssociatedReceiver<mojom::blink::FrameWidgetHost>
+      frame_widget_host_receiver =
+          frame_widget_host.BindNewEndpointAndPassDedicatedReceiverForTesting();
+
   // Create a local root, if necessary.
   if (!frame->Parent()) {
     widget_client = std::make_unique<TestWebWidgetClient>();
     // TODO(dcheng): The main frame widget currently has a special case.
     // Eliminate this once WebView is no longer a WebWidget.
     WebFrameWidget* frame_widget = WebFrameWidget::CreateForMainFrame(
-        widget_client.get(), frame,
-        CrossVariantMojoAssociatedRemote<mojom::FrameWidgetHostInterfaceBase>(),
-        CrossVariantMojoAssociatedReceiver<mojom::FrameWidgetInterfaceBase>(),
+        widget_client.get(), frame, frame_widget_host.Unbind(),
+        std::move(frame_widget_receiver),
         CrossVariantMojoAssociatedRemote<mojom::WidgetHostInterfaceBase>(),
         CrossVariantMojoAssociatedReceiver<mojom::WidgetInterfaceBase>());
     widget_client->SetFrameWidget(frame_widget);
     // The WebWidget requires the compositor to be set before it is used.
-    frame_widget->SetCompositorHosts(widget_client->layer_tree_host(),
-                                     widget_client->animation_host());
+    widget_client->set_layer_tree_host(frame_widget->InitializeCompositing(
+        widget_client->task_graph_runner(),
+        GetSynchronousSingleThreadLayerTreeSettings(),
+        std::make_unique<cc::TestUkmRecorderFactory>()));
+    frame_widget->SetCompositorVisible(true);
   } else if (frame->Parent()->IsWebRemoteFrame()) {
     widget_client = std::make_unique<TestWebWidgetClient>();
+
     WebFrameWidget* frame_widget = WebFrameWidget::CreateForChildLocalRoot(
-        widget_client.get(), frame,
-        CrossVariantMojoAssociatedRemote<mojom::FrameWidgetHostInterfaceBase>(),
-        CrossVariantMojoAssociatedReceiver<mojom::FrameWidgetInterfaceBase>(),
+        widget_client.get(), frame, frame_widget_host.Unbind(),
+        std::move(frame_widget_receiver),
         CrossVariantMojoAssociatedRemote<mojom::WidgetHostInterfaceBase>(),
         CrossVariantMojoAssociatedReceiver<mojom::WidgetInterfaceBase>());
     widget_client->SetFrameWidget(frame_widget);
     // The WebWidget requires the compositor to be set before it is used.
-    frame_widget->SetCompositorHosts(widget_client->layer_tree_host(),
-                                     widget_client->animation_host());
+    widget_client->set_layer_tree_host(frame_widget->InitializeCompositing(
+        widget_client->task_graph_runner(),
+        GetSynchronousSingleThreadLayerTreeSettings(),
+        std::make_unique<cc::TestUkmRecorderFactory>()));
+    frame_widget->SetCompositorVisible(true);
     frame_widget->Resize(WebSize());
   }
   if (widget_client)
@@ -275,9 +302,10 @@ WebRemoteFrameImpl* CreateRemote(TestWebRemoteFrameClient* client) {
   std::unique_ptr<TestWebRemoteFrameClient> owned_client;
   client = CreateDefaultClientIfNeeded(client, owned_client);
   auto* frame = MakeGarbageCollected<WebRemoteFrameImpl>(
-      WebTreeScopeType::kDocument, client,
+      mojom::blink::TreeScopeType::kDocument, client,
       InterfaceRegistry::GetEmptyInterfaceRegistry(),
-      client->GetAssociatedInterfaceProvider());
+      client->GetAssociatedInterfaceProvider(),
+      base::UnguessableToken::Create());
   client->Bind(frame, std::move(owned_client));
   return frame;
 }
@@ -291,23 +319,39 @@ WebLocalFrameImpl* CreateLocalChild(WebRemoteFrame& parent,
   std::unique_ptr<TestWebFrameClient> owned_client;
   client = CreateDefaultClientIfNeeded(client, owned_client);
   auto* frame = To<WebLocalFrameImpl>(parent.CreateLocalChild(
-      WebTreeScopeType::kDocument, name, FramePolicy(), client, nullptr,
-      previous_sibling, properties, FrameOwnerElementType::kIframe, nullptr));
+      mojom::blink::TreeScopeType::kDocument, name, FramePolicy(), client,
+      nullptr, previous_sibling, properties,
+      mojom::blink::FrameOwnerElementType::kIframe,
+      base::UnguessableToken::Create(), nullptr));
   client->Bind(frame, std::move(owned_client));
 
   std::unique_ptr<TestWebWidgetClient> owned_widget_client;
   widget_client =
       CreateDefaultClientIfNeeded(widget_client, owned_widget_client);
+
+  mojo::AssociatedRemote<mojom::blink::FrameWidget> frame_widget_remote;
+  mojo::PendingAssociatedReceiver<mojom::blink::FrameWidget>
+      frame_widget_receiver =
+          frame_widget_remote
+              .BindNewEndpointAndPassDedicatedReceiverForTesting();
+
+  mojo::AssociatedRemote<mojom::blink::FrameWidgetHost> frame_widget_host;
+  mojo::PendingAssociatedReceiver<mojom::blink::FrameWidgetHost>
+      frame_widget_host_receiver =
+          frame_widget_host.BindNewEndpointAndPassDedicatedReceiverForTesting();
+
   WebFrameWidget* frame_widget = WebFrameWidget::CreateForChildLocalRoot(
-      widget_client, frame,
-      CrossVariantMojoAssociatedRemote<mojom::FrameWidgetHostInterfaceBase>(),
-      CrossVariantMojoAssociatedReceiver<mojom::FrameWidgetInterfaceBase>(),
+      widget_client, frame, frame_widget_host.Unbind(),
+      std::move(frame_widget_receiver),
       CrossVariantMojoAssociatedRemote<mojom::WidgetHostInterfaceBase>(),
       CrossVariantMojoAssociatedReceiver<mojom::WidgetInterfaceBase>());
   // The WebWidget requires the compositor to be set before it is used.
-  frame_widget->SetCompositorHosts(widget_client->layer_tree_host(),
-                                   widget_client->animation_host());
   widget_client->SetFrameWidget(frame_widget);
+  widget_client->set_layer_tree_host(frame_widget->InitializeCompositing(
+      widget_client->task_graph_runner(),
+      GetSynchronousSingleThreadLayerTreeSettings(),
+      std::make_unique<cc::TestUkmRecorderFactory>()));
+  frame_widget->SetCompositorVisible(true);
   // Set an initial size for subframes.
   if (frame->Parent())
     frame_widget->Resize(WebSize());
@@ -323,10 +367,11 @@ WebRemoteFrameImpl* CreateRemoteChild(
   std::unique_ptr<TestWebRemoteFrameClient> owned_client;
   client = CreateDefaultClientIfNeeded(client, owned_client);
   auto* frame = To<WebRemoteFrameImpl>(parent.CreateRemoteChild(
-      WebTreeScopeType::kDocument, name, FramePolicy(),
-      FrameOwnerElementType::kIframe, client,
+      mojom::blink::TreeScopeType::kDocument, name, FramePolicy(),
+      mojom::blink::FrameOwnerElementType::kIframe, client,
       InterfaceRegistry::GetEmptyInterfaceRegistry(),
-      client->GetAssociatedInterfaceProvider(), nullptr));
+      client->GetAssociatedInterfaceProvider(),
+      base::UnguessableToken::Create(), nullptr));
   client->Bind(frame, std::move(owned_client));
   if (!security_origin)
     security_origin = SecurityOrigin::CreateUniqueOpaque();
@@ -358,24 +403,39 @@ WebViewImpl* WebViewHelper::InitializeWithOpener(
   std::unique_ptr<TestWebFrameClient> owned_web_frame_client;
   web_frame_client =
       CreateDefaultClientIfNeeded(web_frame_client, owned_web_frame_client);
-  WebLocalFrame* frame = WebLocalFrame::CreateMainFrame(
-      web_view_, web_frame_client, nullptr, opener);
+  WebLocalFrame* frame =
+      WebLocalFrame::CreateMainFrame(web_view_, web_frame_client, nullptr,
+                                     base::UnguessableToken::Create(), opener);
   web_frame_client->Bind(frame, std::move(owned_web_frame_client));
 
   test_web_widget_client_ = CreateDefaultClientIfNeeded(
       web_widget_client, owned_test_web_widget_client_);
+
+  mojo::AssociatedRemote<mojom::blink::FrameWidget> frame_widget;
+  mojo::PendingAssociatedReceiver<mojom::blink::FrameWidget>
+      frame_widget_receiver =
+          frame_widget.BindNewEndpointAndPassDedicatedReceiverForTesting();
+
+  mojo::AssociatedRemote<mojom::blink::FrameWidgetHost> frame_widget_host;
+  mojo::PendingAssociatedReceiver<mojom::blink::FrameWidgetHost>
+      frame_widget_host_receiver =
+          frame_widget_host.BindNewEndpointAndPassDedicatedReceiverForTesting();
+
   // TODO(dcheng): The main frame widget currently has a special case.
   // Eliminate this once WebView is no longer a WebWidget.
   WebFrameWidget* widget = blink::WebFrameWidget::CreateForMainFrame(
-      test_web_widget_client_, frame,
-      CrossVariantMojoAssociatedRemote<mojom::FrameWidgetHostInterfaceBase>(),
-      CrossVariantMojoAssociatedReceiver<mojom::FrameWidgetInterfaceBase>(),
+      test_web_widget_client_, frame, frame_widget_host.Unbind(),
+      std::move(frame_widget_receiver),
       CrossVariantMojoAssociatedRemote<mojom::WidgetHostInterfaceBase>(),
       CrossVariantMojoAssociatedReceiver<mojom::WidgetInterfaceBase>());
   // The WebWidget requires the compositor to be set before it is used.
-  widget->SetCompositorHosts(test_web_widget_client_->layer_tree_host(),
-                             test_web_widget_client_->animation_host());
   test_web_widget_client_->SetFrameWidget(widget);
+  test_web_widget_client_->set_layer_tree_host(widget->InitializeCompositing(
+      test_web_widget_client_->task_graph_runner(),
+      GetSynchronousSingleThreadLayerTreeSettings(),
+      std::make_unique<cc::TestUkmRecorderFactory>()));
+  widget->SetCompositorVisible(true);
+
   // We inform the WebView when it has a local main frame attached once the
   // WebFrame it fully set up and the WebWidgetClient is initialized (which is
   // the case by this point).
@@ -445,7 +505,8 @@ WebViewImpl* WebViewHelper::InitializeRemoteWithOpener(
   WebRemoteFrameImpl* frame = WebRemoteFrameImpl::CreateMainFrame(
       web_view_, web_remote_frame_client,
       InterfaceRegistry::GetEmptyInterfaceRegistry(),
-      web_remote_frame_client->GetAssociatedInterfaceProvider(), opener);
+      web_remote_frame_client->GetAssociatedInterfaceProvider(),
+      base::UnguessableToken::Create(), opener);
   web_remote_frame_client->Bind(frame,
                                 std::move(owned_web_remote_frame_client));
   if (!security_origin)
@@ -495,11 +556,10 @@ void WebViewHelper::InitializeWebView(TestWebViewClient* web_view_client,
                                       class WebView* opener) {
   test_web_view_client_ =
       CreateDefaultClientIfNeeded(web_view_client, owned_test_web_view_client_);
-  web_view_ = static_cast<WebViewImpl*>(
-      WebView::Create(test_web_view_client_,
-                      /*is_hidden=*/false,
-                      /*compositing_enabled=*/true, opener,
-                      mojo::ScopedInterfaceEndpointHandle()));
+  web_view_ = static_cast<WebViewImpl*>(WebView::Create(
+      test_web_view_client_,
+      /*is_hidden=*/false,
+      /*compositing_enabled=*/true, opener, mojo::NullAssociatedReceiver()));
   // This property must be set at initialization time, it is not supported to be
   // changed afterward, and does nothing.
   web_view_->GetSettings()->SetViewportEnabled(viewport_enabled_);
@@ -557,12 +617,12 @@ void TestWebFrameClient::FrameDetached(DetachType type) {
 
 WebLocalFrame* TestWebFrameClient::CreateChildFrame(
     WebLocalFrame* parent,
-    WebTreeScopeType scope,
+    mojom::blink::TreeScopeType scope,
     const WebString& name,
     const WebString& fallback_name,
     const FramePolicy&,
     const WebFrameOwnerProperties& frame_owner_properties,
-    FrameOwnerElementType owner_type) {
+    mojom::blink::FrameOwnerElementType owner_type) {
   return CreateLocalChild(*parent, scope);
 }
 
@@ -649,28 +709,7 @@ void TestWebRemoteFrameClient::FrameDetached(DetachType type) {
   self_owned_.reset();
 }
 
-content::LayerTreeView* LayerTreeViewFactory::Initialize(
-    content::LayerTreeViewDelegate* specified_delegate) {
-  cc::LayerTreeSettings settings;
-  // Use synchronous compositing so that the MessageLoop becomes idle and the
-  // test makes progress.
-  settings.single_thread_proxy_scheduler = false;
-  settings.use_layer_lists = true;
-
-  layer_tree_view_ = std::make_unique<content::LayerTreeView>(
-      specified_delegate, Thread::Current()->GetTaskRunner(),
-      /*compositor_thread=*/nullptr, &test_task_graph_runner_,
-      &fake_thread_scheduler_);
-  layer_tree_view_->Initialize(settings,
-                               std::make_unique<cc::TestUkmRecorderFactory>());
-  layer_tree_view_->SetVisible(true);
-  return layer_tree_view_.get();
-}
-
-TestWebWidgetClient::TestWebWidgetClient() {
-  layer_tree_view_ = layer_tree_view_factory_.Initialize(this);
-  animation_host_ = layer_tree_view_->animation_host();
-}
+TestWebWidgetClient::TestWebWidgetClient() = default;
 
 void TestWebWidgetClient::SetFrameWidget(WebFrameWidget* widget) {
   frame_widget_ = widget;
@@ -719,23 +758,6 @@ viz::FrameSinkId TestWebWidgetClient::GetFrameSinkId() {
   return viz::FrameSinkId();
 }
 
-void TestWebWidgetClient::BeginMainFrame(base::TimeTicks frame_time) {
-  frame_widget_->BeginFrame(frame_time);
-}
-
-void TestWebWidgetClient::DidBeginMainFrame() {
-  frame_widget_->DidBeginFrame();
-}
-
-void TestWebWidgetClient::UpdateVisualState() {
-  frame_widget_->UpdateVisualState();
-}
-
-void TestWebWidgetClient::ApplyViewportChanges(
-    const ApplyViewportChangesArgs& args) {
-  frame_widget_->ApplyViewportChanges(args);
-}
-
 void TestWebWidgetClient::RequestNewLayerTreeFrameSink(
     LayerTreeFrameSinkCallback callback) {
   // Make a valid LayerTreeFrameSink so the compositor will generate begin main
@@ -752,7 +774,7 @@ WebView* TestWebViewClient::CreateView(WebLocalFrame* opener,
                                        const WebWindowFeatures&,
                                        const WebString& name,
                                        WebNavigationPolicy,
-                                       mojom::blink::WebSandboxFlags,
+                                       network::mojom::blink::WebSandboxFlags,
                                        const FeaturePolicy::FeatureState&,
                                        const SessionStorageNamespaceId&) {
   auto webview_helper = std::make_unique<WebViewHelper>();
diff --git a/chromium/third_party/blink/renderer/core/frame/frame_test_helpers.h b/chromium/third_party/blink/renderer/core/frame/frame_test_helpers.h
index 35504d96582..dc312fbf279 100644
--- a/chromium/third_party/blink/renderer/core/frame/frame_test_helpers.h
+++ b/chromium/third_party/blink/renderer/core/frame/frame_test_helpers.h
@@ -40,11 +40,10 @@
 #include "base/memory/weak_ptr.h"
 #include "cc/test/test_task_graph_runner.h"
 #include "cc/trees/layer_tree_host.h"
-#include "content/renderer/compositor/layer_tree_view.h"
-#include "content/test/stub_layer_tree_view_delegate.h"
-#include "third_party/blink/public/common/frame/frame_owner_element_type.h"
 #include "third_party/blink/public/common/input/web_mouse_event.h"
 #include "third_party/blink/public/mojom/fetch/fetch_api_request.mojom-blink-forward.h"
+#include "third_party/blink/public/mojom/frame/frame_owner_element_type.mojom-blink.h"
+#include "third_party/blink/public/mojom/frame/tree_scope_type.mojom-blink.h"
 #include "third_party/blink/public/platform/platform.h"
 #include "third_party/blink/public/platform/scheduler/test/web_fake_thread_scheduler.h"
 #include "third_party/blink/public/platform/web_string.h"
@@ -87,10 +86,6 @@ namespace base {
 class TickClock;
 }
 
-namespace cc {
-class AnimationHost;
-}
-
 namespace blink {
 class WebFrame;
 class WebLocalFrameImpl;
@@ -105,6 +100,8 @@ class TestWebWidgetClient;
 class TestWebViewClient;
 class WebViewHelper;
 
+cc::LayerTreeSettings GetSynchronousSingleThreadLayerTreeSettings();
+
 // Loads a url into the specified WebLocalFrame for testing purposes.
 void LoadFrameDontWait(WebLocalFrame*, const WebURL& url);
 // Same as above, but also pumps any pending resource requests,
@@ -143,14 +140,14 @@ WebMouseEvent CreateMouseEvent(WebInputEvent::Type,
 
 // Helper for creating a local child frame of a local parent frame.
 WebLocalFrameImpl* CreateLocalChild(WebLocalFrame& parent,
-                                    WebTreeScopeType,
+                                    blink::mojom::blink::TreeScopeType,
                                     TestWebFrameClient* = nullptr);
 
 // Similar, but unlike the overload which takes the client as a raw pointer,
 // ownership of the TestWebFrameClient is transferred to the test framework.
 // TestWebFrameClient may not be null.
 WebLocalFrameImpl* CreateLocalChild(WebLocalFrame& parent,
-                                    WebTreeScopeType,
+                                    blink::mojom::blink::TreeScopeType,
                                     std::unique_ptr<TestWebFrameClient>);
 
 // Helper for creating a provisional local frame that can replace a remote
@@ -179,21 +176,6 @@ WebRemoteFrameImpl* CreateRemoteChild(WebRemoteFrame& parent,
                                       scoped_refptr<SecurityOrigin> = nullptr,
                                       TestWebRemoteFrameClient* = nullptr);
 
-// A class that constructs and owns a LayerTreeView for blink
-// unit tests.
-class LayerTreeViewFactory {
-  DISALLOW_NEW();
-
- public:
-  // Use this to specify a delegate instead of using a stub.
-  content::LayerTreeView* Initialize(content::LayerTreeViewDelegate*);
-
- private:
-  cc::TestTaskGraphRunner test_task_graph_runner_;
-  blink::scheduler::WebFakeThreadScheduler fake_thread_scheduler_;
-  std::unique_ptr<content::LayerTreeView> layer_tree_view_;
-};
-
 struct InjectedScrollGestureData {
   gfx::Vector2dF delta;
   ScrollGranularity granularity;
@@ -201,8 +183,7 @@ struct InjectedScrollGestureData {
   WebInputEvent::Type type;
 };
 
-class TestWebWidgetClient : public WebWidgetClient,
-                            public content::StubLayerTreeViewDelegate {
+class TestWebWidgetClient : public WebWidgetClient {
  public:
   TestWebWidgetClient();
   ~TestWebWidgetClient() override = default;
@@ -211,27 +192,8 @@ class TestWebWidgetClient : public WebWidgetClient,
   // before usage of this class occurs.
   void SetFrameWidget(WebFrameWidget* widget);
 
-  // WebWidgetClient implementation.
-  void ScheduleAnimation() override { animation_scheduled_ = true; }
-  void SetPageScaleStateAndLimits(float page_scale_factor,
-                                  bool is_pinch_gesture_active,
-                                  float minimum,
-                                  float maximum) override;
-  void InjectGestureScrollEvent(WebGestureDevice device,
-                                const gfx::Vector2dF& delta,
-                                ScrollGranularity granularity,
-                                cc::ElementId scrollable_area_element_id,
-                                WebInputEvent::Type injected_type) override;
-  void DidMeaningfulLayout(WebMeaningfulLayout) override;
-  viz::FrameSinkId GetFrameSinkId() override;
-
-  cc::LayerTreeHost* layer_tree_host() {
-    return layer_tree_view_->layer_tree_host();
-  }
-  const cc::LayerTreeHost* layer_tree_host() const {
-    return layer_tree_view_->layer_tree_host();
-  }
-  cc::AnimationHost* animation_host() { return animation_host_; }
+  cc::LayerTreeHost* layer_tree_host() { return layer_tree_host_; }
+  const cc::LayerTreeHost* layer_tree_host() const { return layer_tree_host_; }
 
   bool AnimationScheduled() const { return animation_scheduled_; }
   void ClearAnimationScheduled() { animation_scheduled_ = false; }
@@ -252,20 +214,34 @@ class TestWebWidgetClient : public WebWidgetClient,
     return injected_scroll_gesture_data_;
   }
 
+  cc::TaskGraphRunner* task_graph_runner() { return &test_task_graph_runner_; }
+
+  void set_layer_tree_host(cc::LayerTreeHost* layer_tree_host) {
+    layer_tree_host_ = layer_tree_host;
+  }
+
  protected:
-  // LayerTreeViewDelegate implementation.
-  void BeginMainFrame(base::TimeTicks frame_time) override;
-  void DidBeginMainFrame() override;
-  void UpdateVisualState() override;
-  void ApplyViewportChanges(const ApplyViewportChangesArgs& args) override;
+  // WebWidgetClient overrides;
+  void ScheduleAnimation() override { animation_scheduled_ = true; }
+  void SetPageScaleStateAndLimits(float page_scale_factor,
+                                  bool is_pinch_gesture_active,
+                                  float minimum,
+                                  float maximum) override;
+  void InjectGestureScrollEvent(WebGestureDevice device,
+                                const gfx::Vector2dF& delta,
+                                ScrollGranularity granularity,
+                                cc::ElementId scrollable_area_element_id,
+                                WebInputEvent::Type injected_type) override;
+  void DidMeaningfulLayout(WebMeaningfulLayout) override;
+  viz::FrameSinkId GetFrameSinkId() override;
   void RequestNewLayerTreeFrameSink(
       LayerTreeFrameSinkCallback callback) override;
 
  private:
   WebFrameWidget* frame_widget_ = nullptr;
-  content::LayerTreeView* layer_tree_view_ = nullptr;
-  cc::AnimationHost* animation_host_ = nullptr;
-  LayerTreeViewFactory layer_tree_view_factory_;
+  cc::LayerTreeHost* layer_tree_host_ = nullptr;
+  cc::TestTaskGraphRunner test_task_graph_runner_;
+  blink::scheduler::WebFakeThreadScheduler fake_thread_scheduler_;
   Vector<InjectedScrollGestureData> injected_scroll_gesture_data_;
   bool animation_scheduled_ = false;
   int visually_non_empty_layout_count_ = 0;
@@ -288,12 +264,11 @@ class TestWebViewClient : public WebViewClient {
                       const WebWindowFeatures&,
                       const WebString& name,
                       WebNavigationPolicy,
-                      mojom::blink::WebSandboxFlags,
+                      network::mojom::blink::WebSandboxFlags,
                       const FeaturePolicy::FeatureState&,
                       const SessionStorageNamespaceId&) override;
 
  private:
-  LayerTreeViewFactory layer_tree_view_factory_;
   WTF::Vector<std::unique_ptr<WebViewHelper>> child_web_views_;
 };
 
@@ -424,12 +399,12 @@ class TestWebFrameClient : public WebLocalFrameClient {
   // WebLocalFrameClient:
   void FrameDetached(DetachType) override;
   WebLocalFrame* CreateChildFrame(WebLocalFrame* parent,
-                                  WebTreeScopeType,
+                                  blink::mojom::blink::TreeScopeType,
                                   const WebString& name,
                                   const WebString& fallback_name,
                                   const FramePolicy&,
                                   const WebFrameOwnerProperties&,
-                                  FrameOwnerElementType) override;
+                                  mojom::blink::FrameOwnerElementType) override;
   void DidStartLoading() override;
   void DidStopLoading() override;
   std::unique_ptr<blink::WebURLLoaderFactory> CreateURLLoaderFactory()
diff --git a/chromium/third_party/blink/renderer/core/frame/history.cc b/chromium/third_party/blink/renderer/core/frame/history.cc
index 8a9110005b6..e21cc0f38a8 100644
--- a/chromium/third_party/blink/renderer/core/frame/history.cc
+++ b/chromium/third_party/blink/renderer/core/frame/history.cc
@@ -25,9 +25,13 @@
 
 #include "third_party/blink/renderer/core/frame/history.h"
 
+#include "third_party/blink/public/common/privacy_budget/identifiability_metric_builder.h"
+#include "third_party/blink/public/common/privacy_budget/identifiability_metrics.h"
+#include "third_party/blink/public/mojom/web_feature/web_feature.mojom-shared.h"
 #include "third_party/blink/renderer/core/dom/document.h"
 #include "third_party/blink/renderer/core/execution_context/execution_context.h"
 #include "third_party/blink/renderer/core/frame/frame_console.h"
+#include "third_party/blink/renderer/core/frame/local_dom_window.h"
 #include "third_party/blink/renderer/core/frame/local_frame.h"
 #include "third_party/blink/renderer/core/frame/local_frame_client.h"
 #include "third_party/blink/renderer/core/frame/settings.h"
@@ -61,11 +65,11 @@ bool EqualIgnoringQueryAndFragment(const KURL& a, const KURL& b) {
 }  // namespace
 
 History::History(LocalFrame* frame)
-    : DOMWindowClient(frame), last_state_object_requested_(nullptr) {}
+    : ExecutionContextClient(frame), last_state_object_requested_(nullptr) {}
 
 void History::Trace(Visitor* visitor) {
   ScriptWrappable::Trace(visitor);
-  DOMWindowClient::Trace(visitor);
+  ExecutionContextClient::Trace(visitor);
 }
 
 unsigned History::length(ExceptionState& exception_state) const {
@@ -75,22 +79,52 @@ unsigned History::length(ExceptionState& exception_state) const {
         "fully active");
     return 0;
   }
-  return GetFrame()->Client()->BackForwardLength();
+
+  unsigned result = GetFrame()->Client()->BackForwardLength();
+  Document* document = DomWindow()->document();
+  IdentifiabilityMetricBuilder(document->UkmSourceID())
+      .SetWebfeature(WebFeature::kHistoryLength,
+                     IdentifiabilityDigestHelper(result))
+      .Record(document->UkmRecorder());
+  return result;
 }
 
-ScriptValue History::state(v8::Isolate* isolate,
+ScriptValue History::state(ScriptState* script_state,
                            ExceptionState& exception_state) {
+  v8::Isolate* isolate = script_state->GetIsolate();
+  static const V8PrivateProperty::SymbolKey kHistoryStatePrivateProperty;
+  auto private_prop =
+      V8PrivateProperty::GetSymbol(isolate, kHistoryStatePrivateProperty);
+  v8::Local<v8::Object> v8_history = ToV8(this, script_state).As<v8::Object>();
+  v8::Local<v8::Value> v8_state;
+
+  // Returns the same V8 value unless the history gets updated.  This
+  // implementation is mostly the same as the one of [CachedAttribute], but
+  // it's placed in this function rather than in Blink-V8 bindings layer so
+  // that PopStateEvent.state can also access the same V8 value.
+  scoped_refptr<SerializedScriptValue> current_state = StateInternal();
+  if (last_state_object_requested_ == current_state) {
+    if (!private_prop.GetOrUndefined(v8_history).ToLocal(&v8_state))
+      return ScriptValue::CreateNull(isolate);
+    if (!v8_state->IsUndefined())
+      return ScriptValue(isolate, v8_state);
+  }
+
   if (!GetFrame()) {
     exception_state.ThrowSecurityError(
-        "May not use a History object associated with a Document that is not "
-        "fully active");
-    return ScriptValue::CreateNull(isolate);
+        "May not use a History object associated with a Document that is "
+        "not fully active");
+    v8_state = v8::Null(isolate);
+  } else if (!current_state) {
+    v8_state = v8::Null(isolate);
+  } else {
+    ScriptState::EscapableScope target_context_scope(script_state);
+    v8_state = target_context_scope.Escape(current_state->Deserialize(isolate));
   }
-  last_state_object_requested_ = StateInternal();
-  if (!last_state_object_requested_)
-    return ScriptValue::CreateNull(isolate);
-  return ScriptValue(isolate,
-                     last_state_object_requested_->Deserialize(isolate));
+
+  last_state_object_requested_ = current_state;
+  private_prop.Set(v8_history, v8_state);
+  return ScriptValue(isolate, v8_state);
 }
 
 SerializedScriptValue* History::StateInternal() const {
@@ -156,10 +190,6 @@ HistoryScrollRestorationType History::ScrollRestorationInternal() const {
   return history_item->ScrollRestorationType();
 }
 
-bool History::stateChanged() const {
-  return last_state_object_requested_ != StateInternal();
-}
-
 bool History::IsSameAsCurrentState(SerializedScriptValue* state) const {
   return state == StateInternal();
 }
@@ -184,14 +214,13 @@ void History::go(ScriptState* script_state,
   }
 
   DCHECK(IsMainThread());
-  Document* active_document =
-      Document::From(ExecutionContext::From(script_state));
-  if (!active_document)
+  auto* active_window = LocalDOMWindow::From(script_state);
+  if (!active_window)
     return;
 
-  if (!active_document->GetFrame() ||
-      !active_document->GetFrame()->CanNavigate(*GetFrame()) ||
-      !active_document->GetFrame()->IsNavigationAllowed() ||
+  if (!active_window->GetFrame() ||
+      !active_window->GetFrame()->CanNavigate(*GetFrame()) ||
+      !active_window->GetFrame()->IsNavigationAllowed() ||
       !GetFrame()->IsNavigationAllowed()) {
     return;
   }
diff --git a/chromium/third_party/blink/renderer/core/frame/history.h b/chromium/third_party/blink/renderer/core/frame/history.h
index a08a0f66f40..8621718a727 100644
--- a/chromium/third_party/blink/renderer/core/frame/history.h
+++ b/chromium/third_party/blink/renderer/core/frame/history.h
@@ -45,7 +45,7 @@ class ScriptState;
 
 // This class corresponds to the History interface.
 class CORE_EXPORT History final : public ScriptWrappable,
-                                  public DOMWindowClient {
+                                  public ExecutionContextClient {
   DEFINE_WRAPPERTYPEINFO();
   USING_GARBAGE_COLLECTED_MIXIN(History);
 
@@ -53,7 +53,7 @@ class CORE_EXPORT History final : public ScriptWrappable,
   explicit History(LocalFrame*);
 
   unsigned length(ExceptionState&) const;
-  ScriptValue state(v8::Isolate*, ExceptionState&);
+  ScriptValue state(ScriptState*, ExceptionState&);
 
   void back(ScriptState*, ExceptionState&);
   void forward(ScriptState*, ExceptionState&);
@@ -74,7 +74,6 @@ class CORE_EXPORT History final : public ScriptWrappable,
   void setScrollRestoration(const String& value, ExceptionState&);
   String scrollRestoration(ExceptionState&);
 
-  bool stateChanged() const;
   bool IsSameAsCurrentState(SerializedScriptValue*) const;
 
   void Trace(Visitor*) override;
diff --git a/chromium/third_party/blink/renderer/core/frame/history.idl b/chromium/third_party/blink/renderer/core/frame/history.idl
index a2b8ebd6d6a..7bf5beeb13e 100644
--- a/chromium/third_party/blink/renderer/core/frame/history.idl
+++ b/chromium/third_party/blink/renderer/core/frame/history.idl
@@ -32,7 +32,7 @@ enum ScrollRestoration {"auto", "manual"};
 ] interface History {
     [MeasureAs=HistoryLength, RaisesException] readonly attribute unsigned long length;
     [Measure, RaisesException] attribute ScrollRestoration scrollRestoration;
-    [CachedAttribute=stateChanged, CallWith=Isolate, RaisesException] readonly attribute any state;
+    [CallWith=ScriptState, RaisesException] readonly attribute any state;
     [CallWith=ScriptState, RaisesException] void go(optional long delta = 0);
     [CallWith=ScriptState, RaisesException] void back();
     [CallWith=ScriptState, RaisesException] void forward();
diff --git a/chromium/third_party/blink/renderer/core/frame/intervention.cc b/chromium/third_party/blink/renderer/core/frame/intervention.cc
index e7737916d6b..3cd1a539d59 100644
--- a/chromium/third_party/blink/renderer/core/frame/intervention.cc
+++ b/chromium/third_party/blink/renderer/core/frame/intervention.cc
@@ -8,6 +8,7 @@
 #include "third_party/blink/public/platform/platform.h"
 #include "third_party/blink/renderer/core/frame/frame_console.h"
 #include "third_party/blink/renderer/core/frame/intervention_report_body.h"
+#include "third_party/blink/renderer/core/frame/local_dom_window.h"
 #include "third_party/blink/renderer/core/frame/local_frame.h"
 #include "third_party/blink/renderer/core/frame/local_frame_client.h"
 #include "third_party/blink/renderer/core/frame/report.h"
@@ -21,27 +22,24 @@ namespace blink {
 void Intervention::GenerateReport(const LocalFrame* frame,
                                   const String& id,
                                   const String& message) {
-  if (!frame)
+  if (!frame || !frame->Client())
     return;
 
   // Send the message to the console.
-  Document* document = frame->GetDocument();
-  document->AddConsoleMessage(MakeGarbageCollected<ConsoleMessage>(
+  auto* window = frame->DomWindow();
+  window->AddConsoleMessage(MakeGarbageCollected<ConsoleMessage>(
       mojom::ConsoleMessageSource::kIntervention,
       mojom::ConsoleMessageLevel::kError, message));
 
-  if (!frame->Client())
-    return;
-
   // Construct the intervention report.
   InterventionReportBody* body =
       MakeGarbageCollected<InterventionReportBody>(id, message);
   Report* report = MakeGarbageCollected<Report>(
-      ReportType::kIntervention, document->Url().GetString(), body);
+      ReportType::kIntervention, window->document()->Url().GetString(), body);
 
   // Send the intervention report to the Reporting API and any
   // ReportingObservers.
-  ReportingContext::From(document->ToExecutionContext())->QueueReport(report);
+  ReportingContext::From(window)->QueueReport(report);
 }
 
 }  // namespace blink
diff --git a/chromium/third_party/blink/renderer/core/frame/is_input_pending_options.cc b/chromium/third_party/blink/renderer/core/frame/is_input_pending_options.cc
new file mode 100644
index 00000000000..b091c57fbc2
--- /dev/null
+++ b/chromium/third_party/blink/renderer/core/frame/is_input_pending_options.cc
@@ -0,0 +1,20 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "third_party/blink/renderer/core/frame/is_input_pending_options.h"
+
+#include "third_party/blink/renderer/bindings/core/v8/v8_is_input_pending_options_init.h"
+
+namespace blink {
+
+IsInputPendingOptions* IsInputPendingOptions::Create(
+    const IsInputPendingOptionsInit* options_init) {
+  return MakeGarbageCollected<IsInputPendingOptions>(
+      options_init->includeContinuous());
+}
+
+IsInputPendingOptions::IsInputPendingOptions(bool include_continuous)
+    : include_continuous_(include_continuous) {}
+
+}  // namespace blink
diff --git a/chromium/third_party/blink/renderer/core/frame/is_input_pending_options.h b/chromium/third_party/blink/renderer/core/frame/is_input_pending_options.h
new file mode 100644
index 00000000000..f7036d83b1e
--- /dev/null
+++ b/chromium/third_party/blink/renderer/core/frame/is_input_pending_options.h
@@ -0,0 +1,34 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef THIRD_PARTY_BLINK_RENDERER_CORE_FRAME_IS_INPUT_PENDING_OPTIONS_H_
+#define THIRD_PARTY_BLINK_RENDERER_CORE_FRAME_IS_INPUT_PENDING_OPTIONS_H_
+
+#include "third_party/blink/renderer/platform/bindings/script_wrappable.h"
+
+namespace blink {
+
+class IsInputPendingOptionsInit;
+
+class IsInputPendingOptions : public ScriptWrappable {
+  DEFINE_WRAPPERTYPEINFO();
+
+ public:
+  static IsInputPendingOptions* Create(
+      const IsInputPendingOptionsInit* options_init);
+
+  explicit IsInputPendingOptions(bool include_continuous);
+
+  bool includeContinuous() const { return include_continuous_; }
+  void setIncludeContinuous(bool include_continuous) {
+    include_continuous_ = include_continuous;
+  }
+
+ private:
+  bool include_continuous_;
+};
+
+}  // namespace blink
+
+#endif  // THIRD_PARTY_BLINK_RENDERER_CORE_FRAME_IS_INPUT_PENDING_OPTIONS_H_
diff --git a/chromium/third_party/blink/renderer/core/frame/is_input_pending_options.idl b/chromium/third_party/blink/renderer/core/frame/is_input_pending_options.idl
new file mode 100644
index 00000000000..48423d12b50
--- /dev/null
+++ b/chromium/third_party/blink/renderer/core/frame/is_input_pending_options.idl
@@ -0,0 +1,12 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// https://github.com/WICG/is-input-pending
+[
+    Exposed=Window,
+    RuntimeEnabled=ExperimentalIsInputPending
+] interface IsInputPendingOptions {
+    constructor(optional IsInputPendingOptionsInit options = {});
+    attribute boolean includeContinuous;
+};
diff --git a/chromium/third_party/blink/renderer/core/frame/is_input_pending_options_init.idl b/chromium/third_party/blink/renderer/core/frame/is_input_pending_options_init.idl
new file mode 100644
index 00000000000..a818a1791e7
--- /dev/null
+++ b/chromium/third_party/blink/renderer/core/frame/is_input_pending_options_init.idl
@@ -0,0 +1,8 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// https://github.com/WICG/is-input-pending
+dictionary IsInputPendingOptionsInit {
+  boolean includeContinuous = false;
+};
diff --git a/chromium/third_party/blink/renderer/core/frame/local_dom_window.cc b/chromium/third_party/blink/renderer/core/frame/local_dom_window.cc
index 558e2a8b2da..41cbe27f5e2 100644
--- a/chromium/third_party/blink/renderer/core/frame/local_dom_window.cc
+++ b/chromium/third_party/blink/renderer/core/frame/local_dom_window.cc
@@ -30,7 +30,9 @@
 #include <utility>
 
 #include "cc/input/snap_selection_strategy.h"
+#include "net/base/registry_controlled_domains/registry_controlled_domain.h"
 #include "third_party/blink/public/common/browser_interface_broker_proxy.h"
+#include "third_party/blink/public/mojom/feature_policy/policy_disposition.mojom-blink.h"
 #include "third_party/blink/public/platform/platform.h"
 #include "third_party/blink/public/platform/task_type.h"
 #include "third_party/blink/public/platform/web_screen_info.h"
@@ -60,6 +62,9 @@
 #include "third_party/blink/renderer/core/dom/scripted_idle_task_controller.h"
 #include "third_party/blink/renderer/core/editing/editor.h"
 #include "third_party/blink/renderer/core/editing/frame_selection.h"
+#include "third_party/blink/renderer/core/editing/ime/input_method_controller.h"
+#include "third_party/blink/renderer/core/editing/spellcheck/spell_checker.h"
+#include "third_party/blink/renderer/core/editing/suggestion/text_suggestion_controller.h"
 #include "third_party/blink/renderer/core/events/hash_change_event.h"
 #include "third_party/blink/renderer/core/events/message_event.h"
 #include "third_party/blink/renderer/core/events/pop_state_event.h"
@@ -68,16 +73,19 @@
 #include "third_party/blink/renderer/core/execution_context/window_agent.h"
 #include "third_party/blink/renderer/core/frame/bar_prop.h"
 #include "third_party/blink/renderer/core/frame/csp/content_security_policy.h"
+#include "third_party/blink/renderer/core/frame/document_policy_violation_report_body.h"
 #include "third_party/blink/renderer/core/frame/dom_visual_viewport.h"
 #include "third_party/blink/renderer/core/frame/event_handler_registry.h"
 #include "third_party/blink/renderer/core/frame/external.h"
+#include "third_party/blink/renderer/core/frame/feature_policy_violation_report_body.h"
 #include "third_party/blink/renderer/core/frame/frame_console.h"
 #include "third_party/blink/renderer/core/frame/history.h"
 #include "third_party/blink/renderer/core/frame/local_frame.h"
 #include "third_party/blink/renderer/core/frame/local_frame_client.h"
 #include "third_party/blink/renderer/core/frame/local_frame_view.h"
 #include "third_party/blink/renderer/core/frame/navigator.h"
-#include "third_party/blink/renderer/core/frame/sandbox_flags.h"
+#include "third_party/blink/renderer/core/frame/report.h"
+#include "third_party/blink/renderer/core/frame/reporting_context.h"
 #include "third_party/blink/renderer/core/frame/screen.h"
 #include "third_party/blink/renderer/core/frame/settings.h"
 #include "third_party/blink/renderer/core/frame/viewport_data.h"
@@ -226,7 +234,12 @@ LocalDOMWindow::LocalDOMWindow(LocalFrame& frame)
       unused_preloads_timer_(frame.GetTaskRunner(TaskType::kInternalDefault),
                              this,
                              &LocalDOMWindow::WarnUnusedPreloads),
-      should_print_when_finished_loading_(false) {}
+      should_print_when_finished_loading_(false),
+      input_method_controller_(
+          MakeGarbageCollected<InputMethodController>(*this, frame)),
+      spell_checker_(MakeGarbageCollected<SpellChecker>(*this)),
+      text_suggestion_controller_(
+          MakeGarbageCollected<TextSuggestionController>(*this)) {}
 
 void LocalDOMWindow::ClearDocument() {
   if (!document_)
@@ -254,18 +267,18 @@ TrustedTypePolicyFactory* LocalDOMWindow::trustedTypes() const {
   return trusted_types_.Get();
 }
 
-Document* LocalDOMWindow::CreateDocument(const DocumentInit& init,
-                                         bool force_xhtml) {
-  Document* document = nullptr;
-  if (force_xhtml) {
-    // This is a hack for XSLTProcessor. See
-    // XSLTProcessor::createDocumentFromSource().
-    document = MakeGarbageCollected<Document>(init);
-  } else {
-    document = DOMImplementation::createDocument(init);
-  }
-
-  return document;
+bool LocalDOMWindow::IsCrossSiteSubframe() const {
+  if (!GetFrame())
+    return false;
+  // It'd be nice to avoid the url::Origin temporaries, but that would require
+  // exposing the net internal helper.
+  // TODO: If the helper gets exposed, we could do this without any new
+  // allocations using StringUTF8Adaptor.
+  auto* top_origin =
+      GetFrame()->Tree().Top().GetSecurityContext()->GetSecurityOrigin();
+  return !net::registry_controlled_domains::SameDomainOrHost(
+      top_origin->ToUrlOrigin(), GetSecurityOrigin()->ToUrlOrigin(),
+      net::registry_controlled_domains::INCLUDE_PRIVATE_REGISTRIES);
 }
 
 LocalDOMWindow* LocalDOMWindow::From(const ScriptState* script_state) {
@@ -303,11 +316,13 @@ void LocalDOMWindow::DisableEval(const String& error_message) {
 }
 
 String LocalDOMWindow::UserAgent() const {
-  return document()->UserAgent();
+  return GetFrame() ? GetFrame()->Loader().UserAgent() : String();
 }
 
 HttpsState LocalDOMWindow::GetHttpsState() const {
-  return document()->GetHttpsState();
+  // TODO(https://crbug.com/880986): Implement Document's HTTPS state in more
+  // spec-conformant way.
+  return CalculateHttpsState(GetSecurityOrigin());
 }
 
 ResourceFetcher* LocalDOMWindow::Fetcher() const {
@@ -350,7 +365,7 @@ network::mojom::ReferrerPolicy LocalDOMWindow::GetReferrerPolicy() const {
 }
 
 CoreProbeSink* LocalDOMWindow::GetProbeSink() {
-  return document()->GetProbeSink();
+  return probe::ToCoreProbeSink(GetFrame());
 }
 
 BrowserInterfaceBrokerProxy& LocalDOMWindow::GetBrowserInterfaceBroker() {
@@ -370,21 +385,61 @@ FrameOrWorkerScheduler* LocalDOMWindow::GetScheduler() {
 
 scoped_refptr<base::SingleThreadTaskRunner> LocalDOMWindow::GetTaskRunner(
     TaskType type) {
-  return document()->GetTaskRunner(type);
+  if (GetFrame())
+    return GetFrame()->GetTaskRunner(type);
+  // In most cases, the ExecutionContext will get us to a relevant Frame. In
+  // some cases, though, there isn't a good candidate (most commonly when either
+  // the passed-in document or the ExecutionContext used to be attached to a
+  // Frame but has since been detached).
+  return Thread::Current()->GetTaskRunner();
 }
 
 void LocalDOMWindow::CountPotentialFeaturePolicyViolation(
     mojom::blink::FeaturePolicyFeature feature) const {
-  document()->CountPotentialFeaturePolicyViolation(feature);
+  wtf_size_t index = static_cast<wtf_size_t>(feature);
+  if (potentially_violated_features_.size() == 0) {
+    potentially_violated_features_.resize(
+        static_cast<wtf_size_t>(mojom::blink::FeaturePolicyFeature::kMaxValue) +
+        1);
+  } else if (potentially_violated_features_[index]) {
+    return;
+  }
+  potentially_violated_features_[index] = true;
+  UMA_HISTOGRAM_ENUMERATION("Blink.UseCounter.FeaturePolicy.PotentialViolation",
+                            feature);
 }
 
 void LocalDOMWindow::ReportFeaturePolicyViolation(
     mojom::blink::FeaturePolicyFeature feature,
     mojom::blink::PolicyDisposition disposition,
-    const String& message,
-    const String& source_file) const {
-  document()->ReportFeaturePolicyViolation(feature, disposition, message,
-                                           source_file);
+    const String& message) const {
+  if (!RuntimeEnabledFeatures::FeaturePolicyReportingEnabled(this))
+    return;
+  if (!GetFrame())
+    return;
+
+  // Construct the feature policy violation report.
+  const String& feature_name = GetNameForFeature(feature);
+  const String& disp_str =
+      (disposition == mojom::blink::PolicyDisposition::kReport ? "report"
+                                                               : "enforce");
+
+  FeaturePolicyViolationReportBody* body =
+      MakeGarbageCollected<FeaturePolicyViolationReportBody>(feature_name,
+                                                             message, disp_str);
+
+  Report* report = MakeGarbageCollected<Report>(
+      ReportType::kFeaturePolicyViolation, Url().GetString(), body);
+
+  // Send the feature policy violation report to any ReportingObservers.
+  ReportingContext::From(this)->QueueReport(report);
+
+  // TODO(iclelland): Report something different in report-only mode
+  if (disposition == mojom::blink::PolicyDisposition::kEnforce) {
+    GetFrame()->Console().AddMessage(MakeGarbageCollected<ConsoleMessage>(
+        mojom::blink::ConsoleMessageSource::kViolation,
+        mojom::blink::ConsoleMessageLevel::kError, body->message()));
+  }
 }
 
 void LocalDOMWindow::ReportDocumentPolicyViolation(
@@ -392,8 +447,46 @@ void LocalDOMWindow::ReportDocumentPolicyViolation(
     mojom::blink::PolicyDisposition disposition,
     const String& message,
     const String& source_file) const {
-  document()->ReportDocumentPolicyViolation(feature, disposition, message,
-                                            source_file);
+  if (!GetFrame())
+    return;
+
+  // Construct the document policy violation report.
+  const String& feature_name =
+      GetDocumentPolicyFeatureInfoMap().at(feature).feature_name.c_str();
+  bool is_report_only = disposition == mojom::blink::PolicyDisposition::kReport;
+  const String& disp_str = is_report_only ? "report" : "enforce";
+  const DocumentPolicy* relevant_document_policy =
+      is_report_only ? GetSecurityContext().GetReportOnlyDocumentPolicy()
+                     : GetSecurityContext().GetDocumentPolicy();
+
+  DocumentPolicyViolationReportBody* body =
+      MakeGarbageCollected<DocumentPolicyViolationReportBody>(
+          feature_name, message, disp_str, source_file);
+
+  Report* report = MakeGarbageCollected<Report>(
+      ReportType::kDocumentPolicyViolation, Url().GetString(), body);
+
+  // Send the document policy violation report to any ReportingObservers.
+  const base::Optional<std::string> endpoint =
+      relevant_document_policy->GetFeatureEndpoint(feature);
+
+  if (is_report_only) {
+    UMA_HISTOGRAM_ENUMERATION("Blink.UseCounter.DocumentPolicy.ReportOnly",
+                              feature);
+  } else {
+    UMA_HISTOGRAM_ENUMERATION("Blink.UseCounter.DocumentPolicy.Enforced",
+                              feature);
+  }
+
+  ReportingContext::From(this)->QueueReport(
+      report, endpoint ? Vector<String>{endpoint->c_str()} : Vector<String>{});
+
+  // TODO(iclelland): Report something different in report-only mode
+  if (!is_report_only) {
+    GetFrame()->Console().AddMessage(MakeGarbageCollected<ConsoleMessage>(
+        mojom::blink::ConsoleMessageSource::kViolation,
+        mojom::blink::ConsoleMessageLevel::kError, body->message()));
+  }
 }
 
 static void RunAddConsoleMessageTask(mojom::ConsoleMessageSource source,
@@ -443,6 +536,13 @@ void LocalDOMWindow::AddConsoleMessageImpl(ConsoleMessage* console_message,
   GetFrame()->Console().AddMessage(console_message, discard_duplicates);
 }
 
+void LocalDOMWindow::AddInspectorIssue(
+    mojom::blink::InspectorIssueInfoPtr info) {
+  if (GetFrame()) {
+    GetFrame()->AddInspectorIssue(std::move(info));
+  }
+}
+
 void LocalDOMWindow::CountUse(mojom::WebFeature feature) {
   if (!GetFrame())
     return;
@@ -454,13 +554,12 @@ void LocalDOMWindow::CountDeprecation(mojom::WebFeature feature) {
   document()->CountDeprecation(feature);
 }
 
-Document* LocalDOMWindow::InstallNewDocument(const DocumentInit& init,
-                                             bool force_xhtml) {
+Document* LocalDOMWindow::InstallNewDocument(const DocumentInit& init) {
   DCHECK_EQ(init.GetFrame(), GetFrame());
 
   ClearDocument();
 
-  document_ = CreateDocument(init, force_xhtml);
+  document_ = DOMImplementation::createDocument(init);
   document_->Initialize();
 
   // The CSP delegate doesn't have access to all of the state it needs until
@@ -757,8 +856,7 @@ FrameConsole* LocalDOMWindow::GetFrameConsole() const {
 }
 
 ApplicationCache* LocalDOMWindow::applicationCache() const {
-  DCHECK(RuntimeEnabledFeatures::AppCacheEnabled(
-      document()->ToExecutionContext()));
+  DCHECK(RuntimeEnabledFeatures::AppCacheEnabled(this));
   if (!IsCurrentlyDisplayedInFrame())
     return nullptr;
   if (!isSecureContext()) {
@@ -784,15 +882,14 @@ void LocalDOMWindow::SchedulePostMessage(
   // is problematic; consider imposing a limit or other restriction if this
   // surfaces often as a problem (see crbug.com/587012).
   std::unique_ptr<SourceLocation> location =
-      SourceLocation::Capture(source->ToExecutionContext());
+      SourceLocation::Capture(source->GetExecutionContext());
   document_->GetTaskRunner(TaskType::kPostedMessage)
       ->PostTask(FROM_HERE,
                  WTF::Bind(&LocalDOMWindow::DispatchPostMessage,
                            WrapPersistent(this), WrapPersistent(event),
                            std::move(target), std::move(location),
-                           source->ToExecutionContext()->GetAgentClusterID()));
-  probe::AsyncTaskScheduled(document()->ToExecutionContext(), "postMessage",
-                            event->async_task_id());
+                           source->GetExecutionContext()->GetAgentClusterID()));
+  probe::AsyncTaskScheduled(this, "postMessage", event->async_task_id());
 }
 
 void LocalDOMWindow::DispatchPostMessage(
@@ -800,12 +897,11 @@ void LocalDOMWindow::DispatchPostMessage(
     scoped_refptr<const SecurityOrigin> intended_target_origin,
     std::unique_ptr<SourceLocation> location,
     const base::UnguessableToken& source_agent_cluster_id) {
-  probe::AsyncTask async_task(document()->ToExecutionContext(),
-                              event->async_task_id());
+  probe::AsyncTask async_task(this, event->async_task_id());
   if (!IsCurrentlyDisplayedInFrame())
     return;
 
-  event->EntangleMessagePorts(document()->ToExecutionContext());
+  event->EntangleMessagePorts(this);
 
   DispatchMessageEventWithOriginCheck(intended_target_origin.get(), event,
                                       std::move(location),
@@ -858,8 +954,7 @@ void LocalDOMWindow::DispatchMessageEventWithOriginCheck(
     }
   }
   if (event->IsLockedToAgentCluster()) {
-    if (!document()->ToExecutionContext()->IsSameAgentCluster(
-            source_agent_cluster_id)) {
+    if (!IsSameAgentCluster(source_agent_cluster_id)) {
       UseCounter::Count(
           document(),
           WebFeature::kMessageEventSharedArrayBufferDifferentAgentCluster);
@@ -935,7 +1030,8 @@ void LocalDOMWindow::alert(ScriptState* script_state, const String& message) {
   if (!GetFrame())
     return;
 
-  if (document()->IsSandboxed(mojom::blink::WebSandboxFlags::kModals)) {
+  if (document()->IsSandboxed(
+          network::mojom::blink::WebSandboxFlags::kModals)) {
     UseCounter::Count(document(), WebFeature::kDialogInSandboxedContext);
     GetFrameConsole()->AddMessage(MakeGarbageCollected<ConsoleMessage>(
         mojom::ConsoleMessageSource::kSecurity,
@@ -968,7 +1064,8 @@ bool LocalDOMWindow::confirm(ScriptState* script_state, const String& message) {
   if (!GetFrame())
     return false;
 
-  if (document()->IsSandboxed(mojom::blink::WebSandboxFlags::kModals)) {
+  if (document()->IsSandboxed(
+          network::mojom::blink::WebSandboxFlags::kModals)) {
     UseCounter::Count(document(), WebFeature::kDialogInSandboxedContext);
     GetFrameConsole()->AddMessage(MakeGarbageCollected<ConsoleMessage>(
         mojom::ConsoleMessageSource::kSecurity,
@@ -1003,7 +1100,8 @@ String LocalDOMWindow::prompt(ScriptState* script_state,
   if (!GetFrame())
     return String();
 
-  if (document()->IsSandboxed(mojom::blink::WebSandboxFlags::kModals)) {
+  if (document()->IsSandboxed(
+          network::mojom::blink::WebSandboxFlags::kModals)) {
     UseCounter::Count(document(), WebFeature::kDialogInSandboxedContext);
     GetFrameConsole()->AddMessage(MakeGarbageCollected<ConsoleMessage>(
         mojom::ConsoleMessageSource::kSecurity,
@@ -1854,6 +1952,9 @@ void LocalDOMWindow::Trace(Visitor* visitor) {
   visitor->Trace(visualViewport_);
   visitor->Trace(event_listener_observers_);
   visitor->Trace(trusted_types_);
+  visitor->Trace(input_method_controller_);
+  visitor->Trace(spell_checker_);
+  visitor->Trace(text_suggestion_controller_);
   DOMWindow::Trace(visitor);
   ExecutionContext::Trace(visitor);
   Supplementable<LocalDOMWindow>::Trace(visitor);
diff --git a/chromium/third_party/blink/renderer/core/frame/local_dom_window.h b/chromium/third_party/blink/renderer/core/frame/local_dom_window.h
index 7494c6d34a6..bdc61595261 100644
--- a/chromium/third_party/blink/renderer/core/frame/local_dom_window.h
+++ b/chromium/third_party/blink/renderer/core/frame/local_dom_window.h
@@ -97,8 +97,6 @@ class CORE_EXPORT LocalDOMWindow final : public DOMWindow,
     virtual void DidRemoveAllEventListeners(LocalDOMWindow*) = 0;
   };
 
-  static Document* CreateDocument(const DocumentInit&, bool force_xhtml);
-
   static LocalDOMWindow* From(const ScriptState*);
 
   explicit LocalDOMWindow(LocalFrame&);
@@ -119,10 +117,6 @@ class CORE_EXPORT LocalDOMWindow final : public DOMWindow,
   const KURL& BaseURL() const final;
   KURL CompleteURL(const String&) const final;
   void DisableEval(const String& error_message) final;
-  LocalDOMWindow* ExecutingWindow() const final {
-    // TODO(crbug.com/1029822): This const_cast is gross.
-    return const_cast<LocalDOMWindow*>(this);
-  }
   String UserAgent() const final;
   HttpsState GetHttpsState() const final;
   ResourceFetcher* Fetcher() const final;
@@ -130,6 +124,7 @@ class CORE_EXPORT LocalDOMWindow final : public DOMWindow,
   const SecurityContext& GetSecurityContext() const final;
   bool CanExecuteScripts(ReasonForCallingCanExecuteScripts) final;
   void ExceptionThrown(ErrorEvent*) final;
+  void AddInspectorIssue(mojom::blink::InspectorIssueInfoPtr) final;
   EventTarget* ErrorEventTarget() final { return this; }
   String OutgoingReferrer() const final;
   network::mojom::ReferrerPolicy GetReferrerPolicy() const final;
@@ -145,10 +140,7 @@ class CORE_EXPORT LocalDOMWindow final : public DOMWindow,
   void ReportFeaturePolicyViolation(
       mojom::blink::FeaturePolicyFeature,
       mojom::blink::PolicyDisposition,
-      const String& message = g_empty_string,
-      // If source_file is set to empty string,
-      // current JS file would be used as source_file instead.
-      const String& source_file = g_empty_string) const final;
+      const String& message = g_empty_string) const final;
   void ReportDocumentPolicyViolation(
       mojom::blink::DocumentPolicyFeature,
       mojom::blink::PolicyDisposition,
@@ -163,7 +155,7 @@ class CORE_EXPORT LocalDOMWindow final : public DOMWindow,
   void CountUse(mojom::WebFeature feature) final;
   void CountDeprecation(mojom::WebFeature feature) final;
 
-  Document* InstallNewDocument(const DocumentInit&, bool force_xhtml);
+  Document* InstallNewDocument(const DocumentInit&);
 
   // EventTarget overrides:
   ExecutionContext* GetExecutionContext() const override;
@@ -361,6 +353,10 @@ class CORE_EXPORT LocalDOMWindow final : public DOMWindow,
 
   TrustedTypePolicyFactory* trustedTypes() const;
 
+  // Returns true if this window is cross-site to the main frame. Defaults to
+  // false in a detached window.
+  bool IsCrossSiteSubframe() const;
+
   void DispatchPersistedPageshowEvent(base::TimeTicks navigation_start);
 
   void DispatchPagehideEvent(PageTransitionEventPersistence persistence) {
@@ -369,6 +365,14 @@ class CORE_EXPORT LocalDOMWindow final : public DOMWindow,
         document_.Get());
   }
 
+  InputMethodController& GetInputMethodController() const {
+    return *input_method_controller_;
+  }
+  TextSuggestionController& GetTextSuggestionController() const {
+    return *text_suggestion_controller_;
+  }
+  SpellChecker& GetSpellChecker() const { return *spell_checker_; }
+
  protected:
   // EventTarget overrides.
   void AddedEventListener(const AtomicString& event_type,
@@ -442,6 +446,15 @@ class CORE_EXPORT LocalDOMWindow final : public DOMWindow,
   // TODO(altimin): We should be able to remove it after we complete
   // frame:document lifetime refactoring.
   std::unique_ptr<FrameOrWorkerScheduler> detached_scheduler_;
+
+  Member<InputMethodController> input_method_controller_;
+  Member<SpellChecker> spell_checker_;
+  Member<TextSuggestionController> text_suggestion_controller_;
+
+  // Tracks which features have already been potentially violated in this
+  // document. This helps to count them only once per page load.
+  // We don't use std::bitset to avoid to include feature_policy.mojom-blink.h.
+  mutable Vector<bool> potentially_violated_features_;
 };
 
 template <>
diff --git a/chromium/third_party/blink/renderer/core/frame/local_frame.cc b/chromium/third_party/blink/renderer/core/frame/local_frame.cc
index 3c78d008993..923913ab9dd 100644
--- a/chromium/third_party/blink/renderer/core/frame/local_frame.cc
+++ b/chromium/third_party/blink/renderer/core/frame/local_frame.cc
@@ -51,6 +51,7 @@
 #include "third_party/blink/public/mojom/frame/frame_owner_properties.mojom-blink.h"
 #include "third_party/blink/public/mojom/frame/lifecycle.mojom-blink.h"
 #include "third_party/blink/public/mojom/frame/media_player_action.mojom-blink.h"
+#include "third_party/blink/public/mojom/frame/reporting_observer.mojom-blink.h"
 #include "third_party/blink/public/mojom/scroll/scrollbar_mode.mojom-blink.h"
 #include "third_party/blink/public/platform/interface_registry.h"
 #include "third_party/blink/public/platform/scheduler/web_resource_loading_task_runner_handle.h"
@@ -99,11 +100,13 @@
 #include "third_party/blink/renderer/core/frame/page_scale_constraints_set.h"
 #include "third_party/blink/renderer/core/frame/performance_monitor.h"
 #include "third_party/blink/renderer/core/frame/picture_in_picture_controller.h"
+#include "third_party/blink/renderer/core/frame/remote_frame.h"
 #include "third_party/blink/renderer/core/frame/remote_frame_owner.h"
 #include "third_party/blink/renderer/core/frame/report.h"
 #include "third_party/blink/renderer/core/frame/reporting_context.h"
 #include "third_party/blink/renderer/core/frame/root_frame_viewport.h"
 #include "third_party/blink/renderer/core/frame/settings.h"
+#include "third_party/blink/renderer/core/frame/user_activation.h"
 #include "third_party/blink/renderer/core/frame/visual_viewport.h"
 #include "third_party/blink/renderer/core/frame/web_frame_widget_base.h"
 #include "third_party/blink/renderer/core/frame/web_local_frame_impl.h"
@@ -114,7 +117,7 @@
 #include "third_party/blink/renderer/core/html/plugin_document.h"
 #include "third_party/blink/renderer/core/input/event_handler.h"
 #include "third_party/blink/renderer/core/inspector/console_message.h"
-#include "third_party/blink/renderer/core/inspector/inspector_issue.h"
+#include "third_party/blink/renderer/core/inspector/inspector_issue_storage.h"
 #include "third_party/blink/renderer/core/inspector/inspector_task_runner.h"
 #include "third_party/blink/renderer/core/inspector/inspector_trace_events.h"
 #include "third_party/blink/renderer/core/intersection_observer/intersection_observer_controller.h"
@@ -125,6 +128,7 @@
 #include "third_party/blink/renderer/core/loader/document_loader.h"
 #include "third_party/blink/renderer/core/loader/frame_load_request.h"
 #include "third_party/blink/renderer/core/loader/idleness_detector.h"
+#include "third_party/blink/renderer/core/messaging/message_port.h"
 #include "third_party/blink/renderer/core/page/chrome_client.h"
 #include "third_party/blink/renderer/core/page/drag_controller.h"
 #include "third_party/blink/renderer/core/page/focus_controller.h"
@@ -156,9 +160,15 @@
 #include "third_party/blink/renderer/platform/network/network_utils.h"
 #include "third_party/blink/renderer/platform/runtime_enabled_features.h"
 #include "third_party/blink/renderer/platform/scheduler/public/frame_scheduler.h"
+#include "third_party/blink/renderer/platform/wtf/casting.h"
 #include "third_party/blink/renderer/platform/wtf/std_lib_extras.h"
 #include "ui/gfx/geometry/point.h"
 
+#if defined(OS_MACOSX)
+#include "third_party/blink/renderer/core/editing/ephemeral_range.h"
+#include "ui/gfx/range/range.h"
+#endif
+
 namespace blink {
 
 namespace {
@@ -176,6 +186,14 @@ inline float ParentTextZoomFactor(LocalFrame* frame) {
   return parent_local_frame ? parent_local_frame->TextZoomFactor() : 1;
 }
 
+#if defined(OS_MACOSX)
+uint32_t GetCurrentCursorPositionInFrame(LocalFrame* local_frame) {
+  blink::WebRange range =
+      WebLocalFrameImpl::FromFrame(local_frame)->SelectionRange();
+  return range.IsNull() ? 0U : static_cast<uint32_t>(range.StartOffset());
+}
+#endif
+
 // Convert a data url to a message pipe handle that corresponds to a remote
 // blob, so that it can be passed across processes.
 mojo::ScopedMessagePipeHandle DataURLToMessagePipeHandle(
@@ -202,6 +220,13 @@ HitTestResult HitTestResultForRootFramePos(
   return result;
 }
 
+RemoteFrame* SourceFrameForOptionalToken(
+    const base::Optional<base::UnguessableToken>& source_frame_token) {
+  if (!source_frame_token)
+    return nullptr;
+  return RemoteFrame::FromFrameToken(source_frame_token.value());
+}
+
 class WebBundleGenerationDelegate
     : public WebFrameSerializer::MHTMLPartsGenerationDelegate {
   STACK_ALLOCATED();
@@ -358,12 +383,9 @@ void LocalFrame::Trace(Visitor* visitor) {
   visitor->Trace(page_popup_owner_);
   visitor->Trace(script_controller_);
   visitor->Trace(editor_);
-  visitor->Trace(spell_checker_);
   visitor->Trace(selection_);
   visitor->Trace(event_handler_);
   visitor->Trace(console_);
-  visitor->Trace(input_method_controller_);
-  visitor->Trace(text_suggestion_controller_);
   visitor->Trace(smooth_scroll_sequencer_);
   visitor->Trace(content_capture_manager_);
   visitor->Trace(system_clipboard_);
@@ -573,9 +595,6 @@ void LocalFrame::DidAttachDocument() {
   // even after the frame reattaches.
   GetEventHandler().Clear();
   Selection().DidAttachDocument(document);
-  GetInputMethodController().DidAttachDocument(document);
-  GetSpellChecker().DidAttachDocument(document);
-  GetTextSuggestionController().DidAttachDocument(document);
   if (IsCrossOriginToParentFrame() && !first_url_cross_origin_to_parent_) {
     first_url_cross_origin_to_parent_ = GetDocument()->Url().GetString();
   }
@@ -902,6 +921,16 @@ void LocalFrame::DeviceScaleFactorChanged() {
   }
 }
 
+void LocalFrame::MediaQueryAffectingValueChangedForLocalSubtree(
+    MediaValueChange value) {
+  GetDocument()->MediaQueryAffectingValueChanged(value);
+  for (Frame* child = Tree().FirstChild(); child;
+       child = child->Tree().NextSibling()) {
+    if (auto* child_local_frame = DynamicTo<LocalFrame>(child))
+      child_local_frame->MediaQueryAffectingValueChangedForLocalSubtree(value);
+  }
+}
+
 double LocalFrame::DevicePixelRatio() const {
   if (!page_)
     return 0;
@@ -987,12 +1016,14 @@ bool LocalFrame::ShouldThrottleRendering() const {
 LocalFrame::LocalFrame(LocalFrameClient* client,
                        Page& page,
                        FrameOwner* owner,
+                       const base::UnguessableToken& frame_token,
                        WindowAgentFactory* inheriting_agent_factory,
                        InterfaceRegistry* interface_registry,
                        const base::TickClock* clock)
     : Frame(client,
             page,
             owner,
+            frame_token,
             MakeGarbageCollected<LocalWindowProxyManager>(*this),
             inheriting_agent_factory),
       frame_scheduler_(page.GetPageScheduler()->CreateFrameScheduler(
@@ -1005,14 +1036,9 @@ LocalFrame::LocalFrame(LocalFrameClient* client,
           *this,
           *static_cast<LocalWindowProxyManager*>(GetWindowProxyManager()))),
       editor_(MakeGarbageCollected<Editor>(*this)),
-      spell_checker_(MakeGarbageCollected<SpellChecker>(*this)),
       selection_(MakeGarbageCollected<FrameSelection>(*this)),
       event_handler_(MakeGarbageCollected<EventHandler>(*this)),
       console_(MakeGarbageCollected<FrameConsole>(*this)),
-      input_method_controller_(
-          MakeGarbageCollected<InputMethodController>(*this)),
-      text_suggestion_controller_(
-          MakeGarbageCollected<TextSuggestionController>(*this)),
       navigation_disable_count_(0),
       page_zoom_factor_(ParentPageZoomFactor(this)),
       text_zoom_factor_(ParentTextZoomFactor(this)),
@@ -1054,6 +1080,12 @@ LocalFrame::LocalFrame(LocalFrameClient* client,
   Initialize();
 
   probe::FrameAttachedToParent(this);
+#if defined(OS_MACOSX)
+  // It should be bound before accessing TextInputHost which is the interface to
+  // respond to GetCharacterIndexAtPoint.
+  GetBrowserInterfaceBroker().GetInterface(
+      text_input_host_.BindNewPipeAndPassReceiver());
+#endif
 }
 
 FrameScheduler* LocalFrame::GetFrameScheduler() {
@@ -1127,7 +1159,7 @@ bool LocalFrame::CanNavigate(const Frame& target_frame,
   }
 
   if (GetSecurityContext()->IsSandboxed(
-          mojom::blink::WebSandboxFlags::kNavigation)) {
+          network::mojom::blink::WebSandboxFlags::kNavigation)) {
     if (!target_frame.Tree().IsDescendantOf(this) &&
         !target_frame.IsMainFrame()) {
       PrintNavigationErrorMessage(
@@ -1142,10 +1174,10 @@ bool LocalFrame::CanNavigate(const Frame& target_frame,
     // 'allow-popups' flag is specified, or if the
     if (target_frame.IsMainFrame() && target_frame != Tree().Top() &&
         GetSecurityContext()->IsSandboxed(
-            mojom::blink::WebSandboxFlags::
+            network::mojom::blink::WebSandboxFlags::
                 kPropagatesToAuxiliaryBrowsingContexts) &&
         (GetSecurityContext()->IsSandboxed(
-             mojom::blink::WebSandboxFlags::kPopups) ||
+             network::mojom::blink::WebSandboxFlags::kPopups) ||
          target_frame.Client()->Opener() != this)) {
       PrintNavigationErrorMessage(
           target_frame,
@@ -1159,9 +1191,10 @@ bool LocalFrame::CanNavigate(const Frame& target_frame,
     // allow-top-navigation-by-user-activation will also skips origin checks.
     if (target_frame == Tree().Top()) {
       if (GetSecurityContext()->IsSandboxed(
-              mojom::blink::WebSandboxFlags::kTopNavigation) &&
+              network::mojom::blink::WebSandboxFlags::kTopNavigation) &&
           GetSecurityContext()->IsSandboxed(
-              mojom::blink::WebSandboxFlags::kTopNavigationByUserActivation)) {
+              network::mojom::blink::WebSandboxFlags::
+                  kTopNavigationByUserActivation)) {
         PrintNavigationErrorMessage(
             target_frame,
             "The frame attempting navigation of the top-level window is "
@@ -1171,9 +1204,10 @@ bool LocalFrame::CanNavigate(const Frame& target_frame,
       }
 
       if (GetSecurityContext()->IsSandboxed(
-              mojom::blink::WebSandboxFlags::kTopNavigation) &&
+              network::mojom::blink::WebSandboxFlags::kTopNavigation) &&
           !GetSecurityContext()->IsSandboxed(
-              mojom::blink::WebSandboxFlags::kTopNavigationByUserActivation) &&
+              network::mojom::blink::WebSandboxFlags::
+                  kTopNavigationByUserActivation) &&
           !LocalFrame::HasTransientUserActivation(this)) {
         // With only 'allow-top-navigation-by-user-activation' (but not
         // 'allow-top-navigation'), top navigation requires a user gesture.
@@ -1563,8 +1597,7 @@ void LocalFrame::ForceSynchronousDocumentInstall(
   DomWindow()->InstallNewDocument(
       DocumentInit::Create()
           .WithDocumentLoader(loader_.GetDocumentLoader())
-          .WithTypeFrom(mime_type),
-      false);
+          .WithTypeFrom(mime_type));
   loader_.StateMachine()->AdvanceTo(
       FrameLoaderStateMachine::kCommittedFirstRealLoad);
 
@@ -1859,15 +1892,14 @@ void LocalFrame::DidResume() {
 
 void LocalFrame::PauseContext() {
   GetDocument()->Fetcher()->SetDefersLoading(true);
-  GetDocument()->ToExecutionContext()->SetLifecycleState(lifecycle_state_);
+  DomWindow()->SetLifecycleState(lifecycle_state_);
   Loader().SetDefersLoading(true);
   GetFrameScheduler()->SetPaused(true);
 }
 
 void LocalFrame::UnpauseContext() {
   GetDocument()->Fetcher()->SetDefersLoading(false);
-  GetDocument()->ToExecutionContext()->SetLifecycleState(
-      mojom::FrameLifecycleState::kRunning);
+  DomWindow()->SetLifecycleState(mojom::FrameLifecycleState::kRunning);
   Loader().SetDefersLoading(false);
   GetFrameScheduler()->SetPaused(false);
 }
@@ -2121,6 +2153,38 @@ void LocalFrame::ZoomToFindInPageRect(const gfx::Rect& rect_in_root_frame) {
       WebRect(rect_in_root_frame));
 }
 
+#if defined(OS_MACOSX)
+void LocalFrame::GetCharacterIndexAtPoint(const gfx::Point& point) {
+  HitTestLocation location(View()->ViewportToFrame(IntPoint(point)));
+  HitTestResult result = GetEventHandler().HitTestResultAtLocation(
+      location, HitTestRequest::kReadOnly | HitTestRequest::kActive);
+  uint32_t index =
+      Selection().CharacterIndexForPoint(result.RoundedPointInInnerNodeFrame());
+  GetTextInputHost().GotCharacterIndexAtPoint(index);
+}
+
+void LocalFrame::GetFirstRectForRange(const gfx::Range& range) {
+  gfx::Rect rect;
+  WebLocalFrameClient* client = WebLocalFrameImpl::FromFrame(this)->Client();
+  if (!client)
+    return;
+
+  if (!client->GetCaretBoundsFromFocusedPlugin(rect)) {
+    blink::WebRect web_rect;
+    // When request range is invalid we will try to obtain it from current
+    // frame selection. The fallback value will be 0.
+    uint32_t start =
+        range.IsValid() ? range.start() : GetCurrentCursorPositionInFrame(this);
+
+    WebLocalFrameImpl::FromFrame(this)->FirstRectForCharacterRange(
+        start, range.length(), web_rect);
+    rect.SetRect(web_rect.x, web_rect.y, web_rect.width, web_rect.height);
+  }
+
+  GetTextInputHost().GotFirstRectForRange(rect);
+}
+#endif
+
 HitTestResult LocalFrame::HitTestResultForVisualViewportPos(
     const IntPoint& pos_in_viewport) {
   IntPoint root_frame_point(
@@ -2219,7 +2283,23 @@ void LocalFrame::AddMessageToConsole(mojom::blink::ConsoleMessageLevel level,
 }
 
 void LocalFrame::AddInspectorIssue(mojom::blink::InspectorIssueInfoPtr info) {
-  GetDocument()->AddInspectorIssue(InspectorIssue::Create(std::move(info)));
+  if (GetPage()) {
+    GetPage()->GetInspectorIssueStorage().AddInspectorIssue(DomWindow(), std::move(info));
+  }
+}
+
+void LocalFrame::StopLoading() {
+  Loader().StopAllLoaders();
+
+  // The stopLoading handler may run script, which may cause this frame to be
+  // detached/deleted. If that happens, return immediately.
+  if (!IsAttached())
+    return;
+
+  // Notify RenderFrame observers.
+  WebLocalFrameClient* client = Client()->GetWebFrame()->Client();
+  if (client)
+    client->OnStopLoading();
 }
 
 void LocalFrame::Collapse(bool collapsed) {
@@ -2448,6 +2528,19 @@ void LocalFrame::MediaPlayerActionAt(
   MediaPlayerActionAtViewportPoint(location, action->type, action->enable);
 }
 
+void LocalFrame::AdvanceFocusInFrame(
+    mojom::blink::FocusType focus_type,
+    const base::Optional<base::UnguessableToken>& source_frame_token) {
+  RemoteFrame* source_frame = SourceFrameForOptionalToken(source_frame_token);
+  if (!source_frame) {
+    SetInitialFocus(focus_type == mojom::blink::FocusType::kBackward);
+    return;
+  }
+
+  GetPage()->GetFocusController().AdvanceFocusAcrossFrames(focus_type,
+                                                           source_frame, this);
+}
+
 void LocalFrame::AdvanceFocusInForm(mojom::blink::FocusType focus_type) {
   auto* focused_frame = GetPage()->GetFocusController().FocusedFrame();
   if (focused_frame != this)
@@ -2504,6 +2597,84 @@ void LocalFrame::DidUpdateFramePolicy(const FramePolicy& frame_policy) {
   To<RemoteFrameOwner>(Owner())->SetFramePolicy(frame_policy);
 }
 
+void LocalFrame::OnScreensChange() {
+  if (RuntimeEnabledFeatures::WindowPlacementEnabled()) {
+    DomWindow()->DispatchEvent(
+        *Event::Create(event_type_names::kScreenschange));
+  }
+}
+
+void LocalFrame::PostMessageEvent(
+    const base::Optional<base::UnguessableToken>& source_frame_token,
+    const String& source_origin,
+    const String& target_origin,
+    BlinkTransferableMessage message) {
+  RemoteFrame* source_frame = SourceFrameForOptionalToken(source_frame_token);
+
+  // We must pass in the target_origin to do the security check on this side,
+  // since it may have changed since the original postMessage call was made.
+  scoped_refptr<SecurityOrigin> target_security_origin;
+  if (!target_origin.IsEmpty()) {
+    target_security_origin = SecurityOrigin::CreateFromString(target_origin);
+  }
+
+  // Preparation of the MessageEvent.
+  MessageEvent* message_event = MessageEvent::Create();
+  DOMWindow* window = nullptr;
+  if (source_frame)
+    window = source_frame->DomWindow();
+  MessagePortArray* ports = nullptr;
+  if (GetDocument()) {
+    ports = MessagePort::EntanglePorts(*GetDocument()->GetExecutionContext(),
+                                       std::move(message.ports));
+  }
+  UserActivation* user_activation = nullptr;
+  if (message.user_activation) {
+    user_activation = MakeGarbageCollected<UserActivation>(
+        message.user_activation->has_been_active,
+        message.user_activation->was_active);
+  }
+  message_event->initMessageEvent(
+      "message", false, false, std::move(message.message), source_origin,
+      "" /*lastEventId*/, window, ports, user_activation,
+      message.transfer_user_activation, message.allow_autoplay);
+
+  // If the agent cluster id had a value it means this was locked when it
+  // was serialized.
+  if (message.locked_agent_cluster_id)
+    message_event->LockToAgentCluster();
+
+  // Transfer user activation state in the target's renderer when
+  // |transferUserActivation| is true.
+  //
+  // Also do the same as an ad-hoc solution to allow the origin trial of dynamic
+  // delegation of autoplay capability through postMessages.  Note that we
+  // skipped updating the user activation states in all other copies of the
+  // frame tree in this case because this is a temporary hack.
+  //
+  // TODO(mustaq): Remove the ad-hoc solution when the API shape is
+  // ready. https://crbug.com/985914
+  if ((RuntimeEnabledFeatures::UserActivationPostMessageTransferEnabled() &&
+       message.transfer_user_activation) ||
+      message.allow_autoplay) {
+    TransferUserActivationFrom(source_frame);
+    if (message.allow_autoplay)
+      UseCounter::Count(GetDocument(), WebFeature::kAutoplayDynamicDelegation);
+  }
+
+  // Finally dispatch the message to the DOM Window.
+  DomWindow()->DispatchMessageEventWithOriginCheck(
+      target_security_origin.get(), message_event,
+      std::make_unique<SourceLocation>(String(), 0, 0, nullptr),
+      message.locked_agent_cluster_id ? message.locked_agent_cluster_id.value()
+                                      : base::UnguessableToken());
+}
+
+void LocalFrame::BindReportingObserver(
+    mojo::PendingReceiver<mojom::blink::ReportingObserver> receiver) {
+  ReportingContext::From(DomWindow())->Bind(std::move(receiver));
+}
+
 bool LocalFrame::ShouldThrottleDownload() {
   const auto now = base::TimeTicks::Now();
   if (num_burst_download_requests_ == 0) {
@@ -2523,6 +2694,13 @@ bool LocalFrame::ShouldThrottleDownload() {
   return false;
 }
 
+#if defined(OS_MACOSX)
+mojom::blink::TextInputHost& LocalFrame::GetTextInputHost() {
+  DCHECK(text_input_host_);
+  return *text_input_host_.get();
+}
+#endif
+
 void LocalFrame::BindToReceiver(
     blink::LocalFrame* frame,
     mojo::PendingAssociatedReceiver<mojom::blink::LocalFrame> receiver) {
@@ -2541,4 +2719,19 @@ void LocalFrame::BindToMainFrameReceiver(
       frame->GetTaskRunner(blink::TaskType::kInternalDefault));
 }
 
+SpellChecker& LocalFrame::GetSpellChecker() const {
+  DCHECK(DomWindow());
+  return DomWindow()->GetSpellChecker();
+}
+
+InputMethodController& LocalFrame::GetInputMethodController() const {
+  DCHECK(DomWindow());
+  return DomWindow()->GetInputMethodController();
+}
+
+TextSuggestionController& LocalFrame::GetTextSuggestionController() const {
+  DCHECK(DomWindow());
+  return DomWindow()->GetTextSuggestionController();
+}
+
 }  // namespace blink
diff --git a/chromium/third_party/blink/renderer/core/frame/local_frame.h b/chromium/third_party/blink/renderer/core/frame/local_frame.h
index 30763d3fc99..a222d33ca63 100644
--- a/chromium/third_party/blink/renderer/core/frame/local_frame.h
+++ b/chromium/third_party/blink/renderer/core/frame/local_frame.h
@@ -34,6 +34,7 @@
 #include "base/macros.h"
 #include "base/time/default_tick_clock.h"
 #include "base/unguessable_token.h"
+#include "build/build_config.h"
 #include "mojo/public/cpp/bindings/associated_receiver.h"
 #include "mojo/public/cpp/bindings/associated_remote.h"
 #include "mojo/public/cpp/bindings/pending_associated_receiver.h"
@@ -42,6 +43,7 @@
 #include "third_party/blink/public/mojom/frame/frame.mojom-blink.h"
 #include "third_party/blink/public/mojom/frame/frame_owner_properties.mojom-blink-forward.h"
 #include "third_party/blink/public/mojom/frame/lifecycle.mojom-blink-forward.h"
+#include "third_party/blink/public/mojom/frame/reporting_observer.mojom-blink-forward.h"
 #include "third_party/blink/public/mojom/input/focus_type.mojom-blink-forward.h"
 #include "third_party/blink/public/mojom/loader/pause_subresource_loading_handle.mojom-blink-forward.h"
 #include "third_party/blink/public/mojom/reporting/reporting.mojom-blink.h"
@@ -56,7 +58,6 @@
 #include "third_party/blink/renderer/core/frame/frame.h"
 #include "third_party/blink/renderer/core/frame/frame_types.h"
 #include "third_party/blink/renderer/core/frame/local_frame_view.h"
-#include "third_party/blink/renderer/core/inspector/inspector_issue.h"
 #include "third_party/blink/renderer/core/loader/frame_loader.h"
 #include "third_party/blink/renderer/platform/graphics/touch_action.h"
 #include "third_party/blink/renderer/platform/heap/handle.h"
@@ -64,6 +65,9 @@
 #include "third_party/blink/renderer/platform/loader/fetch/client_hints_preferences.h"
 #include "third_party/blink/renderer/platform/scheduler/public/frame_scheduler.h"
 #include "third_party/blink/renderer/platform/supplementable.h"
+#if defined(OS_MACOSX)
+#include "third_party/blink/public/mojom/input/text_input_host.mojom-blink.h"
+#endif
 
 namespace base {
 class SingleThreadTaskRunner;
@@ -73,6 +77,12 @@ namespace gfx {
 class Point;
 }
 
+#if defined(OS_MACOSX)
+namespace gfx {
+class Range;
+}
+#endif
+
 namespace blink {
 
 class AdTracker;
@@ -131,6 +141,7 @@ class CORE_EXPORT LocalFrame final : public Frame,
       LocalFrameClient*,
       Page&,
       FrameOwner*,
+      const base::UnguessableToken& frame_token,
       WindowAgentFactory* inheriting_agent_factory,
       InterfaceRegistry*,
       const base::TickClock* clock = base::DefaultTickClock::GetInstance());
@@ -261,6 +272,10 @@ class CORE_EXPORT LocalFrame final : public Frame,
   void DeviceScaleFactorChanged();
   double DevicePixelRatio() const;
 
+  // Informs the local root's document and its local descendant subtree that a
+  // media query value changed.
+  void MediaQueryAffectingValueChangedForLocalSubtree(MediaValueChange);
+
   String SelectedText() const;
   String SelectedTextForClipboard() const;
 
@@ -510,6 +525,7 @@ class CORE_EXPORT LocalFrame final : public Frame,
                            const WTF::String& message,
                            bool discard_duplicates) final;
   void AddInspectorIssue(mojom::blink::InspectorIssueInfoPtr) final;
+  void StopLoading() final;
   void Collapse(bool collapsed) final;
   void EnableViewSourceMode() final;
   void Focus() final;
@@ -526,6 +542,9 @@ class CORE_EXPORT LocalFrame final : public Frame,
   void MediaPlayerActionAt(
       const gfx::Point& window_point,
       blink::mojom::blink::MediaPlayerActionPtr action) final;
+  void AdvanceFocusInFrame(
+      mojom::blink::FocusType focus_type,
+      const base::Optional<base::UnguessableToken>& source_frame_token) final;
   void AdvanceFocusInForm(mojom::blink::FocusType focus_type) final;
   void ReportContentSecurityPolicyViolation(
       network::mojom::blink::CSPViolationPtr csp_violation) final;
@@ -535,6 +554,14 @@ class CORE_EXPORT LocalFrame final : public Frame,
   // sandbox flags or container policy. The new policy won't take effect until
   // the next navigation.
   void DidUpdateFramePolicy(const FramePolicy& frame_policy) final;
+  void OnScreensChange() final;
+  void PostMessageEvent(
+      const base::Optional<base::UnguessableToken>& source_frame_token,
+      const String& source_origin,
+      const String& target_origin,
+      BlinkTransferableMessage message) final;
+  void BindReportingObserver(
+      mojo::PendingReceiver<mojom::blink::ReportingObserver> receiver) final;
 
   // blink::mojom::LocalMainFrame overrides:
   void AnimateDoubleTapZoom(const gfx::Point& point,
@@ -548,6 +575,10 @@ class CORE_EXPORT LocalFrame final : public Frame,
   void SetInitialFocus(bool reverse) override;
   void EnablePreferredSizeChangedMode() override;
   void ZoomToFindInPageRect(const gfx::Rect& rect_in_root_frame) override;
+#if defined(OS_MACOSX)
+  void GetCharacterIndexAtPoint(const gfx::Point& point) final;
+  void GetFirstRectForRange(const gfx::Range& range) final;
+#endif
 
   SystemClipboard* GetSystemClipboard();
   RawSystemClipboard* GetRawSystemClipboard();
@@ -561,6 +592,7 @@ class CORE_EXPORT LocalFrame final : public Frame,
 
  private:
   friend class FrameNavigationDisabler;
+  FRIEND_TEST_ALL_PREFIXES(LocalFrameTest, CharacterIndexAtPointWithPinchZoom);
 
   // Frame protected overrides:
   void DetachImpl(FrameDetachType) override;
@@ -614,6 +646,10 @@ class CORE_EXPORT LocalFrame final : public Frame,
 
   bool ShouldThrottleDownload();
 
+#if defined(OS_MACOSX)
+  mojom::blink::TextInputHost& GetTextInputHost();
+#endif
+
   static void BindToReceiver(
       blink::LocalFrame* frame,
       mojo::PendingAssociatedReceiver<mojom::blink::LocalFrame> receiver);
@@ -638,12 +674,9 @@ class CORE_EXPORT LocalFrame final : public Frame,
 
   const Member<ScriptController> script_controller_;
   const Member<Editor> editor_;
-  const Member<SpellChecker> spell_checker_;
   const Member<FrameSelection> selection_;
   const Member<EventHandler> event_handler_;
   const Member<FrameConsole> console_;
-  const Member<InputMethodController> input_method_controller_;
-  const Member<TextSuggestionController> text_suggestion_controller_;
 
   int navigation_disable_count_;
   // TODO(dcheng): In theory, this could be replaced by checking the
@@ -673,6 +706,10 @@ class CORE_EXPORT LocalFrame final : public Frame,
   // const methods.
   mutable mojo::Remote<mojom::blink::ReportingServiceProxy> reporting_service_;
 
+#if defined(OS_MACOSX)
+  mojo::Remote<mojom::blink::TextInputHost> text_input_host_;
+#endif
+
   ViewportIntersectionState intersection_state_;
 
   // Per-frame URLLoader factory.
@@ -744,23 +781,10 @@ inline Editor& LocalFrame::GetEditor() const {
   return *editor_;
 }
 
-inline SpellChecker& LocalFrame::GetSpellChecker() const {
-  return *spell_checker_;
-}
-
 inline FrameConsole& LocalFrame::Console() const {
   return *console_;
 }
 
-inline InputMethodController& LocalFrame::GetInputMethodController() const {
-  return *input_method_controller_;
-}
-
-inline TextSuggestionController& LocalFrame::GetTextSuggestionController()
-    const {
-  return *text_suggestion_controller_;
-}
-
 inline bool LocalFrame::InViewSourceMode() const {
   return in_view_source_mode_;
 }
diff --git a/chromium/third_party/blink/renderer/core/frame/local_frame_client.h b/chromium/third_party/blink/renderer/core/frame/local_frame_client.h
index 5faee38f8a7..b9a8d9bce7a 100644
--- a/chromium/third_party/blink/renderer/core/frame/local_frame_client.h
+++ b/chromium/third_party/blink/renderer/core/frame/local_frame_client.h
@@ -49,6 +49,7 @@
 #include "third_party/blink/public/platform/scheduler/web_scoped_virtual_time_pauser.h"
 #include "third_party/blink/public/platform/web_content_settings_client.h"
 #include "third_party/blink/public/platform/web_effective_connection_type.h"
+#include "third_party/blink/public/platform/web_impression.h"
 #include "third_party/blink/public/platform/web_worker_fetch_context.h"
 #include "third_party/blink/public/web/web_frame_load_type.h"
 #include "third_party/blink/public/web/web_history_commit_type.h"
@@ -146,7 +147,6 @@ class CORE_EXPORT LocalFrameClient : public FrameClient {
       DocumentLoader*,
       WebNavigationType,
       NavigationPolicy,
-      bool has_transient_activation,
       WebFrameLoadType,
       bool is_client_redirect,
       TriggeringEventInfo,
@@ -156,6 +156,7 @@ class CORE_EXPORT LocalFrameClient : public FrameClient {
       mojo::PendingRemote<mojom::blink::BlobURLToken>,
       base::TimeTicks input_start_time,
       const String& href_translate,
+      const base::Optional<WebImpression>& impression,
       WTF::Vector<network::mojom::blink::ContentSecurityPolicyPtr>
           initiator_csp,
       network::mojom::blink::CSPSourcePtr initiator_self_source,
@@ -206,6 +207,13 @@ class CORE_EXPORT LocalFrameClient : public FrameClient {
   virtual void DidObserveLayoutShift(double score, bool after_input_or_scroll) {
   }
 
+  // Reports the number of LayoutBlock creation, and LayoutObject::UpdateLayout
+  // calls. All values are deltas since the last calls of this function.
+  virtual void DidObserveLayoutNg(uint32_t all_block_count,
+                                  uint32_t ng_block_count,
+                                  uint32_t all_call_count,
+                                  uint32_t ng_call_count) {}
+
   // Reports lazy loaded behavior when the frame or image is fully deferred or
   // if the frame or image is loaded after being deferred. Called every time the
   // behavior occurs. This does not apply to images that were loaded as
@@ -280,7 +288,7 @@ class CORE_EXPORT LocalFrameClient : public FrameClient {
       HTMLMediaElement&) = 0;
 
   virtual void DidCreateInitialEmptyDocument() = 0;
-  virtual void DidCommitJavascriptUrlNavigation(DocumentLoader*) = 0;
+  virtual void DidCommitDocumentReplacementNavigation(DocumentLoader*) = 0;
   virtual void DispatchDidClearWindowObjectInMainWorld() = 0;
   virtual void DocumentElementAvailable() = 0;
   virtual void RunScriptsAtDocumentElementAvailable() = 0;
@@ -307,12 +315,10 @@ class CORE_EXPORT LocalFrameClient : public FrameClient {
   virtual void DidChangeFramePolicy(Frame* child_frame, const FramePolicy&) {}
 
   virtual void DidSetFramePolicyHeaders(
-      mojom::blink::WebSandboxFlags,
+      network::mojom::blink::WebSandboxFlags,
       const ParsedFeaturePolicy& feature_policy_header,
       const DocumentPolicy::FeatureState& document_policy_header) {}
 
-  virtual void DidChangeFrameOwnerProperties(HTMLFrameOwnerElement*) {}
-
   virtual std::unique_ptr<WebServiceWorkerProvider>
   CreateServiceWorkerProvider() = 0;
 
diff --git a/chromium/third_party/blink/renderer/core/frame/local_frame_test.cc b/chromium/third_party/blink/renderer/core/frame/local_frame_test.cc
index 0d63d5a2b8e..d1f8b812ac8 100644
--- a/chromium/third_party/blink/renderer/core/frame/local_frame_test.cc
+++ b/chromium/third_party/blink/renderer/core/frame/local_frame_test.cc
@@ -4,6 +4,7 @@
 
 #include "third_party/blink/renderer/core/frame/local_frame.h"
 
+#include "build/build_config.h"
 #include "testing/gtest/include/gtest/gtest.h"
 #include "third_party/blink/renderer/core/dom/node_computed_style.h"
 #include "third_party/blink/renderer/core/frame/settings.h"
@@ -13,6 +14,13 @@
 #include "third_party/blink/renderer/platform/loader/fetch/fetch_parameters.h"
 #include "third_party/blink/renderer/platform/network/network_state_notifier.h"
 #include "third_party/blink/renderer/platform/testing/runtime_enabled_features_test_helpers.h"
+#if defined(OS_MACOSX)
+#include "mojo/public/cpp/bindings/receiver.h"
+#include "third_party/blink/public/mojom/input/text_input_host.mojom-blink.h"
+#include "third_party/blink/renderer/core/frame/frame_test_helpers.h"
+#include "third_party/blink/renderer/platform/testing/unit_test_helpers.h"
+#include "third_party/blink/renderer/platform/testing/url_test_helpers.h"
+#endif
 
 namespace blink {
 
@@ -25,6 +33,51 @@ void EnableLazyLoadInSettings(Settings& settings) {
   settings.SetLazyLoadEnabled(true);
 }
 
+#if defined(OS_MACOSX)
+void RegisterMockedHttpURLLoad(const std::string& base_url,
+                               const std::string& file_name) {
+  url_test_helpers::RegisterMockedURLLoadFromBase(
+      WebString::FromUTF8(base_url), test::CoreTestDataPath(),
+      WebString::FromUTF8(file_name));
+}
+
+class TestTextInputHostWaiter : public mojom::blink::TextInputHost {
+ public:
+  TestTextInputHostWaiter() = default;
+  ~TestTextInputHostWaiter() override = default;
+
+  void Init(base::OnceClosure callback,
+            blink::BrowserInterfaceBrokerProxy& provider) {
+    callback_ = std::move(callback);
+    provider.SetBinderForTesting(
+        mojom::blink::TextInputHost::Name_,
+        base::BindRepeating(&TestTextInputHostWaiter::BindTextInputHostReceiver,
+                            base::Unretained(this)));
+  }
+
+  void GotCharacterIndexAtPoint(uint32_t index) override {
+    index_ = index;
+    if (callback_)
+      std::move(callback_).Run();
+  }
+
+  void GotFirstRectForRange(const gfx::Rect& rect) override {}
+
+  void BindTextInputHostReceiver(
+      mojo::ScopedMessagePipeHandle message_pipe_handle) {
+    receiver_.Bind(mojo::PendingReceiver<mojom::blink::TextInputHost>(
+        std::move(message_pipe_handle)));
+  }
+
+  uint32_t index() { return index_; }
+
+ private:
+  mojo::Receiver<mojom::blink::TextInputHost> receiver_{this};
+  uint32_t index_;
+  base::OnceClosure callback_;
+};
+#endif
+
 }  // namespace
 
 class LocalFrameTest : public testing::Test {
@@ -185,4 +238,35 @@ TEST_F(LocalFrameTest, ForceSynchronousDocumentInstall_XMLStyleSheet) {
   TestGreenDiv(*page_holder);
 }
 
+#if defined(OS_MACOSX)
+TEST_F(LocalFrameTest, CharacterIndexAtPointWithPinchZoom) {
+  RegisterMockedHttpURLLoad("http://internal.test/", "sometext.html");
+
+  frame_test_helpers::WebViewHelper web_view_helper;
+  web_view_helper.InitializeAndLoad("http://internal.test/sometext.html");
+  web_view_helper.LoadAhem();
+  web_view_helper.Resize(WebSize(640, 480));
+
+  // Move the visual viewport to the start of the target div containing the
+  // text.
+  web_view_helper.GetWebView()->SetPageScaleFactor(2);
+  web_view_helper.GetWebView()->SetVisualViewportOffset(gfx::PointF(100, 50));
+
+  Page* page = web_view_helper.GetWebView()->GetPage();
+  LocalFrame* main_frame = DynamicTo<LocalFrame>(page->MainFrame());
+  main_frame->text_input_host_.reset();
+
+  base::RunLoop run_loop;
+  TestTextInputHostWaiter waiter;
+  waiter.Init(run_loop.QuitClosure(), main_frame->GetBrowserInterfaceBroker());
+  main_frame->GetBrowserInterfaceBroker().GetInterface(
+      main_frame->text_input_host_.BindNewPipeAndPassReceiver());
+  // Since we're zoomed in to 2X, each char of Ahem is 20px wide/tall in
+  // viewport space. We expect to hit the fifth char on the first line.
+  main_frame->GetCharacterIndexAtPoint(gfx::Point(100, 15));
+  run_loop.Run();
+  EXPECT_EQ(waiter.index(), 5ul);
+}
+#endif
+
 }  // namespace blink
diff --git a/chromium/third_party/blink/renderer/core/frame/local_frame_ukm_aggregator.h b/chromium/third_party/blink/renderer/core/frame/local_frame_ukm_aggregator.h
index ef31447acc5..d5d0f2e5315 100644
--- a/chromium/third_party/blink/renderer/core/frame/local_frame_ukm_aggregator.h
+++ b/chromium/third_party/blink/renderer/core/frame/local_frame_ukm_aggregator.h
@@ -5,7 +5,7 @@
 #ifndef THIRD_PARTY_BLINK_RENDERER_CORE_FRAME_LOCAL_FRAME_UKM_AGGREGATOR_H_
 #define THIRD_PARTY_BLINK_RENDERER_CORE_FRAME_LOCAL_FRAME_UKM_AGGREGATOR_H_
 
-#include "cc/metrics/frame_sequence_tracker.h"
+#include "cc/metrics/frame_sequence_tracker_collection.h"
 #include "third_party/blink/renderer/core/core_export.h"
 #include "third_party/blink/renderer/platform/instrumentation/histogram.h"
 #include "third_party/blink/renderer/platform/wtf/allocator/allocator.h"
diff --git a/chromium/third_party/blink/renderer/core/frame/local_frame_view.cc b/chromium/third_party/blink/renderer/core/frame/local_frame_view.cc
index afab16121f7..a64c209a396 100644
--- a/chromium/third_party/blink/renderer/core/frame/local_frame_view.cc
+++ b/chromium/third_party/blink/renderer/core/frame/local_frame_view.cc
@@ -49,6 +49,7 @@
 #include "third_party/blink/renderer/core/animation/document_animations.h"
 #include "third_party/blink/renderer/core/css/font_face_set_document.h"
 #include "third_party/blink/renderer/core/css/style_change_reason.h"
+#include "third_party/blink/renderer/core/display_lock/display_lock_utilities.h"
 #include "third_party/blink/renderer/core/dom/static_node_list.h"
 #include "third_party/blink/renderer/core/editing/compute_layer_selection.h"
 #include "third_party/blink/renderer/core/editing/drag_caret.h"
@@ -60,6 +61,7 @@
 #include "third_party/blink/renderer/core/frame/find_in_page.h"
 #include "third_party/blink/renderer/core/frame/frame_overlay.h"
 #include "third_party/blink/renderer/core/frame/frame_view_auto_size_info.h"
+#include "third_party/blink/renderer/core/frame/local_dom_window.h"
 #include "third_party/blink/renderer/core/frame/local_frame.h"
 #include "third_party/blink/renderer/core/frame/local_frame_client.h"
 #include "third_party/blink/renderer/core/frame/local_frame_ukm_aggregator.h"
@@ -155,7 +157,7 @@
 #include "third_party/blink/renderer/platform/wtf/std_lib_extras.h"
 #include "third_party/skia/include/core/SkBitmap.h"
 #include "ui/base/cursor/cursor.h"
-#include "ui/base/mojom/cursor_type.mojom-blink.h"
+#include "ui/base/cursor/mojom/cursor_type.mojom-blink.h"
 
 // Used to check for dirty layouts violating document lifecycle rules.
 // If arg evaluates to true, the program will continue. If arg evaluates to
@@ -230,7 +232,6 @@ LocalFrameView::LocalFrameView(LocalFrame& frame, const IntSize& initial_size)
 LocalFrameView::LocalFrameView(LocalFrame& frame, IntRect frame_rect)
     : FrameView(frame_rect),
       frame_(frame),
-      display_mode_(blink::mojom::DisplayMode::kBrowser),
       can_have_scrollbars_(true),
       has_pending_layout_(false),
       layout_scheduling_enabled_(true),
@@ -271,7 +272,7 @@ LocalFrameView::LocalFrameView(LocalFrame& frame, IntRect frame_rect)
       forced_layout_start_time_(base::TimeTicks()),
       paint_frame_count_(0),
       unique_id_(NewUniqueObjectId()),
-      layout_shift_tracker_(std::make_unique<LayoutShiftTracker>(this)),
+      layout_shift_tracker_(MakeGarbageCollected<LayoutShiftTracker>(this)),
       paint_timing_detector_(MakeGarbageCollected<PaintTimingDetector>(this))
 #if DCHECK_IS_ON()
       ,
@@ -301,6 +302,7 @@ void LocalFrameView::Trace(Visitor* visitor) {
   visitor->Trace(viewport_scrollable_area_);
   visitor->Trace(anchoring_adjustment_queue_);
   visitor->Trace(scroll_event_queue_);
+  visitor->Trace(layout_shift_tracker_);
   visitor->Trace(paint_timing_detector_);
   visitor->Trace(lifecycle_observers_);
 }
@@ -639,11 +641,37 @@ void LocalFrameView::PerformPreLayoutTasks() {
 
   Lifecycle().AdvanceTo(DocumentLifecycle::kStyleClean);
 
-  if (was_resized)
+  if (was_resized) {
     document->ClearResizedForViewportUnits();
+
+    // Mark all of writing-mode roots for layout, as the ICB size has changed.
+    MarkOrthogonalWritingModeRootsForLayout();
+  }
 }
 
-void LocalFrameView::LayoutFromRootObject(LayoutObject& root) {
+bool LocalFrameView::LayoutFromRootObject(LayoutObject& root) {
+  if (!root.NeedsLayout())
+    return false;
+
+  if (auto* locked_ancestor =
+          DisplayLockUtilities::LockedAncestorPreventingLayout(root)) {
+    // Note that since we're preventing the layout on a layout root, we have to
+    // mark its ancestor chain for layout. The reason for this is that we will
+    // clear the layout roots whether or not we have finished laying them out,
+    // so the fact that this root still needs layout will be lost if we don't
+    // mark its container chain.
+    //
+    // Also, since we know that this root has a layout-blocking ancestor, the
+    // layout bit propagation will stop there.
+    //
+    // TODO(vmpstr): Note that an alternative to this approach is to keep `root`
+    // as a layout root in `layout_subtree_root_list_`. It would mean that we
+    // will keep it in the list while the display-lock prevents layout. We need
+    // to investigate which of these approaches is better.
+    root.MarkContainerChainForLayout();
+    return false;
+  }
+
   LayoutState layout_state(root);
   if (scrollable_areas_) {
     for (auto& scrollable_area : *scrollable_areas_) {
@@ -654,6 +682,7 @@ void LocalFrameView::LayoutFromRootObject(LayoutObject& root) {
   }
 
   root.UpdateLayout();
+  return true;
 }
 
 void LocalFrameView::PrepareLayoutAnalyzer() {
@@ -730,9 +759,8 @@ void LocalFrameView::PerformLayout(bool in_subtree_layout) {
                              layout_subtree_root_list_.size());
       }
       for (auto& root : layout_subtree_root_list_.Ordered()) {
-        if (!root->NeedsLayout())
+        if (!LayoutFromRootObject(*root))
           continue;
-        LayoutFromRootObject(*root);
 
         root->PaintingLayer()->UpdateLayerPositionsAfterLayout();
 
@@ -1181,18 +1209,6 @@ void LocalFrameView::AddPartToUpdate(LayoutEmbeddedObject& object) {
   part_update_set_.insert(&object);
 }
 
-void LocalFrameView::SetDisplayMode(blink::mojom::DisplayMode mode) {
-  if (mode == display_mode_)
-    return;
-
-  display_mode_ = mode;
-
-  if (frame_->GetDocument()) {
-    frame_->GetDocument()->MediaQueryAffectingValueChanged(
-        MediaValueChange::kOther);
-  }
-}
-
 void LocalFrameView::SetDisplayShape(DisplayShape display_shape) {
   if (display_shape == display_shape_)
     return;
@@ -1279,16 +1295,35 @@ bool LocalFrameView::RequiresMainThreadScrollingForBackgroundAttachmentFixed()
   return true;
 }
 
-void LocalFrameView::AddViewportConstrainedObject(LayoutObject& object) {
+void LocalFrameView::AddViewportConstrainedObject(
+    LayoutObject& object,
+    ViewportConstrainedType constrained_reason) {
   if (!viewport_constrained_objects_)
     viewport_constrained_objects_ = std::make_unique<ObjectSet>();
 
-  viewport_constrained_objects_->insert(&object);
+  auto result = viewport_constrained_objects_->insert(&object);
+  if (constrained_reason == ViewportConstrainedType::kSticky) {
+    if (result.is_new_entry) {
+      sticky_position_object_count_++;
+    }
+    DCHECK_LE(sticky_position_object_count_,
+              viewport_constrained_objects_->size());
+  }
 }
 
-void LocalFrameView::RemoveViewportConstrainedObject(LayoutObject& object) {
-  if (viewport_constrained_objects_)
-    viewport_constrained_objects_->erase(&object);
+void LocalFrameView::RemoveViewportConstrainedObject(
+    LayoutObject& object,
+    ViewportConstrainedType constrained_reason) {
+  if (viewport_constrained_objects_) {
+    auto it = viewport_constrained_objects_->find(&object);
+    if (it != viewport_constrained_objects_->end()) {
+      viewport_constrained_objects_->erase(it);
+      if (constrained_reason == ViewportConstrainedType::kSticky) {
+        DCHECK_GT(sticky_position_object_count_, 0U);
+        sticky_position_object_count_--;
+      }
+    }
+  }
 }
 
 void LocalFrameView::ViewportSizeChanged(bool width_changed,
@@ -1623,6 +1658,17 @@ void LocalFrameView::ScheduleOrthogonalWritingModeRootsForLayout() {
   }
 }
 
+void LocalFrameView::MarkOrthogonalWritingModeRootsForLayout() {
+  for (auto& root : orthogonal_writing_mode_root_list_.Ordered()) {
+    // OOF-positioned objects don't depend on the ICB size.
+    if (root->NeedsLayout() || root->IsOutOfFlowPositioned())
+      continue;
+
+    root->SetNeedsLayoutAndIntrinsicWidthsRecalc(
+        layout_invalidation_reason::kSizeChanged);
+  }
+}
+
 bool LocalFrameView::CheckLayoutInvalidationIsAllowed() const {
 #if DCHECK_IS_ON()
   if (allows_layout_invalidation_after_layout_clean_)
@@ -1694,7 +1740,8 @@ void LocalFrameView::ScheduleRelayoutOfSubtree(LayoutObject* relayout_root) {
     if (!ShouldThrottleRendering())
       GetPage()->Animator().ScheduleVisualUpdate(frame_.Get());
 
-    Lifecycle().EnsureStateAtMost(DocumentLifecycle::kStyleClean);
+    if (GetPage()->Animator().IsServicingAnimations())
+      Lifecycle().EnsureStateAtMost(DocumentLifecycle::kStyleClean);
   }
   TRACE_EVENT_INSTANT1(TRACE_DISABLED_BY_DEFAULT("devtools.timeline"),
                        "InvalidateLayout", TRACE_EVENT_SCOPE_THREAD, "data",
@@ -2191,34 +2238,33 @@ bool LocalFrameView::NotifyResizeObservers(
     return false;
 
   // Controller exists only if ResizeObserver was created.
-  if (!GetFrame().GetDocument()->GetResizeObserverController())
+  ResizeObserverController* resize_controller =
+      ResizeObserverController::FromIfExists(*GetFrame().DomWindow());
+  if (!resize_controller)
     return false;
 
-  ResizeObserverController& resize_controller =
-      frame_->GetDocument()->EnsureResizeObserverController();
-
   DCHECK(Lifecycle().GetState() >= DocumentLifecycle::kPrePaintClean);
 
-  size_t min_depth = resize_controller.GatherObservations();
+  size_t min_depth = resize_controller->GatherObservations();
 
   if (min_depth != ResizeObserverController::kDepthBottom) {
-    resize_controller.DeliverObservations();
+    resize_controller->DeliverObservations();
   } else {
     // Observation depth limit reached
-    if (resize_controller.SkippedObservations()) {
-      resize_controller.ClearObservations();
+    if (resize_controller->SkippedObservations() &&
+        !resize_controller->IsLoopLimitErrorDispatched()) {
+      resize_controller->ClearObservations();
       ErrorEvent* error = ErrorEvent::Create(
           "ResizeObserver loop limit exceeded",
-          SourceLocation::Capture(frame_->GetDocument()->ToExecutionContext()),
-          nullptr);
+          SourceLocation::Capture(frame_->DomWindow()), nullptr);
       // We're using |SanitizeScriptErrors::kDoNotSanitize| as the error is made
       // by blink itself.
       // TODO(yhirano): Reconsider this.
-      frame_->GetDocument()->ToExecutionContext()->DispatchErrorEvent(
+      frame_->DomWindow()->DispatchErrorEvent(
           error, SanitizeScriptErrors::kDoNotSanitize);
       // Ensure notifications will get delivered in next cycle.
       ScheduleAnimation();
-      DCHECK(Lifecycle().GetState() >= DocumentLifecycle::kPrePaintClean);
+      resize_controller->SetLoopLimitErrorDispatched(true);
     }
     if (Lifecycle().GetState() >= DocumentLifecycle::kPrePaintClean)
       return false;
@@ -2433,9 +2479,10 @@ bool LocalFrameView::RunResizeObserverSteps(
   }
   if (!re_run_lifecycles) {
     ForAllNonThrottledLocalFrameViews([](LocalFrameView& frame_view) {
-      ResizeObserverController& resize_controller =
-          frame_view.frame_->GetDocument()->EnsureResizeObserverController();
-      resize_controller.ClearMinDepth();
+      ResizeObserverController* resize_controller =
+          ResizeObserverController::From(*frame_view.frame_->DomWindow());
+      resize_controller->ClearMinDepth();
+      resize_controller->SetLoopLimitErrorDispatched(false);
     });
   }
   return re_run_lifecycles;
@@ -2972,9 +3019,18 @@ void LocalFrameView::PushPaintArtifactToCompositor() {
     paint_controller_->CommitNewDisplayItems();
   }
 
+  WTF::Vector<const TransformPaintPropertyNode*> scroll_translation_nodes;
+  if (RuntimeEnabledFeatures::ScrollUnificationEnabled()) {
+    ForAllNonThrottledLocalFrameViews(
+        [&scroll_translation_nodes](LocalFrameView& frame_view) {
+          scroll_translation_nodes.AppendVector(
+              frame_view.GetScrollTranslationNodes());
+        });
+  }
+
   paint_artifact_compositor_->Update(
       paint_controller_->GetPaintArtifactShared(), viewport_properties,
-      settings);
+      settings, scroll_translation_nodes);
 
   probe::LayerTreePainted(&GetFrame());
 }
@@ -4545,4 +4601,17 @@ LocalFrameView::EnsureOverlayInterstitialAdDetector() {
   return *overlay_interstitial_ad_detector_.get();
 }
 
+WTF::Vector<const TransformPaintPropertyNode*>
+LocalFrameView::GetScrollTranslationNodes() {
+  WTF::Vector<const TransformPaintPropertyNode*> scroll_translation_nodes;
+  for (auto area : *ScrollableAreas()) {
+    const auto* paint_properties =
+        area->GetLayoutBox()->FirstFragment().PaintProperties();
+    if (paint_properties && paint_properties->Scroll()) {
+      scroll_translation_nodes.push_back(paint_properties->ScrollTranslation());
+    }
+  }
+  return scroll_translation_nodes;
+}
+
 }  // namespace blink
diff --git a/chromium/third_party/blink/renderer/core/frame/local_frame_view.h b/chromium/third_party/blink/renderer/core/frame/local_frame_view.h
index 076606e9eed..6d0cfa5b5c7 100644
--- a/chromium/third_party/blink/renderer/core/frame/local_frame_view.h
+++ b/chromium/third_party/blink/renderer/core/frame/local_frame_view.h
@@ -30,7 +30,6 @@
 
 #include "third_party/blink/public/common/metrics/document_update_reason.h"
 #include "third_party/blink/public/mojom/frame/lifecycle.mojom-blink-forward.h"
-#include "third_party/blink/public/mojom/manifest/display_mode.mojom-shared.h"
 #include "third_party/blink/public/mojom/scroll/scroll_into_view_params.mojom-blink-forward.h"
 #include "third_party/blink/public/platform/shape_properties.h"
 #include "third_party/blink/renderer/core/core_export.h"
@@ -177,6 +176,7 @@ class CORE_EXPORT LocalFrameView final
   bool HasOrthogonalWritingModeRoots() const;
   void LayoutOrthogonalWritingModeRoots();
   void ScheduleOrthogonalWritingModeRootsForLayout();
+  void MarkOrthogonalWritingModeRootsForLayout();
 
   unsigned LayoutCountForTesting() const { return layout_count_for_testing_; }
   unsigned LifecycleUpdateCountForTesting() const {
@@ -275,16 +275,16 @@ class CORE_EXPORT LocalFrameView final
   void SetMediaType(const AtomicString&);
   void AdjustMediaTypeForPrinting(bool printing);
 
-  blink::mojom::DisplayMode DisplayMode() { return display_mode_; }
-  void SetDisplayMode(blink::mojom::DisplayMode);
-
   DisplayShape GetDisplayShape() { return display_shape_; }
   void SetDisplayShape(DisplayShape);
 
-  // Fixed-position objects.
+  // For any viewport-constrained object, we need to know if it's due to fixed
+  // or sticky so that we can support HasStickyViewportConstrainedObject().
+  enum ViewportConstrainedType { kFixed = 0, kSticky = 1 };
+  // Fixed-position and viewport-constrained sticky-position objects.
   typedef HashSet<LayoutObject*> ObjectSet;
-  void AddViewportConstrainedObject(LayoutObject&);
-  void RemoveViewportConstrainedObject(LayoutObject&);
+  void AddViewportConstrainedObject(LayoutObject&, ViewportConstrainedType);
+  void RemoveViewportConstrainedObject(LayoutObject&, ViewportConstrainedType);
   const ObjectSet* ViewportConstrainedObjects() const {
     return viewport_constrained_objects_.get();
   }
@@ -292,6 +292,12 @@ class CORE_EXPORT LocalFrameView final
     return viewport_constrained_objects_ &&
            viewport_constrained_objects_->size() > 0;
   }
+  // Returns true if any of the objects in viewport_constrained_objects_ are
+  // sticky position.
+  bool HasStickyViewportConstrainedObject() const {
+    DCHECK(!sticky_position_object_count_ || HasViewportConstrainedObjects());
+    return sticky_position_object_count_ > 0;
+  }
 
   // Objects with background-attachment:fixed.
   void AddBackgroundAttachmentFixedObject(LayoutObject*);
@@ -726,7 +732,7 @@ class CORE_EXPORT LocalFrameView final
     ~DisallowLayoutInvalidationScope();
 
    private:
-    UntracedMember<LocalFrameView> local_frame_view_;
+    LocalFrameView* local_frame_view_;
   };
 #endif
 
@@ -845,7 +851,9 @@ class CORE_EXPORT LocalFrameView final
 
   PaintController* GetPaintController() { return paint_controller_.get(); }
 
-  void LayoutFromRootObject(LayoutObject& root);
+  // Returns true if the root object was laid out. Returns false if the layout
+  // was prevented (e.g. by ancestor display-lock) or not needed.
+  bool LayoutFromRootObject(LayoutObject& root);
 
   void UpdateLayerDebugInfoEnabled();
 
@@ -853,6 +861,8 @@ class CORE_EXPORT LocalFrameView final
   // necessary.
   OverlayInterstitialAdDetector& EnsureOverlayInterstitialAdDetector();
 
+  WTF::Vector<const TransformPaintPropertyNode*> GetScrollTranslationNodes();
+
   LayoutSize size_;
 
   typedef HashSet<scoped_refptr<LayoutEmbeddedObject>> EmbeddedObjectSet;
@@ -860,8 +870,6 @@ class CORE_EXPORT LocalFrameView final
 
   Member<LocalFrame> frame_;
 
-  blink::mojom::DisplayMode display_mode_;
-
   DisplayShape display_shape_;
 
   bool can_have_scrollbars_;
@@ -897,6 +905,7 @@ class CORE_EXPORT LocalFrameView final
   Member<ScrollableAreaSet> scrollable_areas_;
   Member<ScrollableAreaSet> animating_scrollable_areas_;
   std::unique_ptr<ObjectSet> viewport_constrained_objects_;
+  // Number of entries in viewport_constrained_objects_ that are sticky.
   unsigned sticky_position_object_count_;
   ObjectSet background_attachment_fixed_objects_;
   Member<FrameViewAutoSizeInfo> auto_size_info_;
@@ -994,7 +1003,7 @@ class CORE_EXPORT LocalFrameView final
   size_t paint_frame_count_;
 
   UniqueObjectId unique_id_;
-  std::unique_ptr<LayoutShiftTracker> layout_shift_tracker_;
+  Member<LayoutShiftTracker> layout_shift_tracker_;
   Member<PaintTimingDetector> paint_timing_detector_;
 
   HeapHashSet<WeakMember<LifecycleNotificationObserver>> lifecycle_observers_;
diff --git a/chromium/third_party/blink/renderer/core/frame/local_frame_view_test.cc b/chromium/third_party/blink/renderer/core/frame/local_frame_view_test.cc
index eae22851688..73c958ac79d 100644
--- a/chromium/third_party/blink/renderer/core/frame/local_frame_view_test.cc
+++ b/chromium/third_party/blink/renderer/core/frame/local_frame_view_test.cc
@@ -344,7 +344,7 @@ TEST_F(SimTest, FragmentNavChangesFocusWhileRenderingBlocked) {
       << "Scroll offset changed while rendering is blocked";
 
   // Force a layout.
-  anchor->style()->setProperty(GetDocument().ToExecutionContext(), "display",
+  anchor->style()->setProperty(GetDocument().GetExecutionContext(), "display",
                                "block", String(), ASSERT_NO_EXCEPTION);
   GetDocument().UpdateStyleAndLayout(DocumentUpdateReason::kTest);
 
diff --git a/chromium/third_party/blink/renderer/core/frame/location.cc b/chromium/third_party/blink/renderer/core/frame/location.cc
index 63deafc4f52..ec10b320410 100644
--- a/chromium/third_party/blink/renderer/core/frame/location.cc
+++ b/chromium/third_party/blink/renderer/core/frame/location.cc
@@ -103,6 +103,7 @@ String Location::origin() const {
 }
 
 FragmentDirective* Location::fragmentDirective() const {
+  GetDocument()->CountUse(WebFeature::kLocationFragmentDirectiveAccessed);
   return fragment_directive_;
 }
 
diff --git a/chromium/third_party/blink/renderer/core/frame/location_report_body.cc b/chromium/third_party/blink/renderer/core/frame/location_report_body.cc
index 6525fb03152..5e37642db22 100644
--- a/chromium/third_party/blink/renderer/core/frame/location_report_body.cc
+++ b/chromium/third_party/blink/renderer/core/frame/location_report_body.cc
@@ -6,21 +6,35 @@
 
 namespace blink {
 
+// static
+LocationReportBody::ReportLocation LocationReportBody::CreateReportLocation(
+    const String& file,
+    base::Optional<uint32_t> line_number,
+    base::Optional<uint32_t> column_number) {
+  return file.IsEmpty() ? CreateReportLocation(SourceLocation::Capture())
+                        : ReportLocation{file, line_number, column_number};
+}
+
+// static
+LocationReportBody::ReportLocation LocationReportBody::CreateReportLocation(
+    std::unique_ptr<SourceLocation> location) {
+  return location->IsUnknown()
+             ? ReportLocation{}
+             : ReportLocation{location->Url(), location->LineNumber(),
+                              location->ColumnNumber()};
+}
+
 void LocationReportBody::BuildJSONValue(V8ObjectBuilder& builder) const {
   builder.AddStringOrNull("sourceFile", sourceFile());
-  bool is_null = false;
-  uint32_t line_number = lineNumber(is_null);
-  if (is_null) {
-    builder.AddNull("lineNumber");
+  if (lineNumber()) {
+    builder.AddNumber("lineNumber", lineNumber().value());
   } else {
-    builder.AddNumber("lineNumber", line_number);
+    builder.AddNull("lineNumber");
   }
-  is_null = true;
-  uint32_t column_number = columnNumber(is_null);
-  if (is_null) {
-    builder.AddNull("columnNumber");
+  if (columnNumber()) {
+    builder.AddNumber("columnNumber", columnNumber().value());
   } else {
-    builder.AddNumber("columnNumber", column_number);
+    builder.AddNull("columnNumber");
   }
 }
 
diff --git a/chromium/third_party/blink/renderer/core/frame/location_report_body.h b/chromium/third_party/blink/renderer/core/frame/location_report_body.h
index c7f86ba18ed..67237e188a2 100644
--- a/chromium/third_party/blink/renderer/core/frame/location_report_body.h
+++ b/chromium/third_party/blink/renderer/core/frame/location_report_body.h
@@ -15,25 +15,38 @@
 namespace blink {
 
 class CORE_EXPORT LocationReportBody : public ReportBody {
- public:
+ private:
+  struct ReportLocation {
+    String file;
+    base::Optional<uint32_t> line_number;
+    base::Optional<uint32_t> column_number;
+  };
+
+  static ReportLocation CreateReportLocation(
+      const String& file,
+      base::Optional<uint32_t> line_number,
+      base::Optional<uint32_t> column_number);
+
+  static ReportLocation CreateReportLocation(
+      std::unique_ptr<SourceLocation> location);
+
+  explicit LocationReportBody(const ReportLocation& location)
+      : source_file_(location.file),
+        line_number_(location.line_number),
+        column_number_(location.column_number) {}
+
+ protected:
   explicit LocationReportBody(std::unique_ptr<SourceLocation> location)
-      : source_file_(location->Url()),
-        line_number_(location->IsUnknown()
-                         ? base::nullopt
-                         : base::make_optional(location->LineNumber())),
-        column_number_(location->IsUnknown()
-                           ? base::nullopt
-                           : base::make_optional(location->ColumnNumber())) {}
-
-  LocationReportBody() : LocationReportBody(SourceLocation::Capture()) {}
-
-  LocationReportBody(const String& source_file,
-                     base::Optional<uint32_t> line_number = base::nullopt,
-                     base::Optional<uint32_t> column_number = base::nullopt)
-      : source_file_(source_file),
-        line_number_(line_number),
-        column_number_(column_number) {}
+      : LocationReportBody(CreateReportLocation(std::move(location))) {}
+
+  explicit LocationReportBody(
+      const String& source_file = g_empty_string,
+      base::Optional<uint32_t> line_number = base::nullopt,
+      base::Optional<uint32_t> column_number = base::nullopt)
+      : LocationReportBody(
+            CreateReportLocation(source_file, line_number, column_number)) {}
 
+ public:
   ~LocationReportBody() override = default;
 
   const String& sourceFile() const { return source_file_; }
@@ -41,16 +54,6 @@ class CORE_EXPORT LocationReportBody : public ReportBody {
   base::Optional<uint32_t> lineNumber() const { return line_number_; }
   base::Optional<uint32_t> columnNumber() const { return column_number_; }
 
-  // TODO(crbug.com/1060971): Remove |is_null| version.
-  uint32_t lineNumber(bool& is_null) const {  // DEPRECATED
-    is_null = !line_number_.has_value();
-    return line_number_.value_or(0);
-  }
-  uint32_t columnNumber(bool& is_null) const {  // DEPRECATED
-    is_null = !column_number_.has_value();
-    return column_number_.value_or(0);
-  }
-
   void BuildJSONValue(V8ObjectBuilder& builder) const override;
 
  protected:
diff --git a/chromium/third_party/blink/renderer/core/frame/mhtml_loading_test.cc b/chromium/third_party/blink/renderer/core/frame/mhtml_loading_test.cc
index b73fafeae55..2c22e859220 100644
--- a/chromium/third_party/blink/renderer/core/frame/mhtml_loading_test.cc
+++ b/chromium/third_party/blink/renderer/core/frame/mhtml_loading_test.cc
@@ -30,6 +30,8 @@
 
 #include "base/bind_helpers.h"
 #include "build/build_config.h"
+#include "services/network/public/cpp/web_sandbox_flags.h"
+#include "services/network/public/mojom/web_sandbox_flags.mojom-blink.h"
 #include "testing/gtest/include/gtest/gtest.h"
 #include "third_party/blink/public/platform/web_string.h"
 #include "third_party/blink/public/platform/web_url.h"
@@ -119,9 +121,9 @@ TEST_F(MHTMLLoadingTest, EnforceSandboxFlags) {
 
   // Full sandboxing with the exception to new top-level windows should be
   // turned on.
-  EXPECT_EQ(mojom::blink::WebSandboxFlags::kAll &
-                ~(mojom::blink::WebSandboxFlags::kPopups |
-                  mojom::blink::WebSandboxFlags::
+  EXPECT_EQ(network::mojom::blink::WebSandboxFlags::kAll &
+                ~(network::mojom::blink::WebSandboxFlags::kPopups |
+                  network::mojom::blink::WebSandboxFlags::
                       kPropagatesToAuxiliaryBrowsingContexts),
             document->GetSandboxFlags());
 
@@ -140,9 +142,9 @@ TEST_F(MHTMLLoadingTest, EnforceSandboxFlags) {
   Document* child_document = child_frame->GetDocument();
   ASSERT_TRUE(child_document);
 
-  EXPECT_EQ(mojom::blink::WebSandboxFlags::kAll &
-                ~(mojom::blink::WebSandboxFlags::kPopups |
-                  mojom::blink::WebSandboxFlags::
+  EXPECT_EQ(network::mojom::blink::WebSandboxFlags::kAll &
+                ~(network::mojom::blink::WebSandboxFlags::kPopups |
+                  network::mojom::blink::WebSandboxFlags::
                       kPropagatesToAuxiliaryBrowsingContexts),
             child_document->GetSandboxFlags());
 
@@ -167,9 +169,9 @@ TEST_F(MHTMLLoadingTest, EnforceSandboxFlagsInXSLT) {
 
   // Full sandboxing with the exception to new top-level windows should be
   // turned on.
-  EXPECT_EQ(mojom::blink::WebSandboxFlags::kAll &
-                ~(mojom::blink::WebSandboxFlags::kPopups |
-                  mojom::blink::WebSandboxFlags::
+  EXPECT_EQ(network::mojom::blink::WebSandboxFlags::kAll &
+                ~(network::mojom::blink::WebSandboxFlags::kPopups |
+                  network::mojom::blink::WebSandboxFlags::
                       kPropagatesToAuxiliaryBrowsingContexts),
             document->GetSandboxFlags());
 
@@ -189,7 +191,6 @@ TEST_F(MHTMLLoadingTest, ShadowDom) {
   Document* document = frame->GetDocument();
   ASSERT_TRUE(document);
 
-  EXPECT_TRUE(IsShadowHost(document->getElementById("h1")));
   EXPECT_TRUE(IsShadowHost(document->getElementById("h2")));
   // The nested shadow DOM tree is created.
   EXPECT_TRUE(IsShadowHost(
diff --git a/chromium/third_party/blink/renderer/core/frame/navigator.cc b/chromium/third_party/blink/renderer/core/frame/navigator.cc
index f00fb00e14c..8918712cc0a 100644
--- a/chromium/third_party/blink/renderer/core/frame/navigator.cc
+++ b/chromium/third_party/blink/renderer/core/frame/navigator.cc
@@ -26,6 +26,7 @@
 #include "third_party/blink/public/common/user_agent/user_agent_metadata.h"
 #include "third_party/blink/renderer/bindings/core/v8/script_controller.h"
 #include "third_party/blink/renderer/core/dom/document.h"
+#include "third_party/blink/renderer/core/frame/local_dom_window.h"
 #include "third_party/blink/renderer/core/frame/local_frame.h"
 #include "third_party/blink/renderer/core/frame/navigator_id.h"
 #include "third_party/blink/renderer/core/frame/settings.h"
@@ -38,9 +39,8 @@
 namespace blink {
 
 Navigator::Navigator(LocalFrame* frame)
-    : NavigatorLanguage(frame ? frame->GetDocument()->ToExecutionContext()
-                              : nullptr),
-      DOMWindowClient(frame) {}
+    : NavigatorLanguage(frame ? frame->DomWindow() : nullptr),
+      ExecutionContextClient(frame) {}
 
 String Navigator::productSub() const {
   return "20030107";
@@ -117,7 +117,7 @@ String Navigator::GetAcceptLanguages() {
 void Navigator::Trace(Visitor* visitor) {
   ScriptWrappable::Trace(visitor);
   NavigatorLanguage::Trace(visitor);
-  DOMWindowClient::Trace(visitor);
+  ExecutionContextClient::Trace(visitor);
   Supplementable<Navigator>::Trace(visitor);
 }
 
diff --git a/chromium/third_party/blink/renderer/core/frame/navigator.h b/chromium/third_party/blink/renderer/core/frame/navigator.h
index b01e1a2c6f0..4a4dd79a03f 100644
--- a/chromium/third_party/blink/renderer/core/frame/navigator.h
+++ b/chromium/third_party/blink/renderer/core/frame/navigator.h
@@ -45,7 +45,7 @@ class CORE_EXPORT Navigator final : public ScriptWrappable,
                                     public NavigatorLanguage,
                                     public NavigatorOnLine,
                                     public NavigatorUA,
-                                    public DOMWindowClient,
+                                    public ExecutionContextClient,
                                     public Supplementable<Navigator> {
   DEFINE_WRAPPERTYPEINFO();
   USING_GARBAGE_COLLECTED_MIXIN(Navigator);
diff --git a/chromium/third_party/blink/renderer/core/frame/navigator_automation_information.idl b/chromium/third_party/blink/renderer/core/frame/navigator_automation_information.idl
index 263575eabe4..3d7ca44799b 100644
--- a/chromium/third_party/blink/renderer/core/frame/navigator_automation_information.idl
+++ b/chromium/third_party/blink/renderer/core/frame/navigator_automation_information.idl
@@ -5,7 +5,6 @@
 // https://w3c.github.io/webdriver/#interface
 
 [
-    Exposed=Window,
     RuntimeEnabled=AutomationControlled
 ] interface mixin NavigatorAutomationInformation {
     readonly attribute boolean webdriver;
diff --git a/chromium/third_party/blink/renderer/core/frame/navigator_concurrent_hardware.idl b/chromium/third_party/blink/renderer/core/frame/navigator_concurrent_hardware.idl
index f10248c815f..3bb78d4b00c 100644
--- a/chromium/third_party/blink/renderer/core/frame/navigator_concurrent_hardware.idl
+++ b/chromium/third_party/blink/renderer/core/frame/navigator_concurrent_hardware.idl
@@ -4,8 +4,6 @@
 
 // https://html.spec.whatwg.org/C/#navigator.hardwareconcurrency
 
-[
-    Exposed=(Window, Worker)
-] interface mixin NavigatorConcurrentHardware {
+interface mixin NavigatorConcurrentHardware {
     [HighEntropy, MeasureAs=NavigatorHardwareConcurrency] readonly attribute unsigned long long hardwareConcurrency;
 };
diff --git a/chromium/third_party/blink/renderer/core/frame/navigator_cookies.idl b/chromium/third_party/blink/renderer/core/frame/navigator_cookies.idl
index 3909adb7bc6..a231a8627bc 100644
--- a/chromium/third_party/blink/renderer/core/frame/navigator_cookies.idl
+++ b/chromium/third_party/blink/renderer/core/frame/navigator_cookies.idl
@@ -5,5 +5,6 @@
 // https://html.spec.whatwg.org/C/#cookies
 
 interface mixin NavigatorCookies {
+  [HighEntropy,MeasureAs=NavigatorCookieEnabled]
   readonly attribute boolean cookieEnabled;
 };
diff --git a/chromium/third_party/blink/renderer/core/frame/navigator_device_memory.idl b/chromium/third_party/blink/renderer/core/frame/navigator_device_memory.idl
index 76295186c35..8f2f283a210 100644
--- a/chromium/third_party/blink/renderer/core/frame/navigator_device_memory.idl
+++ b/chromium/third_party/blink/renderer/core/frame/navigator_device_memory.idl
@@ -4,9 +4,7 @@
 
 // https://github.com/w3c/device-memory#the-web-exposed-api
 
-[
-    Exposed=(Window, Worker)
-] interface mixin NavigatorDeviceMemory {
+interface mixin NavigatorDeviceMemory {
     [HighEntropy,MeasureAs=NavigatorDeviceMemory,SecureContext]
     readonly attribute float deviceMemory;
 };
diff --git a/chromium/third_party/blink/renderer/core/frame/navigator_id.idl b/chromium/third_party/blink/renderer/core/frame/navigator_id.idl
index 803f5e25f5a..8eb98208c8d 100644
--- a/chromium/third_party/blink/renderer/core/frame/navigator_id.idl
+++ b/chromium/third_party/blink/renderer/core/frame/navigator_id.idl
@@ -30,9 +30,7 @@
 
 // https://html.spec.whatwg.org/C/#client-identification
 
-[
-    Exposed=(Window,Worker)
-] interface mixin NavigatorID {
+interface mixin NavigatorID {
     readonly attribute DOMString appCodeName; // constant "Mozilla"
     readonly attribute DOMString appName; // constant "Netscape"
     [HighEntropy, MeasureAs=NavigatorAppVersion] readonly attribute DOMString appVersion;
diff --git a/chromium/third_party/blink/renderer/core/frame/navigator_language.idl b/chromium/third_party/blink/renderer/core/frame/navigator_language.idl
index cba24ed03cb..a5a08667c91 100644
--- a/chromium/third_party/blink/renderer/core/frame/navigator_language.idl
+++ b/chromium/third_party/blink/renderer/core/frame/navigator_language.idl
@@ -4,9 +4,7 @@
 
 // https://html.spec.whatwg.org/C/#language-preferences
 
-[
-    Exposed=(Window, Worker)
-] interface mixin NavigatorLanguage {
+interface mixin NavigatorLanguage {
     [HighEntropy, MeasureAs=NavigatorLanguage] readonly attribute DOMString language;
     [CachedAttribute=IsLanguagesDirty, HighEntropy, MeasureAs=NavigatorLanguages] readonly attribute FrozenArray<DOMString> languages;
 };
diff --git a/chromium/third_party/blink/renderer/core/frame/navigator_on_line.idl b/chromium/third_party/blink/renderer/core/frame/navigator_on_line.idl
index 4fcfb1344dc..63a987cf5dc 100644
--- a/chromium/third_party/blink/renderer/core/frame/navigator_on_line.idl
+++ b/chromium/third_party/blink/renderer/core/frame/navigator_on_line.idl
@@ -30,8 +30,6 @@
 
 // https://html.spec.whatwg.org/C/#navigator.online
 
-[
-    Exposed=(Window,Worker)
-] interface mixin NavigatorOnLine {
+interface mixin NavigatorOnLine {
     readonly attribute boolean onLine;
 };
diff --git a/chromium/third_party/blink/renderer/core/frame/navigator_scheduling.idl b/chromium/third_party/blink/renderer/core/frame/navigator_scheduling.idl
index 76d9e9b75a5..69c476d8b7f 100644
--- a/chromium/third_party/blink/renderer/core/frame/navigator_scheduling.idl
+++ b/chromium/third_party/blink/renderer/core/frame/navigator_scheduling.idl
@@ -2,9 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// https://github.com/tdresser/is-input-pending
+// https://github.com/WICG/is-input-pending
 [
-    Exposed=Window,
     ImplementedAs=NavigatorScheduling,
     RuntimeEnabled=ExperimentalIsInputPending
 ] partial interface Navigator {
diff --git a/chromium/third_party/blink/renderer/core/frame/navigator_ua.cc b/chromium/third_party/blink/renderer/core/frame/navigator_ua.cc
index 09d4cd858c3..f19b1b83a10 100644
--- a/chromium/third_party/blink/renderer/core/frame/navigator_ua.cc
+++ b/chromium/third_party/blink/renderer/core/frame/navigator_ua.cc
@@ -11,8 +11,7 @@ NavigatorUAData* NavigatorUA::userAgentData() {
       MakeGarbageCollected<NavigatorUAData>(GetUAExecutionContext());
 
   UserAgentMetadata metadata = GetUserAgentMetadata();
-  ua_data->AddBrand(String::FromUTF8(metadata.brand),
-                    String::FromUTF8(metadata.major_version));
+  ua_data->SetBrandVersionList(metadata.brand_version_list);
   ua_data->SetMobile(metadata.mobile);
   ua_data->SetPlatform(String::FromUTF8(metadata.platform),
                        String::FromUTF8(metadata.platform_version));
diff --git a/chromium/third_party/blink/renderer/core/frame/navigator_ua_data.cc b/chromium/third_party/blink/renderer/core/frame/navigator_ua_data.cc
index c0c00cbc876..050c34a84ae 100644
--- a/chromium/third_party/blink/renderer/core/frame/navigator_ua_data.cc
+++ b/chromium/third_party/blink/renderer/core/frame/navigator_ua_data.cc
@@ -4,6 +4,7 @@
 
 #include "third_party/blink/renderer/core/frame/navigator_ua_data.h"
 
+#include "base/single_thread_task_runner.h"
 #include "third_party/blink/renderer/bindings/core/v8/script_promise_resolver.h"
 #include "third_party/blink/renderer/bindings/core/v8/v8_ua_data_values.h"
 #include "third_party/blink/renderer/core/page/page.h"
@@ -18,13 +19,22 @@ NavigatorUAData::NavigatorUAData(ExecutionContext* context)
   empty_brand_set_.push_back(dict);
 }
 
-void NavigatorUAData::AddBrand(const String& brand, const String& version) {
+void NavigatorUAData::AddBrandVersion(const String& brand,
+                                      const String& version) {
   NavigatorUABrandVersion* dict = NavigatorUABrandVersion::Create();
   dict->setBrand(brand);
   dict->setVersion(version);
   brand_set_.push_back(dict);
 }
 
+void NavigatorUAData::SetBrandVersionList(
+    const UserAgentBrandList& brand_version_list) {
+  for (const auto& brand_version : brand_version_list) {
+    AddBrandVersion(String::FromUTF8(brand_version.brand),
+                    String::FromUTF8(brand_version.major_version));
+  }
+}
+
 void NavigatorUAData::SetMobile(bool mobile) {
   is_mobile_ = mobile;
 }
@@ -53,7 +63,7 @@ bool NavigatorUAData::mobile() const {
   return false;
 }
 
-const HeapVector<Member<NavigatorUABrandVersion>>& NavigatorUAData::uaList()
+const HeapVector<Member<NavigatorUABrandVersion>>& NavigatorUAData::brands()
     const {
   if (GetExecutionContext()) {
     return brand_set_;
@@ -66,6 +76,8 @@ ScriptPromise NavigatorUAData::getHighEntropyValues(
     Vector<String>& hints) const {
   auto* resolver = MakeGarbageCollected<ScriptPromiseResolver>(script_state);
   ScriptPromise promise = resolver->Promise();
+  auto* executionContext =
+      ExecutionContext::From(script_state);  // GetExecutionContext();
   UADataValues* values = MakeGarbageCollected<UADataValues>();
   for (const String& hint : hints) {
     if (hint == "platform") {
@@ -80,7 +92,15 @@ ScriptPromise NavigatorUAData::getHighEntropyValues(
       values->setUaFullVersion(ua_full_version_);
     }
   }
-  resolver->Resolve(values);
+
+  DCHECK(executionContext);
+  executionContext->GetTaskRunner(TaskType::kPermission)
+      ->PostTask(
+          FROM_HERE,
+          WTF::Bind([](ScriptPromiseResolver* resolver,
+                       UADataValues* values) { resolver->Resolve(values); },
+                    WrapPersistent(resolver), WrapPersistent(values)));
+
   return promise;
 }
 
diff --git a/chromium/third_party/blink/renderer/core/frame/navigator_ua_data.h b/chromium/third_party/blink/renderer/core/frame/navigator_ua_data.h
index 49e69793312..e14afb7d942 100644
--- a/chromium/third_party/blink/renderer/core/frame/navigator_ua_data.h
+++ b/chromium/third_party/blink/renderer/core/frame/navigator_ua_data.h
@@ -5,6 +5,7 @@
 #ifndef THIRD_PARTY_BLINK_RENDERER_CORE_FRAME_NAVIGATOR_UA_DATA_H_
 #define THIRD_PARTY_BLINK_RENDERER_CORE_FRAME_NAVIGATOR_UA_DATA_H_
 
+#include "third_party/blink/public/common/user_agent/user_agent_metadata.h"
 #include "third_party/blink/renderer/bindings/core/v8/script_promise.h"
 #include "third_party/blink/renderer/bindings/core/v8/v8_navigator_ua_brand_version.h"
 #include "third_party/blink/renderer/core/execution_context/execution_context_lifecycle_observer.h"
@@ -13,6 +14,7 @@
 
 namespace blink {
 
+class NavigatorUABrandVersion;
 class ScriptState;
 
 class NavigatorUAData : public ScriptWrappable, ExecutionContextClient {
@@ -26,7 +28,7 @@ class NavigatorUAData : public ScriptWrappable, ExecutionContextClient {
 
   explicit NavigatorUAData(ExecutionContext* context);
 
-  void AddBrand(const String& brand, const String& version);
+  void SetBrandVersionList(const UserAgentBrandList& brand_version_list);
   void SetMobile(bool mobile);
   void SetPlatform(const String& brand, const String& version);
   void SetArchitecture(const String& architecture);
@@ -34,7 +36,7 @@ class NavigatorUAData : public ScriptWrappable, ExecutionContextClient {
   void SetUAFullVersion(const String& uaFullVersion);
 
   // IDL implementation
-  const HeapVector<Member<NavigatorUABrandVersion>>& uaList() const;
+  const HeapVector<Member<NavigatorUABrandVersion>>& brands() const;
   bool mobile() const;
   ScriptPromise getHighEntropyValues(ScriptState*, Vector<String>&) const;
 
@@ -49,6 +51,8 @@ class NavigatorUAData : public ScriptWrappable, ExecutionContextClient {
   String architecture_;
   String model_;
   String ua_full_version_;
+
+  void AddBrandVersion(const String& brand, const String& version);
 };
 
 }  // namespace blink
diff --git a/chromium/third_party/blink/renderer/core/frame/navigator_ua_data.idl b/chromium/third_party/blink/renderer/core/frame/navigator_ua_data.idl
index 5e0e6a10f20..17d29118034 100644
--- a/chromium/third_party/blink/renderer/core/frame/navigator_ua_data.idl
+++ b/chromium/third_party/blink/renderer/core/frame/navigator_ua_data.idl
@@ -8,7 +8,7 @@
     RuntimeEnabled=UserAgentClientHint,
     Exposed=(Window,Worker)
 ] interface NavigatorUAData {
-  readonly attribute FrozenArray<NavigatorUABrandVersion> uaList;
+  readonly attribute FrozenArray<NavigatorUABrandVersion> brands;
   readonly attribute boolean mobile;
   [CallWith=ScriptState] Promise<UADataValues> getHighEntropyValues(sequence<DOMString> hints);
 };
diff --git a/chromium/third_party/blink/renderer/core/frame/overlay_interstitial_ad_detector.cc b/chromium/third_party/blink/renderer/core/frame/overlay_interstitial_ad_detector.cc
index 3c699046130..9d343f2fded 100644
--- a/chromium/third_party/blink/renderer/core/frame/overlay_interstitial_ad_detector.cc
+++ b/chromium/third_party/blink/renderer/core/frame/overlay_interstitial_ad_detector.cc
@@ -4,12 +4,14 @@
 
 #include "third_party/blink/renderer/core/frame/overlay_interstitial_ad_detector.h"
 
+#include "third_party/blink/renderer/core/dom/dom_node_ids.h"
 #include "third_party/blink/renderer/core/frame/local_frame.h"
 #include "third_party/blink/renderer/core/html/html_frame_owner_element.h"
 #include "third_party/blink/renderer/core/html/html_image_element.h"
 #include "third_party/blink/renderer/core/layout/layout_object.h"
 #include "third_party/blink/renderer/core/layout/layout_object_inlines.h"
 #include "third_party/blink/renderer/core/layout/layout_view.h"
+#include "third_party/blink/renderer/core/paint/first_meaningful_paint_detector.h"
 #include "third_party/blink/renderer/core/scroll/scrollable_area.h"
 
 namespace blink {
@@ -17,6 +19,7 @@ namespace blink {
 namespace {
 
 constexpr base::TimeDelta kFireInterval = base::TimeDelta::FromSeconds(1);
+constexpr double kLargeAdSizeToViewportSizeThreshold = 0.1;
 
 bool IsIframeAd(Element* element) {
   HTMLFrameOwnerElement* frame_owner_element =
@@ -69,7 +72,7 @@ bool IsImmobileAndCanOverlapWithOtherContent(Element* element) {
   return false;
 }
 
-bool IsInterstitialAd(Element* element) {
+bool IsOverlayAdCandidate(Element* element) {
   return (IsIframeAd(element) || IsImageAd(element)) &&
          IsImmobileAndCanOverlapWithOtherContent(element);
 }
@@ -86,24 +89,106 @@ void OverlayInterstitialAdDetector::MaybeFireDetection(LocalFrame* main_frame) {
   DCHECK(main_frame->ContentLayoutObject());
 
   base::Time current_time = base::Time::Now();
-  if (!last_detection_time_.has_value() ||
-      current_time - last_detection_time_.value() >= kFireInterval) {
-    IntSize main_frame_size =
-        main_frame->View()->GetScrollableArea()->VisibleContentRect().Size();
+
+  if (!started_detection_ ||
+      current_time - last_detection_time_ >= kFireInterval) {
+    IntSize main_frame_size = main_frame->GetMainFrameViewportSize();
+
+    if (started_detection_ &&
+        main_frame_size != last_detection_main_frame_size_) {
+      // Reset the candidate when the the viewport size has changed. Changing
+      // the viewport size could influence the layout and may trick the detector
+      // into believing that an element appeared and was dismissed, but what
+      // could have happened is that the element no longer covers the center,
+      // but still exists (e.g. a sticky ad at the top).
+      candidate_id_ = kInvalidDOMNodeId;
+    }
+
     HitTestLocation location(DoublePoint(main_frame_size.Width() / 2.0,
                                          main_frame_size.Height() / 2.0));
     HitTestResult result;
     main_frame->ContentLayoutObject()->HitTestNoLifecycleUpdate(location,
                                                                 result);
+    started_detection_ = true;
+
+    last_detection_time_ = current_time;
+    last_detection_main_frame_size_ = main_frame_size;
+
     Element* element = result.InnerElement();
+    if (!element)
+      return;
+
+    DOMNodeId element_id = DOMNodeIds::IdForNode(element);
+
+    bool is_new_element = (element_id != candidate_id_);
+
+    if (is_new_element && candidate_id_ != kInvalidDOMNodeId) {
+      // If the main frame scrolling offset hasn't changed since the candidate's
+      // appearance, we consider it to be a overlay interstitial; otherwise, we
+      // skip that candidate because it could be a parallax/scroller ad.
+      if (main_frame->GetMainFrameScrollOffset().Y() ==
+          candidate_start_main_frame_scroll_offset_) {
+        OnPopupAdDetected(main_frame);
+        return;
+      }
+      last_unqualified_element_id_ = candidate_id_;
+      candidate_id_ = kInvalidDOMNodeId;
+    }
 
-    if (element && IsInterstitialAd(element)) {
-      UseCounter::Count(main_frame->GetDocument(),
-                        WebFeature::kOverlayInterstitialAd);
-      done_detection_ = true;
+    if (!is_new_element)
+      return;
+
+    if (element_id == last_unqualified_element_id_)
+      return;
+
+    if (!element->GetLayoutObject())
+      return;
+
+    // Skip considering the overlay for a pop-up candidate if we haven't seen or
+    // have just seen the first meaningful paint. If we have just seen the first
+    // meaningful paint, however, we would consider future overlays for pop-up
+    // candidates.
+    if (!main_content_has_loaded_) {
+      if (FirstMeaningfulPaintDetector::From(*(main_frame->GetDocument()))
+              .SeenFirstMeaningfulPaint()) {
+        main_content_has_loaded_ = true;
+      }
+      last_unqualified_element_id_ = element_id;
+      return;
+    }
+
+    IntRect overlay_rect =
+        element->GetLayoutObject()->AbsoluteBoundingBoxRect();
+
+    bool is_large =
+        !overlay_rect.IsEmpty() &&
+        (overlay_rect.Size().Area() >
+         main_frame_size.Area() * kLargeAdSizeToViewportSizeThreshold);
+
+    bool has_gesture = LocalFrame::HasTransientUserActivation(main_frame);
+
+    if (!has_gesture && is_large && IsOverlayAdCandidate(element)) {
+      // If main page is not scrollable, immediately determinine the overlay
+      // to be a popup. There's is no need to check any state at the dismissal
+      // time.
+      if (!main_frame->GetDocument()
+               ->GetLayoutView()
+               ->HasScrollableOverflowY()) {
+        OnPopupAdDetected(main_frame);
+        return;
+      }
+      candidate_id_ = element_id;
+      candidate_start_main_frame_scroll_offset_ =
+          main_frame->GetMainFrameScrollOffset().Y();
+    } else {
+      last_unqualified_element_id_ = element_id;
     }
-    last_detection_time_ = current_time;
   }
 }
 
+void OverlayInterstitialAdDetector::OnPopupAdDetected(LocalFrame* main_frame) {
+  UseCounter::Count(main_frame->GetDocument(), WebFeature::kOverlayPopupAd);
+  done_detection_ = true;
+}
+
 }  // namespace blink
diff --git a/chromium/third_party/blink/renderer/core/frame/overlay_interstitial_ad_detector.h b/chromium/third_party/blink/renderer/core/frame/overlay_interstitial_ad_detector.h
index eb81875e614..e3a2bb379a2 100644
--- a/chromium/third_party/blink/renderer/core/frame/overlay_interstitial_ad_detector.h
+++ b/chromium/third_party/blink/renderer/core/frame/overlay_interstitial_ad_detector.h
@@ -5,23 +5,79 @@
 #ifndef THIRD_PARTY_BLINK_RENDERER_CORE_FRAME_OVERLAY_INTERSTITIAL_AD_DETECTOR_H_
 #define THIRD_PARTY_BLINK_RENDERER_CORE_FRAME_OVERLAY_INTERSTITIAL_AD_DETECTOR_H_
 
-#include "base/optional.h"
+#include "base/macros.h"
 #include "base/time/time.h"
 #include "third_party/blink/renderer/core/core_export.h"
+#include "third_party/blink/renderer/platform/geometry/int_size.h"
+#include "third_party/blink/renderer/platform/graphics/dom_node_id.h"
 
 namespace blink {
 
 class LocalFrame;
 
+// Detects overlay interstitials and record a use counter when an instance is
+// found. The current scope is to consider only pop-ups, which appear after
+// content on the page begins to load.
+//
+// Better Ads Standards definition:
+// https://www.betterads.org/desktop-pop-up-ad/
+// https://www.betterads.org/mobile-pop-up-ad/
+//
+// Heuristic:
+// We do hit testing at the center of the browser viewport at regular intervals.
+// The top element is an interstitial pop-up candidate if the following
+// conditions are met:
+// 1) It's immobile to scrolling (e.g. position:fixed).
+// 2) The size is large.
+// 3) It's created without user gesture.
+// 4) It's created after the main content has loaded.
+//
+// The candidate will be actually counted as an overlay pop-up instance after we
+// have checked some status at its dismissal time. On dismissal, if the main
+// frame scrolling offset hasn't changed since the candidate's appearance, we
+// count it as an overlay pop-up; otherwise, we skip that candidate because it
+// could be a parallax/scroller ad.
+//
+// We could potentially miss some true positive cases: the user could click at
+// an empty space which activates the user gesture, and coincidentally the
+// pop-up automatically shows up; the user could make some scrolling
+// before closing the pop-up; etc. However, we accept the trade-off exchanging a
+// lower rate of false positive for an increase in the rate of false negatives.
 class CORE_EXPORT OverlayInterstitialAdDetector {
  public:
   OverlayInterstitialAdDetector() = default;
   ~OverlayInterstitialAdDetector() = default;
 
   void MaybeFireDetection(LocalFrame* main_frame);
+  void OnPopupAdDetected(LocalFrame* main_frame);
 
  private:
-  base::Optional<base::Time> last_detection_time_;
+  bool started_detection_ = false;
+  bool main_content_has_loaded_ = false;
+
+  // The following members are valid only when |started_detection_| is true.
+  base::Time last_detection_time_;
+  IntSize last_detection_main_frame_size_;
+
+  DOMNodeId candidate_id_;
+
+  // The following members are valid only when |candidate_| is not nullptr.
+  int candidate_start_main_frame_scroll_offset_ = 0;
+
+  // The node id of the last element that was detected as unqualified to be an
+  // overlay pop-up. We compare any potential candidate with the last
+  // unqualified element and skip it if they are equal.
+  //
+  // It allows us to exclude some false positive cases. e.g. an
+  // overlay was excluded from the initial consideration because it was created
+  // with a gesture. After 5 seconds the gesture would be gone, but we still
+  // want to exclude it as it was originally created with a gesture.
+  //
+  // Another advantage is this saves some computation cost. e.g. if an ad was
+  // unqualified because it didn't have a viewport constraint position, then we
+  // can skip it on its next occurrence without computing the style again.
+  DOMNodeId last_unqualified_element_id_;
+
   bool done_detection_ = false;
 
   DISALLOW_COPY_AND_ASSIGN(OverlayInterstitialAdDetector);
diff --git a/chromium/third_party/blink/renderer/core/frame/pausable_script_executor.cc b/chromium/third_party/blink/renderer/core/frame/pausable_script_executor.cc
index a95f9754017..8a5f658b7ea 100644
--- a/chromium/third_party/blink/renderer/core/frame/pausable_script_executor.cc
+++ b/chromium/third_party/blink/renderer/core/frame/pausable_script_executor.cc
@@ -16,6 +16,7 @@
 #include "third_party/blink/renderer/bindings/core/v8/v8_binding_for_core.h"
 #include "third_party/blink/renderer/bindings/core/v8/window_proxy.h"
 #include "third_party/blink/renderer/core/dom/document.h"
+#include "third_party/blink/renderer/core/frame/local_dom_window.h"
 #include "third_party/blink/renderer/core/frame/local_frame.h"
 #include "third_party/blink/renderer/platform/bindings/trace_wrapper_v8_reference.h"
 #include "third_party/blink/renderer/platform/heap/heap.h"
@@ -115,7 +116,7 @@ Vector<v8::Local<v8::Value>> V8FunctionExecutor::Execute(LocalFrame* frame) {
 
   {
     if (V8ScriptRunner::CallFunction(function_.NewLocal(isolate),
-                                     frame->GetDocument()->ToExecutionContext(),
+                                     frame->DomWindow(),
                                      receiver_.NewLocal(isolate), args.size(),
                                      args.data(), ToIsolate(frame))
             .ToLocal(&single_result))
@@ -187,7 +188,7 @@ PausableScriptExecutor::PausableScriptExecutor(
     ScriptState* script_state,
     WebScriptExecutionCallback* callback,
     Executor* executor)
-    : ExecutionContextLifecycleObserver(frame->GetDocument()),
+    : ExecutionContextLifecycleObserver(frame->DomWindow()),
       script_state_(script_state),
       callback_(callback),
       blocking_option_(kNonBlocking),
@@ -216,7 +217,7 @@ void PausableScriptExecutor::RunAsync(BlockingOption blocking) {
   DCHECK(context);
   blocking_option_ = blocking;
   if (blocking_option_ == kOnloadBlocking)
-    Document::From(GetExecutionContext())->IncrementLoadEventDelayCount();
+    To<LocalDOMWindow>(context)->document()->IncrementLoadEventDelayCount();
 
   task_handle_ = PostCancellableTask(
       *context->GetTaskRunner(TaskType::kJavascriptTimer), FROM_HERE,
@@ -230,9 +231,9 @@ void PausableScriptExecutor::ExecuteAndDestroySelf() {
   if (callback_)
     callback_->WillExecute();
 
+  auto* window = To<LocalDOMWindow>(GetExecutionContext());
   ScriptState::Scope script_scope(script_state_);
-  Vector<v8::Local<v8::Value>> results =
-      executor_->Execute(Document::From(GetExecutionContext())->GetFrame());
+  Vector<v8::Local<v8::Value>> results = executor_->Execute(window->GetFrame());
 
   // The script may have removed the frame, in which case contextDestroyed()
   // will have handled the disposal/callback.
@@ -240,7 +241,7 @@ void PausableScriptExecutor::ExecuteAndDestroySelf() {
     return;
 
   if (blocking_option_ == kOnloadBlocking)
-    Document::From(GetExecutionContext())->DecrementLoadEventDelayCount();
+    window->document()->DecrementLoadEventDelayCount();
 
   if (callback_)
     callback_->Completed(results);
diff --git a/chromium/third_party/blink/renderer/core/frame/performance_monitor.cc b/chromium/third_party/blink/renderer/core/frame/performance_monitor.cc
index 26ae7e33046..14e9d641b5e 100644
--- a/chromium/third_party/blink/renderer/core/frame/performance_monitor.cc
+++ b/chromium/third_party/blink/renderer/core/frame/performance_monitor.cc
@@ -14,6 +14,7 @@
 #include "third_party/blink/renderer/core/dom/events/event_listener.h"
 #include "third_party/blink/renderer/core/execution_context/execution_context.h"
 #include "third_party/blink/renderer/core/frame/frame.h"
+#include "third_party/blink/renderer/core/frame/local_dom_window.h"
 #include "third_party/blink/renderer/core/frame/local_frame.h"
 #include "third_party/blink/renderer/core/html/parser/html_document_parser.h"
 #include "third_party/blink/renderer/core/probe/core_probes.h"
@@ -52,10 +53,10 @@ void PerformanceMonitor::ReportGenericViolation(
 // static
 PerformanceMonitor* PerformanceMonitor::Monitor(
     const ExecutionContext* context) {
-  const auto* document = Document::DynamicFrom(context);
-  if (!document)
+  const auto* window = DynamicTo<LocalDOMWindow>(context);
+  if (!window)
     return nullptr;
-  LocalFrame* frame = document->GetFrame();
+  LocalFrame* frame = window->GetFrame();
   if (!frame)
     return nullptr;
   return frame->GetPerformanceMonitor();
@@ -147,12 +148,12 @@ void PerformanceMonitor::DidExecuteScript() {
 }
 
 void PerformanceMonitor::UpdateTaskAttribution(ExecutionContext* context) {
-  // If |context| is not a document, unable to attribute a frame context.
-  auto* document = Document::DynamicFrom(context);
-  if (!document)
+  // If |context| is not a window, unable to attribute a frame context.
+  auto* window = DynamicTo<LocalDOMWindow>(context);
+  if (!window)
     return;
 
-  UpdateTaskShouldBeReported(document->GetFrame());
+  UpdateTaskShouldBeReported(window->GetFrame());
   if (!task_execution_context_)
     task_execution_context_ = context;
   else if (task_execution_context_ != context)
@@ -263,7 +264,7 @@ void PerformanceMonitor::DocumentWriteFetchScript(Document* document) {
   if (!enabled_)
     return;
   String text = "Parser was blocked due to document.write(<script>)";
-  InnerReportGenericViolation(document->ToExecutionContext(), kBlockedParser,
+  InnerReportGenericViolation(document->GetExecutionContext(), kBlockedParser,
                               text, base::TimeDelta(), nullptr);
 }
 
diff --git a/chromium/third_party/blink/renderer/core/frame/performance_monitor_test.cc b/chromium/third_party/blink/renderer/core/frame/performance_monitor_test.cc
index 349beab1d42..d0573ee357c 100644
--- a/chromium/third_party/blink/renderer/core/frame/performance_monitor_test.cc
+++ b/chromium/third_party/blink/renderer/core/frame/performance_monitor_test.cc
@@ -5,6 +5,7 @@
 #include "third_party/blink/renderer/core/frame/performance_monitor.h"
 
 #include "testing/gtest/include/gtest/gtest.h"
+#include "third_party/blink/renderer/core/frame/local_dom_window.h"
 #include "third_party/blink/renderer/core/frame/local_frame.h"
 #include "third_party/blink/renderer/core/frame/location.h"
 #include "third_party/blink/renderer/core/probe/core_probes.h"
@@ -25,13 +26,13 @@ class PerformanceMonitorTest : public testing::Test {
     return page_holder_->GetDocument().GetFrame();
   }
   ExecutionContext* GetExecutionContext() const {
-    return page_holder_->GetDocument().ToExecutionContext();
+    return page_holder_->GetFrame().DomWindow();
   }
   LocalFrame* AnotherFrame() const {
     return another_page_holder_->GetDocument().GetFrame();
   }
   ExecutionContext* AnotherExecutionContext() const {
-    return another_page_holder_->GetDocument().ToExecutionContext();
+    return another_page_holder_->GetFrame().DomWindow();
   }
 
   void WillExecuteScript(ExecutionContext* execution_context) {
@@ -91,7 +92,7 @@ String PerformanceMonitorTest::FrameContextURL() {
   // This is reported only if there is a single frameContext URL.
   if (monitor_->task_has_multiple_contexts_)
     return g_empty_string;
-  return Document::From(monitor_->task_execution_context_.Get())
+  return To<LocalDOMWindow>(monitor_->task_execution_context_.Get())
       ->location()
       ->toString();
 }
diff --git a/chromium/third_party/blink/renderer/core/frame/platform_event_controller.cc b/chromium/third_party/blink/renderer/core/frame/platform_event_controller.cc
index 18273936e12..33f9529c925 100644
--- a/chromium/third_party/blink/renderer/core/frame/platform_event_controller.cc
+++ b/chromium/third_party/blink/renderer/core/frame/platform_event_controller.cc
@@ -4,16 +4,16 @@
 
 #include "third_party/blink/renderer/core/frame/platform_event_controller.h"
 
-#include "third_party/blink/renderer/core/dom/document.h"
+#include "third_party/blink/renderer/core/frame/local_dom_window.h"
 #include "third_party/blink/renderer/core/page/page.h"
 
 namespace blink {
 
-PlatformEventController::PlatformEventController(Document* document)
-    : PageVisibilityObserver(document ? document->GetPage() : nullptr),
+PlatformEventController::PlatformEventController(LocalDOMWindow& window)
+    : PageVisibilityObserver(window.GetFrame()->GetPage()),
       has_event_listener_(false),
       is_active_(false),
-      document_(document) {}
+      window_(window) {}
 
 PlatformEventController::~PlatformEventController() = default;
 
@@ -23,12 +23,12 @@ void PlatformEventController::UpdateCallback() {
 }
 
 void PlatformEventController::StartUpdating() {
-  if (is_active_ || !document_)
+  if (is_active_ || !window_)
     return;
 
   if (HasLastData() && !update_callback_handle_.IsActive()) {
     update_callback_handle_ = PostCancellableTask(
-        *document_->GetTaskRunner(TaskType::kInternalDefault), FROM_HERE,
+        *window_->GetTaskRunner(TaskType::kInternalDefault), FROM_HERE,
         WTF::Bind(&PlatformEventController::UpdateCallback,
                   WrapWeakPersistent(this)));
   }
@@ -57,7 +57,7 @@ void PlatformEventController::PageVisibilityChanged() {
 }
 
 void PlatformEventController::Trace(Visitor* visitor) {
-  visitor->Trace(document_);
+  visitor->Trace(window_);
   PageVisibilityObserver::Trace(visitor);
 }
 
diff --git a/chromium/third_party/blink/renderer/core/frame/platform_event_controller.h b/chromium/third_party/blink/renderer/core/frame/platform_event_controller.h
index 078167cf7ce..d52c3c5f487 100644
--- a/chromium/third_party/blink/renderer/core/frame/platform_event_controller.h
+++ b/chromium/third_party/blink/renderer/core/frame/platform_event_controller.h
@@ -14,7 +14,7 @@
 
 namespace blink {
 
-class Document;
+class LocalDOMWindow;
 
 // Base controller class for registering controllers with a dispatcher.
 // It watches page visibility and calls stopUpdating when page is not visible.
@@ -29,10 +29,10 @@ class CORE_EXPORT PlatformEventController : public PageVisibilityObserver {
   virtual void DidUpdateData() = 0;
 
   void Trace(Visitor*) override;
-  Document* GetDocument() const { return document_; }
+  LocalDOMWindow& GetWindow() const { return *window_; }
 
  protected:
-  explicit PlatformEventController(Document*);
+  explicit PlatformEventController(LocalDOMWindow&);
   virtual ~PlatformEventController();
 
   virtual void RegisterWithDispatcher() = 0;
@@ -51,7 +51,7 @@ class CORE_EXPORT PlatformEventController : public PageVisibilityObserver {
   void UpdateCallback();
 
   bool is_active_;
-  Member<Document> document_;
+  Member<LocalDOMWindow> window_;
   TaskHandle update_callback_handle_;
 };
 
diff --git a/chromium/third_party/blink/renderer/core/frame/remote_frame.cc b/chromium/third_party/blink/renderer/core/frame/remote_frame.cc
index 04c16e3882d..3c80fea603e 100644
--- a/chromium/third_party/blink/renderer/core/frame/remote_frame.cc
+++ b/chromium/third_party/blink/renderer/core/frame/remote_frame.cc
@@ -5,6 +5,7 @@
 #include "third_party/blink/renderer/core/frame/remote_frame.h"
 
 #include "cc/layers/surface_layer.h"
+#include "services/network/public/mojom/web_sandbox_flags.mojom-blink.h"
 #include "third_party/blink/public/common/associated_interfaces/associated_interface_provider.h"
 #include "third_party/blink/public/mojom/frame/frame_owner_properties.mojom-blink.h"
 #include "third_party/blink/public/mojom/frame/intrinsic_sizing_info.mojom-blink.h"
@@ -16,6 +17,7 @@
 #include "third_party/blink/renderer/bindings/core/v8/window_proxy.h"
 #include "third_party/blink/renderer/bindings/core/v8/window_proxy_manager.h"
 #include "third_party/blink/renderer/core/frame/csp/content_security_policy.h"
+#include "third_party/blink/renderer/core/frame/local_dom_window.h"
 #include "third_party/blink/renderer/core/frame/local_frame.h"
 #include "third_party/blink/renderer/core/frame/local_frame_client.h"
 #include "third_party/blink/renderer/core/frame/remote_dom_window.h"
@@ -39,6 +41,7 @@
 #include "third_party/blink/renderer/core/timing/dom_window_performance.h"
 #include "third_party/blink/renderer/platform/graphics/graphics_layer.h"
 #include "third_party/blink/renderer/platform/heap/heap.h"
+#include "third_party/blink/renderer/platform/heap/heap_allocator.h"
 #include "third_party/blink/renderer/platform/loader/fetch/fetch_client_settings_object.h"
 #include "third_party/blink/renderer/platform/loader/fetch/resource_fetcher.h"
 #include "third_party/blink/renderer/platform/loader/fetch/resource_fetcher_properties.h"
@@ -49,6 +52,16 @@
 namespace blink {
 
 namespace {
+
+// Maintain a global (statically-allocated) hash map indexed by the the result
+// of hashing the |frame_token| passed on creation of a RemoteFrame object.
+typedef HeapHashMap<uint64_t, WeakMember<RemoteFrame>> RemoteFramesByTokenMap;
+static RemoteFramesByTokenMap& GetRemoteFramesMap() {
+  DEFINE_STATIC_LOCAL(Persistent<RemoteFramesByTokenMap>, map,
+                      (MakeGarbageCollected<RemoteFramesByTokenMap>()));
+  return *map;
+}
+
 FloatRect DeNormalizeRect(const gfx::RectF& normalized, const IntRect& base) {
   FloatRect result(normalized);
   result.Scale(base.Width(), base.Height());
@@ -58,18 +71,32 @@ FloatRect DeNormalizeRect(const gfx::RectF& normalized, const IntRect& base) {
 
 }  // namespace
 
+// static
+RemoteFrame* RemoteFrame::FromFrameToken(
+    const base::UnguessableToken& frame_token) {
+  RemoteFramesByTokenMap& remote_frames_map = GetRemoteFramesMap();
+  auto it = remote_frames_map.find(base::UnguessableTokenHash()(frame_token));
+  return it == remote_frames_map.end() ? nullptr : it->value.Get();
+}
+
 RemoteFrame::RemoteFrame(
     RemoteFrameClient* client,
     Page& page,
     FrameOwner* owner,
+    const base::UnguessableToken& frame_token,
     WindowAgentFactory* inheriting_agent_factory,
     InterfaceRegistry* interface_registry,
     AssociatedInterfaceProvider* associated_interface_provider)
     : Frame(client,
             page,
             owner,
+            frame_token,
             MakeGarbageCollected<RemoteWindowProxyManager>(*this),
             inheriting_agent_factory) {
+  auto frame_tracking_result = GetRemoteFramesMap().insert(
+      base::UnguessableTokenHash()(frame_token), this);
+  CHECK(frame_tracking_result.stored_value) << "Inserting a duplicate item.";
+
   dom_window_ = MakeGarbageCollected<RemoteDOMWindow>(*this);
 
   interface_registry->AddAssociatedInterface(WTF::BindRepeating(
@@ -130,10 +157,7 @@ void RemoteFrame::Navigate(FrameLoadRequest& frame_request,
                           : nullptr;
   MixedContentChecker::UpgradeInsecureRequest(
       frame_request.GetResourceRequest(), fetch_client_settings_object,
-      frame_request.OriginDocument()
-          ? frame_request.OriginDocument()->ToExecutionContext()
-          : nullptr,
-      frame_request.GetFrameType(),
+      frame ? frame->DomWindow() : nullptr, frame_request.GetFrameType(),
       frame ? frame->GetContentSettingsClient() : nullptr);
 
   // Navigations in portal contexts do not create back/forward entries.
@@ -142,6 +166,9 @@ void RemoteFrame::Navigate(FrameLoadRequest& frame_request,
     frame_load_type = WebFrameLoadType::kReplaceCurrentItem;
   }
 
+  WebLocalFrame* initiator_frame =
+      frame ? frame->Client()->GetWebFrame() : nullptr;
+
   bool is_opener_navigation = false;
   bool initiator_frame_has_download_sandbox_flag = false;
   bool initiator_frame_is_ad = false;
@@ -151,19 +178,21 @@ void RemoteFrame::Navigate(FrameLoadRequest& frame_request,
     initiator_frame_has_download_sandbox_flag =
         frame->GetSecurityContext() &&
         frame->GetSecurityContext()->IsSandboxed(
-            mojom::blink::WebSandboxFlags::kDownloads);
+            network::mojom::blink::WebSandboxFlags::kDownloads);
     initiator_frame_is_ad = frame->IsAdSubframe();
     if (frame_request.ClientRedirectReason() != ClientNavigationReason::kNone) {
       probe::FrameRequestedNavigation(frame, this, url,
-                                      frame_request.ClientRedirectReason());
+                                      frame_request.ClientRedirectReason(),
+                                      kNavigationPolicyCurrentTab);
     }
   }
 
-  Client()->Navigate(frame_request.GetResourceRequest(),
+  Client()->Navigate(frame_request.GetResourceRequest(), initiator_frame,
                      frame_load_type == WebFrameLoadType::kReplaceCurrentItem,
                      is_opener_navigation,
                      initiator_frame_has_download_sandbox_flag,
-                     initiator_frame_is_ad, frame_request.GetBlobURLToken());
+                     initiator_frame_is_ad, frame_request.GetBlobURLToken(),
+                     frame_request.Impression());
 }
 
 void RemoteFrame::DetachImpl(FrameDetachType type) {
@@ -323,7 +352,7 @@ void RemoteFrame::SetReplicatedFeaturePolicyHeaderAndOpenerPolicies(
 }
 
 void RemoteFrame::SetReplicatedSandboxFlags(
-    mojom::blink::WebSandboxFlags flags) {
+    network::mojom::blink::WebSandboxFlags flags) {
   security_context_.ResetAndEnforceSandboxFlags(flags);
 }
 
@@ -564,8 +593,8 @@ void RemoteFrame::IntrinsicSizingInfoOfChildChanged(
 // ensure that sandbox flags and feature policy are inherited properly if this
 // proxy ever parents a local frame.
 void RemoteFrame::DidSetFramePolicyHeaders(
-    mojom::blink::WebSandboxFlags sandbox_flags,
-    const Vector<ParsedFeaturePolicyDeclaration>& parsed_feature_policy) {
+    network::mojom::blink::WebSandboxFlags sandbox_flags,
+    const WTF::Vector<ParsedFeaturePolicyDeclaration>& parsed_feature_policy) {
   SetReplicatedSandboxFlags(sandbox_flags);
   // Convert from WTF::Vector<ParsedFeaturePolicyDeclaration>
   // to std::vector<ParsedFeaturePolicyDeclaration>, since ParsedFeaturePolicy
@@ -620,7 +649,7 @@ bool RemoteFrame::IsIgnoredForHitTest() const {
   if (!owner || !owner->GetLayoutObject())
     return false;
 
-  return owner->OwnerType() == FrameOwnerElementType::kPortal ||
+  return owner->OwnerType() == mojom::blink::FrameOwnerElementType::kPortal ||
          !visible_to_hit_testing_;
 }
 
diff --git a/chromium/third_party/blink/renderer/core/frame/remote_frame.h b/chromium/third_party/blink/renderer/core/frame/remote_frame.h
index 15767ce1b4b..dc29695ff00 100644
--- a/chromium/third_party/blink/renderer/core/frame/remote_frame.h
+++ b/chromium/third_party/blink/renderer/core/frame/remote_frame.h
@@ -7,6 +7,7 @@
 
 #include "mojo/public/cpp/bindings/associated_receiver.h"
 #include "mojo/public/cpp/bindings/associated_remote.h"
+#include "services/network/public/mojom/web_sandbox_flags.mojom-blink-forward.h"
 #include "third_party/blink/public/mojom/frame/frame.mojom-blink.h"
 #include "third_party/blink/public/mojom/frame/frame_owner_properties.mojom-blink-forward.h"
 #include "third_party/blink/public/mojom/input/focus_type.mojom-blink-forward.h"
@@ -33,11 +34,15 @@ struct FrameLoadRequest;
 class CORE_EXPORT RemoteFrame final : public Frame,
                                       public mojom::blink::RemoteFrame {
  public:
+  // Returns the RemoteFrame for the given |frame_token|.
+  static RemoteFrame* FromFrameToken(const base::UnguessableToken& frame_token);
+
   // For a description of |inheriting_agent_factory| go see the comment on the
   // Frame constructor.
   RemoteFrame(RemoteFrameClient*,
               Page&,
               FrameOwner*,
+              const base::UnguessableToken& frame_token,
               WindowAgentFactory* inheriting_agent_factory,
               InterfaceRegistry*,
               AssociatedInterfaceProvider*);
@@ -89,7 +94,7 @@ class CORE_EXPORT RemoteFrame final : public Frame,
       const ParsedFeaturePolicy& parsed_header,
       const FeaturePolicy::FeatureState&);
 
-  void SetReplicatedSandboxFlags(mojom::blink::WebSandboxFlags);
+  void SetReplicatedSandboxFlags(network::mojom::blink::WebSandboxFlags);
   void SetInsecureRequestPolicy(mojom::blink::InsecureRequestPolicy);
   void SetInsecureNavigationsSet(const WebVector<unsigned>&);
 
@@ -130,7 +135,7 @@ class CORE_EXPORT RemoteFrame final : public Frame,
   void IntrinsicSizingInfoOfChildChanged(
       mojom::blink::IntrinsicSizingInfoPtr sizing_info) override;
   void DidSetFramePolicyHeaders(
-      mojom::blink::WebSandboxFlags,
+      network::mojom::blink::WebSandboxFlags,
       const WTF::Vector<ParsedFeaturePolicyDeclaration>&) override;
   // Updates the snapshotted policy attributes (sandbox flags and feature policy
   // container policy) in the frame's FrameOwner. This is used when this frame's
diff --git a/chromium/third_party/blink/renderer/core/frame/remote_frame_client.h b/chromium/third_party/blink/renderer/core/frame/remote_frame_client.h
index e73cc62bcef..056e0d5969f 100644
--- a/chromium/third_party/blink/renderer/core/frame/remote_frame_client.h
+++ b/chromium/third_party/blink/renderer/core/frame/remote_frame_client.h
@@ -5,9 +5,11 @@
 #ifndef THIRD_PARTY_BLINK_RENDERER_CORE_FRAME_REMOTE_FRAME_CLIENT_H_
 #define THIRD_PARTY_BLINK_RENDERER_CORE_FRAME_REMOTE_FRAME_CLIENT_H_
 
+#include "base/optional.h"
 #include "cc/paint/paint_canvas.h"
 #include "third_party/blink/public/mojom/blob/blob_url_store.mojom-blink-forward.h"
 #include "third_party/blink/public/platform/viewport_intersection_state.h"
+#include "third_party/blink/public/platform/web_impression.h"
 #include "third_party/blink/public/web/web_frame_load_type.h"
 #include "third_party/blink/renderer/core/frame/frame_client.h"
 #include "third_party/blink/renderer/core/frame/frame_types.h"
@@ -23,17 +25,20 @@ class LocalFrame;
 class MessageEvent;
 class ResourceRequest;
 class SecurityOrigin;
+class WebLocalFrame;
 
 class RemoteFrameClient : public FrameClient {
  public:
   ~RemoteFrameClient() override = default;
 
   virtual void Navigate(const ResourceRequest&,
+                        blink::WebLocalFrame* initiator_frame,
                         bool should_replace_current_entry,
                         bool is_opener_navigation,
                         bool initiator_frame_has_download_sandbox_flag,
                         bool initiator_frame_is_ad,
-                        mojo::PendingRemote<mojom::blink::BlobURLToken>) = 0;
+                        mojo::PendingRemote<mojom::blink::BlobURLToken>,
+                        const base::Optional<WebImpression>& impression) = 0;
   unsigned BackForwardLength() override = 0;
 
   // Forwards a postMessage for a remote frame.
diff --git a/chromium/third_party/blink/renderer/core/frame/remote_frame_client_impl.cc b/chromium/third_party/blink/renderer/core/frame/remote_frame_client_impl.cc
index ec1271d743a..312b23cd3ab 100644
--- a/chromium/third_party/blink/renderer/core/frame/remote_frame_client_impl.cc
+++ b/chromium/third_party/blink/renderer/core/frame/remote_frame_client_impl.cc
@@ -100,19 +100,22 @@ base::UnguessableToken RemoteFrameClientImpl::GetDevToolsFrameToken() const {
 
 void RemoteFrameClientImpl::Navigate(
     const ResourceRequest& request,
+    blink::WebLocalFrame* initiator_frame,
     bool should_replace_current_entry,
     bool is_opener_navigation,
     bool initiator_frame_has_download_sandbox_flag,
     bool initiator_frame_is_ad,
-    mojo::PendingRemote<mojom::blink::BlobURLToken> blob_url_token) {
+    mojo::PendingRemote<mojom::blink::BlobURLToken> blob_url_token,
+    const base::Optional<WebImpression>& impression) {
   bool blocking_downloads_in_sandbox_enabled =
       RuntimeEnabledFeatures::BlockingDownloadsInSandboxEnabled();
   if (web_frame_->Client()) {
     web_frame_->Client()->Navigate(
-        WrappedResourceRequest(request), should_replace_current_entry,
-        is_opener_navigation, initiator_frame_has_download_sandbox_flag,
+        WrappedResourceRequest(request), initiator_frame,
+        should_replace_current_entry, is_opener_navigation,
+        initiator_frame_has_download_sandbox_flag,
         blocking_downloads_in_sandbox_enabled, initiator_frame_is_ad,
-        blob_url_token.PassPipe());
+        blob_url_token.PassPipe(), impression);
   }
 }
 
diff --git a/chromium/third_party/blink/renderer/core/frame/remote_frame_client_impl.h b/chromium/third_party/blink/renderer/core/frame/remote_frame_client_impl.h
index 382e4f8214b..a0591ce692f 100644
--- a/chromium/third_party/blink/renderer/core/frame/remote_frame_client_impl.h
+++ b/chromium/third_party/blink/renderer/core/frame/remote_frame_client_impl.h
@@ -34,11 +34,13 @@ class RemoteFrameClientImpl final : public RemoteFrameClient {
 
   // RemoteFrameClient overrides:
   void Navigate(const ResourceRequest&,
+                blink::WebLocalFrame* initiator_frame,
                 bool should_replace_current_entry,
                 bool is_opener_navigation,
                 bool prevent_sandboxed_download,
                 bool initiator_frame_is_ad,
-                mojo::PendingRemote<mojom::blink::BlobURLToken>) override;
+                mojo::PendingRemote<mojom::blink::BlobURLToken>,
+                const base::Optional<WebImpression>& impression) override;
   unsigned BackForwardLength() override;
   void ForwardPostMessage(MessageEvent*,
                           scoped_refptr<const SecurityOrigin> target,
diff --git a/chromium/third_party/blink/renderer/core/frame/remote_frame_owner.cc b/chromium/third_party/blink/renderer/core/frame/remote_frame_owner.cc
index 525f18e1705..4abf53df891 100644
--- a/chromium/third_party/blink/renderer/core/frame/remote_frame_owner.cc
+++ b/chromium/third_party/blink/renderer/core/frame/remote_frame_owner.cc
@@ -4,8 +4,10 @@
 
 #include "third_party/blink/renderer/core/frame/remote_frame_owner.h"
 
+#include "third_party/blink/public/mojom/frame/intrinsic_sizing_info.mojom-blink.h"
 #include "third_party/blink/public/web/web_local_frame_client.h"
 #include "third_party/blink/renderer/core/exported/web_remote_frame_impl.h"
+#include "third_party/blink/renderer/core/frame/local_dom_window.h"
 #include "third_party/blink/renderer/core/frame/local_frame.h"
 #include "third_party/blink/renderer/core/frame/local_frame_client.h"
 #include "third_party/blink/renderer/core/frame/web_frame_widget_base.h"
@@ -18,7 +20,7 @@ namespace blink {
 RemoteFrameOwner::RemoteFrameOwner(
     const FramePolicy& frame_policy,
     const WebFrameOwnerProperties& frame_owner_properties,
-    FrameOwnerElementType frame_owner_element_type)
+    mojom::blink::FrameOwnerElementType frame_owner_element_type)
     : frame_policy_(frame_policy),
       browsing_context_container_name_(
           static_cast<String>(frame_owner_properties.name)),
@@ -55,7 +57,7 @@ void RemoteFrameOwner::AddResourceTiming(const ResourceTimingInfo& info) {
   mojom::blink::ResourceTimingInfoPtr resource_timing =
       Performance::GenerateResourceTiming(
           *frame->Tree().Parent()->GetSecurityContext()->GetSecurityOrigin(),
-          info, *frame->GetDocument()->ToExecutionContext());
+          info, *frame->DomWindow());
   frame->GetLocalFrameHostRemote().ForwardResourceTimingToParent(
       std::move(resource_timing));
 }
@@ -66,7 +68,7 @@ void RemoteFrameOwner::DispatchLoad() {
 }
 
 void RemoteFrameOwner::RenderFallbackContent(Frame* failed_frame) {
-  if (frame_owner_element_type_ != FrameOwnerElementType::kObject)
+  if (frame_owner_element_type_ != mojom::blink::FrameOwnerElementType::kObject)
     return;
   DCHECK(failed_frame->IsLocalFrame());
   LocalFrame* local_frame = To<LocalFrame>(failed_frame);
@@ -82,9 +84,14 @@ void RemoteFrameOwner::IntrinsicSizingInfoChanged() {
   // By virtue of having been invoked, GetIntrinsicSizingInfo() should always
   // succeed here.
   DCHECK(result);
+
+  auto sizing_info = mojom::blink::IntrinsicSizingInfo::New(
+      gfx::SizeF(intrinsic_sizing_info.size),
+      gfx::SizeF(intrinsic_sizing_info.aspect_ratio),
+      intrinsic_sizing_info.has_width, intrinsic_sizing_info.has_height);
   WebLocalFrameImpl::FromFrame(local_frame)
       ->FrameWidgetImpl()
-      ->IntrinsicSizingInfoChanged(intrinsic_sizing_info);
+      ->IntrinsicSizingInfoChanged(std::move(sizing_info));
 }
 
 void RemoteFrameOwner::SetNeedsOcclusionTracking(bool needs_tracking) {
diff --git a/chromium/third_party/blink/renderer/core/frame/remote_frame_owner.h b/chromium/third_party/blink/renderer/core/frame/remote_frame_owner.h
index a75f1badd8f..17605568826 100644
--- a/chromium/third_party/blink/renderer/core/frame/remote_frame_owner.h
+++ b/chromium/third_party/blink/renderer/core/frame/remote_frame_owner.h
@@ -5,8 +5,8 @@
 #ifndef THIRD_PARTY_BLINK_RENDERER_CORE_FRAME_REMOTE_FRAME_OWNER_H_
 #define THIRD_PARTY_BLINK_RENDERER_CORE_FRAME_REMOTE_FRAME_OWNER_H_
 
-#include "third_party/blink/public/common/frame/frame_owner_element_type.h"
 #include "third_party/blink/public/common/frame/frame_policy.h"
+#include "third_party/blink/public/mojom/frame/frame_owner_element_type.mojom-blink.h"
 #include "third_party/blink/public/mojom/scroll/scrollbar_mode.mojom-blink.h"
 #include "third_party/blink/public/web/web_frame_owner_properties.h"
 #include "third_party/blink/renderer/core/core_export.h"
@@ -27,9 +27,10 @@ class CORE_EXPORT RemoteFrameOwner final
   USING_GARBAGE_COLLECTED_MIXIN(RemoteFrameOwner);
 
  public:
-  RemoteFrameOwner(const FramePolicy&,
-                   const WebFrameOwnerProperties&,
-                   FrameOwnerElementType frame_owner_element_type);
+  RemoteFrameOwner(
+      const FramePolicy&,
+      const WebFrameOwnerProperties&,
+      mojom::blink::FrameOwnerElementType frame_owner_element_type);
 
   // FrameOwner overrides:
   Frame* ContentFrame() const override { return frame_.Get(); }
@@ -39,7 +40,8 @@ class CORE_EXPORT RemoteFrameOwner final
   void AddResourceTiming(const ResourceTimingInfo&) override;
   void DispatchLoad() override;
   bool CanRenderFallbackContent() const override {
-    return frame_owner_element_type_ == FrameOwnerElementType::kObject;
+    return frame_owner_element_type_ ==
+           mojom::blink::FrameOwnerElementType::kObject;
   }
   void RenderFallbackContent(Frame*) override;
   void IntrinsicSizingInfoChanged() override;
@@ -100,7 +102,7 @@ class CORE_EXPORT RemoteFrameOwner final
   bool is_display_none_;
   bool needs_occlusion_tracking_;
   WebString required_csp_;
-  const FrameOwnerElementType frame_owner_element_type_;
+  const mojom::blink::FrameOwnerElementType frame_owner_element_type_;
 };
 
 template <>
diff --git a/chromium/third_party/blink/renderer/core/frame/remote_frame_view.cc b/chromium/third_party/blink/renderer/core/frame/remote_frame_view.cc
index f6a342c248f..1e58c5d6d81 100644
--- a/chromium/third_party/blink/renderer/core/frame/remote_frame_view.cc
+++ b/chromium/third_party/blink/renderer/core/frame/remote_frame_view.cc
@@ -5,7 +5,7 @@
 #include "third_party/blink/renderer/core/frame/remote_frame_view.h"
 
 #include "components/paint_preview/common/paint_preview_tracker.h"
-#include "third_party/blink/public/common/frame/frame_owner_element_type.h"
+#include "third_party/blink/public/mojom/frame/frame_owner_element_type.mojom-blink.h"
 #include "third_party/blink/renderer/core/dom/document.h"
 #include "third_party/blink/renderer/core/frame/local_frame.h"
 #include "third_party/blink/renderer/core/frame/local_frame_view.h"
@@ -36,7 +36,8 @@ LocalFrameView* RemoteFrameView::ParentFrameView() const {
     return nullptr;
 
   HTMLFrameOwnerElement* owner = remote_frame_->DeprecatedLocalOwner();
-  if (owner && owner->OwnerType() == FrameOwnerElementType::kPortal)
+  if (owner &&
+      owner->OwnerType() == mojom::blink::FrameOwnerElementType::kPortal)
     return owner->GetDocument().GetFrame()->View();
 
   // |is_attached_| is only set from AttachToLayout(), which ensures that the
@@ -53,7 +54,8 @@ LocalFrameView* RemoteFrameView::ParentLocalRootFrameView() const {
     return nullptr;
 
   HTMLFrameOwnerElement* owner = remote_frame_->DeprecatedLocalOwner();
-  if (owner && owner->OwnerType() == FrameOwnerElementType::kPortal)
+  if (owner &&
+      owner->OwnerType() == mojom::blink::FrameOwnerElementType::kPortal)
     return owner->GetDocument().GetFrame()->LocalFrameRoot().View();
 
   // |is_attached_| is only set from AttachToLayout(), which ensures that the
diff --git a/chromium/third_party/blink/renderer/core/frame/reporting_context.cc b/chromium/third_party/blink/renderer/core/frame/reporting_context.cc
index fbbc1b1b1a9..0da2f0398e5 100644
--- a/chromium/third_party/blink/renderer/core/frame/reporting_context.cc
+++ b/chromium/third_party/blink/renderer/core/frame/reporting_context.cc
@@ -23,13 +23,39 @@
 
 namespace blink {
 
+namespace {
+
+// In the spec (https://w3c.github.io/reporting/#report-body) a report body can
+// have anything that can be serialized into a JSON text, but V8ObjectBuilder
+// doesn't allow us to implement that. Hence here we implement just a one-level
+// dictionary, as that is what is needed currently.
+class DictionaryValueReportBody final : public ReportBody {
+ public:
+  explicit DictionaryValueReportBody(mojom::blink::ReportBodyPtr body)
+      : body_(std::move(body)) {}
+
+  void BuildJSONValue(V8ObjectBuilder& builder) const override {
+    DCHECK(body_);
+
+    for (const auto& element : body_->body) {
+      builder.AddString(element->name, element->value);
+    }
+  }
+
+ private:
+  const mojom::blink::ReportBodyPtr body_;
+};
+
+}  // namespace
+
 // static
 const char ReportingContext::kSupplementName[] = "ReportingContext";
 
 ReportingContext::ReportingContext(ExecutionContext& context)
     : Supplement<ExecutionContext>(context),
       execution_context_(context),
-      reporting_service_(&context) {}
+      reporting_service_(&context),
+      receiver_(this, &context) {}
 
 // static
 ReportingContext* ReportingContext::From(ExecutionContext* context) {
@@ -42,30 +68,25 @@ ReportingContext* ReportingContext::From(ExecutionContext* context) {
   return reporting_context;
 }
 
+void ReportingContext::Bind(
+    mojo::PendingReceiver<mojom::blink::ReportingObserver> receiver) {
+  receiver_.reset();
+  receiver_.Bind(std::move(receiver),
+                 execution_context_->GetTaskRunner(TaskType::kMiscPlatformAPI));
+}
+
 void ReportingContext::QueueReport(Report* report,
                                    const Vector<String>& endpoints) {
   CountReport(report);
 
-  // Buffer the report.
-  if (!report_buffer_.Contains(report->type()))
-    report_buffer_.insert(report->type(), HeapListHashSet<Member<Report>>());
-  report_buffer_.find(report->type())->value.insert(report);
-
-  // Only the most recent 100 reports will remain buffered, per report type.
-  // https://w3c.github.io/reporting/#notify-observers
-  if (report_buffer_.at(report->type()).size() > 100)
-    report_buffer_.find(report->type())->value.RemoveFirst();
-
-  // Queue the report in all registered observers.
-  for (auto observer : observers_)
-    observer->QueueReport(report);
+  NotifyInternal(report);
 
   // Send the report via the Reporting API.
   for (auto& endpoint : endpoints)
     SendToReportingAPI(report, endpoint);
 }
 
-void ReportingContext::RegisterObserver(ReportingObserver* observer) {
+void ReportingContext::RegisterObserver(blink::ReportingObserver* observer) {
   UseCounter::Count(execution_context_, WebFeature::kReportingObserver);
 
   observers_.insert(observer);
@@ -80,15 +101,25 @@ void ReportingContext::RegisterObserver(ReportingObserver* observer) {
   }
 }
 
-void ReportingContext::UnregisterObserver(ReportingObserver* observer) {
+void ReportingContext::UnregisterObserver(blink::ReportingObserver* observer) {
   observers_.erase(observer);
 }
 
+void ReportingContext::Notify(mojom::blink::ReportPtr report) {
+  ReportBody* body = report->body
+                         ? MakeGarbageCollected<DictionaryValueReportBody>(
+                               std::move(report->body))
+                         : nullptr;
+  NotifyInternal(MakeGarbageCollected<Report>(report->type,
+                                              report->url.GetString(), body));
+}
+
 void ReportingContext::Trace(Visitor* visitor) {
   visitor->Trace(observers_);
   visitor->Trace(report_buffer_);
   visitor->Trace(execution_context_);
   visitor->Trace(reporting_service_);
+  visitor->Trace(receiver_);
   Supplement<ExecutionContext>::Trace(visitor);
 }
 
@@ -119,6 +150,22 @@ ReportingContext::GetReportingService() const {
   return reporting_service_;
 }
 
+void ReportingContext::NotifyInternal(Report* report) {
+  // Buffer the report.
+  if (!report_buffer_.Contains(report->type()))
+    report_buffer_.insert(report->type(), HeapListHashSet<Member<Report>>());
+  report_buffer_.find(report->type())->value.insert(report);
+
+  // Only the most recent 100 reports will remain buffered, per report type.
+  // https://w3c.github.io/reporting/#notify-observers
+  if (report_buffer_.at(report->type()).size() > 100)
+    report_buffer_.find(report->type())->value.RemoveFirst();
+
+  // Queue the report in all registered observers.
+  for (auto observer : observers_)
+    observer->QueueReport(report);
+}
+
 void ReportingContext::SendToReportingAPI(Report* report,
                                           const String& endpoint) const {
   const String& type = report->type();
@@ -131,13 +178,8 @@ void ReportingContext::SendToReportingAPI(Report* report,
 
   const LocationReportBody* location_body =
       static_cast<LocationReportBody*>(report->body());
-  bool is_null;
-  int line_number = location_body->lineNumber(is_null);
-  if (is_null)
-    line_number = 0;
-  int column_number = location_body->columnNumber(is_null);
-  if (is_null)
-    column_number = 0;
+  int line_number = location_body->lineNumber().value_or(0);
+  int column_number = location_body->columnNumber().value_or(0);
   KURL url = KURL(report->url());
 
   if (type == ReportType::kCSPViolation) {
diff --git a/chromium/third_party/blink/renderer/core/frame/reporting_context.h b/chromium/third_party/blink/renderer/core/frame/reporting_context.h
index 67a26a9becd..ec572629ed7 100644
--- a/chromium/third_party/blink/renderer/core/frame/reporting_context.h
+++ b/chromium/third_party/blink/renderer/core/frame/reporting_context.h
@@ -5,9 +5,11 @@
 #ifndef THIRD_PARTY_BLINK_RENDERER_CORE_FRAME_REPORTING_CONTEXT_H_
 #define THIRD_PARTY_BLINK_RENDERER_CORE_FRAME_REPORTING_CONTEXT_H_
 
+#include "third_party/blink/public/mojom/frame/reporting_observer.mojom-blink.h"
 #include "third_party/blink/public/mojom/reporting/reporting.mojom-blink.h"
 #include "third_party/blink/renderer/core/core_export.h"
 #include "third_party/blink/renderer/core/execution_context/execution_context.h"
+#include "third_party/blink/renderer/platform/mojo/heap_mojo_receiver.h"
 #include "third_party/blink/renderer/platform/mojo/heap_mojo_remote.h"
 #include "third_party/blink/renderer/platform/supplementable.h"
 #include "third_party/blink/renderer/platform/wtf/text/wtf_string.h"
@@ -22,6 +24,7 @@ class ReportingObserver;
 // a container for all active ReportingObservers on that ExecutionContext.
 class CORE_EXPORT ReportingContext final
     : public GarbageCollected<ReportingContext>,
+      public mojom::blink::ReportingObserver,
       public Supplement<ExecutionContext> {
   USING_GARBAGE_COLLECTED_MIXIN(ReportingContext);
 
@@ -36,12 +39,16 @@ class CORE_EXPORT ReportingContext final
   static ReportingContext* From(const ExecutionContext* context) {
     return ReportingContext::From(const_cast<ExecutionContext*>(context));
   }
+  void Bind(mojo::PendingReceiver<mojom::blink::ReportingObserver> receiver);
 
   // Queues a report for the Reporting API and in all registered observers.
   void QueueReport(Report*, const Vector<String>& endpoints = {"default"});
 
-  void RegisterObserver(ReportingObserver*);
-  void UnregisterObserver(ReportingObserver*);
+  void RegisterObserver(blink::ReportingObserver*);
+  void UnregisterObserver(blink::ReportingObserver*);
+
+  // mojom::blink::ReportingObserver implementation.
+  void Notify(mojom::blink::ReportPtr report) override;
 
   void Trace(Visitor*) override;
 
@@ -52,10 +59,11 @@ class CORE_EXPORT ReportingContext final
   const HeapMojoRemote<mojom::blink::ReportingServiceProxy>&
   GetReportingService() const;
 
+  void NotifyInternal(Report* report);
   // Send |report| via the Reporting API to |endpoint|.
   void SendToReportingAPI(Report* report, const String& endpoint) const;
 
-  HeapListHashSet<Member<ReportingObserver>> observers_;
+  HeapListHashSet<Member<blink::ReportingObserver>> observers_;
   HeapHashMap<String, HeapListHashSet<Member<Report>>> report_buffer_;
   Member<ExecutionContext> execution_context_;
 
@@ -63,6 +71,8 @@ class CORE_EXPORT ReportingContext final
   // const methods.
   mutable HeapMojoRemote<mojom::blink::ReportingServiceProxy>
       reporting_service_;
+
+  HeapMojoReceiver<mojom::blink::ReportingObserver, ReportingContext> receiver_;
 };
 
 }  // namespace blink
diff --git a/chromium/third_party/blink/renderer/core/frame/reporting_context_test.cc b/chromium/third_party/blink/renderer/core/frame/reporting_context_test.cc
index 4b7212311bd..7ae687c38cc 100644
--- a/chromium/third_party/blink/renderer/core/frame/reporting_context_test.cc
+++ b/chromium/third_party/blink/renderer/core/frame/reporting_context_test.cc
@@ -7,6 +7,7 @@
 #include "testing/gtest/include/gtest/gtest.h"
 #include "third_party/blink/public/common/thread_safe_browser_interface_broker_proxy.h"
 #include "third_party/blink/renderer/core/frame/deprecation_report_body.h"
+#include "third_party/blink/renderer/core/frame/local_dom_window.h"
 #include "third_party/blink/renderer/core/frame/report.h"
 #include "third_party/blink/renderer/core/testing/page_test_base.h"
 #include "third_party/blink/renderer/platform/testing/histogram_tester.h"
@@ -134,7 +135,7 @@ TEST_F(ReportingContextTest, CountQueuedReports) {
 
   // Send the deprecation report to the Reporting API and any
   // ReportingObservers.
-  ReportingContext::From(dummy_page_holder->GetDocument().ToExecutionContext())
+  ReportingContext::From(dummy_page_holder->GetFrame().DomWindow())
       ->QueueReport(report);
   //  tester.ExpectTotalCount("Blink.UseCounter.Features.DeprecationReport", 1);
   // The potential violation for an already recorded violation does not count
@@ -143,7 +144,7 @@ TEST_F(ReportingContextTest, CountQueuedReports) {
 
 TEST_F(ReportingContextTest, DeprecationReportContent) {
   auto dummy_page_holder = std::make_unique<DummyPageHolder>();
-  auto& doc = dummy_page_holder->GetDocument();
+  auto* win = dummy_page_holder->GetFrame().DomWindow();
   base::RunLoop run_loop;
   MockReportingServiceProxy reporting_service(
       *Platform::Current()->GetBrowserInterfaceBroker(),
@@ -151,9 +152,9 @@ TEST_F(ReportingContextTest, DeprecationReportContent) {
 
   auto* body = MakeGarbageCollected<DeprecationReportBody>(
       "FeatureId", base::Time::FromJsTime(1000), "Test report");
-  auto* report =
-      MakeGarbageCollected<Report>("deprecation", doc.Url().GetString(), body);
-  ReportingContext::From(doc.ToExecutionContext())->QueueReport(report);
+  auto* report = MakeGarbageCollected<Report>(
+      "deprecation", win->document()->Url().GetString(), body);
+  ReportingContext::From(win)->QueueReport(report);
   run_loop.Run();
 
   EXPECT_TRUE(reporting_service.DeprecationReportAnticipatedRemoval());
diff --git a/chromium/third_party/blink/renderer/core/frame/reporting_observer.idl b/chromium/third_party/blink/renderer/core/frame/reporting_observer.idl
index 134e31d61ab..03017d16102 100644
--- a/chromium/third_party/blink/renderer/core/frame/reporting_observer.idl
+++ b/chromium/third_party/blink/renderer/core/frame/reporting_observer.idl
@@ -7,7 +7,8 @@
 callback ReportingObserverCallback = void (sequence<Report> reports, ReportingObserver observer);
 
 [
-    ActiveScriptWrappable
+    ActiveScriptWrappable,
+    Exposed=(Window,Worker)
 ] interface ReportingObserver {
     [CallWith=ExecutionContext] constructor(ReportingObserverCallback callback, optional ReportingObserverOptions options = {});
     void observe();
diff --git a/chromium/third_party/blink/renderer/core/frame/sandbox_flags.cc b/chromium/third_party/blink/renderer/core/frame/sandbox_flags.cc
index 218f0234c33..8479d77988e 100644
--- a/chromium/third_party/blink/renderer/core/frame/sandbox_flags.cc
+++ b/chromium/third_party/blink/renderer/core/frame/sandbox_flags.cc
@@ -26,38 +26,36 @@
 
 #include "third_party/blink/renderer/core/frame/sandbox_flags.h"
 
-#include "third_party/blink/public/common/frame/sandbox_flags.h"
+#include "services/network/public/cpp/web_sandbox_flags.h"
+#include "services/network/public/mojom/web_sandbox_flags.mojom-blink.h"
 #include "third_party/blink/public/mojom/feature_policy/feature_policy.mojom-blink.h"
 #include "third_party/blink/renderer/core/feature_policy/feature_policy_parser.h"
-#include "third_party/blink/renderer/core/html/html_iframe_element.h"
-#include "third_party/blink/renderer/core/html/parser/html_parser_idioms.h"
-#include "third_party/blink/renderer/platform/runtime_enabled_features.h"
-#include "third_party/blink/renderer/platform/wtf/assertions.h"
-#include "third_party/blink/renderer/platform/wtf/text/string_builder.h"
-#include "third_party/blink/renderer/platform/wtf/vector.h"
 
 namespace blink {
 
 const SandboxFlagFeaturePolicyPairs& SandboxFlagsWithFeaturePolicies() {
-  DEFINE_STATIC_LOCAL(SandboxFlagFeaturePolicyPairs, array,
-                      ({{mojom::blink::WebSandboxFlags::kTopNavigation,
-                         mojom::blink::FeaturePolicyFeature::kTopNavigation},
-                        {mojom::blink::WebSandboxFlags::kForms,
-                         mojom::blink::FeaturePolicyFeature::kFormSubmission},
-                        {mojom::blink::WebSandboxFlags::kScripts,
-                         mojom::blink::FeaturePolicyFeature::kScript},
-                        {mojom::blink::WebSandboxFlags::kPopups,
-                         mojom::blink::FeaturePolicyFeature::kPopups},
-                        {mojom::blink::WebSandboxFlags::kPointerLock,
-                         mojom::blink::FeaturePolicyFeature::kPointerLock},
-                        {mojom::blink::WebSandboxFlags::kModals,
-                         mojom::blink::FeaturePolicyFeature::kModals},
-                        {mojom::blink::WebSandboxFlags::kOrientationLock,
-                         mojom::blink::FeaturePolicyFeature::kOrientationLock},
-                        {mojom::blink::WebSandboxFlags::kPresentationController,
-                         mojom::blink::FeaturePolicyFeature::kPresentation},
-                        {mojom::blink::WebSandboxFlags::kDownloads,
-                         mojom::blink::FeaturePolicyFeature::kDownloads}}));
+  DEFINE_STATIC_LOCAL(
+      SandboxFlagFeaturePolicyPairs, array,
+      ({
+          {network::mojom::blink::WebSandboxFlags::kTopNavigation,
+           mojom::blink::FeaturePolicyFeature::kTopNavigation},
+          {network::mojom::blink::WebSandboxFlags::kForms,
+           mojom::blink::FeaturePolicyFeature::kFormSubmission},
+          {network::mojom::blink::WebSandboxFlags::kScripts,
+           mojom::blink::FeaturePolicyFeature::kScript},
+          {network::mojom::blink::WebSandboxFlags::kPopups,
+           mojom::blink::FeaturePolicyFeature::kPopups},
+          {network::mojom::blink::WebSandboxFlags::kPointerLock,
+           mojom::blink::FeaturePolicyFeature::kPointerLock},
+          {network::mojom::blink::WebSandboxFlags::kModals,
+           mojom::blink::FeaturePolicyFeature::kModals},
+          {network::mojom::blink::WebSandboxFlags::kOrientationLock,
+           mojom::blink::FeaturePolicyFeature::kOrientationLock},
+          {network::mojom::blink::WebSandboxFlags::kPresentationController,
+           mojom::blink::FeaturePolicyFeature::kPresentation},
+          {network::mojom::blink::WebSandboxFlags::kDownloads,
+           mojom::blink::FeaturePolicyFeature::kDownloads},
+      }));
   return array;
 }
 
@@ -65,95 +63,32 @@ const SandboxFlagFeaturePolicyPairs& SandboxFlagsWithFeaturePolicies() {
 // corresponding feature policies. With FeaturePolicyForSandbox, these flags
 // are always removed from the set of sandbox flags set for a sandboxed
 // <iframe> (those sandbox flags are now contained in the |ContainerPolicy|).
-mojom::blink::WebSandboxFlags SandboxFlagsImplementedByFeaturePolicy() {
-  DEFINE_STATIC_LOCAL(mojom::blink::WebSandboxFlags, mask,
-                      (mojom::blink::WebSandboxFlags::kNone));
-  if (mask == mojom::blink::WebSandboxFlags::kNone) {
+network::mojom::blink::WebSandboxFlags
+SandboxFlagsImplementedByFeaturePolicy() {
+  DEFINE_STATIC_LOCAL(network::mojom::blink::WebSandboxFlags, mask,
+                      (network::mojom::blink::WebSandboxFlags::kNone));
+  if (mask == network::mojom::blink::WebSandboxFlags::kNone) {
     for (const auto& pair : SandboxFlagsWithFeaturePolicies())
       mask |= pair.first;
   }
   return mask;
 }
 
-mojom::blink::WebSandboxFlags ParseSandboxPolicy(
-    const SpaceSplitString& policy,
-    String& invalid_tokens_error_message) {
-  // http://www.w3.org/TR/html5/the-iframe-element.html#attr-iframe-sandbox
-  // Parse the unordered set of unique space-separated tokens.
-  mojom::blink::WebSandboxFlags flags = mojom::blink::WebSandboxFlags::kAll;
-  unsigned length = policy.size();
-  unsigned number_of_token_errors = 0;
-  StringBuilder token_errors;
-
-  for (unsigned index = 0; index < length; index++) {
-    // Turn off the corresponding sandbox flag if it's set as "allowed".
-    String sandbox_token(policy[index]);
-    if (EqualIgnoringASCIICase(sandbox_token, "allow-same-origin")) {
-      flags = flags & ~mojom::blink::WebSandboxFlags::kOrigin;
-    } else if (EqualIgnoringASCIICase(sandbox_token, "allow-forms")) {
-      flags = flags & ~mojom::blink::WebSandboxFlags::kForms;
-    } else if (EqualIgnoringASCIICase(sandbox_token, "allow-scripts")) {
-      flags = flags & ~mojom::blink::WebSandboxFlags::kScripts;
-      flags = flags & ~mojom::blink::WebSandboxFlags::kAutomaticFeatures;
-    } else if (EqualIgnoringASCIICase(sandbox_token, "allow-top-navigation")) {
-      flags = flags & ~mojom::blink::WebSandboxFlags::kTopNavigation;
-    } else if (EqualIgnoringASCIICase(sandbox_token, "allow-popups")) {
-      flags = flags & ~mojom::blink::WebSandboxFlags::kPopups;
-    } else if (EqualIgnoringASCIICase(sandbox_token, "allow-pointer-lock")) {
-      flags = flags & ~mojom::blink::WebSandboxFlags::kPointerLock;
-    } else if (EqualIgnoringASCIICase(sandbox_token,
-                                      "allow-orientation-lock")) {
-      flags = flags & ~mojom::blink::WebSandboxFlags::kOrientationLock;
-    } else if (EqualIgnoringASCIICase(sandbox_token,
-                                      "allow-popups-to-escape-sandbox")) {
-      flags = flags & ~mojom::blink::WebSandboxFlags::
-                          kPropagatesToAuxiliaryBrowsingContexts;
-    } else if (EqualIgnoringASCIICase(sandbox_token, "allow-modals")) {
-      flags = flags & ~mojom::blink::WebSandboxFlags::kModals;
-    } else if (EqualIgnoringASCIICase(sandbox_token, "allow-presentation")) {
-      flags = flags & ~mojom::blink::WebSandboxFlags::kPresentationController;
-    } else if (EqualIgnoringASCIICase(
-                   sandbox_token, "allow-top-navigation-by-user-activation")) {
-      flags = flags &
-              ~mojom::blink::WebSandboxFlags::kTopNavigationByUserActivation;
-    } else if (EqualIgnoringASCIICase(sandbox_token, "allow-downloads")) {
-      flags = flags & ~mojom::blink::WebSandboxFlags::kDownloads;
-    } else if (RuntimeEnabledFeatures::StorageAccessAPIEnabled() &&
-               EqualIgnoringASCIICase(
-                   sandbox_token, "allow-storage-access-by-user-activation")) {
-      flags = flags &
-              ~mojom::blink::WebSandboxFlags::kStorageAccessByUserActivation;
-    } else {
-      token_errors.Append(token_errors.IsEmpty() ? "'" : ", '");
-      token_errors.Append(sandbox_token);
-      token_errors.Append("'");
-      number_of_token_errors++;
-    }
-  }
-
-  if (number_of_token_errors) {
-    token_errors.Append(number_of_token_errors > 1
-                            ? " are invalid sandbox flags."
-                            : " is an invalid sandbox flag.");
-    invalid_tokens_error_message = token_errors.ToString();
-  }
-
-  return flags;
-}
-
 // Removes a certain set of flags from |sandbox_flags| for which we have feature
 // policies implemented.
-mojom::blink::WebSandboxFlags GetSandboxFlagsNotImplementedAsFeaturePolicy(
-    mojom::blink::WebSandboxFlags sandbox_flags) {
+network::mojom::blink::WebSandboxFlags
+GetSandboxFlagsNotImplementedAsFeaturePolicy(
+    network::mojom::blink::WebSandboxFlags sandbox_flags) {
   // Punch all the sandbox flags which are converted to feature policy.
   return sandbox_flags & ~SandboxFlagsImplementedByFeaturePolicy();
 }
 
 void ApplySandboxFlagsToParsedFeaturePolicy(
-    mojom::blink::WebSandboxFlags sandbox_flags,
+    network::mojom::blink::WebSandboxFlags sandbox_flags,
     ParsedFeaturePolicy& parsed_feature_policy) {
   for (const auto& pair : SandboxFlagsWithFeaturePolicies()) {
-    if ((sandbox_flags & pair.first) != mojom::blink::WebSandboxFlags::kNone)
+    if ((sandbox_flags & pair.first) !=
+        network::mojom::blink::WebSandboxFlags::kNone)
       DisallowFeatureIfNotPresent(pair.second, parsed_feature_policy);
   }
 }
diff --git a/chromium/third_party/blink/renderer/core/frame/sandbox_flags.h b/chromium/third_party/blink/renderer/core/frame/sandbox_flags.h
index 817d836fdf0..8bbf7a95cbc 100644
--- a/chromium/third_party/blink/renderer/core/frame/sandbox_flags.h
+++ b/chromium/third_party/blink/renderer/core/frame/sandbox_flags.h
@@ -27,16 +27,14 @@
 #ifndef THIRD_PARTY_BLINK_RENDERER_CORE_FRAME_SANDBOX_FLAGS_H_
 #define THIRD_PARTY_BLINK_RENDERER_CORE_FRAME_SANDBOX_FLAGS_H_
 
+#include "services/network/public/mojom/web_sandbox_flags.mojom-blink-forward.h"
 #include "third_party/blink/public/common/feature_policy/feature_policy.h"
-#include "third_party/blink/public/common/frame/sandbox_flags.h"
-#include "third_party/blink/public/mojom/feature_policy/feature_policy.mojom-blink-forward.h"
 #include "third_party/blink/public/mojom/feature_policy/feature_policy_feature.mojom-blink-forward.h"
-#include "third_party/blink/renderer/core/dom/space_split_string.h"
 #include "third_party/blink/renderer/platform/wtf/forward.h"
 
 namespace blink {
 using SandboxFlagFeaturePolicyPairs =
-    Vector<std::pair<mojom::blink::WebSandboxFlags,
+    Vector<std::pair<network::mojom::blink::WebSandboxFlags,
                      mojom::blink::FeaturePolicyFeature>>;
 
 // Returns a vector of pairs of sandbox flags and the corresponding feature
@@ -44,21 +42,19 @@ using SandboxFlagFeaturePolicyPairs =
 // yet migrated to using feature policies.
 const SandboxFlagFeaturePolicyPairs& SandboxFlagsWithFeaturePolicies();
 
-mojom::blink::WebSandboxFlags ParseSandboxPolicy(
-    const SpaceSplitString& policy,
-    String& invalid_tokens_error_message);
-
 // With FeaturePolicyForSandbox most sandbox flags will be represented with
 // features. This method returns the part of sandbox flags which were not mapped
 // to corresponding features.
-mojom::blink::WebSandboxFlags GetSandboxFlagsNotImplementedAsFeaturePolicy(
-    mojom::blink::WebSandboxFlags);
+network::mojom::blink::WebSandboxFlags
+    GetSandboxFlagsNotImplementedAsFeaturePolicy(
+        network::mojom::blink::WebSandboxFlags);
 
 // Applies the sandbox flags as parsed feature policies; If a flag is present
 // both in the provided flags and in the parsed feature as a feature policy,
 // the parsed policy takes precedence.
-void ApplySandboxFlagsToParsedFeaturePolicy(mojom::blink::WebSandboxFlags,
-                                            ParsedFeaturePolicy&);
+void ApplySandboxFlagsToParsedFeaturePolicy(
+    network::mojom::blink::WebSandboxFlags,
+    ParsedFeaturePolicy&);
 
 }  // namespace blink
 
diff --git a/chromium/third_party/blink/renderer/core/frame/scheduling.cc b/chromium/third_party/blink/renderer/core/frame/scheduling.cc
index cd659ee2522..d270b559c30 100644
--- a/chromium/third_party/blink/renderer/core/frame/scheduling.cc
+++ b/chromium/third_party/blink/renderer/core/frame/scheduling.cc
@@ -5,61 +5,30 @@
 #include "third_party/blink/renderer/core/frame/scheduling.h"
 #include "third_party/blink/public/platform/platform.h"
 #include "third_party/blink/renderer/core/execution_context/execution_context.h"
-#include "third_party/blink/renderer/core/inspector/console_message.h"
-#include "third_party/blink/renderer/platform/heap/heap.h"
+#include "third_party/blink/renderer/core/frame/is_input_pending_options.h"
+#include "third_party/blink/renderer/core/frame/local_dom_window.h"
 #include "third_party/blink/renderer/platform/runtime_enabled_features.h"
 #include "third_party/blink/renderer/platform/scheduler/main_thread/pending_user_input.h"
-#include "third_party/blink/renderer/platform/scheduler/public/pending_user_input_type.h"
 #include "third_party/blink/renderer/platform/scheduler/public/thread_scheduler.h"
-#include "third_party/blink/renderer/platform/wtf/text/atomic_string.h"
-#include "third_party/blink/renderer/platform/wtf/text/string_builder.h"
 
 namespace blink {
 
 bool Scheduling::isInputPending(ScriptState* script_state,
-                                const Vector<String>& input_types) const {
+                                const IsInputPendingOptions* options) const {
   DCHECK(RuntimeEnabledFeatures::ExperimentalIsInputPendingEnabled(
       ExecutionContext::From(script_state)));
 
-  if (!Platform::Current()->IsLockedToSite()) {
-    // As we're interested in checking pending events for as many frames as we
-    // can on the main thread, restrict the API to the case where all frames in
-    // a process are part of the same site to avoid leaking cross-site inputs.
-    ExecutionContext::From(script_state)
-        ->AddConsoleMessage(MakeGarbageCollected<ConsoleMessage>(
-            mojom::ConsoleMessageSource::kJavaScript,
-            mojom::ConsoleMessageLevel::kWarning,
-            "isInputPending requires site-per-process (crbug.com/910421)."));
+  auto* frame = LocalDOMWindow::From(script_state)->GetFrame();
+  if (!frame)
     return false;
-  }
 
   auto* scheduler = ThreadScheduler::Current();
-  auto input_info = scheduler->GetPendingUserInputInfo();
-  if (input_types.size() == 0) {
-    // If unspecified, return true if any input type is pending.
-    return input_info.HasPendingInputType(
-        scheduler::PendingUserInputType::kAny);
-  }
+  auto info = scheduler->GetPendingUserInputInfo(options->includeContinuous());
 
-  bool has_pending_input = false;
-  for (const String& input_type_string : input_types) {
-    const auto pending_input_type = scheduler::PendingUserInput::TypeFromString(
-        AtomicString(input_type_string));
-    if (pending_input_type == scheduler::PendingUserInputType::kNone) {
-      StringBuilder message;
-      message.Append("Unknown input event type \"");
-      message.Append(input_type_string);
-      message.Append("\". Skipping.");
-      ExecutionContext::From(script_state)
-          ->AddConsoleMessage(MakeGarbageCollected<ConsoleMessage>(
-              mojom::ConsoleMessageSource::kJavaScript,
-              mojom::ConsoleMessageLevel::kWarning, message.ToString()));
-    }
-
-    if (!has_pending_input)
-      has_pending_input |= input_info.HasPendingInputType(pending_input_type);
-  }
-  return has_pending_input;
+  // TODO(acomminos): Attribution first requires a reverse mapping between
+  // cc::ElementId instances and their underlying Document* objects.
+  (void)info;
+  return false;
 }
 
 bool Scheduling::isFramePending() const {
diff --git a/chromium/third_party/blink/renderer/core/frame/scheduling.h b/chromium/third_party/blink/renderer/core/frame/scheduling.h
index 55df6f89981..b2f35f168d7 100644
--- a/chromium/third_party/blink/renderer/core/frame/scheduling.h
+++ b/chromium/third_party/blink/renderer/core/frame/scheduling.h
@@ -12,12 +12,14 @@
 
 namespace blink {
 
+class IsInputPendingOptions;
+
 // Low-level scheduling primitives for JS scheduler implementations.
 class Scheduling : public ScriptWrappable {
   DEFINE_WRAPPERTYPEINFO();
 
  public:
-  bool isInputPending(ScriptState*, const Vector<String>& input_types) const;
+  bool isInputPending(ScriptState*, const IsInputPendingOptions* options) const;
   bool isFramePending() const;
 };
 
diff --git a/chromium/third_party/blink/renderer/core/frame/scheduling.idl b/chromium/third_party/blink/renderer/core/frame/scheduling.idl
index c1ae6538e09..ea3bd840d17 100644
--- a/chromium/third_party/blink/renderer/core/frame/scheduling.idl
+++ b/chromium/third_party/blink/renderer/core/frame/scheduling.idl
@@ -2,9 +2,11 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// https://github.com/tdresser/is-input-pending
-[RuntimeEnabled=ExperimentalIsInputPending]
-interface Scheduling {
+// https://github.com/WICG/is-input-pending
+[
+    Exposed=Window,
+    RuntimeEnabled=ExperimentalIsInputPending
+] interface Scheduling {
     [RuntimeEnabled=ExperimentalIsInputPending] boolean isFramePending();
-    [CallWith=ScriptState, MeasureAs=SchedulingIsInputPending, RuntimeEnabled=ExperimentalIsInputPending] boolean isInputPending(optional sequence<DOMString> inputTypes = []);
+    [CallWith=ScriptState, MeasureAs=SchedulingIsInputPending, RuntimeEnabled=ExperimentalIsInputPending] boolean isInputPending(IsInputPendingOptions options);
 };
diff --git a/chromium/third_party/blink/renderer/core/frame/screen.cc b/chromium/third_party/blink/renderer/core/frame/screen.cc
index 835eb382387..4410029341a 100644
--- a/chromium/third_party/blink/renderer/core/frame/screen.cc
+++ b/chromium/third_party/blink/renderer/core/frame/screen.cc
@@ -46,11 +46,11 @@ WebScreenInfo GetScreenInfo(LocalFrame& frame) {
 
 }  // namespace
 
-Screen::Screen(LocalFrame* frame) : DOMWindowClient(frame) {}
+Screen::Screen(LocalFrame* frame) : ExecutionContextClient(frame) {}
 
 int Screen::height() const {
   if (display_) {
-    DCHECK(RuntimeEnabledFeatures::ScreenEnumerationEnabled());
+    DCHECK(RuntimeEnabledFeatures::WindowPlacementEnabled());
     return display_->bounds.height();
   }
   LocalFrame* frame = GetFrame();
@@ -67,7 +67,7 @@ int Screen::height() const {
 
 int Screen::width() const {
   if (display_) {
-    DCHECK(RuntimeEnabledFeatures::ScreenEnumerationEnabled());
+    DCHECK(RuntimeEnabledFeatures::WindowPlacementEnabled());
     return display_->bounds.width();
   }
   LocalFrame* frame = GetFrame();
@@ -84,7 +84,7 @@ int Screen::width() const {
 
 unsigned Screen::colorDepth() const {
   if (display_) {
-    DCHECK(RuntimeEnabledFeatures::ScreenEnumerationEnabled());
+    DCHECK(RuntimeEnabledFeatures::WindowPlacementEnabled());
     return display_->color_depth;
   }
   LocalFrame* frame = GetFrame();
@@ -99,7 +99,7 @@ unsigned Screen::pixelDepth() const {
 
 int Screen::availLeft() const {
   if (display_) {
-    DCHECK(RuntimeEnabledFeatures::ScreenEnumerationEnabled());
+    DCHECK(RuntimeEnabledFeatures::WindowPlacementEnabled());
     return display_->work_area.x();
   }
   LocalFrame* frame = GetFrame();
@@ -116,7 +116,7 @@ int Screen::availLeft() const {
 
 int Screen::availTop() const {
   if (display_) {
-    DCHECK(RuntimeEnabledFeatures::ScreenEnumerationEnabled());
+    DCHECK(RuntimeEnabledFeatures::WindowPlacementEnabled());
     return display_->work_area.y();
   }
   LocalFrame* frame = GetFrame();
@@ -133,7 +133,7 @@ int Screen::availTop() const {
 
 int Screen::availHeight() const {
   if (display_) {
-    DCHECK(RuntimeEnabledFeatures::ScreenEnumerationEnabled());
+    DCHECK(RuntimeEnabledFeatures::WindowPlacementEnabled());
     return display_->work_area.height();
   }
   LocalFrame* frame = GetFrame();
@@ -150,7 +150,7 @@ int Screen::availHeight() const {
 
 int Screen::availWidth() const {
   if (display_) {
-    DCHECK(RuntimeEnabledFeatures::ScreenEnumerationEnabled());
+    DCHECK(RuntimeEnabledFeatures::WindowPlacementEnabled());
     return display_->work_area.width();
   }
   LocalFrame* frame = GetFrame();
@@ -167,21 +167,23 @@ int Screen::availWidth() const {
 
 void Screen::Trace(Visitor* visitor) {
   ScriptWrappable::Trace(visitor);
-  DOMWindowClient::Trace(visitor);
+  ExecutionContextClient::Trace(visitor);
   Supplementable<Screen>::Trace(visitor);
 }
 
 Screen::Screen(display::mojom::blink::DisplayPtr display,
                bool internal,
-               bool primary)
-    : DOMWindowClient(static_cast<LocalFrame*>(nullptr)),
+               bool primary,
+               const String& id)
+    : ExecutionContextClient(static_cast<LocalFrame*>(nullptr)),
       display_(std::move(display)),
       internal_(internal),
-      primary_(primary) {}
+      primary_(primary),
+      id_(id) {}
 
 int Screen::left() const {
   if (display_) {
-    DCHECK(RuntimeEnabledFeatures::ScreenEnumerationEnabled());
+    DCHECK(RuntimeEnabledFeatures::WindowPlacementEnabled());
     return display_->bounds.x();
   }
   LocalFrame* frame = GetFrame();
@@ -198,7 +200,7 @@ int Screen::left() const {
 
 int Screen::top() const {
   if (display_) {
-    DCHECK(RuntimeEnabledFeatures::ScreenEnumerationEnabled());
+    DCHECK(RuntimeEnabledFeatures::WindowPlacementEnabled());
     return display_->bounds.y();
   }
   LocalFrame* frame = GetFrame();
@@ -215,7 +217,7 @@ int Screen::top() const {
 
 bool Screen::internal() const {
   if (display_) {
-    DCHECK(RuntimeEnabledFeatures::ScreenEnumerationEnabled());
+    DCHECK(RuntimeEnabledFeatures::WindowPlacementEnabled());
     return internal_.has_value() && internal_.value();
   }
   // TODO(http://crbug.com/994889): Implement this for |window.screen|?
@@ -225,7 +227,7 @@ bool Screen::internal() const {
 
 bool Screen::primary() const {
   if (display_) {
-    DCHECK(RuntimeEnabledFeatures::ScreenEnumerationEnabled());
+    DCHECK(RuntimeEnabledFeatures::WindowPlacementEnabled());
     return primary_.has_value() && primary_.value();
   }
   // TODO(http://crbug.com/994889): Implement this for |window.screen|?
@@ -235,7 +237,7 @@ bool Screen::primary() const {
 
 float Screen::scaleFactor() const {
   if (display_) {
-    DCHECK(RuntimeEnabledFeatures::ScreenEnumerationEnabled());
+    DCHECK(RuntimeEnabledFeatures::WindowPlacementEnabled());
     return display_->device_scale_factor;
   }
   LocalFrame* frame = GetFrame();
@@ -244,19 +246,30 @@ float Screen::scaleFactor() const {
   return GetScreenInfo(*frame).device_scale_factor;
 }
 
-const String Screen::name() const {
-  // TODO(http://crbug.com/994889): Implement this.
-  NOTIMPLEMENTED_LOG_ONCE();
+const String Screen::id() const {
   if (display_) {
-    DCHECK(RuntimeEnabledFeatures::ScreenEnumerationEnabled());
-    return "Generic Screen";
+    DCHECK(RuntimeEnabledFeatures::WindowPlacementEnabled());
+    return id_;
   }
+  // TODO(http://crbug.com/994889): Implement this for |window.screen|?
+  NOTIMPLEMENTED_LOG_ONCE();
   return String();
 }
 
+bool Screen::touchSupport() const {
+  if (display_) {
+    DCHECK(RuntimeEnabledFeatures::WindowPlacementEnabled());
+    return display_->touch_support ==
+           display::mojom::blink::TouchSupport::AVAILABLE;
+  }
+  // TODO(http://crbug.com/994889): Implement this for |window.screen|?
+  NOTIMPLEMENTED_LOG_ONCE();
+  return false;
+}
+
 int64_t Screen::DisplayId() const {
   if (display_) {
-    DCHECK(RuntimeEnabledFeatures::ScreenEnumerationEnabled());
+    DCHECK(RuntimeEnabledFeatures::WindowPlacementEnabled());
     return display_->id;
   }
   return kInvalidDisplayId;
diff --git a/chromium/third_party/blink/renderer/core/frame/screen.h b/chromium/third_party/blink/renderer/core/frame/screen.h
index 8503ee5f9ef..57b9235cf77 100644
--- a/chromium/third_party/blink/renderer/core/frame/screen.h
+++ b/chromium/third_party/blink/renderer/core/frame/screen.h
@@ -43,7 +43,7 @@ namespace blink {
 class LocalFrame;
 
 class CORE_EXPORT Screen final : public ScriptWrappable,
-                                 public DOMWindowClient,
+                                 public ExecutionContextClient,
                                  public Supplementable<Screen> {
   DEFINE_WRAPPERTYPEINFO();
   USING_GARBAGE_COLLECTED_MIXIN(Screen);
@@ -67,13 +67,15 @@ class CORE_EXPORT Screen final : public ScriptWrappable,
   // TODO(msw): Resolve different info sources, caching, and lifetimes.
   Screen(display::mojom::blink::DisplayPtr display,
          bool internal,
-         bool primary);
+         bool primary,
+         const String& id);
   int left() const;
   int top() const;
   bool internal() const;
   bool primary() const;
   float scaleFactor() const;
-  const String name() const;
+  const String id() const;
+  bool touchSupport() const;
 
   // Not web-exposed; for internal usage only.
   static constexpr int64_t kInvalidDisplayId = -1;
@@ -92,6 +94,10 @@ class CORE_EXPORT Screen final : public ScriptWrappable,
   // value provided upon construction. This member is only valid for Screen
   // objects obtained via the experimental Screen Enumeration API.
   const base::Optional<bool> primary_;
+  // A web-exposed device id; it is a static value provided upon construction.
+  // This member is only valid for Screen objects obtained via the experimental
+  // Screen Enumeration API.
+  const String id_;
 };
 
 }  // namespace blink
diff --git a/chromium/third_party/blink/renderer/core/frame/screen.idl b/chromium/third_party/blink/renderer/core/frame/screen.idl
index d9f328eeb06..9a5e18dbb72 100644
--- a/chromium/third_party/blink/renderer/core/frame/screen.idl
+++ b/chromium/third_party/blink/renderer/core/frame/screen.idl
@@ -44,10 +44,11 @@
 
     // Proposed
     // https://github.com/webscreens/screen-enumeration
-    [RuntimeEnabled=ScreenEnumeration] readonly attribute long left;
-    [RuntimeEnabled=ScreenEnumeration] readonly attribute long top;
-    [RuntimeEnabled=ScreenEnumeration] readonly attribute boolean internal;
-    [RuntimeEnabled=ScreenEnumeration] readonly attribute boolean primary;
-    [RuntimeEnabled=ScreenEnumeration] readonly attribute float scaleFactor;
-    [RuntimeEnabled=ScreenEnumeration] readonly attribute DOMString name;
+    [RuntimeEnabled=WindowPlacement] readonly attribute long left;
+    [RuntimeEnabled=WindowPlacement] readonly attribute long top;
+    [RuntimeEnabled=WindowPlacement] readonly attribute boolean internal;
+    [RuntimeEnabled=WindowPlacement] readonly attribute boolean primary;
+    [RuntimeEnabled=WindowPlacement] readonly attribute float scaleFactor;
+    [RuntimeEnabled=WindowPlacement] readonly attribute DOMString id;
+    [RuntimeEnabled=WindowPlacement] readonly attribute boolean touchSupport;
 };
diff --git a/chromium/third_party/blink/renderer/core/frame/screen_orientation_controller.cc b/chromium/third_party/blink/renderer/core/frame/screen_orientation_controller.cc
deleted file mode 100644
index a8ff1b8a489..00000000000
--- a/chromium/third_party/blink/renderer/core/frame/screen_orientation_controller.cc
+++ /dev/null
@@ -1,33 +0,0 @@
-// Copyright 2016 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "third_party/blink/renderer/core/frame/screen_orientation_controller.h"
-
-namespace blink {
-
-ScreenOrientationController::ScreenOrientationController(LocalFrame& frame)
-    : Supplement<LocalFrame>(frame) {}
-
-// static
-ScreenOrientationController* ScreenOrientationController::From(
-    LocalFrame& frame) {
-  return Supplement<LocalFrame>::From<ScreenOrientationController>(frame);
-}
-
-void ScreenOrientationController::Trace(Visitor* visitor) {
-  Supplement<LocalFrame>::Trace(visitor);
-}
-
-// static
-void ScreenOrientationController::ProvideTo(
-    LocalFrame& frame,
-    ScreenOrientationController* controller) {
-  Supplement<LocalFrame>::ProvideTo(frame, controller);
-}
-
-// static
-const char ScreenOrientationController::kSupplementName[] =
-    "ScreenOrientationController";
-
-}  // namespace blink
diff --git a/chromium/third_party/blink/renderer/core/frame/screen_orientation_controller.h b/chromium/third_party/blink/renderer/core/frame/screen_orientation_controller.h
deleted file mode 100644
index fdda50f2e99..00000000000
--- a/chromium/third_party/blink/renderer/core/frame/screen_orientation_controller.h
+++ /dev/null
@@ -1,57 +0,0 @@
-// Copyright 2016 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef THIRD_PARTY_BLINK_RENDERER_CORE_FRAME_SCREEN_ORIENTATION_CONTROLLER_H_
-#define THIRD_PARTY_BLINK_RENDERER_CORE_FRAME_SCREEN_ORIENTATION_CONTROLLER_H_
-
-#include "third_party/blink/public/common/screen_orientation/web_screen_orientation_lock_type.h"
-#include "third_party/blink/renderer/core/core_export.h"
-#include "third_party/blink/renderer/core/frame/local_frame.h"
-#include "third_party/blink/renderer/platform/supplementable.h"
-
-namespace blink {
-
-class WebLockOrientationCallback;
-
-// ScreenOrientationController allows to manipulate screen orientation in Blink
-// outside of the screen_orientation/ modules. It is an interface that the
-// module will implement and add a provider for.
-// Callers of ScreenOrientationController::from() should always assume the
-// returned pointer can be nullptr.
-class CORE_EXPORT ScreenOrientationController
-    : public GarbageCollected<ScreenOrientationController>,
-      public Supplement<LocalFrame> {
-  USING_GARBAGE_COLLECTED_MIXIN(ScreenOrientationController);
-
- public:
-  static const char kSupplementName[];
-
-  virtual ~ScreenOrientationController() = default;
-
-  static ScreenOrientationController* From(LocalFrame&);
-
-  virtual void NotifyOrientationChanged() = 0;
-
-  virtual void lock(WebScreenOrientationLockType,
-                    std::unique_ptr<WebLockOrientationCallback>) = 0;
-  virtual void unlock() = 0;
-
-  // Returns whether a lock() call was made without an unlock() call. Others
-  // frames might have changed the lock state so this should only be used to
-  // know whether the current frame made an attempt to lock without explicitly
-  // unlocking.
-  virtual bool MaybeHasActiveLock() const = 0;
-
-  void Trace(Visitor*) override;
-
- protected:
-  explicit ScreenOrientationController(LocalFrame&);
-  // To be called by an ScreenOrientationController to register its
-  // implementation.
-  static void ProvideTo(LocalFrame&, ScreenOrientationController*);
-};
-
-}  // namespace blink
-
-#endif  // THIRD_PARTY_BLINK_RENDERER_CORE_FRAME_SCREEN_ORIENTATION_CONTROLLER_H_
diff --git a/chromium/third_party/blink/renderer/core/frame/settings.json5 b/chromium/third_party/blink/renderer/core/frame/settings.json5
index 6d0831608f3..e6ab013ef0e 100644
--- a/chromium/third_party/blink/renderer/core/frame/settings.json5
+++ b/chromium/third_party/blink/renderer/core/frame/settings.json5
@@ -1035,22 +1035,22 @@
     },
     {
       name: "lazyImageFirstKFullyLoadSlow2G",
-      initial: 12,
+      initial: 0,
       type: "int",
     },
     {
       name: "lazyImageFirstKFullyLoad2G",
-      initial: 10,
+      initial: 0,
       type: "int",
     },
     {
       name: "lazyImageFirstKFullyLoad3G",
-      initial: 8,
+      initial: 0,
       type: "int",
     },
     {
       name: "lazyImageFirstKFullyLoad4G",
-      initial: 6,
+      initial: 0,
       type: "int",
     },
 
@@ -1082,5 +1082,12 @@
       invalidate: "MediaQuery",
       type: "NavigationControls",
     },
+
+    {
+      name: "accessibilityAlwaysShowFocus",
+      initial: false,
+      invalidate: "Style",
+      type: "bool"
+    }
   ],
 }
diff --git a/chromium/third_party/blink/renderer/core/frame/ua_data_values.idl b/chromium/third_party/blink/renderer/core/frame/ua_data_values.idl
index 3def0d4d529..095981d5ffc 100644
--- a/chromium/third_party/blink/renderer/core/frame/ua_data_values.idl
+++ b/chromium/third_party/blink/renderer/core/frame/ua_data_values.idl
@@ -5,9 +5,9 @@
 // https://github.com/WICG/ua-client-hints
 
 dictionary UADataValues {
-  DOMString platform = "";
-  DOMString platformVersion = "";
-  DOMString architecture = "";
-  DOMString model = "";
-  DOMString uaFullVersion = "";
+  DOMString platform;
+  DOMString platformVersion;
+  DOMString architecture;
+  DOMString model;
+  DOMString uaFullVersion;
 };
diff --git a/chromium/third_party/blink/renderer/core/frame/visual_viewport.cc b/chromium/third_party/blink/renderer/core/frame/visual_viewport.cc
index 0d3977949cd..74903f8f5ba 100644
--- a/chromium/third_party/blink/renderer/core/frame/visual_viewport.cc
+++ b/chromium/third_party/blink/renderer/core/frame/visual_viewport.cc
@@ -34,7 +34,7 @@
 
 #include "base/metrics/histogram_functions.h"
 #include "cc/input/main_thread_scrolling_reason.h"
-#include "cc/layers/scrollbar_layer_base.h"
+#include "cc/layers/solid_color_scrollbar_layer.h"
 #include "third_party/blink/public/mojom/scroll/scroll_into_view_params.mojom-blink.h"
 #include "third_party/blink/public/platform/task_type.h"
 #include "third_party/blink/renderer/core/frame/local_frame.h"
@@ -630,9 +630,6 @@ void VisualViewport::UpdateScrollbarLayer(ScrollbarOrientation orientation) {
   scoped_refptr<cc::ScrollbarLayerBase>& scrollbar_layer =
       is_horizontal ? scrollbar_layer_horizontal_ : scrollbar_layer_vertical_;
   if (!scrollbar_layer) {
-    ScrollingCoordinator* coordinator = GetPage().GetScrollingCoordinator();
-    DCHECK(coordinator);
-
     auto& theme = ScrollbarThemeOverlayMobile::GetInstance();
     int thumb_thickness = clampTo<int>(
         std::floor(GetPage().GetChromeClient().WindowToViewportScalar(
@@ -640,9 +637,12 @@ void VisualViewport::UpdateScrollbarLayer(ScrollbarOrientation orientation) {
     int scrollbar_margin = clampTo<int>(
         std::floor(GetPage().GetChromeClient().WindowToViewportScalar(
             MainFrame(), theme.ScrollbarMargin())));
-    scrollbar_layer = coordinator->CreateSolidColorScrollbarLayer(
-        orientation, thumb_thickness, scrollbar_margin, false,
-        GetScrollbarElementId(orientation));
+    cc::ScrollbarOrientation cc_orientation =
+        orientation == kHorizontalScrollbar ? cc::HORIZONTAL : cc::VERTICAL;
+    scrollbar_layer = cc::SolidColorScrollbarLayer::Create(
+        cc_orientation, thumb_thickness, scrollbar_margin,
+        /*is_left_side_vertical_scrollbar*/ false);
+    scrollbar_layer->SetElementId(GetScrollbarElementId(orientation));
     scrollbar_layer->SetScrollElementId(scroll_layer_->element_id());
     scrollbar_layer->SetIsDrawable(true);
   }
diff --git a/chromium/third_party/blink/renderer/core/frame/visual_viewport.idl b/chromium/third_party/blink/renderer/core/frame/visual_viewport.idl
index 4d64ea5347d..6aedf344bc9 100644
--- a/chromium/third_party/blink/renderer/core/frame/visual_viewport.idl
+++ b/chromium/third_party/blink/renderer/core/frame/visual_viewport.idl
@@ -27,6 +27,7 @@
  // WICG proposal: https://github.com/WICG/ViewportAPI
 
 [
+    Exposed=Window,
     ImplementedAs=DOMVisualViewport
 ] interface VisualViewport : EventTarget {
     [HighEntropy, Measure] readonly attribute double offsetLeft;
diff --git a/chromium/third_party/blink/renderer/core/frame/visual_viewport_test.cc b/chromium/third_party/blink/renderer/core/frame/visual_viewport_test.cc
index c0d594da78d..5fc2bfe737b 100644
--- a/chromium/third_party/blink/renderer/core/frame/visual_viewport_test.cc
+++ b/chromium/third_party/blink/renderer/core/frame/visual_viewport_test.cc
@@ -13,9 +13,9 @@
 #include "cc/trees/transform_node.h"
 #include "testing/gmock/include/gmock/gmock.h"
 #include "testing/gtest/include/gtest/gtest.h"
+#include "third_party/blink/public/common/input/web_coalesced_input_event.h"
 #include "third_party/blink/public/common/input/web_input_event.h"
 #include "third_party/blink/public/mojom/fetch/fetch_api_request.mojom-blink.h"
-#include "third_party/blink/public/platform/web_coalesced_input_event.h"
 #include "third_party/blink/public/platform/web_url_loader_mock_factory.h"
 #include "third_party/blink/public/web/web_ax_context.h"
 #include "third_party/blink/public/web/web_context_menu_data.h"
@@ -1135,7 +1135,7 @@ TEST_P(VisualViewportTest, TestContextMenuShownInCorrectLocation) {
   RegisterMockedHttpURLLoad("200-by-300.html");
   NavigateTo(base_url_ + "200-by-300.html");
 
-  WebMouseEvent mouse_down_event(WebInputEvent::kMouseDown,
+  WebMouseEvent mouse_down_event(WebInputEvent::Type::kMouseDown,
                                  WebInputEvent::kNoModifiers,
                                  WebInputEvent::GetStaticTimeStampForTests());
   mouse_down_event.SetPositionInWidget(10, 10);
@@ -1145,7 +1145,7 @@ TEST_P(VisualViewportTest, TestContextMenuShownInCorrectLocation) {
 
   // Corresponding release event (Windows shows context menu on release).
   WebMouseEvent mouse_up_event(mouse_down_event);
-  mouse_up_event.SetType(WebInputEvent::kMouseUp);
+  mouse_up_event.SetType(WebInputEvent::Type::kMouseUp);
 
   WebLocalFrameClient* old_client = WebView()->MainFrameImpl()->Client();
   VisualViewportMockWebFrameClient mock_web_frame_client;
@@ -1157,14 +1157,14 @@ TEST_P(VisualViewportTest, TestContextMenuShownInCorrectLocation) {
   // Do a sanity check with no scale applied.
   WebView()->MainFrameImpl()->SetClient(&mock_web_frame_client);
   WebView()->MainFrameWidget()->HandleInputEvent(
-      WebCoalescedInputEvent(mouse_down_event));
+      WebCoalescedInputEvent(mouse_down_event, ui::LatencyInfo()));
   WebView()->MainFrameWidget()->HandleInputEvent(
-      WebCoalescedInputEvent(mouse_up_event));
+      WebCoalescedInputEvent(mouse_up_event, ui::LatencyInfo()));
 
   Mock::VerifyAndClearExpectations(&mock_web_frame_client);
   mouse_down_event.button = WebMouseEvent::Button::kLeft;
   WebView()->MainFrameWidget()->HandleInputEvent(
-      WebCoalescedInputEvent(mouse_down_event));
+      WebCoalescedInputEvent(mouse_down_event, ui::LatencyInfo()));
 
   // Now pinch zoom into the page and move the visual viewport. The context menu
   // should still appear at the location of the event, relative to the WebView.
@@ -1179,9 +1179,9 @@ TEST_P(VisualViewportTest, TestContextMenuShownInCorrectLocation) {
 
   mouse_down_event.button = WebMouseEvent::Button::kRight;
   WebView()->MainFrameWidget()->HandleInputEvent(
-      WebCoalescedInputEvent(mouse_down_event));
+      WebCoalescedInputEvent(mouse_down_event, ui::LatencyInfo()));
   WebView()->MainFrameWidget()->HandleInputEvent(
-      WebCoalescedInputEvent(mouse_up_event));
+      WebCoalescedInputEvent(mouse_up_event, ui::LatencyInfo()));
 
   // Reset the old client so destruction can occur naturally.
   WebView()->MainFrameImpl()->SetClient(old_client);
@@ -1899,7 +1899,7 @@ TEST_P(VisualViewportTest, SlowScrollAfterImplScroll) {
 
   // Send a scroll event on the main thread path.
   WebGestureEvent gsb(
-      WebInputEvent::kGestureScrollBegin, WebInputEvent::kNoModifiers,
+      WebInputEvent::Type::kGestureScrollBegin, WebInputEvent::kNoModifiers,
       WebInputEvent::GetStaticTimeStampForTests(), WebGestureDevice::kTouchpad);
   gsb.SetFrameScale(1);
   gsb.data.scroll_begin.delta_x_hint = -50;
@@ -1909,7 +1909,7 @@ TEST_P(VisualViewportTest, SlowScrollAfterImplScroll) {
   GetFrame()->GetEventHandler().HandleGestureEvent(gsb);
 
   WebGestureEvent gsu(
-      WebInputEvent::kGestureScrollUpdate, WebInputEvent::kNoModifiers,
+      WebInputEvent::Type::kGestureScrollUpdate, WebInputEvent::kNoModifiers,
       WebInputEvent::GetStaticTimeStampForTests(), WebGestureDevice::kTouchpad);
   gsu.SetFrameScale(1);
   gsu.data.scroll_update.delta_x = -50;
@@ -2654,7 +2654,7 @@ TEST_P(VisualViewportTest, PaintScrollbar) {
   auto check_scrollbar = [](const cc::Layer* scrollbar, float scale) {
     EXPECT_TRUE(scrollbar->DrawsContent());
     EXPECT_FALSE(scrollbar->HitTestable());
-    EXPECT_TRUE(scrollbar->is_scrollbar());
+    EXPECT_TRUE(scrollbar->IsScrollbarLayerForTesting());
     EXPECT_EQ(
         cc::VERTICAL,
         static_cast<const cc::ScrollbarLayerBase*>(scrollbar)->orientation());
diff --git a/chromium/third_party/blink/renderer/core/frame/web_frame_widget_base.cc b/chromium/third_party/blink/renderer/core/frame/web_frame_widget_base.cc
index cce5caed45a..b39722bc337 100644
--- a/chromium/third_party/blink/renderer/core/frame/web_frame_widget_base.cc
+++ b/chromium/third_party/blink/renderer/core/frame/web_frame_widget_base.cc
@@ -12,7 +12,9 @@
 #include "base/time/time.h"
 #include "cc/trees/layer_tree_host.h"
 #include "cc/trees/swap_promise.h"
+#include "cc/trees/ukm_manager.h"
 #include "third_party/blink/public/platform/platform.h"
+#include "third_party/blink/public/platform/scheduler/web_render_widget_scheduling_state.h"
 #include "third_party/blink/public/web/web_local_frame.h"
 #include "third_party/blink/public/web/web_widget_client.h"
 #include "third_party/blink/renderer/core/dom/element.h"
@@ -96,12 +98,15 @@ void WebFrameWidgetBase::BindLocalRoot(WebLocalFrame& local_root) {
           &WebFrameWidgetBase::RequestAnimationAfterDelayTimerFired));
 }
 
-void WebFrameWidgetBase::Close() {
+void WebFrameWidgetBase::Close(
+    scoped_refptr<base::SingleThreadTaskRunner> cleanup_runner,
+    base::OnceCallback<void()> cleanup_task) {
   mutator_dispatcher_ = nullptr;
   local_root_->SetFrameWidget(nullptr);
   local_root_ = nullptr;
   client_ = nullptr;
   request_animation_after_delay_timer_.reset();
+  widget_base_->Shutdown(std::move(cleanup_runner), std::move(cleanup_task));
   widget_base_.reset();
   receiver_.reset();
 }
@@ -252,7 +257,7 @@ void WebFrameWidgetBase::DragSourceEndedAt(const gfx::PointF& point_in_viewport,
           FloatPoint(point_in_viewport)));
 
   WebMouseEvent fake_mouse_move(
-      WebInputEvent::kMouseMove, point_in_root_frame, screen_point,
+      WebInputEvent::Type::kMouseMove, point_in_root_frame, screen_point,
       WebPointerProperties::Button::kLeft, 0, WebInputEvent::kNoModifiers,
       base::TimeTicks::Now());
   fake_mouse_move.SetFrameScale(1);
@@ -368,6 +373,11 @@ Page* WebFrameWidgetBase::GetPage() const {
   return View()->GetPage();
 }
 
+const mojo::AssociatedRemote<mojom::blink::FrameWidgetHost>&
+WebFrameWidgetBase::GetAssociatedFrameWidgetHost() const {
+  return frame_widget_host_;
+}
+
 void WebFrameWidgetBase::DidAcquirePointerLock() {
   GetPage()->GetPointerLockController().DidAcquirePointerLock();
 
@@ -436,6 +446,40 @@ void WebFrameWidgetBase::RequestBeginMainFrameNotExpected(bool request) {
   widget_base_->LayerTreeHost()->RequestBeginMainFrameNotExpected(request);
 }
 
+void WebFrameWidgetBase::EndCommitCompositorFrame(
+    base::TimeTicks commit_start_time) {
+  Client()->DidCommitCompositorFrame(commit_start_time);
+}
+
+void WebFrameWidgetBase::DidCommitAndDrawCompositorFrame() {
+  Client()->DidCommitAndDrawCompositorFrame();
+}
+
+void WebFrameWidgetBase::OnDeferMainFrameUpdatesChanged(bool defer) {
+  Client()->OnDeferMainFrameUpdatesChanged(defer);
+}
+
+void WebFrameWidgetBase::OnDeferCommitsChanged(bool defer) {
+  Client()->OnDeferCommitsChanged(defer);
+}
+
+void WebFrameWidgetBase::RequestNewLayerTreeFrameSink(
+    LayerTreeFrameSinkCallback callback) {
+  Client()->RequestNewLayerTreeFrameSink(std::move(callback));
+}
+
+void WebFrameWidgetBase::DidCompletePageScaleAnimation() {
+  Client()->DidCompletePageScaleAnimation();
+}
+
+void WebFrameWidgetBase::DidBeginMainFrame() {
+  Client()->DidBeginMainFrame();
+}
+
+void WebFrameWidgetBase::WillBeginMainFrame() {
+  Client()->WillBeginMainFrame();
+}
+
 int WebFrameWidgetBase::GetLayerTreeId() {
   if (!View()->does_composite())
     return 0;
@@ -451,6 +495,26 @@ void WebFrameWidgetBase::SetEventListenerProperties(
     cc::EventListenerProperties listener_properties) {
   widget_base_->LayerTreeHost()->SetEventListenerProperties(
       listener_class, listener_properties);
+
+  if (listener_class == cc::EventListenerClass::kTouchStartOrMove ||
+      listener_class == cc::EventListenerClass::kTouchEndOrCancel) {
+    bool has_touch_handlers =
+        EventListenerProperties(cc::EventListenerClass::kTouchStartOrMove) !=
+            cc::EventListenerProperties::kNone ||
+        EventListenerProperties(cc::EventListenerClass::kTouchEndOrCancel) !=
+            cc::EventListenerProperties::kNone;
+    if (!has_touch_handlers_ || *has_touch_handlers_ != has_touch_handlers) {
+      has_touch_handlers_ = has_touch_handlers;
+
+      // Can be NULL when running tests.
+      if (auto* scheduler_state = widget_base_->RendererWidgetSchedulingState())
+        scheduler_state->SetHasTouchHandler(has_touch_handlers);
+      frame_widget_host_->SetHasTouchEventHandlers(has_touch_handlers);
+    }
+  } else if (listener_class == cc::EventListenerClass::kPointerRawUpdate) {
+    client_->SetHasPointerRawUpdateEventHandlers(
+        listener_properties != cc::EventListenerProperties::kNone);
+  }
 }
 
 cc::EventListenerProperties WebFrameWidgetBase::EventListenerProperties(
@@ -459,6 +523,10 @@ cc::EventListenerProperties WebFrameWidgetBase::EventListenerProperties(
       listener_class);
 }
 
+mojom::blink::DisplayMode WebFrameWidgetBase::DisplayMode() const {
+  return display_mode_;
+}
+
 void WebFrameWidgetBase::StartDeferringCommits(base::TimeDelta timeout) {
   if (!View()->does_composite())
     return;
@@ -514,7 +582,7 @@ void WebFrameWidgetBase::PointerLockMouseEvent(
 
   AtomicString event_type;
   switch (input_event.GetType()) {
-    case WebInputEvent::kMouseDown:
+    case WebInputEvent::Type::kMouseDown:
       event_type = event_type_names::kMousedown;
       if (!GetPage() || !GetPage()->GetPointerLockController().GetElement())
         break;
@@ -524,10 +592,10 @@ void WebFrameWidgetBase::PointerLockMouseEvent(
                                            ->GetDocument()
                                            .GetFrame());
       break;
-    case WebInputEvent::kMouseUp:
+    case WebInputEvent::Type::kMouseUp:
       event_type = event_type_names::kMouseup;
       break;
-    case WebInputEvent::kMouseMove:
+    case WebInputEvent::Type::kMouseMove:
       event_type = event_type_names::kMousemove;
       break;
     default:
@@ -581,34 +649,26 @@ WebLocalFrame* WebFrameWidgetBase::FocusedWebLocalFrameInWidget() const {
   return WebLocalFrameImpl::FromFrame(FocusedLocalFrameInWidget());
 }
 
-void WebFrameWidgetBase::SetCompositorHosts(cc::LayerTreeHost* layer_tree_host,
-                                            cc::AnimationHost* animation_host) {
-  widget_base_->SetCompositorHosts(layer_tree_host, animation_host);
+cc::LayerTreeHost* WebFrameWidgetBase::InitializeCompositing(
+    cc::TaskGraphRunner* task_graph_runner,
+    const cc::LayerTreeSettings& settings,
+    std::unique_ptr<cc::UkmRecorderFactory> ukm_recorder_factory) {
+  widget_base_->InitializeCompositing(task_graph_runner, settings,
+                                      std::move(ukm_recorder_factory));
   GetPage()->AnimationHostInitialized(*AnimationHost(),
                                       GetLocalFrameViewForAnimationScrolling());
+  return widget_base_->LayerTreeHost();
 }
 
 void WebFrameWidgetBase::SetCompositorVisible(bool visible) {
   widget_base_->SetCompositorVisible(visible);
 }
 
-void WebFrameWidgetBase::UpdateVisualState() {
-  widget_base_->UpdateVisualState();
-}
-
 void WebFrameWidgetBase::RecordTimeToFirstActivePaint(
     base::TimeDelta duration) {
   Client()->RecordTimeToFirstActivePaint(duration);
 }
 
-void WebFrameWidgetBase::BeginFrame(base::TimeTicks frame_time) {
-  widget_base_->BeginMainFrame(frame_time);
-}
-
-void WebFrameWidgetBase::WillBeginCompositorFrame() {
-  widget_base_->WillBeginCompositorFrame();
-}
-
 void WebFrameWidgetBase::DispatchRafAlignedInput(base::TimeTicks frame_time) {
   base::TimeTicks raf_aligned_input_start_time;
   if (LocalRootImpl() && WidgetBase::ShouldRecordBeginMainFrameMetrics()) {
@@ -626,10 +686,32 @@ void WebFrameWidgetBase::DispatchRafAlignedInput(base::TimeTicks frame_time) {
 
 void WebFrameWidgetBase::ApplyViewportChangesForTesting(
     const ApplyViewportChangesArgs& args) {
-  // TODO(dtapuska): Temporarily just call ApplyViewportChanges.
-  // ApplyViewportChanges will eventually be removed when compositing moves into
-  // |widget_base_|.
-  ApplyViewportChanges(args);
+  widget_base_->ApplyViewportChanges(args);
+}
+
+void WebFrameWidgetBase::SetDisplayMode(mojom::blink::DisplayMode mode) {
+  if (mode != display_mode_) {
+    display_mode_ = mode;
+    LocalFrame* frame = LocalRootImpl()->GetFrame();
+    frame->MediaQueryAffectingValueChangedForLocalSubtree(
+        MediaValueChange::kOther);
+  }
+}
+
+void WebFrameWidgetBase::SetCursor(const ui::Cursor& cursor) {
+  widget_base_->SetCursor(cursor);
+}
+
+void WebFrameWidgetBase::AutoscrollStart(const gfx::PointF& position) {
+  GetAssociatedFrameWidgetHost()->AutoscrollStart(std::move(position));
+}
+
+void WebFrameWidgetBase::AutoscrollFling(const gfx::Vector2dF& velocity) {
+  GetAssociatedFrameWidgetHost()->AutoscrollFling(std::move(velocity));
+}
+
+void WebFrameWidgetBase::AutoscrollEnd() {
+  GetAssociatedFrameWidgetHost()->AutoscrollEnd();
 }
 
 void WebFrameWidgetBase::RequestAnimationAfterDelay(
@@ -761,8 +843,8 @@ class ReportTimeSwapPromise : public cc::SwapPromise {
       int frame_token) {
     // If the widget was collected or the widget wasn't collected yet, but
     // it was closed don't schedule a presentation callback.
-    if (widget && widget->Client()) {
-      widget->Client()->AddPresentationCallback(
+    if (widget && widget->widget_base_) {
+      widget->widget_base_->AddPresentationCallback(
           frame_token,
           WTF::Bind(&RunCallbackAfterPresentation,
                     std::move(presentation_time_callback), swap_time));
@@ -832,4 +914,9 @@ void WebFrameWidgetBase::NotifySwapAndPresentationTime(
           this));
 }
 
+scheduler::WebRenderWidgetSchedulingState*
+WebFrameWidgetBase::RendererWidgetSchedulingState() {
+  return widget_base_->RendererWidgetSchedulingState();
+}
+
 }  // namespace blink
diff --git a/chromium/third_party/blink/renderer/core/frame/web_frame_widget_base.h b/chromium/third_party/blink/renderer/core/frame/web_frame_widget_base.h
index 2663b0e651d..9cfb36d4718 100644
--- a/chromium/third_party/blink/renderer/core/frame/web_frame_widget_base.h
+++ b/chromium/third_party/blink/renderer/core/frame/web_frame_widget_base.h
@@ -13,10 +13,11 @@
 #include "mojo/public/cpp/bindings/associated_receiver.h"
 #include "mojo/public/cpp/bindings/associated_remote.h"
 #include "services/network/public/mojom/referrer_policy.mojom-blink-forward.h"
+#include "third_party/blink/public/common/input/web_coalesced_input_event.h"
 #include "third_party/blink/public/common/input/web_gesture_device.h"
+#include "third_party/blink/public/mojom/manifest/display_mode.mojom-blink.h"
 #include "third_party/blink/public/mojom/page/widget.mojom-blink.h"
 #include "third_party/blink/public/platform/cross_variant_mojo_util.h"
-#include "third_party/blink/public/platform/web_coalesced_input_event.h"
 #include "third_party/blink/public/platform/web_drag_data.h"
 #include "third_party/blink/public/web/web_frame_widget.h"
 #include "third_party/blink/renderer/core/clipboard/data_object.h"
@@ -44,7 +45,6 @@ class PaintWorkletPaintDispatcher;
 class WebLocalFrameImpl;
 class WebViewImpl;
 class WidgetBase;
-struct IntrinsicSizingInfo;
 
 class CORE_EXPORT WebFrameWidgetBase
     : public GarbageCollected<WebFrameWidgetBase>,
@@ -76,7 +76,12 @@ class CORE_EXPORT WebFrameWidgetBase
   void BindLocalRoot(WebLocalFrame&);
 
   virtual bool ForSubframe() const = 0;
-  virtual void IntrinsicSizingInfoChanged(const IntrinsicSizingInfo&) {}
+  virtual void IntrinsicSizingInfoChanged(
+      mojom::blink::IntrinsicSizingInfoPtr) {}
+
+  void AutoscrollStart(const gfx::PointF& position);
+  void AutoscrollFling(const gfx::Vector2dF& position);
+  void AutoscrollEnd();
 
   // Creates or returns cached mutator dispatcher. This usually requires a
   // round trip to the compositor. The returned WeakPtr must only be
@@ -91,7 +96,7 @@ class CORE_EXPORT WebFrameWidgetBase
   base::WeakPtr<PaintWorkletPaintDispatcher> EnsureCompositorPaintDispatcher(
       scoped_refptr<base::SingleThreadTaskRunner>* paint_task_runner);
 
-  virtual HitTestResult CoreHitTestResultAt(const gfx::Point&) = 0;
+  virtual HitTestResult CoreHitTestResultAt(const gfx::PointF&) = 0;
 
   // FrameWidget implementation.
   WebWidgetClient* Client() const final { return client_; }
@@ -111,9 +116,9 @@ class CORE_EXPORT WebFrameWidgetBase
                                   cc::EventListenerProperties) final;
   cc::EventListenerProperties EventListenerProperties(
       cc::EventListenerClass) const final;
+  mojom::blink::DisplayMode DisplayMode() const override;
 
   // WebFrameWidget implementation.
-  void Close() override;
   WebLocalFrame* LocalRoot() const override;
   WebDragOperation DragTargetDragEnter(const WebDragData&,
                                        const gfx::PointF& point_in_viewport,
@@ -140,12 +145,13 @@ class CORE_EXPORT WebFrameWidgetBase
       cc::ElementId scroll_latched_element_id) override;
 
   WebLocalFrame* FocusedWebLocalFrameInWidget() const override;
-  void SetCompositorHosts(cc::LayerTreeHost*, cc::AnimationHost*) override;
   void ApplyViewportChangesForTesting(
       const ApplyViewportChangesArgs& args) override;
   void NotifySwapAndPresentationTime(
       WebReportTimeCallback swap_callback,
       WebReportTimeCallback presentation_callback) override;
+  scheduler::WebRenderWidgetSchedulingState* RendererWidgetSchedulingState()
+      override;
 
   // Called when a drag-n-drop operation should begin.
   void StartDragging(network::mojom::ReferrerPolicy,
@@ -159,23 +165,53 @@ class CORE_EXPORT WebFrameWidgetBase
   static bool IgnoreInputEvents() { return ignore_input_events_; }
 
   // WebWidget methods.
+  cc::LayerTreeHost* InitializeCompositing(
+      cc::TaskGraphRunner* task_graph_runner,
+      const cc::LayerTreeSettings& settings,
+      std::unique_ptr<cc::UkmRecorderFactory> ukm_recorder_factory) override;
+  void Close(scoped_refptr<base::SingleThreadTaskRunner> cleanup_runner,
+             base::OnceCallback<void()> cleanup_task) override;
   void DidAcquirePointerLock() override;
   void DidNotAcquirePointerLock() override;
   void DidLosePointerLock() override;
   void ShowContextMenu(WebMenuSourceType) override;
-  void BeginFrame(base::TimeTicks frame_time) final;
   void SetCompositorVisible(bool visible) override;
-  void UpdateVisualState() override;
-  void WillBeginCompositorFrame() final;
+  void SetDisplayMode(mojom::blink::DisplayMode) override;
+  void SetCursor(const ui::Cursor& cursor) override;
 
   // WidgetBaseClient methods.
   void DispatchRafAlignedInput(base::TimeTicks frame_time) override;
   void RecordTimeToFirstActivePaint(base::TimeDelta duration) override;
+  void EndCommitCompositorFrame(base::TimeTicks commit_start_time) override;
+  void DidCommitAndDrawCompositorFrame() override;
+  void OnDeferMainFrameUpdatesChanged(bool defer) override;
+  void OnDeferCommitsChanged(bool defer) override;
+  void RequestNewLayerTreeFrameSink(
+      LayerTreeFrameSinkCallback callback) override;
+  void DidCompletePageScaleAnimation() override;
+  void DidBeginMainFrame() override;
+  void WillBeginMainFrame() override;
 
   // mojom::blink::FrameWidget methods.
   void DragSourceSystemDragEnded() override;
   void SetBackgroundOpaque(bool opaque) override;
 
+  // Sets the inherited effective touch action on an out-of-process iframe.
+  void SetInheritedEffectiveTouchActionForSubFrame(
+      WebTouchAction touch_action) override {}
+
+  // Toggles render throttling for an out-of-process iframe. Local frames are
+  // throttled based on their visibility in the viewport, but remote frames
+  // have to have throttling information propagated from parent to child
+  // across processes.
+  void UpdateRenderThrottlingStatusForSubFrame(
+      bool is_throttled,
+      bool subtree_throttled) override {}
+
+  // Sets the inert bit on an out-of-process iframe, causing it to ignore
+  // input.
+  void SetIsInertForSubFrame(bool inert) override {}
+
   // Called when the FrameView for this Widget's local root is created.
   virtual void DidCreateLocalRootView() {}
 
@@ -265,6 +301,9 @@ class CORE_EXPORT WebFrameWidgetBase
   // the page is shutting down, but will be valid at all other times.
   Page* GetPage() const;
 
+  const mojo::AssociatedRemote<mojom::blink::FrameWidgetHost>&
+  GetAssociatedFrameWidgetHost() const;
+
   // Helper function to process events while pointer locked.
   void PointerLockMouseEvent(const WebCoalescedInputEvent&);
 
@@ -296,6 +335,8 @@ class CORE_EXPORT WebFrameWidgetBase
   void CancelDrag();
   void RequestAnimationAfterDelayTimerFired(TimerBase*);
 
+  static bool ignore_input_events_;
+
   WebWidgetClient* client_;
 
   // WebFrameWidget is associated with a subtree of the frame tree,
@@ -303,7 +344,7 @@ class CORE_EXPORT WebFrameWidgetBase
   // points to the root of that subtree.
   Member<WebLocalFrameImpl> local_root_;
 
-  static bool ignore_input_events_;
+  mojom::blink::DisplayMode display_mode_;
 
   // This is owned by the LayerTreeHostImpl, and should only be used on the
   // compositor thread, so we keep the TaskRunner where you post tasks to
@@ -325,7 +366,12 @@ class CORE_EXPORT WebFrameWidgetBase
   mojo::AssociatedRemote<mojom::blink::FrameWidgetHost> frame_widget_host_;
   mojo::AssociatedReceiver<mojom::blink::FrameWidget> receiver_;
 
+  // Different consumers in the browser process makes different assumptions, so
+  // must always send the first IPC regardless of value.
+  base::Optional<bool> has_touch_handlers_;
+
   friend class WebViewImpl;
+  friend class ReportTimeSwapPromise;
 };
 
 template <>
diff --git a/chromium/third_party/blink/renderer/core/frame/web_frame_widget_impl.cc b/chromium/third_party/blink/renderer/core/frame/web_frame_widget_impl.cc
index dd8f1641e16..12628872674 100644
--- a/chromium/third_party/blink/renderer/core/frame/web_frame_widget_impl.cc
+++ b/chromium/third_party/blink/renderer/core/frame/web_frame_widget_impl.cc
@@ -37,6 +37,7 @@
 #include "base/optional.h"
 #include "build/build_config.h"
 #include "cc/layers/picture_layer.h"
+#include "third_party/blink/public/mojom/frame/intrinsic_sizing_info.mojom-blink.h"
 #include "third_party/blink/public/platform/platform.h"
 #include "third_party/blink/public/web/web_autofill_client.h"
 #include "third_party/blink/public/web/web_element.h"
@@ -194,10 +195,12 @@ void WebFrameWidgetImpl::Trace(Visitor* visitor) {
 
 // WebWidget ------------------------------------------------------------------
 
-void WebFrameWidgetImpl::Close() {
+void WebFrameWidgetImpl::Close(
+    scoped_refptr<base::SingleThreadTaskRunner> cleanup_runner,
+    base::OnceCallback<void()> cleanup_task) {
   GetPage()->WillCloseAnimationHost(LocalRootImpl()->GetFrame()->View());
 
-  WebFrameWidgetBase::Close();
+  WebFrameWidgetBase::Close(std::move(cleanup_runner), std::move(cleanup_task));
 
   self_keep_alive_.Clear();
 }
@@ -310,8 +313,9 @@ void WebFrameWidgetImpl::BeginMainFrame(base::TimeTicks last_frame_time) {
     GetPage()->GetValidationMessageClient().LayoutOverlay();
 }
 
-void WebFrameWidgetImpl::DidBeginFrame() {
+void WebFrameWidgetImpl::DidBeginMainFrame() {
   DCHECK(LocalRootImpl()->GetFrame());
+  WebFrameWidgetBase::DidBeginMainFrame();
   PageWidgetDelegate::DidBeginFrame(*LocalRootImpl()->GetFrame());
 }
 
@@ -393,6 +397,7 @@ void WebFrameWidgetImpl::UpdateLifecycle(WebLifecycleUpdate requested_update,
       LocalRootImpl()->GetFrame()->GetDocument()->Lifecycle());
   PageWidgetDelegate::UpdateLifecycle(*GetPage(), *LocalRootImpl()->GetFrame(),
                                       requested_update, reason);
+  View()->UpdatePagePopup();
 }
 
 void WebFrameWidgetImpl::ThemeChanged() {
@@ -402,7 +407,7 @@ void WebFrameWidgetImpl::ThemeChanged() {
   view->InvalidateRect(damaged_rect);
 }
 
-WebHitTestResult WebFrameWidgetImpl::HitTestResultAt(const gfx::Point& point) {
+WebHitTestResult WebFrameWidgetImpl::HitTestResultAt(const gfx::PointF& point) {
   return CoreHitTestResultAt(point);
 }
 
@@ -474,25 +479,25 @@ WebInputEventResult WebFrameWidgetImpl::HandleInputEvent(
     HTMLPlugInElement* target = mouse_capture_element_;
 
     // Not all platforms call mouseCaptureLost() directly.
-    if (input_event.GetType() == WebInputEvent::kMouseUp)
+    if (input_event.GetType() == WebInputEvent::Type::kMouseUp)
       MouseCaptureLost();
 
     AtomicString event_type;
     switch (input_event.GetType()) {
-      case WebInputEvent::kMouseEnter:
+      case WebInputEvent::Type::kMouseEnter:
         event_type = event_type_names::kMouseover;
         break;
-      case WebInputEvent::kMouseMove:
+      case WebInputEvent::Type::kMouseMove:
         event_type = event_type_names::kMousemove;
         break;
-      case WebInputEvent::kMouseLeave:
+      case WebInputEvent::Type::kMouseLeave:
         event_type = event_type_names::kMouseout;
         break;
-      case WebInputEvent::kMouseDown:
+      case WebInputEvent::Type::kMouseDown:
         event_type = event_type_names::kMousedown;
         LocalFrame::NotifyUserActivation(target->GetDocument().GetFrame());
         break;
-      case WebInputEvent::kMouseUp:
+      case WebInputEvent::Type::kMouseUp:
         event_type = event_type_names::kMouseup;
         break;
       default:
@@ -523,11 +528,6 @@ void WebFrameWidgetImpl::SetCursorVisibilityState(bool is_visible) {
   GetPage()->SetIsCursorVisible(is_visible);
 }
 
-void WebFrameWidgetImpl::OnFallbackCursorModeToggled(bool is_on) {
-  // TODO(crbug.com/944575) Should support oopif.
-  NOTREACHED();
-}
-
 void WebFrameWidgetImpl::DidDetachLocalFrameTree() {}
 
 WebInputMethodController*
@@ -554,13 +554,9 @@ bool WebFrameWidgetImpl::ScrollFocusedEditableElementIntoView() {
 }
 
 void WebFrameWidgetImpl::IntrinsicSizingInfoChanged(
-    const IntrinsicSizingInfo& sizing_info) {
-  WebIntrinsicSizingInfo web_sizing_info;
-  web_sizing_info.size = sizing_info.size;
-  web_sizing_info.aspect_ratio = sizing_info.aspect_ratio;
-  web_sizing_info.has_width = sizing_info.has_width;
-  web_sizing_info.has_height = sizing_info.has_height;
-  Client()->IntrinsicSizingInfoChanged(web_sizing_info);
+    mojom::blink::IntrinsicSizingInfoPtr sizing_info) {
+  GetAssociatedFrameWidgetHost()->IntrinsicSizingInfoChanged(
+      std::move(sizing_info));
 }
 
 void WebFrameWidgetImpl::MouseCaptureLost() {
@@ -646,21 +642,22 @@ void WebFrameWidgetImpl::SetRemoteViewportIntersection(
       intersection_state);
 }
 
-void WebFrameWidgetImpl::SetIsInert(bool inert) {
+void WebFrameWidgetImpl::SetIsInertForSubFrame(bool inert) {
   DCHECK(LocalRootImpl()->Parent());
   DCHECK(LocalRootImpl()->Parent()->IsWebRemoteFrame());
   LocalRootImpl()->GetFrame()->SetIsInert(inert);
 }
 
-void WebFrameWidgetImpl::SetInheritedEffectiveTouchAction(
+void WebFrameWidgetImpl::SetInheritedEffectiveTouchActionForSubFrame(
     TouchAction touch_action) {
   DCHECK(LocalRootImpl()->Parent());
   DCHECK(LocalRootImpl()->Parent()->IsWebRemoteFrame());
   LocalRootImpl()->GetFrame()->SetInheritedEffectiveTouchAction(touch_action);
 }
 
-void WebFrameWidgetImpl::UpdateRenderThrottlingStatus(bool is_throttled,
-                                                      bool subtree_throttled) {
+void WebFrameWidgetImpl::UpdateRenderThrottlingStatusForSubFrame(
+    bool is_throttled,
+    bool subtree_throttled) {
   DCHECK(LocalRootImpl()->Parent());
   DCHECK(LocalRootImpl()->Parent()->IsWebRemoteFrame());
   LocalRootImpl()->GetFrameView()->UpdateRenderThrottlingStatus(
@@ -745,12 +742,10 @@ void WebFrameWidgetImpl::MouseContextMenu(const WebMouseEvent& event) {
   WebMouseEvent transformed_event =
       TransformWebMouseEvent(LocalRootImpl()->GetFrameView(), event);
   transformed_event.menu_source_type = kMenuSourceMouse;
-  IntPoint position_in_root_frame =
-      FlooredIntPoint(transformed_event.PositionInRootFrame());
 
   // Find the right target frame. See issue 1186900.
-  HitTestResult result =
-      HitTestResultForRootFramePos(PhysicalOffset(position_in_root_frame));
+  HitTestResult result = HitTestResultForRootFramePos(
+      FloatPoint(transformed_event.PositionInRootFrame()));
   Frame* target_frame;
   if (result.InnerNodeOrImageMapImage())
     target_frame = result.InnerNodeOrImageMapImage()->GetDocument().GetFrame();
@@ -805,12 +800,12 @@ WebInputEventResult WebFrameWidgetImpl::HandleGestureEvent(
 
   WebViewImpl* view_impl = View();
   switch (event.GetType()) {
-    case WebInputEvent::kGestureScrollBegin:
-    case WebInputEvent::kGestureScrollEnd:
-    case WebInputEvent::kGestureScrollUpdate:
-    case WebInputEvent::kGestureTap:
-    case WebInputEvent::kGestureTapUnconfirmed:
-    case WebInputEvent::kGestureTapDown:
+    case WebInputEvent::Type::kGestureScrollBegin:
+    case WebInputEvent::Type::kGestureScrollEnd:
+    case WebInputEvent::Type::kGestureScrollUpdate:
+    case WebInputEvent::Type::kGestureTap:
+    case WebInputEvent::Type::kGestureTapUnconfirmed:
+    case WebInputEvent::Type::kGestureTapDown:
       // Touch pinch zoom and scroll on the page (outside of a popup) must hide
       // the popup. In case of a touch scroll or pinch zoom, this function is
       // called with GestureTapDown rather than a GSB/GSU/GSE or GPB/GPU/GPE.
@@ -822,10 +817,10 @@ WebInputEventResult WebFrameWidgetImpl::HandleGestureEvent(
       // case to do so.
       View()->CancelPagePopup();
       break;
-    case WebInputEvent::kGestureTapCancel:
-    case WebInputEvent::kGestureShowPress:
+    case WebInputEvent::Type::kGestureTapCancel:
+    case WebInputEvent::Type::kGestureShowPress:
       break;
-    case WebInputEvent::kGestureDoubleTap:
+    case WebInputEvent::Type::kGestureDoubleTap:
       if (GetPage()->GetChromeClient().DoubleTapToZoomEnabled() &&
           view_impl->MinimumPageScaleFactor() !=
               view_impl->MaximumPageScaleFactor()) {
@@ -834,22 +829,21 @@ WebInputEventResult WebFrameWidgetImpl::HandleGestureEvent(
             TransformWebGestureEvent(frame->View(), event);
         IntPoint pos_in_local_frame_root =
             FlooredIntPoint(scaled_event.PositionInRootFrame());
-        WebRect block_bounds =
-            ComputeBlockBound(pos_in_local_frame_root, false);
+        auto block_bounds =
+            gfx::Rect(ComputeBlockBound(pos_in_local_frame_root, false));
 
         // This sends the tap point and bounds to the main frame renderer via
         // the browser, where their coordinates will be transformed into the
         // main frame's coordinate space.
-        Client()->AnimateDoubleTapZoomInMainFrame(pos_in_local_frame_root,
-                                                  block_bounds);
+        GetAssociatedFrameWidgetHost()->AnimateDoubleTapZoomInMainFrame(
+            pos_in_local_frame_root, block_bounds);
       }
       event_result = WebInputEventResult::kHandledSystem;
       Client()->DidHandleGestureEvent(event, event_cancelled);
       return event_result;
-      break;
-    case WebInputEvent::kGestureTwoFingerTap:
-    case WebInputEvent::kGestureLongPress:
-    case WebInputEvent::kGestureLongTap:
+    case WebInputEvent::Type::kGestureTwoFingerTap:
+    case WebInputEvent::Type::kGestureLongPress:
+    case WebInputEvent::Type::kGestureLongTap:
       GetPage()->GetContextMenuController().ClearContextMenu();
       maybe_context_menu_scope.emplace();
       break;
@@ -873,9 +867,9 @@ LocalFrameView* WebFrameWidgetImpl::GetLocalFrameViewForAnimationScrolling() {
 
 WebInputEventResult WebFrameWidgetImpl::HandleKeyEvent(
     const WebKeyboardEvent& event) {
-  DCHECK((event.GetType() == WebInputEvent::kRawKeyDown) ||
-         (event.GetType() == WebInputEvent::kKeyDown) ||
-         (event.GetType() == WebInputEvent::kKeyUp));
+  DCHECK((event.GetType() == WebInputEvent::Type::kRawKeyDown) ||
+         (event.GetType() == WebInputEvent::Type::kKeyDown) ||
+         (event.GetType() == WebInputEvent::Type::kKeyUp));
 
   // Please refer to the comments explaining the m_suppressNextKeypressEvent
   // member.
@@ -890,7 +884,7 @@ WebInputEventResult WebFrameWidgetImpl::HandleKeyEvent(
   scoped_refptr<WebPagePopupImpl> page_popup = View()->GetPagePopup();
   if (page_popup) {
     page_popup->HandleKeyEvent(event);
-    if (event.GetType() == WebInputEvent::kRawKeyDown) {
+    if (event.GetType() == WebInputEvent::Type::kRawKeyDown) {
       suppress_next_keypress_event_ = true;
     }
     return WebInputEventResult::kHandledSystem;
@@ -902,7 +896,7 @@ WebInputEventResult WebFrameWidgetImpl::HandleKeyEvent(
 
   WebInputEventResult result = frame->GetEventHandler().KeyEvent(event);
   if (result != WebInputEventResult::kNotHandled) {
-    if (WebInputEvent::kRawKeyDown == event.GetType()) {
+    if (WebInputEvent::Type::kRawKeyDown == event.GetType()) {
       // Suppress the next keypress event unless the focused node is a plugin
       // node.  (Flash needs these keypress events to handle non-US keyboards.)
       Element* element = FocusedElement();
@@ -916,12 +910,12 @@ WebInputEventResult WebFrameWidgetImpl::HandleKeyEvent(
 #if !defined(OS_MACOSX)
   const WebInputEvent::Type kContextMenuKeyTriggeringEventType =
 #if defined(OS_WIN)
-      WebInputEvent::kKeyUp;
+      WebInputEvent::Type::kKeyUp;
 #else
-      WebInputEvent::kRawKeyDown;
+      WebInputEvent::Type::kRawKeyDown;
 #endif
   const WebInputEvent::Type kShiftF10TriggeringEventType =
-      WebInputEvent::kRawKeyDown;
+      WebInputEvent::Type::kRawKeyDown;
 
   bool is_unmodified_menu_key =
       !(event.GetModifiers() & WebInputEvent::kInputModifiers) &&
@@ -942,7 +936,7 @@ WebInputEventResult WebFrameWidgetImpl::HandleKeyEvent(
 
 WebInputEventResult WebFrameWidgetImpl::HandleCharEvent(
     const WebKeyboardEvent& event) {
-  DCHECK_EQ(event.GetType(), WebInputEvent::kChar);
+  DCHECK_EQ(event.GetType(), WebInputEvent::Type::kChar);
 
   // Please refer to the comments explaining the m_suppressNextKeypressEvent
   // member.  The m_suppressNextKeypressEvent is set if the KeyDown is
@@ -1031,23 +1025,24 @@ void WebFrameWidgetImpl::SetRootLayer(scoped_refptr<cc::Layer> layer) {
 }
 
 HitTestResult WebFrameWidgetImpl::CoreHitTestResultAt(
-    const gfx::Point& point_in_viewport) {
+    const gfx::PointF& point_in_viewport) {
   DocumentLifecycle::AllowThrottlingScope throttling_scope(
       LocalRootImpl()->GetFrame()->GetDocument()->Lifecycle());
   LocalFrameView* view = LocalRootImpl()->GetFrameView();
-  PhysicalOffset point_in_root_frame(
-      view->ViewportToFrame(IntPoint(point_in_viewport)));
+  FloatPoint point_in_root_frame(
+      view->ViewportToFrame(FloatPoint(point_in_viewport)));
   return HitTestResultForRootFramePos(point_in_root_frame);
 }
 
 void WebFrameWidgetImpl::ZoomToFindInPageRect(
     const WebRect& rect_in_root_frame) {
-  Client()->ZoomToFindInPageRectInMainFrame(rect_in_root_frame);
+  GetAssociatedFrameWidgetHost()->ZoomToFindInPageRectInMainFrame(
+      gfx::Rect(rect_in_root_frame));
 }
 
 HitTestResult WebFrameWidgetImpl::HitTestResultForRootFramePos(
-    const PhysicalOffset& pos_in_root_frame) {
-  PhysicalOffset doc_point =
+    const FloatPoint& pos_in_root_frame) {
+  FloatPoint doc_point =
       LocalRootImpl()->GetFrame()->View()->ConvertFromRootFrame(
           pos_in_root_frame);
   HitTestLocation location(doc_point);
diff --git a/chromium/third_party/blink/renderer/core/frame/web_frame_widget_impl.h b/chromium/third_party/blink/renderer/core/frame/web_frame_widget_impl.h
index eb9c8bb7208..494c1d3f25e 100644
--- a/chromium/third_party/blink/renderer/core/frame/web_frame_widget_impl.h
+++ b/chromium/third_party/blink/renderer/core/frame/web_frame_widget_impl.h
@@ -37,8 +37,8 @@
 #include "base/optional.h"
 #include "base/single_thread_task_runner.h"
 #include "base/util/type_safety/pass_key.h"
+#include "third_party/blink/public/common/input/web_coalesced_input_event.h"
 #include "third_party/blink/public/mojom/scroll/scroll_into_view_params.mojom-blink-forward.h"
-#include "third_party/blink/public/platform/web_coalesced_input_event.h"
 #include "third_party/blink/public/platform/web_size.h"
 #include "third_party/blink/public/web/web_input_method_controller.h"
 #include "third_party/blink/renderer/core/frame/web_frame_widget_base.h"
@@ -84,39 +84,28 @@ class WebFrameWidgetImpl final : public WebFrameWidgetBase,
   ~WebFrameWidgetImpl() override;
 
   // WebWidget functions:
-  void Close() override;
+  void Close(scoped_refptr<base::SingleThreadTaskRunner> cleanup_runner,
+             base::OnceCallback<void()> cleanup_task) override;
   WebSize Size() override;
   void Resize(const WebSize&) override;
   void DidEnterFullscreen() override;
   void DidExitFullscreen() override;
-  void DidBeginFrame() override;
-  void BeginUpdateLayers() override;
-  void EndUpdateLayers() override;
-  void BeginCommitCompositorFrame() override;
-  void EndCommitCompositorFrame(base::TimeTicks commit_start_time) override;
-  void RecordStartOfFrameMetrics() override;
-  void RecordEndOfFrameMetrics(
-      base::TimeTicks,
-      cc::ActiveFrameSequenceTrackers trackers) override;
-  std::unique_ptr<cc::BeginMainFrameMetrics> GetBeginMainFrameMetrics()
-      override;
   void UpdateLifecycle(WebLifecycleUpdate requested_update,
                        DocumentUpdateReason reason) override;
   void ThemeChanged() override;
-  WebHitTestResult HitTestResultAt(const gfx::Point&) override;
+  WebHitTestResult HitTestResultAt(const gfx::PointF&) override;
   WebInputEventResult DispatchBufferedTouchEvents() override;
   WebInputEventResult HandleInputEvent(const WebCoalescedInputEvent&) override;
   void SetCursorVisibilityState(bool is_visible) override;
-  void OnFallbackCursorModeToggled(bool is_on) override;
 
   void MouseCaptureLost() override;
   void SetFocus(bool enable) override;
   bool SelectionBounds(WebRect& anchor, WebRect& focus) const override;
   void SetRemoteViewportIntersection(const ViewportIntersectionState&) override;
-  void SetIsInert(bool) override;
-  void SetInheritedEffectiveTouchAction(TouchAction) override;
-  void UpdateRenderThrottlingStatus(bool is_throttled,
-                                    bool subtree_throttled) override;
+  void SetIsInertForSubFrame(bool) override;
+  void SetInheritedEffectiveTouchActionForSubFrame(TouchAction) override;
+  void UpdateRenderThrottlingStatusForSubFrame(bool is_throttled,
+                                               bool subtree_throttled) override;
   WebURL GetURLForDebugTrace() override;
 
   // WebFrameWidget implementation.
@@ -133,9 +122,10 @@ class WebFrameWidgetImpl final : public WebFrameWidgetBase,
 
   // WebFrameWidgetBase overrides:
   bool ForSubframe() const override { return true; }
-  void IntrinsicSizingInfoChanged(const IntrinsicSizingInfo&) override;
+  void IntrinsicSizingInfoChanged(
+      mojom::blink::IntrinsicSizingInfoPtr) override;
   void DidCreateLocalRootView() override;
-  HitTestResult CoreHitTestResultAt(const gfx::Point&) override;
+  HitTestResult CoreHitTestResultAt(const gfx::PointF&) override;
   void ZoomToFindInPageRect(const WebRect& rect_in_root_frame) override;
 
   // FrameWidget overrides:
@@ -144,6 +134,17 @@ class WebFrameWidgetImpl final : public WebFrameWidgetBase,
   // WidgetBaseClient overrides:
   void BeginMainFrame(base::TimeTicks last_frame_time) override;
   void SetSuppressFrameRequestsWorkaroundFor704763Only(bool) final;
+  void RecordStartOfFrameMetrics() override;
+  void RecordEndOfFrameMetrics(
+      base::TimeTicks,
+      cc::ActiveFrameSequenceTrackers trackers) override;
+  std::unique_ptr<cc::BeginMainFrameMetrics> GetBeginMainFrameMetrics()
+      override;
+  void BeginUpdateLayers() override;
+  void EndUpdateLayers() override;
+  void BeginCommitCompositorFrame() override;
+  void EndCommitCompositorFrame(base::TimeTicks commit_start_time) override;
+  void DidBeginMainFrame() override;
 
   void UpdateMainFrameLayoutSize();
 
@@ -157,7 +158,7 @@ class WebFrameWidgetImpl final : public WebFrameWidgetBase,
 
   // Perform a hit test for a point relative to the root frame of the page.
   HitTestResult HitTestResultForRootFramePos(
-      const PhysicalOffset& pos_in_root_frame);
+      const FloatPoint& pos_in_root_frame);
 
   void UpdateLayerTreeViewport();
 
diff --git a/chromium/third_party/blink/renderer/core/frame/web_local_frame_impl.cc b/chromium/third_party/blink/renderer/core/frame/web_local_frame_impl.cc
index 2660078b0ed..64803c9f6c9 100644
--- a/chromium/third_party/blink/renderer/core/frame/web_local_frame_impl.cc
+++ b/chromium/third_party/blink/renderer/core/frame/web_local_frame_impl.cc
@@ -95,9 +95,13 @@
 #include "build/build_config.h"
 #include "mojo/public/cpp/bindings/pending_associated_receiver.h"
 #include "mojo/public/cpp/bindings/pending_associated_remote.h"
-#include "third_party/blink/public/common/frame/frame_owner_element_type.h"
+#include "services/network/public/cpp/web_sandbox_flags.h"
+#include "services/network/public/mojom/web_sandbox_flags.mojom-blink.h"
+#include "third_party/blink/public/mojom/devtools/inspector_issue.mojom-blink.h"
 #include "third_party/blink/public/mojom/feature_policy/feature_policy.mojom-blink.h"
+#include "third_party/blink/public/mojom/frame/frame_owner_element_type.mojom-blink.h"
 #include "third_party/blink/public/mojom/frame/media_player_action.mojom-blink.h"
+#include "third_party/blink/public/mojom/frame/tree_scope_type.mojom-blink.h"
 #include "third_party/blink/public/platform/interface_registry.h"
 #include "third_party/blink/public/platform/task_type.h"
 #include "third_party/blink/public/platform/web_double_size.h"
@@ -115,7 +119,6 @@
 #include "third_party/blink/public/web/web_console_message.h"
 #include "third_party/blink/public/web/web_content_capture_client.h"
 #include "third_party/blink/public/web/web_document.h"
-#include "third_party/blink/public/web/web_dom_message_event.h"
 #include "third_party/blink/public/web/web_form_element.h"
 #include "third_party/blink/public/web/web_frame_owner_properties.h"
 #include "third_party/blink/public/web/web_history_item.h"
@@ -131,7 +134,6 @@
 #include "third_party/blink/public/web/web_range.h"
 #include "third_party/blink/public/web/web_script_source.h"
 #include "third_party/blink/public/web/web_serialized_script_value.h"
-#include "third_party/blink/public/web/web_tree_scope_type.h"
 #include "third_party/blink/renderer/bindings/core/v8/binding_security.h"
 #include "third_party/blink/renderer/bindings/core/v8/isolated_world_csp.h"
 #include "third_party/blink/renderer/bindings/core/v8/sanitize_script_errors.h"
@@ -142,6 +144,7 @@
 #include "third_party/blink/renderer/bindings/core/v8/v8_binding_for_core.h"
 #include "third_party/blink/renderer/bindings/core/v8/v8_gc_controller.h"
 #include "third_party/blink/renderer/core/clipboard/clipboard_utilities.h"
+#include "third_party/blink/renderer/core/core_initializer.h"
 #include "third_party/blink/renderer/core/dom/document.h"
 #include "third_party/blink/renderer/core/dom/icon_url.h"
 #include "third_party/blink/renderer/core/dom/node.h"
@@ -184,7 +187,6 @@
 #include "third_party/blink/renderer/core/frame/pausable_script_executor.h"
 #include "third_party/blink/renderer/core/frame/remote_frame.h"
 #include "third_party/blink/renderer/core/frame/remote_frame_owner.h"
-#include "third_party/blink/renderer/core/frame/screen_orientation_controller.h"
 #include "third_party/blink/renderer/core/frame/settings.h"
 #include "third_party/blink/renderer/core/frame/smart_clip.h"
 #include "third_party/blink/renderer/core/frame/visual_viewport.h"
@@ -210,7 +212,6 @@
 #include "third_party/blink/renderer/core/input/context_menu_allowed_scope.h"
 #include "third_party/blink/renderer/core/input/event_handler.h"
 #include "third_party/blink/renderer/core/inspector/console_message.h"
-#include "third_party/blink/renderer/core/inspector/inspector_issue.h"
 #include "third_party/blink/renderer/core/inspector/main_thread_debugger.h"
 #include "third_party/blink/renderer/core/layout/hit_test_result.h"
 #include "third_party/blink/renderer/core/layout/layout_embedded_content.h"
@@ -254,6 +255,7 @@
 #include "third_party/blink/renderer/platform/loader/fetch/resource_fetcher.h"
 #include "third_party/blink/renderer/platform/loader/fetch/resource_request.h"
 #include "third_party/blink/renderer/platform/scheduler/public/frame_scheduler.h"
+#include "third_party/blink/renderer/platform/scheduler/public/scheduling_policy.h"
 #include "third_party/blink/renderer/platform/text/text_direction.h"
 #include "third_party/blink/renderer/platform/weborigin/kurl.h"
 #include "third_party/blink/renderer/platform/weborigin/scheme_registry.h"
@@ -791,10 +793,8 @@ void WebLocalFrameImpl::SetIsolatedWorldInfo(int32_t world_id,
       info.security_origin.Get()
           ? info.security_origin.Get()
                 ->IsolatedCopy()
-                ->GetOriginForAgentCluster(GetFrame()
-                                               ->GetDocument()
-                                               ->ToExecutionContext()
-                                               ->GetAgentClusterID())
+                ->GetOriginForAgentCluster(
+                    GetFrame()->DomWindow()->GetAgentClusterID())
           : nullptr;
 
   CHECK(info.content_security_policy.IsNull() || security_origin);
@@ -833,7 +833,7 @@ void WebLocalFrameImpl::CollectGarbageForTesting() {
     return;
   if (!GetFrame()->GetSettings()->GetScriptEnabled())
     return;
-  V8GCController::CollectAllGarbageForTesting(v8::Isolate::GetCurrent());
+  ThreadState::Current()->CollectAllGarbageForTesting();
 }
 
 v8::Local<v8::Value> WebLocalFrameImpl::ExecuteScriptAndReturnValue(
@@ -908,7 +908,7 @@ v8::MaybeLocal<v8::Value> WebLocalFrameImpl::CallFunctionEvenIfScriptDisabled(
     v8::Local<v8::Value> argv[]) {
   DCHECK(GetFrame());
   return V8ScriptRunner::CallFunction(
-      function, GetFrame()->GetDocument()->ToExecutionContext(), receiver, argc,
+      function, GetFrame()->DomWindow(), receiver, argc,
       static_cast<v8::Local<v8::Value>*>(argv), ToIsolate(GetFrame()));
 }
 
@@ -969,14 +969,6 @@ void WebLocalFrameImpl::StartNavigation(const WebURLRequest& request) {
                                        WebFrameLoadType::kStandard);
 }
 
-void WebLocalFrameImpl::StopLoading() {
-  if (!GetFrame())
-    return;
-  // FIXME: Figure out what we should really do here. It seems like a bug
-  // that FrameLoader::stopLoading doesn't call stopAllLoaders.
-  GetFrame()->Loader().StopAllLoaders();
-}
-
 WebDocumentLoader* WebLocalFrameImpl::GetDocumentLoader() const {
   DCHECK(GetFrame());
   return DocumentLoaderForDocLoader(GetFrame()->Loader().GetDocumentLoader());
@@ -1006,7 +998,11 @@ void WebLocalFrameImpl::SetReferrerForRequest(WebURLRequest& request,
 
 WebAssociatedURLLoader* WebLocalFrameImpl::CreateAssociatedURLLoader(
     const WebAssociatedURLLoaderOptions& options) {
-  return new WebAssociatedURLLoaderImpl(GetFrame()->GetDocument(), options);
+  return new WebAssociatedURLLoaderImpl(GetFrame()->DomWindow(), options);
+}
+
+void WebLocalFrameImpl::StopLoading() {
+  GetFrame()->StopLoading();
 }
 
 void WebLocalFrameImpl::ReplaceSelection(const WebString& text) {
@@ -1056,19 +1052,6 @@ bool WebLocalFrameImpl::FirstRectForCharacterRange(
   return true;
 }
 
-size_t WebLocalFrameImpl::CharacterIndexForPoint(
-    const gfx::Point& point_in_viewport) const {
-  if (!GetFrame())
-    return kNotFound;
-
-  HitTestLocation location(
-      GetFrame()->View()->ViewportToFrame(IntPoint(point_in_viewport)));
-  HitTestResult result = GetFrame()->GetEventHandler().HitTestResultAtLocation(
-      location, HitTestRequest::kReadOnly | HitTestRequest::kActive);
-  return GetFrame()->Selection().CharacterIndexForPoint(
-      result.RoundedPointInInnerNodeFrame());
-}
-
 bool WebLocalFrameImpl::ExecuteCommand(const WebString& name) {
   DCHECK(GetFrame());
 
@@ -1491,6 +1474,13 @@ void WebLocalFrameImpl::DispatchBeforePrintEvent() {
   is_in_printing_ = true;
 #endif
 
+  // Disable BackForwardCache when printing API is used for now. When the page
+  // navigates with BackForwardCache, we currently do not close the printing
+  // popup properly.
+  GetFrame()->GetFrameScheduler()->RegisterStickyFeature(
+      blink::SchedulingPolicy::Feature::kPrinting,
+      {blink::SchedulingPolicy::RecordMetricsForBackForwardCache()});
+
   GetFrame()->GetDocument()->SetPrinting(Document::kBeforePrinting);
   DispatchPrintEventRecursively(event_type_names::kBeforeprint);
 }
@@ -1612,16 +1602,10 @@ PageSizeType WebLocalFrameImpl::GetPageSizeType(int page_index) {
   return GetFrame()->GetDocument()->StyleForPage(page_index)->GetPageSizeType();
 }
 
-void WebLocalFrameImpl::PageSizeAndMarginsInPixels(int page_index,
-                                                   WebDoubleSize& page_size,
-                                                   int& margin_top,
-                                                   int& margin_right,
-                                                   int& margin_bottom,
-                                                   int& margin_left) {
-  DoubleSize size = page_size;
-  GetFrame()->GetDocument()->PageSizeAndMarginsInPixels(
-      page_index, size, margin_top, margin_right, margin_bottom, margin_left);
-  page_size = size;
+void WebLocalFrameImpl::GetPageDescription(
+    int page_index,
+    WebPrintPageDescription* description) {
+  GetFrame()->GetDocument()->GetPageDescription(page_index, description);
 }
 
 void WebLocalFrameImpl::PrintPagesForTesting(
@@ -1640,42 +1624,52 @@ WebRect WebLocalFrameImpl::GetSelectionBoundsRectForTesting() const {
              : WebRect();
 }
 
+gfx::Point WebLocalFrameImpl::GetPositionInViewportForTesting() const {
+  LocalFrameView* view = GetFrameView();
+  return view->ConvertToRootFrame(IntPoint());
+}
+
 // WebLocalFrameImpl public --------------------------------------------------
 
 WebLocalFrame* WebLocalFrame::CreateMainFrame(
     WebView* web_view,
     WebLocalFrameClient* client,
     InterfaceRegistry* interface_registry,
+    const base::UnguessableToken& frame_token,
     WebFrame* opener,
     const WebString& name,
-    mojom::blink::WebSandboxFlags sandbox_flags,
+    network::mojom::blink::WebSandboxFlags sandbox_flags,
     const FeaturePolicy::FeatureState& opener_feature_state) {
   return WebLocalFrameImpl::CreateMainFrame(
-      web_view, client, interface_registry, opener, name, sandbox_flags,
-      opener_feature_state);
+      web_view, client, interface_registry, frame_token, opener, name,
+      sandbox_flags, opener_feature_state);
 }
 
 WebLocalFrame* WebLocalFrame::CreateProvisional(
     WebLocalFrameClient* client,
     InterfaceRegistry* interface_registry,
+    const base::UnguessableToken& frame_token,
     WebFrame* previous_frame,
     const FramePolicy& frame_policy,
     const WebString& name) {
-  return WebLocalFrameImpl::CreateProvisional(
-      client, interface_registry, previous_frame, frame_policy, name);
+  return WebLocalFrameImpl::CreateProvisional(client, interface_registry,
+                                              frame_token, previous_frame,
+                                              frame_policy, name);
 }
 
 WebLocalFrameImpl* WebLocalFrameImpl::CreateMainFrame(
     WebView* web_view,
     WebLocalFrameClient* client,
     InterfaceRegistry* interface_registry,
+    const base::UnguessableToken& frame_token,
     WebFrame* opener,
     const WebString& name,
-    mojom::blink::WebSandboxFlags sandbox_flags,
+    network::mojom::blink::WebSandboxFlags sandbox_flags,
     const FeaturePolicy::FeatureState& opener_feature_state) {
   auto* frame = MakeGarbageCollected<WebLocalFrameImpl>(
-      util::PassKey<WebLocalFrameImpl>(), WebTreeScopeType::kDocument, client,
-      interface_registry);
+      util::PassKey<WebLocalFrameImpl>(),
+      mojom::blink::TreeScopeType::kDocument, client, interface_registry,
+      frame_token);
   frame->SetOpener(opener);
   Page& page = *static_cast<WebViewImpl*>(web_view)->GetPage();
   DCHECK(!page.MainFrame());
@@ -1689,6 +1683,7 @@ WebLocalFrameImpl* WebLocalFrameImpl::CreateMainFrame(
 WebLocalFrameImpl* WebLocalFrameImpl::CreateProvisional(
     WebLocalFrameClient* client,
     blink::InterfaceRegistry* interface_registry,
+    const base::UnguessableToken& frame_token,
     WebFrame* previous_web_frame,
     const FramePolicy& frame_policy,
     const WebString& name) {
@@ -1697,13 +1692,14 @@ WebLocalFrameImpl* WebLocalFrameImpl::CreateProvisional(
   DCHECK(name.IsEmpty() || name.Equals(previous_frame->Tree().GetName()));
   auto* web_frame = MakeGarbageCollected<WebLocalFrameImpl>(
       util::PassKey<WebLocalFrameImpl>(),
-      previous_web_frame->InShadowTree() ? WebTreeScopeType::kShadow
-                                         : WebTreeScopeType::kDocument,
-      client, interface_registry);
+      previous_web_frame->InShadowTree()
+          ? mojom::blink::TreeScopeType::kShadow
+          : mojom::blink::TreeScopeType::kDocument,
+      client, interface_registry, frame_token);
   web_frame->SetParent(previous_web_frame->Parent());
   web_frame->SetOpener(previous_web_frame->Opener());
-  mojom::blink::WebSandboxFlags sandbox_flags =
-      mojom::blink::WebSandboxFlags::kNone;
+  network::mojom::blink::WebSandboxFlags sandbox_flags =
+      network::mojom::blink::WebSandboxFlags::kNone;
   FeaturePolicy::FeatureState feature_state;
   if (!previous_frame->Owner()) {
     // Provisional main frames need to force sandbox flags.  This is necessary
@@ -1743,21 +1739,24 @@ WebLocalFrameImpl* WebLocalFrameImpl::CreateProvisional(
 }
 
 WebLocalFrameImpl* WebLocalFrameImpl::CreateLocalChild(
-    WebTreeScopeType scope,
+    mojom::blink::TreeScopeType scope,
     WebLocalFrameClient* client,
-    blink::InterfaceRegistry* interface_registry) {
+    blink::InterfaceRegistry* interface_registry,
+    const base::UnguessableToken& frame_token) {
   auto* frame = MakeGarbageCollected<WebLocalFrameImpl>(
-      util::PassKey<WebLocalFrameImpl>(), scope, client, interface_registry);
+      util::PassKey<WebLocalFrameImpl>(), scope, client, interface_registry,
+      frame_token);
   AppendChild(frame);
   return frame;
 }
 
 WebLocalFrameImpl::WebLocalFrameImpl(
     util::PassKey<WebLocalFrameImpl>,
-    WebTreeScopeType scope,
+    mojom::blink::TreeScopeType scope,
     WebLocalFrameClient* client,
-    blink::InterfaceRegistry* interface_registry)
-    : WebNavigationControl(scope),
+    blink::InterfaceRegistry* interface_registry,
+    const base::UnguessableToken& frame_token)
+    : WebNavigationControl(scope, frame_token),
       client_(client),
       local_frame_client_(MakeGarbageCollected<LocalFrameClientImpl>(this)),
       autofill_client_(nullptr),
@@ -1774,13 +1773,15 @@ WebLocalFrameImpl::WebLocalFrameImpl(
 
 WebLocalFrameImpl::WebLocalFrameImpl(
     util::PassKey<WebRemoteFrameImpl>,
-    WebTreeScopeType scope,
+    mojom::blink::TreeScopeType scope,
     WebLocalFrameClient* client,
-    blink::InterfaceRegistry* interface_registry)
+    blink::InterfaceRegistry* interface_registry,
+    const base::UnguessableToken& frame_token)
     : WebLocalFrameImpl(util::PassKey<WebLocalFrameImpl>(),
                         scope,
                         client,
-                        interface_registry) {}
+                        interface_registry,
+                        frame_token) {}
 
 WebLocalFrameImpl::~WebLocalFrameImpl() {
   // The widget for the frame, if any, must have already been closed.
@@ -1808,11 +1809,11 @@ void WebLocalFrameImpl::InitializeCoreFrame(
     FrameOwner* owner,
     const AtomicString& name,
     WindowAgentFactory* window_agent_factory,
-    mojom::blink::WebSandboxFlags sandbox_flags,
+    network::mojom::blink::WebSandboxFlags sandbox_flags,
     const FeaturePolicy::FeatureState& opener_feature_state) {
-  SetCoreFrame(MakeGarbageCollected<LocalFrame>(local_frame_client_.Get(), page,
-                                                owner, window_agent_factory,
-                                                interface_registry_));
+  SetCoreFrame(MakeGarbageCollected<LocalFrame>(
+      local_frame_client_.Get(), page, owner, GetFrameToken(),
+      window_agent_factory, interface_registry_));
   frame_->Tree().SetName(name);
   if (RuntimeEnabledFeatures::FeaturePolicyForSandboxEnabled())
     frame_->SetOpenerFeatureState(opener_feature_state);
@@ -1841,10 +1842,10 @@ LocalFrame* WebLocalFrameImpl::CreateChildFrame(
     HTMLFrameOwnerElement* owner_element) {
   DCHECK(client_);
   TRACE_EVENT0("blink", "WebLocalFrameImpl::createChildframe");
-  WebTreeScopeType scope =
+  mojom::blink::TreeScopeType scope =
       GetFrame()->GetDocument() == owner_element->GetTreeScope()
-          ? WebTreeScopeType::kDocument
-          : WebTreeScopeType::kShadow;
+          ? mojom::blink::TreeScopeType::kDocument
+          : mojom::blink::TreeScopeType::kShadow;
   WebFrameOwnerProperties owner_properties(
       owner_element->BrowsingContextContainerName(),
       owner_element->ScrollbarMode(), owner_element->MarginWidth(),
@@ -1881,7 +1882,7 @@ std::pair<RemoteFrame*, base::UnguessableToken> WebLocalFrameImpl::CreatePortal(
   WebRemoteFrame* portal_frame;
   base::UnguessableToken portal_token;
   std::tie(portal_frame, portal_token) = client_->CreatePortal(
-      portal_receiver.PassHandle(), portal_client.PassHandle(), portal);
+      std::move(portal_receiver), std::move(portal_client), portal);
   return {To<WebRemoteFrameImpl>(portal_frame)->GetFrame(), portal_token};
 }
 
@@ -1943,8 +1944,6 @@ void WebLocalFrameImpl::CreateFrameView() {
                                            web_view->MaxAutoSize());
   }
 
-  GetFrame()->View()->SetDisplayMode(web_view->DisplayMode());
-
   if (frame_widget_)
     frame_widget_->DidCreateLocalRootView();
 }
@@ -2207,8 +2206,7 @@ void WebLocalFrameImpl::SendOrientationChangeEvent() {
     return;
 
   // Screen Orientation API
-  if (ScreenOrientationController::From(*GetFrame()))
-    ScreenOrientationController::From(*GetFrame())->NotifyOrientationChanged();
+  CoreInitializer::GetInstance().NotifyOrientationChanged(*GetFrame());
 
   // Legacy window.orientation API
   if (RuntimeEnabledFeatures::OrientationEventEnabled() &&
@@ -2216,41 +2214,6 @@ void WebLocalFrameImpl::SendOrientationChangeEvent() {
     GetFrame()->DomWindow()->SendOrientationChangeEvent();
 }
 
-void WebLocalFrameImpl::DispatchMessageEventWithOriginCheck(
-    const WebSecurityOrigin& intended_target_origin,
-    const WebDOMMessageEvent& event) {
-  DCHECK(!event.IsNull());
-
-  MessageEvent* msg_event = static_cast<MessageEvent*>((Event*)event);
-  Frame* source_frame = nullptr;
-  if (msg_event->source() && msg_event->source()->ToDOMWindow())
-    source_frame = msg_event->source()->ToDOMWindow()->GetFrame();
-
-  // Transfer user activation state in the target's renderer when
-  // |transferUserActivation| is true.
-  //
-  // Also do the same as an ad-hoc solution to allow the origin trial of dynamic
-  // delegation of autoplay capability through postMessages.  Note that we
-  // skipped updating the user activation states in all other copies of the
-  // frame tree in this case because this is a temporary hack.
-  //
-  // TODO(mustaq): Remove the ad-hoc solution when the API shape is
-  // ready. crbug.com/985914
-  if ((RuntimeEnabledFeatures::UserActivationPostMessageTransferEnabled() &&
-       msg_event->transferUserActivation()) ||
-      msg_event->allowAutoplay()) {
-    GetFrame()->TransferUserActivationFrom(source_frame);
-    if (msg_event->allowAutoplay())
-      UseCounter::Count(GetDocument(), WebFeature::kAutoplayDynamicDelegation);
-  }
-
-  GetFrame()->DomWindow()->DispatchMessageEventWithOriginCheck(
-      intended_target_origin.Get(), msg_event,
-      std::make_unique<SourceLocation>(String(), 0, 0, nullptr),
-      event.locked_agent_cluster_id() ? event.locked_agent_cluster_id().value()
-                                      : base::UnguessableToken());
-}
-
 WebNode WebLocalFrameImpl::ContextMenuNode() const {
   return ContextMenuNodeInner();
 }
@@ -2290,11 +2253,12 @@ void WebLocalFrameImpl::CopyImageAtForTesting(
   GetFrame()->CopyImageAtViewportPoint(IntPoint(pos_in_viewport));
 }
 
-mojom::blink::WebSandboxFlags
+network::mojom::blink::WebSandboxFlags
 WebLocalFrameImpl::EffectiveSandboxFlagsForTesting() const {
   if (!GetFrame())
-    return mojom::blink::WebSandboxFlags::kNone;
-  SandboxFlags flags = GetFrame()->Loader().EffectiveSandboxFlags();
+    return network::mojom::blink::WebSandboxFlags::kNone;
+  network::mojom::blink::WebSandboxFlags flags =
+      GetFrame()->Loader().EffectiveSandboxFlags();
   if (RuntimeEnabledFeatures::FeaturePolicyForSandboxEnabled()) {
     // When some of sandbox flags set in the 'sandbox' attribute are implemented
     // as policies they are removed form the FrameOwner's sandbox flags to avoid
@@ -2305,13 +2269,13 @@ WebLocalFrameImpl::EffectiveSandboxFlagsForTesting() const {
     // FeaturePolicy. For certain flags such as "downloads", dedicated API
     // should be used (see IsAllowedToDownload()).
     auto* local_owner = GetFrame()->DeprecatedLocalOwner();
-    if (local_owner &&
-        local_owner->OwnerType() == FrameOwnerElementType::kIframe) {
+    if (local_owner && local_owner->OwnerType() ==
+                           mojom::blink::FrameOwnerElementType::kIframe) {
       flags |= To<HTMLIFrameElement>(local_owner)
                    ->sandbox_flags_converted_to_feature_policies();
     }
   }
-  return static_cast<mojom::blink::WebSandboxFlags>(flags);
+  return flags;
 }
 
 bool WebLocalFrameImpl::IsAllowedToDownload() const {
@@ -2330,8 +2294,8 @@ bool WebLocalFrameImpl::IsAllowedToDownload() const {
            GetFrame()->Owner()->GetFramePolicy().allowed_to_download;
   }
   return (GetFrame()->Loader().PendingEffectiveSandboxFlags() &
-          mojom::blink::WebSandboxFlags::kDownloads) ==
-         mojom::blink::WebSandboxFlags::kNone;
+          network::mojom::blink::WebSandboxFlags::kDownloads) ==
+         network::mojom::blink::WebSandboxFlags::kNone;
 }
 
 void WebLocalFrameImpl::UsageCountChromeLoadTimes(const WebString& metric) {
@@ -2428,6 +2392,10 @@ static String CreateMarkupInRect(LocalFrame* frame,
   return CreateMarkup(end_position, start_position, create_markup_options);
 }
 
+void WebLocalFrameImpl::SetMainFrameOverlayColor(SkColor color) {
+  GetFrame()->SetMainFrameColorOverlay(color);
+}
+
 bool WebLocalFrameImpl::ShouldSuppressKeyboardForFocusedElement() {
   if (!autofill_client_)
     return false;
@@ -2455,8 +2423,8 @@ void WebLocalFrameImpl::OnPortalActivated(
   DCHECK(!blink_data.locked_agent_cluster_id)
       << "portal activation is always cross-agent-cluster and should be "
          "diagnosed early";
-  MessagePortArray* ports = MessagePort::EntanglePorts(
-      *window->document()->ToExecutionContext(), std::move(blink_data.ports));
+  MessagePortArray* ports =
+      MessagePort::EntanglePorts(*window, std::move(blink_data.ports));
 
   PortalActivateEvent* event = PortalActivateEvent::Create(
       frame_.Get(), portal_token, std::move(portal), std::move(portal_client),
@@ -2497,10 +2465,8 @@ void WebLocalFrameImpl::AddInspectorIssueImpl(
     mojom::blink::InspectorIssueCode code) {
   DCHECK(GetFrame());
   auto info = mojom::blink::InspectorIssueInfo::New(
-      code, mojom::blink::InspectorIssueDetails::New(),
-      mojom::blink::AffectedResources::New());
-  GetFrame()->GetDocument()->AddInspectorIssue(
-      InspectorIssue::Create(std::move(info)));
+      code, mojom::blink::InspectorIssueDetails::New());
+  GetFrame()->AddInspectorIssue(std::move(info));
 }
 
 void WebLocalFrameImpl::SetTextCheckClient(
@@ -2546,17 +2512,16 @@ WebDevToolsAgentImpl* WebLocalFrameImpl::DevToolsAgentImpl() {
 }
 
 void WebLocalFrameImpl::BindDevToolsAgent(
-    mojo::ScopedInterfaceEndpointHandle devtools_agent_host_remote,
-    mojo::ScopedInterfaceEndpointHandle devtools_agent_receiver) {
+    CrossVariantMojoAssociatedRemote<
+        mojom::blink::DevToolsAgentHostInterfaceBase>
+        devtools_agent_host_remote,
+    CrossVariantMojoAssociatedReceiver<mojom::blink::DevToolsAgentInterfaceBase>
+        devtools_agent_receiver) {
   WebDevToolsAgentImpl* agent = DevToolsAgentImpl();
   if (!agent)
     return;
-  agent->BindReceiver(
-      mojo::PendingAssociatedRemote<mojom::blink::DevToolsAgentHost>(
-          std::move(devtools_agent_host_remote),
-          mojom::blink::DevToolsAgentHost::Version_),
-      mojo::PendingAssociatedReceiver<mojom::blink::DevToolsAgent>(
-          std::move(devtools_agent_receiver)));
+  agent->BindReceiver(std::move(devtools_agent_host_remote),
+                      std::move(devtools_agent_receiver));
 }
 
 void WebLocalFrameImpl::SetLifecycleState(mojom::FrameLifecycleState state) {
diff --git a/chromium/third_party/blink/renderer/core/frame/web_local_frame_impl.h b/chromium/third_party/blink/renderer/core/frame/web_local_frame_impl.h
index a8d2023b6b3..5ee856c20dc 100644
--- a/chromium/third_party/blink/renderer/core/frame/web_local_frame_impl.h
+++ b/chromium/third_party/blink/renderer/core/frame/web_local_frame_impl.h
@@ -39,10 +39,12 @@
 #include "base/util/type_safety/pass_key.h"
 #include "mojo/public/cpp/bindings/pending_associated_receiver.h"
 #include "mojo/public/cpp/bindings/pending_associated_remote.h"
+#include "services/network/public/mojom/web_sandbox_flags.mojom-blink.h"
 #include "third_party/blink/public/mojom/ad_tagging/ad_frame.mojom-blink-forward.h"
 #include "third_party/blink/public/mojom/devtools/devtools_agent.mojom-blink-forward.h"
 #include "third_party/blink/public/mojom/frame/find_in_page.mojom-blink-forward.h"
 #include "third_party/blink/public/mojom/frame/lifecycle.mojom-blink-forward.h"
+#include "third_party/blink/public/mojom/frame/tree_scope_type.mojom-blink.h"
 #include "third_party/blink/public/mojom/portal/portal.mojom-blink-forward.h"
 #include "third_party/blink/public/platform/web_file_system_type.h"
 #include "third_party/blink/public/web/web_history_commit_type.h"
@@ -98,13 +100,14 @@ class CORE_EXPORT WebLocalFrameImpl final
   void Close() override;
   WebView* View() const override;
   v8::Local<v8::Object> GlobalProxy() const override;
-  void StopLoading() override;
   bool IsLoading() const override;
 
   // WebLocalFrame overrides:
-  WebLocalFrameImpl* CreateLocalChild(WebTreeScopeType,
-                                      WebLocalFrameClient*,
-                                      blink::InterfaceRegistry*) override;
+  WebLocalFrameImpl* CreateLocalChild(
+      mojom::blink::TreeScopeType,
+      WebLocalFrameClient*,
+      blink::InterfaceRegistry*,
+      const base::UnguessableToken& frame_token) override;
   WebLocalFrameClient* Client() const override { return client_; }
   void SetAutofillClient(WebAutofillClient*) override;
   WebAutofillClient* AutofillClient() override;
@@ -137,12 +140,7 @@ class CORE_EXPORT WebLocalFrameImpl final
                          const WebSourceLocation&) override;
   void SendOrientationChangeEvent() override;
   PageSizeType GetPageSizeType(int page_index) override;
-  void PageSizeAndMarginsInPixels(int page_index,
-                                  WebDoubleSize& page_size,
-                                  int& margin_top,
-                                  int& margin_right,
-                                  int& margin_bottom,
-                                  int& margin_left) override;
+  void GetPageDescription(int page_index, WebPrintPageDescription*) override;
   void ExecuteScript(const WebScriptSource&) override;
   void ExecuteScriptInIsolatedWorld(int32_t world_id,
                                     const WebScriptSource&) override;
@@ -180,16 +178,18 @@ class CORE_EXPORT WebLocalFrameImpl final
   bool Confirm(const WebString& message) override;
   WebString Prompt(const WebString& message,
                    const WebString& default_value) override;
-  void BindDevToolsAgent(
-      mojo::ScopedInterfaceEndpointHandle devtools_agent_host_ptr_info,
-      mojo::ScopedInterfaceEndpointHandle devtools_agent_request) override;
+  void BindDevToolsAgent(CrossVariantMojoAssociatedRemote<
+                             mojom::blink::DevToolsAgentHostInterfaceBase>
+                             devtools_agent_host_remote,
+                         CrossVariantMojoAssociatedReceiver<
+                             mojom::blink::DevToolsAgentInterfaceBase>
+                             devtools_agent_receiver) override;
   void UnmarkText() override;
   bool HasMarkedText() const override;
   WebRange MarkedRange() const override;
   bool FirstRectForCharacterRange(unsigned location,
                                   unsigned length,
                                   WebRect&) const override;
-  size_t CharacterIndexForPoint(const gfx::Point&) const override;
   bool ExecuteCommand(const WebString&) override;
   bool ExecuteCommand(const WebString&, const WebString& value) override;
   bool IsCommandEnabled(const WebString&) const override;
@@ -237,7 +237,7 @@ class CORE_EXPORT WebLocalFrameImpl final
       const WebVector<WebString>& words) override;
   void SetContentSettingsClient(WebContentSettingsClient*) override;
   void ReloadImage(const WebNode&) override;
-  mojom::blink::WebSandboxFlags EffectiveSandboxFlagsForTesting()
+  network::mojom::blink::WebSandboxFlags EffectiveSandboxFlagsForTesting()
       const override;
   bool IsAllowedToDownload() const override;
   bool FindForTesting(int identifier,
@@ -250,9 +250,6 @@ class CORE_EXPORT WebLocalFrameImpl final
   void SetTickmarks(const WebVector<WebRect>&) override;
   WebNode ContextMenuNode() const override;
   void CopyImageAtForTesting(const gfx::Point&) override;
-  void DispatchMessageEventWithOriginCheck(
-      const WebSecurityOrigin& intended_target_origin,
-      const WebDOMMessageEvent&) override;
   void UsageCountChromeLoadTimes(const WebString& metric) override;
   void OnPortalActivated(
       const base::UnguessableToken& portal_token,
@@ -271,6 +268,7 @@ class CORE_EXPORT WebLocalFrameImpl final
   WebInputMethodController* GetInputMethodController() override;
   WebAssociatedURLLoader* CreateAssociatedURLLoader(
       const WebAssociatedURLLoaderOptions&) override;
+  void StopLoading() override;
   WebSize GetScrollOffset() const override;
   void SetScrollOffset(const WebSize&) override;
   WebSize DocumentSize() const override;
@@ -287,6 +285,7 @@ class CORE_EXPORT WebLocalFrameImpl final
                                       WebPrintPresetOptions*) override;
   bool CapturePaintPreview(const WebRect& bounds,
                            cc::PaintCanvas* canvas) override;
+  void SetMainFrameOverlayColor(SkColor) override;
   bool ShouldSuppressKeyboardForFocusedElement() override;
   WebPerformance Performance() const override;
   bool IsAdSubframe() const override;
@@ -294,6 +293,7 @@ class CORE_EXPORT WebLocalFrameImpl final
   void WaitForDebuggerWhenShown() override;
   void PrintPagesForTesting(cc::PaintCanvas*, const WebSize&) override;
   WebRect GetSelectionBoundsRectForTesting() const override;
+  gfx::Point GetPositionInViewportForTesting() const override;
   void SetLifecycleState(mojom::FrameLifecycleState state) override;
   void WasHidden() override;
   void WasShown() override;
@@ -335,8 +335,8 @@ class CORE_EXPORT WebLocalFrameImpl final
       FrameOwner*,
       const AtomicString& name,
       WindowAgentFactory*,
-      mojom::blink::WebSandboxFlags sandbox_flags =
-          mojom::blink::WebSandboxFlags::kNone,
+      network::mojom::blink::WebSandboxFlags sandbox_flags =
+          network::mojom::blink::WebSandboxFlags::kNone,
       const FeaturePolicy::FeatureState& opener_feature_state =
           FeaturePolicy::FeatureState());
   LocalFrame* GetFrame() const { return frame_.Get(); }
@@ -345,27 +345,33 @@ class CORE_EXPORT WebLocalFrameImpl final
   void WillDetachParent();
   void CollectGarbageForTesting();
 
-  static WebLocalFrameImpl* CreateMainFrame(WebView*,
-                                            WebLocalFrameClient*,
-                                            InterfaceRegistry*,
-                                            WebFrame* opener,
-                                            const WebString& name,
-                                            mojom::blink::WebSandboxFlags,
-                                            const FeaturePolicy::FeatureState&);
-  static WebLocalFrameImpl* CreateProvisional(WebLocalFrameClient*,
-                                              InterfaceRegistry*,
-                                              WebFrame*,
-                                              const FramePolicy&,
-                                              const WebString& name);
+  static WebLocalFrameImpl* CreateMainFrame(
+      WebView*,
+      WebLocalFrameClient*,
+      InterfaceRegistry*,
+      const base::UnguessableToken& frame_token,
+      WebFrame* opener,
+      const WebString& name,
+      network::mojom::blink::WebSandboxFlags,
+      const FeaturePolicy::FeatureState&);
+  static WebLocalFrameImpl* CreateProvisional(
+      WebLocalFrameClient*,
+      InterfaceRegistry*,
+      const base::UnguessableToken& frame_token,
+      WebFrame*,
+      const FramePolicy&,
+      const WebString& name);
 
   WebLocalFrameImpl(util::PassKey<WebLocalFrameImpl>,
-                    WebTreeScopeType,
+                    mojom::blink::TreeScopeType,
                     WebLocalFrameClient*,
-                    blink::InterfaceRegistry*);
+                    blink::InterfaceRegistry*,
+                    const base::UnguessableToken& frame_token);
   WebLocalFrameImpl(util::PassKey<WebRemoteFrameImpl>,
-                    WebTreeScopeType,
+                    mojom::blink::TreeScopeType,
                     WebLocalFrameClient*,
-                    blink::InterfaceRegistry*);
+                    blink::InterfaceRegistry*,
+                    const base::UnguessableToken& frame_token);
   ~WebLocalFrameImpl() override;
 
   LocalFrame* CreateChildFrame(const AtomicString& name,
diff --git a/chromium/third_party/blink/renderer/core/frame/web_view_frame_widget.cc b/chromium/third_party/blink/renderer/core/frame/web_view_frame_widget.cc
index 74d711852ad..42afbfb7318 100644
--- a/chromium/third_party/blink/renderer/core/frame/web_view_frame_widget.cc
+++ b/chromium/third_party/blink/renderer/core/frame/web_view_frame_widget.cc
@@ -5,6 +5,7 @@
 #include "third_party/blink/renderer/core/frame/web_view_frame_widget.h"
 
 #include "third_party/blink/renderer/core/exported/web_view_impl.h"
+#include "third_party/blink/renderer/core/frame/local_frame_ukm_aggregator.h"
 #include "third_party/blink/renderer/core/frame/web_local_frame_impl.h"
 #include "third_party/blink/renderer/platform/scheduler/public/thread.h"
 #include "third_party/blink/renderer/platform/widget/widget_base.h"
@@ -35,13 +36,15 @@ WebViewFrameWidget::WebViewFrameWidget(
 
 WebViewFrameWidget::~WebViewFrameWidget() = default;
 
-void WebViewFrameWidget::Close() {
+void WebViewFrameWidget::Close(
+    scoped_refptr<base::SingleThreadTaskRunner> cleanup_runner,
+    base::OnceCallback<void()> cleanup_task) {
   GetPage()->WillCloseAnimationHost(nullptr);
   // Closing the WebViewFrameWidget happens in response to the local main frame
   // being detached from the Page/WebViewImpl.
   web_view_->SetMainFrameWidgetBase(nullptr);
   web_view_ = nullptr;
-  WebFrameWidgetBase::Close();
+  WebFrameWidgetBase::Close(std::move(cleanup_runner), std::move(cleanup_task));
   self_keep_alive_.Clear();
 }
 
@@ -67,14 +70,19 @@ void WebViewFrameWidget::SetSuppressFrameRequestsWorkaroundFor704763Only(
       suppress_frame_requests);
 }
 
-void WebViewFrameWidget::DidBeginFrame() {
-  web_view_->DidBeginFrame();
-}
-
 void WebViewFrameWidget::BeginMainFrame(base::TimeTicks last_frame_time) {
   web_view_->BeginFrame(last_frame_time);
 }
 
+void WebViewFrameWidget::DidBeginMainFrame() {
+  WebFrameWidgetBase::DidBeginMainFrame();
+
+  auto* main_frame = web_view_->MainFrameImpl();
+  DocumentLifecycle::AllowThrottlingScope throttling_scope(
+      main_frame->GetFrame()->GetDocument()->Lifecycle());
+  PageWidgetDelegate::DidBeginFrame(*main_frame->GetFrame());
+}
+
 void WebViewFrameWidget::BeginUpdateLayers() {
   web_view_->BeginUpdateLayers();
 }
@@ -84,12 +92,21 @@ void WebViewFrameWidget::EndUpdateLayers() {
 }
 
 void WebViewFrameWidget::BeginCommitCompositorFrame() {
-  web_view_->BeginCommitCompositorFrame();
+  commit_compositor_frame_start_time_.emplace(base::TimeTicks::Now());
 }
 
 void WebViewFrameWidget::EndCommitCompositorFrame(
     base::TimeTicks commit_start_time) {
-  web_view_->EndCommitCompositorFrame(commit_start_time);
+  DCHECK(commit_compositor_frame_start_time_.has_value());
+
+  WebFrameWidgetBase::EndCommitCompositorFrame(commit_start_time);
+  web_view_->MainFrameImpl()
+      ->GetFrame()
+      ->View()
+      ->EnsureUkmAggregator()
+      .RecordImplCompositorSample(commit_compositor_frame_start_time_.value(),
+                                  commit_start_time, base::TimeTicks::Now());
+  commit_compositor_frame_start_time_.reset();
 }
 
 void WebViewFrameWidget::RecordStartOfFrameMetrics() {
@@ -129,10 +146,6 @@ void WebViewFrameWidget::SetCursorVisibilityState(bool is_visible) {
   web_view_->SetCursorVisibilityState(is_visible);
 }
 
-void WebViewFrameWidget::OnFallbackCursorModeToggled(bool is_on) {
-  web_view_->OnFallbackCursorModeToggled(is_on);
-}
-
 void WebViewFrameWidget::ApplyViewportChanges(
     const ApplyViewportChangesArgs& args) {
   web_view_->ApplyViewportChanges(args);
@@ -193,11 +206,12 @@ void WebViewFrameWidget::SetRootLayer(scoped_refptr<cc::Layer> root_layer) {
   web_view_->DidChangeRootLayer(!!root_layer);
 }
 
-WebHitTestResult WebViewFrameWidget::HitTestResultAt(const gfx::Point& point) {
+WebHitTestResult WebViewFrameWidget::HitTestResultAt(const gfx::PointF& point) {
   return web_view_->HitTestResultAt(point);
 }
 
-HitTestResult WebViewFrameWidget::CoreHitTestResultAt(const gfx::Point& point) {
+HitTestResult WebViewFrameWidget::CoreHitTestResultAt(
+    const gfx::PointF& point) {
   return web_view_->CoreHitTestResultAt(point);
 }
 
diff --git a/chromium/third_party/blink/renderer/core/frame/web_view_frame_widget.h b/chromium/third_party/blink/renderer/core/frame/web_view_frame_widget.h
index 1bc5f79982e..483c9961018 100644
--- a/chromium/third_party/blink/renderer/core/frame/web_view_frame_widget.h
+++ b/chromium/third_party/blink/renderer/core/frame/web_view_frame_widget.h
@@ -54,36 +54,18 @@ class CORE_EXPORT WebViewFrameWidget : public WebFrameWidgetBase {
   ~WebViewFrameWidget() override;
 
   // WebWidget overrides:
-  void Close() override;
+  void Close(scoped_refptr<base::SingleThreadTaskRunner> cleanup_runner,
+             base::OnceCallback<void()> cleanup_task) override;
   WebSize Size() override;
   void Resize(const WebSize&) override;
   void DidEnterFullscreen() override;
   void DidExitFullscreen() override;
-  void DidBeginFrame() override;
-  void BeginUpdateLayers() override;
-  void EndUpdateLayers() override;
-  void BeginCommitCompositorFrame() override;
-  void EndCommitCompositorFrame(base::TimeTicks commit_start_time) override;
-  void RecordStartOfFrameMetrics() override;
-  void RecordEndOfFrameMetrics(
-      base::TimeTicks frame_begin_time,
-      cc::ActiveFrameSequenceTrackers trackers) override;
-  std::unique_ptr<cc::BeginMainFrameMetrics> GetBeginMainFrameMetrics()
-      override;
   void UpdateLifecycle(WebLifecycleUpdate requested_update,
                        DocumentUpdateReason reason) override;
   void ThemeChanged() override;
   WebInputEventResult HandleInputEvent(const WebCoalescedInputEvent&) override;
   WebInputEventResult DispatchBufferedTouchEvents() override;
   void SetCursorVisibilityState(bool is_visible) override;
-  void OnFallbackCursorModeToggled(bool is_on) override;
-  void ApplyViewportChanges(const ApplyViewportChangesArgs&) override;
-  void RecordManipulationTypeCounts(cc::ManipulationInfo info) override;
-  void SendOverscrollEventFromImplSide(
-      const gfx::Vector2dF& overscroll_delta,
-      cc::ElementId scroll_latched_element_id) override;
-  void SendScrollEndEventFromImplSide(
-      cc::ElementId scroll_latched_element_id) override;
   void MouseCaptureLost() override;
   void SetFocus(bool) override;
   bool SelectionBounds(WebRect& anchor, WebRect& focus) const override;
@@ -93,11 +75,11 @@ class CORE_EXPORT WebViewFrameWidget : public WebFrameWidgetBase {
   void DidDetachLocalFrameTree() override;
   WebInputMethodController* GetActiveWebInputMethodController() const override;
   bool ScrollFocusedEditableElementIntoView() override;
-  WebHitTestResult HitTestResultAt(const gfx::Point&) override;
+  WebHitTestResult HitTestResultAt(const gfx::PointF&) override;
 
   // WebFrameWidgetBase overrides:
   bool ForSubframe() const override { return false; }
-  HitTestResult CoreHitTestResultAt(const gfx::Point&) override;
+  HitTestResult CoreHitTestResultAt(const gfx::PointF&) override;
   void ZoomToFindInPageRect(const WebRect& rect_in_root_frame) override;
 
   // FrameWidget overrides:
@@ -106,6 +88,24 @@ class CORE_EXPORT WebViewFrameWidget : public WebFrameWidgetBase {
   // WidgetBaseClient overrides:
   void BeginMainFrame(base::TimeTicks last_frame_time) override;
   void SetSuppressFrameRequestsWorkaroundFor704763Only(bool) final;
+  void RecordStartOfFrameMetrics() override;
+  void RecordEndOfFrameMetrics(
+      base::TimeTicks frame_begin_time,
+      cc::ActiveFrameSequenceTrackers trackers) override;
+  std::unique_ptr<cc::BeginMainFrameMetrics> GetBeginMainFrameMetrics()
+      override;
+  void BeginUpdateLayers() override;
+  void EndUpdateLayers() override;
+  void DidBeginMainFrame() override;
+  void ApplyViewportChanges(const cc::ApplyViewportChangesArgs& args) override;
+  void RecordManipulationTypeCounts(cc::ManipulationInfo info) override;
+  void SendOverscrollEventFromImplSide(
+      const gfx::Vector2dF& overscroll_delta,
+      cc::ElementId scroll_latched_element_id) override;
+  void SendScrollEndEventFromImplSide(
+      cc::ElementId scroll_latched_element_id) override;
+  void BeginCommitCompositorFrame() override;
+  void EndCommitCompositorFrame(base::TimeTicks commit_start_time) override;
 
   void Trace(Visitor*) override;
 
@@ -114,6 +114,7 @@ class CORE_EXPORT WebViewFrameWidget : public WebFrameWidgetBase {
   LocalFrameView* GetLocalFrameViewForAnimationScrolling() override;
 
   scoped_refptr<WebViewImpl> web_view_;
+  base::Optional<base::TimeTicks> commit_compositor_frame_start_time_;
 
   SelfKeepAlive<WebViewFrameWidget> self_keep_alive_;
 
diff --git a/chromium/third_party/blink/renderer/core/frame/window.idl b/chromium/third_party/blink/renderer/core/frame/window.idl
index 47dd13efd72..b3d5a5549db 100644
--- a/chromium/third_party/blink/renderer/core/frame/window.idl
+++ b/chromium/third_party/blink/renderer/core/frame/window.idl
@@ -35,9 +35,9 @@
 ] interface Window : EventTarget {
     // the current browsing context
     // FIXME: The spec uses the WindowProxy type for this and many other attributes.
-    [Affects=Nothing, Unforgeable, CrossOrigin] readonly attribute Window window;
-    [Replaceable, CrossOrigin] readonly attribute Window self;
-    [Affects=Nothing, Unforgeable, CachedAccessor] readonly attribute Document document;
+    [Affects=Nothing, Unforgeable, CrossOrigin, CachedAccessor=kWindowProxy] readonly attribute Window window;
+    [Replaceable, CrossOrigin, CachedAccessor=kWindowProxy] readonly attribute Window self;
+    [Affects=Nothing, Unforgeable, CachedAccessor=kWindowDocument] readonly attribute Document document;
     attribute DOMString name;
     [Affects=Nothing, PutForwards=href, Unforgeable, CrossOrigin=(Getter,Setter), Custom=Getter] readonly attribute Location location;
     [CallWith=ScriptState] readonly attribute CustomElementRegistry customElements;
@@ -56,7 +56,7 @@
     [CrossOrigin] void blur();
 
     // other browsing contexts
-    [Replaceable, CrossOrigin] readonly attribute Window frames;
+    [Replaceable, CrossOrigin, CachedAccessor=kWindowProxy] readonly attribute Window frames;
     [Replaceable, CrossOrigin] readonly attribute unsigned long length;
     [Unforgeable, CrossOrigin] readonly attribute Window? top;
     // FIXME: opener should be of type any.
@@ -209,7 +209,7 @@
     [DisableInNewIDLCompiler] attribute DOMMatrixConstructor WebKitCSSMatrix;
 
     // TrustedTypes API: http://github.com/wicg/trusted-types
-    [RuntimeEnabled=TrustedDOMTypes, SecureContext] readonly attribute TrustedTypePolicyFactory trustedTypes;
+    [RuntimeEnabled=TrustedDOMTypes] readonly attribute TrustedTypePolicyFactory trustedTypes;
 };
 
 Window includes GlobalEventHandlers;
diff --git a/chromium/third_party/blink/renderer/core/frame/window_event_handlers.idl b/chromium/third_party/blink/renderer/core/frame/window_event_handlers.idl
index 48ed1316809..f4f1fdeae78 100644
--- a/chromium/third_party/blink/renderer/core/frame/window_event_handlers.idl
+++ b/chromium/third_party/blink/renderer/core/frame/window_event_handlers.idl
@@ -34,8 +34,7 @@
 ] interface mixin WindowEventHandlers {
     attribute EventHandler onafterprint;
     attribute EventHandler onbeforeprint;
-    // FIXME: onbeforeunload should be an OnBeforeUnloadEventHandler.
-    attribute EventHandler onbeforeunload;
+    attribute OnBeforeUnloadEventHandler onbeforeunload;
     attribute EventHandler onhashchange;
     attribute EventHandler onlanguagechange;
     attribute EventHandler onmessage;
diff --git a/chromium/third_party/blink/renderer/core/frame/window_or_worker_global_scope.cc b/chromium/third_party/blink/renderer/core/frame/window_or_worker_global_scope.cc
index 13d6a539a16..a2001fb6fb3 100644
--- a/chromium/third_party/blink/renderer/core/frame/window_or_worker_global_scope.cc
+++ b/chromium/third_party/blink/renderer/core/frame/window_or_worker_global_scope.cc
@@ -35,11 +35,11 @@
 #include "base/containers/span.h"
 #include "third_party/blink/renderer/bindings/core/v8/scheduled_action.h"
 #include "third_party/blink/renderer/bindings/core/v8/v8_gc_for_context_dispose.h"
-#include "third_party/blink/renderer/core/dom/document.h"
 #include "third_party/blink/renderer/core/dom/events/event_target.h"
 #include "third_party/blink/renderer/core/execution_context/execution_context.h"
 #include "third_party/blink/renderer/core/frame/csp/content_security_policy.h"
 #include "third_party/blink/renderer/core/frame/dom_timer.h"
+#include "third_party/blink/renderer/core/frame/local_dom_window.h"
 #include "third_party/blink/renderer/core/html/parser/html_parser_idioms.h"
 #include "third_party/blink/renderer/core/imagebitmap/image_bitmap_factories.h"
 #include "third_party/blink/renderer/core/trustedtypes/trusted_types_util.h"
@@ -55,10 +55,10 @@ namespace blink {
 static bool IsAllowed(ExecutionContext* execution_context,
                       bool is_eval,
                       const String& source) {
-  if (Document* document = Document::DynamicFrom(execution_context)) {
-    if (!document->GetFrame())
+  if (auto* window = DynamicTo<LocalDOMWindow>(execution_context)) {
+    if (!window->GetFrame())
       return false;
-    if (is_eval && !document->GetContentSecurityPolicy()->AllowEval(
+    if (is_eval && !window->GetContentSecurityPolicy()->AllowEval(
                        ReportingDisposition::kReport,
                        ContentSecurityPolicy::kWillNotThrowException, source)) {
       return false;
@@ -217,17 +217,17 @@ void WindowOrWorkerGlobalScope::clearInterval(EventTarget& event_target,
 
 ScriptPromise WindowOrWorkerGlobalScope::createImageBitmap(
     ScriptState* script_state,
-    EventTarget& event_target,
+    EventTarget&,
     const ImageBitmapSourceUnion& bitmap_source,
     const ImageBitmapOptions* options,
     ExceptionState& exception_state) {
-  return ImageBitmapFactories::CreateImageBitmap(
-      script_state, event_target, bitmap_source, options, exception_state);
+  return ImageBitmapFactories::CreateImageBitmap(script_state, bitmap_source,
+                                                 options, exception_state);
 }
 
 ScriptPromise WindowOrWorkerGlobalScope::createImageBitmap(
     ScriptState* script_state,
-    EventTarget& event_target,
+    EventTarget&,
     const ImageBitmapSourceUnion& bitmap_source,
     int sx,
     int sy,
@@ -235,9 +235,8 @@ ScriptPromise WindowOrWorkerGlobalScope::createImageBitmap(
     int sh,
     const ImageBitmapOptions* options,
     ExceptionState& exception_state) {
-  return ImageBitmapFactories::CreateImageBitmap(script_state, event_target,
-                                                 bitmap_source, sx, sy, sw, sh,
-                                                 options, exception_state);
+  return ImageBitmapFactories::CreateImageBitmap(
+      script_state, bitmap_source, sx, sy, sw, sh, options, exception_state);
 }
 
 }  // namespace blink
author	Allan Sandfeld Jensen <allan.jensen@qt.io>	2020-10-06 12:48:11 +0200
committer	Allan Sandfeld Jensen <allan.jensen@qt.io>	2020-10-13 09:33:43 +0000
commit	7b5b123ac58f58ffde0f4f6e488bcd09aa4decd3 (patch)
tree	fa14ba0ca8d2683ba2efdabd246dc9b18a1229c6 /chromium/third_party/blink/renderer/core/frame
parent	79b4f909db1049fca459c07cca55af56a9b54fe3 (diff)
download	qtwebengine-chromium-7b5b123ac58f58ffde0f4f6e488bcd09aa4decd3.tar.gz