BASELINE: Update Chromium to 73.0.3683.64

Change-Id: I76517dc277ba4e16bfd7e098fda3d079656b3b9f
Reviewed-by: Michael Brüning <michael.bruning@qt.io>

45 files changed, 548 insertions, 162 deletions

diff --git a/chromium/third_party/blink/renderer/bindings/scripts/v8_dictionary.py b/chromium/third_party/blink/renderer/bindings/scripts/v8_dictionary.py
index 04860137a09..e06325a44bd 100644
--- a/chromium/third_party/blink/renderer/bindings/scripts/v8_dictionary.py
+++ b/chromium/third_party/blink/renderer/bindings/scripts/v8_dictionary.py
@@ -164,6 +164,7 @@ def member_context(dictionary, member):
         'has_explicit_presence': has_explicit_presence,
         'has_method_name': has_method_name_for_dictionary_member(member),
         'idl_type': idl_type.base_type,
+        'is_callback_function_type': idl_type.is_callback_function,
         'is_interface_type': idl_type.is_interface_type and not is_deprecated_dictionary,
         'is_nullable': idl_type.is_nullable,
         'is_object': unwrapped_idl_type.name == 'Object' or is_deprecated_dictionary,
diff --git a/chromium/third_party/blink/renderer/bindings/templates/dictionary_v8.cc.tmpl b/chromium/third_party/blink/renderer/bindings/templates/dictionary_v8.cc.tmpl
index 5562da43f2d..a32227277a3 100644
--- a/chromium/third_party/blink/renderer/bindings/templates/dictionary_v8.cc.tmpl
+++ b/chromium/third_party/blink/renderer/bindings/templates/dictionary_v8.cc.tmpl
@@ -84,6 +84,12 @@ void {{v8_class}}::ToImpl(v8::Isolate* isolate, v8::Local<v8::Value> v8_value, {
     {% if member.deprecate_as %}
     Deprecation::CountDeprecation(CurrentExecutionContext(isolate), WebFeature::k{{member.deprecate_as}});
     {% endif %}
+    {% if member.is_callback_function_type %}
+    if (!{{member.v8_value}}->IsFunction()) {
+      exception_state.ThrowTypeError("member {{member.name}} is not a function.");
+      return;
+    }
+    {% endif %}
     {{v8_value_to_local_cpp_value(member) | trim | indent}}
     {% if member.is_interface_type %}
     if (!{{member.cpp_value}}) {
diff --git a/chromium/third_party/blink/renderer/controller/oom_intervention_impl.cc b/chromium/third_party/blink/renderer/controller/oom_intervention_impl.cc
index 680dd044269..a1f7a5caa61 100644
--- a/chromium/third_party/blink/renderer/controller/oom_intervention_impl.cc
+++ b/chromium/third_party/blink/renderer/controller/oom_intervention_impl.cc
@@ -82,12 +82,15 @@ void OomInterventionImpl::Check(TimerBase*) {
   if (oom_detected) {
     if (navigate_ads_enabled_ || purge_v8_memory_enabled_) {
       for (const auto& page : Page::OrdinaryPages()) {
-        if (page->MainFrame()->IsLocalFrame()) {
-          LocalFrame* frame = ToLocalFrame(page->MainFrame());
+        for (Frame* frame = page->MainFrame(); frame;
+             frame = frame->Tree().TraverseNext()) {
+          if (!frame->IsLocalFrame())
+            continue;
+          LocalFrame* local_frame = ToLocalFrame(frame);
           if (navigate_ads_enabled_)
-            frame->GetDocument()->NavigateLocalAdsFrames();
+            local_frame->GetDocument()->NavigateLocalAdsFrames();
           if (purge_v8_memory_enabled_)
-            frame->ForciblyPurgeV8Memory();
+            local_frame->ForciblyPurgeV8Memory();
         }
       }
     }
diff --git a/chromium/third_party/blink/renderer/core/css/style_engine.cc b/chromium/third_party/blink/renderer/core/css/style_engine.cc
index db393e393ab..8248be742a1 100644
--- a/chromium/third_party/blink/renderer/core/css/style_engine.cc
+++ b/chromium/third_party/blink/renderer/core/css/style_engine.cc
@@ -511,6 +511,15 @@ const ActiveStyleSheetVector StyleEngine::ActiveStyleSheetsForInspector() {
   return active_style_sheets;
 }
 
+void StyleEngine::ShadowRootInsertedToDocument(ShadowRoot& shadow_root) {
+  DCHECK(shadow_root.isConnected());
+  if (GetDocument().IsDetached() || !shadow_root.HasAdoptedStyleSheets())
+    return;
+  EnsureStyleSheetCollectionFor(shadow_root);
+  SetNeedsActiveStyleUpdate(shadow_root);
+  active_tree_scopes_.insert(&shadow_root);
+}
+
 void StyleEngine::ShadowRootRemovedFromDocument(ShadowRoot* shadow_root) {
   style_sheet_collection_map_.erase(shadow_root);
   active_tree_scopes_.erase(shadow_root);
diff --git a/chromium/third_party/blink/renderer/core/css/style_engine.h b/chromium/third_party/blink/renderer/core/css/style_engine.h
index d05f7cbc72d..b8b17e964e7 100644
--- a/chromium/third_party/blink/renderer/core/css/style_engine.h
+++ b/chromium/third_party/blink/renderer/core/css/style_engine.h
@@ -217,6 +217,7 @@ class CORE_EXPORT StyleEngine final
 
   void ResetCSSFeatureFlags(const RuleFeatureSet&);
 
+  void ShadowRootInsertedToDocument(ShadowRoot&);
   void ShadowRootRemovedFromDocument(ShadowRoot*);
   void AddTreeBoundaryCrossingScope(const TreeScope&);
   const TreeOrderedList& TreeBoundaryCrossingScopes() const {
diff --git a/chromium/third_party/blink/renderer/core/dom/container_node.cc b/chromium/third_party/blink/renderer/core/dom/container_node.cc
index 59467cf7652..09def33064f 100644
--- a/chromium/third_party/blink/renderer/core/dom/container_node.cc
+++ b/chromium/third_party/blink/renderer/core/dom/container_node.cc
@@ -688,6 +688,10 @@ Node* ContainerNode::RemoveChild(Node* old_child,
 
   WillRemoveChild(*child);
 
+  // TODO(crbug.com/927646): |WillRemoveChild()| may dispatch events that set
+  // focus to a node that will be detached, leaving behind a detached focused
+  // node. Fix it.
+
   // Mutation events might have moved this child into a different parent.
   if (child->parentNode() != this) {
     exception_state.ThrowDOMException(
diff --git a/chromium/third_party/blink/renderer/core/dom/document.cc b/chromium/third_party/blink/renderer/core/dom/document.cc
index e5d02bd5288..1aa4f77b363 100644
--- a/chromium/third_party/blink/renderer/core/dom/document.cc
+++ b/chromium/third_party/blink/renderer/core/dom/document.cc
@@ -3182,6 +3182,7 @@ void Document::open() {
     if (frame_ && frame_->Client())
       frame_->Client()->AbortClientNavigation();
   }
+  javascript_url_task_handle_.Cancel();
 
   // For each shadow-including inclusive descendant |node| of |document|, erase
   // all event listeners and handlers given |node|.
diff --git a/chromium/third_party/blink/renderer/core/dom/shadow_root.cc b/chromium/third_party/blink/renderer/core/dom/shadow_root.cc
index 39d2eed15fc..0788dc8db18 100644
--- a/chromium/third_party/blink/renderer/core/dom/shadow_root.cc
+++ b/chromium/third_party/blink/renderer/core/dom/shadow_root.cc
@@ -170,6 +170,8 @@ Node::InsertionNotificationRequest ShadowRoot::InsertedInto(
   if (!insertion_point.isConnected())
     return kInsertionDone;
 
+  GetDocument().GetStyleEngine().ShadowRootInsertedToDocument(*this);
+
   GetDocument().GetSlotAssignmentEngine().Connected(*this);
 
   // FIXME: When parsing <video controls>, InsertedInto() is called many times
diff --git a/chromium/third_party/blink/renderer/core/editing/finder/find_buffer.cc b/chromium/third_party/blink/renderer/core/editing/finder/find_buffer.cc
index 6cd63bbe743..b3c08463402 100644
--- a/chromium/third_party/blink/renderer/core/editing/finder/find_buffer.cc
+++ b/chromium/third_party/blink/renderer/core/editing/finder/find_buffer.cc
@@ -225,7 +225,8 @@ void FindBuffer::CollectTextUntilBlockBoundary(Node& start_node) {
     if (ShouldIgnoreContents(*node)) {
       // Move the node so we wouldn't encounter this node or its descendants
       // later.
-      buffer_.push_back(kObjectReplacementCharacter);
+      if (!IsHTMLWBRElement(ToHTMLElement(*node)))
+        buffer_.push_back(kObjectReplacementCharacter);
       node = FlatTreeTraversal::NextSkippingChildren(*node);
       continue;
     }
diff --git a/chromium/third_party/blink/renderer/core/editing/frame_caret.cc b/chromium/third_party/blink/renderer/core/editing/frame_caret.cc
index 95cce009cde..55e590dc927 100644
--- a/chromium/third_party/blink/renderer/core/editing/frame_caret.cc
+++ b/chromium/third_party/blink/renderer/core/editing/frame_caret.cc
@@ -74,6 +74,7 @@ const PositionWithAffinity FrameCaret::CaretPosition() const {
       selection_editor_->ComputeVisibleSelectionInDOMTree();
   if (!selection.IsCaret())
     return PositionWithAffinity();
+  DCHECK(selection.Start().IsValidFor(*frame_->GetDocument()));
   return PositionWithAffinity(selection.Start(), selection.Affinity());
 }
 
diff --git a/chromium/third_party/blink/renderer/core/exported/web_frame_test.cc b/chromium/third_party/blink/renderer/core/exported/web_frame_test.cc
index 4bac8b63743..e6917e62f31 100644
--- a/chromium/third_party/blink/renderer/core/exported/web_frame_test.cc
+++ b/chromium/third_party/blink/renderer/core/exported/web_frame_test.cc
@@ -134,6 +134,7 @@
 #include "third_party/blink/renderer/core/page/chrome_client.h"
 #include "third_party/blink/renderer/core/page/page.h"
 #include "third_party/blink/renderer/core/page/scoped_page_pauser.h"
+#include "third_party/blink/renderer/core/page/scrolling/top_document_root_scroller_controller.h"
 #include "third_party/blink/renderer/core/paint/compositing/composited_layer_mapping.h"
 #include "third_party/blink/renderer/core/paint/paint_layer.h"
 #include "third_party/blink/renderer/core/paint/paint_layer_scrollable_area.h"
@@ -11594,6 +11595,88 @@ TEST_F(WebFrameSimTest, TestScrollFocusedEditableElementIntoView) {
   EXPECT_EQ(1, WebView().FakePageScaleAnimationPageScaleForTesting());
 }
 
+// Ensures scrolling a focused editable text into view that's located in the
+// root scroller works by scrolling the root scroller.
+TEST_F(WebFrameSimTest, TestScrollFocusedEditableInRootScroller) {
+  WebView().MainFrameWidget()->Resize(WebSize(500, 300));
+  WebView().SetDefaultPageScaleLimits(1.f, 4);
+  WebView().EnableFakePageScaleAnimationForTesting(true);
+  WebView().GetPage()->GetSettings().SetTextAutosizingEnabled(false);
+  WebView().GetPage()->GetSettings().SetViewportEnabled(false);
+  WebView().GetSettings()->SetAutoZoomFocusedNodeToLegibleScale(true);
+
+  SimRequest request("https://example.com/test.html", "text/html");
+  LoadURL("https://example.com/test.html");
+  request.Complete(R"HTML(
+      <!DOCTYPE html>
+      <style>
+        ::-webkit-scrollbar {
+          width: 0px;
+          height: 0px;
+        }
+        body,html {
+          width: 100%;
+          height: 100%;
+          margin: 0px;
+        }
+        input {
+          border: 0;
+          padding: 0;
+          margin-left: 200px;
+          margin-top: 700px;
+          width: 100px;
+          height: 20px;
+        }
+        #scroller {
+          background: silver;
+          width: 100%;
+          height: 100%;
+          overflow: auto;
+        }
+      </style>
+      <div id="scroller" tabindex="-1">
+        <input type="text">
+      </div>
+  )HTML");
+
+  Compositor().BeginFrame();
+
+  TopDocumentRootScrollerController& rs_controller =
+      GetDocument().GetPage()->GlobalRootScrollerController();
+
+  Element* scroller = GetDocument().getElementById("scroller");
+  ASSERT_EQ(scroller, rs_controller.GlobalRootScroller());
+
+  LocalFrame* frame = ToLocalFrame(WebView().GetPage()->MainFrame());
+  VisualViewport& visual_viewport = frame->GetPage()->GetVisualViewport();
+
+  WebView().AdvanceFocus(false);
+
+  rs_controller.RootScrollerArea()->SetScrollOffset(ScrollOffset(0, 300),
+                                                    kProgrammaticScroll);
+
+  FloatRect inputRect(200, 700, 100, 20);
+  ASSERT_EQ(1, visual_viewport.Scale());
+  ASSERT_EQ(FloatPoint(0, 300),
+            visual_viewport.VisibleRectInDocument().Location());
+  ASSERT_FALSE(visual_viewport.VisibleRectInDocument().Contains(inputRect));
+
+  WebView()
+      .MainFrameImpl()
+      ->FrameWidget()
+      ->ScrollFocusedEditableElementIntoView();
+
+  EXPECT_EQ(1, WebView().FakePageScaleAnimationPageScaleForTesting());
+
+  ScrollOffset target_offset = ToFloatSize(
+      FloatPoint(WebView().FakePageScaleAnimationTargetPositionForTesting()));
+
+  rs_controller.RootScrollerArea()->SetScrollOffset(target_offset,
+                                                    kProgrammaticScroll);
+
+  EXPECT_TRUE(visual_viewport.VisibleRectInDocument().Contains(inputRect));
+}
+
 TEST_F(WebFrameSimTest, ScrollFocusedIntoViewClipped) {
   // The Android On-Screen Keyboard (OSK) resizes the Widget Blink is hosted
   // in. When the keyboard is shown, we scroll and zoom in on the currently
diff --git a/chromium/third_party/blink/renderer/core/exported/web_view_impl.cc b/chromium/third_party/blink/renderer/core/exported/web_view_impl.cc
index 2455c372862..8dde30b743e 100644
--- a/chromium/third_party/blink/renderer/core/exported/web_view_impl.cc
+++ b/chromium/third_party/blink/renderer/core/exported/web_view_impl.cc
@@ -2148,6 +2148,25 @@ void WebViewImpl::ComputeScaleAndScrollForEditableElementRects(
     bool& need_animation) {
   VisualViewport& visual_viewport = GetPage()->GetVisualViewport();
 
+  TopDocumentRootScrollerController& controller =
+      GetPage()->GlobalRootScrollerController();
+  Node* root_scroller = controller.GlobalRootScroller();
+
+  IntRect element_bounds_in_content = element_bounds_in_document;
+  IntRect caret_bounds_in_content = caret_bounds_in_document;
+
+  // If the page has a non-default root scroller then we need to scroll that
+  // rather than the "real" viewport. However, the given coordinates are in the
+  // real viewport's document space rather than the root scroller's so we
+  // perform the conversion here.  TODO(bokan): Convert this function to take
+  // coordinates in absolute/root-frame coordinates to make this more
+  // consistent. https://crbug.com/931447.
+  if (root_scroller != MainFrameImpl()->GetFrame()->GetDocument()) {
+    ScrollOffset offset = controller.RootScrollerArea()->GetScrollOffset();
+    element_bounds_in_content.Move(FlooredIntSize(offset));
+    caret_bounds_in_content.Move(FlooredIntSize(offset));
+  }
+
   if (!zoom_into_legible_scale) {
     new_scale = PageScaleFactor();
   } else {
@@ -2155,14 +2174,14 @@ void WebViewImpl::ComputeScaleAndScrollForEditableElementRects(
     // the caret height will become minReadableCaretHeightForNode (adjusted
     // for dpi and font scale factor).
     const int min_readable_caret_height_for_node =
-        (element_bounds_in_document.Height() >=
-                 2 * caret_bounds_in_document.Height()
+        (element_bounds_in_content.Height() >=
+                 2 * caret_bounds_in_content.Height()
              ? minReadableCaretHeightForTextArea
              : minReadableCaretHeight) *
         MainFrameImpl()->GetFrame()->PageZoomFactor();
     new_scale = ClampPageScaleFactorToLimits(
         MaximumLegiblePageScale() * min_readable_caret_height_for_node /
-        caret_bounds_in_document.Height());
+        caret_bounds_in_content.Height());
     new_scale = std::max(new_scale, PageScaleFactor());
   }
   const float delta_scale = new_scale / PageScaleFactor();
@@ -2177,17 +2196,17 @@ void WebViewImpl::ComputeScaleAndScrollForEditableElementRects(
 
   // If the caret is offscreen, then animate.
   if (!visual_viewport.VisibleRectInDocument().Contains(
-          caret_bounds_in_document))
+          caret_bounds_in_content))
     need_animation = true;
 
   // If the box is partially offscreen and it's possible to bring it fully
   // onscreen, then animate.
   if (visual_viewport.VisibleRect().Width() >=
-          element_bounds_in_document.Width() &&
+          element_bounds_in_content.Width() &&
       visual_viewport.VisibleRect().Height() >=
-          element_bounds_in_document.Height() &&
+          element_bounds_in_content.Height() &&
       !visual_viewport.VisibleRectInDocument().Contains(
-          element_bounds_in_document))
+          element_bounds_in_content))
     need_animation = true;
 
   if (!need_animation)
@@ -2196,36 +2215,36 @@ void WebViewImpl::ComputeScaleAndScrollForEditableElementRects(
   FloatSize target_viewport_size(visual_viewport.Size());
   target_viewport_size.Scale(1 / new_scale);
 
-  if (element_bounds_in_document.Width() <= target_viewport_size.Width()) {
+  if (element_bounds_in_content.Width() <= target_viewport_size.Width()) {
     // Field is narrower than screen. Try to leave padding on left so field's
     // label is visible, but it's more important to ensure entire field is
     // onscreen.
     int ideal_left_padding = target_viewport_size.Width() * leftBoxRatio;
     int max_left_padding_keeping_box_onscreen =
-        target_viewport_size.Width() - element_bounds_in_document.Width();
-    new_scroll.SetX(element_bounds_in_document.X() -
+        target_viewport_size.Width() - element_bounds_in_content.Width();
+    new_scroll.SetX(element_bounds_in_content.X() -
                     std::min<int>(ideal_left_padding,
                                   max_left_padding_keeping_box_onscreen));
   } else {
     // Field is wider than screen. Try to left-align field, unless caret would
     // be offscreen, in which case right-align the caret.
     new_scroll.SetX(std::max<int>(
-        element_bounds_in_document.X(),
-        caret_bounds_in_document.X() + caret_bounds_in_document.Width() +
+        element_bounds_in_content.X(),
+        caret_bounds_in_content.X() + caret_bounds_in_content.Width() +
             caretPadding - target_viewport_size.Width()));
   }
-  if (element_bounds_in_document.Height() <= target_viewport_size.Height()) {
+  if (element_bounds_in_content.Height() <= target_viewport_size.Height()) {
     // Field is shorter than screen. Vertically center it.
     new_scroll.SetY(
-        element_bounds_in_document.Y() -
-        (target_viewport_size.Height() - element_bounds_in_document.Height()) /
+        element_bounds_in_content.Y() -
+        (target_viewport_size.Height() - element_bounds_in_content.Height()) /
             2);
   } else {
     // Field is taller than screen. Try to top align field, unless caret would
     // be offscreen, in which case bottom-align the caret.
     new_scroll.SetY(std::max<int>(
-        element_bounds_in_document.Y(),
-        caret_bounds_in_document.Y() + caret_bounds_in_document.Height() +
+        element_bounds_in_content.Y(),
+        caret_bounds_in_content.Y() + caret_bounds_in_content.Height() +
             caretPadding - target_viewport_size.Height()));
   }
 }
diff --git a/chromium/third_party/blink/renderer/core/fileapi/file_reader_loader.cc b/chromium/third_party/blink/renderer/core/fileapi/file_reader_loader.cc
index 5a1cc40c235..36491a4b86f 100644
--- a/chromium/third_party/blink/renderer/core/fileapi/file_reader_loader.cc
+++ b/chromium/third_party/blink/renderer/core/fileapi/file_reader_loader.cc
@@ -143,14 +143,16 @@ DOMArrayBuffer* FileReaderLoader::ArrayBufferResult() {
   if (!raw_data_ || error_code_ != FileErrorCode::kOK)
     return nullptr;
 
-  DOMArrayBuffer* result = DOMArrayBuffer::Create(raw_data_->ToArrayBuffer());
-  if (finished_loading_) {
-    array_buffer_result_ = result;
-    AdjustReportedMemoryUsageToV8(
-        -1 * static_cast<int64_t>(raw_data_->ByteLength()));
-    raw_data_.reset();
+  if (!finished_loading_) {
+    return DOMArrayBuffer::Create(
+        ArrayBuffer::Create(raw_data_->Data(), raw_data_->ByteLength()));
   }
-  return result;
+
+  array_buffer_result_ = DOMArrayBuffer::Create(raw_data_->ToArrayBuffer());
+  AdjustReportedMemoryUsageToV8(-1 *
+                                static_cast<int64_t>(raw_data_->ByteLength()));
+  raw_data_.reset();
+  return array_buffer_result_;
 }
 
 String FileReaderLoader::StringResult() {
diff --git a/chromium/third_party/blink/renderer/core/frame/web_local_frame_impl.cc b/chromium/third_party/blink/renderer/core/frame/web_local_frame_impl.cc
index 5a9963e8ed5..6197e91bd3c 100644
--- a/chromium/third_party/blink/renderer/core/frame/web_local_frame_impl.cc
+++ b/chromium/third_party/blink/renderer/core/frame/web_local_frame_impl.cc
@@ -1496,7 +1496,6 @@ void WebLocalFrameImpl::DispatchPrintEventRecursively(
 
 int WebLocalFrameImpl::PrintBegin(const WebPrintParams& print_params,
                                   const WebNode& constrain_to_node) {
-  DCHECK(!GetFrame()->GetDocument()->IsFrameSet());
   WebPluginContainerImpl* plugin_container = nullptr;
   if (constrain_to_node.IsNull()) {
     // If this is a plugin document, check if the plugin supports its own
diff --git a/chromium/third_party/blink/renderer/core/html/canvas/html_canvas_element.cc b/chromium/third_party/blink/renderer/core/html/canvas/html_canvas_element.cc
index c9a271fdd85..2ef7a11feae 100644
--- a/chromium/third_party/blink/renderer/core/html/canvas/html_canvas_element.cc
+++ b/chromium/third_party/blink/renderer/core/html/canvas/html_canvas_element.cc
@@ -984,44 +984,47 @@ void HTMLCanvasElement::PushFrame(scoped_refptr<CanvasResource> image,
 }
 
 bool HTMLCanvasElement::ShouldAccelerate(AccelerationCriteria criteria) const {
-  if (base::FeatureList::IsEnabled(features::kAlwaysAccelerateCanvas))
-    return true;
-
-  if (context_ && !Is2d())
-    return false;
-
-  // The following is necessary for handling the special case of canvases in the
-  // dev tools overlay, which run in a process that supports accelerated 2d
-  // canvas but in a special compositing context that does not.
-  if (GetLayoutBox() && !GetLayoutBox()->HasAcceleratedCompositing())
-    return false;
-
-  base::CheckedNumeric<int> checked_canvas_pixel_count = Size().Width();
-  checked_canvas_pixel_count *= Size().Height();
-  if (!checked_canvas_pixel_count.IsValid())
-    return false;
-  int canvas_pixel_count = checked_canvas_pixel_count.ValueOrDie();
-
-  // Do not use acceleration for small canvas.
-  if (criteria != kIgnoreResourceLimitCriteria) {
-    Settings* settings = GetDocument().GetSettings();
-    if (!settings ||
-        canvas_pixel_count < settings->GetMinimumAccelerated2dCanvasSize()) {
+  // With this feature enabled we want to accelerate canvases whenever we can.
+  // This does not include when the context_provider CANNOT accelerated
+  // canvases.
+  if (!base::FeatureList::IsEnabled(features::kAlwaysAccelerateCanvas)) {
+    if (context_ && !Is2d())
       return false;
-    }
 
-    // When GPU allocated memory runs low (due to having created too many
-    // accelerated canvases), the compositor starves and browser becomes laggy.
-    // Thus, we should stop allocating more GPU memory to new canvases created
-    // when the current memory usage exceeds the threshold.
-    if (global_gpu_memory_usage_ >= kMaxGlobalGPUMemoryUsage)
+    // The following is necessary for handling the special case of canvases in
+    // the dev tools overlay, which run in a process that supports accelerated
+    // 2d canvas but in a special compositing context that does not.
+    if (GetLayoutBox() && !GetLayoutBox()->HasAcceleratedCompositing())
       return false;
 
-    // Allocating too many GPU resources can makes us run into the driver's
-    // resource limits. So we need to keep the number of texture resources
-    // under tight control
-    if (global_accelerated_context_count_ >= kMaxGlobalAcceleratedResourceCount)
+    base::CheckedNumeric<int> checked_canvas_pixel_count = Size().Width();
+    checked_canvas_pixel_count *= Size().Height();
+    if (!checked_canvas_pixel_count.IsValid())
       return false;
+    int canvas_pixel_count = checked_canvas_pixel_count.ValueOrDie();
+
+    // Do not use acceleration for small canvas.
+    if (criteria != kIgnoreResourceLimitCriteria) {
+      Settings* settings = GetDocument().GetSettings();
+      if (!settings ||
+          canvas_pixel_count < settings->GetMinimumAccelerated2dCanvasSize()) {
+        return false;
+      }
+
+      // When GPU allocated memory runs low (due to having created too many
+      // accelerated canvases), the compositor starves and browser becomes
+      // laggy. Thus, we should stop allocating more GPU memory to new canvases
+      // created when the current memory usage exceeds the threshold.
+      if (global_gpu_memory_usage_ >= kMaxGlobalGPUMemoryUsage)
+        return false;
+
+      // Allocating too many GPU resources can makes us run into the driver's
+      // resource limits. So we need to keep the number of texture resources
+      // under tight control
+      if (global_accelerated_context_count_ >=
+          kMaxGlobalAcceleratedResourceCount)
+        return false;
+    }
   }
 
   // Avoid creating |contextProvider| until we're sure we want to try use it,
diff --git a/chromium/third_party/blink/renderer/core/html/forms/resources/pickerCommon.js b/chromium/third_party/blink/renderer/core/html/forms/resources/pickerCommon.js
index d4b6856b22f..b5071055647 100644
--- a/chromium/third_party/blink/renderer/core/html/forms/resources/pickerCommon.js
+++ b/chromium/third_party/blink/renderer/core/html/forms/resources/pickerCommon.js
@@ -141,7 +141,14 @@ function _adjustWindowRectVertically(windowRect, availRect, anchorRect, minHeigh
 
   var availableSpaceBelow = availRect.maxY - anchorRect.maxY;
   availableSpaceBelow = Math.max(0, Math.min(availRect.height, availableSpaceBelow));
-  if (windowRect.height > availableSpaceBelow && availableSpaceBelow < availableSpaceAbove) {
+
+  // In some situations, there may be no space available.  This can happen on
+  // Linux when using a buggy window manager (https://crbug.com/774232).  When
+  // this happens, don't try to constrain the window at all.
+  if (availableSpaceAbove == 0 && availableSpaceBelow == 0) {
+    windowRect.height = Math.max(minHeight, windowRect.height);
+    windowRect.y = anchorRect.maxY;
+  } else if (windowRect.height > availableSpaceBelow && availableSpaceBelow < availableSpaceAbove) {
     windowRect.height = Math.min(windowRect.height, availableSpaceAbove);
     windowRect.height = Math.max(windowRect.height, minHeight);
     windowRect.y = anchorRect.y - windowRect.height;
@@ -156,6 +163,11 @@ function _adjustWindowRectVertically(windowRect, availRect, anchorRect, minHeigh
  * Arguments are DIPs.
  */
 function _adjustWindowRectHorizontally(windowRect, availRect, anchorRect, minWidth) {
+  if (anchorRect.maxX <= availRect.x || availRect.maxX <= anchorRect.x) {
+    windowRect.width = Math.max(minWidth, windowRect.width);
+    windowRect.x = anchorRect.x
+    return;
+  }
   windowRect.width = Math.min(windowRect.width, availRect.width);
   windowRect.width = Math.max(windowRect.width, minWidth);
   windowRect.x = anchorRect.x;
diff --git a/chromium/third_party/blink/renderer/core/html/forms/text_control_element.cc b/chromium/third_party/blink/renderer/core/html/forms/text_control_element.cc
index add2d09f30b..3eec0b9eb69 100644
--- a/chromium/third_party/blink/renderer/core/html/forms/text_control_element.cc
+++ b/chromium/third_party/blink/renderer/core/html/forms/text_control_element.cc
@@ -429,7 +429,9 @@ bool TextControlElement::SetSelectionRange(
     direction = kSelectionHasForwardDirection;
   bool did_change = CacheSelection(start, end, direction);
 
-  if (GetDocument().FocusedElement() != this)
+  // TODO(crbug.com/927646): The focused element should always be connected, but
+  // we fail to ensure so in some cases. Fix it.
+  if (GetDocument().FocusedElement() != this || !isConnected())
     return did_change;
 
   HTMLElement* inner_editor = InnerEditorElement();
diff --git a/chromium/third_party/blink/renderer/core/layout/layout_box.cc b/chromium/third_party/blink/renderer/core/layout/layout_box.cc
index ce5f73c0eea..f2a3d68ff60 100644
--- a/chromium/third_party/blink/renderer/core/layout/layout_box.cc
+++ b/chromium/third_party/blink/renderer/core/layout/layout_box.cc
@@ -656,8 +656,12 @@ LayoutRect LayoutBox::ScrollRectToVisibleRecursive(
   if (!GetFrameView())
     return absolute_rect;
 
-  if (params.stop_at_main_frame_layout_viewport && IsLayoutView() &&
-      GetFrame()->IsMainFrame())
+  // If we've reached the main frame's layout viewport (which is always set to
+  // the global root scroller, see ViewportScrollCallback::SetScroller), abort
+  // if the stop_at_main_frame_layout_viewport option is set. We do this so
+  // that we can allow a smooth "scroll and zoom" animation to do the final
+  // scroll in cases like scrolling a focused editable box into view.
+  if (params.stop_at_main_frame_layout_viewport && IsGlobalRootScroller())
     return absolute_rect;
 
   // Presumably the same issue as in setScrollTop. See crbug.com/343132.
diff --git a/chromium/third_party/blink/renderer/core/layout/layout_flexible_box.cc b/chromium/third_party/blink/renderer/core/layout/layout_flexible_box.cc
index f17f377b405..42fcaab49c5 100644
--- a/chromium/third_party/blink/renderer/core/layout/layout_flexible_box.cc
+++ b/chromium/third_party/blink/renderer/core/layout/layout_flexible_box.cc
@@ -523,9 +523,12 @@ LayoutUnit LayoutFlexibleBox::ChildIntrinsicLogicalWidth(
   // If our height is auto, make sure that our returned height is unaffected by
   // earlier layouts by returning the shrink-to-fit size.
   if (!CrossAxisLengthIsDefinite(child, child.StyleRef().LogicalWidth())) {
+    LayoutUnit available_size =
+        ContentLogicalWidth() - child.MarginLogicalWidth();
     MinMaxSize sizes{child.MinPreferredLogicalWidth(),
                      child.MaxPreferredLogicalWidth()};
-    return sizes.ShrinkToFit(ContentLogicalWidth());
+    return child.ConstrainLogicalWidthByMinMax(
+        sizes.ShrinkToFit(available_size), available_size, this);
   }
 
   return child.LogicalWidth();
@@ -1236,20 +1239,6 @@ void LayoutFlexibleBox::SetOverrideMainAxisContentSizeForChild(FlexItem& item) {
   }
 }
 
-bool LayoutFlexibleBox::ChildLogicalHeightStretchesToFlexboxSize(
-    FlexItem& item) const {
-  if (IsMultiline())
-    return false;
-  if (!NeedToStretchChildLogicalHeight(*item.box))
-    return false;
-  if (HasAutoMarginsInCrossAxis(*item.box))
-    return false;
-  if (item.box->IntrinsicContentLogicalHeight() == -1)
-    return false;
-
-  return HasDefiniteLogicalHeight();
-}
-
 LayoutUnit LayoutFlexibleBox::StaticMainAxisPositionForPositionedChild(
     const LayoutBox& child) {
   const LayoutUnit available_space =
@@ -1408,35 +1397,6 @@ void LayoutFlexibleBox::LayoutLineItems(FlexLine* current_line,
     child->SetShouldCheckForPaintInvalidation();
 
     SetOverrideMainAxisContentSizeForChild(flex_item);
-
-    // We may have already forced relayout for orthogonal flowing children in
-    // computeInnerFlexBaseSizeForChild.
-    bool force_child_relayout =
-        relayout_children && !relaid_out_children_.Contains(child);
-
-    // Apply optimization 1 from section 9.8 for row flexboxes by overriding
-    // the logical height of stretchable children to the parent's definite
-    // height, if present (https://crbug.com/703512).
-    if (ChildLogicalHeightStretchesToFlexboxSize(flex_item)) {
-      LogicalExtentComputedValues computed_values;
-      ComputeLogicalHeight(computed_values);
-      LayoutUnit cross_axis_extent = computed_values.extent_;
-      DCHECK_NE(cross_axis_extent, LayoutUnit(-1));
-
-      // Compute the maximum possible cross axis extent available, since we
-      // don't optimize for intrinsically sized children.
-      LayoutUnit stretched_logical_height =
-          std::max(child->BorderAndPaddingLogicalHeight(),
-                   cross_axis_extent - flex_item.CrossAxisMarginExtent());
-      LayoutUnit clamped_logical_height = child->ConstrainLogicalHeightByMinMax(
-          stretched_logical_height, child->IntrinsicContentLogicalHeight());
-
-      child->SetOverrideLogicalHeight(clamped_logical_height);
-      if (clamped_logical_height != child->LogicalHeight()) {
-        force_child_relayout = true;
-      }
-    }
-
     // The flexed content size and the override size include the scrollbar
     // width, so we need to compare to the size including the scrollbar.
     if (flex_item.flexed_content_size !=
@@ -1447,6 +1407,10 @@ void LayoutFlexibleBox::LayoutLineItems(FlexLine* current_line,
       // updateAutoMarginsInCrossAxis, we reset the margins here.
       ResetAutoMarginsAndLogicalTopInCrossAxis(*child);
     }
+    // We may have already forced relayout for orthogonal flowing children in
+    // computeInnerFlexBaseSizeForChild.
+    bool force_child_relayout =
+        relayout_children && !relaid_out_children_.Contains(child);
     // TODO(dgrogan): Broaden the NG part of this check once NG types other
     // than Mixin derivatives are cached.
     if (child->IsLayoutBlock() &&
@@ -1655,7 +1619,7 @@ void LayoutFlexibleBox::ApplyStretchAlignmentToChild(FlexItem& flex_item) {
         flex_item.cross_axis_size != child.LogicalHeight();
     if (child.IsLayoutBlock() &&
         ToLayoutBlock(child).HasPercentHeightDescendants() &&
-        !CanAvoidLayoutForNGChild(child) && !child.HasOverrideLogicalHeight()) {
+        !CanAvoidLayoutForNGChild(child)) {
       // Have to force another relayout even though the child is sized
       // correctly, because its descendants are not sized correctly yet. Our
       // previous layout of the child was done without an override height set.
diff --git a/chromium/third_party/blink/renderer/core/layout/layout_flexible_box.h b/chromium/third_party/blink/renderer/core/layout/layout_flexible_box.h
index 0d340bb8f49..d1ad9b9b649 100644
--- a/chromium/third_party/blink/renderer/core/layout/layout_flexible_box.h
+++ b/chromium/third_party/blink/renderer/core/layout/layout_flexible_box.h
@@ -189,7 +189,6 @@ class CORE_EXPORT LayoutFlexibleBox : public LayoutBlock {
 
   void ResetAutoMarginsAndLogicalTopInCrossAxis(LayoutBox& child);
   void SetOverrideMainAxisContentSizeForChild(FlexItem&);
-  bool ChildLogicalHeightStretchesToFlexboxSize(FlexItem&) const;
   void PrepareChildForPositionedLayout(LayoutBox& child);
   void LayoutLineItems(FlexLine*, bool relayout_children, SubtreeLayoutScope&);
   void ApplyLineItemsPosition(FlexLine*);
diff --git a/chromium/third_party/blink/renderer/core/layout/layout_object.cc b/chromium/third_party/blink/renderer/core/layout/layout_object.cc
index 161a879c44d..33be8a2e95b 100644
--- a/chromium/third_party/blink/renderer/core/layout/layout_object.cc
+++ b/chromium/third_party/blink/renderer/core/layout/layout_object.cc
@@ -1503,10 +1503,17 @@ bool LayoutObject::HasDistortingVisualEffects() const {
 }
 
 bool LayoutObject::HasNonZeroEffectiveOpacity() const {
-  PropertyTreeState paint_properties = EnclosingLayer()
-                                           ->GetLayoutObject()
-                                           .FirstFragment()
-                                           .LocalBorderBoxProperties();
+  const FragmentData& fragment =
+      EnclosingLayer()->GetLayoutObject().FirstFragment();
+
+  // This can happen for an iframe element which is outside the viewport and has
+  // therefore never been painted. In that case, we do the safe thing -- report
+  // it as having non-zero opacity -- since this method is used by
+  // IntersectionObserver to detect occlusion.
+  if (!fragment.HasLocalBorderBoxProperties())
+    return true;
+
+  PropertyTreeState paint_properties = fragment.LocalBorderBoxProperties();
 
   for (const auto* effect = SafeUnalias(paint_properties.Effect()); effect;
        effect = SafeUnalias(effect->Parent())) {
diff --git a/chromium/third_party/blink/renderer/core/loader/base_fetch_context.cc b/chromium/third_party/blink/renderer/core/loader/base_fetch_context.cc
index 040374a5e0e..a90cdf13423 100644
--- a/chromium/third_party/blink/renderer/core/loader/base_fetch_context.cc
+++ b/chromium/third_party/blink/renderer/core/loader/base_fetch_context.cc
@@ -380,7 +380,7 @@ BaseFetchContext::CanRequestInternal(
   // Loading of a subresource may be blocked by previews resource loading hints.
   if (GetPreviewsResourceLoadingHints() &&
       !GetPreviewsResourceLoadingHints()->AllowLoad(
-          url, resource_request.Priority())) {
+          type, url, resource_request.Priority())) {
     return ResourceRequestBlockedReason::kOther;
   }
 
diff --git a/chromium/third_party/blink/renderer/core/loader/previews_resource_loading_hints.cc b/chromium/third_party/blink/renderer/core/loader/previews_resource_loading_hints.cc
index a8ff441153f..68c172eb04a 100644
--- a/chromium/third_party/blink/renderer/core/loader/previews_resource_loading_hints.cc
+++ b/chromium/third_party/blink/renderer/core/loader/previews_resource_loading_hints.cc
@@ -4,9 +4,11 @@
 
 #include "third_party/blink/renderer/core/loader/previews_resource_loading_hints.h"
 
+#include "base/metrics/field_trial_params.h"
 #include "base/metrics/histogram_macros.h"
 #include "services/metrics/public/cpp/ukm_builders.h"
 #include "services/metrics/public/cpp/ukm_recorder.h"
+#include "third_party/blink/public/common/features.h"
 #include "third_party/blink/renderer/core/dom/document.h"
 #include "third_party/blink/renderer/core/frame/local_frame.h"
 #include "third_party/blink/renderer/core/inspector/console_message.h"
@@ -14,6 +16,7 @@
 #include "third_party/blink/renderer/core/loader/document_loader.h"
 #include "third_party/blink/renderer/platform/weborigin/kurl.h"
 #include "third_party/blink/renderer/platform/wtf/text/string_builder.h"
+#include "third_party/blink/renderer/platform/wtf/text/wtf_string.h"
 
 namespace blink {
 
@@ -48,16 +51,44 @@ PreviewsResourceLoadingHints::PreviewsResourceLoadingHints(
   subresource_patterns_to_block_usage_.assign(
       subresource_patterns_to_block.size(), false);
   blocked_resource_load_priority_counts_.fill(0);
+
+  // Populate which specific resource types are eligible for blocking.
+  // Certain resource types are blocked by default since their blocking
+  // is currently verified by the server verification pipeline. Note that
+  // the blocking of these resource types can be overridden using field trial.
+  block_resource_type_[static_cast<int>(ResourceType::kCSSStyleSheet)] = true;
+  block_resource_type_[static_cast<int>(ResourceType::kScript)] = true;
+  block_resource_type_[static_cast<int>(ResourceType::kRaw)] = true;
+  for (int i = 0; i < static_cast<int>(ResourceType::kLast) + 1; ++i) {
+    // Parameter names are of format: "block_resource_type_%d". The value
+    // should be either "true" or "false".
+    block_resource_type_[i] = base::GetFieldTrialParamByFeatureAsBool(
+        features::kPreviewsResourceLoadingHintsSpecificResourceTypes,
+        String::Format("block_resource_type_%d", i).Ascii().data(),
+        block_resource_type_[i]);
+  }
+
+  // Ensure that the ResourceType enums have not changed. These should not be
+  // changed since the resource type integer values are used as field trial
+  // params.
+  static_assert(static_cast<int>(ResourceType::kImage) == 1 &&
+                    static_cast<int>(ResourceType::kCSSStyleSheet) == 2 &&
+                    static_cast<int>(ResourceType::kScript) == 3,
+                "ResourceType enums can't be changed");
 }
 
 PreviewsResourceLoadingHints::~PreviewsResourceLoadingHints() = default;
 
 bool PreviewsResourceLoadingHints::AllowLoad(
+    ResourceType type,
     const KURL& resource_url,
     ResourceLoadPriority resource_load_priority) const {
   if (!resource_url.ProtocolIsInHTTPFamily())
     return true;
 
+  if (!block_resource_type_[static_cast<int>(type)])
+    return true;
+
   WTF::String resource_url_string = resource_url.GetString();
   resource_url_string = resource_url_string.Left(resource_url.PathEnd());
   bool allow_load = true;
diff --git a/chromium/third_party/blink/renderer/core/loader/previews_resource_loading_hints.h b/chromium/third_party/blink/renderer/core/loader/previews_resource_loading_hints.h
index 2ad7cc24cf1..db3febbe135 100644
--- a/chromium/third_party/blink/renderer/core/loader/previews_resource_loading_hints.h
+++ b/chromium/third_party/blink/renderer/core/loader/previews_resource_loading_hints.h
@@ -7,9 +7,11 @@
 
 #include <vector>
 
+#include "base/feature_list.h"
 #include "third_party/blink/renderer/core/core_export.h"
 #include "third_party/blink/renderer/platform/heap/garbage_collected.h"
 #include "third_party/blink/renderer/platform/heap/handle.h"
+#include "third_party/blink/renderer/platform/loader/fetch/resource.h"
 #include "third_party/blink/renderer/platform/loader/fetch/resource_load_priority.h"
 #include "third_party/blink/renderer/platform/wtf/text/wtf_string.h"
 
@@ -38,9 +40,11 @@ class CORE_EXPORT PreviewsResourceLoadingHints final
       const std::vector<WTF::String>& subresource_patterns_to_block);
   ~PreviewsResourceLoadingHints();
 
-  // Returns true if load of resource with URL |resource_url| and priority
-  // |resource_load_priority| is allowed as per resource loading hints.
-  bool AllowLoad(const KURL& resource_url,
+  // Returns true if load of resource with type |type|, URL |resource_url|
+  // and priority |resource_load_priority| is allowed as per resource loading
+  // hints.
+  bool AllowLoad(ResourceType type,
+                 const KURL& resource_url,
                  ResourceLoadPriority resource_load_priority) const;
 
   virtual void Trace(blink::Visitor*);
@@ -64,6 +68,10 @@ class CORE_EXPORT PreviewsResourceLoadingHints final
   // be blocked.
   const std::vector<WTF::String> subresource_patterns_to_block_;
 
+  // True if resource blocking hints should apply to resource of a given type.
+  bool block_resource_type_[static_cast<int>(ResourceType::kLast) + 1] = {
+      false};
+
   // |subresource_patterns_to_block_usage_| records whether the pattern located
   // at the same index in |subresource_patterns_to_block_| was ever blocked.
   mutable std::vector<bool> subresource_patterns_to_block_usage_;
diff --git a/chromium/third_party/blink/renderer/core/loader/previews_resource_loading_hints_test.cc b/chromium/third_party/blink/renderer/core/loader/previews_resource_loading_hints_test.cc
index 4d5a001a2e6..03869ad50d8 100644
--- a/chromium/third_party/blink/renderer/core/loader/previews_resource_loading_hints_test.cc
+++ b/chromium/third_party/blink/renderer/core/loader/previews_resource_loading_hints_test.cc
@@ -8,15 +8,18 @@
 #include <vector>
 
 #include "base/test/metrics/histogram_tester.h"
+#include "base/test/scoped_feature_list.h"
 #include "components/ukm/test_ukm_recorder.h"
 #include "services/metrics/public/cpp/ukm_builders.h"
 #include "services/metrics/public/cpp/ukm_recorder.h"
 #include "testing/gtest/include/gtest/gtest.h"
+#include "third_party/blink/public/common/features.h"
 #include "third_party/blink/renderer/core/frame/local_frame.h"
 #include "third_party/blink/renderer/core/loader/frame_loader.h"
 #include "third_party/blink/renderer/core/testing/dummy_page_holder.h"
 #include "third_party/blink/renderer/core/testing/page_test_base.h"
 #include "third_party/blink/renderer/platform/geometry/int_size.h"
+#include "third_party/blink/renderer/platform/loader/fetch/resource.h"
 #include "third_party/blink/renderer/platform/loader/fetch/resource_load_priority.h"
 #include "third_party/blink/renderer/platform/testing/url_test_helpers.h"
 #include "third_party/blink/renderer/platform/weborigin/kurl.h"
@@ -42,7 +45,8 @@ TEST_F(PreviewsResourceLoadingHintsTest, NoPatterns) {
   PreviewsResourceLoadingHints* hints = PreviewsResourceLoadingHints::Create(
       dummy_page_holder_->GetDocument(), ukm::UkmRecorder::GetNewSourceID(),
       subresources_to_block);
-  EXPECT_TRUE(hints->AllowLoad(KURL("https://www.example.com/"),
+  EXPECT_TRUE(hints->AllowLoad(ResourceType::kScript,
+                               KURL("https://www.example.com/"),
                                ResourceLoadPriority::kHighest));
 }
 
@@ -72,16 +76,24 @@ TEST_F(PreviewsResourceLoadingHintsTest, OnePattern) {
 
   for (const auto& test : tests) {
     base::HistogramTester histogram_tester;
+    // By default, resource blocking hints do not apply to images.
+    EXPECT_TRUE(hints->AllowLoad(ResourceType::kImage, test.url,
+                                 ResourceLoadPriority::kHighest));
+    // By default, resource blocking hints apply to CSS and Scripts.
     EXPECT_EQ(test.allow_load_expected,
-              hints->AllowLoad(test.url, ResourceLoadPriority::kHighest));
+              hints->AllowLoad(ResourceType::kCSSStyleSheet, test.url,
+                               ResourceLoadPriority::kHighest));
+    EXPECT_EQ(test.allow_load_expected,
+              hints->AllowLoad(ResourceType::kScript, test.url,
+                               ResourceLoadPriority::kHighest));
     histogram_tester.ExpectUniqueSample(
         "ResourceLoadingHints.ResourceLoadingBlocked",
-        !test.allow_load_expected, 1);
+        !test.allow_load_expected, 2);
     if (!test.allow_load_expected) {
       histogram_tester.ExpectUniqueSample(
           "ResourceLoadingHints.ResourceLoadingBlocked.ResourceLoadPriority."
           "Blocked",
-          ResourceLoadPriority::kHighest, 1);
+          ResourceLoadPriority::kHighest, 2);
       histogram_tester.ExpectTotalCount(
           "ResourceLoadingHints.ResourceLoadingBlocked.ResourceLoadPriority."
           "Allowed",
@@ -94,7 +106,7 @@ TEST_F(PreviewsResourceLoadingHintsTest, OnePattern) {
       histogram_tester.ExpectUniqueSample(
           "ResourceLoadingHints.ResourceLoadingBlocked.ResourceLoadPriority."
           "Allowed",
-          ResourceLoadPriority::kHighest, 1);
+          ResourceLoadPriority::kHighest, 2);
     }
   }
 }
@@ -128,7 +140,8 @@ TEST_F(PreviewsResourceLoadingHintsTest, MultiplePatterns) {
 
   for (const auto& test : tests) {
     EXPECT_EQ(test.allow_load_expected,
-              hints->AllowLoad(test.url, ResourceLoadPriority::kHighest));
+              hints->AllowLoad(ResourceType::kScript, test.url,
+                               ResourceLoadPriority::kHighest));
   }
 }
 
@@ -158,7 +171,8 @@ TEST_F(PreviewsResourceLoadingHintsTest, OnePatternHistogramChecker) {
   for (const auto& test : tests) {
     base::HistogramTester histogram_tester;
     EXPECT_EQ(test.allow_load_expected,
-              hints->AllowLoad(test.url, test.resource_load_priority));
+              hints->AllowLoad(ResourceType::kScript, test.url,
+                               test.resource_load_priority));
     histogram_tester.ExpectUniqueSample(
         "ResourceLoadingHints.ResourceLoadingBlocked",
         !test.allow_load_expected, 1);
@@ -235,7 +249,7 @@ TEST_F(PreviewsResourceLoadingHintsTest, MultiplePatternUKMChecker) {
   };
 
   for (const auto& resource_to_load : resources_to_load) {
-    hints->AllowLoad(resource_to_load.url,
+    hints->AllowLoad(ResourceType::kScript, resource_to_load.url,
                      resource_to_load.resource_load_priority);
   }
 
@@ -262,6 +276,122 @@ TEST_F(PreviewsResourceLoadingHintsTest, MultiplePatternUKMChecker) {
       entry, UkmEntry::kblocked_very_high_priorityName, 1);
 }
 
+// Test class that overrides field trial so that resource blocking hints apply
+// to images as well.
+class PreviewsResourceLoadingHintsTestBlockImages
+    : public PreviewsResourceLoadingHintsTest {
+ public:
+  PreviewsResourceLoadingHintsTestBlockImages() = default;
+
+  void SetUp() override {
+    std::map<std::string, std::string> feature_parameters;
+    feature_parameters["block_resource_type_1"] = "true";
+
+    scoped_feature_list_.InitAndEnableFeatureWithParameters(
+        blink::features::kPreviewsResourceLoadingHintsSpecificResourceTypes,
+        feature_parameters);
+  }
+
+ protected:
+  base::test::ScopedFeatureList scoped_feature_list_;
+};
+
+TEST_F(PreviewsResourceLoadingHintsTestBlockImages,
+       OnePatternWithResourceSubtype) {
+  std::vector<WTF::String> subresources_to_block;
+  subresources_to_block.push_back("foo.jpg");
+
+  PreviewsResourceLoadingHints* hints = PreviewsResourceLoadingHints::Create(
+      dummy_page_holder_->GetDocument(), ukm::UkmRecorder::GetNewSourceID(),
+      subresources_to_block);
+
+  const struct {
+    KURL url;
+    bool allow_load_expected;
+  } tests[] = {
+      {KURL("https://www.example.com/"), true},
+      {KURL("https://www.example.com/foo.js"), true},
+      {KURL("https://www.example.com/foo.jpg"), false},
+      {KURL("https://www.example.com/pages/foo.jpg"), false},
+      {KURL("https://www.example.com/foobar.jpg"), true},
+      {KURL("https://www.example.com/barfoo.jpg"), false},
+      {KURL("http://www.example.com/foo.jpg"), false},
+      {KURL("http://www.example.com/foo.jpg?q=alpha"), false},
+      {KURL("http://www.example.com/bar.jpg?q=foo.jpg"), true},
+      {KURL("http://www.example.com/bar.jpg?q=foo.jpg#foo.jpg"), true},
+  };
+
+  for (const auto& test : tests) {
+    // By default, resource blocking hints do not apply to fonts.
+    EXPECT_TRUE(hints->AllowLoad(ResourceType::kFont, test.url,
+                                 ResourceLoadPriority::kHighest));
+    // Feature override should cause resource blocking hints to apply to images.
+    EXPECT_EQ(test.allow_load_expected,
+              hints->AllowLoad(ResourceType::kImage, test.url,
+                               ResourceLoadPriority::kHighest));
+    EXPECT_EQ(test.allow_load_expected,
+              hints->AllowLoad(ResourceType::kScript, test.url,
+                               ResourceLoadPriority::kHighest));
+  }
+}
+
+// Test class that overrides field trial so that resource blocking hints do not
+// apply to CSS.
+class PreviewsResourceLoadingHintsTestAllowCSS
+    : public PreviewsResourceLoadingHintsTestBlockImages {
+ public:
+  PreviewsResourceLoadingHintsTestAllowCSS() = default;
+
+  void SetUp() override {
+    std::map<std::string, std::string> feature_parameters;
+    feature_parameters["block_resource_type_2"] = "false";
+
+    scoped_feature_list_.InitAndEnableFeatureWithParameters(
+        blink::features::kPreviewsResourceLoadingHintsSpecificResourceTypes,
+        feature_parameters);
+  }
+};
+
+TEST_F(PreviewsResourceLoadingHintsTestAllowCSS,
+       OnePatternWithResourceSubtype) {
+  std::vector<WTF::String> subresources_to_block;
+  subresources_to_block.push_back("foo.jpg");
+
+  PreviewsResourceLoadingHints* hints = PreviewsResourceLoadingHints::Create(
+      dummy_page_holder_->GetDocument(), ukm::UkmRecorder::GetNewSourceID(),
+      subresources_to_block);
+
+  const struct {
+    KURL url;
+    bool allow_load_expected;
+  } tests[] = {
+      {KURL("https://www.example.com/"), true},
+      {KURL("https://www.example.com/foo.js"), true},
+      {KURL("https://www.example.com/foo.jpg"), false},
+      {KURL("https://www.example.com/pages/foo.jpg"), false},
+      {KURL("https://www.example.com/foobar.jpg"), true},
+      {KURL("https://www.example.com/barfoo.jpg"), false},
+      {KURL("http://www.example.com/foo.jpg"), false},
+      {KURL("http://www.example.com/foo.jpg?q=alpha"), false},
+      {KURL("http://www.example.com/bar.jpg?q=foo.jpg"), true},
+      {KURL("http://www.example.com/bar.jpg?q=foo.jpg#foo.jpg"), true},
+  };
+
+  for (const auto& test : tests) {
+    // Feature override should cause resource blocking hints to apply to only
+    // scripts.
+    EXPECT_TRUE(hints->AllowLoad(ResourceType::kFont, test.url,
+                                 ResourceLoadPriority::kHighest));
+    EXPECT_TRUE(hints->AllowLoad(ResourceType::kImage, test.url,
+                                 ResourceLoadPriority::kHighest));
+    EXPECT_TRUE(hints->AllowLoad(ResourceType::kCSSStyleSheet, test.url,
+                                 ResourceLoadPriority::kHighest));
+    EXPECT_EQ(test.allow_load_expected,
+              hints->AllowLoad(ResourceType::kScript, test.url,
+                               ResourceLoadPriority::kHighest));
+  }
+}
+
 }  // namespace
 
 }  // namespace blink
diff --git a/chromium/third_party/blink/renderer/core/page/chrome_client.cc b/chromium/third_party/blink/renderer/core/page/chrome_client.cc
index fa1e5f91ffb..bfa0cd319f7 100644
--- a/chromium/third_party/blink/renderer/core/page/chrome_client.cc
+++ b/chromium/third_party/blink/renderer/core/page/chrome_client.cc
@@ -105,10 +105,14 @@ Page* ChromeClient::CreateWindow(
     NavigationPolicy navigation_policy,
     SandboxFlags sandbox_flags,
     const SessionStorageNamespaceId& session_storage_namespace_id) {
+// Popups during page unloading is a feature being put behind a policy and
+// needing an easily-mergeable change. See https://crbug.com/936080 .
+#if 0
   if (!CanOpenUIElementIfDuringPageDismissal(
           frame->Tree().Top(), UIElementType::kPopup, g_empty_string)) {
     return nullptr;
   }
+#endif
 
   return CreateWindowDelegate(frame, r, features, navigation_policy,
                               sandbox_flags, session_storage_namespace_id);
diff --git a/chromium/third_party/blink/renderer/core/page/scrolling/scroll_into_view_test.cc b/chromium/third_party/blink/renderer/core/page/scrolling/scroll_into_view_test.cc
index ab766f46f64..ab2162bbe33 100644
--- a/chromium/third_party/blink/renderer/core/page/scrolling/scroll_into_view_test.cc
+++ b/chromium/third_party/blink/renderer/core/page/scrolling/scroll_into_view_test.cc
@@ -10,11 +10,15 @@
 #include "third_party/blink/renderer/core/dom/element.h"
 #include "third_party/blink/renderer/core/frame/find_in_page.h"
 #include "third_party/blink/renderer/core/frame/local_dom_window.h"
+#include "third_party/blink/renderer/core/frame/root_frame_viewport.h"
 #include "third_party/blink/renderer/core/frame/scroll_into_view_options.h"
 #include "third_party/blink/renderer/core/frame/scroll_to_options.h"
 #include "third_party/blink/renderer/core/frame/web_local_frame_impl.h"
 #include "third_party/blink/renderer/core/html/html_element.h"
+#include "third_party/blink/renderer/core/layout/layout_box.h"
 #include "third_party/blink/renderer/core/layout/layout_object.h"
+#include "third_party/blink/renderer/core/page/scrolling/top_document_root_scroller_controller.h"
+#include "third_party/blink/renderer/core/paint/paint_layer_scrollable_area.h"
 #include "third_party/blink/renderer/core/testing/sim/sim_compositor.h"
 #include "third_party/blink/renderer/core/testing/sim/sim_request.h"
 #include "third_party/blink/renderer/core/testing/sim/sim_test.h"
@@ -528,6 +532,83 @@ TEST_F(ScrollIntoViewTest, ApplyRootElementScrollBehaviorToViewport) {
   ASSERT_EQ(Window().scrollY(), content->OffsetTop());
 }
 
+// This test ensures the stop-at-layout viewport option works correctly when a
+// non-default root scroller is set as the layout viewport.
+TEST_F(ScrollIntoViewTest, StopAtLayoutViewportOption) {
+  v8::HandleScope HandleScope(v8::Isolate::GetCurrent());
+  WebView().MainFrameWidget()->Resize(WebSize(800, 600));
+  SimRequest request("https://example.com/test.html", "text/html");
+  LoadURL("https://example.com/test.html");
+  request.Complete(R"HTML(
+    <!DOCTYPE html>
+    <style>
+      body,html {
+        margin: 0;
+        width: 100%;
+        height: 100%;
+      }
+      #root {
+        width: 100%;
+        height: 100%;
+        overflow: auto;
+      }
+      #inner {
+        width: 100%;
+        height: 100%;
+        overflow: auto;
+        margin-top: 1000px;
+      }
+      #target {
+        margin-top: 1000px;
+        margin-bottom: 1000px;
+        width: 100px;
+        height: 100px;
+      }
+    </style>
+    <div id='root'>
+      <div id='inner'>
+        <div id='target'></div>
+      <div>
+    </div>
+  )HTML");
+
+  Compositor().BeginFrame();
+
+  Element* root = GetDocument().getElementById("root");
+  Element* inner = GetDocument().getElementById("inner");
+
+  // Make sure the root scroller is set since that's what we're trying to test
+  // here.
+  {
+    TopDocumentRootScrollerController& rs_controller =
+        GetDocument().GetPage()->GlobalRootScrollerController();
+    ASSERT_EQ(root, rs_controller.GlobalRootScroller());
+  }
+
+  // Use ScrollRectToVisible on the #target element, specifying
+  // stop_at_main_frame_layout_viewport.
+  LayoutObject* target =
+      GetDocument().getElementById("target")->GetLayoutObject();
+  WebScrollIntoViewParams params(
+      ScrollAlignment::kAlignLeftAlways, ScrollAlignment::kAlignTopAlways,
+      kProgrammaticScroll, false, kScrollBehaviorInstant);
+  params.stop_at_main_frame_layout_viewport = true;
+  target->ScrollRectToVisible(LayoutRect(target->AbsoluteBoundingBoxRect()),
+                              params);
+
+  ScrollableArea* root_scroller =
+      ToLayoutBox(root->GetLayoutObject())->GetScrollableArea();
+  ScrollableArea* inner_scroller =
+      ToLayoutBox(inner->GetLayoutObject())->GetScrollableArea();
+
+  // Only the inner scroller should have scrolled. The root_scroller shouldn't
+  // scroll because it is the layout viewport.
+  ASSERT_EQ(root_scroller,
+            &GetDocument().View()->GetRootFrameViewport()->LayoutViewport());
+  EXPECT_EQ(ScrollOffset(), root_scroller->GetScrollOffset());
+  EXPECT_EQ(ScrollOffset(0, 1000), inner_scroller->GetScrollOffset());
+}
+
 // This test passes if it doesn't crash/hit an ASAN check.
 TEST_F(ScrollIntoViewTest, RemoveSequencedScrollableArea) {
   v8::HandleScope HandleScope(v8::Isolate::GetCurrent());
diff --git a/chromium/third_party/blink/renderer/core/trustedtypes/trusted_type_policy.h b/chromium/third_party/blink/renderer/core/trustedtypes/trusted_type_policy.h
index fcbbf061270..6f39524b7fe 100644
--- a/chromium/third_party/blink/renderer/core/trustedtypes/trusted_type_policy.h
+++ b/chromium/third_party/blink/renderer/core/trustedtypes/trusted_type_policy.h
@@ -56,7 +56,7 @@ class CORE_EXPORT TrustedTypePolicy final : public ScriptWrappable {
 
  private:
   String name_;
-  Member<TrustedTypePolicyOptions> policy_options_;
+  TraceWrapperMember<TrustedTypePolicyOptions> policy_options_;
 };
 
 }  // namespace blink
diff --git a/chromium/third_party/blink/renderer/core/trustedtypes/trusted_type_policy_factory.h b/chromium/third_party/blink/renderer/core/trustedtypes/trusted_type_policy_factory.h
index c103e7d062a..b36807b368e 100644
--- a/chromium/third_party/blink/renderer/core/trustedtypes/trusted_type_policy_factory.h
+++ b/chromium/third_party/blink/renderer/core/trustedtypes/trusted_type_policy_factory.h
@@ -57,7 +57,7 @@ class CORE_EXPORT TrustedTypePolicyFactory final : public ScriptWrappable,
   const WrapperTypeInfo* GetWrapperTypeInfoFromScriptValue(ScriptState*,
                                                            const ScriptValue&);
 
-  HeapHashMap<String, Member<TrustedTypePolicy>> policy_map_;
+  HeapHashMap<String, TraceWrapperMember<TrustedTypePolicy>> policy_map_;
 
   bool hadAssignmentError = false;
 };
diff --git a/chromium/third_party/blink/renderer/devtools/front_end/devtools_compatibility.js b/chromium/third_party/blink/renderer/devtools/front_end/devtools_compatibility.js
index 010108b9903..31901d0dd9d 100644
--- a/chromium/third_party/blink/renderer/devtools/front_end/devtools_compatibility.js
+++ b/chromium/third_party/blink/renderer/devtools/front_end/devtools_compatibility.js
@@ -1373,7 +1373,7 @@
    */
   function getRemoteMajorVersion() {
     try {
-      const remoteVersion = new URLSearchParams(window.location.href).get('remoteVersion');
+      const remoteVersion = new URLSearchParams(window.location.search).get('remoteVersion');
       if (!remoteVersion)
         return null;
       const majorVersion = parseInt(remoteVersion.split('.')[0], 10);
diff --git a/chromium/third_party/blink/renderer/devtools/front_end/elements/DOMLinkifier.js b/chromium/third_party/blink/renderer/devtools/front_end/elements/DOMLinkifier.js
index c62906af703..ee9fd7c7181 100644
--- a/chromium/third_party/blink/renderer/devtools/front_end/elements/DOMLinkifier.js
+++ b/chromium/third_party/blink/renderer/devtools/front_end/elements/DOMLinkifier.js
@@ -89,7 +89,7 @@ Elements.DOMLinkifier.linkifyDeferredNodeReference = function(deferredNode) {
   const root = createElement('div');
   const shadowRoot = UI.createShadowRootWithCoreStyles(root, 'elements/domLinkifier.css');
   const link = shadowRoot.createChild('div', 'node-link');
-  link.createChild('content');
+  link.createChild('slot');
   link.addEventListener('click', deferredNode.resolve.bind(deferredNode, onDeferredNodeResolved), false);
   link.addEventListener('mousedown', e => e.consume(), false);
 
diff --git a/chromium/third_party/blink/renderer/devtools/front_end/elements/ElementsTreeOutline.js b/chromium/third_party/blink/renderer/devtools/front_end/elements/ElementsTreeOutline.js
index 215f897f63d..ac9405c1b4a 100644
--- a/chromium/third_party/blink/renderer/devtools/front_end/elements/ElementsTreeOutline.js
+++ b/chromium/third_party/blink/renderer/devtools/front_end/elements/ElementsTreeOutline.js
@@ -563,7 +563,6 @@ Elements.ElementsTreeOutline = class extends UI.TreeOutline {
       return;
 
     element.select();
-    event.consume(true);
   }
 
   /**
diff --git a/chromium/third_party/blink/renderer/devtools/front_end/network/RequestHTMLView.js b/chromium/third_party/blink/renderer/devtools/front_end/network/RequestHTMLView.js
index e2b85ba9af8..b0fa4033d67 100644
--- a/chromium/third_party/blink/renderer/devtools/front_end/network/RequestHTMLView.js
+++ b/chromium/third_party/blink/renderer/devtools/front_end/network/RequestHTMLView.js
@@ -38,7 +38,7 @@ Network.RequestHTMLView = class extends UI.VBox {
   constructor(dataURL) {
     super(true);
     this.registerRequiredCSS('network/requestHTMLView.css');
-    this._dataURL = dataURL;
+    this._dataURL = encodeURI(dataURL).replace(/#/g, '%23');
     this.contentElement.classList.add('html', 'request-view');
   }
 
@@ -63,7 +63,7 @@ Network.RequestHTMLView = class extends UI.VBox {
     const iframe = createElement('iframe');
     iframe.className = 'html-preview-frame';
     iframe.setAttribute('sandbox', '');  // Forbid to run JavaScript and set unique origin.
-    iframe.setAttribute('src', encodeURI(this._dataURL));
+    iframe.setAttribute('src', this._dataURL);
     iframe.setAttribute('tabIndex', -1);
     this.contentElement.appendChild(iframe);
   }
diff --git a/chromium/third_party/blink/renderer/devtools/front_end/ui/TextPrompt.js b/chromium/third_party/blink/renderer/devtools/front_end/ui/TextPrompt.js
index 9aeaf150395..f0ecc9cbfa6 100644
--- a/chromium/third_party/blink/renderer/devtools/front_end/ui/TextPrompt.js
+++ b/chromium/third_party/blink/renderer/devtools/front_end/ui/TextPrompt.js
@@ -415,7 +415,7 @@ UI.TextPrompt = class extends Common.Object {
 
     const expressionRange = wordQueryRange.cloneRange();
     expressionRange.collapse(true);
-    expressionRange.setStartBefore(this._proxyElement);
+    expressionRange.setStartBefore(this._element);
     const completionRequestId = ++this._completionRequestId;
     const completions = await this._loadCompletions(expressionRange.toString(), wordQueryRange.toString(), !!force);
     this._completionsReady(completionRequestId, selection, wordQueryRange, !!force, completions);
diff --git a/chromium/third_party/blink/renderer/devtools/front_end/ui/View.js b/chromium/third_party/blink/renderer/devtools/front_end/ui/View.js
index 0cf76eef38e..ca8234177dd 100644
--- a/chromium/third_party/blink/renderer/devtools/front_end/ui/View.js
+++ b/chromium/third_party/blink/renderer/devtools/front_end/ui/View.js
@@ -632,8 +632,7 @@ UI.ViewManager._TabbedLocation = class extends UI.ViewManager._Location {
     this._tabbedPane.addEventListener(UI.TabbedPane.Events.TabClosed, this._tabClosed, this);
     this._closeableTabSetting = Common.settings.createSetting(location + '-closeableTabs', {});
     this._tabOrderSetting = Common.settings.createSetting(location + '-tabOrder', {});
-    this._tabbedPane.addEventListener(
-        UI.TabbedPane.Events.TabOrderChanged, event => this._persistTabOrder(event.data['tabId']));
+    this._tabbedPane.addEventListener(UI.TabbedPane.Events.TabOrderChanged, this._persistTabOrder, this);
     if (restoreSelection)
       this._lastSelectedTabSetting = Common.settings.createSetting(location + '-selectedTab', '');
     this._defaultTab = defaultTab;
@@ -766,7 +765,7 @@ UI.ViewManager._TabbedLocation = class extends UI.ViewManager._Location {
         this._closeableTabSetting.set(tabs);
       }
     }
-    this._persistTabOrder(view.viewId());
+    this._persistTabOrder();
   }
 
   /**
@@ -822,20 +821,23 @@ UI.ViewManager._TabbedLocation = class extends UI.ViewManager._Location {
     this._views.get(id).disposeView();
   }
 
-  /**
-   * @param {string} tabId
-   */
-  _persistTabOrder(tabId) {
+  _persistTabOrder() {
     const tabIds = this._tabbedPane.tabIds();
-    const previousId = tabIds[tabIds.indexOf(tabId) - 1];
-    const orders = this._tabOrderSetting.get();
-    orders[tabId] = previousId && orders[previousId] ? orders[previousId] + 1 : 0;
-    const keys = Object.keys(orders);
-    keys.sort((a, b) => orders[a] - orders[b]);
-
     const tabOrders = {};
-    for (let i = 0; i < keys.length; i++)
-      tabOrders[keys[i]] = (i + 1) * UI.ViewManager._TabbedLocation.orderStep;
+    for (let i = 0; i < tabIds.length; i++)
+      tabOrders[tabIds[i]] = (i + 1) * UI.ViewManager._TabbedLocation.orderStep;
+
+    const oldTabOrder = this._tabOrderSetting.get();
+    const oldTabArray = Object.keys(oldTabOrder);
+    oldTabArray.sort((a, b) => oldTabOrder[a] - oldTabOrder[b]);
+    let lastOrder = 0;
+    for (const key of oldTabArray) {
+      if (key in tabOrders) {
+        lastOrder = tabOrders[key];
+        continue;
+      }
+      tabOrders[key] = ++lastOrder;
+    }
     this._tabOrderSetting.set(tabOrders);
   }
 };
diff --git a/chromium/third_party/blink/renderer/modules/shapedetection/barcode_detector.idl b/chromium/third_party/blink/renderer/modules/shapedetection/barcode_detector.idl
index 0d89b5bf68c..47ac42c3247 100644
--- a/chromium/third_party/blink/renderer/modules/shapedetection/barcode_detector.idl
+++ b/chromium/third_party/blink/renderer/modules/shapedetection/barcode_detector.idl
@@ -9,7 +9,7 @@
     ConstructorCallWith=ExecutionContext,
     Exposed=(Window,Worker),
     MeasureAs=ShapeDetection_BarcodeDetectorConstructor,
-    OriginTrialEnabled=ShapeDetection
+    RuntimeEnabled=ShapeDetection
 ] interface BarcodeDetector {
     [CallWith=ScriptState, MeasureAs=ShapeDetectionAPI] Promise<sequence<DetectedBarcode>> detect(ImageBitmapSource image);
 };
diff --git a/chromium/third_party/blink/renderer/modules/shapedetection/detected_barcode.idl b/chromium/third_party/blink/renderer/modules/shapedetection/detected_barcode.idl
index e9ac10817c8..12682c87744 100644
--- a/chromium/third_party/blink/renderer/modules/shapedetection/detected_barcode.idl
+++ b/chromium/third_party/blink/renderer/modules/shapedetection/detected_barcode.idl
@@ -7,7 +7,7 @@
 [
     Constructor,
     Serializable,
-    OriginTrialEnabled=ShapeDetection
+    RuntimeEnabled=ShapeDetection
 ] interface DetectedBarcode {
     // TODO(mcasas): Implement missing fields. https://crbug.com/646083
     [SameObject] readonly attribute DOMString rawValue;
diff --git a/chromium/third_party/blink/renderer/modules/shapedetection/detected_face.idl b/chromium/third_party/blink/renderer/modules/shapedetection/detected_face.idl
index d7f7985dd85..c4b2559051b 100644
--- a/chromium/third_party/blink/renderer/modules/shapedetection/detected_face.idl
+++ b/chromium/third_party/blink/renderer/modules/shapedetection/detected_face.idl
@@ -7,7 +7,7 @@
 [
     Constructor,
     Serializable,
-    OriginTrialEnabled=ShapeDetection
+    RuntimeEnabled=ShapeDetection
 ] interface DetectedFace {
     // TODO(xianglu): Implement any other fields. https://crbug.com/646083
     [SameObject] readonly attribute DOMRectReadOnly boundingBox;
diff --git a/chromium/third_party/blink/renderer/modules/shapedetection/detected_text.idl b/chromium/third_party/blink/renderer/modules/shapedetection/detected_text.idl
index b549c86666d..dcbc270ad3d 100644
--- a/chromium/third_party/blink/renderer/modules/shapedetection/detected_text.idl
+++ b/chromium/third_party/blink/renderer/modules/shapedetection/detected_text.idl
@@ -7,7 +7,7 @@
 [
     Constructor,
     Serializable,
-    OriginTrialEnabled=ShapeDetection
+    RuntimeEnabled=ShapeDetection
 ] interface DetectedText {
     [SameObject] readonly attribute DOMString rawValue;
     [SameObject] readonly attribute DOMRectReadOnly boundingBox;
diff --git a/chromium/third_party/blink/renderer/modules/shapedetection/face_detector.idl b/chromium/third_party/blink/renderer/modules/shapedetection/face_detector.idl
index 32218dff569..7b943fdb492 100644
--- a/chromium/third_party/blink/renderer/modules/shapedetection/face_detector.idl
+++ b/chromium/third_party/blink/renderer/modules/shapedetection/face_detector.idl
@@ -9,7 +9,7 @@
     ConstructorCallWith=ExecutionContext,
     Exposed=(Window,Worker),
     MeasureAs=ShapeDetection_FaceDetectorConstructor,
-    OriginTrialEnabled=ShapeDetection
+    RuntimeEnabled=ShapeDetection
 ] interface FaceDetector {
     [CallWith=ScriptState, MeasureAs=ShapeDetectionAPI] Promise<sequence<DetectedFace>> detect(ImageBitmapSource image);
 };
diff --git a/chromium/third_party/blink/renderer/modules/shapedetection/text_detector.idl b/chromium/third_party/blink/renderer/modules/shapedetection/text_detector.idl
index 0c7000514e6..e24bf9acd1a 100644
--- a/chromium/third_party/blink/renderer/modules/shapedetection/text_detector.idl
+++ b/chromium/third_party/blink/renderer/modules/shapedetection/text_detector.idl
@@ -9,7 +9,7 @@
     ConstructorCallWith=ExecutionContext,
     Exposed=(Window,Worker),
     MeasureAs=ShapeDetection_TextDetectorConstructor,
-    OriginTrialEnabled=ShapeDetection
+    RuntimeEnabled=ShapeDetection
 ] interface TextDetector {
     [CallWith=ScriptState, MeasureAs=ShapeDetectionAPI] Promise<sequence<DetectedText>> detect(ImageBitmapSource image);
 };
diff --git a/chromium/third_party/blink/renderer/platform/fonts/skia/skia_text_metrics.cc b/chromium/third_party/blink/renderer/platform/fonts/skia/skia_text_metrics.cc
index 73a48b721be..8e0ab9f3e51 100644
--- a/chromium/third_party/blink/renderer/platform/fonts/skia/skia_text_metrics.cc
+++ b/chromium/third_party/blink/renderer/platform/fonts/skia/skia_text_metrics.cc
@@ -116,6 +116,12 @@ void SkFontGetBoundsForGlyph(const SkFont& font, Glyph glyph, SkRect* bounds) {
   SkPath path;
   font.getPath(glyph, &path);
   *bounds = path.getBounds();
+  // For Apple Color Emoji path bounds are returning empty rectangles, see
+  // https://bugs.chromium.org/p/skia/issues/detail?id=8779
+  // OpenTypeVerticalData::GetVerticalTranslationsForGlyphs needs a non-empty
+  // rectangle for vertical origin computation, hence fall back to bounds here.
+  if (UNLIKELY(bounds->isEmpty()))
+    font.getWidths(&glyph, 1, nullptr, bounds);
 #else
   font.getWidths(&glyph, 1, nullptr, bounds);
 #endif
diff --git a/chromium/third_party/blink/renderer/platform/heap/heap_compact.cc b/chromium/third_party/blink/renderer/platform/heap/heap_compact.cc
index 055f2dc71ba..e0934160dac 100644
--- a/chromium/third_party/blink/renderer/platform/heap/heap_compact.cc
+++ b/chromium/third_party/blink/renderer/platform/heap/heap_compact.cc
@@ -383,11 +383,13 @@ bool HeapCompact::ShouldCompact(ThreadHeap* heap,
 
   if (reason != BlinkGC::GCReason::kIdleGC &&
       reason != BlinkGC::GCReason::kPreciseGC &&
-      reason != BlinkGC::GCReason::kIncrementalIdleGC &&
-      reason != BlinkGC::GCReason::kIncrementalV8FollowupGC &&
       reason != BlinkGC::GCReason::kForcedGC)
     return false;
 
+  // TODO(keishi): crbug.com/918064 Heap compaction for incremental marking
+  // needs to be disabled until this crash is fixed.
+  CHECK_NE(marking_type, BlinkGC::kIncrementalMarking);
+
   // Compaction enable rules:
   //  - It's been a while since the last time.
   //  - "Considerable" amount of heap memory is bound up in freelist
diff --git a/chromium/third_party/blink/renderer/platform/loader/fetch/resource.h b/chromium/third_party/blink/renderer/platform/loader/fetch/resource.h
index ac52ace54cd..5a19bdf3329 100644
--- a/chromium/third_party/blink/renderer/platform/loader/fetch/resource.h
+++ b/chromium/third_party/blink/renderer/platform/loader/fetch/resource.h
@@ -84,7 +84,8 @@ enum class ResourceType : uint8_t {
   kAudio,
   kVideo,
   kManifest,
-  kMock  // Only for testing
+  kMock,  // Only for testing
+  kLast = kMock
 };
 
 // A resource that is held in the cache. Classes who want to use this object
diff --git a/chromium/third_party/blink/renderer/platform/runtime_enabled_features.json5 b/chromium/third_party/blink/renderer/platform/runtime_enabled_features.json5
index 8f577c5c879..9771c74c96f 100644
--- a/chromium/third_party/blink/renderer/platform/runtime_enabled_features.json5
+++ b/chromium/third_party/blink/renderer/platform/runtime_enabled_features.json5
@@ -1230,7 +1230,6 @@
     },
     {
       name: "ShapeDetection",
-      origin_trial_feature_name: "ShapeDetection",
       status: "experimental",
     },
     {