BASELINE: Update Chromium to 92.0.4515.166

Change-Id: I42a050486714e9e54fc271f2a8939223a02ae364

15 files changed, 164 insertions, 84 deletions

diff --git a/chromium/weblayer/browser/java/org/chromium/weblayer_private/BrowserViewController.java b/chromium/weblayer/browser/java/org/chromium/weblayer_private/BrowserViewController.java
index fdf1d72db14..ba9898332d9 100644
--- a/chromium/weblayer/browser/java/org/chromium/weblayer_private/BrowserViewController.java
+++ b/chromium/weblayer/browser/java/org/chromium/weblayer_private/BrowserViewController.java
@@ -17,20 +17,29 @@ import android.widget.RelativeLayout;
 
 import androidx.annotation.Nullable;
 
+import org.chromium.base.ContextUtils;
 import org.chromium.base.annotations.JNINamespace;
 import org.chromium.cc.input.BrowserControlsState;
+import org.chromium.components.browser_ui.bottomsheet.BottomSheetControllerFactory;
+import org.chromium.components.browser_ui.bottomsheet.BottomSheetObserver;
+import org.chromium.components.browser_ui.bottomsheet.EmptyBottomSheetObserver;
+import org.chromium.components.browser_ui.bottomsheet.ManagedBottomSheetController;
 import org.chromium.components.browser_ui.modaldialog.AppModalPresenter;
 import org.chromium.components.browser_ui.widget.InsetObserverView;
+import org.chromium.components.browser_ui.widget.scrim.ScrimCoordinator;
+import org.chromium.components.browser_ui.widget.scrim.ScrimCoordinator.SystemUiScrimDelegate;
 import org.chromium.components.content_capture.ContentCaptureConsumer;
 import org.chromium.components.content_capture.OnscreenContentProvider;
 import org.chromium.components.embedder_support.view.ContentView;
 import org.chromium.content_public.browser.WebContents;
+import org.chromium.ui.KeyboardVisibilityDelegate;
 import org.chromium.ui.modaldialog.DialogDismissalCause;
 import org.chromium.ui.modaldialog.ModalDialogManager;
 import org.chromium.ui.modaldialog.ModalDialogManager.ModalDialogType;
 import org.chromium.ui.modaldialog.ModalDialogProperties;
 import org.chromium.ui.modaldialog.SimpleModalDialogController;
 import org.chromium.ui.modelutil.PropertyModel;
+import org.chromium.ui.util.TokenHolder;
 import org.chromium.weblayer_private.interfaces.BrowserEmbeddabilityMode;
 
 /**
@@ -70,6 +79,12 @@ public final class BrowserViewController
     private final View.OnAttachStateChangeListener mOnAttachedStateChangeListener;
     private final ModalDialogManager mModalDialogManager;
 
+    private final ScrimCoordinator mScrim;
+
+    private final ViewGroup mBottomSheetContainer;
+    private final ManagedBottomSheetController mBottomSheetController;
+    private final BottomSheetObserver mBottomSheetObserver;
+
     private TabImpl mTab;
 
     private WebContentsGestureStateTracker mGestureStateTracker;
@@ -134,9 +149,75 @@ public final class BrowserViewController
         mModalDialogManager.registerPresenter(
                 new WebLayerTabModalPresenter(this, context), ModalDialogType.TAB);
         mWindowAndroid.setModalDialogManager(mModalDialogManager);
+
+        SystemUiScrimDelegate systemUiDelegate = new SystemUiScrimDelegate() {
+            @Override
+            public void setStatusBarScrimFraction(float scrimFraction) {
+                // TODO(mdjones): Support status bar tinting if it is needed by WebLayer.
+            }
+
+            @Override
+            public void setNavigationBarScrimFraction(float scrimFraction) {}
+        };
+        mScrim = new ScrimCoordinator(context, systemUiDelegate, mContentViewRenderView,
+                context.getResources().getColor(R.color.default_scrim_color));
+        mBottomSheetContainer = new FrameLayout(context);
+        mBottomSheetContainer.setLayoutParams(
+                new LayoutParams(LayoutParams.MATCH_PARENT, LayoutParams.MATCH_PARENT));
+        mBottomSheetContainer.setClipChildren(false);
+        mBottomSheetContainer.addOnLayoutChangeListener(new View.OnLayoutChangeListener() {
+            @Override
+            public void onLayoutChange(View view, int left, int top, int right, int bottom,
+                    int oldLeft, int oldTop, int oldRight, int oldBottom) {
+                // Allow the sheet container to layout once before hiding it until it is used.
+                mBottomSheetContainer.setVisibility(View.GONE);
+                mBottomSheetContainer.removeOnLayoutChangeListener(this);
+            }
+        });
+        mContentViewRenderView.addView(mBottomSheetContainer);
+
+        mBottomSheetController = BottomSheetControllerFactory.createBottomSheetController(
+                () -> mScrim, (v) -> {}, ContextUtils.activityFromContext(context).getWindow(),
+                KeyboardVisibilityDelegate.getInstance(), () -> mBottomSheetContainer);
+        BottomSheetControllerFactory.attach(mWindowAndroid, mBottomSheetController);
+
+        mBottomSheetObserver = new EmptyBottomSheetObserver() {
+            /** A token for suppressing app modal dialogs. */
+            private int mAppModalToken = TokenHolder.INVALID_TOKEN;
+
+            /** A token for suppressing tab modal dialogs. */
+            private int mTabModalToken = TokenHolder.INVALID_TOKEN;
+
+            @Override
+            public void onSheetOpened(int reason) {
+                assert mAppModalToken == TokenHolder.INVALID_TOKEN;
+                assert mTabModalToken == TokenHolder.INVALID_TOKEN;
+                mAppModalToken =
+                        mModalDialogManager.suspendType(ModalDialogManager.ModalDialogType.APP);
+                mTabModalToken =
+                        mModalDialogManager.suspendType(ModalDialogManager.ModalDialogType.TAB);
+            }
+
+            @Override
+            public void onSheetClosed(int reason) {
+                if (mAppModalToken != TokenHolder.INVALID_TOKEN
+                        || mTabModalToken != TokenHolder.INVALID_TOKEN) {
+                    // If one modal dialog token is set, the other should be as well.
+                    assert mAppModalToken != TokenHolder.INVALID_TOKEN
+                            && mTabModalToken != TokenHolder.INVALID_TOKEN;
+                    mModalDialogManager.resumeType(
+                            ModalDialogManager.ModalDialogType.APP, mAppModalToken);
+                    mModalDialogManager.resumeType(
+                            ModalDialogManager.ModalDialogType.TAB, mTabModalToken);
+                }
+            }
+        };
+        mBottomSheetController.addObserver(mBottomSheetObserver);
     }
 
     public void destroy() {
+        BottomSheetControllerFactory.detach(mBottomSheetController);
+        mBottomSheetController.removeObserver(mBottomSheetObserver);
         mWindowAndroid.setModalDialogManager(null);
         setActiveTab(null);
         if (mOnscreenContentProvider != null) mOnscreenContentProvider.destroy();
diff --git a/chromium/weblayer/browser/java/org/chromium/weblayer_private/ExternalNavigationDelegateImpl.java b/chromium/weblayer/browser/java/org/chromium/weblayer_private/ExternalNavigationDelegateImpl.java
index 2b16bfafc8a..77403ce02e3 100644
--- a/chromium/weblayer/browser/java/org/chromium/weblayer_private/ExternalNavigationDelegateImpl.java
+++ b/chromium/weblayer/browser/java/org/chromium/weblayer_private/ExternalNavigationDelegateImpl.java
@@ -15,11 +15,11 @@ import org.chromium.base.PackageManagerUtils;
 import org.chromium.components.embedder_support.util.UrlUtilities;
 import org.chromium.components.external_intents.ExternalNavigationDelegate;
 import org.chromium.components.external_intents.ExternalNavigationDelegate.StartActivityIfNeededResult;
-import org.chromium.components.external_intents.ExternalNavigationHandler.OverrideUrlLoadingResult;
 import org.chromium.components.external_intents.ExternalNavigationParams;
 import org.chromium.content_public.browser.LoadUrlParams;
 import org.chromium.content_public.browser.WebContents;
 import org.chromium.ui.base.WindowAndroid;
+import org.chromium.url.GURL;
 import org.chromium.url.Origin;
 
 /**
@@ -49,7 +49,7 @@ public class ExternalNavigationDelegateImpl implements ExternalNavigationDelegat
     }
 
     @Override
-    public boolean shouldDisableExternalIntentRequestsForUrl(String url) {
+    public boolean shouldDisableExternalIntentRequestsForUrl(GURL url) {
         return false;
     }
 
@@ -88,14 +88,6 @@ public class ExternalNavigationDelegateImpl implements ExternalNavigationDelegat
         return StartActivityIfNeededResult.DID_NOT_HANDLE;
     }
 
-    // This method should never be invoked as WebLayer does not handle incoming intents.
-    @Override
-    public OverrideUrlLoadingResult handleIncognitoIntentTargetingSelf(
-            final Intent intent, final String referrerUrl, final String fallbackUrl) {
-        assert false;
-        return OverrideUrlLoadingResult.forNoOverride();
-    }
-
     @Override
     public void loadUrlIfPossible(LoadUrlParams loadUrlParams) {
         if (!hasValidTab()) return;
@@ -111,23 +103,6 @@ public class ExternalNavigationDelegateImpl implements ExternalNavigationDelegat
     public void maybeSetWindowId(Intent intent) {}
 
     @Override
-    public boolean supportsCreatingNewTabs() {
-        // In WebLayer all URLs that ExternalNavigationHandler loads internally are loaded within
-        // the current tab; this flow is sufficient for WebLayer from a UX POV, and there is no
-        // reason to add the complexity of a flow to create new tabs here. In particular, in Chrome
-        // that new tab creation is done by launching an activity targeted at the Chrome package.
-        // This would not work for WebLayer as the embedder does not in general handle incoming
-        // browsing intents.
-        return false;
-    }
-
-    @Override
-    public void loadUrlInNewTab(final String url, final boolean launchIncognito) {
-        // Should never be invoked based on the implementation of supportsCreatingNewTabs().
-        assert false;
-    }
-
-    @Override
     public boolean canLoadUrlInCurrentTab() {
         return true;
     }
@@ -154,7 +129,7 @@ public class ExternalNavigationDelegateImpl implements ExternalNavigationDelegat
     @Override
     // This is relevant only if the intent ends up being handled by this app, which does not happen
     // for WebLayer.
-    public void maybeSetPendingReferrer(Intent intent, String referrerUrl) {}
+    public void maybeSetPendingReferrer(Intent intent, GURL referrerUrl) {}
 
     @Override
     // This is relevant only if the intent ends up being handled by this app, which does not happen
@@ -163,7 +138,7 @@ public class ExternalNavigationDelegateImpl implements ExternalNavigationDelegat
 
     @Override
     public boolean maybeLaunchInstantApp(
-            String url, String referrerUrl, boolean isIncomingRedirect, boolean isSerpReferrer) {
+            GURL url, GURL referrerUrl, boolean isIncomingRedirect, boolean isSerpReferrer) {
         return false;
     }
 
@@ -212,7 +187,7 @@ public class ExternalNavigationDelegateImpl implements ExternalNavigationDelegat
 
     @Override
     public boolean handleWithAutofillAssistant(ExternalNavigationParams params, Intent targetIntent,
-            String browserFallbackUrl, boolean isGoogleReferrer) {
+            GURL browserFallbackUrl, boolean isGoogleReferrer) {
         return false;
     }
 
diff --git a/chromium/weblayer/browser/java/org/chromium/weblayer_private/FragmentHostingRemoteFragmentImpl.java b/chromium/weblayer/browser/java/org/chromium/weblayer_private/FragmentHostingRemoteFragmentImpl.java
index ea42dacbc59..13f836ffae0 100644
--- a/chromium/weblayer/browser/java/org/chromium/weblayer_private/FragmentHostingRemoteFragmentImpl.java
+++ b/chromium/weblayer/browser/java/org/chromium/weblayer_private/FragmentHostingRemoteFragmentImpl.java
@@ -197,7 +197,7 @@ public abstract class FragmentHostingRemoteFragmentImpl extends RemoteFragmentIm
         super.onDetach();
         mContext = null;
 
-        // If the Fragment is retained, onDestory won't be called during configuration changes. We
+        // If the Fragment is retained, onDestroy won't be called during configuration changes. We
         // have to create a new FragmentController that's attached to the correct Context when
         // reattaching this Fragment, so destroy the existing one here.
         if (!mFragmentController.getSupportFragmentManager().isDestroyed()) {
diff --git a/chromium/weblayer/browser/java/org/chromium/weblayer_private/NavigationImpl.java b/chromium/weblayer/browser/java/org/chromium/weblayer_private/NavigationImpl.java
index 7c445011691..57e40303e0c 100644
--- a/chromium/weblayer/browser/java/org/chromium/weblayer_private/NavigationImpl.java
+++ b/chromium/weblayer/browser/java/org/chromium/weblayer_private/NavigationImpl.java
@@ -50,7 +50,6 @@ public final class NavigationImpl extends INavigation.Stub {
         } catch (RemoteException e) {
             throw new APICallException(e);
         }
-        NavigationImplJni.get().setJavaNavigation(mNativeNavigationImpl, NavigationImpl.this);
     }
 
     public IClientNavigation getClientNavigation() {
@@ -244,6 +243,13 @@ public final class NavigationImpl extends INavigation.Stub {
         return mPage.getClientPage();
     }
 
+    @Override
+    public int getNavigationEntryOffset() {
+        StrictModeWorkaround.apply();
+        throwIfNativeDestroyed();
+        return NavigationImplJni.get().getNavigationEntryOffset(mNativeNavigationImpl);
+    }
+
     public void setIntentLaunched() {
         mIntentLaunched = true;
     }
@@ -292,7 +298,6 @@ public final class NavigationImpl extends INavigation.Stub {
 
     @NativeMethods
     interface Natives {
-        void setJavaNavigation(long nativeNavigationImpl, NavigationImpl caller);
         int getState(long nativeNavigationImpl);
         String getUri(long nativeNavigationImpl);
         String[] getRedirectChain(long nativeNavigationImpl);
@@ -316,5 +321,6 @@ public final class NavigationImpl extends INavigation.Stub {
         boolean isFormSubmission(long nativeNavigationImpl);
         String getReferrer(long nativeNavigationImpl);
         long getPage(long nativeNavigationImpl);
+        int getNavigationEntryOffset(long nativeNavigationImpl);
     }
 }
diff --git a/chromium/weblayer/browser/java/org/chromium/weblayer_private/PageInfoControllerDelegateImpl.java b/chromium/weblayer/browser/java/org/chromium/weblayer_private/PageInfoControllerDelegateImpl.java
index 27268e9ec2b..5eb95aa6bd4 100644
--- a/chromium/weblayer/browser/java/org/chromium/weblayer_private/PageInfoControllerDelegateImpl.java
+++ b/chromium/weblayer/browser/java/org/chromium/weblayer_private/PageInfoControllerDelegateImpl.java
@@ -72,17 +72,6 @@ public class PageInfoControllerDelegateImpl extends PageInfoControllerDelegate {
         return mBrowser.getWindowAndroid().getModalDialogManager();
     }
 
-    /**
-     * {@inheritDoc}
-     */
-    @Override
-    public void showSiteSettings(String url) {
-        Intent intent = SettingsIntentHelper.createIntentForSiteSettingsSingleWebsite(
-                mContext, mProfile.getName(), mProfile.isIncognito(), url);
-
-        launchIntent(intent);
-    }
-
     @Override
     public void showCookieSettings() {
         String category = SiteSettingsCategory.preferenceKey(SiteSettingsCategory.Type.COOKIES);
@@ -138,9 +127,9 @@ public class PageInfoControllerDelegateImpl extends PageInfoControllerDelegate {
     }
 
     @Override
-    public void getFavicon(String url, Callback<Drawable> callback) {
+    public void getFavicon(GURL url, Callback<Drawable> callback) {
         mProfile.getCachedFaviconForPageUri(
-                url, ObjectWrapper.wrap((ValueCallback<Bitmap>) (bitmap) -> {
+                url.getSpec(), ObjectWrapper.wrap((ValueCallback<Bitmap>) (bitmap) -> {
                     if (bitmap != null) {
                         callback.onResult(new BitmapDrawable(mContext.getResources(), bitmap));
                     } else {
diff --git a/chromium/weblayer/browser/java/org/chromium/weblayer_private/README.md b/chromium/weblayer/browser/java/org/chromium/weblayer_private/README.md
index 35e0aedea89..3a262dfb4f1 100644
--- a/chromium/weblayer/browser/java/org/chromium/weblayer_private/README.md
+++ b/chromium/weblayer/browser/java/org/chromium/weblayer_private/README.md
@@ -21,7 +21,7 @@ context go to the WebView or WebLayer support APK and not the embedder's APK. Th
 is what's returned by [`BrowserImpl.getContext()`][link2]. Use this when referencing WebLayer specific
 resources. This is expected to be the most common use case.
 
-[link2]: https://source.chromium.org/chromium/chromium/src/+/master:weblayer/browser/java/org/chromium/weblayer_private/BrowserImpl.java?q=f:browserimpl%20getContext&ss=chromium%2Fchromium%2Fsrc
+[link2]: https://source.chromium.org/chromium/chromium/src/+/main:weblayer/browser/java/org/chromium/weblayer_private/BrowserImpl.java?q=f:browserimpl%20getContext&ss=chromium%2Fchromium%2Fsrc
 
 ## Embedder's Application Context
 
@@ -33,4 +33,4 @@ reference WebLayer-specific resources. This is what's returned by
 It shouldn't be downcast to Application (or any subclass thereof) since it's wrapped in a
 ContextWrapper.
 
-[link3]: https://source.chromium.org/chromium/chromium/src/+/master:base/android/java/src/org/chromium/base/ContextUtils.java?q=f:base%2FContextUtils%20getApplicationContext()&ss=chromium%2Fchromium%2Fsrc
+[link3]: https://source.chromium.org/chromium/chromium/src/+/main:base/android/java/src/org/chromium/base/ContextUtils.java?q=f:base%2FContextUtils%20getApplicationContext()&ss=chromium%2Fchromium%2Fsrc
diff --git a/chromium/weblayer/browser/java/org/chromium/weblayer_private/TabImpl.java b/chromium/weblayer/browser/java/org/chromium/weblayer_private/TabImpl.java
index 5b916fb81a8..96dc7886893 100644
--- a/chromium/weblayer/browser/java/org/chromium/weblayer_private/TabImpl.java
+++ b/chromium/weblayer/browser/java/org/chromium/weblayer_private/TabImpl.java
@@ -30,6 +30,7 @@ import org.chromium.base.Callback;
 import org.chromium.base.annotations.CalledByNative;
 import org.chromium.base.annotations.JNINamespace;
 import org.chromium.base.annotations.NativeMethods;
+import org.chromium.base.supplier.ObservableSupplier;
 import org.chromium.cc.input.BrowserControlsState;
 import org.chromium.components.autofill.AutofillActionModeCallback;
 import org.chromium.components.autofill.AutofillProvider;
@@ -358,8 +359,10 @@ public final class TabImpl extends ITab.Stub {
             if (mBrowser.getContext() == null) {
                 // The Context and ViewContainer in which Autofill was previously operating have
                 // gone away, so tear down |mAutofillProvider|.
-                mAutofillProvider = null;
-                TabImplJni.get().onAutofillProviderChanged(mNativeTab, null);
+                if (mAutofillProvider != null) {
+                    mAutofillProvider.destroy();
+                    mAutofillProvider = null;
+                }
                 selectionController.setNonSelectionActionModeCallback(null);
             } else {
                 if (mAutofillProvider == null) {
@@ -367,8 +370,9 @@ public final class TabImpl extends ITab.Stub {
                     // the context won't change unless it is first nulled out, since the fragment
                     // must be detached before it can be reattached to a new Context.
                     mAutofillProvider = new AutofillProvider(mBrowser.getContext(),
-                            mBrowser.getViewAndroidDelegateContainerView(), "WebLayer");
-                    TabImplJni.get().onAutofillProviderChanged(mNativeTab, mAutofillProvider);
+                            mBrowser.getViewAndroidDelegateContainerView(), mWebContents,
+                            "WebLayer");
+                    TabImplJni.get().initializeAutofillIfNecessary(mNativeTab);
                 }
                 mAutofillProvider.onContainerViewChanged(
                         mBrowser.getViewAndroidDelegateContainerView());
@@ -501,6 +505,11 @@ public final class TabImpl extends ITab.Stub {
         String url = loadUrlParams.getUrl();
         if (url == null || url.isEmpty()) return;
 
+        // TODO(https://crbug.com/783819): Don't fix up all URLs. Documentation on FixupURL
+        // explicitly says not to use it on URLs coming from untrustworthy sources, like other apps.
+        // Once migrations of Java code to GURL are complete and incoming URLs are converted to
+        // GURLs at their source, we can make decisions of whether or not to fix up GURLs on a
+        // case-by-case basis based on trustworthiness of the incoming URL.
         GURL fixedUrl = UrlFormatter.fixupUrl(url);
         if (!fixedUrl.isValid()) return;
 
@@ -1007,6 +1016,11 @@ public final class TabImpl extends ITab.Stub {
             mMediaSessionHelper = null;
         }
 
+        if (mAutofillProvider != null) {
+            mAutofillProvider.destroy();
+            mAutofillProvider = null;
+        }
+
         // Destroying FaviconCallbackProxy removes from mFaviconCallbackProxies. Copy to avoid
         // problems.
         Set<FaviconCallbackProxy> faviconCallbackProxies = mFaviconCallbackProxies;
@@ -1186,13 +1200,25 @@ public final class TabImpl extends ITab.Stub {
 
                     @Override
                     public InsetObserverView getInsetObserverView() {
-                        return mBrowser.getViewController().getInsetObserverView();
+                        BrowserViewController controller = mBrowser.getPossiblyNullViewController();
+                        return controller != null ? controller.getInsetObserverView() : null;
+                    }
+
+                    @Override
+                    public ObservableSupplier<Integer> getBrowserDisplayCutoutModeSupplier() {
+                        // No activity-wide display cutout mode override.
+                        return null;
                     }
 
                     @Override
                     public boolean isInteractable() {
                         return isVisible();
                     }
+
+                    @Override
+                    public boolean isInBrowserFullscreen() {
+                        return false;
+                    }
                 });
     }
 
@@ -1240,7 +1266,7 @@ public final class TabImpl extends ITab.Stub {
         void removeTabFromBrowserBeforeDestroying(long nativeTabImpl);
         void deleteTab(long tab);
         void setJavaImpl(long nativeTabImpl, TabImpl impl);
-        void onAutofillProviderChanged(long nativeTabImpl, AutofillProvider autofillProvider);
+        void initializeAutofillIfNecessary(long nativeTabImpl);
         void setBrowserControlsContainerViews(long nativeTabImpl,
                 long nativeTopBrowserControlsContainerView,
                 long nativeBottomBrowserControlsContainerView);
diff --git a/chromium/weblayer/browser/java/org/chromium/weblayer_private/UrlBarControllerImpl.java b/chromium/weblayer/browser/java/org/chromium/weblayer_private/UrlBarControllerImpl.java
index 2b1f112d1cb..aa2e0d09414 100644
--- a/chromium/weblayer/browser/java/org/chromium/weblayer_private/UrlBarControllerImpl.java
+++ b/chromium/weblayer/browser/java/org/chromium/weblayer_private/UrlBarControllerImpl.java
@@ -28,13 +28,10 @@ import androidx.core.widget.ImageViewCompat;
 import org.chromium.base.LifetimeAssert;
 import org.chromium.base.annotations.JNINamespace;
 import org.chromium.base.annotations.NativeMethods;
-import org.chromium.components.content_settings.ContentSettingsType;
-import org.chromium.components.embedder_support.util.Origin;
 import org.chromium.components.embedder_support.util.UrlUtilities;
 import org.chromium.components.omnibox.SecurityButtonAnimationDelegate;
 import org.chromium.components.omnibox.SecurityStatusIcon;
 import org.chromium.components.page_info.PageInfoController;
-import org.chromium.components.page_info.PermissionParamsListBuilderDelegate;
 import org.chromium.components.security_state.ConnectionSecurityLevel;
 import org.chromium.content_public.browser.WebContents;
 import org.chromium.weblayer_private.interfaces.IObjectWrapper;
@@ -252,18 +249,6 @@ public class UrlBarControllerImpl extends IUrlBarController.Stub {
             PageInfoController.show(mBrowserImpl.getWindowAndroid().getActivity().get(),
                     webContents, publisherUrl, PageInfoController.OpenedFromSource.TOOLBAR,
                     PageInfoControllerDelegateImpl.create(webContents),
-                    new PermissionParamsListBuilderDelegate(mBrowserImpl.getProfile()) {
-                        @Override
-                        public String getDelegateAppName(
-                                Origin origin, @ContentSettingsType int type) {
-                            if (type == ContentSettingsType.GEOLOCATION
-                                    && WebLayerImpl.isLocationPermissionManaged(origin)) {
-                                return WebLayerImpl.getClientApplicationName();
-                            }
-
-                            return null;
-                        }
-                    },
                     PageInfoController.NO_HIGHLIGHTED_PERMISSION);
         }
 
diff --git a/chromium/weblayer/browser/java/org/chromium/weblayer_private/WebLayerImpl.java b/chromium/weblayer/browser/java/org/chromium/weblayer_private/WebLayerImpl.java
index eb8e5c01dd5..d9ec732671f 100644
--- a/chromium/weblayer/browser/java/org/chromium/weblayer_private/WebLayerImpl.java
+++ b/chromium/weblayer/browser/java/org/chromium/weblayer_private/WebLayerImpl.java
@@ -55,10 +55,12 @@ import org.chromium.base.task.TaskTraits;
 import org.chromium.components.browser_ui.contacts_picker.ContactsPickerDialog;
 import org.chromium.components.browser_ui.photo_picker.DecoderServiceHost;
 import org.chromium.components.browser_ui.photo_picker.ImageDecoder;
+import org.chromium.components.browser_ui.photo_picker.PhotoPickerDelegateBase;
 import org.chromium.components.browser_ui.photo_picker.PhotoPickerDialog;
 import org.chromium.components.embedder_support.application.ClassLoaderContextWrapperFactory;
 import org.chromium.components.embedder_support.application.FirebaseConfig;
 import org.chromium.components.embedder_support.util.Origin;
+import org.chromium.components.payments.PaymentDetailsUpdateService;
 import org.chromium.content_public.browser.BrowserStartupController;
 import org.chromium.content_public.browser.ChildProcessCreationParams;
 import org.chromium.content_public.browser.ChildProcessLauncherHelper;
@@ -68,7 +70,6 @@ import org.chromium.content_public.browser.DeviceUtils;
 import org.chromium.content_public.browser.SelectionPopupController;
 import org.chromium.net.NetworkChangeNotifier;
 import org.chromium.ui.base.PhotoPicker;
-import org.chromium.ui.base.PhotoPickerDelegate;
 import org.chromium.ui.base.PhotoPickerListener;
 import org.chromium.ui.base.ResourceBundle;
 import org.chromium.ui.base.SelectFileDialog;
@@ -326,21 +327,16 @@ public final class WebLayerImpl extends IWebLayer.Stub {
                 });
 
         DecoderServiceHost.setIntentSupplier(() -> { return createImageDecoderServiceIntent(); });
-        SelectFileDialog.setPhotoPickerDelegate(new PhotoPickerDelegate() {
+        SelectFileDialog.setPhotoPickerDelegate(new PhotoPickerDelegateBase() {
             @Override
             public PhotoPicker showPhotoPicker(WindowAndroid windowAndroid,
                     PhotoPickerListener listener, boolean allowMultiple, List<String> mimeTypes) {
                 PhotoPickerDialog dialog = new PhotoPickerDialog(windowAndroid,
                         windowAndroid.getContext().get().getContentResolver(), listener,
-                        allowMultiple, /* animatedThumbnailsSupported = */ false, mimeTypes);
+                        allowMultiple, mimeTypes);
                 dialog.show();
                 return dialog;
             }
-
-            @Override
-            public boolean supportsVideos() {
-                return false;
-            }
         });
 
         performDexFixIfNecessary(packageInfo);
@@ -482,6 +478,12 @@ public final class WebLayerImpl extends IWebLayer.Stub {
     }
 
     @Override
+    public IObjectWrapper createPaymentDetailsUpdateService() {
+        StrictModeWorkaround.apply();
+        return ObjectWrapper.wrap(new PaymentDetailsUpdateService());
+    }
+
+    @Override
     public void enumerateAllProfileNames(IObjectWrapper valueCallback) {
         StrictModeWorkaround.apply();
         final ValueCallback<String[]> callback =
diff --git a/chromium/weblayer/browser/java/org/chromium/weblayer_private/interfaces/INavigation.aidl b/chromium/weblayer/browser/java/org/chromium/weblayer_private/interfaces/INavigation.aidl
index 81dd72fd6ea..1fd8e02b39b 100644
--- a/chromium/weblayer/browser/java/org/chromium/weblayer_private/interfaces/INavigation.aidl
+++ b/chromium/weblayer/browser/java/org/chromium/weblayer_private/interfaces/INavigation.aidl
@@ -51,4 +51,7 @@ interface INavigation {
 
   // @since 91
   List<String> getResponseHeaders() = 21;
+
+  // @since 92
+  int getNavigationEntryOffset() = 22;
 }
diff --git a/chromium/weblayer/browser/java/org/chromium/weblayer_private/interfaces/IRemoteFragmentClient.aidl b/chromium/weblayer/browser/java/org/chromium/weblayer_private/interfaces/IRemoteFragmentClient.aidl
index e88f1721fb7..8a80532f55d 100644
--- a/chromium/weblayer/browser/java/org/chromium/weblayer_private/interfaces/IRemoteFragmentClient.aidl
+++ b/chromium/weblayer/browser/java/org/chromium/weblayer_private/interfaces/IRemoteFragmentClient.aidl
@@ -6,6 +6,10 @@ package org.chromium.weblayer_private.interfaces;
 
 import org.chromium.weblayer_private.interfaces.IObjectWrapper;
 
+// Interface backed by the Fragment in the client library. It is possible
+// for the underlying Fragment to change. This happens during configuration
+// changes when ViewModel is enabled. See comments in RemoteFragment for
+// details.
 interface IRemoteFragmentClient {
   void superOnCreate(in IObjectWrapper savedInstanceState) = 0;
   void superOnAttach(in IObjectWrapper context) = 1;
diff --git a/chromium/weblayer/browser/java/org/chromium/weblayer_private/interfaces/IWebLayer.aidl b/chromium/weblayer/browser/java/org/chromium/weblayer_private/interfaces/IWebLayer.aidl
index 14c78801628..feb14c0d09c 100644
--- a/chromium/weblayer/browser/java/org/chromium/weblayer_private/interfaces/IWebLayer.aidl
+++ b/chromium/weblayer/browser/java/org/chromium/weblayer_private/interfaces/IWebLayer.aidl
@@ -114,9 +114,12 @@ interface IWebLayer {
       in IRemoteFragmentClient remoteFragmentClient,
       in IObjectWrapper fragmentArgs) = 25;
 
-  // Creates an instance of GooglePayDataCallbacksService.
+  // Creates an instance of GooglePayDataCallbacksService. Added in Version 92.
   IObjectWrapper createGooglePayDataCallbacksService() = 26;
 
+  // Creates an instance of PaymentDetailsUpdateService. Added in Version 92.
+  IObjectWrapper createPaymentDetailsUpdateService() = 27;
+
   // WARNING: when choosing next value make sure you look back for the max, as
   // merges may mean the last function does not have the max value.
 }
diff --git a/chromium/weblayer/browser/java/org/chromium/weblayer_private/metrics/UmaUtils.java b/chromium/weblayer/browser/java/org/chromium/weblayer_private/metrics/UmaUtils.java
index f093df9214c..2fc13ae0268 100644
--- a/chromium/weblayer/browser/java/org/chromium/weblayer_private/metrics/UmaUtils.java
+++ b/chromium/weblayer/browser/java/org/chromium/weblayer_private/metrics/UmaUtils.java
@@ -8,7 +8,6 @@ import android.os.SystemClock;
 
 import org.chromium.base.annotations.CalledByNative;
 import org.chromium.base.annotations.JNINamespace;
-import org.chromium.base.annotations.MainDex;
 
 /**
  * Utilities to support startup metrics
@@ -20,7 +19,6 @@ public class UmaUtils {
     /**
      * Record the time in the application lifecycle at which WebLayer code first runs.
      */
-    @MainDex
     public static void recordMainEntryPointTime() {
         // We can't simply pass this down through a JNI call, since the JNI for weblayer
         // isn't initialized until we start the native content browser component, and we
diff --git a/chromium/weblayer/browser/java/org/chromium/weblayer_private/payments/test_support/WebLayerPaymentRequestBuilder.java b/chromium/weblayer/browser/java/org/chromium/weblayer_private/payments/test_support/WebLayerPaymentRequestBuilder.java
index a2b0eae6429..34d5319b787 100644
--- a/chromium/weblayer/browser/java/org/chromium/weblayer_private/payments/test_support/WebLayerPaymentRequestBuilder.java
+++ b/chromium/weblayer/browser/java/org/chromium/weblayer_private/payments/test_support/WebLayerPaymentRequestBuilder.java
@@ -13,6 +13,7 @@ import org.mockito.Mockito;
 import org.chromium.components.payments.BrowserPaymentRequest;
 import org.chromium.components.payments.JourneyLogger;
 import org.chromium.components.payments.MojoPaymentRequestGateKeeper;
+import org.chromium.components.payments.PaymentAppFactoryInterface;
 import org.chromium.components.payments.PaymentRequestService;
 import org.chromium.components.payments.PaymentRequestSpec;
 import org.chromium.content_public.browser.RenderFrameHost;
@@ -195,4 +196,9 @@ public class WebLayerPaymentRequestBuilder implements PaymentRequestService.Dele
         Mockito.doReturn(weakContext).when(window).getContext();
         return window;
     }
+
+    @Override
+    public PaymentAppFactoryInterface createAndroidPaymentAppFactory() {
+        return null;
+    }
 }
diff --git a/chromium/weblayer/browser/java/org/chromium/weblayer_private/settings/WebLayerSiteSettingsDelegate.java b/chromium/weblayer/browser/java/org/chromium/weblayer_private/settings/WebLayerSiteSettingsDelegate.java
index 77e3f237b94..f19a8e425cd 100644
--- a/chromium/weblayer/browser/java/org/chromium/weblayer_private/settings/WebLayerSiteSettingsDelegate.java
+++ b/chromium/weblayer/browser/java/org/chromium/weblayer_private/settings/WebLayerSiteSettingsDelegate.java
@@ -18,6 +18,7 @@ import org.chromium.components.browser_ui.site_settings.SiteSettingsDelegate;
 import org.chromium.components.content_settings.ContentSettingsType;
 import org.chromium.components.embedder_support.browser_context.BrowserContextHandle;
 import org.chromium.components.embedder_support.util.Origin;
+import org.chromium.url.GURL;
 import org.chromium.weblayer_private.WebLayerImpl;
 
 import java.util.Collections;
@@ -47,7 +48,7 @@ public class WebLayerSiteSettingsDelegate
     }
 
     @Override
-    public void getFaviconImageForURL(String faviconUrl, Callback<Bitmap> callback) {
+    public void getFaviconImageForURL(GURL faviconUrl, Callback<Bitmap> callback) {
         // We don't currently support favicons on WebLayer.
         callback.onResult(null);
     }
@@ -55,9 +56,10 @@ public class WebLayerSiteSettingsDelegate
     @Override
     public boolean isCategoryVisible(@Type int type) {
         return type == Type.ADS || type == Type.ALL_SITES || type == Type.AUTOMATIC_DOWNLOADS
-                || type == Type.CAMERA || type == Type.COOKIES || type == Type.DEVICE_LOCATION
-                || type == Type.JAVASCRIPT || type == Type.MICROPHONE || type == Type.POPUPS
-                || type == Type.PROTECTED_MEDIA || type == Type.SOUND || type == Type.USE_STORAGE;
+                || type == Type.BACKGROUND_SYNC || type == Type.CAMERA || type == Type.COOKIES
+                || type == Type.DEVICE_LOCATION || type == Type.JAVASCRIPT
+                || type == Type.MICROPHONE || type == Type.POPUPS || type == Type.PROTECTED_MEDIA
+                || type == Type.SOUND || type == Type.USE_STORAGE;
     }
 
     @Override