BASELINE: Update Chromium to 96.0.4664.181

Change-Id: I762cd1da89d73aa6313b4a753fe126c34833f046
Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>

19 files changed, 93 insertions, 85 deletions

diff --git a/chromium/weblayer/browser/java/org/chromium/weblayer_private/BrowserControlsContainerView.java b/chromium/weblayer/browser/java/org/chromium/weblayer_private/BrowserControlsContainerView.java
index 876b27f2b8c..2499c468985 100644
--- a/chromium/weblayer/browser/java/org/chromium/weblayer_private/BrowserControlsContainerView.java
+++ b/chromium/weblayer/browser/java/org/chromium/weblayer_private/BrowserControlsContainerView.java
@@ -371,7 +371,7 @@ class BrowserControlsContainerView extends FrameLayout {
         int width = right - left;
         int height = bottom - top;
         boolean heightChanged = height != mLastHeight;
-        if (!heightChanged && width == mLastWidth) return;
+        if (!heightChanged && width == mLastWidth && mViewResourceAdapter != null) return;
 
         int prevHeight = mLastHeight;
         mLastWidth = width;
diff --git a/chromium/weblayer/browser/java/org/chromium/weblayer_private/BrowserFragmentImpl.java b/chromium/weblayer/browser/java/org/chromium/weblayer_private/BrowserFragmentImpl.java
index 71d4904b064..89ff0e5db8e 100644
--- a/chromium/weblayer/browser/java/org/chromium/weblayer_private/BrowserFragmentImpl.java
+++ b/chromium/weblayer/browser/java/org/chromium/weblayer_private/BrowserFragmentImpl.java
@@ -16,7 +16,6 @@ import android.view.ViewGroup;
 import androidx.annotation.Nullable;
 
 import org.chromium.base.metrics.RecordHistogram;
-import org.chromium.components.browser_ui.styles.R;
 import org.chromium.components.embedder_support.application.ClassLoaderContextWrapperFactory;
 import org.chromium.weblayer_private.interfaces.BrowserFragmentArgs;
 import org.chromium.weblayer_private.interfaces.IBrowser;
@@ -186,7 +185,9 @@ public class BrowserFragmentImpl extends FragmentHostingRemoteFragmentImpl {
     protected FragmentHostingRemoteFragmentImpl.RemoteFragmentContext createRemoteFragmentContext(
             Context embedderContext) {
         Context wrappedContext = ClassLoaderContextWrapperFactory.get(embedderContext);
-        Context themedContext = new ContextThemeWrapper(wrappedContext, R.style.Theme_BrowserUI);
+        Context themedContext =
+                new ContextThemeWrapper(wrappedContext, R.style.Theme_WebLayer_Settings);
+        themedContext.getTheme().applyStyle(R.style.ColorOverlay_WebLayer, /*force=*/true);
         return new FragmentHostingRemoteFragmentImpl.RemoteFragmentContext(themedContext);
     }
 }
diff --git a/chromium/weblayer/browser/java/org/chromium/weblayer_private/BrowserImpl.java b/chromium/weblayer/browser/java/org/chromium/weblayer_private/BrowserImpl.java
index 9d85c4133bd..2f8e859684f 100644
--- a/chromium/weblayer/browser/java/org/chromium/weblayer_private/BrowserImpl.java
+++ b/chromium/weblayer/browser/java/org/chromium/weblayer_private/BrowserImpl.java
@@ -222,7 +222,7 @@ public class BrowserImpl extends IBrowser.Stub implements View.OnAttachStateChan
         if (mWindowAndroid != null) {
             IntentRequestTracker tracker = mWindowAndroid.getIntentRequestTracker();
             assert tracker != null;
-            tracker.onActivityResult(requestCode, resultCode, data, mWindowAndroid);
+            tracker.onActivityResult(requestCode, resultCode, data);
         }
     }
 
diff --git a/chromium/weblayer/browser/java/org/chromium/weblayer_private/BrowserViewController.java b/chromium/weblayer/browser/java/org/chromium/weblayer_private/BrowserViewController.java
index d83b2c33426..e2e10008418 100644
--- a/chromium/weblayer/browser/java/org/chromium/weblayer_private/BrowserViewController.java
+++ b/chromium/weblayer/browser/java/org/chromium/weblayer_private/BrowserViewController.java
@@ -512,7 +512,8 @@ public final class BrowserViewController
                         .with(ModalDialogProperties.CONTROLLER, dialogController)
                         .with(ModalDialogProperties.TITLE, resources,
                                 R.string.http_post_warning_title)
-                        .with(ModalDialogProperties.MESSAGE, resources, R.string.http_post_warning)
+                        .with(ModalDialogProperties.MESSAGE,
+                                resources.getString(R.string.http_post_warning))
                         .with(ModalDialogProperties.POSITIVE_BUTTON_TEXT, resources,
                                 R.string.http_post_warning_resend)
                         .with(ModalDialogProperties.NEGATIVE_BUTTON_TEXT, resources,
diff --git a/chromium/weblayer/browser/java/org/chromium/weblayer_private/ContentViewRenderView.java b/chromium/weblayer/browser/java/org/chromium/weblayer_private/ContentViewRenderView.java
index c963f6de834..ed95cc3a693 100644
--- a/chromium/weblayer/browser/java/org/chromium/weblayer_private/ContentViewRenderView.java
+++ b/chromium/weblayer/browser/java/org/chromium/weblayer_private/ContentViewRenderView.java
@@ -64,6 +64,9 @@ public class ContentViewRenderView
     // The native side of this object.
     private long mNativeContentViewRenderView;
 
+    private Surface mLastSurface;
+    private boolean mLastCanBeUsedWithSurfaceControl;
+
     private int mMinimumSurfaceWidth;
     private int mMinimumSurfaceHeight;
 
@@ -164,6 +167,13 @@ public class ContentViewRenderView
                 int height, boolean transparentBackground) {
             assert mNativeContentViewRenderView != 0;
             assert mSurfaceData == ContentViewRenderView.this.mCurrent;
+            if (mLastSurface == surface
+                    && mLastCanBeUsedWithSurfaceControl == canBeUsedWithSurfaceControl) {
+                surface = null;
+            } else {
+                mLastSurface = surface;
+                mLastCanBeUsedWithSurfaceControl = canBeUsedWithSurfaceControl;
+            }
             ContentViewRenderViewJni.get().surfaceChanged(mNativeContentViewRenderView,
                     canBeUsedWithSurfaceControl, width, height, transparentBackground, surface);
             mCompositorHasSurface = surface != null;
@@ -178,6 +188,8 @@ public class ContentViewRenderView
             ContentViewRenderViewJni.get().surfaceDestroyed(
                     mNativeContentViewRenderView, cacheBackBuffer);
             mCompositorHasSurface = false;
+            mLastSurface = null;
+            mLastCanBeUsedWithSurfaceControl = false;
         }
 
         @Override
@@ -1023,7 +1035,7 @@ public class ContentViewRenderView
         void surfaceCreated(long nativeContentViewRenderView);
         void surfaceDestroyed(long nativeContentViewRenderView, boolean cacheBackBuffer);
         void surfaceChanged(long nativeContentViewRenderView, boolean canBeUsedWithSurfaceControl,
-                int width, int height, boolean transparentBackground, Surface surface);
+                int width, int height, boolean transparentBackground, Surface newSurface);
         void setNeedsRedraw(long nativeContentViewRenderView);
         void evictCachedSurface(long nativeContentViewRenderView);
         ResourceManager getResourceManager(long nativeContentViewRenderView);
diff --git a/chromium/weblayer/browser/java/org/chromium/weblayer_private/ExternalNavigationDelegateImpl.java b/chromium/weblayer/browser/java/org/chromium/weblayer_private/ExternalNavigationDelegateImpl.java
index 6717c9d5cec..967dab2fac5 100644
--- a/chromium/weblayer/browser/java/org/chromium/weblayer_private/ExternalNavigationDelegateImpl.java
+++ b/chromium/weblayer/browser/java/org/chromium/weblayer_private/ExternalNavigationDelegateImpl.java
@@ -14,7 +14,6 @@ import androidx.annotation.Nullable;
 import org.chromium.base.Callback;
 import org.chromium.base.Function;
 import org.chromium.base.PackageManagerUtils;
-import org.chromium.components.embedder_support.util.UrlUtilities;
 import org.chromium.components.external_intents.ExternalNavigationDelegate;
 import org.chromium.components.external_intents.ExternalNavigationDelegate.StartActivityIfNeededResult;
 import org.chromium.components.external_intents.ExternalNavigationParams;
@@ -78,17 +77,7 @@ public class ExternalNavigationDelegateImpl implements ExternalNavigationDelegat
         assert !proxy
             : "|proxy| should be true only for instant apps, which WebLayer doesn't handle";
 
-        boolean isExternalProtocol = !UrlUtilities.isAcceptedScheme(intent.toUri(0));
-        boolean hasDefaultHandler = hasDefaultHandler(intent);
-
-        // Match CCT's custom behavior of keeping http(s) URLs with no default handler in the app.
-        // TODO(blundell): If/when CCT eliminates its special handling of this case, eliminate it
-        // from WebLayer as well.
-        if (!isExternalProtocol && !hasDefaultHandler) {
-            return StartActivityIfNeededResult.HANDLED_WITHOUT_ACTIVITY_START;
-        }
-
-        // Otherwise defer to ExternalNavigationHandler's default logic.
+        // Defer to ExternalNavigationHandler's default logic.
         return StartActivityIfNeededResult.DID_NOT_HANDLE;
     }
 
diff --git a/chromium/weblayer/browser/java/org/chromium/weblayer_private/NavigationImpl.java b/chromium/weblayer/browser/java/org/chromium/weblayer_private/NavigationImpl.java
index 57e40303e0c..d75f24f0b7a 100644
--- a/chromium/weblayer/browser/java/org/chromium/weblayer_private/NavigationImpl.java
+++ b/chromium/weblayer/browser/java/org/chromium/weblayer_private/NavigationImpl.java
@@ -233,10 +233,13 @@ public final class NavigationImpl extends INavigation.Stub {
         if (mPage == null) {
             long nativePageImpl = NavigationImplJni.get().getPage(mNativeNavigationImpl);
             if (nativePageImpl == -1) {
-                throw new IllegalStateException("Using Navigation after native destroyed");
+                throw new IllegalStateException(
+                        "Invoking Navigation#getPage() outside of valid calling context");
             }
 
-            if (nativePageImpl == 0) return null;
+            // There should always be a Page associated with the navigation within the valid
+            // calling contexts for Navigation#getPage().
+            assert (nativePageImpl != 0);
 
             mPage = mNavigationController.getPage(nativePageImpl);
         }
diff --git a/chromium/weblayer/browser/java/org/chromium/weblayer_private/PageInfoControllerDelegateImpl.java b/chromium/weblayer/browser/java/org/chromium/weblayer_private/PageInfoControllerDelegateImpl.java
index 13c18c22c6e..f5a13126fb3 100644
--- a/chromium/weblayer/browser/java/org/chromium/weblayer_private/PageInfoControllerDelegateImpl.java
+++ b/chromium/weblayer/browser/java/org/chromium/weblayer_private/PageInfoControllerDelegateImpl.java
@@ -9,6 +9,7 @@ import android.content.Intent;
 import android.graphics.Bitmap;
 import android.graphics.drawable.BitmapDrawable;
 import android.graphics.drawable.Drawable;
+import android.view.ViewGroup;
 import android.webkit.ValueCallback;
 
 import androidx.annotation.NonNull;
@@ -26,7 +27,6 @@ import org.chromium.components.content_settings.CookieControlsObserver;
 import org.chromium.components.embedder_support.util.UrlConstants;
 import org.chromium.components.page_info.PageInfoControllerDelegate;
 import org.chromium.components.page_info.PageInfoMainController;
-import org.chromium.components.page_info.PageInfoRowView;
 import org.chromium.components.page_info.PageInfoSubpageController;
 import org.chromium.content_public.browser.BrowserContextHandle;
 import org.chromium.content_public.browser.WebContents;
@@ -36,6 +36,8 @@ import org.chromium.weblayer_private.interfaces.ObjectWrapper;
 import org.chromium.weblayer_private.interfaces.SettingsIntentHelper;
 import org.chromium.weblayer_private.settings.WebLayerSiteSettingsDelegate;
 
+import java.util.Collection;
+
 /**
  * WebLayer's customization of PageInfoControllerDelegate.
  */
@@ -103,8 +105,8 @@ public class PageInfoControllerDelegateImpl extends PageInfoControllerDelegate {
      */
     @Override
     @Nullable
-    public PageInfoSubpageController createHistoryController(
-            PageInfoMainController mainController, PageInfoRowView rowView) {
+    public Collection<PageInfoSubpageController> createAdditionalRowViews(
+            PageInfoMainController mainController, ViewGroup rowWrapper) {
         return null;
     }
 
diff --git a/chromium/weblayer/browser/java/org/chromium/weblayer_private/TranslateCompactInfoBar.java b/chromium/weblayer/browser/java/org/chromium/weblayer_private/TranslateCompactInfoBar.java
index 88a8f237c24..90844b919ec 100644
--- a/chromium/weblayer/browser/java/org/chromium/weblayer_private/TranslateCompactInfoBar.java
+++ b/chromium/weblayer/browser/java/org/chromium/weblayer_private/TranslateCompactInfoBar.java
@@ -74,8 +74,6 @@ public class TranslateCompactInfoBar extends InfoBar
     private static final String INFOBAR_HISTOGRAM_NEVER_TRANSLATE_LANGUAGE =
             "Translate.CompactInfobar.Language.NeverTranslate";
     private static final String INFOBAR_HISTOGRAM = "Translate.CompactInfobar.Event";
-    private static final String INFOBAR_HISTOGRAM_TRANSLATION_COUNT =
-            "Translate.CompactInfobar.TranslationsPerPage";
 
     // Need 2 instances of TranslateMenuHelper to prevent a race condition bug which happens when
     // showing language menu after dismissing overflow menu.
@@ -144,7 +142,7 @@ public class TranslateCompactInfoBar extends InfoBar
                 (TranslateTabLayout) content.findViewById(R.id.weblayer_translate_infobar_tabs);
         if (mDefaultTextColor > 0) {
             mTabLayout.setTabTextColors(
-                    ContextCompat.getColor(getContext(), R.color.default_text_color),
+                    ContextCompat.getColor(getContext(), R.color.default_text_color_baseline),
                     ContextCompat.getColor(
                             getContext(), R.color.weblayer_tab_layout_selected_tab_color));
         }
@@ -235,7 +233,6 @@ public class TranslateCompactInfoBar extends InfoBar
 
     @CalledByNative
     private void onPageTranslated(int errorType) {
-        incrementAndRecordTranslationsPerPageCount();
         if (mTabLayout != null) {
             mTabLayout.hideProgressBar();
             if (errorType != 0) {
@@ -293,7 +290,6 @@ public class TranslateCompactInfoBar extends InfoBar
     public void onTabSelected(TabLayout.Tab tab) {
         switch (tab.getPosition()) {
             case SOURCE_TAB_INDEX:
-                incrementAndRecordTranslationsPerPageCount();
                 recordInfobarAction(InfobarEvent.INFOBAR_REVERT);
                 onButtonClicked(ActionType.TRANSLATE_SHOW_ORIGINAL);
                 return;
@@ -531,10 +527,6 @@ public class TranslateCompactInfoBar extends InfoBar
         }
     }
 
-    private void incrementAndRecordTranslationsPerPageCount() {
-        RecordHistogram.recordCountHistogram(
-                INFOBAR_HISTOGRAM_TRANSLATION_COUNT, ++mTotalTranslationCount);
-    }
 
     // Return the width of parent in pixels.  Return 0 if there is no parent.
     private int getParentWidth() {
diff --git a/chromium/weblayer/browser/java/org/chromium/weblayer_private/UrlBarControllerImpl.java b/chromium/weblayer/browser/java/org/chromium/weblayer_private/UrlBarControllerImpl.java
index 229ffc380d1..414c9f8969f 100644
--- a/chromium/weblayer/browser/java/org/chromium/weblayer_private/UrlBarControllerImpl.java
+++ b/chromium/weblayer/browser/java/org/chromium/weblayer_private/UrlBarControllerImpl.java
@@ -44,6 +44,8 @@ import org.chromium.weblayer_private.interfaces.UrlBarOptionsKeys;
  *  Implementation of {@link IUrlBarController}.
  */
 @JNINamespace("weblayer")
+// This isn't part of Chrome, so using explicit colors/sizes is ok.
+@SuppressWarnings("checkstyle:SetTextColorAndSetTextSizeCheck")
 public class UrlBarControllerImpl extends IUrlBarController.Stub {
     public static final float DEFAULT_TEXT_SIZE = 10.0F;
     public static final float MINIMUM_TEXT_SIZE = 5.0F;
@@ -102,6 +104,37 @@ public class UrlBarControllerImpl extends IUrlBarController.Stub {
         return ObjectWrapper.wrap(urlBarView);
     }
 
+    @Override
+    public void showPageInfo(@NonNull Bundle bundle) {
+        if (mBrowserImpl == null) {
+            throw new IllegalStateException("Page info can not be shown without a valid Browser");
+        }
+        if (!mBrowserImpl.isViewAttachedToWindow()) {
+            throw new IllegalStateException("Must be attached to window to show page info");
+        }
+        final boolean showPublisherUrl =
+                bundle.getBoolean(UrlBarOptionsKeys.SHOW_PUBLISHER_URL, /*default= */ false);
+        showPageInfoUi(showPublisherUrl);
+    }
+
+    private void showPageInfoUi(boolean showPublisherUrl) {
+        WebContents webContents = mBrowserImpl.getActiveTab().getWebContents();
+
+        String publisherUrl = null;
+        if (showPublisherUrl) {
+            String publisherUrlMaybeNull =
+                    UrlBarControllerImplJni.get().getPublisherUrl(mNativeUrlBarController);
+            if (publisherUrlMaybeNull != null && !TextUtils.isEmpty(publisherUrlMaybeNull)) {
+                publisherUrl = UrlUtilities.extractPublisherFromPublisherUrl(publisherUrlMaybeNull);
+            }
+        }
+
+        PageInfoController.show(mBrowserImpl.getWindowAndroid().getActivity().get(), webContents,
+                publisherUrl, PageInfoController.OpenedFromSource.TOOLBAR,
+                PageInfoControllerDelegateImpl.create(webContents),
+                PageInfoController.NO_HIGHLIGHTED_PERMISSION);
+    }
+
     protected class UrlBarView
             extends LinearLayout implements BrowserImpl.VisibleSecurityStateObserver {
         private final UrlBarControllerImpl mController;
@@ -146,20 +179,26 @@ public class UrlBarControllerImpl extends IUrlBarController.Stub {
             mUrlBarLongClickListener =
                     ObjectWrapper.unwrap(longClickListener, OnLongClickListener.class);
 
-            updateView();
+            // NOTE: We don't animate the security button update here because this is not a change
+            // per se but rather an initial setting of the state. See crbug.com/1247666 for details.
+            updateView(/*animateSecurityButtonUpdate=*/false);
         }
 
         // BrowserImpl.VisibleSecurityStateObserver
         @Override
         public void onVisibleSecurityStateOfActiveTabChanged() {
-            updateView();
+            updateView(/*animateSecurityButtonUpdate=*/true);
         }
 
         @Override
         protected void onAttachedToWindow() {
             if (mBrowserImpl != null) {
                 mBrowserImpl.addVisibleSecurityStateObserver(this);
-                updateView();
+
+                // NOTE: We don't animate the security button update here because this is not a
+                // change per se but rather an initial setting of the state. See crbug.com/1247666
+                // for details.
+                updateView(/*animateSecurityButtonUpdate=*/false);
             }
 
             super.onAttachedToWindow();
@@ -173,7 +212,7 @@ public class UrlBarControllerImpl extends IUrlBarController.Stub {
             mController.removeActiveView();
         }
 
-        private void updateView() {
+        private void updateView(boolean animateSecurityButtonUpdate) {
             if (mBrowserImpl == null) return;
             int securityLevel = UrlBarControllerImplJni.get().getConnectionSecurityLevel(
                     mNativeUrlBarController);
@@ -201,7 +240,9 @@ public class UrlBarControllerImpl extends IUrlBarController.Stub {
                 mUrlTextView.setTextColor(ContextCompat.getColor(embedderContext, mUrlTextColor));
             }
 
-            mSecurityButtonAnimationDelegate.updateSecurityButton(securityIcon);
+            mSecurityButtonAnimationDelegate.updateSecurityButton(
+                    securityIcon, animateSecurityButtonUpdate);
+
             mSecurityButton.setContentDescription(getContext().getResources().getString(
                     SecurityStatusIcon.getSecurityIconContentDescriptionResourceId(securityLevel)));
 
@@ -215,7 +256,7 @@ public class UrlBarControllerImpl extends IUrlBarController.Stub {
                 // Set clicklisteners on the entire UrlBarView.
                 assert (mUrlBarClickListener == null);
                 mSecurityButton.setClickable(false);
-                setOnClickListener(v -> { showPageInfoUi(v); });
+                setOnClickListener(v -> { showPageInfoUi(mShowPublisherUrl); });
 
                 if (mUrlBarLongClickListener != null) {
                     setOnLongClickListener(mUrlBarLongClickListener);
@@ -223,7 +264,7 @@ public class UrlBarControllerImpl extends IUrlBarController.Stub {
             } else {
                 // Set a clicklistener on the security status and TextView separately. This mode
                 // can be used to create an editable URL bar using WebLayer.
-                mSecurityButton.setOnClickListener(v -> { showPageInfoUi(v); });
+                mSecurityButton.setOnClickListener(v -> { showPageInfoUi(mShowPublisherUrl); });
                 if (mUrlBarClickListener != null) {
                     mUrlTextView.setOnClickListener(mUrlBarClickListener);
                 }
@@ -233,23 +274,8 @@ public class UrlBarControllerImpl extends IUrlBarController.Stub {
             }
         }
 
-        private void showPageInfoUi(View v) {
-            WebContents webContents = mBrowserImpl.getActiveTab().getWebContents();
-
-            String publisherUrl = null;
-            if (mShowPublisherUrl) {
-                String publisherUrlMaybeNull =
-                        UrlBarControllerImplJni.get().getPublisherUrl(mNativeUrlBarController);
-                if (publisherUrlMaybeNull != null && !TextUtils.isEmpty(publisherUrlMaybeNull)) {
-                    publisherUrl =
-                            UrlUtilities.extractPublisherFromPublisherUrl(publisherUrlMaybeNull);
-                }
-            }
-
-            PageInfoController.show(mBrowserImpl.getWindowAndroid().getActivity().get(),
-                    webContents, publisherUrl, PageInfoController.OpenedFromSource.TOOLBAR,
-                    PageInfoControllerDelegateImpl.create(webContents),
-                    PageInfoController.NO_HIGHLIGHTED_PERMISSION);
+        public boolean showPublisherUrl() {
+            return mShowPublisherUrl;
         }
 
         @DrawableRes
diff --git a/chromium/weblayer/browser/java/org/chromium/weblayer_private/interfaces/BrowserFragmentArgs.java b/chromium/weblayer/browser/java/org/chromium/weblayer_private/interfaces/BrowserFragmentArgs.java
index 0c9c1bf598e..98dd129e83c 100644
--- a/chromium/weblayer/browser/java/org/chromium/weblayer_private/interfaces/BrowserFragmentArgs.java
+++ b/chromium/weblayer/browser/java/org/chromium/weblayer_private/interfaces/BrowserFragmentArgs.java
@@ -12,4 +12,5 @@ public interface BrowserFragmentArgs {
      * A boolean value indicating whether the profile is incognito.
      */
     String IS_INCOGNITO = "is_incognito";
+    String USE_VIEW_MODEL = "use_view_model";
 }
diff --git a/chromium/weblayer/browser/java/org/chromium/weblayer_private/interfaces/IUrlBarController.aidl b/chromium/weblayer/browser/java/org/chromium/weblayer_private/interfaces/IUrlBarController.aidl
index 3ea58166065..4a4e0a232a3 100644
--- a/chromium/weblayer/browser/java/org/chromium/weblayer_private/interfaces/IUrlBarController.aidl
+++ b/chromium/weblayer/browser/java/org/chromium/weblayer_private/interfaces/IUrlBarController.aidl
@@ -14,4 +14,7 @@ interface IUrlBarController {
       in Bundle options,
       in IObjectWrapper /* View.OnClickListener */ textClickListener,
       in IObjectWrapper /* View.OnLongClickListener */ textLongClickListener) = 1;
+
+  // Added in 95.
+  void showPageInfo(in Bundle options) = 2;
 }
diff --git a/chromium/weblayer/browser/java/org/chromium/weblayer_private/interfaces/WebLayerVersionConstants.java b/chromium/weblayer/browser/java/org/chromium/weblayer_private/interfaces/WebLayerVersionConstants.java
index 4d786a43c1b..a2dae708282 100644
--- a/chromium/weblayer/browser/java/org/chromium/weblayer_private/interfaces/WebLayerVersionConstants.java
+++ b/chromium/weblayer/browser/java/org/chromium/weblayer_private/interfaces/WebLayerVersionConstants.java
@@ -15,7 +15,7 @@ public interface WebLayerVersionConstants {
      *
      * @see WebLayer#isAvailable()
      */
-    int MAX_SKEW = 4;
+    int MAX_SKEW = 6;
 
     /**
      * Minimum version of client and implementation.
diff --git a/chromium/weblayer/browser/java/org/chromium/weblayer_private/media/MediaRouteDialogFragmentImpl.java b/chromium/weblayer/browser/java/org/chromium/weblayer_private/media/MediaRouteDialogFragmentImpl.java
index 14ac8f15519..6522ddd5176 100644
--- a/chromium/weblayer/browser/java/org/chromium/weblayer_private/media/MediaRouteDialogFragmentImpl.java
+++ b/chromium/weblayer/browser/java/org/chromium/weblayer_private/media/MediaRouteDialogFragmentImpl.java
@@ -38,7 +38,8 @@ public class MediaRouteDialogFragmentImpl extends FragmentHostingRemoteFragmentI
             // TODO(estade): this is necessary because MediaRouter dialogs crash if the theme has an
             // action bar. It's unclear why this is necessary when it's not in Chrome, and why
             // ContextThemeWrapper doesn't work.
-            getTheme().applyStyle(R.style.Theme_BrowserUI, true);
+            getTheme().applyStyle(R.style.Theme_BrowserUI_DayNight, /*force=*/true);
+            getTheme().applyStyle(R.style.ColorOverlay_WebLayer, /*force=*/true);
         }
     }
 
diff --git a/chromium/weblayer/browser/java/org/chromium/weblayer_private/payments/DIR_METADATA b/chromium/weblayer/browser/java/org/chromium/weblayer_private/payments/DIR_METADATA
index 2b4b65caffd..c933c596281 100644
--- a/chromium/weblayer/browser/java/org/chromium/weblayer_private/payments/DIR_METADATA
+++ b/chromium/weblayer/browser/java/org/chromium/weblayer_private/payments/DIR_METADATA
@@ -1,5 +1,2 @@
-monorail: {
-  component: "Blink>Payments"
-}
-team_email: "payments-dev@chromium.org"
+mixins: "//components/payments/COMMON_METADATA"
 os: ANDROID
diff --git a/chromium/weblayer/browser/java/org/chromium/weblayer_private/payments/WebLayerPaymentRequestService.java b/chromium/weblayer/browser/java/org/chromium/weblayer_private/payments/WebLayerPaymentRequestService.java
index 8e9934a75ce..082c675e3ed 100644
--- a/chromium/weblayer/browser/java/org/chromium/weblayer_private/payments/WebLayerPaymentRequestService.java
+++ b/chromium/weblayer/browser/java/org/chromium/weblayer_private/payments/WebLayerPaymentRequestService.java
@@ -4,11 +4,8 @@
 
 package org.chromium.weblayer_private.payments;
 
-import android.text.TextUtils;
-
 import androidx.annotation.Nullable;
 
-import org.chromium.components.payments.AbortReason;
 import org.chromium.components.payments.BrowserPaymentRequest;
 import org.chromium.components.payments.JourneyLogger;
 import org.chromium.components.payments.PaymentApp;
@@ -164,14 +161,6 @@ public class WebLayerPaymentRequestService implements BrowserPaymentRequest {
         return !mAvailableApps.isEmpty() && mAvailableApps.get(0).isComplete();
     }
 
-    // Implements BrowserPaymentRequest:
-    @Override
-    public void onInstrumentDetailsError(String errorMessage) {
-        assert !TextUtils.isEmpty(errorMessage);
-        mJourneyLogger.setAborted(AbortReason.ABORTED_BY_USER);
-        disconnectFromClientWithDebugMessage(errorMessage);
-    }
-
     private void disconnectFromClientWithDebugMessage(String debugMessage) {
         if (mPaymentRequestService != null) {
             mPaymentRequestService.disconnectFromClientWithDebugMessage(
diff --git a/chromium/weblayer/browser/java/org/chromium/weblayer_private/payments/WebLayerPaymentRequestServiceTest.java b/chromium/weblayer/browser/java/org/chromium/weblayer_private/payments/WebLayerPaymentRequestServiceTest.java
index b3d2a278681..632712937fd 100644
--- a/chromium/weblayer/browser/java/org/chromium/weblayer_private/payments/WebLayerPaymentRequestServiceTest.java
+++ b/chromium/weblayer/browser/java/org/chromium/weblayer_private/payments/WebLayerPaymentRequestServiceTest.java
@@ -29,7 +29,6 @@ import org.chromium.components.payments.PaymentApp.InstrumentDetailsCallback;
 import org.chromium.components.payments.PaymentAppFactoryDelegate;
 import org.chromium.components.payments.PaymentAppFactoryInterface;
 import org.chromium.components.payments.PaymentAppService;
-import org.chromium.components.payments.PaymentFeatureList;
 import org.chromium.components.payments.PaymentRequestService;
 import org.chromium.components.payments.test_support.ShadowPaymentFeatureList;
 import org.chromium.payments.mojom.PaymentRequest;
@@ -78,14 +77,7 @@ public class WebLayerPaymentRequestServiceTest {
                 .when(mErrorMessageUtilMock)
                 .getNotSupportedErrorMessage(Mockito.any());
 
-        ShadowPaymentFeatureList.setFeatureEnabled(
-                PaymentFeatureList.WEB_PAYMENTS_SINGLE_APP_UI_SKIP, true);
-        ShadowPaymentFeatureList.setFeatureEnabled(
-                PaymentFeatureList.SECURE_PAYMENT_CONFIRMATION, true);
-        ShadowPaymentFeatureList.setFeatureEnabled(
-                PaymentFeatureList.SECURE_PAYMENT_CONFIRMATION_API_V3, true);
-        ShadowPaymentFeatureList.setFeatureEnabled(
-                PaymentFeatureList.WEB_PAYMENTS_EXPERIMENTAL_FEATURES, true);
+        ShadowPaymentFeatureList.setDefaultStatuses();
         PaymentRequestService.resetShowingPaymentRequestForTest();
         PaymentAppService.getInstance().resetForTest();
 
diff --git a/chromium/weblayer/browser/java/org/chromium/weblayer_private/payments/test_support/WebLayerPaymentRequestBuilder.java b/chromium/weblayer/browser/java/org/chromium/weblayer_private/payments/test_support/WebLayerPaymentRequestBuilder.java
index a9d4204c504..3d1e3a39ca8 100644
--- a/chromium/weblayer/browser/java/org/chromium/weblayer_private/payments/test_support/WebLayerPaymentRequestBuilder.java
+++ b/chromium/weblayer/browser/java/org/chromium/weblayer_private/payments/test_support/WebLayerPaymentRequestBuilder.java
@@ -46,7 +46,6 @@ public class WebLayerPaymentRequestBuilder implements PaymentRequestService.Dele
     private final WebContents mWebContents;
     private final JourneyLogger mJourneyLogger;
     private final PaymentRequestSpec mSpec;
-    private final boolean mGoogleBridgeEligible;
     private final PaymentOptions mOptions;
     private String mSupportedMethod = "https://www.chromium.org";
 
@@ -79,7 +78,6 @@ public class WebLayerPaymentRequestBuilder implements PaymentRequestService.Dele
         mDetails.total = new PaymentItem();
         mOptions = new PaymentOptions();
         mSpec = Mockito.mock(PaymentRequestSpec.class);
-        mGoogleBridgeEligible = false;
     }
 
     /**
@@ -105,7 +103,7 @@ public class WebLayerPaymentRequestBuilder implements PaymentRequestService.Dele
                 (client, onClosed)
                         -> new PaymentRequestService(
                                 mRenderFrameHost, client, onClosed, /*delegate=*/this, () -> null));
-        request.init(mClient, mMethodData, mDetails, mOptions, mGoogleBridgeEligible);
+        request.init(mClient, mMethodData, mDetails, mOptions);
         return request;
     }
 
diff --git a/chromium/weblayer/browser/java/org/chromium/weblayer_private/settings/SettingsFragmentImpl.java b/chromium/weblayer/browser/java/org/chromium/weblayer_private/settings/SettingsFragmentImpl.java
index 2690991a7ee..6171b1da71b 100644
--- a/chromium/weblayer/browser/java/org/chromium/weblayer_private/settings/SettingsFragmentImpl.java
+++ b/chromium/weblayer/browser/java/org/chromium/weblayer_private/settings/SettingsFragmentImpl.java
@@ -58,6 +58,7 @@ public class SettingsFragmentImpl extends FragmentHostingRemoteFragmentImpl {
         public SettingsContext(SettingsFragmentImpl fragmentImpl, Context embedderContext) {
             super(new ContextThemeWrapper(ClassLoaderContextWrapperFactory.get(embedderContext),
                     R.style.Theme_WebLayer_Settings));
+            getTheme().applyStyle(R.style.ColorOverlay_WebLayer, /*force=*/true);
             mEmbedderContext = embedderContext;
             mFragmentImpl = fragmentImpl;
         }