BASELINE: Update Chromium to 98.0.4758.90

Change-Id: Ib7c41539bf8a8e0376bd639f27d68294de90f3c8 Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>
author: Allan Sandfeld Jensen <allan.jensen@qt.io> 2022-02-04 17:20:24 +0100
committer: Allan Sandfeld Jensen <allan.jensen@qt.io> 2022-02-12 08:15:25 +0000
commit: 8fa0776f1f79e91fc9c0b9c1ba11a0a29c05196b (patch)
tree: 788d8d7549712682703a0310ca4a0f0860d4802b /chromium/weblayer
parent: 606d85f2a5386472314d39923da28c70c60dc8e7 (diff)
download: qtwebengine-chromium-8fa0776f1f79e91fc9c0b9c1ba11a0a29c05196b.tar.gz
166 files changed, 810 insertions, 843 deletions
diff --git a/chromium/weblayer/BUILD.gn b/chromium/weblayer/BUILD.gn
index 46597e050c8..31e9d1e6b29 100644
--- a/chromium/weblayer/BUILD.gn
+++ b/chromium/weblayer/BUILD.gn
@@ -191,8 +191,6 @@ source_set("weblayer_lib_base") {
     "browser/cookie_manager_impl.h",
     "browser/cookie_settings_factory.cc",
     "browser/cookie_settings_factory.h",
-    "browser/default_search_engine.cc",
-    "browser/default_search_engine.h",
     "browser/download_impl.cc",
     "browser/download_impl.h",
     "browser/download_manager_delegate_impl.cc",
@@ -589,8 +587,6 @@ source_set("weblayer_lib_base") {
       "browser/android/exception_filter.h",
       "browser/android/metrics/uma_utils.cc",
       "browser/android/metrics/uma_utils.h",
-      "browser/android/metrics/weblayer_metrics_navigation_throttle.cc",
-      "browser/android/metrics/weblayer_metrics_navigation_throttle.h",
       "browser/android/metrics/weblayer_metrics_service_client.cc",
       "browser/android/metrics/weblayer_metrics_service_client.h",
       "browser/android/permission_request_utils.cc",
@@ -819,6 +815,7 @@ if (is_android) {
       ":weblayer_lib_base",
       "//base",
       "//base/test:test_support",
+      "//components/content_settings/core/browser",
       "//components/infobars/android",
       "//components/infobars/content",
       "//components/infobars/core",
diff --git a/chromium/weblayer/app/DEPS b/chromium/weblayer/app/DEPS
index 83532f21148..8e63fcf187b 100644
--- a/chromium/weblayer/app/DEPS
+++ b/chromium/weblayer/app/DEPS
@@ -5,6 +5,7 @@ include_rules = [
   "+components/variations",
   "+components/version_info",
   "+components/viz/common",
+  "+components/translate/core/common",
   "+content/public",
   "+device/base/features.h",
   "+media/base/media_switches.h",
diff --git a/chromium/weblayer/app/content_main_delegate_impl.cc b/chromium/weblayer/app/content_main_delegate_impl.cc
index 610a09bdb5c..16f8626a933 100644
--- a/chromium/weblayer/app/content_main_delegate_impl.cc
+++ b/chromium/weblayer/app/content_main_delegate_impl.cc
@@ -12,6 +12,7 @@
 #include "base/containers/flat_set.h"
 #include "base/cpu.h"
 #include "base/files/file_util.h"
+#include "base/ignore_result.h"
 #include "base/lazy_instance.h"
 #include "base/logging.h"
 #include "base/path_service.h"
@@ -20,10 +21,12 @@
 #include "build/chromeos_buildflags.h"
 #include "components/content_capture/common/content_capture_features.h"
 #include "components/startup_metric_utils/browser/startup_metric_utils.h"
+#include "components/translate/core/common/translate_util.h"
 #include "components/variations/variations_ids_provider.h"
 #include "content/public/browser/browser_main_runner.h"
 #include "content/public/common/content_features.h"
 #include "content/public/common/content_switches.h"
+#include "content/public/common/main_function_params.h"
 #include "content/public/common/url_constants.h"
 #include "media/base/media_switches.h"
 #include "services/network/public/cpp/features.h"
@@ -183,6 +186,8 @@ bool ContentMainDelegateImpl::BasicStartupComplete(int* exit_code) {
     blink::features::kPortals,
     // TODO(crbug.com/1144912): Support BackForwardCache on WebLayer.
     ::features::kBackForwardCache,
+    // TODO(crbug.com/1247836): Enable TFLite/Optimization Guide on WebLayer.
+    translate::kTFLiteLanguageDetectionEnabled,
 
 #if defined(OS_ANDROID)
     // TODO(crbug.com/1131016): Support Picture in Picture API on WebLayer.
@@ -294,17 +299,18 @@ void ContentMainDelegateImpl::PostEarlyInitialization(bool is_running_tests) {
   browser_client_->CreateFeatureListAndFieldTrials();
 }
 
-int ContentMainDelegateImpl::RunProcess(
+absl::variant<int, content::MainFunctionParams>
+ContentMainDelegateImpl::RunProcess(
     const std::string& process_type,
-    const content::MainFunctionParams& main_function_params) {
+    content::MainFunctionParams main_function_params) {
   // For non-browser process, return and have the caller run the main loop.
   if (!process_type.empty())
-    return -1;
+    return std::move(main_function_params);
 
 #if !defined(OS_ANDROID)
-  // On non-Android, we can return -1 and have the caller run BrowserMain()
-  // normally.
-  return -1;
+  // On non-Android, we can return |main_function_params| back and have the
+  // caller run BrowserMain() normally.
+  return std::move(main_function_params);
 #else
   // On Android, we defer to the system message loop when the stack unwinds.
   // So here we only create (and leak) a BrowserMainRunner. The shutdown
@@ -314,7 +320,8 @@ int ContentMainDelegateImpl::RunProcess(
   // In browser tests, the |main_function_params| contains a |ui_task| which
   // will execute the testing. The task will be executed synchronously inside
   // Initialize() so we don't depend on the BrowserMainRunner being Run().
-  int initialize_exit_code = main_runner->Initialize(main_function_params);
+  int initialize_exit_code =
+      main_runner->Initialize(std::move(main_function_params));
   DCHECK_LT(initialize_exit_code, 0)
       << "BrowserMainRunner::Initialize failed in MainDelegate";
   ignore_result(main_runner.release());
diff --git a/chromium/weblayer/app/content_main_delegate_impl.h b/chromium/weblayer/app/content_main_delegate_impl.h
index 2c168d86e1b..5da2e801499 100644
--- a/chromium/weblayer/app/content_main_delegate_impl.h
+++ b/chromium/weblayer/app/content_main_delegate_impl.h
@@ -8,7 +8,6 @@
 #include <memory>
 
 #include "base/compiler_specific.h"
-#include "base/macros.h"
 #include "build/build_config.h"
 #include "content/public/app/content_main_delegate.h"
 #include "weblayer/public/main.h"
@@ -34,9 +33,9 @@ class ContentMainDelegateImpl : public content::ContentMainDelegate {
   variations::VariationsIdsProvider* CreateVariationsIdsProvider() override;
   void PreSandboxStartup() override;
   void PostEarlyInitialization(bool is_running_tests) override;
-  int RunProcess(
+  absl::variant<int, content::MainFunctionParams> RunProcess(
       const std::string& process_type,
-      const content::MainFunctionParams& main_function_params) override;
+      content::MainFunctionParams main_function_params) override;
   content::ContentClient* CreateContentClient() override;
   content::ContentBrowserClient* CreateContentBrowserClient() override;
   content::ContentRendererClient* CreateContentRendererClient() override;
diff --git a/chromium/weblayer/app/main.cc b/chromium/weblayer/app/main.cc
index 9bb74da3359..07602dd5e87 100644
--- a/chromium/weblayer/app/main.cc
+++ b/chromium/weblayer/app/main.cc
@@ -49,7 +49,7 @@ int Main(MainParams params
   content_params.argv = argv;
 #endif
 
-  return content::ContentMain(content_params);
+  return content::ContentMain(std::move(content_params));
 }
 #endif  // !defined(OS_ANDROID)
 
diff --git a/chromium/weblayer/browser/android/javatests/AndroidManifest_bundle.xml b/chromium/weblayer/browser/android/javatests/AndroidManifest_bundle.xml
index 902ad48688c..26ca5d38736 100644
--- a/chromium/weblayer/browser/android/javatests/AndroidManifest_bundle.xml
+++ b/chromium/weblayer/browser/android/javatests/AndroidManifest_bundle.xml
@@ -10,6 +10,18 @@
     package="org.chromium.weblayer.tests">
   <uses-permission android:name="android.permission.RUN_INSTRUMENTATION" />
   <uses-permission android:name="android.permission.ACCESS_NETWORK_STATE"/>
+
+  <!-- Starting from Android 11 not all packages are visible by default and this stops us
+       from starting an EmbeddedTestServer. Request visibility by using an intent
+       filter signature
+       (https://developer.android.com/training/package-visibility/declaring#intent-filter-signature)
+  -->
+  <queries>
+    <intent>
+      <action android:name="org.chromium.net.test.EMBEDDED_TEST_SERVER_SERVICE" />
+    </intent>
+  </queries>
+
   <!-- We add an application tag here just so that we can indicate that this
        package needs to link against the android.test library, which is
        needed when building test cases. -->
diff --git a/chromium/weblayer/browser/android/javatests/BUILD.gn b/chromium/weblayer/browser/android/javatests/BUILD.gn
index 8b6ebe592b7..8fa4c433523 100644
--- a/chromium/weblayer/browser/android/javatests/BUILD.gn
+++ b/chromium/weblayer/browser/android/javatests/BUILD.gn
@@ -66,6 +66,7 @@ android_library("weblayer_java_tests") {
     "//third_party/androidx:androidx_core_core_java",
     "//third_party/androidx:androidx_fragment_fragment_java",
     "//third_party/androidx:androidx_test_runner_java",
+    "//third_party/blink/public/common:common_java",
     "//third_party/hamcrest:hamcrest_java",
     "//third_party/junit:junit",
     "//weblayer/browser/java:interfaces_java",
diff --git a/chromium/weblayer/browser/android/javatests/skew/expectations.txt b/chromium/weblayer/browser/android/javatests/skew/expectations.txt
index f235719bf91..335e7e3b6f8 100644
--- a/chromium/weblayer/browser/android/javatests/skew/expectations.txt
+++ b/chromium/weblayer/browser/android/javatests/skew/expectations.txt
@@ -5,7 +5,7 @@
 # with versions less than or equal to $VERSION of the implementation.
 #
 # These lines are not comments! They define the set of known tags and other information.
-# tags: [ client_lte_91 client_lte_94 client_lte_95 impl_lte_95 ]
+# tags: [ client_lte_91 client_lte_94 client_lte_95 impl_lte_95 client_lte_97 impl_lte_97 ]
 # 'all' disables the test from any skew test.
 # tags: [ all ]
 # results: [ Skip ]
@@ -90,3 +90,24 @@ crbug.com/1191751 [ all ] org.chromium.weblayer.test.CookieManagerTest#testCooki
 crbug.com/1191751 [ all ] org.chromium.weblayer.test.NavigationTest#testIsFormSubmission [ Skip ]
 crbug.com/1191751 [ all ] org.chromium.weblayer.test.TabCallbackTest#testOnRenderProcessGone [ Skip ]
 crbug.com/1191751 [ all ] org.chromium.weblayer.test.ScrollOffsetCallbackTest#testBasic [ Skip ]
+
+# In 98 we changed the implementation to have navigations succeed rather than
+# fail in this case. Unfortunately there is no way to skip tests based on
+# the impl being >= a given version.
+crbug.com/1233480 [ all ] org.chromium.weblayer.test.NavigationTest#testInitialRendererInitiatedNavigationToAboutBlankFails [ Skip ]
+
+# In 99 we added logic to avoid the disambiguation dialog and a test for it.
+crbug.com/1278017 [ client_lte_97 ] org.chromium.weblayer.test.ExternalNavigationTest#testExternalIntentAfterRedirectInBackgroundTabLaunchedWhenBackgroundLaunchesAllowed [ Skip ]
+crbug.com/1278017 [ client_lte_97 ] org.chromium.weblayer.test.ExternalNavigationTest#testExternalIntentAfterRedirectLaunched [ Skip ]
+crbug.com/1278017 [ client_lte_97 ] org.chromium.weblayer.test.ExternalNavigationTest#testExternalIntentInNewTabLaunchedOnLinkClick [ Skip ]
+crbug.com/1278017 [ client_lte_97 ] org.chromium.weblayer.test.ExternalNavigationTest#testExternalIntentInSameTabLaunchedOnLinkClick [ Skip ]
+crbug.com/1278017 [ client_lte_97 ] org.chromium.weblayer.test.ExternalNavigationTest#testExternalIntentNavigationParamSetOnIntentLaunchViaLinkClick [ Skip ]
+crbug.com/1278017 [ client_lte_97 ] org.chromium.weblayer.test.ExternalNavigationTest#testExternalIntentNavigationParamSetOnNavigationsToIntents [ Skip ]
+crbug.com/1278017 [ client_lte_97 ] org.chromium.weblayer.test.ExternalNavigationTest#testExternalIntentViaOnLoadLaunched [ Skip ]
+crbug.com/1278017 [ client_lte_97 ] org.chromium.weblayer.test.ExternalNavigationTest#testExternalIntentWithFallbackUrlAfterRedirectLaunched [ Skip ]
+crbug.com/1278017 [ client_lte_97 ] org.chromium.weblayer.test.ExternalNavigationTest#testExternalIntentWithNoRedirectInBackgroundTabLaunchedWhenBackgroundLaunchesAllowed [ Skip ]
+crbug.com/1278017 [ client_lte_97 ] org.chromium.weblayer.test.ExternalNavigationTest#testExternalIntentWithNoRedirectInBrowserStartupLaunchedWhenBackgroundLaunchesAllowed [ Skip ]
+crbug.com/1278017 [ client_lte_97 ] org.chromium.weblayer.test.ExternalNavigationTest#testExternalIntentWithNoRedirectLaunched [ Skip ]
+crbug.com/1278017 [ client_lte_97 ] org.chromium.weblayer.test.ExternalNavigationTest#testUserClicksLinkToPageWithExternalIntentLaunchedViaOnLoad [ Skip ]
+crbug.com/1278017 [ client_lte_97 ] org.chromium.weblayer.test.ExternalNavigationTest#testAvoidDisambiguationDialog [ Skip ]
+crbug.com/1278017 [ impl_lte_97 ] org.chromium.weblayer.test.ExternalNavigationTest#testAvoidDisambiguationDialog [ Skip ]
diff --git a/chromium/weblayer/browser/android/metrics/metrics_browsertest.cc b/chromium/weblayer/browser/android/metrics/metrics_browsertest.cc
index e1e8fbbc23f..11e17377fd1 100644
--- a/chromium/weblayer/browser/android/metrics/metrics_browsertest.cc
+++ b/chromium/weblayer/browser/android/metrics/metrics_browsertest.cc
@@ -4,7 +4,6 @@
 
 #include <deque>
 
-#include "base/command_line.h"
 #include "base/metrics/metrics_hashes.h"
 #include "base/metrics/statistics_recorder.h"
 #include "base/no_destructor.h"
@@ -45,8 +44,7 @@ bool HasHistogramWithHash(const metrics::ChromeUserMetricsExtension& uma_log,
 class MetricsBrowserTest : public WebLayerBrowserTest {
  public:
   void SetUp() override {
-    base::CommandLine* command_line = base::CommandLine::ForCurrentProcess();
-    command_line->AppendSwitch(metrics::switches::kForceEnableMetricsReporting);
+    metrics::ForceEnableMetricsReportingForTesting();
 
     InstallTestGmsBridge(GetConsentType(),
                          base::BindRepeating(&MetricsBrowserTest::OnLogMetrics,
diff --git a/chromium/weblayer/browser/android/metrics/weblayer_metrics_navigation_throttle.cc b/chromium/weblayer/browser/android/metrics/weblayer_metrics_navigation_throttle.cc
deleted file mode 100644
index 04c78457d61..00000000000
--- a/chromium/weblayer/browser/android/metrics/weblayer_metrics_navigation_throttle.cc
+++ /dev/null
@@ -1,28 +0,0 @@
-// Copyright 2021 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "weblayer/browser/android/metrics/weblayer_metrics_navigation_throttle.h"
-
-#include "base/metrics/histogram_functions.h"
-#include "weblayer/browser/android/metrics/weblayer_metrics_service_client.h"
-
-namespace weblayer {
-
-WebLayerMetricsNavigationThrottle::WebLayerMetricsNavigationThrottle(
-    content::NavigationHandle* handle)
-    : content::NavigationThrottle(handle) {}
-
-const char* WebLayerMetricsNavigationThrottle::GetNameForLogging() {
-  return "WebLayerMetricsNavigationThrottle";
-}
-
-content::NavigationThrottle::ThrottleCheckResult
-WebLayerMetricsNavigationThrottle::WillStartRequest() {
-  auto* metrics_client = WebLayerMetricsServiceClient::GetInstance();
-  base::UmaHistogramBoolean("WebLayer.NavigationStart.ConsentDetermined",
-                            metrics_client->IsConsentDetermined());
-  return content::NavigationThrottle::PROCEED;
-}
-
-}  // namespace weblayer
diff --git a/chromium/weblayer/browser/android/metrics/weblayer_metrics_navigation_throttle.h b/chromium/weblayer/browser/android/metrics/weblayer_metrics_navigation_throttle.h
deleted file mode 100644
index 5d9278db2ed..00000000000
--- a/chromium/weblayer/browser/android/metrics/weblayer_metrics_navigation_throttle.h
+++ /dev/null
@@ -1,29 +0,0 @@
-// Copyright 2021 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef WEBLAYER_BROWSER_ANDROID_METRICS_WEBLAYER_METRICS_NAVIGATION_THROTTLE_H_
-#define WEBLAYER_BROWSER_ANDROID_METRICS_WEBLAYER_METRICS_NAVIGATION_THROTTLE_H_
-
-#include "content/public/browser/navigation_throttle.h"
-
-namespace weblayer {
-
-// Logs WebLayer specific metrics.
-class WebLayerMetricsNavigationThrottle : public content::NavigationThrottle {
- public:
-  explicit WebLayerMetricsNavigationThrottle(content::NavigationHandle* handle);
-  WebLayerMetricsNavigationThrottle(const WebLayerMetricsNavigationThrottle&) =
-      delete;
-  WebLayerMetricsNavigationThrottle& operator=(
-      const WebLayerMetricsNavigationThrottle&) = delete;
-  ~WebLayerMetricsNavigationThrottle() override = default;
-
-  // content::NavigationThrottle:
-  const char* GetNameForLogging() override;
-  ThrottleCheckResult WillStartRequest() override;
-};
-
-}  // namespace weblayer
-
-#endif  // WEBLAYER_BROWSER_ANDROID_METRICS_WEBLAYER_METRICS_NAVIGATION_THROTTLE_H_
diff --git a/chromium/weblayer/browser/android/metrics/weblayer_metrics_service_client.h b/chromium/weblayer/browser/android/metrics/weblayer_metrics_service_client.h
index 55677c18633..2fc05942cb8 100644
--- a/chromium/weblayer/browser/android/metrics/weblayer_metrics_service_client.h
+++ b/chromium/weblayer/browser/android/metrics/weblayer_metrics_service_client.h
@@ -8,7 +8,6 @@
 #include <memory>
 #include <string>
 
-#include "base/macros.h"
 #include "base/metrics/field_trial.h"
 #include "base/no_destructor.h"
 #include "base/sequence_checker.h"
diff --git a/chromium/weblayer/browser/autofill_browsertest.cc b/chromium/weblayer/browser/autofill_browsertest.cc
index 404c31c2c59..2f9d563c6b7 100644
--- a/chromium/weblayer/browser/autofill_browsertest.cc
+++ b/chromium/weblayer/browser/autofill_browsertest.cc
@@ -4,7 +4,6 @@
 
 #include "weblayer/test/weblayer_browser_test.h"
 
-#include "base/macros.h"
 #include "base/strings/utf_string_conversions.h"
 #include "build/build_config.h"
 #include "components/autofill/core/common/form_data.h"
diff --git a/chromium/weblayer/browser/autofill_client_impl.cc b/chromium/weblayer/browser/autofill_client_impl.cc
index 22d52697c73..b0f391034ed 100644
--- a/chromium/weblayer/browser/autofill_client_impl.cc
+++ b/chromium/weblayer/browser/autofill_client_impl.cc
@@ -320,7 +320,8 @@ void AutofillClientImpl::LoadRiskData(
 }
 
 AutofillClientImpl::AutofillClientImpl(content::WebContents* web_contents)
-    : content::WebContentsObserver(web_contents) {}
+    : content::WebContentsUserData<AutofillClientImpl>(*web_contents),
+      content::WebContentsObserver(web_contents) {}
 
 WEB_CONTENTS_USER_DATA_KEY_IMPL(AutofillClientImpl);
 
diff --git a/chromium/weblayer/browser/autofill_client_impl.h b/chromium/weblayer/browser/autofill_client_impl.h
index a5559500120..629015a54f4 100644
--- a/chromium/weblayer/browser/autofill_client_impl.h
+++ b/chromium/weblayer/browser/autofill_client_impl.h
@@ -6,7 +6,6 @@
 #define WEBLAYER_BROWSER_AUTOFILL_CLIENT_IMPL_H_
 
 #include "base/compiler_specific.h"
-#include "base/macros.h"
 #include "build/build_config.h"
 #include "components/autofill/core/browser/autofill_client.h"
 #include "content/public/browser/web_contents_observer.h"
diff --git a/chromium/weblayer/browser/background_download_service_factory.cc b/chromium/weblayer/browser/background_download_service_factory.cc
index f5e884b31b4..2bbba378c3f 100644
--- a/chromium/weblayer/browser/background_download_service_factory.cc
+++ b/chromium/weblayer/browser/background_download_service_factory.cc
@@ -5,8 +5,9 @@
 #include "weblayer/browser/background_download_service_factory.h"
 
 #include "base/files/file_path.h"
-#include "base/sequenced_task_runner.h"
-#include "base/single_thread_task_runner.h"
+#include "base/memory/raw_ptr.h"
+#include "base/task/sequenced_task_runner.h"
+#include "base/task/single_thread_task_runner.h"
 #include "base/task/task_traits.h"
 #include "base/task/thread_pool.h"
 #include "components/background_fetch/download_client.h"
@@ -103,7 +104,7 @@ class DownloadBlobContextGetterFactory
     std::move(callback).Run(browser_context_->GetBlobStorageContext());
   }
 
-  content::BrowserContext* browser_context_;
+  raw_ptr<content::BrowserContext> browser_context_;
 };
 
 }  // namespace
diff --git a/chromium/weblayer/browser/background_fetch/background_fetch_delegate_factory.h b/chromium/weblayer/browser/background_fetch/background_fetch_delegate_factory.h
index 79b1b682a60..f137cad9b19 100644
--- a/chromium/weblayer/browser/background_fetch/background_fetch_delegate_factory.h
+++ b/chromium/weblayer/browser/background_fetch/background_fetch_delegate_factory.h
@@ -5,7 +5,6 @@
 #ifndef WEBLAYER_BROWSER_BACKGROUND_FETCH_BACKGROUND_FETCH_DELEGATE_FACTORY_H_
 #define WEBLAYER_BROWSER_BACKGROUND_FETCH_BACKGROUND_FETCH_DELEGATE_FACTORY_H_
 
-#include "base/macros.h"
 #include "base/memory/singleton.h"
 #include "components/keyed_service/content/browser_context_keyed_service_factory.h"
 
diff --git a/chromium/weblayer/browser/background_fetch/background_fetch_download.h b/chromium/weblayer/browser/background_fetch/background_fetch_download.h
index a898fec3804..c87212503b8 100644
--- a/chromium/weblayer/browser/background_fetch/background_fetch_download.h
+++ b/chromium/weblayer/browser/background_fetch/background_fetch_download.h
@@ -7,6 +7,7 @@
 
 #include <string>
 
+#include "base/memory/raw_ptr.h"
 #include "weblayer/browser/download_impl.h"
 
 namespace background_fetch {
@@ -48,10 +49,10 @@ class BackgroundFetchDownload : public DownloadImpl {
   void OnFinished(bool activated) override;
 
  private:
-  BackgroundFetchDelegateImpl* controller_;
+  raw_ptr<BackgroundFetchDelegateImpl> controller_;
   std::string job_id_;
   int notification_id_ = 0;
-  const background_fetch::JobDetails* job_;
+  raw_ptr<const background_fetch::JobDetails> job_;
 };
 
 }  // namespace weblayer
diff --git a/chromium/weblayer/browser/background_sync/background_sync_delegate_impl.h b/chromium/weblayer/browser/background_sync/background_sync_delegate_impl.h
index 33e59d19f45..3bc11151425 100644
--- a/chromium/weblayer/browser/background_sync/background_sync_delegate_impl.h
+++ b/chromium/weblayer/browser/background_sync/background_sync_delegate_impl.h
@@ -5,6 +5,7 @@
 #ifndef WEBLAYER_BROWSER_BACKGROUND_SYNC_BACKGROUND_SYNC_DELEGATE_IMPL_H_
 #define WEBLAYER_BROWSER_BACKGROUND_SYNC_BACKGROUND_SYNC_DELEGATE_IMPL_H_
 
+#include "base/memory/raw_ptr.h"
 #include "build/build_config.h"
 #include "components/background_sync/background_sync_delegate.h"
 #include "url/origin.h"
@@ -47,7 +48,7 @@ class BackgroundSyncDelegateImpl
 #endif  // defined(OS_ANDROID)
 
  private:
-  content::BrowserContext* browser_context_;
+  raw_ptr<content::BrowserContext> browser_context_;
 };
 
 }  // namespace weblayer
diff --git a/chromium/weblayer/browser/browser_context_impl.cc b/chromium/weblayer/browser/browser_context_impl.cc
index 9e7a8d056a1..ae918a274a0 100644
--- a/chromium/weblayer/browser/browser_context_impl.cc
+++ b/chromium/weblayer/browser/browser_context_impl.cc
@@ -4,6 +4,7 @@
 
 #include "weblayer/browser/browser_context_impl.h"
 
+#include "base/memory/raw_ptr.h"
 #include "base/threading/thread_restrictions.h"
 #include "components/background_sync/background_sync_controller_impl.h"
 #include "components/blocked_content/safe_browsing_triggered_popup_blocker.h"
@@ -42,7 +43,6 @@
 #include "weblayer/browser/browsing_data_remover_delegate.h"
 #include "weblayer/browser/browsing_data_remover_delegate_factory.h"
 #include "weblayer/browser/client_hints_factory.h"
-#include "weblayer/browser/default_search_engine.h"
 #include "weblayer/browser/heavy_ad_service_factory.h"
 #include "weblayer/browser/permissions/permission_manager_factory.h"
 #include "weblayer/browser/stateful_ssl_host_state_delegate_factory.h"
@@ -118,12 +118,6 @@ BrowserContextImpl::BrowserContextImpl(ProfileImpl* profile_impl,
   }
 
   site_isolation::SiteIsolationPolicy::ApplyPersistedIsolatedOrigins(this);
-
-  // Set the DSE permissions every time the browser context is created for
-  // simplicity. These permissions are not editable in site settings, so should
-  // not ever be changed by the user. The site settings entry will link to the
-  // client app's system level permissions page to handle these.
-  ResetDsePermissions(this);
 }
 
 BrowserContextImpl::~BrowserContextImpl() {
@@ -333,7 +327,7 @@ class BrowserContextImpl::WebLayerVariationsClient
   }
 
  private:
-  content::BrowserContext* browser_context_;
+  raw_ptr<content::BrowserContext> browser_context_;
 };
 
 variations::VariationsClient* BrowserContextImpl::GetVariationsClient() {
diff --git a/chromium/weblayer/browser/browser_context_impl.h b/chromium/weblayer/browser/browser_context_impl.h
index 2198b389893..b2fb37566ae 100644
--- a/chromium/weblayer/browser/browser_context_impl.h
+++ b/chromium/weblayer/browser/browser_context_impl.h
@@ -6,6 +6,7 @@
 #define WEBLAYER_BROWSER_BROWSER_CONTEXT_IMPL_H_
 
 #include "base/files/file_path.h"
+#include "base/memory/raw_ptr.h"
 #include "build/build_config.h"
 #include "components/keyed_service/core/simple_factory_key.h"
 #include "content/public/browser/browser_context.h"
@@ -82,7 +83,7 @@ class BrowserContextImpl : public content::BrowserContext {
   // Registers the preferences that WebLayer accesses.
   void RegisterPrefs(user_prefs::PrefRegistrySyncable* pref_registry);
 
-  ProfileImpl* const profile_impl_;
+  const raw_ptr<ProfileImpl> profile_impl_;
   base::FilePath path_;
   // In Chrome, a SimpleFactoryKey is used as a minimal representation of a
   // BrowserContext used before full browser mode has started. WebLayer doesn't
diff --git a/chromium/weblayer/browser/browser_controls_container_view.h b/chromium/weblayer/browser/browser_controls_container_view.h
index 51d79d38f2d..0ef18471131 100644
--- a/chromium/weblayer/browser/browser_controls_container_view.h
+++ b/chromium/weblayer/browser/browser_controls_container_view.h
@@ -6,7 +6,7 @@
 #define WEBLAYER_BROWSER_BROWSER_CONTROLS_CONTAINER_VIEW_H_
 
 #include "base/android/scoped_java_ref.h"
-#include "base/macros.h"
+#include "base/memory/raw_ptr.h"
 #include "base/memory/scoped_refptr.h"
 #include "build/build_config.h"
 #include "content/public/browser/web_contents_observer.h"
@@ -94,7 +94,7 @@ class BrowserControlsContainerView : public content::WebContentsObserver {
 
   base::android::ScopedJavaGlobalRef<jobject>
       java_browser_controls_container_view_;
-  ContentViewRenderView* content_view_render_view_;
+  raw_ptr<ContentViewRenderView> content_view_render_view_;
   const bool is_top_;
   int controls_resource_id_ = -1;
 
diff --git a/chromium/weblayer/browser/browser_controls_navigation_state_handler.cc b/chromium/weblayer/browser/browser_controls_navigation_state_handler.cc
index 474a77a2b67..5b6c5f2a24f 100644
--- a/chromium/weblayer/browser/browser_controls_navigation_state_handler.cc
+++ b/chromium/weblayer/browser/browser_controls_navigation_state_handler.cc
@@ -104,7 +104,7 @@ void BrowserControlsNavigationStateHandler::DidChangeVisibleSecurityState() {
   UpdateState();
 }
 
-void BrowserControlsNavigationStateHandler::RenderProcessGone(
+void BrowserControlsNavigationStateHandler::PrimaryMainFrameRenderProcessGone(
     base::TerminationStatus status) {
   is_crashed_ = true;
   UpdateState();
diff --git a/chromium/weblayer/browser/browser_controls_navigation_state_handler.h b/chromium/weblayer/browser/browser_controls_navigation_state_handler.h
index 2771f65beb5..2034c2dbfec 100644
--- a/chromium/weblayer/browser/browser_controls_navigation_state_handler.h
+++ b/chromium/weblayer/browser/browser_controls_navigation_state_handler.h
@@ -5,6 +5,7 @@
 #ifndef WEBLAYER_BROWSER_BROWSER_CONTROLS_NAVIGATION_STATE_HANDLER_H_
 #define WEBLAYER_BROWSER_BROWSER_CONTROLS_NAVIGATION_STATE_HANDLER_H_
 
+#include "base/memory/raw_ptr.h"
 #include "base/timer/timer.h"
 #include "cc/input/browser_controls_state.h"
 #include "content/public/browser/web_contents_observer.h"
@@ -47,7 +48,8 @@ class BrowserControlsNavigationStateHandler
                    const GURL& validated_url,
                    int error_code) override;
   void DidChangeVisibleSecurityState() override;
-  void RenderProcessGone(base::TerminationStatus status) override;
+  void PrimaryMainFrameRenderProcessGone(
+      base::TerminationStatus status) override;
   void OnRendererUnresponsive(
       content::RenderProcessHost* render_process_host) override;
   void OnRendererResponsive(
@@ -73,7 +75,7 @@ class BrowserControlsNavigationStateHandler
 
   bool IsRendererHungOrCrashed();
 
-  BrowserControlsNavigationStateHandlerDelegate* delegate_;
+  raw_ptr<BrowserControlsNavigationStateHandlerDelegate> delegate_;
 
   // The controls are forced visible when a navigation starts, and allowed to
   // hide a short amount of time after done.
diff --git a/chromium/weblayer/browser/browser_impl.cc b/chromium/weblayer/browser/browser_impl.cc
index da2c667ce03..14910cd7cc4 100644
--- a/chromium/weblayer/browser/browser_impl.cc
+++ b/chromium/weblayer/browser/browser_impl.cc
@@ -159,8 +159,10 @@ ScopedJavaLocalRef<jbyteArray> BrowserImpl::GetBrowserPersisterCryptoKey(
 }
 
 ScopedJavaLocalRef<jbyteArray> BrowserImpl::GetMinimalPersistenceState(
-    JNIEnv* env) {
-  return base::android::ToJavaByteArray(env, GetMinimalPersistenceState());
+    JNIEnv* env,
+    int max_navigations_per_tab) {
+  return base::android::ToJavaByteArray(
+      env, GetMinimalPersistenceState(max_navigations_per_tab, 0));
 }
 
 void BrowserImpl::RestoreStateIfNecessary(
@@ -215,8 +217,9 @@ void BrowserImpl::OnFragmentPause(JNIEnv* env) {
 #endif
 
 std::vector<uint8_t> BrowserImpl::GetMinimalPersistenceState(
+    int max_navigations_per_tab,
     int max_size_in_bytes) {
-  return PersistMinimalState(this, max_size_in_bytes);
+  return PersistMinimalState(this, max_navigations_per_tab, max_size_in_bytes);
 }
 
 void BrowserImpl::SetWebPreferences(blink::web_pref::WebPreferences* prefs) {
@@ -343,7 +346,7 @@ std::string BrowserImpl::GetPersistenceId() {
 
 std::vector<uint8_t> BrowserImpl::GetMinimalPersistenceState() {
   // 0 means use the default max.
-  return GetMinimalPersistenceState(0);
+  return GetMinimalPersistenceState(0, 0);
 }
 
 bool BrowserImpl::IsRestoringPreviousState() {
diff --git a/chromium/weblayer/browser/browser_impl.h b/chromium/weblayer/browser/browser_impl.h
index 8d8a220dba5..5debb852f26 100644
--- a/chromium/weblayer/browser/browser_impl.h
+++ b/chromium/weblayer/browser/browser_impl.h
@@ -9,6 +9,7 @@
 #include <vector>
 
 #include "base/callback.h"
+#include "base/memory/raw_ptr.h"
 #include "base/observer_list.h"
 #include "build/build_config.h"
 #include "weblayer/public/browser.h"
@@ -77,7 +78,8 @@ class BrowserImpl : public Browser {
   base::android::ScopedJavaLocalRef<jbyteArray> GetBrowserPersisterCryptoKey(
       JNIEnv* env);
   base::android::ScopedJavaLocalRef<jbyteArray> GetMinimalPersistenceState(
-      JNIEnv* env);
+      JNIEnv* env,
+      int max_navigations_per_tab);
   void RestoreStateIfNecessary(
       JNIEnv* env,
       const base::android::JavaParamRef<jstring>& j_persistence_id,
@@ -96,7 +98,8 @@ class BrowserImpl : public Browser {
 #endif
 
   // Used in tests to specify a non-default max (0 means use the default).
-  std::vector<uint8_t> GetMinimalPersistenceState(int max_size_in_bytes);
+  std::vector<uint8_t> GetMinimalPersistenceState(int max_navigations_per_tab,
+                                                  int max_size_in_bytes);
 
   // Used by tests to specify a callback to listen to changes to visible
   // security state.
@@ -161,9 +164,9 @@ class BrowserImpl : public Browser {
 #endif
   base::ObserverList<BrowserObserver> browser_observers_;
   base::ObserverList<BrowserRestoreObserver> browser_restore_observers_;
-  ProfileImpl* const profile_;
+  const raw_ptr<ProfileImpl> profile_;
   std::vector<std::unique_ptr<Tab>> tabs_;
-  TabImpl* active_tab_ = nullptr;
+  raw_ptr<TabImpl> active_tab_ = nullptr;
   std::string persistence_id_;
   std::unique_ptr<BrowserPersister> browser_persister_;
   base::OnceClosure visible_security_state_changed_callback_for_tests_;
diff --git a/chromium/weblayer/browser/browser_main_parts_impl.cc b/chromium/weblayer/browser/browser_main_parts_impl.cc
index c0f773379a5..f653ad348c5 100644
--- a/chromium/weblayer/browser/browser_main_parts_impl.cc
+++ b/chromium/weblayer/browser/browser_main_parts_impl.cc
@@ -150,10 +150,10 @@ void StopMessageLoop(base::OnceClosure quit_closure) {
 
 BrowserMainPartsImpl::BrowserMainPartsImpl(
     MainParams* params,
-    const content::MainFunctionParams& main_function_params,
+    content::MainFunctionParams main_function_params,
     std::unique_ptr<PrefService> local_state)
     : params_(params),
-      main_function_params_(main_function_params),
+      main_function_params_(std::move(main_function_params)),
       local_state_(std::move(local_state)) {}
 
 BrowserMainPartsImpl::~BrowserMainPartsImpl() = default;
@@ -251,12 +251,6 @@ int BrowserMainPartsImpl::PreMainMessageLoopRun() {
           FROM_HERE,
           base::BindOnce(&PublishSubresourceFilterRulesetFromResourceBundle));
 
-  if (main_function_params_.ui_task) {
-    std::move(*main_function_params_.ui_task).Run();
-    delete main_function_params_.ui_task;
-    run_message_loop_ = false;
-  }
-
 #if defined(OS_ANDROID)
   // On Android, retrieve the application start time from Java and record it. On
   // other platforms, the application start time was already recorded in the
@@ -290,14 +284,10 @@ int BrowserMainPartsImpl::PreMainMessageLoopRun() {
 
 void BrowserMainPartsImpl::WillRunMainMessageLoop(
     std::unique_ptr<base::RunLoop>& run_loop) {
-  if (run_message_loop_) {
-    // Wrap the method that stops the message loop so we can do other shutdown
-    // cleanup inside content.
-    params_->delegate->SetMainMessageLoopQuitClosure(
-        base::BindOnce(StopMessageLoop, run_loop->QuitClosure()));
-  } else {
-    run_loop.reset();
-  }
+  // Wrap the method that stops the message loop so we can do other shutdown
+  // cleanup inside content.
+  params_->delegate->SetMainMessageLoopQuitClosure(
+      base::BindOnce(StopMessageLoop, run_loop->QuitClosure()));
 }
 
 void BrowserMainPartsImpl::OnFirstIdle() {
diff --git a/chromium/weblayer/browser/browser_main_parts_impl.h b/chromium/weblayer/browser/browser_main_parts_impl.h
index c7d1c2c4581..92824b5e6e6 100644
--- a/chromium/weblayer/browser/browser_main_parts_impl.h
+++ b/chromium/weblayer/browser/browser_main_parts_impl.h
@@ -7,7 +7,7 @@
 
 #include <memory>
 
-#include "base/macros.h"
+#include "base/memory/raw_ptr.h"
 #include "base/metrics/field_trial.h"
 #include "build/build_config.h"
 #include "components/embedder_support/android/metrics/memory_metrics_logger.h"
@@ -27,7 +27,7 @@ struct MainParams;
 class BrowserMainPartsImpl : public content::BrowserMainParts {
  public:
   BrowserMainPartsImpl(MainParams* params,
-                       const content::MainFunctionParams& main_function_params,
+                       content::MainFunctionParams main_function_params,
                        std::unique_ptr<PrefService> local_state);
 
   BrowserMainPartsImpl(const BrowserMainPartsImpl&) = delete;
@@ -46,7 +46,7 @@ class BrowserMainPartsImpl : public content::BrowserMainParts {
   void PostMainMessageLoopRun() override;
 
  private:
-  MainParams* params_;
+  raw_ptr<MainParams> params_;
 
   std::unique_ptr<BrowserProcess> browser_process_;
   std::unique_ptr<performance_manager::PerformanceManagerLifetime>
@@ -56,8 +56,7 @@ class BrowserMainPartsImpl : public content::BrowserMainParts {
 #endif  // defined(OS_ANDROID)
 
   // For running weblayer_browsertests.
-  const content::MainFunctionParams main_function_params_;
-  bool run_message_loop_ = true;
+  content::MainFunctionParams main_function_params_;
 
   // Ownership of this moves to BrowserProcess. See
   // ContentBrowserClientImpl::local_state_ for details.
diff --git a/chromium/weblayer/browser/browser_process.h b/chromium/weblayer/browser/browser_process.h
index a7f9a38a265..a052d188752 100644
--- a/chromium/weblayer/browser/browser_process.h
+++ b/chromium/weblayer/browser/browser_process.h
@@ -7,7 +7,6 @@
 
 #include <memory>
 
-#include "base/macros.h"
 #include "base/memory/scoped_refptr.h"
 #include "base/sequence_checker.h"
 #include "build/build_config.h"
diff --git a/chromium/weblayer/browser/browsing_data_remover_delegate.cc b/chromium/weblayer/browser/browsing_data_remover_delegate.cc
index 35b6b019c89..08647e8de92 100644
--- a/chromium/weblayer/browser/browsing_data_remover_delegate.cc
+++ b/chromium/weblayer/browser/browsing_data_remover_delegate.cc
@@ -15,7 +15,6 @@
 #include "content/public/browser/browsing_data_filter_builder.h"
 #include "services/network/public/mojom/cookie_manager.mojom.h"
 #include "weblayer/browser/browser_process.h"
-#include "weblayer/browser/default_search_engine.h"
 #include "weblayer/browser/favicon/favicon_service_impl.h"
 #include "weblayer/browser/favicon/favicon_service_impl_factory.h"
 #include "weblayer/browser/heavy_ad_service_factory.h"
@@ -112,9 +111,6 @@ void BrowsingDataRemoverDelegate::RemoveEmbedderData(
   if (remove_mask & DATA_TYPE_SITE_SETTINGS) {
     browsing_data::RemoveSiteSettingsData(delete_begin, delete_end,
                                           host_content_settings_map);
-
-    // Reset the Default Search Engine permissions to their default.
-    ResetDsePermissions(browser_context_);
   }
 
   RunCallbackIfDone();
diff --git a/chromium/weblayer/browser/browsing_data_remover_delegate.h b/chromium/weblayer/browser/browsing_data_remover_delegate.h
index 588c1469702..70585079bd3 100644
--- a/chromium/weblayer/browser/browsing_data_remover_delegate.h
+++ b/chromium/weblayer/browser/browsing_data_remover_delegate.h
@@ -6,6 +6,7 @@
 #define WEBLAYER_BROWSER_BROWSING_DATA_REMOVER_DELEGATE_H_
 
 #include "base/callback.h"
+#include "base/memory/raw_ptr.h"
 #include "base/memory/weak_ptr.h"
 #include "components/keyed_service/core/keyed_service.h"
 #include "content/public/browser/browsing_data_remover.h"
@@ -62,7 +63,7 @@ class BrowsingDataRemoverDelegate : public content::BrowsingDataRemoverDelegate,
 
   void RunCallbackIfDone();
 
-  content::BrowserContext* browser_context_ = nullptr;
+  raw_ptr<content::BrowserContext> browser_context_ = nullptr;
 
   int pending_tasks_ = 0;
 
diff --git a/chromium/weblayer/browser/captive_portal_service_factory.h b/chromium/weblayer/browser/captive_portal_service_factory.h
index d9a9715742a..cc48d0ec95b 100644
--- a/chromium/weblayer/browser/captive_portal_service_factory.h
+++ b/chromium/weblayer/browser/captive_portal_service_factory.h
@@ -6,7 +6,6 @@
 #define WEBLAYER_BROWSER_CAPTIVE_PORTAL_SERVICE_FACTORY_H_
 
 #include "base/compiler_specific.h"
-#include "base/macros.h"
 #include "base/memory/singleton.h"
 #include "components/keyed_service/content/browser_context_keyed_service_factory.h"
 
diff --git a/chromium/weblayer/browser/client_hints_browsertest.cc b/chromium/weblayer/browser/client_hints_browsertest.cc
index f7e6c01b30e..9fa210cfe73 100644
--- a/chromium/weblayer/browser/client_hints_browsertest.cc
+++ b/chromium/weblayer/browser/client_hints_browsertest.cc
@@ -31,8 +31,7 @@ class ClientHintsBrowserTest : public WebLayerBrowserTest {
   void SetAcceptClientHints() {
     NavigateAndWaitForCompletion(
         embedded_test_server()->GetURL(
-            "/set-header?Accept-CH: device-memory,rtt&Accept-CH-Lifetime: "
-            "86400"),
+            "/set-header?Accept-CH: device-memory,rtt"),
         shell());
   }
 
diff --git a/chromium/weblayer/browser/client_hints_factory.cc b/chromium/weblayer/browser/client_hints_factory.cc
index 39385c5cb03..38e631b777e 100644
--- a/chromium/weblayer/browser/client_hints_factory.cc
+++ b/chromium/weblayer/browser/client_hints_factory.cc
@@ -41,7 +41,7 @@ KeyedService* ClientHintsFactory::BuildServiceInstanceFor(
       context, BrowserProcess::GetInstance()->GetNetworkQualityTracker(),
       HostContentSettingsMapFactory::GetForBrowserContext(context),
       CookieSettingsFactory::GetForBrowserContext(context),
-      embedder_support::GetUserAgentMetadata());
+      BrowserProcess::GetInstance()->GetLocalState());
 }
 
 content::BrowserContext* ClientHintsFactory::GetBrowserContextToUse(
diff --git a/chromium/weblayer/browser/clipboard_browsertest.cc b/chromium/weblayer/browser/clipboard_browsertest.cc
index b88b7f204be..595daa4f7dd 100644
--- a/chromium/weblayer/browser/clipboard_browsertest.cc
+++ b/chromium/weblayer/browser/clipboard_browsertest.cc
@@ -56,7 +56,7 @@ class ClipboardBrowserTest : public WebLayerBrowserTest {
   }
 
   GURL GetBaseOrigin() {
-    return embedded_test_server()->base_url().GetOrigin();
+    return embedded_test_server()->base_url().DeprecatedGetOriginAsURL();
   }
 
   permissions::MockPermissionPromptFactory* prompt_factory() {
diff --git a/chromium/weblayer/browser/content_browser_client_impl.cc b/chromium/weblayer/browser/content_browser_client_impl.cc
index 7d49191ad3f..f7797c18f26 100644
--- a/chromium/weblayer/browser/content_browser_client_impl.cc
+++ b/chromium/weblayer/browser/content_browser_client_impl.cc
@@ -7,7 +7,6 @@
 #include <utility>
 
 #include "base/command_line.h"
-#include "base/containers/contains.h"
 #include "base/containers/flat_set.h"
 #include "base/files/file.h"
 #include "base/files/file_util.h"
@@ -137,7 +136,6 @@
 #include "content/public/browser/browser_thread.h"
 #include "mojo/public/cpp/bindings/self_owned_receiver.h"
 #include "ui/base/resource/resource_bundle_android.h"
-#include "weblayer/browser/android/metrics/weblayer_metrics_navigation_throttle.h"
 #include "weblayer/browser/android/metrics/weblayer_metrics_service_client.h"
 #include "weblayer/browser/android_descriptors.h"
 #include "weblayer/browser/bluetooth/weblayer_bluetooth_delegate_impl_client.h"
@@ -309,12 +307,12 @@ ContentBrowserClientImpl::~ContentBrowserClientImpl() = default;
 
 std::unique_ptr<content::BrowserMainParts>
 ContentBrowserClientImpl::CreateBrowserMainParts(
-    const content::MainFunctionParams& parameters) {
+    content::MainFunctionParams parameters) {
   // This should be called after CreateFeatureListAndFieldTrials(), which
   // creates |local_state_|.
   DCHECK(local_state_);
   std::unique_ptr<BrowserMainPartsImpl> browser_main_parts =
-      std::make_unique<BrowserMainPartsImpl>(params_, parameters,
+      std::make_unique<BrowserMainPartsImpl>(params_, std::move(parameters),
                                              std::move(local_state_));
 
   return browser_main_parts;
@@ -329,16 +327,6 @@ std::string ContentBrowserClientImpl::GetAcceptLangs(
   return i18n::GetAcceptLangs();
 }
 
-bool ContentBrowserClientImpl::AllowAppCache(
-    const GURL& manifest_url,
-    const net::SiteForCookies& site_for_cookies,
-    const absl::optional<url::Origin>& top_frame_origin,
-    content::BrowserContext* context) {
-  return embedder_support::AllowAppCache(
-      manifest_url, site_for_cookies, top_frame_origin,
-      CookieSettingsFactory::GetForBrowserContext(context).get());
-}
-
 content::AllowServiceWorkerResult ContentBrowserClientImpl::AllowServiceWorker(
     const GURL& scope,
     const net::SiteForCookies& site_for_cookies,
@@ -637,7 +625,7 @@ void ContentBrowserClientImpl::OverridePageVisibilityState(
       NoStatePrefetchManagerFactory::GetForBrowserContext(
           web_contents->GetBrowserContext());
   if (no_state_prefetch_manager &&
-      no_state_prefetch_manager->IsWebContentsPrerendering(web_contents)) {
+      no_state_prefetch_manager->IsWebContentsPrefetching(web_contents)) {
     *visibility_state = content::PageVisibilityState::kHiddenButPainting;
   }
 }
@@ -783,16 +771,17 @@ ContentBrowserClientImpl::CreateThrottlesForNavigation(
     navigation_controller =
         static_cast<NavigationControllerImpl*>(tab->GetNavigationController());
   }
+
+  NavigationImpl* navigation_impl = nullptr;
+  if (navigation_controller) {
+    navigation_impl =
+        navigation_controller->GetNavigationImplFromHandle(handle);
+  }
+
   if (handle->IsInMainFrame()) {
     NavigationUIDataImpl* navigation_ui_data =
         static_cast<NavigationUIDataImpl*>(handle->GetNavigationUIData());
 
-    NavigationImpl* navigation_impl = nullptr;
-    if (navigation_controller) {
-      navigation_impl =
-          navigation_controller->GetNavigationImplFromHandle(handle);
-    }
-
     if ((!navigation_ui_data ||
          !navigation_ui_data->disable_network_error_auto_reload()) &&
         (!navigation_impl ||
@@ -804,11 +793,6 @@ ContentBrowserClientImpl::CreateThrottlesForNavigation(
         throttles.push_back(std::move(auto_reload_throttle));
     }
 
-#if defined(OS_ANDROID)
-    throttles.push_back(
-        std::make_unique<WebLayerMetricsNavigationThrottle>(handle));
-#endif
-
     // MetricsNavigationThrottle requires that it runs before
     // NavigationThrottles that may delay or cancel navigations, so only
     // NavigationThrottles that don't delay or cancel navigations (e.g.
@@ -852,14 +836,15 @@ ContentBrowserClientImpl::CreateThrottlesForNavigation(
   }
 
 #if defined(OS_ANDROID)
-  if (handle->IsInMainFrame()) {
-    if (base::FeatureList::IsEnabled(features::kWebLayerSafeBrowsing) &&
-        IsSafebrowsingSupported()) {
-      throttles.push_back(
-          GetSafeBrowsingService()->CreateSafeBrowsingNavigationThrottle(
-              handle));
-    }
+  if (IsSafebrowsingSupported()) {
+    std::unique_ptr<content::NavigationThrottle> safe_browsing_throttle =
+        GetSafeBrowsingService()->MaybeCreateSafeBrowsingNavigationThrottleFor(
+            handle);
+    if (safe_browsing_throttle)
+      throttles.push_back(std::move(safe_browsing_throttle));
+  }
 
+  if (!navigation_impl || !navigation_impl->disable_intent_processing()) {
     std::unique_ptr<content::NavigationThrottle> intercept_navigation_throttle =
         navigation_interception::InterceptNavigationDelegate::
             MaybeCreateThrottleFor(
@@ -1153,7 +1138,7 @@ ContentBrowserClientImpl::CreateLoginDelegate(
     const net::AuthChallengeInfo& auth_info,
     content::WebContents* web_contents,
     const content::GlobalRequestID& request_id,
-    bool is_main_frame,
+    bool is_request_for_primary_main_frame,
     const GURL& url,
     scoped_refptr<net::HttpResponseHeaders> response_headers,
     bool first_auth_attempt,
@@ -1223,8 +1208,7 @@ bool ContentBrowserClientImpl::IsClipboardPasteAllowed(
 
   const GURL& url = render_frame_host->GetLastCommittedOrigin().GetURL();
   content::BrowserContext* browser_context =
-      content::WebContents::FromRenderFrameHost(render_frame_host)
-          ->GetBrowserContext();
+      render_frame_host->GetBrowserContext();
   DCHECK(browser_context);
 
   content::PermissionController* permission_controller =
@@ -1243,4 +1227,9 @@ bool ContentBrowserClientImpl::IsClipboardPasteAllowed(
   return true;
 }
 
+bool ContentBrowserClientImpl::ShouldPreconnectNavigation(
+    content::BrowserContext* browser_context) {
+  return true;
+}
+
 }  // namespace weblayer
diff --git a/chromium/weblayer/browser/content_browser_client_impl.h b/chromium/weblayer/browser/content_browser_client_impl.h
index 4f7ed021656..a3d515d95f9 100644
--- a/chromium/weblayer/browser/content_browser_client_impl.h
+++ b/chromium/weblayer/browser/content_browser_client_impl.h
@@ -11,6 +11,7 @@
 #include "base/callback.h"
 #include "base/compiler_specific.h"
 #include "base/files/file_path.h"
+#include "base/memory/raw_ptr.h"
 #include "build/build_config.h"
 #include "build/chromeos_buildflags.h"
 #include "content/public/browser/child_process_security_policy.h"
@@ -49,13 +50,9 @@ class ContentBrowserClientImpl : public content::ContentBrowserClient {
 
   // ContentBrowserClient overrides.
   std::unique_ptr<content::BrowserMainParts> CreateBrowserMainParts(
-      const content::MainFunctionParams& parameters) override;
+      content::MainFunctionParams parameters) override;
   std::string GetApplicationLocale() override;
   std::string GetAcceptLangs(content::BrowserContext* context) override;
-  bool AllowAppCache(const GURL& manifest_url,
-                     const net::SiteForCookies& site_for_cookies,
-                     const absl::optional<url::Origin>& top_frame_origin,
-                     content::BrowserContext* context) override;
   content::AllowServiceWorkerResult AllowServiceWorker(
       const GURL& scope,
       const net::SiteForCookies& site_for_cookies,
@@ -210,7 +207,7 @@ class ContentBrowserClientImpl : public content::ContentBrowserClient {
       const net::AuthChallengeInfo& auth_info,
       content::WebContents* web_contents,
       const content::GlobalRequestID& request_id,
-      bool is_main_frame,
+      bool is_request_for_primary_main_frame,
       const GURL& url,
       scoped_refptr<net::HttpResponseHeaders> response_headers,
       bool first_auth_attempt,
@@ -229,6 +226,8 @@ class ContentBrowserClientImpl : public content::ContentBrowserClient {
   bool HasErrorPage(int http_status_code) override;
   bool IsClipboardPasteAllowed(
       content::RenderFrameHost* render_frame_host) override;
+  bool ShouldPreconnectNavigation(
+      content::BrowserContext* browser_context) override;
 
   void CreateFeatureListAndFieldTrials();
 
@@ -241,7 +240,7 @@ class ContentBrowserClientImpl : public content::ContentBrowserClient {
   std::unique_ptr<permissions::BluetoothDelegateImpl> bluetooth_delegate_;
 #endif
 
-  MainParams* params_;
+  raw_ptr<MainParams> params_;
 
   // Local-state is created early on, before BrowserProcess. Ownership moves to
   // BrowserMainParts, then BrowserProcess. BrowserProcess ultimately owns
diff --git a/chromium/weblayer/browser/content_view_render_view.cc b/chromium/weblayer/browser/content_view_render_view.cc
index 6dc244d6947..f8b7c13775e 100644
--- a/chromium/weblayer/browser/content_view_render_view.cc
+++ b/chromium/weblayer/browser/content_view_render_view.cc
@@ -155,7 +155,9 @@ void ContentViewRenderView::SurfaceChanged(
 }
 
 void ContentViewRenderView::SetNeedsRedraw(JNIEnv* env) {
-  compositor_->SetNeedsRedraw();
+  if (compositor_) {
+    compositor_->SetNeedsRedraw();
+  }
 }
 
 base::android::ScopedJavaLocalRef<jobject>
@@ -179,6 +181,12 @@ void ContentViewRenderView::SetRequiresAlphaChannel(
   UpdateBackgroundColor(env);
 }
 
+void ContentViewRenderView::SetDidSwapBuffersCallbackEnabled(JNIEnv* env,
+                                                             jboolean enable) {
+  InitCompositor();
+  compositor_->SetDidSwapBuffersCallbackEnabled(enable);
+}
+
 void ContentViewRenderView::UpdateLayerTreeHost() {
   // TODO(wkorman): Rename Layout to UpdateLayerTreeHost in all Android
   // Compositor related classes.
diff --git a/chromium/weblayer/browser/content_view_render_view.h b/chromium/weblayer/browser/content_view_render_view.h
index c7110bd24ac..f9c9fdd2668 100644
--- a/chromium/weblayer/browser/content_view_render_view.h
+++ b/chromium/weblayer/browser/content_view_render_view.h
@@ -9,7 +9,7 @@
 
 #include "base/android/jni_weak_ref.h"
 #include "base/callback.h"
-#include "base/macros.h"
+#include "base/memory/raw_ptr.h"
 #include "base/memory/weak_ptr.h"
 #include "content/public/browser/android/compositor_client.h"
 #include "ui/gfx/native_widget_types.h"
@@ -68,6 +68,7 @@ class ContentViewRenderView : public content::CompositorClient {
   base::android::ScopedJavaLocalRef<jobject> GetResourceManager(JNIEnv* env);
   void UpdateBackgroundColor(JNIEnv* env);
   void SetRequiresAlphaChannel(JNIEnv* env, jboolean requires_alpha_channel);
+  void SetDidSwapBuffersCallbackEnabled(JNIEnv* env, jboolean enable);
 
   // CompositorClient implementation
   void UpdateLayerTreeHost() override;
@@ -83,7 +84,7 @@ class ContentViewRenderView : public content::CompositorClient {
   base::android::ScopedJavaGlobalRef<jobject> java_obj_;
   bool use_transparent_background_ = false;
   bool requires_alpha_channel_ = false;
-  content::WebContents* web_contents_ = nullptr;
+  raw_ptr<content::WebContents> web_contents_ = nullptr;
 
   std::unique_ptr<content::Compositor> compositor_;
 
diff --git a/chromium/weblayer/browser/cookie_manager_impl.cc b/chromium/weblayer/browser/cookie_manager_impl.cc
index 7e9e5f928a9..b9724341648 100644
--- a/chromium/weblayer/browser/cookie_manager_impl.cc
+++ b/chromium/weblayer/browser/cookie_manager_impl.cc
@@ -76,7 +76,7 @@ void CookieManagerImpl::GetCookie(const GURL& url, GetCookieCallback callback) {
   browser_context_->GetDefaultStoragePartition()
       ->GetCookieManagerForBrowserProcess()
       ->GetCookieList(url, net::CookieOptions::MakeAllInclusive(),
-                      net::CookiePartitionKeychain::Todo(),
+                      net::CookiePartitionKeyCollection::Todo(),
                       base::BindOnce(&GetCookieComplete, std::move(callback)));
 }
 
diff --git a/chromium/weblayer/browser/cookie_manager_impl.h b/chromium/weblayer/browser/cookie_manager_impl.h
index 4729b481bbe..3fbd6eaff8a 100644
--- a/chromium/weblayer/browser/cookie_manager_impl.h
+++ b/chromium/weblayer/browser/cookie_manager_impl.h
@@ -5,6 +5,7 @@
 #ifndef WEBLAYER_BROWSER_COOKIE_MANAGER_IMPL_H_
 #define WEBLAYER_BROWSER_COOKIE_MANAGER_IMPL_H_
 
+#include "base/memory/raw_ptr.h"
 #include "base/memory/weak_ptr.h"
 #include "build/build_config.h"
 #include "mojo/public/cpp/bindings/receiver_set.h"
@@ -71,7 +72,7 @@ class CookieManagerImpl : public CookieManager {
   void OnCookieSet(SetCookieCallback callback, bool success);
   void OnFlushTimerFired();
 
-  content::BrowserContext* browser_context_;
+  raw_ptr<content::BrowserContext> browser_context_;
   mojo::ReceiverSet<network::mojom::CookieChangeListener,
                     std::unique_ptr<network::mojom::CookieChangeListener>>
       cookie_change_receivers_;
diff --git a/chromium/weblayer/browser/default_search_engine.cc b/chromium/weblayer/browser/default_search_engine.cc
deleted file mode 100644
index 3999231b639..00000000000
--- a/chromium/weblayer/browser/default_search_engine.cc
+++ /dev/null
@@ -1,41 +0,0 @@
-// Copyright 2020 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "weblayer/browser/default_search_engine.h"
-
-#include "base/no_destructor.h"
-#include "components/content_settings/core/browser/host_content_settings_map.h"
-#include "content/public/browser/browser_context.h"
-#include "url/gurl.h"
-#include "url/origin.h"
-#include "weblayer/browser/host_content_settings_map_factory.h"
-
-namespace weblayer {
-
-const url::Origin& GetDseOrigin() {
-  static const base::NoDestructor<url::Origin> kOrigin(
-      url::Origin::Create(GURL("https://www.google.com")));
-  return *kOrigin;
-}
-
-bool IsPermissionControlledByDse(ContentSettingsType type,
-                                 const url::Origin& origin) {
-  return type == ContentSettingsType::GEOLOCATION && GetDseOrigin() == origin;
-}
-
-bool IsDseOrigin(const url::Origin& origin) {
-  return GetDseOrigin() == origin;
-}
-
-void ResetDsePermissions(content::BrowserContext* browser_context) {
-  // Incognito should still have to prompt for permissions.
-  if (browser_context->IsOffTheRecord())
-    return;
-  GURL url = GetDseOrigin().GetURL();
-  HostContentSettingsMapFactory::GetForBrowserContext(browser_context)
-      ->SetContentSettingDefaultScope(
-          url, url, ContentSettingsType::GEOLOCATION, CONTENT_SETTING_ALLOW);
-}
-
-}  // namespace weblayer
diff --git a/chromium/weblayer/browser/default_search_engine.h b/chromium/weblayer/browser/default_search_engine.h
deleted file mode 100644
index 930db3d63f8..00000000000
--- a/chromium/weblayer/browser/default_search_engine.h
+++ /dev/null
@@ -1,39 +0,0 @@
-// Copyright 2020 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef WEBLAYER_BROWSER_DEFAULT_SEARCH_ENGINE_H_
-#define WEBLAYER_BROWSER_DEFAULT_SEARCH_ENGINE_H_
-
-#include "components/content_settings/core/common/content_settings.h"
-
-namespace content {
-class BrowserContext;
-}
-
-namespace url {
-class Origin;
-}
-
-namespace weblayer {
-const url::Origin& GetDseOrigin();
-
-// Returns whether permissions for |type| and |origin| are controlled by
-// WebLayer's default search engine logic. This only applies to the GEOLOCATION
-// permission, which will be force allowed and controlled by the client app's
-// system level location permissions.
-bool IsPermissionControlledByDse(ContentSettingsType type,
-                                 const url::Origin& origin);
-
-// Returns whether the provided |origin| matches the Weblayer's default search
-// engine logic.
-bool IsDseOrigin(const url::Origin& origin);
-
-// Resets all permissions managed by WebLayer for the default search engine.
-// TODO(crbug.com/1063433): If this logic gets more complicated consider
-// refactoring SearchPermissionsService to be used in WebLayer.
-void ResetDsePermissions(content::BrowserContext* browser_context);
-
-}  // namespace weblayer
-
-#endif  // WEBLAYER_BROWSER_DEFAULT_SEARCH_ENGINE_H_
diff --git a/chromium/weblayer/browser/default_search_engine_browsertest.cc b/chromium/weblayer/browser/default_search_engine_browsertest.cc
deleted file mode 100644
index 3695e647b02..00000000000
--- a/chromium/weblayer/browser/default_search_engine_browsertest.cc
+++ /dev/null
@@ -1,54 +0,0 @@
-// Copyright 2020 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "components/content_settings/core/browser/host_content_settings_map.h"
-#include "content/public/test/browser_test_utils.h"
-#include "weblayer/browser/default_search_engine.h"
-#include "weblayer/browser/host_content_settings_map_factory.h"
-#include "weblayer/browser/tab_impl.h"
-#include "weblayer/shell/browser/shell.h"
-#include "weblayer/test/weblayer_browser_test.h"
-#include "weblayer/test/weblayer_browser_test_utils.h"
-
-namespace weblayer {
-
-using DefaultSearchEngineBrowserTest = WebLayerBrowserTest;
-
-IN_PROC_BROWSER_TEST_F(DefaultSearchEngineBrowserTest,
-                       HasGeolocationPermission) {
-  auto* settings_map = HostContentSettingsMapFactory::GetForBrowserContext(
-      static_cast<TabImpl*>(shell()->tab())
-          ->web_contents()
-          ->GetBrowserContext());
-  auto origin = GetDseOrigin().GetURL();
-  EXPECT_EQ(settings_map->GetContentSetting(origin, origin,
-                                            ContentSettingsType::GEOLOCATION),
-            CONTENT_SETTING_ALLOW);
-  EXPECT_EQ(settings_map->GetContentSetting(origin, origin,
-                                            ContentSettingsType::NOTIFICATIONS),
-            CONTENT_SETTING_ASK);
-}
-
-class IncognitoDefaultSearchEngineBrowserTest
-    : public DefaultSearchEngineBrowserTest {
- public:
-  IncognitoDefaultSearchEngineBrowserTest() { SetShellStartsInIncognitoMode(); }
-};
-
-IN_PROC_BROWSER_TEST_F(IncognitoDefaultSearchEngineBrowserTest,
-                       IncognitoDoesNotHaveGeolocationPermission) {
-  auto* settings_map = HostContentSettingsMapFactory::GetForBrowserContext(
-      static_cast<TabImpl*>(shell()->tab())
-          ->web_contents()
-          ->GetBrowserContext());
-  auto origin = GetDseOrigin().GetURL();
-  EXPECT_EQ(settings_map->GetContentSetting(origin, origin,
-                                            ContentSettingsType::GEOLOCATION),
-            CONTENT_SETTING_ASK);
-  EXPECT_EQ(settings_map->GetContentSetting(origin, origin,
-                                            ContentSettingsType::NOTIFICATIONS),
-            CONTENT_SETTING_ASK);
-}
-
-}  // namespace weblayer
diff --git a/chromium/weblayer/browser/devtools_manager_delegate_android.h b/chromium/weblayer/browser/devtools_manager_delegate_android.h
index a94f178612e..f5d1ad01a85 100644
--- a/chromium/weblayer/browser/devtools_manager_delegate_android.h
+++ b/chromium/weblayer/browser/devtools_manager_delegate_android.h
@@ -5,7 +5,6 @@
 #ifndef WEBLAYER_BROWSER_DEVTOOLS_MANAGER_DELEGATE_ANDROID_H_
 #define WEBLAYER_BROWSER_DEVTOOLS_MANAGER_DELEGATE_ANDROID_H_
 
-#include "base/macros.h"
 #include "content/public/browser/devtools_manager_delegate.h"
 
 namespace weblayer {
diff --git a/chromium/weblayer/browser/download_browsertest.cc b/chromium/weblayer/browser/download_browsertest.cc
index 0f1fb10999e..25637a4745b 100644
--- a/chromium/weblayer/browser/download_browsertest.cc
+++ b/chromium/weblayer/browser/download_browsertest.cc
@@ -11,6 +11,7 @@
 #include "base/task/post_task.h"
 #include "base/test/bind.h"
 #include "base/threading/thread_restrictions.h"
+#include "build/build_config.h"
 #include "content/public/browser/download_manager.h"
 #include "content/public/browser/web_contents.h"
 #include "content/public/test/slow_download_http_response.h"
@@ -230,7 +231,13 @@ IN_PROC_BROWSER_TEST_F(DownloadBrowserTest, Basic) {
             download_location().DirName());
 }
 
-IN_PROC_BROWSER_TEST_F(DownloadBrowserTest, OverrideDownloadDirectory) {
+// Test consistently failing on android: crbug.com/1273105
+#if defined(OS_ANDROID)
+#define MAYBE_OverrideDownloadDirectory DISABLED_OverrideDownloadDirectory
+#else
+#define MAYBE_OverrideDownloadDirectory OverrideDownloadDirectory
+#endif
+IN_PROC_BROWSER_TEST_F(DownloadBrowserTest, MAYBE_OverrideDownloadDirectory) {
   base::ScopedAllowBlockingForTesting allow_blocking;
   base::ScopedTempDir download_dir;
   ASSERT_TRUE(download_dir.CreateUniqueTempDir());
diff --git a/chromium/weblayer/browser/download_callback_proxy.h b/chromium/weblayer/browser/download_callback_proxy.h
index 1b6ea6b70f4..09b9f4b839e 100644
--- a/chromium/weblayer/browser/download_callback_proxy.h
+++ b/chromium/weblayer/browser/download_callback_proxy.h
@@ -9,7 +9,7 @@
 
 #include "base/android/scoped_java_ref.h"
 #include "base/callback.h"
-#include "base/macros.h"
+#include "base/memory/raw_ptr.h"
 #include "weblayer/public/download_delegate.h"
 
 namespace weblayer {
@@ -43,7 +43,7 @@ class DownloadCallbackProxy : public DownloadDelegate {
   void DownloadFailed(Download* download) override;
 
  private:
-  Profile* profile_;
+  raw_ptr<Profile> profile_;
   base::android::ScopedJavaGlobalRef<jobject> java_delegate_;
 };
 
diff --git a/chromium/weblayer/browser/download_impl.h b/chromium/weblayer/browser/download_impl.h
index 6b7ae60b9fb..dd5490ca061 100644
--- a/chromium/weblayer/browser/download_impl.h
+++ b/chromium/weblayer/browser/download_impl.h
@@ -5,7 +5,6 @@
 #ifndef WEBLAYER_BROWSER_DOWNLOAD_IMPL_H_
 #define WEBLAYER_BROWSER_DOWNLOAD_IMPL_H_
 
-#include "base/macros.h"
 #include "base/memory/weak_ptr.h"
 #include "base/supports_user_data.h"
 #include "build/build_config.h"
diff --git a/chromium/weblayer/browser/download_manager_delegate_impl.h b/chromium/weblayer/browser/download_manager_delegate_impl.h
index d950cd54408..efa594d7a5b 100644
--- a/chromium/weblayer/browser/download_manager_delegate_impl.h
+++ b/chromium/weblayer/browser/download_manager_delegate_impl.h
@@ -6,6 +6,7 @@
 #define WEBLAYER_BROWSER_DOWNLOAD_MANAGER_DELEGATE_IMPL_H_
 
 #include "base/callback_forward.h"
+#include "base/memory/raw_ptr.h"
 #include "base/memory/weak_ptr.h"
 #include "components/download/public/common/download_item.h"
 #include "content/public/browser/download_manager.h"
@@ -80,7 +81,7 @@ class DownloadManagerDelegateImpl : public content::DownloadManagerDelegate,
   DownloadDelegate* GetDelegate(content::BrowserContext* browser_context);
   DownloadDelegate* GetDelegate(download::DownloadItem* item);
 
-  content::DownloadManager* download_manager_;
+  raw_ptr<content::DownloadManager> download_manager_;
   base::RepeatingClosure download_dropped_callback_;
   base::WeakPtrFactory<DownloadManagerDelegateImpl> weak_ptr_factory_{this};
 };
diff --git a/chromium/weblayer/browser/error_page_callback_proxy.h b/chromium/weblayer/browser/error_page_callback_proxy.h
index 80d2efbbb0f..181b7e0b6e8 100644
--- a/chromium/weblayer/browser/error_page_callback_proxy.h
+++ b/chromium/weblayer/browser/error_page_callback_proxy.h
@@ -8,7 +8,7 @@
 #include <jni.h>
 
 #include "base/android/scoped_java_ref.h"
-#include "base/macros.h"
+#include "base/memory/raw_ptr.h"
 #include "weblayer/public/error_page_delegate.h"
 
 namespace weblayer {
@@ -32,7 +32,7 @@ class ErrorPageCallbackProxy : public ErrorPageDelegate {
       Navigation* navigation) override;
 
  private:
-  Tab* tab_;
+  raw_ptr<Tab> tab_;
   base::android::ScopedJavaGlobalRef<jobject> java_impl_;
 };
 
diff --git a/chromium/weblayer/browser/errorpage_browsertest.cc b/chromium/weblayer/browser/errorpage_browsertest.cc
index 9c28ab3c323..f33d4e1cf37 100644
--- a/chromium/weblayer/browser/errorpage_browsertest.cc
+++ b/chromium/weblayer/browser/errorpage_browsertest.cc
@@ -2,9 +2,9 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+#include "base/memory/raw_ptr.h"
 #include "weblayer/test/weblayer_browser_test.h"
 
-#include "base/macros.h"
 #include "base/test/bind.h"
 #include "base/test/scoped_feature_list.h"
 #include "build/build_config.h"
@@ -116,7 +116,7 @@ class ErrorPageReloadBrowserTest : public ErrorPageBrowserTest {
     }
 
    private:
-    NavigationController* controller_;
+    raw_ptr<NavigationController> controller_;
   };
 };
 
diff --git a/chromium/weblayer/browser/favicon/favicon_backend_wrapper.cc b/chromium/weblayer/browser/favicon/favicon_backend_wrapper.cc
index d68108dc902..42e18493d40 100644
--- a/chromium/weblayer/browser/favicon/favicon_backend_wrapper.cc
+++ b/chromium/weblayer/browser/favicon/favicon_backend_wrapper.cc
@@ -6,7 +6,7 @@
 
 #include "base/files/file_util.h"
 #include "base/logging.h"
-#include "base/sequenced_task_runner.h"
+#include "base/task/sequenced_task_runner.h"
 #include "components/favicon/core/favicon_backend.h"
 #include "components/favicon/core/favicon_database.h"
 
diff --git a/chromium/weblayer/browser/favicon/favicon_fetcher_impl.h b/chromium/weblayer/browser/favicon/favicon_fetcher_impl.h
index 3a68e377b3f..e1eadce23d9 100644
--- a/chromium/weblayer/browser/favicon/favicon_fetcher_impl.h
+++ b/chromium/weblayer/browser/favicon/favicon_fetcher_impl.h
@@ -7,6 +7,7 @@
 
 #include <memory>
 
+#include "base/memory/raw_ptr.h"
 #include "weblayer/browser/favicon/favicon_tab_helper.h"
 #include "weblayer/public/favicon_fetcher.h"
 
@@ -32,7 +33,7 @@ class FaviconFetcherImpl : public FaviconFetcher {
   gfx::Image GetFavicon() override;
 
  private:
-  content::WebContents* web_contents_;
+  raw_ptr<content::WebContents> web_contents_;
   std::unique_ptr<FaviconTabHelper::ObserverSubscription>
       observer_subscription_;
 };
diff --git a/chromium/weblayer/browser/favicon/favicon_service_impl.h b/chromium/weblayer/browser/favicon/favicon_service_impl.h
index 695c36f3c4d..196768b15cd 100644
--- a/chromium/weblayer/browser/favicon/favicon_service_impl.h
+++ b/chromium/weblayer/browser/favicon/favicon_service_impl.h
@@ -7,6 +7,7 @@
 
 #include <unordered_set>
 
+#include "base/memory/raw_ptr.h"
 #include "base/memory/ref_counted.h"
 #include "base/sequence_checker.h"
 #include "components/favicon/core/core_favicon_service.h"
@@ -105,7 +106,7 @@ class FaviconServiceImpl : public favicon::CoreFaviconService,
   std::unordered_set<MissingFaviconUrlHash> missing_favicon_urls_;
 
   // This is only used in tests, where only a single observer is necessary.
-  FaviconServiceImplObserver* observer_ = nullptr;
+  raw_ptr<FaviconServiceImplObserver> observer_ = nullptr;
 };
 
 }  // namespace weblayer
diff --git a/chromium/weblayer/browser/favicon/favicon_tab_helper.cc b/chromium/weblayer/browser/favicon/favicon_tab_helper.cc
index d7af4db4a4c..ff075d26523 100644
--- a/chromium/weblayer/browser/favicon/favicon_tab_helper.cc
+++ b/chromium/weblayer/browser/favicon/favicon_tab_helper.cc
@@ -59,7 +59,8 @@ FaviconTabHelper::RegisterFaviconFetcherDelegate(
 }
 
 FaviconTabHelper::FaviconTabHelper(content::WebContents* contents)
-    : WebContentsObserver(contents) {}
+    : content::WebContentsUserData<FaviconTabHelper>(*contents),
+      WebContentsObserver(contents) {}
 
 void FaviconTabHelper::AddDelegate(FaviconFetcherDelegate* delegate) {
   delegates_.AddObserver(delegate);
diff --git a/chromium/weblayer/browser/favicon/favicon_tab_helper.h b/chromium/weblayer/browser/favicon/favicon_tab_helper.h
index 5558ab16665..1f44c66c1a3 100644
--- a/chromium/weblayer/browser/favicon/favicon_tab_helper.h
+++ b/chromium/weblayer/browser/favicon/favicon_tab_helper.h
@@ -7,6 +7,7 @@
 
 #include <memory>
 
+#include "base/memory/raw_ptr.h"
 #include "base/observer_list.h"
 #include "components/favicon/core/favicon_driver_observer.h"
 #include "content/public/browser/web_contents_observer.h"
@@ -38,8 +39,8 @@ class FaviconTabHelper : public content::WebContentsUserData<FaviconTabHelper>,
     ObserverSubscription(FaviconTabHelper* helper,
                          FaviconFetcherDelegate* delegate);
 
-    FaviconTabHelper* helper_;
-    FaviconFetcherDelegate* delegate_;
+    raw_ptr<FaviconTabHelper> helper_;
+    raw_ptr<FaviconFetcherDelegate> delegate_;
   };
 
   FaviconTabHelper(const FaviconTabHelper&) = delete;
@@ -73,7 +74,7 @@ class FaviconTabHelper : public content::WebContentsUserData<FaviconTabHelper>,
   void DidFinishNavigation(
       content::NavigationHandle* navigation_handle) override;
 
-  content::WebContents* web_contents_;
+  raw_ptr<content::WebContents> web_contents_;
   // Number of observers attached.
   int observer_count_ = 0;
   base::ObserverList<FaviconFetcherDelegate> delegates_;
diff --git a/chromium/weblayer/browser/feature_list_creator.cc b/chromium/weblayer/browser/feature_list_creator.cc
index d0281242f88..b4e16a871f1 100644
--- a/chromium/weblayer/browser/feature_list_creator.cc
+++ b/chromium/weblayer/browser/feature_list_creator.cc
@@ -78,7 +78,7 @@ void FeatureListCreator::SetUpFieldTrials() {
   // Pass false for |extend_variations_safe_mode| to temporarily opt out of the
   // Extended Variations Safe Mode experiment.
   // TODO(crbug/1245347): Enable the experiment on Android WebLayer.
-  variations_service_->SetupFieldTrials(
+  variations_service_->SetUpFieldTrials(
       variation_ids,
       content::GetSwitchDependentFeatureOverrides(
           *base::CommandLine::ForCurrentProcess()),
diff --git a/chromium/weblayer/browser/feature_list_creator.h b/chromium/weblayer/browser/feature_list_creator.h
index 99e704b0fd5..fbc837f9ac2 100644
--- a/chromium/weblayer/browser/feature_list_creator.h
+++ b/chromium/weblayer/browser/feature_list_creator.h
@@ -7,6 +7,7 @@
 
 #include <memory>
 
+#include "base/memory/raw_ptr.h"
 #include "weblayer/browser/weblayer_field_trials.h"
 
 class PrefService;
@@ -54,9 +55,10 @@ class FeatureListCreator {
   void SetUpFieldTrials();
 
   // Owned by BrowserProcess.
-  PrefService* local_state_;
+  raw_ptr<PrefService> local_state_;
 
-  SystemNetworkContextManager* system_network_context_manager_;  // NOT OWNED.
+  raw_ptr<SystemNetworkContextManager>
+      system_network_context_manager_;  // NOT OWNED.
 
   std::unique_ptr<variations::VariationsService> variations_service_;
 
diff --git a/chromium/weblayer/browser/file_select_helper.h b/chromium/weblayer/browser/file_select_helper.h
index 986bfdc7413..bc35ea2a7b6 100644
--- a/chromium/weblayer/browser/file_select_helper.h
+++ b/chromium/weblayer/browser/file_select_helper.h
@@ -8,7 +8,6 @@
 #include <memory>
 #include <vector>
 
-#include "base/macros.h"
 #include "base/memory/weak_ptr.h"
 #include "content/public/browser/browser_thread.h"
 #include "content/public/browser/file_select_listener.h"
diff --git a/chromium/weblayer/browser/fullscreen_callback_proxy.h b/chromium/weblayer/browser/fullscreen_callback_proxy.h
index 100f7dc4372..9c23a774966 100644
--- a/chromium/weblayer/browser/fullscreen_callback_proxy.h
+++ b/chromium/weblayer/browser/fullscreen_callback_proxy.h
@@ -9,7 +9,7 @@
 
 #include "base/android/scoped_java_ref.h"
 #include "base/callback.h"
-#include "base/macros.h"
+#include "base/memory/raw_ptr.h"
 #include "weblayer/public/fullscreen_delegate.h"
 
 namespace weblayer {
@@ -36,7 +36,7 @@ class FullscreenCallbackProxy : public FullscreenDelegate {
   void DoExitFullscreen(JNIEnv* env);
 
  private:
-  Tab* tab_;
+  raw_ptr<Tab> tab_;
   base::android::ScopedJavaGlobalRef<jobject> java_delegate_;
   base::OnceClosure exit_fullscreen_closure_;
 };
diff --git a/chromium/weblayer/browser/google_account_access_token_fetcher_proxy.h b/chromium/weblayer/browser/google_account_access_token_fetcher_proxy.h
index 4b6cf5903c7..114a1333e7a 100644
--- a/chromium/weblayer/browser/google_account_access_token_fetcher_proxy.h
+++ b/chromium/weblayer/browser/google_account_access_token_fetcher_proxy.h
@@ -9,7 +9,7 @@
 
 #include "base/android/scoped_java_ref.h"
 #include "base/callback.h"
-#include "base/macros.h"
+#include "base/memory/raw_ptr.h"
 #include "weblayer/public/google_account_access_token_fetch_delegate.h"
 
 namespace weblayer {
@@ -39,7 +39,7 @@ class GoogleAccountAccessTokenFetcherProxy
 
  private:
   base::android::ScopedJavaGlobalRef<jobject> java_delegate_;
-  Profile* profile_;
+  raw_ptr<Profile> profile_;
 };
 
 }  // namespace weblayer
diff --git a/chromium/weblayer/browser/google_accounts_callback_proxy.h b/chromium/weblayer/browser/google_accounts_callback_proxy.h
index 577fb305a4c..216be92608f 100644
--- a/chromium/weblayer/browser/google_accounts_callback_proxy.h
+++ b/chromium/weblayer/browser/google_accounts_callback_proxy.h
@@ -8,6 +8,7 @@
 #include <jni.h>
 
 #include "base/android/scoped_java_ref.h"
+#include "base/memory/raw_ptr.h"
 #include "weblayer/public/google_accounts_delegate.h"
 
 namespace weblayer {
@@ -25,7 +26,7 @@ class GoogleAccountsCallbackProxy : public GoogleAccountsDelegate {
   std::string GetGaiaId() override;
 
  private:
-  Tab* tab_;
+  raw_ptr<Tab> tab_;
   base::android::ScopedJavaGlobalRef<jobject> java_impl_;
 };
 
diff --git a/chromium/weblayer/browser/host_content_settings_map_factory.h b/chromium/weblayer/browser/host_content_settings_map_factory.h
index b72c287cd4b..85390dd64cc 100644
--- a/chromium/weblayer/browser/host_content_settings_map_factory.h
+++ b/chromium/weblayer/browser/host_content_settings_map_factory.h
@@ -5,7 +5,6 @@
 #ifndef WEBLAYER_BROWSER_HOST_CONTENT_SETTINGS_MAP_FACTORY_H_
 #define WEBLAYER_BROWSER_HOST_CONTENT_SETTINGS_MAP_FACTORY_H_
 
-#include "base/macros.h"
 #include "base/memory/ref_counted.h"
 #include "base/memory/singleton.h"
 #include "components/keyed_service/content/refcounted_browser_context_keyed_service_factory.h"
diff --git a/chromium/weblayer/browser/http_auth_handler_impl.cc b/chromium/weblayer/browser/http_auth_handler_impl.cc
index 73bf47584a7..20879227740 100644
--- a/chromium/weblayer/browser/http_auth_handler_impl.cc
+++ b/chromium/weblayer/browser/http_auth_handler_impl.cc
@@ -20,7 +20,7 @@ HttpAuthHandlerImpl::HttpAuthHandlerImpl(
     content::WebContents* web_contents,
     bool first_auth_attempt,
     LoginAuthRequiredCallback callback)
-    : WebContentsObserver(web_contents), callback_(std::move(callback)) {
+    : callback_(std::move(callback)) {
   DCHECK_CURRENTLY_ON(content::BrowserThread::UI);
 
   url_ = auth_info.challenger.GetURL().Resolve(auth_info.path);
diff --git a/chromium/weblayer/browser/http_auth_handler_impl.h b/chromium/weblayer/browser/http_auth_handler_impl.h
index 62627a82ba1..b6780cc279d 100644
--- a/chromium/weblayer/browser/http_auth_handler_impl.h
+++ b/chromium/weblayer/browser/http_auth_handler_impl.h
@@ -8,14 +8,12 @@
 #include "base/android/scoped_java_ref.h"
 #include "content/public/browser/content_browser_client.h"
 #include "content/public/browser/login_delegate.h"
-#include "content/public/browser/web_contents_observer.h"
 #include "url/gurl.h"
 
 namespace weblayer {
 
 // Implements support for http auth.
-class HttpAuthHandlerImpl : public content::LoginDelegate,
-                            public content::WebContentsObserver {
+class HttpAuthHandlerImpl : public content::LoginDelegate {
  public:
   HttpAuthHandlerImpl(const net::AuthChallengeInfo& auth_info,
                       content::WebContents* web_contents,
@@ -38,4 +36,4 @@ class HttpAuthHandlerImpl : public content::LoginDelegate,
 
 }  // namespace weblayer
 
-#endif  // WEBLAYER_BROWSER_HTTP_AUTH_HANDLER_IMPL_H_
-\ No newline at end of file
+#endif  // WEBLAYER_BROWSER_HTTP_AUTH_HANDLER_IMPL_H_
diff --git a/chromium/weblayer/browser/infobar_container_android.h b/chromium/weblayer/browser/infobar_container_android.h
index b407d100989..7c3a8af1e0e 100644
--- a/chromium/weblayer/browser/infobar_container_android.h
+++ b/chromium/weblayer/browser/infobar_container_android.h
@@ -10,7 +10,6 @@
 #include "base/android/jni_weak_ref.h"
 #include "base/android/scoped_java_ref.h"
 #include "base/compiler_specific.h"
-#include "base/macros.h"
 #include "components/infobars/core/infobar_container.h"
 
 namespace weblayer {
diff --git a/chromium/weblayer/browser/insecure_form_controller_client.h b/chromium/weblayer/browser/insecure_form_controller_client.h
index d88af6d45da..ad2510e837e 100644
--- a/chromium/weblayer/browser/insecure_form_controller_client.h
+++ b/chromium/weblayer/browser/insecure_form_controller_client.h
@@ -5,6 +5,7 @@
 #ifndef WEBLAYER_BROWSER_INSECURE_FORM_CONTROLLER_CLIENT_H_
 #define WEBLAYER_BROWSER_INSECURE_FORM_CONTROLLER_CLIENT_H_
 
+#include "base/memory/raw_ptr.h"
 #include "components/security_interstitials/content/security_interstitial_controller_client.h"
 #include "components/security_interstitials/core/metrics_helper.h"
 
@@ -37,7 +38,7 @@ class InsecureFormControllerClient
   void Proceed() override;
 
  private:
-  content::WebContents* web_contents_;
+  raw_ptr<content::WebContents> web_contents_;
 };
 
 }  // namespace weblayer
diff --git a/chromium/weblayer/browser/java/org/chromium/weblayer_private/BrowserImpl.java b/chromium/weblayer/browser/java/org/chromium/weblayer_private/BrowserImpl.java
index 2f8e859684f..79ac46f1ef4 100644
--- a/chromium/weblayer/browser/java/org/chromium/weblayer_private/BrowserImpl.java
+++ b/chromium/weblayer/browser/java/org/chromium/weblayer_private/BrowserImpl.java
@@ -208,7 +208,8 @@ public class BrowserImpl extends IBrowser.Stub implements View.OnAttachStateChan
                     BrowserImplJni.get().getBrowserPersisterCryptoKey(mNativeBrowser));
         } else if (!hasPersistenceId) {
             outState.putByteArray(SAVED_STATE_MINIMAL_PERSISTENCE_STATE_KEY,
-                    BrowserImplJni.get().getMinimalPersistenceState(mNativeBrowser));
+                    BrowserImplJni.get().getMinimalPersistenceState(mNativeBrowser,
+                            WebLayerImpl.getMaxNavigationsPerTabForInstanceState()));
         }
 
         if (mWindowAndroid != null) {
@@ -716,7 +717,7 @@ public class BrowserImpl extends IBrowser.Stub implements View.OnAttachStateChan
         String getPersistenceId(long nativeBrowserImpl);
         void saveBrowserPersisterIfNecessary(long nativeBrowserImpl);
         byte[] getBrowserPersisterCryptoKey(long nativeBrowserImpl);
-        byte[] getMinimalPersistenceState(long nativeBrowserImpl);
+        byte[] getMinimalPersistenceState(long nativeBrowserImpl, int maxNavigationsPerTab);
         void restoreStateIfNecessary(long nativeBrowserImpl, String persistenceId,
                 byte[] persistenceCryptoKey, byte[] minimalPersistenceState);
         void webPreferencesChanged(long nativeBrowserImpl);
diff --git a/chromium/weblayer/browser/java/org/chromium/weblayer_private/ContentViewRenderView.java b/chromium/weblayer/browser/java/org/chromium/weblayer_private/ContentViewRenderView.java
index ed95cc3a693..e675a3e8854 100644
--- a/chromium/weblayer/browser/java/org/chromium/weblayer_private/ContentViewRenderView.java
+++ b/chromium/weblayer/browser/java/org/chromium/weblayer_private/ContentViewRenderView.java
@@ -159,6 +159,7 @@ public class ContentViewRenderView
                 mSurfaceData.setSurfaceDataNeedsDestroy(ContentViewRenderView.this.mCurrent);
             }
             ContentViewRenderView.this.mCurrent = mSurfaceData;
+            updateNeedsDidSwapBuffersCallback();
             ContentViewRenderViewJni.get().surfaceCreated(mNativeContentViewRenderView);
         }
 
@@ -493,6 +494,12 @@ public class ContentViewRenderView
             for (Runnable r : callbacks) {
                 r.run();
             }
+            updateNeedsDidSwapBuffersCallback();
+        }
+
+        public boolean hasSurfaceRedrawNeededCallbacks() {
+            return mSurfaceRedrawNeededCallbacks != null
+                    && !mSurfaceRedrawNeededCallbacks.isEmpty();
         }
 
         public View getView() {
@@ -558,6 +565,7 @@ public class ContentViewRenderView
                 mSurfaceRedrawNeededCallbacks = new ArrayList<>();
             }
             mSurfaceRedrawNeededCallbacks.add(drawingFinished);
+            updateNeedsDidSwapBuffersCallback();
             ContentViewRenderViewJni.get().setNeedsRedraw(mNativeContentViewRenderView);
         }
 
@@ -663,9 +671,19 @@ public class ContentViewRenderView
 
     // This is a child of ContentViewRenderView and parent of SurfaceView/TextureView.
     // This exists to avoid resizing SurfaceView/TextureView when the soft keyboard is displayed.
+    // Also has workaround for SurfaceView `onAttachedToWindow` visual glitch.
     private class SurfaceParent extends FrameLayout {
+        // This view is used to cover up any SurfaceView/TextureView for a few frames immediately
+        // after `onAttachedToWindow`. This is the workaround a bug in SurfaceView (on some versions
+        // of android) which punches a hole before the surface below has any content, resulting in
+        // black for a few frames. `mCoverView` is a workaround for this bug. It covers up
+        // SurfaceView/TextureView with the background color, and is removed after a few swaps.
+        private final View mCoverView;
+        private int mNumSwapsUntilHideCover;
+
         public SurfaceParent(Context context) {
             super(context);
+            mCoverView = new View(context);
         }
 
         @Override
@@ -695,6 +713,38 @@ public class ContentViewRenderView
             mPhysicalWidth = w;
             mPhysicalHeight = h;
         }
+
+        @Override
+        protected void onAttachedToWindow() {
+            super.onAttachedToWindow();
+            mNumSwapsUntilHideCover = 2;
+            // Add as the top child covering up any other children.
+            addView(mCoverView,
+                    new FrameLayout.LayoutParams(FrameLayout.LayoutParams.MATCH_PARENT,
+                            FrameLayout.LayoutParams.MATCH_PARENT));
+            if (mNativeContentViewRenderView != 0) {
+                ContentViewRenderViewJni.get().setNeedsRedraw(mNativeContentViewRenderView);
+            }
+        }
+
+        @Override
+        protected void onDetachedFromWindow() {
+            super.onDetachedFromWindow();
+            mNumSwapsUntilHideCover = 0;
+            removeView(mCoverView);
+        }
+
+        /** @return true if should keep swapping frames */
+        public boolean didSwapFrame() {
+            if (mNumSwapsUntilHideCover <= 0) return false;
+            mNumSwapsUntilHideCover--;
+            if (mNumSwapsUntilHideCover == 0) removeView(mCoverView);
+            return mNumSwapsUntilHideCover > 0;
+        }
+
+        public void updateCoverViewColor(int color) {
+            mCoverView.setBackgroundColor(color);
+        }
     }
 
     /**
@@ -859,6 +909,7 @@ public class ContentViewRenderView
 
         mBackgroundColor = color;
         super.setBackgroundColor(color);
+        mSurfaceParent.updateCoverViewColor(color);
         if (mRequested != null) {
             mRequested.setBackgroundColor(color);
         }
@@ -926,7 +977,7 @@ public class ContentViewRenderView
 
         while (!mPendingRunnables.isEmpty()) {
             TrackedRunnable runnable = mPendingRunnables.get(0);
-            removeCallbacks(runnable);
+            mSurfaceParent.removeCallbacks(runnable);
             runnable.run();
             assert !mPendingRunnables.contains(runnable);
         }
@@ -957,7 +1008,9 @@ public class ContentViewRenderView
     @CalledByNative
     private boolean didSwapFrame() {
         assert mCurrent != null;
-        return mCurrent.didSwapFrame();
+        boolean ret = mCurrent.didSwapFrame();
+        ret = ret || mSurfaceParent.didSwapFrame();
+        return ret;
     }
 
     @CalledByNative
@@ -967,6 +1020,14 @@ public class ContentViewRenderView
         mCurrent.runSurfaceRedrawNeededCallbacks();
     }
 
+    // Should be called any time inputs used to compute `needsDidSwapBuffersCallback` change.
+    private void updateNeedsDidSwapBuffersCallback() {
+        boolean needsDidSwapBuffersCallback =
+                mCurrent != null && mCurrent.hasSurfaceRedrawNeededCallbacks();
+        ContentViewRenderViewJni.get().setDidSwapBuffersCallbackEnabled(
+                mNativeContentViewRenderView, needsDidSwapBuffersCallback);
+    }
+
     private void evictCachedSurface() {
         if (mNativeContentViewRenderView == 0) return;
         ContentViewRenderViewJni.get().evictCachedSurface(mNativeContentViewRenderView);
@@ -1042,5 +1103,6 @@ public class ContentViewRenderView
         void updateBackgroundColor(long nativeContentViewRenderView);
         void setRequiresAlphaChannel(
                 long nativeContentViewRenderView, boolean requiresAlphaChannel);
+        void setDidSwapBuffersCallbackEnabled(long nativeContentViewRenderView, boolean enabled);
     }
 }
diff --git a/chromium/weblayer/browser/java/org/chromium/weblayer_private/ExternalNavigationDelegateImpl.java b/chromium/weblayer/browser/java/org/chromium/weblayer_private/ExternalNavigationDelegateImpl.java
index 967dab2fac5..72c3b39d56b 100644
--- a/chromium/weblayer/browser/java/org/chromium/weblayer_private/ExternalNavigationDelegateImpl.java
+++ b/chromium/weblayer/browser/java/org/chromium/weblayer_private/ExternalNavigationDelegateImpl.java
@@ -6,16 +6,14 @@ package org.chromium.weblayer_private;
 
 import android.content.Context;
 import android.content.Intent;
-import android.content.pm.ResolveInfo;
 import android.os.RemoteException;
 
 import androidx.annotation.Nullable;
 
 import org.chromium.base.Callback;
 import org.chromium.base.Function;
-import org.chromium.base.PackageManagerUtils;
+import org.chromium.components.embedder_support.util.UrlUtilities;
 import org.chromium.components.external_intents.ExternalNavigationDelegate;
-import org.chromium.components.external_intents.ExternalNavigationDelegate.StartActivityIfNeededResult;
 import org.chromium.components.external_intents.ExternalNavigationParams;
 import org.chromium.content_public.browser.LoadUrlParams;
 import org.chromium.content_public.browser.WebContents;
@@ -82,6 +80,12 @@ public class ExternalNavigationDelegateImpl implements ExternalNavigationDelegat
     }
 
     @Override
+    public boolean shouldAvoidDisambiguationDialog(Intent intent) {
+        // Don't show the disambiguation dialog if WebLayer can handle the intent.
+        return UrlUtilities.isAcceptedScheme(intent.toUri(0));
+    }
+
+    @Override
     public void loadUrlIfPossible(LoadUrlParams loadUrlParams) {
         if (!hasValidTab()) return;
         mTab.loadUrl(loadUrlParams);
@@ -217,13 +221,8 @@ public class ExternalNavigationDelegateImpl implements ExternalNavigationDelegat
         return false;
     }
 
-    /**
-     * Resolve the default external handler of an intent.
-     * @return Whether the default external handler is found.
-     */
-    private boolean hasDefaultHandler(Intent intent) {
-        ResolveInfo info = PackageManagerUtils.resolveActivity(intent, 0);
-        if (info == null) return false;
-        return info.match != 0;
+    @Override
+    public boolean maybeSetTargetPackage(Intent intent) {
+        return false;
     }
 }
diff --git a/chromium/weblayer/browser/java/org/chromium/weblayer_private/NavigationControllerImpl.java b/chromium/weblayer/browser/java/org/chromium/weblayer_private/NavigationControllerImpl.java
index 02166780d11..5dcefd7b1bf 100644
--- a/chromium/weblayer/browser/java/org/chromium/weblayer_private/NavigationControllerImpl.java
+++ b/chromium/weblayer/browser/java/org/chromium/weblayer_private/NavigationControllerImpl.java
@@ -20,7 +20,6 @@ import org.chromium.weblayer_private.interfaces.INavigationController;
 import org.chromium.weblayer_private.interfaces.INavigationControllerClient;
 import org.chromium.weblayer_private.interfaces.IObjectWrapper;
 import org.chromium.weblayer_private.interfaces.NavigateParams;
-import org.chromium.weblayer_private.interfaces.NavigationState;
 import org.chromium.weblayer_private.interfaces.ObjectWrapper;
 import org.chromium.weblayer_private.interfaces.StrictModeWorkaround;
 
@@ -241,17 +240,12 @@ public final class NavigationControllerImpl extends INavigationController.Stub {
     }
 
     @CalledByNative
+    private void getOrCreatePageForNavigation(NavigationImpl navigation) throws RemoteException {
+        navigation.getPage();
+    }
+
+    @CalledByNative
     private void navigationCompleted(NavigationImpl navigation) throws RemoteException {
-        if (navigation.getState() == NavigationState.COMPLETE) {
-            // Ensure that the Java-side Page object for this navigation is populated from and
-            // linked to the native Page object (which is guaranteed to exist at this point, since
-            // this is a committed navigation). Without this call, the Java-side navigation object
-            // won't be created and linked to the native object until/unless the client calls
-            // Navigation#getPage(), which is problematic when implementation-side callers need to
-            // bridge the C++ Page object into Java (e.g., to fire
-            // NavigationCallback#onPageLanguageDetermined()).
-            navigation.getPage();
-        }
         mNavigationControllerClient.navigationCompleted(navigation.getClientNavigation());
     }
 
@@ -261,9 +255,9 @@ public final class NavigationControllerImpl extends INavigationController.Stub {
     }
 
     @CalledByNative
-    private void loadStateChanged(boolean isLoading, boolean toDifferentDocument)
+    private void loadStateChanged(boolean isLoading, boolean shouldShowLoadingUi)
             throws RemoteException {
-        mNavigationControllerClient.loadStateChanged(isLoading, toDifferentDocument);
+        mNavigationControllerClient.loadStateChanged(isLoading, shouldShowLoadingUi);
     }
 
     @CalledByNative
diff --git a/chromium/weblayer/browser/java/org/chromium/weblayer_private/NavigationImpl.java b/chromium/weblayer/browser/java/org/chromium/weblayer_private/NavigationImpl.java
index d75f24f0b7a..212df3c7442 100644
--- a/chromium/weblayer/browser/java/org/chromium/weblayer_private/NavigationImpl.java
+++ b/chromium/weblayer/browser/java/org/chromium/weblayer_private/NavigationImpl.java
@@ -213,6 +213,13 @@ public final class NavigationImpl extends INavigation.Stub {
     }
 
     @Override
+    public void disableIntentProcessing() {
+        if (!NavigationImplJni.get().disableIntentProcessing(mNativeNavigationImpl)) {
+            throw new IllegalStateException();
+        }
+    }
+
+    @Override
     public boolean isFormSubmission() {
         StrictModeWorkaround.apply();
         throwIfNativeDestroyed();
@@ -320,6 +327,7 @@ public final class NavigationImpl extends INavigation.Stub {
         boolean isReload(long nativeNavigationImpl);
         boolean isServedFromBackForwardCache(long nativeNavigationImpl);
         boolean disableNetworkErrorAutoReload(long nativeNavigationImpl);
+        boolean disableIntentProcessing(long nativeNavigationImpl);
         boolean areIntentLaunchesAllowedInBackground(long nativeNavigationImpl);
         boolean isFormSubmission(long nativeNavigationImpl);
         String getReferrer(long nativeNavigationImpl);
diff --git a/chromium/weblayer/browser/java/org/chromium/weblayer_private/UrlBarControllerImpl.java b/chromium/weblayer/browser/java/org/chromium/weblayer_private/UrlBarControllerImpl.java
index 414c9f8969f..663e0da0624 100644
--- a/chromium/weblayer/browser/java/org/chromium/weblayer_private/UrlBarControllerImpl.java
+++ b/chromium/weblayer/browser/java/org/chromium/weblayer_private/UrlBarControllerImpl.java
@@ -32,6 +32,7 @@ import org.chromium.components.embedder_support.util.UrlUtilities;
 import org.chromium.components.omnibox.SecurityButtonAnimationDelegate;
 import org.chromium.components.omnibox.SecurityStatusIcon;
 import org.chromium.components.page_info.PageInfoController;
+import org.chromium.components.page_info.PageInfoHighlight;
 import org.chromium.components.security_state.ConnectionSecurityLevel;
 import org.chromium.content_public.browser.WebContents;
 import org.chromium.weblayer_private.interfaces.IObjectWrapper;
@@ -132,7 +133,7 @@ public class UrlBarControllerImpl extends IUrlBarController.Stub {
         PageInfoController.show(mBrowserImpl.getWindowAndroid().getActivity().get(), webContents,
                 publisherUrl, PageInfoController.OpenedFromSource.TOOLBAR,
                 PageInfoControllerDelegateImpl.create(webContents),
-                PageInfoController.NO_HIGHLIGHTED_PERMISSION);
+                PageInfoHighlight.noHighlight());
     }
 
     protected class UrlBarView
diff --git a/chromium/weblayer/browser/java/org/chromium/weblayer_private/WebLayerImpl.java b/chromium/weblayer/browser/java/org/chromium/weblayer_private/WebLayerImpl.java
index 000421e568b..6774271235c 100644
--- a/chromium/weblayer/browser/java/org/chromium/weblayer_private/WebLayerImpl.java
+++ b/chromium/weblayer/browser/java/org/chromium/weblayer_private/WebLayerImpl.java
@@ -63,7 +63,6 @@ import org.chromium.components.component_updater.ComponentLoaderPolicyBridge;
 import org.chromium.components.component_updater.EmbeddedComponentLoader;
 import org.chromium.components.embedder_support.application.ClassLoaderContextWrapperFactory;
 import org.chromium.components.embedder_support.application.FirebaseConfig;
-import org.chromium.components.embedder_support.util.Origin;
 import org.chromium.components.payments.PaymentDetailsUpdateService;
 import org.chromium.content_public.browser.BrowserStartupController;
 import org.chromium.content_public.browser.ChildProcessCreationParams;
@@ -138,6 +137,9 @@ public final class WebLayerImpl extends IWebLayer.Stub {
     // //build/android/gyp/util/protoresources.py and WebViewChromiumFactoryProvider.java.
     private static final int REQUIRED_PACKAGE_IDENTIFIER = 36;
 
+    // 0 results in using the default value.
+    private static int sMaxNavigationsForInstanceState = 0;
+
     private final ProfileManager mProfileManager = new ProfileManager();
 
     private boolean mInited;
@@ -547,6 +549,16 @@ public final class WebLayerImpl extends IWebLayer.Stub {
         return ObjectWrapper.wrap(ContextUtils.getApplicationContext());
     }
 
+    public static int getMaxNavigationsPerTabForInstanceState() {
+        try {
+            return (WebLayerFactoryImpl.getClientMajorVersion() >= 98)
+                    ? sClient.getMaxNavigationsPerTabForInstanceState()
+                    : 0;
+        } catch (RemoteException e) {
+            throw new APICallException(e);
+        }
+    }
+
     public static Intent createIntent() {
         if (sClient == null) {
             throw new IllegalStateException("WebLayer should have been initialized already.");
@@ -639,13 +651,6 @@ public final class WebLayerImpl extends IWebLayer.Stub {
                 .toString();
     }
 
-    public static boolean isLocationPermissionManaged(Origin origin) {
-        if (origin == null) {
-            return false;
-        }
-        return WebLayerImplJni.get().isLocationPermissionManaged(origin.toString());
-    }
-
     /**
      * Converts the given id into a resource ID that can be shown in system UI, such as
      * notifications.
@@ -1003,7 +1008,6 @@ public final class WebLayerImpl extends IWebLayer.Stub {
         void setIsWebViewCompatMode(boolean value);
         String getUserAgentString();
         void registerExternalExperimentIDs(int[] experimentIDs);
-        boolean isLocationPermissionManaged(String origin);
         ComponentLoaderPolicyBridge[] getComponentLoaderPolicies();
     }
 }
diff --git a/chromium/weblayer/browser/java/org/chromium/weblayer_private/interfaces/INavigation.aidl b/chromium/weblayer/browser/java/org/chromium/weblayer_private/interfaces/INavigation.aidl
index 1fd8e02b39b..1ba5335bcd2 100644
--- a/chromium/weblayer/browser/java/org/chromium/weblayer_private/interfaces/INavigation.aidl
+++ b/chromium/weblayer/browser/java/org/chromium/weblayer_private/interfaces/INavigation.aidl
@@ -54,4 +54,8 @@ interface INavigation {
 
   // @since 92
   int getNavigationEntryOffset() = 22;
+
+  // @since 97
+  void disableIntentProcessing() = 23;
+
 }
diff --git a/chromium/weblayer/browser/java/org/chromium/weblayer_private/interfaces/INavigationControllerClient.aidl b/chromium/weblayer/browser/java/org/chromium/weblayer_private/interfaces/INavigationControllerClient.aidl
index 5eeeb5847a4..09cd8eb0cfc 100644
--- a/chromium/weblayer/browser/java/org/chromium/weblayer_private/interfaces/INavigationControllerClient.aidl
+++ b/chromium/weblayer/browser/java/org/chromium/weblayer_private/interfaces/INavigationControllerClient.aidl
@@ -26,7 +26,7 @@ interface INavigationControllerClient {
 
   void navigationFailed(IClientNavigation navigation) = 5;
 
-  void loadStateChanged(boolean isLoading, boolean toDifferentDocument) = 6;
+  void loadStateChanged(boolean isLoading, boolean shouldShowLoadingUi) = 6;
 
   void loadProgressChanged(double progress) = 7;
 
diff --git a/chromium/weblayer/browser/java/org/chromium/weblayer_private/interfaces/IWebLayerClient.aidl b/chromium/weblayer/browser/java/org/chromium/weblayer_private/interfaces/IWebLayerClient.aidl
index e8f34f60aad..c109ce758de 100644
--- a/chromium/weblayer/browser/java/org/chromium/weblayer_private/interfaces/IWebLayerClient.aidl
+++ b/chromium/weblayer/browser/java/org/chromium/weblayer_private/interfaces/IWebLayerClient.aidl
@@ -19,4 +19,7 @@ interface IWebLayerClient {
   Intent createRemoteMediaServiceIntent() = 7;
   int getPresentationApiNotificationId() = 8;
   int getRemotePlaybackApiNotificationId() = 9;
+
+  // Added in Version 98.
+  int getMaxNavigationsPerTabForInstanceState() = 10;
 }
diff --git a/chromium/weblayer/browser/java/org/chromium/weblayer_private/settings/WebLayerSiteSettingsDelegate.java b/chromium/weblayer/browser/java/org/chromium/weblayer_private/settings/WebLayerSiteSettingsDelegate.java
index 0aaac28cf66..26f35435739 100644
--- a/chromium/weblayer/browser/java/org/chromium/weblayer_private/settings/WebLayerSiteSettingsDelegate.java
+++ b/chromium/weblayer/browser/java/org/chromium/weblayer_private/settings/WebLayerSiteSettingsDelegate.java
@@ -11,7 +11,6 @@ import androidx.annotation.Nullable;
 import androidx.preference.Preference;
 
 import org.chromium.base.Callback;
-import org.chromium.base.ContextUtils;
 import org.chromium.components.browser_ui.settings.ManagedPreferenceDelegate;
 import org.chromium.components.browser_ui.site_settings.SiteSettingsCategory.Type;
 import org.chromium.components.browser_ui.site_settings.SiteSettingsDelegate;
@@ -80,22 +79,12 @@ public class WebLayerSiteSettingsDelegate
     @Override
     @Nullable
     public String getDelegateAppNameForOrigin(Origin origin, @ContentSettingsType int type) {
-        if (WebLayerImpl.isLocationPermissionManaged(origin)
-                && type == ContentSettingsType.GEOLOCATION) {
-            return WebLayerImpl.getClientApplicationName();
-        }
-
         return null;
     }
 
     @Override
     @Nullable
     public String getDelegatePackageNameForOrigin(Origin origin, @ContentSettingsType int type) {
-        if (WebLayerImpl.isLocationPermissionManaged(origin)
-                && type == ContentSettingsType.GEOLOCATION) {
-            return ContextUtils.getApplicationContext().getPackageName();
-        }
-
         return null;
     }
 
diff --git a/chromium/weblayer/browser/java/org/chromium/weblayer_private/test_interfaces/ITestWebLayer.aidl b/chromium/weblayer/browser/java/org/chromium/weblayer_private/test_interfaces/ITestWebLayer.aidl
index 9c24c4141f4..46c577521c5 100644
--- a/chromium/weblayer/browser/java/org/chromium/weblayer_private/test_interfaces/ITestWebLayer.aidl
+++ b/chromium/weblayer/browser/java/org/chromium/weblayer_private/test_interfaces/ITestWebLayer.aidl
@@ -99,4 +99,7 @@ interface ITestWebLayer {
   // Simulates the implementation-side event of an access token being
   // identified as invalid.
   void fireOnAccessTokenIdentifiedAsInvalid(in IProfile profile, in IObjectWrapper /* Set<String */ scopes, in IObjectWrapper /* String */ token) = 29;
+
+  // Grants `url` location permission.
+  void grantLocationPermission(String url) = 30;
 }
diff --git a/chromium/weblayer/browser/javascript_tab_modal_dialog_manager_delegate_android.h b/chromium/weblayer/browser/javascript_tab_modal_dialog_manager_delegate_android.h
index 46264f02f71..90526f1afde 100644
--- a/chromium/weblayer/browser/javascript_tab_modal_dialog_manager_delegate_android.h
+++ b/chromium/weblayer/browser/javascript_tab_modal_dialog_manager_delegate_android.h
@@ -5,6 +5,7 @@
 #ifndef WEBLAYER_BROWSER_JAVASCRIPT_TAB_MODAL_DIALOG_MANAGER_DELEGATE_ANDROID_H_
 #define WEBLAYER_BROWSER_JAVASCRIPT_TAB_MODAL_DIALOG_MANAGER_DELEGATE_ANDROID_H_
 
+#include "base/memory/raw_ptr.h"
 #include "components/javascript_dialogs/tab_modal_dialog_manager_delegate.h"
 
 namespace content {
@@ -40,7 +41,7 @@ class JavaScriptTabModalDialogManagerDelegateAndroid
   bool IsApp() override;
 
  private:
-  content::WebContents* web_contents_;
+  raw_ptr<content::WebContents> web_contents_;
 };
 
 }  // namespace weblayer
diff --git a/chromium/weblayer/browser/js_communication/web_message_browsertest.cc b/chromium/weblayer/browser/js_communication/web_message_browsertest.cc
index 815cd961039..064273adcce 100644
--- a/chromium/weblayer/browser/js_communication/web_message_browsertest.cc
+++ b/chromium/weblayer/browser/js_communication/web_message_browsertest.cc
@@ -5,6 +5,7 @@
 #include "weblayer/public/js_communication/web_message.h"
 
 #include "base/callback.h"
+#include "base/memory/raw_ptr.h"
 #include "base/run_loop.h"
 #include "base/strings/utf_string_conversions.h"
 #include "base/test/scoped_feature_list.h"
@@ -84,7 +85,7 @@ class WebMessageHostImpl : public WebMessageHost {
   int call_count_ = 0;
   int back_forward_cache_state_changed_call_count_ = 0;
   base::RepeatingClosure quit_closure_;
-  WebMessageReplyProxy* proxy_;
+  raw_ptr<WebMessageReplyProxy> proxy_;
   std::vector<std::u16string> messages_;
   bool expected_back_forward_value_ = false;
   std::unique_ptr<base::RunLoop> state_changed_run_loop_;
diff --git a/chromium/weblayer/browser/js_communication/web_message_host_factory_wrapper.cc b/chromium/weblayer/browser/js_communication/web_message_host_factory_wrapper.cc
index ad0b2d509c7..e5914a6ec58 100644
--- a/chromium/weblayer/browser/js_communication/web_message_host_factory_wrapper.cc
+++ b/chromium/weblayer/browser/js_communication/web_message_host_factory_wrapper.cc
@@ -4,6 +4,7 @@
 
 #include "weblayer/browser/js_communication/web_message_host_factory_wrapper.h"
 
+#include "base/memory/raw_ptr.h"
 #include "components/js_injection/browser/web_message.h"
 #include "components/js_injection/browser/web_message_host.h"
 #include "components/js_injection/browser/web_message_reply_proxy.h"
@@ -51,7 +52,7 @@ class WebMessageHostWrapper : public js_injection::WebMessageHost,
   }
 
  private:
-  js_injection::WebMessageReplyProxy* proxy_;
+  raw_ptr<js_injection::WebMessageReplyProxy> proxy_;
   std::unique_ptr<weblayer::WebMessageHost> connection_;
 };
 
diff --git a/chromium/weblayer/browser/js_communication/web_message_reply_proxy_impl.h b/chromium/weblayer/browser/js_communication/web_message_reply_proxy_impl.h
index f21bf5dc828..6d884e7179e 100644
--- a/chromium/weblayer/browser/js_communication/web_message_reply_proxy_impl.h
+++ b/chromium/weblayer/browser/js_communication/web_message_reply_proxy_impl.h
@@ -8,6 +8,7 @@
 #include <string>
 
 #include "base/android/scoped_java_ref.h"
+#include "base/memory/raw_ptr.h"
 #include "components/js_injection/browser/web_message_host.h"
 #include "weblayer/public/js_communication/web_message_host.h"
 
@@ -39,7 +40,7 @@ class WebMessageReplyProxyImpl : public WebMessageHost {
   void OnBackForwardCacheStateChanged() override;
 
  private:
-  WebMessageReplyProxy* reply_proxy_;
+  raw_ptr<WebMessageReplyProxy> reply_proxy_;
 
   // The Java WebMessageReplyProxy.
   base::android::ScopedJavaGlobalRef<jobject> java_object_;
diff --git a/chromium/weblayer/browser/navigation_browsertest.cc b/chromium/weblayer/browser/navigation_browsertest.cc
index afa2a57d304..f3a84b77dc9 100644
--- a/chromium/weblayer/browser/navigation_browsertest.cc
+++ b/chromium/weblayer/browser/navigation_browsertest.cc
@@ -2,6 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+#include "base/memory/raw_ptr.h"
 #include "weblayer/test/weblayer_browser_test.h"
 
 #include "base/callback.h"
@@ -99,7 +100,7 @@ class NavigationObserverImpl : public NavigationObserver {
   }
 
  private:
-  NavigationController* controller_;
+  raw_ptr<NavigationController> controller_;
   Callback started_callback_;
   Callback redirected_callback_;
   Callback completed_callback_;
@@ -337,7 +338,7 @@ class BrowserObserverImpl : public BrowserObserver {
 
  private:
   base::RepeatingCallback<void(Tab*)> new_tab_callback_;
-  Browser* browser_;
+  raw_ptr<Browser> browser_;
 };
 
 class NewTabDelegateImpl : public NewTabDelegate {
@@ -805,23 +806,6 @@ class WaitForMediaPlaying : public content::WebContentsObserver {
   base::RunLoop run_loop_;
 };
 
-class WaitForResponseStart : public content::WebContentsObserver {
- public:
-  explicit WaitForResponseStart(content::WebContents* web_contents)
-      : WebContentsObserver(web_contents) {}
-
-  WaitForResponseStart(const WaitForResponseStart&) = delete;
-  WaitForResponseStart& operator=(const WaitForResponseStart&) = delete;
-
-  // WebContentsObserver:
-  void DidReceiveResponse() final { run_loop_.Quit(); }
-
-  void Wait() { run_loop_.Run(); }
-
- private:
-  base::RunLoop run_loop_;
-};
-
 }  // namespace
 
 IN_PROC_BROWSER_TEST_F(NavigationBrowserTest, AutoPlayEnabled) {
@@ -1148,17 +1132,21 @@ IN_PROC_BROWSER_TEST_F(NavigationBrowserTest,
         observer.reset();
       }));
 
+  auto* tab = static_cast<TabImpl*>(shell()->tab());
+  auto wait_for_response_start =
+      std::make_unique<content::TestNavigationManager>(tab->web_contents(),
+                                                       url);
   shell()->LoadURL(url);
+  // Wait until request is ready to start.
+  EXPECT_TRUE(wait_for_response_start->WaitForRequestStart());
+  // Start the request.
+  wait_for_response_start->ResumeNavigation();
+  // Wait for the request to arrive to ControllableHttpResponse.
   response.WaitForRequest();
 
   response.Send(net::HTTP_OK, "text/html", "<html>");
 
-  // Ensure that the navigation has started receiving the response before
-  // proceeding.
-  auto* tab = static_cast<TabImpl*>(shell()->tab());
-  auto wait_for_response_start =
-      std::make_unique<WaitForResponseStart>(tab->web_contents());
-  wait_for_response_start->Wait();
+  ASSERT_TRUE(wait_for_response_start->WaitForResponse());
 
   EXPECT_EQ(NavigationState::kReceivingBytes, ongoing_navigation->GetState());
 
diff --git a/chromium/weblayer/browser/navigation_controller_impl.cc b/chromium/weblayer/browser/navigation_controller_impl.cc
index 47f9c49d008..d93ccd9c726 100644
--- a/chromium/weblayer/browser/navigation_controller_impl.cc
+++ b/chromium/weblayer/browser/navigation_controller_impl.cc
@@ -8,6 +8,7 @@
 
 #include "base/auto_reset.h"
 #include "base/containers/contains.h"
+#include "base/memory/raw_ptr.h"
 #include "base/strings/utf_string_conversions.h"
 #include "content/public/browser/navigation_controller.h"
 #include "content/public/browser/navigation_entry.h"
@@ -100,7 +101,7 @@ class NavigationControllerImpl::NavigationThrottleImpl
   }
 
  private:
-  NavigationControllerImpl* controller_;
+  raw_ptr<NavigationControllerImpl> controller_;
   bool should_cancel_ = false;
 };
 
@@ -361,24 +362,52 @@ void NavigationControllerImpl::Stop() {
 }
 
 int NavigationControllerImpl::GetNavigationListSize() {
+  content::NavigationEntry* current_entry =
+      web_contents()->GetController().GetLastCommittedEntry();
+  if (current_entry && current_entry->IsInitialEntry()) {
+    // If we're currently on the initial NavigationEntry, no navigation has
+    // committed, so the initial NavigationEntry should not be part of the
+    // "Navigation List", and we should return 0 as the navigation list size.
+    // This also preserves the old behavior where we used to not have the
+    // initial NavigationEntry.
+    return 0;
+  }
+
   return web_contents()->GetController().GetEntryCount();
 }
 
 int NavigationControllerImpl::GetNavigationListCurrentIndex() {
+  content::NavigationEntry* current_entry =
+      web_contents()->GetController().GetLastCommittedEntry();
+  if (current_entry && current_entry->IsInitialEntry()) {
+    // If we're currently on the initial NavigationEntry, no navigation has
+    // committed, so the initial NavigationEntry should not be part of the
+    // "Navigation List", and we should return -1 as the current index. This
+    // also preserves the old behavior where we used to not have the initial
+    // NavigationEntry.
+    return -1;
+  }
+
   return web_contents()->GetController().GetCurrentEntryIndex();
 }
 
 GURL NavigationControllerImpl::GetNavigationEntryDisplayURL(int index) {
   auto* entry = web_contents()->GetController().GetEntryAtIndex(index);
-  if (!entry)
-    return GURL();
+  // This function should never be called when GetNavigationListSize() is 0
+  // because `index` should be between 0 and GetNavigationListSize() - 1, which
+  // also means `entry` must not be the initial NavigationEntry.
+  DCHECK_NE(0, GetNavigationListSize());
+  DCHECK(!entry->IsInitialEntry());
   return entry->GetVirtualURL();
 }
 
 std::string NavigationControllerImpl::GetNavigationEntryTitle(int index) {
   auto* entry = web_contents()->GetController().GetEntryAtIndex(index);
-  if (!entry)
-    return std::string();
+  // This function should never be called when GetNavigationListSize() is 0
+  // because `index` should be between 0 and GetNavigationListSize() - 1, which
+  // also means `entry` must not be the initial NavigationEntry.
+  DCHECK_NE(0, GetNavigationListSize());
+  DCHECK(!entry->IsInitialEntry());
   return base::UTF16ToUTF8(entry->GetTitle());
 }
 
@@ -405,6 +434,7 @@ void NavigationControllerImpl::DidStartNavigation(
                                               navigation);
   navigation->set_safe_to_set_request_headers(true);
   navigation->set_safe_to_disable_network_error_auto_reload(true);
+  navigation->set_safe_to_disable_intent_processing(true);
 
 #if defined(OS_ANDROID)
   // Desktop mode and per-navigation UA use the same mechanism and so don't
@@ -447,6 +477,7 @@ void NavigationControllerImpl::DidStartNavigation(
   navigation->set_safe_to_set_user_agent(false);
   navigation->set_safe_to_set_request_headers(false);
   navigation->set_safe_to_disable_network_error_auto_reload(false);
+  navigation->set_safe_to_disable_intent_processing(false);
 }
 
 void NavigationControllerImpl::DidRedirectNavigation(
@@ -506,6 +537,18 @@ void NavigationControllerImpl::DidFinishNavigation(
     auto* rfh = navigation_handle->GetRenderFrameHost();
     PageImpl::GetOrCreateForPage(rfh->GetPage());
     navigation->set_safe_to_get_page();
+
+#if defined(OS_ANDROID)
+    // Ensure that the Java-side Page object for this navigation is
+    // populated from and linked to the native Page object. Without this
+    // call, the Java-side navigation object won't be created and linked to
+    // the native object until/unless the client calls Navigation#getPage(),
+    // which is problematic when implementation-side callers need to bridge
+    // the C++ Page object into Java (e.g., to fire
+    // NavigationCallback#onPageLanguageDetermined()).
+    Java_NavigationControllerImpl_getOrCreatePageForNavigation(
+        AttachCurrentThread(), java_controller_, navigation->java_navigation());
+#endif
   }
 
   // In some corner cases (e.g., a tab closing with an ongoing navigation)
@@ -613,12 +656,12 @@ void NavigationControllerImpl::NotifyLoadStateChanged() {
     TRACE_EVENT0("weblayer", "Java_NavigationControllerImpl_loadStateChanged");
     Java_NavigationControllerImpl_loadStateChanged(
         AttachCurrentThread(), java_controller_, web_contents()->IsLoading(),
-        web_contents()->IsLoadingToDifferentDocument());
+        web_contents()->ShouldShowLoadingUI());
   }
 #endif
   for (auto& observer : observers_) {
     observer.LoadStateChanged(web_contents()->IsLoading(),
-                              web_contents()->IsLoadingToDifferentDocument());
+                              web_contents()->ShouldShowLoadingUI());
   }
 }
 
diff --git a/chromium/weblayer/browser/navigation_controller_impl.h b/chromium/weblayer/browser/navigation_controller_impl.h
index d6d8baeb668..d93e5c80b0e 100644
--- a/chromium/weblayer/browser/navigation_controller_impl.h
+++ b/chromium/weblayer/browser/navigation_controller_impl.h
@@ -8,7 +8,6 @@
 #include <map>
 
 #include <memory>
-#include "base/macros.h"
 #include "base/memory/weak_ptr.h"
 #include "base/observer_list.h"
 #include "build/build_config.h"
diff --git a/chromium/weblayer/browser/navigation_impl.cc b/chromium/weblayer/browser/navigation_impl.cc
index 9f975bae3e8..33dbbb79338 100644
--- a/chromium/weblayer/browser/navigation_impl.cc
+++ b/chromium/weblayer/browser/navigation_impl.cc
@@ -104,6 +104,13 @@ jboolean NavigationImpl::DisableNetworkErrorAutoReload(JNIEnv* env) {
   return true;
 }
 
+jboolean NavigationImpl::DisableIntentProcessing(JNIEnv* env) {
+  if (!safe_to_disable_intent_processing_)
+    return false;
+  disable_intent_processing_ = true;
+  return true;
+}
+
 jboolean NavigationImpl::AreIntentLaunchesAllowedInBackground(JNIEnv* env) {
   NavigationUIDataImpl* navigation_ui_data = static_cast<NavigationUIDataImpl*>(
       navigation_handle_->GetNavigationUIData());
diff --git a/chromium/weblayer/browser/navigation_impl.h b/chromium/weblayer/browser/navigation_impl.h
index 8e3e114b741..1961b3ac0c4 100644
--- a/chromium/weblayer/browser/navigation_impl.h
+++ b/chromium/weblayer/browser/navigation_impl.h
@@ -7,6 +7,7 @@
 
 #include <memory>
 
+#include "base/memory/raw_ptr.h"
 #include "build/build_config.h"
 #include "weblayer/public/navigation.h"
 
@@ -52,6 +53,10 @@ class NavigationImpl : public Navigation {
     safe_to_disable_network_error_auto_reload_ = value;
   }
 
+  void set_safe_to_disable_intent_processing(bool value) {
+    safe_to_disable_intent_processing_ = value;
+  }
+
   void set_safe_to_get_page() { safe_to_get_page_ = true; }
 
   void set_was_stopped() { was_stopped_ = true; }
@@ -62,6 +67,8 @@ class NavigationImpl : public Navigation {
     return disable_network_error_auto_reload_;
   }
 
+  bool disable_intent_processing() { return disable_intent_processing_; }
+
   void set_finished() { finished_ = true; }
 
 #if defined(OS_ANDROID)
@@ -89,6 +96,7 @@ class NavigationImpl : public Navigation {
     return IsServedFromBackForwardCache();
   }
   jboolean DisableNetworkErrorAutoReload(JNIEnv* env);
+  jboolean DisableIntentProcessing(JNIEnv* env);
   jboolean AreIntentLaunchesAllowedInBackground(JNIEnv* env);
   jboolean IsFormSubmission(JNIEnv* env) { return IsFormSubmission(); }
   base::android::ScopedJavaLocalRef<jstring> GetReferrer(JNIEnv* env);
@@ -131,7 +139,7 @@ class NavigationImpl : public Navigation {
   int GetNavigationEntryOffset() override;
 
  private:
-  content::NavigationHandle* navigation_handle_;
+  raw_ptr<content::NavigationHandle> navigation_handle_;
 
   // The NavigationEntry's unique ID for this navigation, or -1 if there isn't
   // one.
@@ -156,11 +164,16 @@ class NavigationImpl : public Navigation {
   // Whether DisableNetworkErrorAutoReload is allowed at this time.
   bool safe_to_disable_network_error_auto_reload_ = false;
 
+  // Whether DisableIntentProcessing is allowed at this time.
+  bool safe_to_disable_intent_processing_ = false;
+
   // Whether GetPage is allowed at this time.
   bool safe_to_get_page_ = false;
 
   bool disable_network_error_auto_reload_ = false;
 
+  bool disable_intent_processing_ = false;
+
   // Whether this navigation has finished.
   bool finished_ = false;
 
diff --git a/chromium/weblayer/browser/new_tab_callback_proxy.h b/chromium/weblayer/browser/new_tab_callback_proxy.h
index 30bf728d907..599e6b5b176 100644
--- a/chromium/weblayer/browser/new_tab_callback_proxy.h
+++ b/chromium/weblayer/browser/new_tab_callback_proxy.h
@@ -8,7 +8,7 @@
 #include <jni.h>
 
 #include "base/android/scoped_java_ref.h"
-#include "base/macros.h"
+#include "base/memory/raw_ptr.h"
 #include "weblayer/public/new_tab_delegate.h"
 
 namespace weblayer {
@@ -30,7 +30,7 @@ class NewTabCallbackProxy : public NewTabDelegate {
   void OnNewTab(Tab* tab, NewTabType type) override;
 
  private:
-  TabImpl* tab_;
+  raw_ptr<TabImpl> tab_;
   base::android::ScopedJavaGlobalRef<jobject> java_impl_;
 };
 
diff --git a/chromium/weblayer/browser/no_state_prefetch/no_state_prefetch_manager_delegate_impl.h b/chromium/weblayer/browser/no_state_prefetch/no_state_prefetch_manager_delegate_impl.h
index 3cf97e0c6f7..02961d1c955 100644
--- a/chromium/weblayer/browser/no_state_prefetch/no_state_prefetch_manager_delegate_impl.h
+++ b/chromium/weblayer/browser/no_state_prefetch/no_state_prefetch_manager_delegate_impl.h
@@ -5,6 +5,7 @@
 #ifndef WEBLAYER_BROWSER_NO_STATE_PREFETCH_NO_STATE_PREFETCH_MANAGER_DELEGATE_IMPL_H_
 #define WEBLAYER_BROWSER_NO_STATE_PREFETCH_NO_STATE_PREFETCH_MANAGER_DELEGATE_IMPL_H_
 
+#include "base/memory/raw_ptr.h"
 #include "components/content_settings/core/browser/cookie_settings.h"
 #include "components/no_state_prefetch/browser/no_state_prefetch_manager_delegate.h"
 
@@ -29,7 +30,7 @@ class NoStatePrefetchManagerDelegateImpl
   std::string GetReasonForDisablingPrediction() override;
 
  private:
-  content::BrowserContext* browser_context_;
+  raw_ptr<content::BrowserContext> browser_context_;
 };
 
 }  // namespace weblayer
diff --git a/chromium/weblayer/browser/no_state_prefetch/prerender_controller_impl.cc b/chromium/weblayer/browser/no_state_prefetch/prerender_controller_impl.cc
index 8a5a512e783..20dd1ef6691 100644
--- a/chromium/weblayer/browser/no_state_prefetch/prerender_controller_impl.cc
+++ b/chromium/weblayer/browser/no_state_prefetch/prerender_controller_impl.cc
@@ -41,12 +41,11 @@ void PrerenderControllerImpl::Prerender(const GURL& url) {
   DCHECK(no_state_prefetch_manager);
 
   // The referrer parameter results in a header being set that lets the server
-  // serving the URL being prerendered see where the request originated. It's
-  // an optional header, it's okay to skip setting it here.
-  // SessionStorageNamespace isn't necessary for NoStatePrefetch, so it's okay
-  // to pass in a nullptr.
+  // serving the URL being prefetched see where the request originated. It's an
+  // optional header, it's okay to skip setting it here. SessionStorageNamespace
+  // isn't necessary for NoStatePrefetch, so it's okay to pass in a nullptr.
   // NoStatePrefetchManager uses default bounds  if the one provided is empty.
-  no_state_prefetch_manager->AddPrerenderFromExternalRequest(
+  no_state_prefetch_manager->StartPrefetchingFromExternalRequest(
       url, content::Referrer(), /* session_storage_namespace= */ nullptr,
       /* bounds= */ gfx::Rect());
 }
diff --git a/chromium/weblayer/browser/no_state_prefetch/prerender_controller_impl.h b/chromium/weblayer/browser/no_state_prefetch/prerender_controller_impl.h
index 5b744e0f595..ac56ece965e 100644
--- a/chromium/weblayer/browser/no_state_prefetch/prerender_controller_impl.h
+++ b/chromium/weblayer/browser/no_state_prefetch/prerender_controller_impl.h
@@ -5,6 +5,7 @@
 #ifndef WEBLAYER_BROWSER_NO_STATE_PREFETCH_PRERENDER_CONTROLLER_IMPL_H_
 #define WEBLAYER_BROWSER_NO_STATE_PREFETCH_PRERENDER_CONTROLLER_IMPL_H_
 
+#include "base/memory/raw_ptr.h"
 #include "build/build_config.h"
 #include "weblayer/public/prerender_controller.h"
 
@@ -37,7 +38,7 @@ class PrerenderControllerImpl : public PrerenderController {
   void DestroyAllContents() override;
 
  private:
-  content::BrowserContext* browser_context_;
+  raw_ptr<content::BrowserContext> browser_context_;
 };
 
 }  // namespace weblayer
diff --git a/chromium/weblayer/browser/no_state_prefetch/prerender_tab_helper.cc b/chromium/weblayer/browser/no_state_prefetch/prerender_tab_helper.cc
index bb0df04bbac..944e081aec6 100644
--- a/chromium/weblayer/browser/no_state_prefetch/prerender_tab_helper.cc
+++ b/chromium/weblayer/browser/no_state_prefetch/prerender_tab_helper.cc
@@ -12,7 +12,8 @@
 namespace weblayer {
 
 PrerenderTabHelper::PrerenderTabHelper(content::WebContents* web_contents)
-    : content::WebContentsObserver(web_contents) {}
+    : content::WebContentsObserver(web_contents),
+      content::WebContentsUserData<PrerenderTabHelper>(*web_contents) {}
 
 PrerenderTabHelper::~PrerenderTabHelper() = default;
 
@@ -31,7 +32,7 @@ void PrerenderTabHelper::DidFinishNavigation(
           web_contents()->GetBrowserContext());
 
   if (no_state_prefetch_manager &&
-      !no_state_prefetch_manager->IsWebContentsPrerendering(web_contents()))
+      !no_state_prefetch_manager->IsWebContentsPrefetching(web_contents()))
     no_state_prefetch_manager->RecordNavigation(navigation_handle->GetURL());
 }
 
diff --git a/chromium/weblayer/browser/no_state_prefetch/prerender_tab_helper.h b/chromium/weblayer/browser/no_state_prefetch/prerender_tab_helper.h
index c353ae55928..9ca3a4fc586 100644
--- a/chromium/weblayer/browser/no_state_prefetch/prerender_tab_helper.h
+++ b/chromium/weblayer/browser/no_state_prefetch/prerender_tab_helper.h
@@ -5,7 +5,6 @@
 #ifndef WEBLAYER_BROWSER_NO_STATE_PREFETCH_PRERENDER_TAB_HELPER_H_
 #define WEBLAYER_BROWSER_NO_STATE_PREFETCH_PRERENDER_TAB_HELPER_H_
 
-#include "base/macros.h"
 #include "content/public/browser/web_contents_observer.h"
 #include "content/public/browser/web_contents_user_data.h"
 
diff --git a/chromium/weblayer/browser/page_load_metrics_initialize.cc b/chromium/weblayer/browser/page_load_metrics_initialize.cc
index 20bacf315f1..157cdf1ddf6 100644
--- a/chromium/weblayer/browser/page_load_metrics_initialize.cc
+++ b/chromium/weblayer/browser/page_load_metrics_initialize.cc
@@ -8,7 +8,6 @@
 #include <utility>
 
 #include "base/bind.h"
-#include "base/macros.h"
 #include "components/page_load_metrics/browser/metrics_web_contents_observer.h"
 #include "components/page_load_metrics/browser/observers/ad_metrics/ads_page_load_metrics_observer.h"
 #include "components/page_load_metrics/browser/page_load_metrics_embedder_base.h"
diff --git a/chromium/weblayer/browser/page_specific_content_settings_delegate.h b/chromium/weblayer/browser/page_specific_content_settings_delegate.h
index e98927fde6e..2d7fe6e651c 100644
--- a/chromium/weblayer/browser/page_specific_content_settings_delegate.h
+++ b/chromium/weblayer/browser/page_specific_content_settings_delegate.h
@@ -5,6 +5,7 @@
 #ifndef WEBLAYER_BROWSER_PAGE_SPECIFIC_CONTENT_SETTINGS_DELEGATE_H_
 #define WEBLAYER_BROWSER_PAGE_SPECIFIC_CONTENT_SETTINGS_DELEGATE_H_
 
+#include "base/memory/raw_ptr.h"
 #include "components/content_settings/browser/page_specific_content_settings.h"
 
 namespace weblayer {
@@ -53,7 +54,7 @@ class PageSpecificContentSettingsDelegate
   void OnServiceWorkerAccessAllowed(const url::Origin& origin) override;
   void OnWebDatabaseAccessAllowed(const url::Origin& origin) override;
 
-  content::WebContents* web_contents_;
+  raw_ptr<content::WebContents> web_contents_;
 };
 
 }  // namespace weblayer
diff --git a/chromium/weblayer/browser/password_manager_driver_factory.cc b/chromium/weblayer/browser/password_manager_driver_factory.cc
index 84de6ca65e2..4bb31efd6ff 100644
--- a/chromium/weblayer/browser/password_manager_driver_factory.cc
+++ b/chromium/weblayer/browser/password_manager_driver_factory.cc
@@ -4,6 +4,7 @@
 
 #include "weblayer/browser/password_manager_driver_factory.h"
 
+#include "base/memory/raw_ptr.h"
 #include "base/stl_util.h"
 #include "components/password_manager/content/browser/bad_message.h"
 #include "components/password_manager/content/browser/form_meta_data.h"
@@ -83,12 +84,14 @@ class PasswordManagerDriverFactory::PasswordManagerDriver
 
   mojo::AssociatedReceiver<autofill::mojom::PasswordManagerDriver>
       password_manager_receiver_{this};
-  content::RenderFrameHost* render_frame_host_;
+  raw_ptr<content::RenderFrameHost> render_frame_host_;
 };
 
 PasswordManagerDriverFactory::PasswordManagerDriverFactory(
     content::WebContents* web_contents)
-    : content::WebContentsObserver(web_contents) {}
+    : content::WebContentsObserver(web_contents),
+      content::WebContentsUserData<PasswordManagerDriverFactory>(
+          *web_contents) {}
 
 PasswordManagerDriverFactory::~PasswordManagerDriverFactory() = default;
 
diff --git a/chromium/weblayer/browser/permissions/geolocation_permission_context_delegate.cc b/chromium/weblayer/browser/permissions/geolocation_permission_context_delegate.cc
index 381eef27258..99deb5f056a 100644
--- a/chromium/weblayer/browser/permissions/geolocation_permission_context_delegate.cc
+++ b/chromium/weblayer/browser/permissions/geolocation_permission_context_delegate.cc
@@ -5,7 +5,6 @@
 #include "weblayer/browser/permissions/geolocation_permission_context_delegate.h"
 
 #include "build/build_config.h"
-#include "weblayer/browser/default_search_engine.h"
 
 #if defined(OS_ANDROID)
 #include "weblayer/browser/android/permission_request_utils.h"
@@ -40,8 +39,7 @@ PrefService* GeolocationPermissionContextDelegate::GetPrefs(
 bool GeolocationPermissionContextDelegate::IsRequestingOriginDSE(
     content::BrowserContext* browser_context,
     const GURL& requesting_origin) {
-  return IsPermissionControlledByDse(ContentSettingsType::GEOLOCATION,
-                                     url::Origin::Create(requesting_origin));
+  return false;
 }
 
 void GeolocationPermissionContextDelegate::FinishNotifyPermissionSet(
diff --git a/chromium/weblayer/browser/permissions/weblayer_permissions_client.cc b/chromium/weblayer/browser/permissions/weblayer_permissions_client.cc
index 46e98ecec0a..84a343b0be7 100644
--- a/chromium/weblayer/browser/permissions/weblayer_permissions_client.cc
+++ b/chromium/weblayer/browser/permissions/weblayer_permissions_client.cc
@@ -8,7 +8,6 @@
 #include "components/subresource_filter/content/browser/subresource_filter_content_settings_manager.h"
 #include "components/subresource_filter/content/browser/subresource_filter_profile_context.h"
 #include "weblayer/browser/cookie_settings_factory.h"
-#include "weblayer/browser/default_search_engine.h"
 #include "weblayer/browser/host_content_settings_map_factory.h"
 #include "weblayer/browser/permissions/permission_decision_auto_blocker_factory.h"
 #include "weblayer/browser/permissions/permission_manager_factory.h"
@@ -75,30 +74,6 @@ WebLayerPermissionsClient::GetChooserContext(
 }
 
 #if defined(OS_ANDROID)
-bool WebLayerPermissionsClient::IsPermissionControlledByDse(
-    content::BrowserContext* browser_context,
-    ContentSettingsType type,
-    const url::Origin& origin) {
-  return weblayer::IsPermissionControlledByDse(type, origin);
-}
-
-bool WebLayerPermissionsClient::IsDseOrigin(
-    content::BrowserContext* browser_context,
-    const url::Origin& origin) {
-  return weblayer::IsDseOrigin(origin);
-}
-
-bool WebLayerPermissionsClient::ResetPermissionIfControlledByDse(
-    content::BrowserContext* browser_context,
-    ContentSettingsType type,
-    const url::Origin& origin) {
-  if (IsPermissionControlledByDse(browser_context, type, origin)) {
-    ResetDsePermissions(browser_context);
-    return true;
-  }
-  return false;
-}
-
 void WebLayerPermissionsClient::RepromptForAndroidPermissions(
     content::WebContents* web_contents,
     const std::vector<ContentSettingsType>& content_settings_types,
diff --git a/chromium/weblayer/browser/permissions/weblayer_permissions_client.h b/chromium/weblayer/browser/permissions/weblayer_permissions_client.h
index 535de583f9b..57a684cd4d0 100644
--- a/chromium/weblayer/browser/permissions/weblayer_permissions_client.h
+++ b/chromium/weblayer/browser/permissions/weblayer_permissions_client.h
@@ -36,15 +36,6 @@ class WebLayerPermissionsClient : public permissions::PermissionsClient {
       content::BrowserContext* browser_context,
       ContentSettingsType type) override;
 #if defined(OS_ANDROID)
-  bool IsPermissionControlledByDse(content::BrowserContext* browser_context,
-                                   ContentSettingsType type,
-                                   const url::Origin& origin) override;
-  bool IsDseOrigin(content::BrowserContext* browser_context,
-                   const url::Origin& origin) override;
-  bool ResetPermissionIfControlledByDse(
-      content::BrowserContext* browser_context,
-      ContentSettingsType type,
-      const url::Origin& origin) override;
   void RepromptForAndroidPermissions(
       content::WebContents* web_contents,
       const std::vector<ContentSettingsType>& content_settings_types,
diff --git a/chromium/weblayer/browser/persistence/browser_persister.h b/chromium/weblayer/browser/persistence/browser_persister.h
index 8a67919ef22..fc30523eeff 100644
--- a/chromium/weblayer/browser/persistence/browser_persister.h
+++ b/chromium/weblayer/browser/persistence/browser_persister.h
@@ -13,7 +13,7 @@
 #include <utility>
 #include <vector>
 
-#include "base/macros.h"
+#include "base/memory/raw_ptr.h"
 #include "base/memory/weak_ptr.h"
 #include "base/scoped_multi_source_observation.h"
 #include "components/sessions/content/session_tab_helper_delegate.h"
@@ -120,7 +120,7 @@ class BrowserPersister : public sessions::CommandStorageManagerDelegate,
   void ProcessRestoreCommands(
       const std::vector<std::unique_ptr<sessions::SessionWindow>>& windows);
 
-  BrowserImpl* browser_;
+  raw_ptr<BrowserImpl> browser_;
 
   // ID used for the browser. The sessions code requires each tab to be
   // associated with a browser.
diff --git a/chromium/weblayer/browser/persistence/browser_persister_browsertest.cc b/chromium/weblayer/browser/persistence/browser_persister_browsertest.cc
index 5ab10e2aba1..dd726c3fe29 100644
--- a/chromium/weblayer/browser/persistence/browser_persister_browsertest.cc
+++ b/chromium/weblayer/browser/persistence/browser_persister_browsertest.cc
@@ -8,6 +8,7 @@
 #include "base/files/file_path.h"
 #include "base/files/file_util.h"
 #include "base/guid.h"
+#include "base/memory/raw_ptr.h"
 #include "base/path_service.h"
 #include "base/run_loop.h"
 #include "base/test/bind.h"
@@ -83,14 +84,14 @@ class BrowserNavigationObserverImpl : public BrowserRestoreObserver,
   void OnRestoreCompleted() override {
     browser_->RemoveBrowserRestoreObserver(this);
     ASSERT_LT(tab_to_wait_for_, browser_->GetTabs().size());
-    ASSERT_EQ(nullptr, tab_);
+    ASSERT_EQ(nullptr, tab_.get());
     tab_ = browser_->GetTabs()[tab_to_wait_for_];
     tab_->GetNavigationController()->AddObserver(this);
   }
 
-  Browser* browser_;
+  raw_ptr<Browser> browser_;
   const GURL& url_;
-  Tab* tab_ = nullptr;
+  raw_ptr<Tab> tab_ = nullptr;
   const size_t tab_to_wait_for_;
   std::unique_ptr<TestNavigationObserver> navigation_observer_;
   base::RunLoop run_loop_;
diff --git a/chromium/weblayer/browser/persistence/minimal_browser_persister.cc b/chromium/weblayer/browser/persistence/minimal_browser_persister.cc
index fe119d4a728..7f8bdf6d5e6 100644
--- a/chromium/weblayer/browser/persistence/minimal_browser_persister.cc
+++ b/chromium/weblayer/browser/persistence/minimal_browser_persister.cc
@@ -266,13 +266,16 @@ bool PersistTabStatePrimaryPass(const SessionID& browser_session_id,
 // commands, false if size exceeded.
 bool PersistTabStateSecondaryPass(const SessionID& browser_session_id,
                                   Tab* tab,
+                                  int max_navigations_per_tab,
                                   MinimalPersister* builder) {
   NavigationEntryIterator iterator(tab);
   if (iterator.at_end())
     return true;
 
   const SessionID& session_id = GetSessionIDForTab(tab);
-  for (int i = 0; i < 2; ++i) {
+  // Subtract 1 from `max_navigations_per_tab` as the first pass wrote a
+  // navigation.
+  for (int i = 0; i < max_navigations_per_tab - 1; ++i) {
     // Skips the navigation that was written during the first pass.
     if (!iterator.Next())
       return true;
@@ -313,6 +316,7 @@ int GetActiveTabIndex(BrowserImpl* browser) {
 }  // namespace
 
 std::vector<uint8_t> PersistMinimalState(BrowserImpl* browser,
+                                         int max_navigations_per_tab,
                                          int max_size_in_bytes) {
   MinimalPersister builder(max_size_in_bytes == 0 ? kMaxSizeInBytes
                                                   : max_size_in_bytes);
@@ -334,16 +338,23 @@ std::vector<uint8_t> PersistMinimalState(BrowserImpl* browser,
   // . active tabs pending navigation entry, if no pending then last committed.
   // . remaining tabs pending navigation entry or last committed if no pending.
   // . active tabs last committed and one navigation before it.
-  // . remaining tabs last committed and one navigation before it.
+  // . remaining tabs last committed and a limited number of preceding
+  //   navigations.
   std::vector<Tab*> tabs = GetTabsInPersistOrder(browser);
   for (Tab* tab : tabs) {
     if (!PersistTabStatePrimaryPass(browser_session_id, tab, &builder))
       return builder.ToByteArray();
   }
 
+  // Use a default of 5 for the max number of navigations to persist.
+  if (max_navigations_per_tab == 0)
+    max_navigations_per_tab = 5;
+
   for (Tab* tab : tabs) {
-    if (!PersistTabStateSecondaryPass(browser_session_id, tab, &builder))
+    if (!PersistTabStateSecondaryPass(browser_session_id, tab,
+                                      max_navigations_per_tab, &builder)) {
       return builder.ToByteArray();
+    }
   }
 
   return builder.ToByteArray();
diff --git a/chromium/weblayer/browser/persistence/minimal_browser_persister.h b/chromium/weblayer/browser/persistence/minimal_browser_persister.h
index 7cd7c75f4f0..aef0422cd9f 100644
--- a/chromium/weblayer/browser/persistence/minimal_browser_persister.h
+++ b/chromium/weblayer/browser/persistence/minimal_browser_persister.h
@@ -16,9 +16,12 @@ class BrowserImpl;
 // Returns a byte array that can later be used to restore the state (Tabs and
 // navigations) of a Browser. This does not store the full state, only a
 // minimal state. For example, it may not include all tabs or all navigations.
-// |max_size_in_bytes| is provided for tests and allows specifying the max.
-// A value of 0 means use the default max.
+// |max_navigations_per_tab| is the max number of navigations to persist per
+// tab. Depending upon space requirements, the max number of navigations may not
+// be honored. |max_size_in_bytes| is provided for tests and allows specifying
+// the max. A value of 0 means use the default max.
 std::vector<uint8_t> PersistMinimalState(BrowserImpl* browser,
+                                         int max_navigations_per_tab = 0,
                                          int max_size_in_bytes = 0);
 
 // Restores the state previously created via PersistMinimalState(). When
diff --git a/chromium/weblayer/browser/persistence/minimal_browser_persister_browsertest.cc b/chromium/weblayer/browser/persistence/minimal_browser_persister_browsertest.cc
index 7dd4326d11d..e0a6728400b 100644
--- a/chromium/weblayer/browser/persistence/minimal_browser_persister_browsertest.cc
+++ b/chromium/weblayer/browser/persistence/minimal_browser_persister_browsertest.cc
@@ -2,6 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+#include "base/memory/raw_ptr.h"
 #include "build/build_config.h"
 #include "content/public/browser/navigation_controller.h"
 #include "content/public/browser/navigation_entry.h"
@@ -9,6 +10,7 @@
 #include "content/public/test/browser_test_utils.h"
 #include "net/base/filename_util.h"
 #include "net/test/embedded_test_server/embedded_test_server.h"
+#include "third_party/blink/public/common/features.h"
 #include "weblayer/browser/browser_impl.h"
 #include "weblayer/browser/profile_impl.h"
 #include "weblayer/browser/tab_impl.h"
@@ -48,10 +50,12 @@ class MinimalBrowserPersisterTest : public WebLayerBrowserTest {
   // Persists the current state, then recreates the browser. See
   // BrowserImpl::GetMinimalPersistenceState() for details on
   // |max_size_in_bytes|, 0 means use the default value.
-  void RecreateBrowserFromCurrentState(int max_size_in_bytes = 0) {
+  void RecreateBrowserFromCurrentState(
+      int max_number_of_navigations_per_tab = 0,
+      int max_size_in_bytes = 0) {
     Browser::PersistenceInfo persistence_info;
-    persistence_info.minimal_state =
-        browser_impl()->GetMinimalPersistenceState(max_size_in_bytes);
+    persistence_info.minimal_state = browser_impl()->GetMinimalPersistenceState(
+        max_number_of_navigations_per_tab, max_size_in_bytes);
     tab_ = nullptr;
     browser_ = Browser::Create(GetProfile(), &persistence_info);
     // There is always at least one tab created (even if restore fails).
@@ -65,7 +69,7 @@ class MinimalBrowserPersisterTest : public WebLayerBrowserTest {
   }
 
   std::unique_ptr<Browser> browser_;
-  TabImpl* tab_ = nullptr;
+  raw_ptr<TabImpl> tab_ = nullptr;
 };
 
 IN_PROC_BROWSER_TEST_F(MinimalBrowserPersisterTest, SingleTab) {
@@ -144,6 +148,33 @@ IN_PROC_BROWSER_TEST_F(MinimalBrowserPersisterTest, TwoNavs) {
   EXPECT_EQ(url2(), nav_controller.GetEntryAtIndex(1)->GetURL());
 }
 
+IN_PROC_BROWSER_TEST_F(MinimalBrowserPersisterTest, NavigationOverflow) {
+  NavigateAndWaitForCompletion(url1(), tab_);
+  NavigateAndWaitForCompletion(url2(), tab_);
+  const GURL url3 = embedded_test_server()->GetURL("/simple_page3.html");
+  NavigateAndWaitForCompletion(url3, tab_);
+  const GURL url4 = embedded_test_server()->GetURL("/simple_page4.html");
+  NavigateAndWaitForCompletion(url4, tab_);
+
+  ASSERT_NO_FATAL_FAILURE(RecreateBrowserFromCurrentState(3));
+
+  // As a max of 3 navigations was specified, only the last three navigations
+  // should be restored.
+  TabImpl* restored_tab = tab_;
+  EXPECT_EQ(restored_tab, browser_->GetActiveTab());
+  TestNavigationObserver observer(
+      url4, TestNavigationObserver::NavigationEvent::kCompletion, restored_tab);
+  observer.Wait();
+  ASSERT_EQ(3,
+            restored_tab->GetNavigationController()->GetNavigationListSize());
+  content::NavigationController& nav_controller =
+      restored_tab->web_contents()->GetController();
+  EXPECT_EQ(2, nav_controller.GetCurrentEntryIndex());
+  EXPECT_EQ(url2(), nav_controller.GetEntryAtIndex(0)->GetURL());
+  EXPECT_EQ(url3, nav_controller.GetEntryAtIndex(1)->GetURL());
+  EXPECT_EQ(url4, nav_controller.GetEntryAtIndex(2)->GetURL());
+}
+
 // crbug.com/1240904: test is flaky on linux and win.
 #if defined(OS_LINUX) || defined(OS_WIN)
 #define MAYBE_Overflow DISABLED_Overflow
@@ -156,11 +187,15 @@ IN_PROC_BROWSER_TEST_F(MinimalBrowserPersisterTest, MAYBE_Overflow) {
   url_string.replace(0, data.size(), data);
   NavigateAndWaitForCompletion(GURL(url_string), tab_);
 
-  ASSERT_NO_FATAL_FAILURE(RecreateBrowserFromCurrentState(2048));
+  ASSERT_NO_FATAL_FAILURE(RecreateBrowserFromCurrentState(0, 2048));
 
   TabImpl* restored_tab = tab_;
   EXPECT_EQ(restored_tab, browser_->GetActiveTab());
-  EXPECT_EQ(0, restored_tab->web_contents()->GetController().GetEntryCount());
+  if (blink::features::IsInitialNavigationEntryEnabled()) {
+    EXPECT_EQ(1, restored_tab->web_contents()->GetController().GetEntryCount());
+  } else {
+    EXPECT_EQ(0, restored_tab->web_contents()->GetController().GetEntryCount());
+  }
   EXPECT_TRUE(restored_tab->web_contents()->GetController().GetPendingEntry() ==
               nullptr);
 }
diff --git a/chromium/weblayer/browser/persistent_download.h b/chromium/weblayer/browser/persistent_download.h
index 2e642f8f500..89ed55e4b35 100644
--- a/chromium/weblayer/browser/persistent_download.h
+++ b/chromium/weblayer/browser/persistent_download.h
@@ -5,6 +5,7 @@
 #ifndef WEBLAYER_BROWSER_PERSISTENT_DOWNLOAD_H_
 #define WEBLAYER_BROWSER_PERSISTENT_DOWNLOAD_H_
 
+#include "base/memory/raw_ptr.h"
 #include "weblayer/browser/download_impl.h"
 
 namespace download {
@@ -51,7 +52,7 @@ class PersistentDownload : public DownloadImpl {
   void ResumeInternal();
   void CancelInternal();
 
-  download::DownloadItem* item_;
+  raw_ptr<download::DownloadItem> item_;
 
   bool pause_pending_ = false;
   bool resume_pending_ = false;
diff --git a/chromium/weblayer/browser/popup_blocker_browsertest.cc b/chromium/weblayer/browser/popup_blocker_browsertest.cc
index 540bd6d01db..e8e68026815 100644
--- a/chromium/weblayer/browser/popup_blocker_browsertest.cc
+++ b/chromium/weblayer/browser/popup_blocker_browsertest.cc
@@ -2,6 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+#include "base/memory/raw_ptr.h"
 #include "base/strings/stringprintf.h"
 #include "build/build_config.h"
 #include "components/blocked_content/popup_blocker_tab_helper.h"
@@ -125,8 +126,8 @@ class PopupBlockerBrowserTest : public WebLayerBrowserTest,
   std::unique_ptr<base::RunLoop> new_tab_run_loop_;
   std::unique_ptr<base::RunLoop> close_tab_run_loop_;
 
-  Tab* original_tab_ = nullptr;
-  Tab* new_tab_ = nullptr;
+  raw_ptr<Tab> original_tab_ = nullptr;
+  raw_ptr<Tab> new_tab_ = nullptr;
 };
 
 IN_PROC_BROWSER_TEST_F(PopupBlockerBrowserTest, BlocksPopup) {
diff --git a/chromium/weblayer/browser/popup_navigation_delegate_impl.h b/chromium/weblayer/browser/popup_navigation_delegate_impl.h
index e640796e857..da9bf427fe6 100644
--- a/chromium/weblayer/browser/popup_navigation_delegate_impl.h
+++ b/chromium/weblayer/browser/popup_navigation_delegate_impl.h
@@ -5,6 +5,7 @@
 #ifndef WEBLAYER_BROWSER_POPUP_NAVIGATION_DELEGATE_IMPL_H_
 #define WEBLAYER_BROWSER_POPUP_NAVIGATION_DELEGATE_IMPL_H_
 
+#include "base/memory/raw_ptr.h"
 #include "components/blocked_content/popup_navigation_delegate.h"
 #include "content/public/browser/page_navigator.h"
 #include "content/public/browser/render_frame_host.h"
@@ -32,8 +33,8 @@ class PopupNavigationDelegateImpl
 
  private:
   content::OpenURLParams params_;
-  content::WebContents* source_contents_;
-  content::RenderFrameHost* opener_;
+  raw_ptr<content::WebContents> source_contents_;
+  raw_ptr<content::RenderFrameHost> opener_;
   const bool original_user_gesture_;
 };
 
diff --git a/chromium/weblayer/browser/profile_browsertest.cc b/chromium/weblayer/browser/profile_browsertest.cc
index 6c069ad4917..0a0a5847154 100644
--- a/chromium/weblayer/browser/profile_browsertest.cc
+++ b/chromium/weblayer/browser/profile_browsertest.cc
@@ -8,7 +8,6 @@
 #include "ui/gfx/image/image_unittest_util.h"
 #include "weblayer/browser/browser_list.h"
 #include "weblayer/browser/browser_list_observer.h"
-#include "weblayer/browser/default_search_engine.h"
 #include "weblayer/browser/favicon/favicon_fetcher_impl.h"
 #include "weblayer/browser/favicon/test_favicon_fetcher_delegate.h"
 #include "weblayer/browser/host_content_settings_map_factory.h"
@@ -137,16 +136,12 @@ IN_PROC_BROWSER_TEST_F(ProfileBrowserTest, DefaultNetworkPredictionState) {
 }
 
 IN_PROC_BROWSER_TEST_F(ProfileBrowserTest, ClearSiteSettings) {
-  auto dse_origin = GetDseOrigin().GetURL();
   auto foo_origin = GURL("http://www.foo.com");
 
   auto* settings_map = HostContentSettingsMapFactory::GetForBrowserContext(
       static_cast<TabImpl*>(shell()->tab())
           ->web_contents()
           ->GetBrowserContext());
-  EXPECT_EQ(settings_map->GetContentSetting(dse_origin, dse_origin,
-                                            ContentSettingsType::GEOLOCATION),
-            CONTENT_SETTING_ALLOW);
   EXPECT_EQ(settings_map->GetContentSetting(foo_origin, foo_origin,
                                             ContentSettingsType::GEOLOCATION),
             CONTENT_SETTING_ASK);
@@ -164,10 +159,6 @@ IN_PROC_BROWSER_TEST_F(ProfileBrowserTest, ClearSiteSettings) {
       base::Time(), now, run_loop.QuitClosure());
   run_loop.Run();
 
-  EXPECT_EQ(settings_map->GetContentSetting(dse_origin, dse_origin,
-                                            ContentSettingsType::GEOLOCATION),
-            CONTENT_SETTING_ALLOW);
-
   EXPECT_EQ(settings_map->GetContentSetting(foo_origin, foo_origin,
                                             ContentSettingsType::GEOLOCATION),
             CONTENT_SETTING_ALLOW);
@@ -178,9 +169,6 @@ IN_PROC_BROWSER_TEST_F(ProfileBrowserTest, ClearSiteSettings) {
                              now, run_loop2.QuitClosure());
   run_loop2.Run();
 
-  EXPECT_EQ(settings_map->GetContentSetting(dse_origin, dse_origin,
-                                            ContentSettingsType::GEOLOCATION),
-            CONTENT_SETTING_ALLOW);
   EXPECT_EQ(settings_map->GetContentSetting(foo_origin, foo_origin,
                                             ContentSettingsType::GEOLOCATION),
             CONTENT_SETTING_ASK);
diff --git a/chromium/weblayer/browser/profile_impl.cc b/chromium/weblayer/browser/profile_impl.cc
index 2f8d4bc947c..dacd6daa6d0 100644
--- a/chromium/weblayer/browser/profile_impl.cc
+++ b/chromium/weblayer/browser/profile_impl.cc
@@ -11,6 +11,7 @@
 #include <vector>
 
 #include "base/bind.h"
+#include "base/memory/raw_ptr.h"
 #include "base/no_destructor.h"
 #include "base/observer_list.h"
 #include "base/task/task_traits.h"
@@ -72,15 +73,6 @@ namespace {
 
 bool g_first_profile_created = false;
 
-// Simulates a WeakPtr for WebContents. Specifically if the WebContents
-// supplied to the constructor is destroyed then web_contents() returns
-// null.
-class WebContentsTracker : public content::WebContentsObserver {
- public:
-  explicit WebContentsTracker(content::WebContents* web_contents)
-      : content::WebContentsObserver(web_contents) {}
-};
-
 // TaskRunner used by MarkProfileAsDeleted and NukeProfilesMarkedForDeletion to
 // esnure that Nuke happens before any Mark in this process.
 base::SequencedTaskRunner* GetBackgroundDiskOperationTaskRunner() {
@@ -172,7 +164,7 @@ class ProfileImpl::DataClearer : public content::BrowsingDataRemover::Observer {
   // DataClearer deletes itself when removal is done.
   ~DataClearer() override = default;
 
-  content::BrowsingDataRemover* remover_;
+  raw_ptr<content::BrowsingDataRemover> remover_;
   base::OnceCallback<void()> callback_;
 };
 
@@ -622,17 +614,18 @@ content::WebContents* ProfileImpl::OpenUrl(
   std::unique_ptr<content::WebContents> new_tab_contents =
       content::WebContents::Create(
           content::WebContents::CreateParams(GetBrowserContext()));
-  WebContentsTracker tracker(new_tab_contents.get());
+  base::WeakPtr<content::WebContents> new_tab_contents_weak_ptr(
+      new_tab_contents->GetWeakPtr());
   Tab* tab = browser->CreateTab(std::move(new_tab_contents));
 
-  if (!tracker.web_contents())
+  if (!new_tab_contents_weak_ptr)
     return nullptr;
 
   Java_ProfileImpl_onTabAdded(env, java_profile_,
                               static_cast<TabImpl*>(tab)->GetJavaTab());
-  tracker.web_contents()->GetController().LoadURLWithParams(
+  new_tab_contents_weak_ptr->GetController().LoadURLWithParams(
       content::NavigationController::LoadURLParams(params));
-  return tracker.web_contents();
+  return new_tab_contents_weak_ptr.get();
 #endif  // defined(OS_ANDROID)
 }
 
@@ -644,7 +637,8 @@ void ProfileImpl::SetBooleanSetting(SettingType type, bool value) {
       safe_browsing::SetSafeBrowsingState(
           pref_service,
           value ? safe_browsing::SafeBrowsingState::STANDARD_PROTECTION
-                : safe_browsing::SafeBrowsingState::NO_SAFE_BROWSING);
+                : safe_browsing::SafeBrowsingState::NO_SAFE_BROWSING,
+          /*is_esb_enabled_in_sync=*/false);
 #endif
       break;
     case SettingType::UKM_ENABLED: {
diff --git a/chromium/weblayer/browser/profile_impl.h b/chromium/weblayer/browser/profile_impl.h
index 2c128c4191a..77cb3ec25a5 100644
--- a/chromium/weblayer/browser/profile_impl.h
+++ b/chromium/weblayer/browser/profile_impl.h
@@ -9,7 +9,7 @@
 #include <vector>
 
 #include "base/files/file_path.h"
-#include "base/macros.h"
+#include "base/memory/raw_ptr.h"
 #include "base/memory/weak_ptr.h"
 #include "base/task/cancelable_task_tracker.h"
 #include "build/build_config.h"
@@ -198,8 +198,9 @@ class ProfileImpl : public Profile {
 
   base::FilePath download_directory_;
 
-  DownloadDelegate* download_delegate_ = nullptr;
-  GoogleAccountAccessTokenFetchDelegate* access_token_fetch_delegate_ = nullptr;
+  raw_ptr<DownloadDelegate> download_delegate_ = nullptr;
+  raw_ptr<GoogleAccountAccessTokenFetchDelegate> access_token_fetch_delegate_ =
+      nullptr;
 
   base::CallbackListSubscription locale_change_subscription_;
 
diff --git a/chromium/weblayer/browser/safe_browsing/OWNERS b/chromium/weblayer/browser/safe_browsing/OWNERS
deleted file mode 100644
index 1fd89e0e2eb..00000000000
--- a/chromium/weblayer/browser/safe_browsing/OWNERS
+++ /dev/null
@@ -1 +0,0 @@
-timvolodine@chromium.org
diff --git a/chromium/weblayer/browser/safe_browsing/safe_browsing_browsertest.cc b/chromium/weblayer/browser/safe_browsing/safe_browsing_browsertest.cc
index bbb9dd0269d..baa0919c7a1 100644
--- a/chromium/weblayer/browser/safe_browsing/safe_browsing_browsertest.cc
+++ b/chromium/weblayer/browser/safe_browsing/safe_browsing_browsertest.cc
@@ -4,6 +4,7 @@
 
 #include <map>
 
+#include "base/memory/raw_ptr.h"
 #include "components/prefs/pref_service.h"
 #include "components/safe_browsing/android/safe_browsing_api_handler.h"
 #include "components/safe_browsing/content/browser/base_blocking_page.h"
@@ -112,7 +113,7 @@ class SafeBrowsingErrorNavigationObserver : public NavigationObserver {
 
  private:
   const GURL url_;
-  Tab* tab_;
+  raw_ptr<Tab> tab_;
   base::RunLoop run_loop_;
 };
 
diff --git a/chromium/weblayer/browser/safe_browsing/safe_browsing_service.cc b/chromium/weblayer/browser/safe_browsing/safe_browsing_service.cc
index 24952a1e249..2f67609eba7 100644
--- a/chromium/weblayer/browser/safe_browsing/safe_browsing_service.cc
+++ b/chromium/weblayer/browser/safe_browsing/safe_browsing_service.cc
@@ -34,6 +34,7 @@
 #include "weblayer/browser/safe_browsing/url_checker_delegate_impl.h"
 #include "weblayer/browser/safe_browsing/weblayer_safe_browsing_blocking_page_factory.h"
 #include "weblayer/browser/safe_browsing/weblayer_ui_manager_delegate.h"
+#include "weblayer/common/features.h"
 
 namespace weblayer {
 
@@ -140,9 +141,13 @@ SafeBrowsingService::CreateURLLoaderThrottle(
 }
 
 std::unique_ptr<content::NavigationThrottle>
-SafeBrowsingService::CreateSafeBrowsingNavigationThrottle(
+SafeBrowsingService::MaybeCreateSafeBrowsingNavigationThrottleFor(
     content::NavigationHandle* handle) {
-  return std::make_unique<safe_browsing::SafeBrowsingNavigationThrottle>(
+  if (!base::FeatureList::IsEnabled(features::kWebLayerSafeBrowsing)) {
+    return nullptr;
+  }
+
+  return safe_browsing::SafeBrowsingNavigationThrottle::MaybeCreateThrottleFor(
       handle, GetSafeBrowsingUIManager().get());
 }
 
diff --git a/chromium/weblayer/browser/safe_browsing/safe_browsing_service.h b/chromium/weblayer/browser/safe_browsing/safe_browsing_service.h
index b487fffd902..8f8892ca1f5 100644
--- a/chromium/weblayer/browser/safe_browsing/safe_browsing_service.h
+++ b/chromium/weblayer/browser/safe_browsing/safe_browsing_service.h
@@ -62,7 +62,8 @@ class SafeBrowsingService {
       int frame_tree_node_id,
       safe_browsing::RealTimeUrlLookupServiceBase* url_lookup_service);
   std::unique_ptr<content::NavigationThrottle>
-  CreateSafeBrowsingNavigationThrottle(content::NavigationHandle* handle);
+  MaybeCreateSafeBrowsingNavigationThrottleFor(
+      content::NavigationHandle* handle);
   void AddInterface(service_manager::BinderRegistry* registry,
                     content::RenderProcessHost* render_process_host);
   void StopDBManager();
diff --git a/chromium/weblayer/browser/safe_browsing/url_checker_delegate_impl.h b/chromium/weblayer/browser/safe_browsing/url_checker_delegate_impl.h
index 647d61fa1c0..764b1b0dd4d 100644
--- a/chromium/weblayer/browser/safe_browsing/url_checker_delegate_impl.h
+++ b/chromium/weblayer/browser/safe_browsing/url_checker_delegate_impl.h
@@ -5,7 +5,6 @@
 #ifndef WEBLAYER_BROWSER_SAFE_BROWSING_URL_CHECKER_DELEGATE_IMPL_H_
 #define WEBLAYER_BROWSER_SAFE_BROWSING_URL_CHECKER_DELEGATE_IMPL_H_
 
-#include "base/macros.h"
 #include "base/memory/ref_counted.h"
 #include "components/safe_browsing/core/browser/url_checker_delegate.h"
 #include "content/public/browser/web_contents.h"
diff --git a/chromium/weblayer/browser/safe_browsing/weblayer_client_side_detection_host_delegate.h b/chromium/weblayer/browser/safe_browsing/weblayer_client_side_detection_host_delegate.h
index 8080bf818c7..da5fa224a41 100644
--- a/chromium/weblayer/browser/safe_browsing/weblayer_client_side_detection_host_delegate.h
+++ b/chromium/weblayer/browser/safe_browsing/weblayer_client_side_detection_host_delegate.h
@@ -5,6 +5,7 @@
 #ifndef WEBLAYER_BROWSER_SAFE_BROWSING_WEBLAYER_CLIENT_SIDE_DETECTION_HOST_DELEGATE_H_
 #define WEBLAYER_BROWSER_SAFE_BROWSING_WEBLAYER_CLIENT_SIDE_DETECTION_HOST_DELEGATE_H_
 
+#include "base/memory/raw_ptr.h"
 #include "components/safe_browsing/content/browser/client_side_detection_host.h"
 #include "components/safe_browsing/core/common/proto/csd.pb.h"
 #include "url/gurl.h"
@@ -37,7 +38,7 @@ class WebLayerClientSideDetectionHostDelegate
                         GURL current_url) override;
 
  private:
-  content::WebContents* web_contents_;
+  raw_ptr<content::WebContents> web_contents_;
 };
 
 }  // namespace weblayer
diff --git a/chromium/weblayer/browser/safe_browsing/weblayer_client_side_detection_service_delegate.h b/chromium/weblayer/browser/safe_browsing/weblayer_client_side_detection_service_delegate.h
index 2fa0c6b4ee0..1f358f8196e 100644
--- a/chromium/weblayer/browser/safe_browsing/weblayer_client_side_detection_service_delegate.h
+++ b/chromium/weblayer/browser/safe_browsing/weblayer_client_side_detection_service_delegate.h
@@ -5,6 +5,7 @@
 #ifndef WEBLAYER_BROWSER_SAFE_BROWSING_WEBLAYER_CLIENT_SIDE_DETECTION_SERVICE_DELEGATE_H_
 #define WEBLAYER_BROWSER_SAFE_BROWSING_WEBLAYER_CLIENT_SIDE_DETECTION_SERVICE_DELEGATE_H_
 
+#include "base/memory/raw_ptr.h"
 #include "components/safe_browsing/content/browser/client_side_detection_service.h"
 #include "weblayer/browser/browser_context_impl.h"
 
@@ -31,7 +32,7 @@ class WebLayerClientSideDetectionServiceDelegate
   safe_browsing::ChromeUserPopulation GetUserPopulation() override;
 
  private:
-  BrowserContextImpl* browser_context_;
+  raw_ptr<BrowserContextImpl> browser_context_;
 };
 
 }  // namespace weblayer
diff --git a/chromium/weblayer/browser/safe_browsing/weblayer_user_population_helper.cc b/chromium/weblayer/browser/safe_browsing/weblayer_user_population_helper.cc
index 06727178448..593f00a562c 100644
--- a/chromium/weblayer/browser/safe_browsing/weblayer_user_population_helper.cc
+++ b/chromium/weblayer/browser/safe_browsing/weblayer_user_population_helper.cc
@@ -4,7 +4,7 @@
 
 #include "weblayer/browser/safe_browsing/weblayer_user_population_helper.h"
 
-#include "components/safe_browsing/content/browser/user_population.h"
+#include "components/safe_browsing/core/browser/user_population.h"
 #include "weblayer/browser/browser_context_impl.h"
 
 namespace weblayer {
diff --git a/chromium/weblayer/browser/signin_url_loader_throttle.cc b/chromium/weblayer/browser/signin_url_loader_throttle.cc
index 19341c4a06c..a32816acdbe 100644
--- a/chromium/weblayer/browser/signin_url_loader_throttle.cc
+++ b/chromium/weblayer/browser/signin_url_loader_throttle.cc
@@ -50,7 +50,7 @@ void ProcessMirrorHeader(content::WebContents::Getter web_contents_getter,
 void MaybeAddQueryParams(GURL* url) {
   // Add manage=true to query parameters for sign out URLs to make sure we
   // receive the Mirror response headers instead of the normal sign out page.
-  if (gaia::IsGaiaSignonRealm(url->GetOrigin()) &&
+  if (gaia::IsGaiaSignonRealm(url->DeprecatedGetOriginAsURL()) &&
       url->path_piece() == kSignOutPath) {
     *url = net::AppendOrReplaceQueryParameter(*url, "manage", "true");
   }
@@ -163,8 +163,8 @@ void SigninURLLoaderThrottle::ProcessRequest(
 
 void SigninURLLoaderThrottle::ProcessResponse(
     const net::HttpResponseHeaders* headers) {
-  if (!gaia::IsGaiaSignonRealm(request_url_.GetOrigin()) || !is_main_frame_ ||
-      !headers) {
+  if (!gaia::IsGaiaSignonRealm(request_url_.DeprecatedGetOriginAsURL()) ||
+      !is_main_frame_ || !headers) {
     return;
   }
 
diff --git a/chromium/weblayer/browser/signin_url_loader_throttle.h b/chromium/weblayer/browser/signin_url_loader_throttle.h
index 9d04810f4da..072feb4d613 100644
--- a/chromium/weblayer/browser/signin_url_loader_throttle.h
+++ b/chromium/weblayer/browser/signin_url_loader_throttle.h
@@ -5,6 +5,7 @@
 #ifndef WEBLAYER_BROWSER_SIGNIN_URL_LOADER_THROTTLE_H_
 #define WEBLAYER_BROWSER_SIGNIN_URL_LOADER_THROTTLE_H_
 
+#include "base/memory/raw_ptr.h"
 #include "components/signin/core/browser/signin_header_helper.h"
 #include "content/public/browser/browser_context.h"
 #include "content/public/browser/web_contents.h"
@@ -52,7 +53,7 @@ class SigninURLLoaderThrottle : public blink::URLLoaderThrottle {
                       net::HttpRequestHeaders* modified_headers);
   void ProcessResponse(const net::HttpResponseHeaders* headers);
 
-  content::BrowserContext* browser_context_;
+  raw_ptr<content::BrowserContext> browser_context_;
   content::WebContents::Getter web_contents_getter_;
   net::HttpRequestHeaders request_headers_;
   GURL request_url_;
diff --git a/chromium/weblayer/browser/site_isolation_browsertest.cc b/chromium/weblayer/browser/site_isolation_browsertest.cc
index 42476872e27..689cd8d247f 100644
--- a/chromium/weblayer/browser/site_isolation_browsertest.cc
+++ b/chromium/weblayer/browser/site_isolation_browsertest.cc
@@ -4,6 +4,7 @@
 
 #include "base/base_switches.h"
 #include "base/files/file_path.h"
+#include "base/memory/raw_ptr.h"
 #include "base/system/sys_info.h"
 #include "base/test/scoped_feature_list.h"
 #include "build/build_config.h"
@@ -103,7 +104,7 @@ class SiteIsolationBrowserTest : public WebLayerBrowserTest {
   };
 
   SiteIsolationContentBrowserClient browser_client_;
-  content::ContentBrowserClient* original_client_ = nullptr;
+  raw_ptr<content::ContentBrowserClient> original_client_ = nullptr;
   base::test::ScopedFeatureList feature_list_;
 };
 
diff --git a/chromium/weblayer/browser/ssl_browsertest.cc b/chromium/weblayer/browser/ssl_browsertest.cc
index 49a1f8de96b..063beb9c310 100644
--- a/chromium/weblayer/browser/ssl_browsertest.cc
+++ b/chromium/weblayer/browser/ssl_browsertest.cc
@@ -5,7 +5,6 @@
 #include "weblayer/test/weblayer_browser_test.h"
 
 #include "base/files/file_path.h"
-#include "base/macros.h"
 #include "base/scoped_observation.h"
 #include "base/test/scoped_feature_list.h"
 #include "build/build_config.h"
@@ -13,7 +12,6 @@
 #include "components/security_interstitials/content/insecure_form_blocking_page.h"
 #include "components/security_interstitials/content/ssl_error_assistant.h"
 #include "components/security_interstitials/content/ssl_error_handler.h"
-#include "components/security_interstitials/core/features.h"
 #include "net/ssl/ssl_info.h"
 #include "net/test/embedded_test_server/embedded_test_server.h"
 #include "third_party/abseil-cpp/absl/types/optional.h"
@@ -412,20 +410,9 @@ IN_PROC_BROWSER_TEST_F(SSLBrowserTest, ErrorPageNotCalledForMismatch) {
   EXPECT_FALSE(error_page_delegate.was_get_error_page_content_called());
 }
 
-class SSLBrowserTestWithInsecureFormsWarningEnabled : public SSLBrowserTest {
- public:
-  SSLBrowserTestWithInsecureFormsWarningEnabled() {
-    feature_list_.InitAndEnableFeature(
-        security_interstitials::kInsecureFormSubmissionInterstitial);
-  }
-
- private:
-  base::test::ScopedFeatureList feature_list_;
-};
-
 // Visits a page that displays an insecure form, submits the form, and checks an
 // interstitial is shown.
-IN_PROC_BROWSER_TEST_F(SSLBrowserTestWithInsecureFormsWarningEnabled,
+IN_PROC_BROWSER_TEST_F(SSLBrowserTest,
                        TestDisplaysInsecureFormSubmissionWarning) {
   GURL insecure_form_url = https_server_->GetURL("/insecure_form.html");
   GURL form_target_url = GURL("http://does-not-exist.test/form_target.html?");
@@ -442,35 +429,4 @@ IN_PROC_BROWSER_TEST_F(SSLBrowserTestWithInsecureFormsWarningEnabled,
   EXPECT_TRUE(IsShowingInsecureFormInterstitial(shell()->tab()));
 }
 
-class SSLBrowserTestWithInsecureFormsWarningDisabled : public SSLBrowserTest {
- public:
-  SSLBrowserTestWithInsecureFormsWarningDisabled() {
-    feature_list_.InitAndDisableFeature(
-        security_interstitials::kInsecureFormSubmissionInterstitial);
-  }
-
- private:
-  base::test::ScopedFeatureList feature_list_;
-};
-
-// Visits a page that displays an insecure form, submits the form, and checks no
-// interstitial is displayed with the feature off.
-IN_PROC_BROWSER_TEST_F(SSLBrowserTestWithInsecureFormsWarningDisabled,
-                       TestNoInsecureFormWarning) {
-  GURL insecure_form_url = https_server_->GetURL("/insecure_form.html");
-  GURL form_target_url = GURL("http://does-not-exist.test/form_target.html?");
-  NavigateAndWaitForCompletion(insecure_form_url, shell());
-
-  // Submit the form and wait for the form target to load. We wait for a
-  // failure since the target url is not served.
-  TestNavigationObserver navigation_observer(
-      form_target_url, TestNavigationObserver::NavigationEvent::kFailure,
-      shell());
-  ExecuteScript(shell(), "submitForm();", false /*use_separate_isolate*/);
-  navigation_observer.Wait();
-
-  // Check no interstitial loaded.
-  EXPECT_FALSE(IsShowingSecurityInterstitial(shell()->tab()));
-}
-
 }  // namespace weblayer
diff --git a/chromium/weblayer/browser/stateful_ssl_host_state_delegate_factory.cc b/chromium/weblayer/browser/stateful_ssl_host_state_delegate_factory.cc
index 42e0ef1d561..f3a008b2712 100644
--- a/chromium/weblayer/browser/stateful_ssl_host_state_delegate_factory.cc
+++ b/chromium/weblayer/browser/stateful_ssl_host_state_delegate_factory.cc
@@ -6,7 +6,6 @@
 
 #include <memory>
 
-#include "base/macros.h"
 #include "components/keyed_service/content/browser_context_dependency_manager.h"
 #include "components/security_interstitials/content/stateful_ssl_host_state_delegate.h"
 #include "components/user_prefs/user_prefs.h"
diff --git a/chromium/weblayer/browser/stateful_ssl_host_state_delegate_factory.h b/chromium/weblayer/browser/stateful_ssl_host_state_delegate_factory.h
index 2e8f9c70116..26af682ce35 100644
--- a/chromium/weblayer/browser/stateful_ssl_host_state_delegate_factory.h
+++ b/chromium/weblayer/browser/stateful_ssl_host_state_delegate_factory.h
@@ -5,7 +5,6 @@
 #ifndef WEBLAYER_BROWSER_STATEFUL_SSL_HOST_STATE_DELEGATE_FACTORY_H_
 #define WEBLAYER_BROWSER_STATEFUL_SSL_HOST_STATE_DELEGATE_FACTORY_H_
 
-#include "base/macros.h"
 #include "base/memory/singleton.h"
 #include "components/keyed_service/content/browser_context_keyed_service_factory.h"
 #include "components/prefs/pref_service.h"
diff --git a/chromium/weblayer/browser/tab_callback_proxy.h b/chromium/weblayer/browser/tab_callback_proxy.h
index a377956f9df..ddc856a0e7a 100644
--- a/chromium/weblayer/browser/tab_callback_proxy.h
+++ b/chromium/weblayer/browser/tab_callback_proxy.h
@@ -8,7 +8,7 @@
 #include <jni.h>
 
 #include "base/android/scoped_java_ref.h"
-#include "base/macros.h"
+#include "base/memory/raw_ptr.h"
 #include "weblayer/public/tab_observer.h"
 
 namespace weblayer {
@@ -32,7 +32,7 @@ class TabCallbackProxy : public TabObserver {
   void OnTitleUpdated(const std::u16string& title) override;
 
  private:
-  Tab* tab_;
+  raw_ptr<Tab> tab_;
   base::android::ScopedJavaGlobalRef<jobject> java_observer_;
 };
 
diff --git a/chromium/weblayer/browser/tab_impl.cc b/chromium/weblayer/browser/tab_impl.cc
index fdd9c389007..41ce1efcff7 100644
--- a/chromium/weblayer/browser/tab_impl.cc
+++ b/chromium/weblayer/browser/tab_impl.cc
@@ -54,7 +54,6 @@
 #include "content/public/browser/render_widget_host_view.h"
 #include "content/public/browser/renderer_preferences_util.h"
 #include "content/public/browser/web_contents.h"
-#include "content/public/browser/web_contents_observer.h"
 #include "third_party/blink/public/common/renderer_preferences/renderer_preferences.h"
 #include "third_party/blink/public/common/web_preferences/web_preferences.h"
 #include "third_party/blink/public/mojom/context_menu/context_menu.mojom.h"
@@ -254,15 +253,6 @@ std::set<TabImpl*>& GetTabs() {
   return *s_all_tab_impl;
 }
 
-// Simulates a WeakPtr for WebContents. Specifically if the WebContents
-// supplied to the constructor is destroyed then web_contents() returns
-// null.
-class WebContentsTracker : public content::WebContentsObserver {
- public:
-  explicit WebContentsTracker(content::WebContents* web_contents)
-      : content::WebContentsObserver(web_contents) {}
-};
-
 // Returns a scoped refptr to the SafeBrowsingService's database manager, if
 // available. Otherwise returns nullptr.
 const scoped_refptr<safe_browsing::SafeBrowsingDatabaseManager>
@@ -779,7 +769,7 @@ void TabImpl::UpdateBrowserControlsState(cc::BrowserControlsState new_state,
     animate = false;
   // The constraint is managed by Java code, so re-use the existing constraint
   // and only update the desired state.
-  web_contents_->GetMainFrame()->UpdateBrowserControlsState(
+  web_contents_->UpdateBrowserControlsState(
       current_browser_controls_visibility_constraint_, new_state, animate);
 }
 
@@ -955,15 +945,16 @@ content::WebContents* TabImpl::OpenURLFromTab(
   std::unique_ptr<content::WebContents> new_tab_contents =
       content::WebContents::Create(content::WebContents::CreateParams(
           web_contents()->GetBrowserContext()));
-  WebContentsTracker tracker(new_tab_contents.get());
+  base::WeakPtr<content::WebContents> new_tab_contents_weak_ptr(
+      new_tab_contents->GetWeakPtr());
   bool was_blocked = false;
   AddNewContents(web_contents(), std::move(new_tab_contents), params.url,
                  params.disposition, {}, params.user_gesture, &was_blocked);
-  if (was_blocked || !tracker.web_contents())
+  if (was_blocked || !new_tab_contents_weak_ptr)
     return nullptr;
-  tracker.web_contents()->GetController().LoadURLWithParams(
+  new_tab_contents_weak_ptr->GetController().LoadURLWithParams(
       content::NavigationController::LoadURLParams(params));
-  return tracker.web_contents();
+  return new_tab_contents_weak_ptr.get();
 }
 
 void TabImpl::ShowRepostFormWarningDialog(content::WebContents* source) {
@@ -1134,8 +1125,7 @@ bool TabImpl::CheckMediaAccessPermission(
           ? ContentSettingsType::MEDIASTREAM_MIC
           : ContentSettingsType::MEDIASTREAM_CAMERA;
   return PermissionManagerFactory::GetForBrowserContext(
-             content::WebContents::FromRenderFrameHost(render_frame_host)
-                 ->GetBrowserContext())
+             render_frame_host->GetBrowserContext())
              ->GetPermissionStatusForFrame(content_settings_type,
                                            render_frame_host, security_origin)
              .content_setting == CONTENT_SETTING_ALLOW;
@@ -1264,7 +1254,8 @@ void TabImpl::FindMatchRectsReply(content::WebContents* web_contents,
 }
 #endif
 
-void TabImpl::RenderProcessGone(base::TerminationStatus status) {
+void TabImpl::PrimaryMainFrameRenderProcessGone(
+    base::TerminationStatus status) {
 #if defined(OS_ANDROID)
   // If a renderer process is lost when the tab is not visible, indicate to the
   // WebContents that it should automatically reload the next time it becomes
@@ -1327,7 +1318,7 @@ void TabImpl::OnUpdateBrowserControlsStateBecauseOfProcessSwitch(
       // here is likely to be racy, so the top-view is always shown.
       const bool animate =
           !base::FeatureList::IsEnabled(kImmediatelyHideBrowserControlsForTest);
-      web_contents_->GetMainFrame()->UpdateBrowserControlsState(
+      web_contents_->UpdateBrowserControlsState(
           cc::BrowserControlsState::kBoth, cc::BrowserControlsState::kShown,
           animate);
       // This falls through to call UpdateBrowserControlsState() again to
@@ -1391,14 +1382,9 @@ void TabImpl::InitializeAutofillDriver() {
 
   autofill::AutofillManager::AutofillDownloadManagerState
       enable_autofill_download_manager =
-          autofill::AutofillManager::DISABLE_AUTOFILL_DOWNLOAD_MANAGER;
-  if (base::FeatureList::IsEnabled(
-          autofill::features::kAndroidAutofillQueryServerFieldTypes) &&
-      (!autofill::AutofillProvider::
-           is_download_manager_disabled_for_testing())) {
-    enable_autofill_download_manager =
-        autofill::AutofillManager::ENABLE_AUTOFILL_DOWNLOAD_MANAGER;
-  }
+          autofill::AutofillProvider::is_download_manager_disabled_for_testing()
+              ? autofill::AutofillManager::DISABLE_AUTOFILL_DOWNLOAD_MANAGER
+              : autofill::AutofillManager::ENABLE_AUTOFILL_DOWNLOAD_MANAGER;
 
   autofill::ContentAutofillDriverFactory::CreateForWebContentsAndDelegate(
       web_contents, AutofillClientImpl::FromWebContents(web_contents),
diff --git a/chromium/weblayer/browser/tab_impl.h b/chromium/weblayer/browser/tab_impl.h
index 43462d1805d..db74cc5f0f0 100644
--- a/chromium/weblayer/browser/tab_impl.h
+++ b/chromium/weblayer/browser/tab_impl.h
@@ -10,7 +10,7 @@
 #include <string>
 
 #include "base/callback_forward.h"
-#include "base/macros.h"
+#include "base/memory/raw_ptr.h"
 #include "base/memory/weak_ptr.h"
 #include "base/observer_list.h"
 #include "build/build_config.h"
@@ -329,7 +329,8 @@ class TabImpl : public Tab,
 #endif
 
   // content::WebContentsObserver:
-  void RenderProcessGone(base::TerminationStatus status) override;
+  void PrimaryMainFrameRenderProcessGone(
+      base::TerminationStatus status) override;
   void DidChangeVisibleSecurityState() override;
 
   // find_in_page::FindResultObserver:
@@ -367,20 +368,21 @@ class TabImpl : public Tab,
 
   void EnterFullscreenImpl();
 
-  BrowserImpl* browser_ = nullptr;
-  ErrorPageDelegate* error_page_delegate_ = nullptr;
-  FullscreenDelegate* fullscreen_delegate_ = nullptr;
-  NewTabDelegate* new_tab_delegate_ = nullptr;
-  GoogleAccountsDelegate* google_accounts_delegate_ = nullptr;
-  ProfileImpl* profile_;
+  raw_ptr<BrowserImpl> browser_ = nullptr;
+  raw_ptr<ErrorPageDelegate> error_page_delegate_ = nullptr;
+  raw_ptr<FullscreenDelegate> fullscreen_delegate_ = nullptr;
+  raw_ptr<NewTabDelegate> new_tab_delegate_ = nullptr;
+  raw_ptr<GoogleAccountsDelegate> google_accounts_delegate_ = nullptr;
+  raw_ptr<ProfileImpl> profile_;
   std::unique_ptr<content::WebContents> web_contents_;
   std::unique_ptr<NavigationControllerImpl> navigation_controller_;
   base::ObserverList<TabObserver>::Unchecked observers_;
   base::CallbackListSubscription locale_change_subscription_;
 
 #if defined(OS_ANDROID)
-  BrowserControlsContainerView* top_controls_container_view_ = nullptr;
-  BrowserControlsContainerView* bottom_controls_container_view_ = nullptr;
+  raw_ptr<BrowserControlsContainerView> top_controls_container_view_ = nullptr;
+  raw_ptr<BrowserControlsContainerView> bottom_controls_container_view_ =
+      nullptr;
   base::android::ScopedJavaGlobalRef<jobject> java_impl_;
   std::unique_ptr<BrowserControlsNavigationStateHandler>
       browser_controls_navigation_state_handler_;
diff --git a/chromium/weblayer/browser/translate_browsertest.cc b/chromium/weblayer/browser/translate_browsertest.cc
index 3d2ce9b28c1..1fbf313e136 100644
--- a/chromium/weblayer/browser/translate_browsertest.cc
+++ b/chromium/weblayer/browser/translate_browsertest.cc
@@ -7,6 +7,7 @@
 #include "components/translate/core/browser/language_state.h"
 #include "components/translate/core/browser/translate_error_details.h"
 #include "components/translate/core/browser/translate_manager.h"
+#include "components/translate/core/common/language_detection_details.h"
 #include "components/translate/core/common/translate_switches.h"
 #include "content/public/browser/browser_context.h"
 #include "net/base/mock_network_change_notifier.h"
@@ -16,8 +17,10 @@
 #include "weblayer/browser/profile_impl.h"
 #include "weblayer/browser/tab_impl.h"
 #include "weblayer/browser/translate_client_impl.h"
+#include "weblayer/public/navigation_controller.h"
 #include "weblayer/public/tab.h"
 #include "weblayer/shell/browser/shell.h"
+#include "weblayer/test/test_navigation_observer.h"
 #include "weblayer/test/weblayer_browser_test.h"
 #include "weblayer/test/weblayer_browser_test_utils.h"
 
@@ -240,6 +243,30 @@ IN_PROC_BROWSER_TEST_F(TranslateBrowserTest, PageLanguageDetection) {
   EXPECT_EQ("fr", translate_client->GetLanguageState().source_language());
 }
 
+// Tests that firing the page language determined notification for a
+// failed-but-committed navigation does not cause a crash. Regression test for
+// crbug.com/1262047.
+IN_PROC_BROWSER_TEST_F(TranslateBrowserTest,
+                       PageLanguageDetectionInFailedButCommittedNavigation) {
+  TranslateClientImpl* translate_client = GetTranslateClient(shell());
+
+  auto url = embedded_test_server()->GetURL("/empty404.html");
+  TestNavigationObserver navigation_failed_observer(
+      url, TestNavigationObserver::NavigationEvent::kFailure, shell());
+  shell()->tab()->GetNavigationController()->Navigate(url);
+  navigation_failed_observer.Wait();
+
+  // Fire the OnLanguageDetermined() notification manually to mimic the
+  // production flow in which this is crashing (crbug.com/1262047).
+  // TODO(blundell): Replace this manual triggering by doing a
+  // failed-but-committed navigation that results in the OnLanguageDetermined()
+  // notification firing once I determine which navigations result in that flow
+  // in production.
+  translate::LanguageDetectionDetails language_details;
+  language_details.adopted_language = "en";
+  translate_client->OnLanguageDetermined(language_details);
+}
+
 // Test that the translation was successful.
 IN_PROC_BROWSER_TEST_F(TranslateBrowserTest, PageTranslationSuccess) {
   SetTranslateScript(kTestValidScript);
diff --git a/chromium/weblayer/browser/translate_client_impl.cc b/chromium/weblayer/browser/translate_client_impl.cc
index 123fbe5fc94..7e895456024 100644
--- a/chromium/weblayer/browser/translate_client_impl.cc
+++ b/chromium/weblayer/browser/translate_client_impl.cc
@@ -55,8 +55,8 @@ std::unique_ptr<translate::TranslatePrefs> CreateTranslatePrefs(
 
 TranslateClientImpl::TranslateClientImpl(content::WebContents* web_contents)
     : content::WebContentsObserver(web_contents),
+      content::WebContentsUserData<TranslateClientImpl>(*web_contents),
       translate_driver_(*web_contents,
-                        &web_contents->GetController(),
                         /*url_language_histogram=*/nullptr,
                         /*translate_model_service=*/nullptr),
       translate_manager_(new translate::TranslateManager(
diff --git a/chromium/weblayer/browser/translate_compact_infobar.h b/chromium/weblayer/browser/translate_compact_infobar.h
index 767a3d2ed81..07800f2248e 100644
--- a/chromium/weblayer/browser/translate_compact_infobar.h
+++ b/chromium/weblayer/browser/translate_compact_infobar.h
@@ -6,7 +6,6 @@
 #define WEBLAYER_BROWSER_TRANSLATE_COMPACT_INFOBAR_H_
 
 #include "base/android/scoped_java_ref.h"
-#include "base/macros.h"
 #include "components/infobars/android/infobar_android.h"
 #include "components/translate/core/browser/translate_infobar_delegate.h"
 #include "components/translate/core/browser/translate_step.h"
diff --git a/chromium/weblayer/browser/url_bar/page_info_delegate_impl.h b/chromium/weblayer/browser/url_bar/page_info_delegate_impl.h
index d9ffb83d421..92fc5a6afbf 100644
--- a/chromium/weblayer/browser/url_bar/page_info_delegate_impl.h
+++ b/chromium/weblayer/browser/url_bar/page_info_delegate_impl.h
@@ -7,6 +7,7 @@
 
 #include <string>
 
+#include "base/memory/raw_ptr.h"
 #include "build/build_config.h"
 #include "components/browsing_data/content/local_shared_objects_container.h"
 #include "components/page_info/page_info.h"
@@ -66,7 +67,7 @@ class PageInfoDelegateImpl : public PageInfoDelegate {
  private:
   content::BrowserContext* GetBrowserContext() const;
 
-  content::WebContents* web_contents_;
+  raw_ptr<content::WebContents> web_contents_;
 };
 
 }  //  namespace weblayer
diff --git a/chromium/weblayer/browser/url_bar/trusted_cdn_observer.cc b/chromium/weblayer/browser/url_bar/trusted_cdn_observer.cc
index f7ae9cb8eda..ec15f627866 100644
--- a/chromium/weblayer/browser/url_bar/trusted_cdn_observer.cc
+++ b/chromium/weblayer/browser/url_bar/trusted_cdn_observer.cc
@@ -11,7 +11,8 @@
 namespace weblayer {
 
 TrustedCDNObserver::TrustedCDNObserver(content::WebContents* web_contents)
-    : WebContentsObserver(web_contents) {}
+    : WebContentsObserver(web_contents),
+      content::WebContentsUserData<TrustedCDNObserver>(*web_contents) {}
 
 TrustedCDNObserver::~TrustedCDNObserver() = default;
 
diff --git a/chromium/weblayer/browser/url_bar/url_bar_browsertest.cc b/chromium/weblayer/browser/url_bar/url_bar_browsertest.cc
index d56c7062c8f..28e3fc3b6d2 100644
--- a/chromium/weblayer/browser/url_bar/url_bar_browsertest.cc
+++ b/chromium/weblayer/browser/url_bar/url_bar_browsertest.cc
@@ -2,6 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+#include "base/memory/raw_ptr.h"
 #include "base/run_loop.h"
 #include "net/test/embedded_test_server/embedded_test_server.h"
 #include "weblayer/browser/browser_impl.h"
@@ -45,8 +46,8 @@ class UrlBarBrowserTest : public WebLayerBrowserTest {
   void SetActiveTab(TabImpl* tab) { shell()->browser()->SetActiveTab(tab); }
 
  protected:
-  TabImpl* tab_ = nullptr;
-  TabImpl* another_tab_ = nullptr;
+  raw_ptr<TabImpl> tab_ = nullptr;
+  raw_ptr<TabImpl> another_tab_ = nullptr;
 
  private:
   BrowserImpl* browser_impl() {
diff --git a/chromium/weblayer/browser/url_bar/url_bar_controller_impl.h b/chromium/weblayer/browser/url_bar/url_bar_controller_impl.h
index d80a8dea197..c1b10364ea3 100644
--- a/chromium/weblayer/browser/url_bar/url_bar_controller_impl.h
+++ b/chromium/weblayer/browser/url_bar/url_bar_controller_impl.h
@@ -7,6 +7,7 @@
 
 #include <string>
 
+#include "base/memory/raw_ptr.h"
 #include "build/build_config.h"
 #include "components/omnibox/browser/location_bar_model_delegate.h"
 #include "weblayer/public/url_bar_controller.h"
@@ -51,7 +52,7 @@ class UrlBarControllerImpl : public UrlBarController,
 
  private:
   content::WebContents* GetActiveWebContents() const;
-  BrowserImpl* const browser_;
+  const raw_ptr<BrowserImpl> browser_;
   std::unique_ptr<LocationBarModelImpl> location_bar_model_;
 };
 
diff --git a/chromium/weblayer/browser/web_contents_view_delegate_impl.cc b/chromium/weblayer/browser/web_contents_view_delegate_impl.cc
index f0895f8f803..cf0ca040635 100644
--- a/chromium/weblayer/browser/web_contents_view_delegate_impl.cc
+++ b/chromium/weblayer/browser/web_contents_view_delegate_impl.cc
@@ -15,7 +15,7 @@ WebContentsViewDelegateImpl::WebContentsViewDelegateImpl(
 WebContentsViewDelegateImpl::~WebContentsViewDelegateImpl() = default;
 
 void WebContentsViewDelegateImpl::ShowContextMenu(
-    content::RenderFrameHost* render_frame_host,
+    content::RenderFrameHost& render_frame_host,
     const content::ContextMenuParams& params) {
   TabImpl* tab = TabImpl::FromWebContents(web_contents_);
   if (tab)
diff --git a/chromium/weblayer/browser/web_contents_view_delegate_impl.h b/chromium/weblayer/browser/web_contents_view_delegate_impl.h
index 3224e9b0112..e597ebf4935 100644
--- a/chromium/weblayer/browser/web_contents_view_delegate_impl.h
+++ b/chromium/weblayer/browser/web_contents_view_delegate_impl.h
@@ -5,7 +5,7 @@
 #ifndef WEBLAYER_BROWSER_WEB_CONTENTS_VIEW_DELEGATE_IMPL_H_
 #define WEBLAYER_BROWSER_WEB_CONTENTS_VIEW_DELEGATE_IMPL_H_
 
-#include "base/macros.h"
+#include "base/memory/raw_ptr.h"
 #include "content/public/browser/web_contents_view_delegate.h"
 
 namespace content {
@@ -25,11 +25,11 @@ class WebContentsViewDelegateImpl : public content::WebContentsViewDelegate {
   ~WebContentsViewDelegateImpl() override;
 
   // WebContentsViewDelegate overrides.
-  void ShowContextMenu(content::RenderFrameHost* render_frame_host,
+  void ShowContextMenu(content::RenderFrameHost& render_frame_host,
                        const content::ContextMenuParams& params) override;
 
  private:
-  content::WebContents* web_contents_;
+  raw_ptr<content::WebContents> web_contents_;
 };
 
 }  // namespace weblayer
diff --git a/chromium/weblayer/browser/webapps/weblayer_webapps_client.cc b/chromium/weblayer/browser/webapps/weblayer_webapps_client.cc
index 7597bf9b91d..c0ce917f455 100644
--- a/chromium/weblayer/browser/webapps/weblayer_webapps_client.cc
+++ b/chromium/weblayer/browser/webapps/weblayer_webapps_client.cc
@@ -18,7 +18,7 @@
 #include "base/guid.h"
 #include "components/webapps/browser/android/add_to_homescreen_params.h"
 #include "components/webapps/browser/android/shortcut_info.h"
-#include "ui/android/color_helpers.h"
+#include "ui/android/color_utils_android.h"
 #include "ui/gfx/android/java_bitmap.h"
 #include "url/gurl.h"
 #endif
diff --git a/chromium/weblayer/browser/weblayer_field_trials.cc b/chromium/weblayer/browser/weblayer_field_trials.cc
index 8ba011f7f09..edea544eae6 100644
--- a/chromium/weblayer/browser/weblayer_field_trials.cc
+++ b/chromium/weblayer/browser/weblayer_field_trials.cc
@@ -10,7 +10,7 @@
 
 namespace weblayer {
 
-void WebLayerFieldTrials::SetupFieldTrials() {
+void WebLayerFieldTrials::SetUpFieldTrials() {
   // Persistent histograms must be enabled as soon as possible.
   base::FilePath metrics_dir;
   if (base::PathService::Get(DIR_USER_DATA, &metrics_dir)) {
diff --git a/chromium/weblayer/browser/weblayer_field_trials.h b/chromium/weblayer/browser/weblayer_field_trials.h
index d4a527145d2..f5c2cdd4d37 100644
--- a/chromium/weblayer/browser/weblayer_field_trials.h
+++ b/chromium/weblayer/browser/weblayer_field_trials.h
@@ -5,7 +5,6 @@
 #ifndef WEBLAYER_BROWSER_WEBLAYER_FIELD_TRIALS_H_
 #define WEBLAYER_BROWSER_WEBLAYER_FIELD_TRIALS_H_
 
-#include "base/macros.h"
 #include "components/variations/platform_field_trials.h"
 
 namespace weblayer {
@@ -22,8 +21,8 @@ class WebLayerFieldTrials : public variations::PlatformFieldTrials {
   ~WebLayerFieldTrials() override = default;
 
   // variations::PlatformFieldTrials:
-  void SetupFieldTrials() override;
-  void SetupFeatureControllingFieldTrials(
+  void SetUpFieldTrials() override;
+  void SetUpFeatureControllingFieldTrials(
       bool has_seed,
       const base::FieldTrial::EntropyProvider* low_entropy_provider,
       base::FeatureList* feature_list) override {}
diff --git a/chromium/weblayer/browser/weblayer_impl_android.cc b/chromium/weblayer/browser/weblayer_impl_android.cc
index 53e0107f48e..9e4f8fca0cf 100644
--- a/chromium/weblayer/browser/weblayer_impl_android.cc
+++ b/chromium/weblayer/browser/weblayer_impl_android.cc
@@ -13,7 +13,6 @@
 #include "components/page_info/android/page_info_client.h"
 #include "weblayer/browser/android/metrics/weblayer_metrics_service_client.h"
 #include "weblayer/browser/component_updater/registration.h"
-#include "weblayer/browser/default_search_engine.h"
 #include "weblayer/browser/devtools_server_android.h"
 #include "weblayer/browser/java/jni/WebLayerImpl_jni.h"
 #include "weblayer/browser/url_bar/page_info_client_impl.h"
@@ -66,14 +65,6 @@ std::u16string GetClientApplicationName() {
       env, Java_WebLayerImpl_getEmbedderName(env));
 }
 
-static jboolean JNI_WebLayerImpl_IsLocationPermissionManaged(
-    JNIEnv* env,
-    const base::android::JavaParamRef<jstring>& origin) {
-  return IsPermissionControlledByDse(
-      ContentSettingsType::GEOLOCATION,
-      url::Origin::Create(GURL(ConvertJavaStringToUTF8(origin))));
-}
-
 static base::android::ScopedJavaLocalRef<jobjectArray>
 JNI_WebLayerImpl_GetComponentLoaderPolicies(JNIEnv* env) {
   return component_updater::AndroidComponentLoaderPolicy::
diff --git a/chromium/weblayer/browser/weblayer_security_blocking_page_factory.cc b/chromium/weblayer/browser/weblayer_security_blocking_page_factory.cc
index 7b30e247dee..b44b17ebbda 100644
--- a/chromium/weblayer/browser/weblayer_security_blocking_page_factory.cc
+++ b/chromium/weblayer/browser/weblayer_security_blocking_page_factory.cc
@@ -154,27 +154,6 @@ WebLayerSecurityBlockingPageFactory::CreateBadClockBlockingPage(
   return interstitial_page;
 }
 
-std::unique_ptr<LegacyTLSBlockingPage>
-WebLayerSecurityBlockingPageFactory::CreateLegacyTLSBlockingPage(
-    content::WebContents* web_contents,
-    int cert_error,
-    const GURL& request_url,
-    std::unique_ptr<SSLCertReporter> ssl_cert_reporter,
-    const net::SSLInfo& ssl_info) {
-  auto controller_client = std::make_unique<SSLErrorControllerClient>(
-      web_contents, cert_error, ssl_info, request_url,
-      CreateMetricsHelperAndStartRecording(web_contents, request_url,
-                                           "legacy_tls", false),
-      CreateSettingsPageHelper());
-
-  auto interstitial_page = std::make_unique<LegacyTLSBlockingPage>(
-      web_contents, cert_error, request_url, std::move(ssl_cert_reporter),
-      /*can_show_enhanced_protection_message=*/false, ssl_info,
-      std::move(controller_client));
-
-  return interstitial_page;
-}
-
 std::unique_ptr<MITMSoftwareBlockingPage>
 WebLayerSecurityBlockingPageFactory::CreateMITMSoftwareBlockingPage(
     content::WebContents* web_contents,
diff --git a/chromium/weblayer/browser/weblayer_security_blocking_page_factory.h b/chromium/weblayer/browser/weblayer_security_blocking_page_factory.h
index 7d1a1b67310..342dee71332 100644
--- a/chromium/weblayer/browser/weblayer_security_blocking_page_factory.h
+++ b/chromium/weblayer/browser/weblayer_security_blocking_page_factory.h
@@ -5,7 +5,6 @@
 #ifndef WEBLAYER_BROWSER_WEBLAYER_SECURITY_BLOCKING_PAGE_FACTORY_H_
 #define WEBLAYER_BROWSER_WEBLAYER_SECURITY_BLOCKING_PAGE_FACTORY_H_
 
-#include "base/macros.h"
 #include "build/build_config.h"
 #include "components/captive_portal/core/buildflags.h"
 #include "components/security_interstitials/content/bad_clock_blocking_page.h"
@@ -55,12 +54,6 @@ class WebLayerSecurityBlockingPageFactory : public SecurityBlockingPageFactory {
       const base::Time& time_triggered,
       ssl_errors::ClockState clock_state,
       std::unique_ptr<SSLCertReporter> ssl_cert_reporter) override;
-  std::unique_ptr<LegacyTLSBlockingPage> CreateLegacyTLSBlockingPage(
-      content::WebContents* web_contents,
-      int cert_error,
-      const GURL& request_url,
-      std::unique_ptr<SSLCertReporter> ssl_cert_reporter,
-      const net::SSLInfo& ssl_info) override;
   std::unique_ptr<MITMSoftwareBlockingPage> CreateMITMSoftwareBlockingPage(
       content::WebContents* web_contents,
       int cert_error,
diff --git a/chromium/weblayer/browser/weblayer_speech_recognition_manager_delegate.cc b/chromium/weblayer/browser/weblayer_speech_recognition_manager_delegate.cc
index 8c941e61ea8..69dce9ef1c9 100644
--- a/chromium/weblayer/browser/weblayer_speech_recognition_manager_delegate.cc
+++ b/chromium/weblayer/browser/weblayer_speech_recognition_manager_delegate.cc
@@ -7,7 +7,6 @@
 #include <string>
 
 #include "base/bind.h"
-#include "base/macros.h"
 #include "build/build_config.h"
 #include "content/public/browser/browser_task_traits.h"
 #include "content/public/browser/browser_thread.h"
diff --git a/chromium/weblayer/browser/weblayer_speech_recognition_manager_delegate.h b/chromium/weblayer/browser/weblayer_speech_recognition_manager_delegate.h
index 6c9aef19ef1..541982ee6d7 100644
--- a/chromium/weblayer/browser/weblayer_speech_recognition_manager_delegate.h
+++ b/chromium/weblayer/browser/weblayer_speech_recognition_manager_delegate.h
@@ -5,7 +5,6 @@
 #ifndef WEBLAYER_BROWSER_WEBLAYER_SPEECH_RECOGNITION_MANAGER_DELEGATE_H_
 #define WEBLAYER_BROWSER_WEBLAYER_SPEECH_RECOGNITION_MANAGER_DELEGATE_H_
 
-#include "base/macros.h"
 #include "content/public/browser/speech_recognition_event_listener.h"
 #include "content/public/browser/speech_recognition_manager_delegate.h"
 #include "content/public/browser/speech_recognition_session_config.h"
diff --git a/chromium/weblayer/browser/weblayer_variations_service_client.h b/chromium/weblayer/browser/weblayer_variations_service_client.h
index 66b7542029a..6c8b40a2515 100644
--- a/chromium/weblayer/browser/weblayer_variations_service_client.h
+++ b/chromium/weblayer/browser/weblayer_variations_service_client.h
@@ -7,7 +7,7 @@
 
 #include <string>
 
-#include "base/macros.h"
+#include "base/memory/raw_ptr.h"
 #include "base/memory/scoped_refptr.h"
 #include "components/variations/service/variations_service_client.h"
 
@@ -39,7 +39,7 @@ class WebLayerVariationsServiceClient
   bool OverridesRestrictParameter(std::string* parameter) override;
   bool IsEnterprise() override;
 
-  SystemNetworkContextManager* network_context_manager_;
+  raw_ptr<SystemNetworkContextManager> network_context_manager_;
 };
 
 }  // namespace weblayer
diff --git a/chromium/weblayer/browser/webui/net_export_ui.cc b/chromium/weblayer/browser/webui/net_export_ui.cc
index 8ba1fa15381..4980c2bcbe9 100644
--- a/chromium/weblayer/browser/webui/net_export_ui.cc
+++ b/chromium/weblayer/browser/webui/net_export_ui.cc
@@ -4,6 +4,7 @@
 
 #include "weblayer/browser/webui/net_export_ui.h"
 
+#include "base/memory/raw_ptr.h"
 #include "base/scoped_observation.h"
 #include "base/strings/utf_string_conversions.h"
 #include "components/net_log/net_export_file_writer.h"
@@ -64,7 +65,7 @@ class NetExportMessageHandler
   void OnEnableNotifyUIWithState(const base::ListValue* list) {
     AllowJavascript();
     if (!state_observation_manager_.IsObserving()) {
-      state_observation_manager_.Observe(file_writer_);
+      state_observation_manager_.Observe(file_writer_.get());
     }
     NotifyUIWithState(file_writer_->GetState());
   }
@@ -137,7 +138,7 @@ class NetExportMessageHandler
   }
 
   // Cached pointer to SystemNetworkContextManager's NetExportFileWriter.
-  net_log::NetExportFileWriter* file_writer_;
+  raw_ptr<net_log::NetExportFileWriter> file_writer_;
 
   base::ScopedObservation<net_log::NetExportFileWriter,
                           net_log::NetExportFileWriter::StateObserver>
diff --git a/chromium/weblayer/browser/webui/web_ui_controller_factory.h b/chromium/weblayer/browser/webui/web_ui_controller_factory.h
index 716313c2292..4a9e73fb914 100644
--- a/chromium/weblayer/browser/webui/web_ui_controller_factory.h
+++ b/chromium/weblayer/browser/webui/web_ui_controller_factory.h
@@ -5,7 +5,6 @@
 #ifndef WEBLAYER_BROWSER_WEBUI_WEB_UI_CONTROLLER_FACTORY_H_
 #define WEBLAYER_BROWSER_WEBUI_WEB_UI_CONTROLLER_FACTORY_H_
 
-#include "base/macros.h"
 #include "base/no_destructor.h"
 #include "content/public/browser/web_ui_controller_factory.h"
 
diff --git a/chromium/weblayer/common/crash_reporter/crash_keys.cc b/chromium/weblayer/common/crash_reporter/crash_keys.cc
index 772345242fa..1a46b777f4e 100644
--- a/chromium/weblayer/common/crash_reporter/crash_keys.cc
+++ b/chromium/weblayer/common/crash_reporter/crash_keys.cc
@@ -31,7 +31,7 @@ const char* const kWebLayerCrashKeyAllowList[] = {
 
     // gpu
     "gpu-driver", "gpu-psver", "gpu-vsver", "gpu-gl-vendor", "gpu-gl-renderer",
-    "oop_read_failure",
+    "oop_read_failure", "gpu-gl-error-message",
 
     // content/:
     "bad_message_reason", "discardable-memory-allocated",
diff --git a/chromium/weblayer/public/java/org/chromium/weblayer/Browser.java b/chromium/weblayer/public/java/org/chromium/weblayer/Browser.java
index 333b14d6137..0b960a2f398 100644
--- a/chromium/weblayer/public/java/org/chromium/weblayer/Browser.java
+++ b/chromium/weblayer/public/java/org/chromium/weblayer/Browser.java
@@ -40,6 +40,31 @@ public class Browser {
     private final ObserverList<BrowserControlsOffsetCallback> mBrowserControlsOffsetCallbacks;
     private final ObserverList<BrowserRestoreCallback> mBrowserRestoreCallbacks;
 
+    private static int sMaxNavigationsPerTabForInstanceState;
+
+    /**
+     * Sets the maximum number of navigations saved when persisting a Browsers instance state. The
+     * max applies to each Tab in the Browser. For example, if a value of 6 is supplied and the
+     * Browser has 4 tabs, then up to 24 navigation entries may be saved. The supplied value is
+     * a recommendation, for various reasons it may not be honored. A value of 0 results in
+     * using the default.
+     *
+     * @param value The maximum number of navigations to persist.
+     *
+     * @throws IllegalArgumentException If {@code value} is less than 0.
+     *
+     * @since 98
+     */
+    public static void setMaxNavigationsPerTabForInstanceState(int value) {
+        ThreadCheck.ensureOnUiThread();
+        if (value < 0) throw new IllegalArgumentException("Max must be >= 0");
+        sMaxNavigationsPerTabForInstanceState = value;
+    }
+
+    static int getMaxNavigationsPerTabForInstanceState() {
+        return sMaxNavigationsPerTabForInstanceState;
+    }
+
     // Constructor for test mocking.
     protected Browser() {
         mImpl = null;
diff --git a/chromium/weblayer/public/java/org/chromium/weblayer/Navigation.java b/chromium/weblayer/public/java/org/chromium/weblayer/Navigation.java
index dbfad2a057d..c9427992bd3 100644
--- a/chromium/weblayer/public/java/org/chromium/weblayer/Navigation.java
+++ b/chromium/weblayer/public/java/org/chromium/weblayer/Navigation.java
@@ -305,6 +305,28 @@ public class Navigation extends IClientNavigation.Stub {
     }
 
     /**
+     * Disables intent processing for the lifetime of this navigation (including following
+     * redirects). This method may only be called from
+     * {@link NavigationCallback.onNavigationStarted}.
+     *
+     * @throws IllegalStateException If not called during start.
+     *
+     * @since 97
+     */
+    public void disableIntentProcessing() {
+        ThreadCheck.ensureOnUiThread();
+        if (WebLayer.shouldPerformVersionChecks()
+                && WebLayer.getSupportedMajorVersionInternal() < 97) {
+            throw new UnsupportedOperationException();
+        }
+        try {
+            mNavigationImpl.disableIntentProcessing();
+        } catch (RemoteException e) {
+            throw new APICallException(e);
+        }
+    }
+
+    /**
      * Sets the user-agent string that applies to the current navigation. This user-agent is not
      * sticky, it applies to this navigation only (and any redirects or resources that are loaded).
      * This method may only be called from {@link NavigationCallback.onNavigationStarted}.
diff --git a/chromium/weblayer/public/java/org/chromium/weblayer/NavigationCallback.java b/chromium/weblayer/public/java/org/chromium/weblayer/NavigationCallback.java
index b94361621be..7ba28025595 100644
--- a/chromium/weblayer/public/java/org/chromium/weblayer/NavigationCallback.java
+++ b/chromium/weblayer/public/java/org/chromium/weblayer/NavigationCallback.java
@@ -81,10 +81,10 @@ public abstract class NavigationCallback {
      * The load state of the document has changed.
      *
      * @param isLoading Whether any resource is loading.
-     * @param toDifferentDocument True if the main frame is loading a different document. Only valid
-     *        when |isLoading| is true.
+     * @param shouldShowLoadingUi True if the navigation is expected to show navigation-in-progress
+     *        UI (if any exists). Only valid when |isLoading| is true.
      */
-    public void onLoadStateChanged(boolean isLoading, boolean toDifferentDocument) {}
+    public void onLoadStateChanged(boolean isLoading, boolean shouldShowLoadingUi) {}
 
     /**
      * The progress of loading the main frame in the document has changed.
diff --git a/chromium/weblayer/public/java/org/chromium/weblayer/NavigationController.java b/chromium/weblayer/public/java/org/chromium/weblayer/NavigationController.java
index 33ee6344716..5298d6fa306 100644
--- a/chromium/weblayer/public/java/org/chromium/weblayer/NavigationController.java
+++ b/chromium/weblayer/public/java/org/chromium/weblayer/NavigationController.java
@@ -334,10 +334,10 @@ public class NavigationController {
         }
 
         @Override
-        public void loadStateChanged(boolean isLoading, boolean toDifferentDocument) {
+        public void loadStateChanged(boolean isLoading, boolean shouldShowLoadingUi) {
             StrictModeWorkaround.apply();
             for (NavigationCallback callback : mCallbacks) {
-                callback.onLoadStateChanged(isLoading, toDifferentDocument);
+                callback.onLoadStateChanged(isLoading, shouldShowLoadingUi);
             }
         }
 
diff --git a/chromium/weblayer/public/java/org/chromium/weblayer/WebLayer.java b/chromium/weblayer/public/java/org/chromium/weblayer/WebLayer.java
index ba3452b3404..86d5030b957 100644
--- a/chromium/weblayer/public/java/org/chromium/weblayer/WebLayer.java
+++ b/chromium/weblayer/public/java/org/chromium/weblayer/WebLayer.java
@@ -826,6 +826,11 @@ public class WebLayer {
             // The id is part of the public library to avoid conflicts.
             return R.id.weblayer_remote_playback_api_notification;
         }
+
+        @Override
+        public int getMaxNavigationsPerTabForInstanceState() {
+            return Browser.getMaxNavigationsPerTabForInstanceState();
+        }
     }
 
     /** Utility class to use new APIs that were added in O (API level 26). */
diff --git a/chromium/weblayer/public/javatestutil/org/chromium/weblayer/TestWebLayer.java b/chromium/weblayer/public/javatestutil/org/chromium/weblayer/TestWebLayer.java
index 40bc3ab8fba..0b9a0a43506 100644
--- a/chromium/weblayer/public/javatestutil/org/chromium/weblayer/TestWebLayer.java
+++ b/chromium/weblayer/public/javatestutil/org/chromium/weblayer/TestWebLayer.java
@@ -205,4 +205,8 @@ public final class TestWebLayer {
         mITestWebLayer.fireOnAccessTokenIdentifiedAsInvalid(
                 profile.getIProfile(), ObjectWrapper.wrap(scopes), ObjectWrapper.wrap(token));
     }
+
+    public void grantLocationPermission(String url) throws RemoteException {
+        mITestWebLayer.grantLocationPermission(url);
+    }
 }
diff --git a/chromium/weblayer/public/main.h b/chromium/weblayer/public/main.h
index 6ff3e088e42..0412f123ad7 100644
--- a/chromium/weblayer/public/main.h
+++ b/chromium/weblayer/public/main.h
@@ -9,6 +9,7 @@
 
 #include "base/callback_forward.h"
 #include "base/files/file.h"
+#include "base/memory/raw_ptr.h"
 #include "build/build_config.h"
 
 #if defined(OS_WIN)
@@ -30,7 +31,7 @@ struct MainParams {
   MainParams(const MainParams& other);
   ~MainParams();
 
-  MainDelegate* delegate;
+  raw_ptr<MainDelegate> delegate;
 
   // If set, logging will redirect to this file.
   base::FilePath log_filename;
diff --git a/chromium/weblayer/public/navigation_observer.h b/chromium/weblayer/public/navigation_observer.h
index 06a5ac12aab..4868f7d2a0e 100644
--- a/chromium/weblayer/public/navigation_observer.h
+++ b/chromium/weblayer/public/navigation_observer.h
@@ -76,10 +76,10 @@ class NavigationObserver {
   virtual void NavigationFailed(Navigation* navigation) {}
 
   // Indicates that loading has started (|is_loading| is true) or is done
-  // (|is_loading| is false). |to_different_document| will be true unless the
+  // (|is_loading| is false). |should_show_loading_ui| will be true unless the
   // load is a fragment navigation, or triggered by
   // history.pushState/replaceState.
-  virtual void LoadStateChanged(bool is_loading, bool to_different_document) {}
+  virtual void LoadStateChanged(bool is_loading, bool should_show_loading_ui) {}
 
   // Indicates that the load progress of the page has changed. |progress|
   // ranges from 0.0 to 1.0.
diff --git a/chromium/weblayer/renderer/content_renderer_client_impl.h b/chromium/weblayer/renderer/content_renderer_client_impl.h
index c34e5eb48b0..8ab7db991e0 100644
--- a/chromium/weblayer/renderer/content_renderer_client_impl.h
+++ b/chromium/weblayer/renderer/content_renderer_client_impl.h
@@ -5,7 +5,6 @@
 #ifndef WEBLAYER_RENDERER_CONTENT_RENDERER_CLIENT_IMPL_H_
 #define WEBLAYER_RENDERER_CONTENT_RENDERER_CLIENT_IMPL_H_
 
-#include "base/macros.h"
 #include "build/build_config.h"
 #include "content/public/renderer/content_renderer_client.h"
 #include "third_party/blink/public/common/thread_safe_browser_interface_broker_proxy.h"
diff --git a/chromium/weblayer/renderer/weblayer_render_frame_observer.h b/chromium/weblayer/renderer/weblayer_render_frame_observer.h
index dcd9c056f3b..bec289b9e32 100644
--- a/chromium/weblayer/renderer/weblayer_render_frame_observer.h
+++ b/chromium/weblayer/renderer/weblayer_render_frame_observer.h
@@ -5,7 +5,6 @@
 #ifndef WEBLAYER_RENDERER_WEBLAYER_RENDER_FRAME_OBSERVER_H_
 #define WEBLAYER_RENDERER_WEBLAYER_RENDER_FRAME_OBSERVER_H_
 
-#include "base/macros.h"
 #include "components/safe_browsing/buildflags.h"
 #include "content/public/renderer/render_frame_observer.h"
 #include "third_party/blink/public/common/associated_interfaces/associated_interface_registry.h"
diff --git a/chromium/weblayer/shell/BUILD.gn b/chromium/weblayer/shell/BUILD.gn
index a5f7cc06245..25218e9a62a 100644
--- a/chromium/weblayer/shell/BUILD.gn
+++ b/chromium/weblayer/shell/BUILD.gn
@@ -158,6 +158,7 @@ repack("support_pak") {
     "$root_gen_dir/ui/resources/webui_generated_resources.pak",
     "$root_gen_dir/ui/resources/webui_resources.pak",
     "$root_gen_dir/ui/strings/app_locale_settings_en-US.pak",
+    "$root_gen_dir/ui/strings/ax_strings_en-US.pak",
     "$root_gen_dir/ui/strings/ui_strings_en-US.pak",
     "$root_gen_dir/weblayer/weblayer_resources.pak",
   ]
diff --git a/chromium/weblayer/shell/android/shell_apk/AndroidManifest.xml b/chromium/weblayer/shell/android/shell_apk/AndroidManifest.xml
index 35457b386a8..bd8cb5980e1 100644
--- a/chromium/weblayer/shell/android/shell_apk/AndroidManifest.xml
+++ b/chromium/weblayer/shell/android/shell_apk/AndroidManifest.xml
@@ -62,9 +62,18 @@
             <intent-filter>
                 <action android:name="android.intent.action.VIEW" />
                 <category android:name="android.intent.category.DEFAULT" />
-                <data android:scheme="http" />
-                <data android:scheme="https" />
-                <data android:scheme="about" />
+                <data android:scheme="data" />
+                <data android:host="externalnavtest" />
+                <category android:name="android.intent.category.BROWSABLE" />
+            </intent-filter>
+        </activity>
+        <activity android:name="org.chromium.weblayer.test.ExternalNavigationTest$SecondDummyActivity"
+                  android:exported="true" >
+            <intent-filter>
+                <action android:name="android.intent.action.VIEW" />
+                <category android:name="android.intent.category.DEFAULT" />
+                <data android:scheme="data" />
+                <data android:host="externalnavtest" />
                 <category android:name="android.intent.category.BROWSABLE" />
             </intent-filter>
         </activity>
diff --git a/chromium/weblayer/shell/android/shell_apk/src/org/chromium/weblayer/shell/WebLayerShellActivity.java b/chromium/weblayer/shell/android/shell_apk/src/org/chromium/weblayer/shell/WebLayerShellActivity.java
index 103e2c15489..261aa68d3ba 100644
--- a/chromium/weblayer/shell/android/shell_apk/src/org/chromium/weblayer/shell/WebLayerShellActivity.java
+++ b/chromium/weblayer/shell/android/shell_apk/src/org/chromium/weblayer/shell/WebLayerShellActivity.java
@@ -702,9 +702,9 @@ public class WebLayerShellActivity extends AppCompatActivity {
 
         mNavigationCallback = new NavigationCallback() {
             @Override
-            public void onLoadStateChanged(boolean isLoading, boolean toDifferentDocument) {
+            public void onLoadStateChanged(boolean isLoading, boolean shouldShowLoadingUi) {
                 mLoadProgressBar.setVisibility(
-                        isLoading && toDifferentDocument ? View.VISIBLE : View.INVISIBLE);
+                        isLoading && shouldShowLoadingUi ? View.VISIBLE : View.INVISIBLE);
             }
 
             @Override
diff --git a/chromium/weblayer/shell/browser/shell.cc b/chromium/weblayer/shell/browser/shell.cc
index cd03aaa4e17..c5718f95049 100644
--- a/chromium/weblayer/shell/browser/shell.cc
+++ b/chromium/weblayer/shell/browser/shell.cc
@@ -10,7 +10,6 @@
 #include <utility>
 
 #include "base/command_line.h"
-#include "base/macros.h"
 #include "base/no_destructor.h"
 #include "base/run_loop.h"
 #include "base/strings/string_util.h"
@@ -132,11 +131,11 @@ void Shell::DisplayedUrlChanged(const GURL& url) {
   PlatformSetAddressBarURL(url);
 }
 
-void Shell::LoadStateChanged(bool is_loading, bool to_different_document) {
+void Shell::LoadStateChanged(bool is_loading, bool should_show_loading_ui) {
   NavigationController* navigation_controller =
       tab()->GetNavigationController();
 
-  PlatformEnableUIControl(STOP_BUTTON, is_loading && to_different_document);
+  PlatformEnableUIControl(STOP_BUTTON, is_loading && should_show_loading_ui);
 
   // TODO(estade): These should be updated in callbacks that correspond to the
   // back/forward list changing, such as NavigationEntriesDeleted.
diff --git a/chromium/weblayer/shell/browser/shell.h b/chromium/weblayer/shell/browser/shell.h
index b5785609b8e..03a25aa85a7 100644
--- a/chromium/weblayer/shell/browser/shell.h
+++ b/chromium/weblayer/shell/browser/shell.h
@@ -12,6 +12,7 @@
 #include <vector>
 
 #include "base/callback_forward.h"
+#include "base/memory/raw_ptr.h"
 #include "base/memory/ref_counted.h"
 #include "build/build_config.h"
 #include "ui/gfx/geometry/size.h"
@@ -101,7 +102,7 @@ class Shell : public TabObserver,
   void DisplayedUrlChanged(const GURL& url) override;
 
   // NavigationObserver implementation:
-  void LoadStateChanged(bool is_loading, bool to_different_document) override;
+  void LoadStateChanged(bool is_loading, bool should_show_loading_ui) override;
   void LoadProgressChanged(double progress) override;
 
   // DownloadDelegate implementation:
@@ -170,7 +171,7 @@ class Shell : public TabObserver,
 #if defined(TOOLKIT_VIEWS)
   static views::ViewsDelegate* views_delegate_;
 
-  views::Widget* window_widget_;
+  raw_ptr<views::Widget> window_widget_;
 #endif  // defined(TOOLKIT_VIEWS)
 #endif  // defined(USE_AURA)
 
diff --git a/chromium/weblayer/shell/browser/shell_views.cc b/chromium/weblayer/shell/browser/shell_views.cc
index 5cf553951e9..1a4012cbf63 100644
--- a/chromium/weblayer/shell/browser/shell_views.cc
+++ b/chromium/weblayer/shell/browser/shell_views.cc
@@ -2,12 +2,14 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+#include "base/memory/raw_ptr.h"
 #include "weblayer/shell/browser/shell.h"
 
 #include <stddef.h>
 
 #include <memory>
 
+#include "base/bind.h"
 #include "base/command_line.h"
 #include "base/cxx17_backports.h"
 #include "base/strings/stringprintf.h"
@@ -28,8 +30,8 @@
 #include "ui/views/controls/textfield/textfield.h"
 #include "ui/views/controls/textfield/textfield_controller.h"
 #include "ui/views/controls/webview/webview.h"
-#include "ui/views/layout/fill_layout.h"
-#include "ui/views/layout/grid_layout.h"
+#include "ui/views/layout/box_layout.h"
+#include "ui/views/layout/flex_layout_view.h"
 #include "ui/views/test/desktop_test_views_delegate.h"
 #include "ui/views/view.h"
 #include "ui/views/widget/widget.h"
@@ -75,18 +77,19 @@ class ShellWindowDelegateView : public views::WidgetDelegateView,
   }
 
   void AttachTab(Tab* tab, const gfx::Size& size) {
-    contents_view_->SetLayoutManager(std::make_unique<views::FillLayout>());
+    contents_view_->SetUseDefaultFillLayout(true);
     // If there was a previous WebView in this Shell it should be removed and
     // deleted.
-    if (web_view_) {
-      contents_view_->RemoveChildView(web_view_);
-      delete web_view_;
-    }
-    auto web_view = std::make_unique<views::WebView>(nullptr);
-    tab->AttachToView(web_view.get());
-    web_view->SetPreferredSize(size);
-    web_view_ = contents_view_->AddChildView(std::move(web_view));
-    Layout();
+    if (web_view_)
+      contents_view_->RemoveChildViewT(web_view_.get());
+
+    views::Builder<views::View>(contents_view_.get())
+        .AddChild(views::Builder<views::WebView>()
+                      .CopyAddressTo(&web_view_)
+                      .SetPreferredSize(size))
+        .BuildChildren();
+    tab->AttachToView(web_view_);
+    web_view_->SizeToPreferredSize();
 
     // Resize the widget, keeping the same origin.
     gfx::Rect bounds = GetWidget()->GetWindowBoundsInScreen();
@@ -121,96 +124,91 @@ class ShellWindowDelegateView : public views::WidgetDelegateView,
  private:
   // Initialize the UI control contained in shell window
   void InitShellWindow() {
-    SetBackground(
-        CreateThemedSolidBackground(this, ui::kColorWindowBackground));
-
-    auto contents_view = std::make_unique<views::View>();
-    auto toolbar_view = std::make_unique<views::View>();
-
-    views::GridLayout* layout =
-        SetLayoutManager(std::make_unique<views::GridLayout>());
-
-    views::ColumnSet* column_set = layout->AddColumnSet(0);
-    column_set->AddPaddingColumn(0, 2);
-    column_set->AddColumn(views::GridLayout::FILL, views::GridLayout::FILL, 1,
-                          views::GridLayout::ColumnSize::kUsePreferred, 0, 0);
-    column_set->AddPaddingColumn(0, 2);
-
-    // Add toolbar buttons and URL text field
-    layout->AddPaddingRow(0, 2);
-    layout->StartRow(0, 0);
-    views::GridLayout* toolbar_layout =
-        toolbar_view->SetLayoutManager(std::make_unique<views::GridLayout>());
-
-    views::ColumnSet* toolbar_column_set = toolbar_layout->AddColumnSet(0);
-    // Back button
-    auto back_button = std::make_unique<views::MdTextButton>(
-        base::BindRepeating(&Shell::GoBackOrForward,
-                            base::Unretained(shell_.get()), -1),
-        u"Back");
-    gfx::Size back_button_size = back_button->GetPreferredSize();
-    toolbar_column_set->AddColumn(
-        views::GridLayout::CENTER, views::GridLayout::CENTER, 0,
-        views::GridLayout::ColumnSize::kFixed, back_button_size.width(),
-        back_button_size.width() / 2);
-    // Forward button
-    auto forward_button = std::make_unique<views::MdTextButton>(
-        base::BindRepeating(&Shell::GoBackOrForward,
-                            base::Unretained(shell_.get()), 1),
-        u"Forward");
-    gfx::Size forward_button_size = forward_button->GetPreferredSize();
-    toolbar_column_set->AddColumn(
-        views::GridLayout::CENTER, views::GridLayout::CENTER, 0,
-        views::GridLayout::ColumnSize::kFixed, forward_button_size.width(),
-        forward_button_size.width() / 2);
-    // Refresh button
-    auto refresh_button = std::make_unique<views::MdTextButton>(
-        base::BindRepeating(&Shell::Reload, base::Unretained(shell_.get())),
-        u"Refresh");
-    gfx::Size refresh_button_size = refresh_button->GetPreferredSize();
-    toolbar_column_set->AddColumn(
-        views::GridLayout::CENTER, views::GridLayout::CENTER, 0,
-        views::GridLayout::ColumnSize::kFixed, refresh_button_size.width(),
-        refresh_button_size.width() / 2);
-    // Stop button
-    auto stop_button = std::make_unique<views::MdTextButton>(
-        base::BindRepeating(&Shell::Stop, base::Unretained(shell_.get())),
-        u"Stop (100%)");
-    int stop_button_width = stop_button->GetPreferredSize().width();
-    toolbar_column_set->AddColumn(views::GridLayout::FILL,
-                                  views::GridLayout::CENTER, 0,
-                                  views::GridLayout::ColumnSize::kFixed,
-                                  stop_button_width, stop_button_width / 2);
-    toolbar_column_set->AddPaddingColumn(0, 2);
-    // URL entry
-    auto url_entry = std::make_unique<views::Textfield>();
-    url_entry->SetAccessibleName(u"Enter URL");
-    url_entry->set_controller(this);
-    url_entry->SetTextInputType(ui::TextInputType::TEXT_INPUT_TYPE_URL);
-    toolbar_column_set->AddColumn(
-        views::GridLayout::FILL, views::GridLayout::FILL, 1,
-        views::GridLayout::ColumnSize::kUsePreferred, 0, 0);
-    toolbar_column_set->AddPaddingColumn(0, 2);
-
-    // Fill up the first row
-    toolbar_layout->StartRow(0, 0);
-    back_button_ = toolbar_layout->AddView(std::move(back_button));
-    forward_button_ = toolbar_layout->AddView(std::move(forward_button));
-    refresh_button_ = toolbar_layout->AddView(std::move(refresh_button));
-    stop_button_ = toolbar_layout->AddView(std::move(stop_button));
-    url_entry_ = toolbar_layout->AddView(std::move(url_entry));
-
-    toolbar_view_ = layout->AddView(std::move(toolbar_view));
-
-    layout->AddPaddingRow(0, 5);
-
-    // Add WebBrowser view as the second row
-    {
-      layout->StartRow(1, 0);
-      contents_view_ = layout->AddView(std::move(contents_view));
-    }
-
-    layout->AddPaddingRow(0, 5);
+    auto toolbar_button_rule = [](const views::View* view,
+                                  const views::SizeBounds& size_bounds) {
+      gfx::Size preferred_size = view->GetPreferredSize();
+      if (size_bounds != views::SizeBounds() &&
+          size_bounds.width().is_bounded()) {
+        preferred_size.set_width(std::max(
+            std::min(size_bounds.width().value(), preferred_size.width()),
+            preferred_size.width() / 2));
+      }
+      return preferred_size;
+    };
+
+    auto* box_layout = SetLayoutManager(std::make_unique<views::BoxLayout>(
+        views::BoxLayout::Orientation::kVertical));
+
+    views::Builder<views::WidgetDelegateView>(this)
+        .SetBackground(
+            CreateThemedSolidBackground(this, ui::kColorWindowBackground))
+        .AddChildren(
+            views::Builder<views::FlexLayoutView>()
+                .CopyAddressTo(&toolbar_view_)
+                .SetOrientation(views::LayoutOrientation::kHorizontal)
+                // Top/Left/Right padding = 2, Bottom padding = 5
+                .SetProperty(views::kMarginsKey, gfx::Insets(2, 2, 5, 2))
+                .AddChildren(
+                    views::Builder<views::MdTextButton>()
+                        .CopyAddressTo(&back_button_)
+                        .SetText(u"Back")
+                        .SetCallback(base::BindRepeating(
+                            &Shell::GoBackOrForward,
+                            base::Unretained(shell_.get()), -1))
+                        .SetProperty(
+                            views::kFlexBehaviorKey,
+                            views::FlexSpecification(
+                                base::BindRepeating(toolbar_button_rule))),
+                    views::Builder<views::MdTextButton>()
+                        .CopyAddressTo(&forward_button_)
+                        .SetText(u"Forward")
+                        .SetCallback(base::BindRepeating(
+                            &Shell::GoBackOrForward,
+                            base::Unretained(shell_.get()), 1))
+                        .SetProperty(
+                            views::kFlexBehaviorKey,
+                            views::FlexSpecification(
+                                base::BindRepeating(toolbar_button_rule))),
+                    views::Builder<views::MdTextButton>()
+                        .CopyAddressTo(&refresh_button_)
+                        .SetText(u"Refresh")
+                        .SetCallback(base::BindRepeating(
+                            &Shell::Reload, base::Unretained(shell_.get())))
+                        .SetProperty(
+                            views::kFlexBehaviorKey,
+                            views::FlexSpecification(
+                                base::BindRepeating(toolbar_button_rule))),
+                    views::Builder<views::MdTextButton>()
+                        .CopyAddressTo(&stop_button_)
+                        .SetText(u"Stop (100%)")
+                        .SetCallback(base::BindRepeating(
+                            &Shell::Stop, base::Unretained(shell_.get())))
+                        .SetProperty(
+                            views::kFlexBehaviorKey,
+                            views::FlexSpecification(
+                                base::BindRepeating(toolbar_button_rule))),
+                    views::Builder<views::Textfield>()
+                        .CopyAddressTo(&url_entry_)
+                        .SetAccessibleName(u"Enter URL")
+                        .SetController(this)
+                        .SetTextInputType(
+                            ui::TextInputType::TEXT_INPUT_TYPE_URL)
+                        .SetProperty(
+                            views::kFlexBehaviorKey,
+                            views::FlexSpecification(
+                                views::MinimumFlexSizeRule::kScaleToMinimum,
+                                views::MaximumFlexSizeRule::kUnbounded))
+                        // Left padding  = 2, Right padding = 2
+                        .SetProperty(views::kMarginsKey,
+                                     gfx::Insets(0, 2, 0, 2))),
+            views::Builder<views::View>()
+                .CopyAddressTo(&contents_view_)
+                .SetUseDefaultFillLayout(true)
+                .SetProperty(views::kMarginsKey, gfx::Insets(0, 2, 0, 2)),
+            views::Builder<views::View>().SetProperty(views::kMarginsKey,
+                                                      gfx::Insets(0, 0, 5, 0)))
+        .BuildChildren();
+    box_layout->SetFlexForView(contents_view_, 1);
   }
 
   void InitAccelerators() {
@@ -280,16 +278,16 @@ class ShellWindowDelegateView : public views::WidgetDelegateView,
   std::u16string title_;
 
   // Toolbar view contains forward/backward/reload button and URL entry
-  View* toolbar_view_ = nullptr;
-  views::Button* back_button_ = nullptr;
-  views::Button* forward_button_ = nullptr;
-  views::Button* refresh_button_ = nullptr;
-  views::MdTextButton* stop_button_ = nullptr;
-  views::Textfield* url_entry_ = nullptr;
+  raw_ptr<views::View> toolbar_view_ = nullptr;
+  raw_ptr<views::Button> back_button_ = nullptr;
+  raw_ptr<views::Button> forward_button_ = nullptr;
+  raw_ptr<views::Button> refresh_button_ = nullptr;
+  raw_ptr<views::MdTextButton> stop_button_ = nullptr;
+  raw_ptr<views::Textfield> url_entry_ = nullptr;
 
   // Contents view contains the WebBrowser view
-  View* contents_view_ = nullptr;
-  views::WebView* web_view_ = nullptr;
+  raw_ptr<views::View> contents_view_ = nullptr;
+  raw_ptr<views::WebView> web_view_ = nullptr;
 };
 
 BEGIN_METADATA(ShellWindowDelegateView, views::WidgetDelegateView)
diff --git a/chromium/weblayer/test/BUILD.gn b/chromium/weblayer/test/BUILD.gn
index 7fd75d96717..72964702748 100644
--- a/chromium/weblayer/test/BUILD.gn
+++ b/chromium/weblayer/test/BUILD.gn
@@ -75,7 +75,8 @@ if (is_android) {
     deps = [ "//third_party/icu:icu_assets" ]
     if (use_v8_context_snapshot) {
       deps += [ "//tools/v8_context_snapshot:v8_context_snapshot_assets" ]
-    } else {
+    }
+    if (!use_v8_context_snapshot || include_both_v8_snapshots) {
       deps += [ "//v8:v8_external_startup_data_assets" ]
     }
   }
@@ -94,7 +95,6 @@ test("weblayer_browsertests") {
     "//components/test/data",
     "//net/tools/testserver/",
     "//third_party/pywebsocket3/src/mod_pywebsocket/",
-    "//third_party/tlslite/",
   ]
 
   data_deps = [
@@ -165,7 +165,6 @@ test("weblayer_browsertests") {
     "../browser/clipboard_browsertest.cc",
     "../browser/content_settings_browsertest.cc",
     "../browser/cookie_manager_browsertest.cc",
-    "../browser/default_search_engine_browsertest.cc",
     "../browser/download_browsertest.cc",
     "../browser/errorpage_browsertest.cc",
     "../browser/favicon/favicon_fetcher_browsertest.cc",
author	Allan Sandfeld Jensen <allan.jensen@qt.io>	2022-02-04 17:20:24 +0100
committer	Allan Sandfeld Jensen <allan.jensen@qt.io>	2022-02-12 08:15:25 +0000
commit	8fa0776f1f79e91fc9c0b9c1ba11a0a29c05196b (patch)
tree	788d8d7549712682703a0310ca4a0f0860d4802b /chromium/weblayer
parent	606d85f2a5386472314d39923da28c70c60dc8e7 (diff)
download	qtwebengine-chromium-8fa0776f1f79e91fc9c0b9c1ba11a0a29c05196b.tar.gz