BASELINE: Update Chromium to 80.0.3987.163

Change-Id: Iba07657949e6bee521813d3d6cf071e1f40f2501
Reviewed-by: Michal Klocek <michal.klocek@qt.io>

58 files changed, 810 insertions, 451 deletions

diff --git a/chromium/DEPS b/chromium/DEPS
index a2c7a284797..c2d89d8165b 100644
--- a/chromium/DEPS
+++ b/chromium/DEPS
@@ -40,7 +40,7 @@ gclient_gn_args = [
 
 
 vars = {
-  "buildspec_platforms": "all",
+  "buildspec_platforms": "linux64, mac64, win, win64",
   # Variable that can be used to support multiple build scenarios, like having
   # Chromium specific targets in a client project's GN file or sync dependencies
   # conditionally etc.
@@ -173,11 +173,11 @@ vars = {
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling Skia
   # and whatever else without interference from each other.
-  'skia_revision': 'ac0e515499dbbfd8de62ed1eb7b5d0f2ad6a7679',
+  'skia_revision': 'a91f9f612e5eeb93cf40a3c0ce7d7c6ddf838feb',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling V8
   # and whatever else without interference from each other.
-  'v8_revision': '2ad0a63d4a25377f3dc5eae52ef87505518867e8',
+  'v8_revision': 'ad234f5685c626501ad54b162c6f43ff123fef33',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling swarming_client
   # and whatever else without interference from each other.
@@ -1476,7 +1476,7 @@ deps = {
   },
 
   'src/third_party/usrsctp/usrsctplib':
-    Var('chromium_git') + '/external/github.com/sctplab/usrsctp' + '@' + '7a8bc9a90ca96634aa56ee712856d97f27d903f8',
+    Var('chromium_git') + '/external/github.com/sctplab/usrsctp' + '@' + 'a68325e7d9ed844cc84ec134192d788586ea6cc1',
 
   # Display server protocol for Linux.
   'src/third_party/wayland/src': {
@@ -1503,7 +1503,7 @@ deps = {
     Var('chromium_git') + '/external/khronosgroup/webgl.git' + '@' + 'dd55f3ca8f2ea716ca917a4aaf36f0729fe902b1',
 
   'src/third_party/webrtc':
-    Var('webrtc_git') + '/src.git' + '@' + '7a0e44c1a84fb4ed57a6701cfc8093756c37af6f',
+    Var('webrtc_git') + '/src.git' + '@' + 'ddc7578b751b05b5078c41f3973aa8fafdd543b7',
 
   'src/third_party/libgifcodec':
      Var('skia_git') + '/libgifcodec' + '@'+  Var('libgifcodec_revision'),
@@ -1573,7 +1573,7 @@ deps = {
     Var('chromium_git') + '/v8/v8.git' + '@' +  Var('v8_revision'),
 
   'src-internal': {
-    'url': 'https://chrome-internal.googlesource.com/chrome/src-internal.git@ccf97446b478e2d30756063e73a9008c4597a034',
+    'url': 'https://chrome-internal.googlesource.com/chrome/src-internal.git@82eace8c6ba9a5d9a413db3cfcee03663cc50ddf',
     'condition': 'checkout_src_internal',
   },
 
@@ -1581,7 +1581,7 @@ deps = {
       'packages': [
           {
               'package': 'chromium/third_party/android_deps/libs/com_google_android_play_core_verification',
-              'version': '5WpfZCqhiL1qWTiBl_x3VTelXCJsv5r_SMuE-3H1CI0C',
+              'version': 'ojrkXUE6tjG8FYmoLfCD3YdOxTyl2BXMdmk7Fb6cS5MC',
           },
       ],
       'condition': 'checkout_android',
diff --git a/chromium/build/util/LASTCHANGE b/chromium/build/util/LASTCHANGE
index 9a33132d012..c61a54cede9 100644
--- a/chromium/build/util/LASTCHANGE
+++ b/chromium/build/util/LASTCHANGE
@@ -1 +1 @@
-LASTCHANGE=d5190fedde334f4c1c3e3851e62966304d236bae-refs/branch-heads/3987@{#983}
+LASTCHANGE=e7fbe071abe9328cdce4ffedac9822435fbd3656-refs/branch-heads/3987@{#1037}
diff --git a/chromium/build/util/LASTCHANGE.committime b/chromium/build/util/LASTCHANGE.committime
index bc5cddd5756..b13b2582162 100644
--- a/chromium/build/util/LASTCHANGE.committime
+++ b/chromium/build/util/LASTCHANGE.committime
@@ -1 +1 @@
-1583284171
\ No newline at end of file
+1585781486
\ No newline at end of file
diff --git a/chromium/chrome/VERSION b/chromium/chrome/VERSION
index 66a204c6266..570fd44ab09 100644
--- a/chromium/chrome/VERSION
+++ b/chromium/chrome/VERSION
@@ -1,4 +1,4 @@
 MAJOR=80
 MINOR=0
 BUILD=3987
-PATCH=136
+PATCH=163
diff --git a/chromium/components/arc/mojom/net.mojom b/chromium/components/arc/mojom/net.mojom
index edcf9430f27..1a6c23ce47c 100644
--- a/chromium/components/arc/mojom/net.mojom
+++ b/chromium/components/arc/mojom/net.mojom
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Next MinVersion: 12
+// Next MinVersion: 13
 
 // This file defines the mojo interface between the ARC networking stack and
 // Chrome OS. There are three different groups of interactions:
@@ -210,6 +210,9 @@ struct NetworkConfiguration {
 
   // True if this network is the host default network.
   [MinVersion=11] bool is_default_network;
+
+  // The name of the shill service associated with this network connection.
+  [MinVersion=12] string? service_name;
 };
 
 // Describes a Wifi network configuration that ARC has requested the host to
diff --git a/chromium/components/arc/net/arc_net_host_impl.cc b/chromium/components/arc/net/arc_net_host_impl.cc
index 126e9b753e0..d4a4843fed0 100644
--- a/chromium/components/arc/net/arc_net_host_impl.cc
+++ b/chromium/components/arc/net/arc_net_host_impl.cc
@@ -37,6 +37,10 @@
 namespace {
 
 constexpr int kGetNetworksListLimit = 100;
+// Delay in millisecond before asking for a network property update when no IP
+// configuration can be retrieved for a network.
+constexpr base::TimeDelta kNetworkPropertyUpdateDelay =
+    base::TimeDelta::FromMilliseconds(5000);
 
 chromeos::NetworkStateHandler* GetStateHandler() {
   return chromeos::NetworkHandler::Get()->network_state_handler();
@@ -173,6 +177,13 @@ arc::mojom::IPConfigurationPtr TranslateONCIPConfig(
   return configuration;
 }
 
+// Returns true if the IP configuration is valid enough for ARC. Empty IP
+// config objects can be generated when IPv4 DHCP or IPv6 autoconf has not
+// completed yet.
+bool IsValidIPConfiguration(const arc::mojom::IPConfiguration& ip_config) {
+  return !ip_config.ip_address.empty() && !ip_config.gateway.empty();
+}
+
 // Returns an IPConfiguration vector from the IPConfigs ONC property, which may
 // include multiple IP configurations (e.g. IPv4 and IPv6).
 std::vector<arc::mojom::IPConfigurationPtr> IPConfigurationsFromONCIPConfigs(
@@ -184,7 +195,7 @@ std::vector<arc::mojom::IPConfigurationPtr> IPConfigurationsFromONCIPConfigs(
   std::vector<arc::mojom::IPConfigurationPtr> result;
   for (const auto& entry : ip_config_list->GetList()) {
     arc::mojom::IPConfigurationPtr config = TranslateONCIPConfig(&entry);
-    if (config)
+    if (config && IsValidIPConfiguration(*config))
       result.push_back(std::move(config));
   }
   return result;
@@ -199,7 +210,7 @@ std::vector<arc::mojom::IPConfigurationPtr> IPConfigurationsFromONCProperty(
   if (!ip_dict)
     return {};
   arc::mojom::IPConfigurationPtr config = TranslateONCIPConfig(ip_dict);
-  if (!config)
+  if (!config || !IsValidIPConfiguration(*config))
     return {};
   std::vector<arc::mojom::IPConfigurationPtr> result;
   result.push_back(std::move(config));
@@ -279,10 +290,6 @@ void AddDeviceProperties(arc::mojom::NetworkConfiguration* network,
 
   network->network_interface = device->interface();
 
-  // IP configurations were already obtained through cached ONC properties.
-  if (network->ip_configs)
-    return;
-
   std::vector<arc::mojom::IPConfigurationPtr> ip_configs;
   for (const auto& kv : device->ip_configs()) {
     auto ip_config = arc::mojom::IPConfiguration::New();
@@ -312,10 +319,14 @@ void AddDeviceProperties(arc::mojom::NetworkConfiguration* network,
         ip_config->name_servers.push_back(dns);
       }
     }
-    ip_configs.push_back(std::move(ip_config));
+    if (IsValidIPConfiguration(*ip_config))
+      ip_configs.push_back(std::move(ip_config));
   }
 
-  network->ip_configs = std::move(ip_configs);
+  // If the DeviceState had any IP configuration, always use them and ignore
+  // any other IP configuration previously obtained through NetworkState.
+  if (!ip_configs.empty())
+    network->ip_configs = std::move(ip_configs);
 }
 
 arc::mojom::NetworkConfigurationPtr TranslateONCConfiguration(
@@ -342,8 +353,7 @@ arc::mojom::NetworkConfigurationPtr TranslateONCConfiguration(
     ip_configs = IPConfigurationsFromONCProperty(
         dict, onc::network_config::kSavedIPConfig);
   }
-  if (!ip_configs.empty())
-    mojo->ip_configs = std::move(ip_configs);
+  mojo->ip_configs = std::move(ip_configs);
 
   mojo->guid = GetStringFromONCDictionary(dict, onc::network_config::kGUID,
                                           true /* required */);
@@ -402,6 +412,7 @@ std::vector<arc::mojom::NetworkConfigurationPtr> TranslateNetworkStates(
         state, chromeos::network_util::TranslateNetworkStateToONC(state).get());
     network->is_default_network =
         (network_path == GetStateHandler()->default_network_path());
+    network->service_name = network_path;
     networks.push_back(std::move(network));
   }
   return networks;
@@ -863,15 +874,14 @@ void ArcNetHostImpl::UpdateDefaultNetwork() {
 void ArcNetHostImpl::DefaultNetworkChanged(
     const chromeos::NetworkState* network) {
   UpdateDefaultNetwork();
+  UpdateActiveNetworks();
+}
 
-  // If the the default network switched between two networks, also send an
-  // ActiveNetworkChanged notification to let ARC observe the switch.
+void ArcNetHostImpl::UpdateActiveNetworks() {
   chromeos::NetworkStateHandler::NetworkStateList network_states;
   GetStateHandler()->GetActiveNetworkListByType(
       chromeos::NetworkTypePattern::Default(), &network_states);
-  if (network_states.size() > 1) {
-    ActiveNetworksChanged(network_states);
-  }
+  ActiveNetworksChanged(network_states);
 }
 
 void ArcNetHostImpl::DeviceListChanged() {
@@ -1100,15 +1110,49 @@ void ArcNetHostImpl::ActiveNetworksChanged(
 
   std::vector<arc::mojom::NetworkConfigurationPtr> network_configurations =
       TranslateNetworkStates(arc_vpn_service_path_, active_networks);
+
+  // A newly connected network may not immediately have any usable IP config
+  // object if IPv4 dhcp or IPv6 autoconf have not completed yet. Schedule
+  // with a few seconds delay a forced property update for that service to
+  // ensure the IP configuration is sent to ARC. Ensure that at most one such
+  // request is scheduled for a given service.
+  for (const auto& network : network_configurations) {
+    if (!network->ip_configs->empty())
+      continue;
+
+    if (!network->service_name)
+      continue;
+
+    const std::string& path = network->service_name.value();
+    if (pending_service_property_requests_.insert(path).second) {
+      LOG(WARNING) << "No IP configuration for " << path;
+      // TODO(hugobenichi): add exponential backoff for the case when IP
+      // configuration stays unavailable.
+      base::ThreadTaskRunnerHandle::Get()->PostDelayedTask(
+          FROM_HERE,
+          base::BindOnce(&ArcNetHostImpl::RequestUpdateForNetwork,
+                         weak_factory_.GetWeakPtr(), path),
+          kNetworkPropertyUpdateDelay);
+    }
+  }
+
   net_instance->ActiveNetworksChanged(std::move(network_configurations));
 }
 
+void ArcNetHostImpl::RequestUpdateForNetwork(const std::string& service_path) {
+  // TODO(hugobenichi): skip the request if the IP configuration for this
+  // service has been received since then and ARC has been notified about it.
+  pending_service_property_requests_.erase(service_path);
+  GetStateHandler()->RequestUpdateForNetwork(service_path);
+}
+
 void ArcNetHostImpl::NetworkListChanged() {
   // This is invoked any time the list of services is reordered or changed.
   // During the transition when a new service comes online, it will
   // temporarily be ranked below "inferior" services.  This callback
   // informs us that shill's ordering has been updated.
   UpdateDefaultNetwork();
+  UpdateActiveNetworks();
 }
 
 void ArcNetHostImpl::OnShuttingDown() {
diff --git a/chromium/components/arc/net/arc_net_host_impl.h b/chromium/components/arc/net/arc_net_host_impl.h
index 815c8ba7a20..63e2f63455b 100644
--- a/chromium/components/arc/net/arc_net_host_impl.h
+++ b/chromium/components/arc/net/arc_net_host_impl.h
@@ -7,6 +7,7 @@
 
 #include <stdint.h>
 #include <memory>
+#include <set>
 #include <string>
 #include <vector>
 
@@ -107,6 +108,7 @@ class ArcNetHostImpl : public KeyedService,
  private:
   const chromeos::NetworkState* GetDefaultNetworkFromChrome();
   void UpdateDefaultNetwork();
+  void UpdateActiveNetworks();
   void DefaultNetworkSuccessCallback(const std::string& service_path,
                                      const base::DictionaryValue& dictionary);
 
@@ -151,11 +153,17 @@ class ArcNetHostImpl : public KeyedService,
       const std::string& error_name,
       std::unique_ptr<base::DictionaryValue> error_data);
 
+  // Request properties of the Service corresponding to |service_path|.
+  void RequestUpdateForNetwork(const std::string& service_path);
+
   ArcBridgeService* const arc_bridge_service_;  // Owned by ArcServiceManager.
 
   // True if the chrome::NetworkStateHandler is currently being observed for
   // state changes.
   bool observing_network_state_ = false;
+  // Contains all service paths for which a property update request is
+  // currently scheduled.
+  std::set<std::string> pending_service_property_requests_;
 
   std::string cached_service_path_;
   std::string cached_guid_;
diff --git a/chromium/components/performance_manager/performance_manager_impl.cc b/chromium/components/performance_manager/performance_manager_impl.cc
index c3cbf5ceecc..cf9565ede7f 100644
--- a/chromium/components/performance_manager/performance_manager_impl.cc
+++ b/chromium/components/performance_manager/performance_manager_impl.cc
@@ -141,11 +141,20 @@ std::unique_ptr<WorkerNodeImpl> PerformanceManagerImpl::CreateWorkerNode(
       worker_type, process_node, url, dev_tools_token);
 }
 
+void PerformanceManagerImpl::DeleteNode(std::unique_ptr<NodeBase> node) {
+  GetTaskRunner()->PostTask(
+      FROM_HERE, base::BindOnce(&PerformanceManagerImpl::DeleteNodeImpl,
+                                base::Unretained(this), node.release()));
+}
+
 void PerformanceManagerImpl::BatchDeleteNodes(
     std::vector<std::unique_ptr<NodeBase>> nodes) {
+  // Move the nodes vector to the heap.
+  auto nodes_ptr = std::make_unique<std::vector<std::unique_ptr<NodeBase>>>(
+      std::move(nodes));
   GetTaskRunner()->PostTask(
       FROM_HERE, base::BindOnce(&PerformanceManagerImpl::BatchDeleteNodesImpl,
-                                base::Unretained(this), std::move(nodes)));
+                                base::Unretained(this), nodes_ptr.release()));
 }
 
 PerformanceManagerImpl::PerformanceManagerImpl() {
@@ -182,15 +191,12 @@ std::unique_ptr<NodeType> PerformanceManagerImpl::CreateNodeImpl(
   return new_node;
 }
 
-void PerformanceManagerImpl::PostDeleteNode(std::unique_ptr<NodeBase> node) {
-  GetTaskRunner()->PostTask(
-      FROM_HERE, base::BindOnce(&PerformanceManagerImpl::DeleteNodeImpl,
-                                base::Unretained(this), std::move(node)));
-}
-
-void PerformanceManagerImpl::DeleteNodeImpl(std::unique_ptr<NodeBase> node) {
+void PerformanceManagerImpl::DeleteNodeImpl(NodeBase* node_ptr) {
   DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
 
+  // Must be done first to avoid leaking |node_ptr|.
+  std::unique_ptr<NodeBase> node(node_ptr);
+
   graph_.RemoveNode(node.get());
 }
 
@@ -208,15 +214,18 @@ void RemoveFrameAndChildrenFromGraph(FrameNodeImpl* frame_node) {
 }  // namespace
 
 void PerformanceManagerImpl::BatchDeleteNodesImpl(
-    std::vector<std::unique_ptr<NodeBase>> nodes) {
+    std::vector<std::unique_ptr<NodeBase>>* nodes_ptr) {
   DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
 
+  // Must be done first to avoid leaking |nodes_ptr|.
+  std::unique_ptr<std::vector<std::unique_ptr<NodeBase>>> nodes(nodes_ptr);
+
   base::flat_set<ProcessNodeImpl*> process_nodes;
 
-  for (auto it = nodes.begin(); it != nodes.end(); ++it) {
-    switch ((*it)->type()) {
+  for (const auto& node : *nodes) {
+    switch (node->type()) {
       case PageNodeImpl::Type(): {
-        auto* page_node = PageNodeImpl::FromNodeBase(it->get());
+        auto* page_node = PageNodeImpl::FromNodeBase(node.get());
 
         // Delete the main frame nodes until no more exist.
         while (!page_node->main_frame_nodes().empty())
@@ -229,14 +238,14 @@ void PerformanceManagerImpl::BatchDeleteNodesImpl(
       case ProcessNodeImpl::Type(): {
         // Keep track of the process nodes for removing once all frames nodes
         // are removed.
-        auto* process_node = ProcessNodeImpl::FromNodeBase(it->get());
+        auto* process_node = ProcessNodeImpl::FromNodeBase(node.get());
         process_nodes.insert(process_node);
         break;
       }
       case FrameNodeImpl::Type():
         break;
       case WorkerNodeImpl::Type(): {
-        auto* worker_node = WorkerNodeImpl::FromNodeBase(it->get());
+        auto* worker_node = WorkerNodeImpl::FromNodeBase(node.get());
         graph_.RemoveNode(worker_node);
         break;
       }
diff --git a/chromium/components/performance_manager/performance_manager_impl.h b/chromium/components/performance_manager/performance_manager_impl.h
index da7f2f9a0ee..54dcebdd437 100644
--- a/chromium/components/performance_manager/performance_manager_impl.h
+++ b/chromium/components/performance_manager/performance_manager_impl.h
@@ -102,8 +102,7 @@ class PerformanceManagerImpl : public PerformanceManager {
 
   // Destroys a node returned from the creation functions above.
   // May be called from any sequence.
-  template <typename NodeType>
-  void DeleteNode(std::unique_ptr<NodeType> node);
+  void DeleteNode(std::unique_ptr<NodeBase> node);
 
   // Each node in |nodes| must have been returned from one of the creation
   // functions above. This function takes care of removing them from the graph
@@ -130,9 +129,14 @@ class PerformanceManagerImpl : public PerformanceManager {
       base::OnceCallback<void(NodeType*)> creation_callback,
       Args&&... constructor_args);
 
-  void PostDeleteNode(std::unique_ptr<NodeBase> node);
-  void DeleteNodeImpl(std::unique_ptr<NodeBase> node);
-  void BatchDeleteNodesImpl(std::vector<std::unique_ptr<NodeBase>> nodes);
+  // Helper functions that removes a node/vector of nodes from the graph on the
+  // PM sequence and deletes them.
+  //
+  // Note that this function has similar semantics to
+  // SequencedTaskRunner::DeleteSoon(). The node/vector of nodes is passed via a
+  // regular pointer so that they are not deleted if the task is not executed.
+  void DeleteNodeImpl(NodeBase* node_ptr);
+  void BatchDeleteNodesImpl(std::vector<std::unique_ptr<NodeBase>>* nodes_ptr);
 
   void OnStartImpl(GraphImplCallback graph_callback);
   static void RunCallbackWithGraphImpl(GraphImplCallback graph_callback);
@@ -149,11 +153,6 @@ class PerformanceManagerImpl : public PerformanceManager {
   DISALLOW_COPY_AND_ASSIGN(PerformanceManagerImpl);
 };
 
-template <typename NodeType>
-void PerformanceManagerImpl::DeleteNode(std::unique_ptr<NodeType> node) {
-  PostDeleteNode(std::move(node));
-}
-
 template <typename TaskReturnType>
 void PerformanceManagerImpl::CallOnGraphAndReplyWithResult(
     const base::Location& from_here,
diff --git a/chromium/components/viz/service/display/surface_aggregator.cc b/chromium/components/viz/service/display/surface_aggregator.cc
index 8a9da59ee76..a134ca8d79d 100644
--- a/chromium/components/viz/service/display/surface_aggregator.cc
+++ b/chromium/components/viz/service/display/surface_aggregator.cc
@@ -861,14 +861,20 @@ void SurfaceAggregator::AddDisplayTransformPass() {
     display_transform_render_pass_id_ = next_render_pass_id_++;
 
   auto display_transform_pass = RenderPass::Create(1, 1);
-  display_transform_pass->SetNew(
+  display_transform_pass->SetAll(
       display_transform_render_pass_id_,
       cc::MathUtil::MapEnclosedRectWith2dAxisAlignedTransform(
           root_surface_transform_, root_render_pass->output_rect),
       cc::MathUtil::MapEnclosedRectWith2dAxisAlignedTransform(
           root_surface_transform_, root_render_pass->damage_rect),
-      gfx::Transform());
-  display_transform_pass->color_space = root_render_pass->color_space;
+      gfx::Transform(),
+      /*filters=*/cc::FilterOperations(),
+      /*backdrop_filters=*/cc::FilterOperations(),
+      /*backdrop_filter_bounds=*/gfx::RRectF(), root_render_pass->color_space,
+      root_render_pass->has_transparent_background,
+      /*cache_render_pass=*/false,
+      /*has_damage_from_contributing_content=*/false,
+      /*generate_mipmap=*/false);
 
   bool are_contents_opaque = true;
   for (const auto* sqs : root_render_pass->shared_quad_state_list) {
diff --git a/chromium/content/browser/browser_interface_binders.cc b/chromium/content/browser/browser_interface_binders.cc
index 8ed53adca64..784c5f2f1e1 100644
--- a/chromium/content/browser/browser_interface_binders.cc
+++ b/chromium/content/browser/browser_interface_binders.cc
@@ -617,7 +617,7 @@ RenderFrameHost* GetContextForHost(RenderFrameHostImpl* host) {
 
 // Dedicated workers
 const url::Origin& GetContextForHost(DedicatedWorkerHost* host) {
-  return host->GetOrigin();
+  return host->GetWorkerOrigin();
 }
 
 void PopulateDedicatedWorkerBinders(DedicatedWorkerHost* host,
diff --git a/chromium/content/browser/font_unique_name_lookup/font_unique_name_browsertest.cc b/chromium/content/browser/font_unique_name_lookup/font_unique_name_browsertest.cc
index 985984cfdfd..c6d53f4341d 100644
--- a/chromium/content/browser/font_unique_name_lookup/font_unique_name_browsertest.cc
+++ b/chromium/content/browser/font_unique_name_lookup/font_unique_name_browsertest.cc
@@ -117,20 +117,10 @@ class FontUniqueNameBrowserTest : public DevToolsProtocolTest {
   }
 
 #if defined(OS_WIN)
-  // The Windows service for font unique name lookup needs a cache directory to
-  // persist the cached information. Configure a temporary one before running
-  // this test.
-  void SetUpInProcessBrowserTestFixture() override {
-    DevToolsProtocolTest::SetUpInProcessBrowserTestFixture();
-    DWriteFontLookupTableBuilder* table_builder =
-        DWriteFontLookupTableBuilder::GetInstance();
-    ASSERT_TRUE(cache_directory_.CreateUniqueTempDir());
-    table_builder->SetCacheDirectoryForTesting(cache_directory_.GetPath());
-  }
-
   void PreRunTestOnMainThread() override {
     DWriteFontLookupTableBuilder* table_builder =
         DWriteFontLookupTableBuilder::GetInstance();
+    table_builder->ResetStateForTesting();
     table_builder->SchedulePrepareFontUniqueNameTableIfNeeded();
     DevToolsProtocolTest::PreRunTestOnMainThread();
   }
diff --git a/chromium/content/browser/frame_host/render_frame_host_impl.cc b/chromium/content/browser/frame_host/render_frame_host_impl.cc
index bbd42aad3d4..050531a82b4 100644
--- a/chromium/content/browser/frame_host/render_frame_host_impl.cc
+++ b/chromium/content/browser/frame_host/render_frame_host_impl.cc
@@ -737,6 +737,8 @@ class FileChooserImpl : public blink::mojom::FileChooser,
     std::move(callback_).Run(nullptr);
   }
 
+  void ResetProxy() { proxy_ = nullptr; }
+
  private:
   class ListenerProxy : public content::FileSelectListener {
    public:
@@ -747,6 +749,8 @@ class FileChooserImpl : public blink::mojom::FileChooser,
           << "Should call either FileSelectListener::FileSelected() or "
              "FileSelectListener::FileSelectionCanceled()";
 #endif
+      if (owner_)
+        owner_->ResetProxy();
     }
     void ResetOwner() { owner_ = nullptr; }
 
diff --git a/chromium/content/browser/renderer_host/dwrite_font_lookup_table_builder_win.cc b/chromium/content/browser/renderer_host/dwrite_font_lookup_table_builder_win.cc
index 55bacfb3132..3465e8dd09e 100644
--- a/chromium/content/browser/renderer_host/dwrite_font_lookup_table_builder_win.cc
+++ b/chromium/content/browser/renderer_host/dwrite_font_lookup_table_builder_win.cc
@@ -129,16 +129,30 @@ DWriteFontLookupTableBuilder::FamilyResult::~FamilyResult() = default;
 
 DWriteFontLookupTableBuilder::DWriteFontLookupTableBuilder()
     : font_indexing_timeout_(kFontIndexingTimeoutDefault) {
+  ResetCallbacksAccessTaskRunner();
   InitializeCacheDirectoryFromProfile();
 }
 
+void DWriteFontLookupTableBuilder::ResetCallbacksAccessTaskRunner() {
+  callbacks_access_task_runner_ = base::CreateSequencedTaskRunner({
+    base::ThreadPool(),
+#if DCHECK_IS_ON()
+        // Needed for DCHECK in DuplicateMemoryRegion() which performs file
+        // operations to detect cache directory.
+        base::MayBlock(),
+#endif
+        base::TaskPriority::USER_VISIBLE,
+        base::TaskShutdownBehavior::SKIP_ON_SHUTDOWN
+  });
+  DETACH_FROM_SEQUENCE(callbacks_access_sequence_checker_);
+}
+
 void DWriteFontLookupTableBuilder::InitializeCacheDirectoryFromProfile() {
-  // In FontUniqueNameBrowserTest the DWriteFontLookupTableBuilder is
-  // instantiated to configure the cache directory for testing explicitly before
-  // GetContentClient() is available. Catch this case here. It is safe to not
-  // set the cache directory here, as an invalid cache directory would be
-  // detected by TableCacheFilePath and the LoadFromFile and PersistToFile
-  // methods.
+  // Unit tests that do not launch a full browser environment usually don't need
+  // testing of src:local()-style font matching. Check that an environment is
+  // present here and configcure the cache directory based on that. If none is
+  // configured, catch this in DuplicateMemoryRegion(), i.e. when a client
+  // tries to use this API.
   cache_directory_ =
       GetContentClient() && GetContentClient()->browser()
           ? GetContentClient()->browser()->GetFontLookupTableCacheDir()
@@ -250,7 +264,8 @@ base::TimeDelta DWriteFontLookupTableBuilder::IndexingTimeout() {
   return font_indexing_timeout_;
 }
 
-void DWriteFontLookupTableBuilder::PostCallbacks() {
+void DWriteFontLookupTableBuilder::PostCallbacksImpl() {
+  DCHECK_CALLED_ON_VALID_SEQUENCE(callbacks_access_sequence_checker_);
   for (auto& pending_callback : pending_callbacks_) {
     pending_callback.task_runner->PostTask(
         FROM_HERE, base::BindOnce(std::move(pending_callback.mojo_callback),
@@ -259,6 +274,13 @@ void DWriteFontLookupTableBuilder::PostCallbacks() {
   pending_callbacks_.clear();
 }
 
+void DWriteFontLookupTableBuilder::PostCallbacks() {
+  callbacks_access_task_runner_->PostTask(
+      FROM_HERE,
+      base::BindOnce(&DWriteFontLookupTableBuilder::PostCallbacksImpl,
+                     base::Unretained(this)));
+}
+
 base::FilePath DWriteFontLookupTableBuilder::TableCacheFilePath() {
   if (!EnsureCacheDirectory(cache_directory_))
     return base::FilePath();
@@ -300,18 +322,38 @@ DWriteFontLookupTableBuilder::CallbackOnTaskRunner::CallbackOnTaskRunner(
 DWriteFontLookupTableBuilder::CallbackOnTaskRunner::~CallbackOnTaskRunner() =
     default;
 
+void DWriteFontLookupTableBuilder::QueueShareMemoryRegionWhenReadyImpl(
+    scoped_refptr<base::SequencedTaskRunner> task_runner,
+    blink::mojom::DWriteFontProxy::GetUniqueNameLookupTableCallback callback) {
+  DCHECK_CALLED_ON_VALID_SEQUENCE(callbacks_access_sequence_checker_);
+
+  // Don't queue but post response directly if the table is already ready for
+  // sharing with renderers to cover the condition in which the font table
+  // becomes ready briefly after a renderer asking for
+  // GetUniqueNameLookupTableIfAvailable(), receiving the information that it
+  // wasn't ready. (https://crbug.com/977283)
+  if (font_table_built_.IsSignaled()) {
+    task_runner->PostTask(FROM_HERE, base::BindOnce(std::move(callback),
+                                                    DuplicateMemoryRegion()));
+    return;
+  }
+
+  pending_callbacks_.push_back(
+      CallbackOnTaskRunner(std::move(task_runner), std::move(callback)));
+}
+
 void DWriteFontLookupTableBuilder::QueueShareMemoryRegionWhenReady(
     scoped_refptr<base::SequencedTaskRunner> task_runner,
     blink::mojom::DWriteFontProxy::GetUniqueNameLookupTableCallback callback) {
   TRACE_EVENT0("dwrite,fonts",
                "DWriteFontLookupTableBuilder::QueueShareMemoryRegionWhenReady");
   DCHECK(!HasDWriteUniqueFontLookups());
-  pending_callbacks_.emplace_back(std::move(task_runner), std::move(callback));
-  // Cover for the condition in which the font table becomes ready briefly after
-  // a renderer asking for GetUniqueNameLookupTableIfAvailable(), receiving the
-  // information that it wasn't ready.
-  if (font_table_built_.IsSignaled())
-    PostCallbacks();
+  CHECK(callbacks_access_task_runner_);
+  callbacks_access_task_runner_->PostTask(
+      FROM_HERE,
+      base::BindOnce(
+          &DWriteFontLookupTableBuilder::QueueShareMemoryRegionWhenReadyImpl,
+          base::Unretained(this), std::move(task_runner), std::move(callback)));
 }
 
 bool DWriteFontLookupTableBuilder::FontUniqueNameTableReady() {
@@ -730,6 +772,7 @@ void DWriteFontLookupTableBuilder::ResetLookupTableForTesting() {
   font_indexing_timeout_ = kFontIndexingTimeoutDefault;
   font_table_memory_ = base::MappedReadOnlyRegion();
   caching_enabled_ = true;
+  ResetCallbacksAccessTaskRunner();
   font_table_built_.Reset();
 }
 
diff --git a/chromium/content/browser/renderer_host/dwrite_font_lookup_table_builder_win.h b/chromium/content/browser/renderer_host/dwrite_font_lookup_table_builder_win.h
index 80c75e0633f..2d743753a07 100644
--- a/chromium/content/browser/renderer_host/dwrite_font_lookup_table_builder_win.h
+++ b/chromium/content/browser/renderer_host/dwrite_font_lookup_table_builder_win.h
@@ -176,6 +176,21 @@ class CONTENT_EXPORT DWriteFontLookupTableBuilder {
   // constructed protobuf to disk.
   void FinalizeFontTable();
 
+  // Internal implementation of adding a callback request to the list in order
+  // to sequentialise access to pending_callbacks_.
+  void QueueShareMemoryRegionWhenReadyImpl(
+      scoped_refptr<base::SequencedTaskRunner> task_runner,
+      blink::mojom::DWriteFontProxy::GetUniqueNameLookupTableCallback callback);
+
+  // Internal implementation of posting the callbacks, running on the sequence
+  // that sequentialises access to pending_callbacks_.
+  void PostCallbacksImpl();
+
+  // Resets the internal task runner guarding access to pending_callbacks_, used
+  // in unit tests, as the TaskEnvironment used in tests tears down and resets
+  // the ThreadPool between tests, and the TaskRunner depends on it.
+  void ResetCallbacksAccessTaskRunner();
+
   void OnTimeout();
 
   bool IsFontUniqueNameTableValid();
@@ -232,6 +247,8 @@ class CONTENT_EXPORT DWriteFontLookupTableBuilder {
 
   std::vector<CallbackOnTaskRunner> pending_callbacks_;
   std::map<HRESULT, unsigned> scanning_error_reasons_;
+  scoped_refptr<base::SequencedTaskRunner> callbacks_access_task_runner_;
+  SEQUENCE_CHECKER(callbacks_access_sequence_checker_);
 
   DISALLOW_COPY_AND_ASSIGN(DWriteFontLookupTableBuilder);
 };
diff --git a/chromium/content/browser/worker_host/dedicated_worker_host.cc b/chromium/content/browser/worker_host/dedicated_worker_host.cc
index 546c134b1d9..f5bd5fe1b8f 100644
--- a/chromium/content/browser/worker_host/dedicated_worker_host.cc
+++ b/chromium/content/browser/worker_host/dedicated_worker_host.cc
@@ -40,12 +40,15 @@ DedicatedWorkerHost::DedicatedWorkerHost(
     int worker_process_id,
     int ancestor_render_frame_id,
     int creator_render_frame_id,
-    const url::Origin& origin,
+    const url::Origin& creator_origin,
     mojo::PendingReceiver<blink::mojom::DedicatedWorkerHost> host)
     : worker_process_id_(worker_process_id),
       ancestor_render_frame_id_(ancestor_render_frame_id),
       creator_render_frame_id_(creator_render_frame_id),
-      origin_(origin),
+      creator_origin_(creator_origin),
+      // TODO(https://crbug.com/1058759): Calculate the worker origin based on
+      // the worker script URL.
+      worker_origin_(creator_origin),
       host_receiver_(this, std::move(host)) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
 }
@@ -85,7 +88,6 @@ void DedicatedWorkerHost::LifecycleStateChanged(
 
 void DedicatedWorkerHost::StartScriptLoad(
     const GURL& script_url,
-    const url::Origin& request_initiator_origin,
     network::mojom::CredentialsMode credentials_mode,
     blink::mojom::FetchClientSettingsObjectPtr
         outside_fetch_client_settings_object,
@@ -176,14 +178,14 @@ void DedicatedWorkerHost::StartScriptLoad(
   // initiator origin to keep consistency with WorkerScriptFetchInitiator, but
   // probably this should be calculated based on the worker origin as the
   // factories be used for subresource loading on the worker.
-  file_url_support_ = request_initiator_origin.scheme() == url::kFileScheme;
+  file_url_support_ = creator_origin_.scheme() == url::kFileScheme;
 
   service_worker_handle_ = std::make_unique<ServiceWorkerNavigationHandle>(
       storage_partition_impl->GetServiceWorkerContext());
 
   WorkerScriptFetchInitiator::Start(
       worker_process_id_, script_url, creator_render_frame_host,
-      request_initiator_origin, network_isolation_key_, credentials_mode,
+      creator_origin_, network_isolation_key_, credentials_mode,
       std::move(outside_fetch_client_settings_object), ResourceType::kWorker,
       storage_partition_impl->GetServiceWorkerContext(),
       service_worker_handle_.get(),
@@ -299,15 +301,16 @@ DedicatedWorkerHost::CreateNetworkFactoryForSubresources(
   GetContentClient()->browser()->WillCreateURLLoaderFactory(
       storage_partition_impl->browser_context(),
       /*frame=*/nullptr, worker_process_id_,
-      ContentBrowserClient::URLLoaderFactoryType::kWorkerSubResource, origin_,
-      /*navigation_id=*/base::nullopt, &default_factory_receiver,
-      &default_header_client, bypass_redirect_checks, &factory_override);
+      ContentBrowserClient::URLLoaderFactoryType::kWorkerSubResource,
+      worker_origin_, /*navigation_id=*/base::nullopt,
+      &default_factory_receiver, &default_header_client, bypass_redirect_checks,
+      &factory_override);
 
   // TODO(nhiroki): Call devtools_instrumentation::WillCreateURLLoaderFactory()
   // here.
 
   worker_process_host->CreateURLLoaderFactory(
-      origin_, origin_,
+      worker_origin_, worker_origin_,
       ancestor_render_frame_host->cross_origin_embedder_policy(),
       /*preferences=*/nullptr, network_isolation_key_,
       std::move(default_header_client),
@@ -344,7 +347,7 @@ void DedicatedWorkerHost::CreateWebSocketConnector(
   }
   mojo::MakeSelfOwnedReceiver(std::make_unique<WebSocketConnectorImpl>(
                                   worker_process_id_, ancestor_render_frame_id_,
-                                  origin_, network_isolation_key_),
+                                  worker_origin_, network_isolation_key_),
                               std::move(receiver));
 }
 
@@ -359,8 +362,8 @@ void DedicatedWorkerHost::CreateQuicTransportConnector(
     return;
   }
   mojo::MakeSelfOwnedReceiver(
-      std::make_unique<QuicTransportConnectorImpl>(worker_process_id_, origin_,
-                                                   network_isolation_key_),
+      std::make_unique<QuicTransportConnectorImpl>(
+          worker_process_id_, worker_origin_, network_isolation_key_),
       std::move(receiver));
 }
 
@@ -370,7 +373,7 @@ void DedicatedWorkerHost::CreateNestedDedicatedWorker(
   CreateDedicatedWorkerHostFactory(worker_process_id_,
                                    ancestor_render_frame_id_,
                                    /*creator_render_frame_id=*/MSG_ROUTING_NONE,
-                                   origin_, std::move(receiver));
+                                   worker_origin_, std::move(receiver));
 }
 
 void DedicatedWorkerHost::CreateIdleManager(
@@ -501,20 +504,19 @@ namespace {
 class DedicatedWorkerHostFactoryImpl final
     : public blink::mojom::DedicatedWorkerHostFactory {
  public:
-  DedicatedWorkerHostFactoryImpl(int creator_process_id,
+  DedicatedWorkerHostFactoryImpl(int worker_process_id,
                                  int ancestor_render_frame_id,
                                  int creator_render_frame_id,
-                                 const url::Origin& parent_context_origin)
-      : creator_process_id_(creator_process_id),
+                                 const url::Origin& creator_origin)
+      : worker_process_id_(worker_process_id),
         ancestor_render_frame_id_(ancestor_render_frame_id),
         creator_render_frame_id_(creator_render_frame_id),
-        parent_context_origin_(parent_context_origin) {
+        creator_origin_(creator_origin) {
     DCHECK_CURRENTLY_ON(BrowserThread::UI);
   }
 
   // blink::mojom::DedicatedWorkerHostFactory:
   void CreateWorkerHost(
-      const url::Origin& origin,
       mojo::PendingReceiver<blink::mojom::BrowserInterfaceBroker>
           broker_receiver,
       mojo::PendingReceiver<blink::mojom::DedicatedWorkerHost> host_receiver)
@@ -525,21 +527,15 @@ class DedicatedWorkerHostFactoryImpl final
       return;
     }
 
-    // TODO(crbug.com/729021): Once |parent_context_origin_| no longer races
-    // with the request for |DedicatedWorkerHostFactory|, enforce that
-    // the worker's origin either matches the origin of the creating context
-    // (Document or DedicatedWorkerGlobalScope), or is unique.
-    // Deletes itself on Mojo disconnection.
     auto* host = new DedicatedWorkerHost(
-        creator_process_id_, ancestor_render_frame_id_,
-        creator_render_frame_id_, origin, std::move(host_receiver));
+        worker_process_id_, ancestor_render_frame_id_, creator_render_frame_id_,
+        creator_origin_, std::move(host_receiver));
     host->BindBrowserInterfaceBrokerReceiver(std::move(broker_receiver));
   }
 
   // PlzDedicatedWorker:
   void CreateWorkerHostAndStartScriptLoad(
       const GURL& script_url,
-      const url::Origin& request_initiator_origin,
       network::mojom::CredentialsMode credentials_mode,
       blink::mojom::FetchClientSettingsObjectPtr
           outside_fetch_client_settings_object,
@@ -554,37 +550,27 @@ class DedicatedWorkerHostFactoryImpl final
       return;
     }
 
-    // Create a worker host that will start a new dedicated worker in the
-    // renderer process whose ID is |creator_process_id_|.
-    //
-    // TODO(crbug.com/729021): Once |parent_context_origin_| no longer races
-    // with the request for |DedicatedWorkerHostFactory|, enforce that
-    // the worker's origin either matches the origin of the creating context
-    // (Document or DedicatedWorkerGlobalScope), or is unique.
-    // Deletes itself on Mojo disconnection.
     auto* host = new DedicatedWorkerHost(
-        creator_process_id_, ancestor_render_frame_id_,
-        creator_render_frame_id_, request_initiator_origin,
-        std::move(host_receiver));
+        worker_process_id_, ancestor_render_frame_id_, creator_render_frame_id_,
+        creator_origin_, std::move(host_receiver));
     mojo::PendingRemote<blink::mojom::BrowserInterfaceBroker> broker;
     host->BindBrowserInterfaceBrokerReceiver(
         broker.InitWithNewPipeAndPassReceiver());
     mojo::Remote<blink::mojom::DedicatedWorkerHostFactoryClient> remote_client(
         std::move(client));
     remote_client->OnWorkerHostCreated(std::move(broker));
-    host->StartScriptLoad(script_url, request_initiator_origin,
-                          credentials_mode,
+    host->StartScriptLoad(script_url, credentials_mode,
                           std::move(outside_fetch_client_settings_object),
                           std::move(blob_url_token), std::move(remote_client));
   }
 
  private:
   // See comments on the corresponding members of DedicatedWorkerHost.
-  const int creator_process_id_;
+  const int worker_process_id_;
   const int ancestor_render_frame_id_;
   const int creator_render_frame_id_;
 
-  const url::Origin parent_context_origin_;
+  const url::Origin creator_origin_;
 
   DISALLOW_COPY_AND_ASSIGN(DedicatedWorkerHostFactoryImpl);
 };
@@ -592,15 +578,15 @@ class DedicatedWorkerHostFactoryImpl final
 }  // namespace
 
 void CreateDedicatedWorkerHostFactory(
-    int creator_process_id,
+    int worker_process_id,
     int ancestor_render_frame_id,
     int creator_render_frame_id,
-    const url::Origin& origin,
+    const url::Origin& creator_origin,
     mojo::PendingReceiver<blink::mojom::DedicatedWorkerHostFactory> receiver) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
   mojo::MakeSelfOwnedReceiver(std::make_unique<DedicatedWorkerHostFactoryImpl>(
-                                  creator_process_id, ancestor_render_frame_id,
-                                  creator_render_frame_id, origin),
+                                  worker_process_id, ancestor_render_frame_id,
+                                  creator_render_frame_id, creator_origin),
                               std::move(receiver));
 }
 
diff --git a/chromium/content/browser/worker_host/dedicated_worker_host.h b/chromium/content/browser/worker_host/dedicated_worker_host.h
index d224846e73e..bab35767d4e 100644
--- a/chromium/content/browser/worker_host/dedicated_worker_host.h
+++ b/chromium/content/browser/worker_host/dedicated_worker_host.h
@@ -41,10 +41,10 @@ class StoragePartitionImpl;
 // Creates a host factory for a dedicated worker. This must be called on the UI
 // thread.
 void CreateDedicatedWorkerHostFactory(
-    int creator_process_id,
+    int worker_process_id,
     int ancestor_render_frame_id,
     int creator_render_frame_id,
-    const url::Origin& origin,
+    const url::Origin& creator_origin,
     mojo::PendingReceiver<blink::mojom::DedicatedWorkerHostFactory> receiver);
 
 // A host for a single dedicated worker. It deletes itself upon Mojo
@@ -55,7 +55,7 @@ class DedicatedWorkerHost final : public blink::mojom::DedicatedWorkerHost {
       int worker_process_id,
       int ancestor_render_frame_id,
       int creator_render_frame_id,
-      const url::Origin& origin,
+      const url::Origin& creator_origin,
       mojo::PendingReceiver<blink::mojom::DedicatedWorkerHost> host);
   ~DedicatedWorkerHost() final;
 
@@ -66,7 +66,7 @@ class DedicatedWorkerHost final : public blink::mojom::DedicatedWorkerHost {
   RenderProcessHost* GetProcessHost() {
     return RenderProcessHost::FromID(worker_process_id_);
   }
-  const url::Origin& GetOrigin() { return origin_; }
+  const url::Origin& GetWorkerOrigin() { return worker_origin_; }
 
   void CreateIdleManager(
       mojo::PendingReceiver<blink::mojom::IdleManager> receiver);
@@ -97,7 +97,6 @@ class DedicatedWorkerHost final : public blink::mojom::DedicatedWorkerHost {
   // PlzDedicatedWorker:
   void StartScriptLoad(
       const GURL& script_url,
-      const url::Origin& request_initiator_origin,
       network::mojom::CredentialsMode credentials_mode,
       blink::mojom::FetchClientSettingsObjectPtr
           outside_fetch_client_settings_object,
@@ -158,7 +157,12 @@ class DedicatedWorkerHost final : public blink::mojom::DedicatedWorkerHost {
   // MSG_ROUTING_NONE when this worker is nested.
   const int creator_render_frame_id_;
 
-  const url::Origin origin_;
+  // The origin of the frame or dedicated worker that starts this worker.
+  const url::Origin creator_origin_;
+
+  // The origin of this worker.
+  // https://html.spec.whatwg.org/C/#concept-settings-object-origin
+  const url::Origin worker_origin_;
 
   // The network isolation key to be used for both the worker script and the
   // worker's subresources.
diff --git a/chromium/content/renderer/pepper/pepper_media_stream_video_track_host.cc b/chromium/content/renderer/pepper/pepper_media_stream_video_track_host.cc
index 44d9e51c323..454de6da8af 100644
--- a/chromium/content/renderer/pepper/pepper_media_stream_video_track_host.cc
+++ b/chromium/content/renderer/pepper/pepper_media_stream_video_track_host.cc
@@ -22,6 +22,7 @@
 #include "ppapi/host/host_message_context.h"
 #include "ppapi/proxy/ppapi_messages.h"
 #include "ppapi/shared_impl/media_stream_buffer.h"
+#include "ui/gfx/gpu_memory_buffer.h"
 #include "third_party/blink/public/web/modules/mediastream/media_stream_video_source.h"
 #include "third_party/blink/public/web/modules/mediastream/media_stream_video_track.h"
 #include "third_party/libyuv/include/libyuv.h"
@@ -354,6 +355,36 @@ void PepperMediaStreamVideoTrackHost::OnVideoFrame(
   if (frame->format() == media::PIXEL_FORMAT_I420A)
     frame = media::WrapAsI420VideoFrame(std::move(video_frame));
   PP_VideoFrame_Format ppformat = ToPpapiFormat(frame->format());
+  if (frame->storage_type() == media::VideoFrame::STORAGE_GPU_MEMORY_BUFFER) {
+    // NV12 is the only supported GMB pixel format at the moment, and there is
+    // no corresponding PP_VideoFrame_Format. Convert the video frame to I420.
+    DCHECK_EQ(frame->format(), media::PIXEL_FORMAT_NV12);
+    ppformat = PP_VIDEOFRAME_FORMAT_I420;
+    auto* gmb = video_frame->GetGpuMemoryBuffer();
+    if (!gmb->Map()) {
+      DLOG(WARNING) << "Failed to map GpuMemoryBuffer";
+      return;
+    }
+    frame = media::VideoFrame::CreateFrame(
+        media::PIXEL_FORMAT_I420, video_frame->coded_size(),
+        video_frame->visible_rect(), video_frame->natural_size(),
+        video_frame->timestamp());
+    int ret = libyuv::NV12ToI420(
+        static_cast<const uint8_t*>(gmb->memory(0)), gmb->stride(0),
+        static_cast<const uint8_t*>(gmb->memory(1)), gmb->stride(1),
+        frame->data(media::VideoFrame::kYPlane),
+        frame->stride(media::VideoFrame::kYPlane),
+        frame->data(media::VideoFrame::kUPlane),
+        frame->stride(media::VideoFrame::kUPlane),
+        frame->data(media::VideoFrame::kVPlane),
+        frame->stride(media::VideoFrame::kVPlane),
+        video_frame->coded_size().width(), video_frame->coded_size().height());
+    gmb->Unmap();
+    if (ret != 0) {
+      DLOG(WARNING) << "Failed to convert NV12 to I420";
+      return;
+    }
+  }
   if (ppformat == PP_VIDEOFRAME_FORMAT_UNKNOWN)
     return;
 
diff --git a/chromium/content/renderer/worker/dedicated_worker_host_factory_client.cc b/chromium/content/renderer/worker/dedicated_worker_host_factory_client.cc
index ae618bb439e..80169970035 100644
--- a/chromium/content/renderer/worker/dedicated_worker_host_factory_client.cc
+++ b/chromium/content/renderer/worker/dedicated_worker_host_factory_client.cc
@@ -18,7 +18,6 @@
 #include "third_party/blink/public/mojom/service_worker/service_worker_provider.mojom.h"
 #include "third_party/blink/public/mojom/worker/worker_main_script_load_params.mojom.h"
 #include "third_party/blink/public/platform/web_dedicated_worker.h"
-#include "third_party/blink/public/platform/web_security_origin.h"
 #include "third_party/blink/public/platform/web_url.h"
 
 namespace content {
@@ -32,28 +31,25 @@ DedicatedWorkerHostFactoryClient::DedicatedWorkerHostFactoryClient(
 
 DedicatedWorkerHostFactoryClient::~DedicatedWorkerHostFactoryClient() = default;
 
-void DedicatedWorkerHostFactoryClient::CreateWorkerHostDeprecated(
-    const blink::WebSecurityOrigin& script_origin) {
+void DedicatedWorkerHostFactoryClient::CreateWorkerHostDeprecated() {
   DCHECK(!base::FeatureList::IsEnabled(blink::features::kPlzDedicatedWorker));
   mojo::PendingRemote<blink::mojom::BrowserInterfaceBroker>
       browser_interface_broker;
   factory_->CreateWorkerHost(
-      script_origin, browser_interface_broker.InitWithNewPipeAndPassReceiver(),
+      browser_interface_broker.InitWithNewPipeAndPassReceiver(),
       remote_host_.BindNewPipeAndPassReceiver());
   OnWorkerHostCreated(std::move(browser_interface_broker));
 }
 
 void DedicatedWorkerHostFactoryClient::CreateWorkerHost(
     const blink::WebURL& script_url,
-    const blink::WebSecurityOrigin& script_origin,
     network::mojom::CredentialsMode credentials_mode,
-    const blink::WebSecurityOrigin& fetch_client_security_origin,
     const blink::WebFetchClientSettingsObject& fetch_client_settings_object,
     mojo::ScopedMessagePipeHandle blob_url_token) {
   DCHECK(base::FeatureList::IsEnabled(blink::features::kPlzDedicatedWorker));
 
   factory_->CreateWorkerHostAndStartScriptLoad(
-      script_url, script_origin, credentials_mode,
+      script_url, credentials_mode,
       FetchClientSettingsObjectFromWebToMojom(fetch_client_settings_object),
       mojo::PendingRemote<blink::mojom::BlobURLToken>(
           std::move(blob_url_token), blink::mojom::BlobURLToken::Version_),
diff --git a/chromium/content/renderer/worker/dedicated_worker_host_factory_client.h b/chromium/content/renderer/worker/dedicated_worker_host_factory_client.h
index 65abffeb028..baf7175fad5 100644
--- a/chromium/content/renderer/worker/dedicated_worker_host_factory_client.h
+++ b/chromium/content/renderer/worker/dedicated_worker_host_factory_client.h
@@ -43,13 +43,10 @@ class DedicatedWorkerHostFactoryClient final
   ~DedicatedWorkerHostFactoryClient() override;
 
   // Implements blink::WebDedicatedWorkerHostFactoryClient.
-  void CreateWorkerHostDeprecated(
-      const blink::WebSecurityOrigin& script_origin) override;
+  void CreateWorkerHostDeprecated() override;
   void CreateWorkerHost(
       const blink::WebURL& script_url,
-      const blink::WebSecurityOrigin& script_origin,
       network::mojom::CredentialsMode credentials_mode,
-      const blink::WebSecurityOrigin& fetch_client_security_origin,
       const blink::WebFetchClientSettingsObject& fetch_client_settings_object,
       mojo::ScopedMessagePipeHandle blob_url_token) override;
   scoped_refptr<blink::WebWorkerFetchContext> CloneWorkerFetchContext(
diff --git a/chromium/gpu/config/gpu_lists_version.h b/chromium/gpu/config/gpu_lists_version.h
index 8ee721df75e..410068f80c7 100644
--- a/chromium/gpu/config/gpu_lists_version.h
+++ b/chromium/gpu/config/gpu_lists_version.h
@@ -3,6 +3,6 @@
 #ifndef GPU_CONFIG_GPU_LISTS_VERSION_H_
 #define GPU_CONFIG_GPU_LISTS_VERSION_H_
 
-#define GPU_LISTS_VERSION "d5190fedde334f4c1c3e3851e62966304d236bae"
+#define GPU_LISTS_VERSION "e7fbe071abe9328cdce4ffedac9822435fbd3656"
 
 #endif  // GPU_CONFIG_GPU_LISTS_VERSION_H_
diff --git a/chromium/media/gpu/vaapi/vaapi_jpeg_encode_accelerator.cc b/chromium/media/gpu/vaapi/vaapi_jpeg_encode_accelerator.cc
index 9d6ad3cfddc..02ebf227f7f 100644
--- a/chromium/media/gpu/vaapi/vaapi_jpeg_encode_accelerator.cc
+++ b/chromium/media/gpu/vaapi/vaapi_jpeg_encode_accelerator.cc
@@ -325,7 +325,7 @@ void VaapiJpegEncodeAccelerator::Encoder::EncodeTask(
   }
 
   if (!vaapi_wrapper_->UploadVideoFrameToSurface(*request->video_frame,
-                                                 va_surface_id_)) {
+                                                 va_surface_id_, input_size_)) {
     VLOGF(1) << "Failed to upload video frame to VA surface";
     notify_error_cb_.Run(task_id, PLATFORM_FAILURE);
     return;
diff --git a/chromium/media/gpu/vaapi/vaapi_video_decode_accelerator.cc b/chromium/media/gpu/vaapi/vaapi_video_decode_accelerator.cc
index 31343cd3f4a..39cc884974d 100644
--- a/chromium/media/gpu/vaapi/vaapi_video_decode_accelerator.cc
+++ b/chromium/media/gpu/vaapi/vaapi_video_decode_accelerator.cc
@@ -115,6 +115,24 @@ class VaapiVideoDecodeAccelerator::InputBuffer {
   DISALLOW_COPY_AND_ASSIGN(InputBuffer);
 };
 
+class VaapiVideoDecodeAccelerator::ScopedVASurfaceID {
+ public:
+  using ReleaseCB = base::OnceCallback<void(VASurfaceID)>;
+
+  ScopedVASurfaceID(VASurfaceID va_surface_id, ReleaseCB release_cb)
+      : va_surface_id_(va_surface_id), release_cb_(std::move(release_cb)) {}
+  ~ScopedVASurfaceID() { std::move(release_cb_).Run(va_surface_id_); }
+
+  ScopedVASurfaceID& operator=(const ScopedVASurfaceID&) = delete;
+  ScopedVASurfaceID(const ScopedVASurfaceID&) = delete;
+
+  VASurfaceID va_surface_id() const { return va_surface_id_; }
+
+ private:
+  const VASurfaceID va_surface_id_;
+  ReleaseCB release_cb_;
+};
+
 void VaapiVideoDecodeAccelerator::NotifyError(Error error) {
   if (!task_runner_->BelongsToCurrentThread()) {
     DCHECK(decoder_thread_task_runner_->BelongsToCurrentThread());
@@ -157,8 +175,8 @@ VaapiVideoDecodeAccelerator::VaapiVideoDecodeAccelerator(
       bind_image_cb_(bind_image_cb),
       weak_this_factory_(this) {
   weak_this_ = weak_this_factory_.GetWeakPtr();
-  va_surface_release_cb_ = BindToCurrentLoop(base::BindRepeating(
-      &VaapiVideoDecodeAccelerator::RecycleVASurfaceID, weak_this_));
+  va_surface_recycle_cb_ = BindToCurrentLoop(base::BindRepeating(
+      &VaapiVideoDecodeAccelerator::RecycleVASurface, weak_this_));
   base::trace_event::MemoryDumpManager::GetInstance()->RegisterDumpProvider(
       this, "media::VaapiVideoDecodeAccelerator",
       base::ThreadTaskRunnerHandle::Get());
@@ -566,12 +584,8 @@ void VaapiVideoDecodeAccelerator::TryFinishSurfaceSetChange() {
 
   // All surfaces released, destroy them and dismiss all PictureBuffers.
   awaiting_va_surfaces_recycle_ = false;
-  if (buffer_allocation_mode_ != BufferAllocationMode::kNone) {
-    vaapi_wrapper_->DestroyContextAndSurfaces(std::vector<VASurfaceID>(
-        available_va_surfaces_.begin(), available_va_surfaces_.end()));
-  } else {
-    vaapi_wrapper_->DestroyContext();
-  }
+  vaapi_wrapper_->DestroyContext();
+
   available_va_surfaces_.clear();
 
   for (auto iter = pictures_.begin(); iter != pictures_.end(); ++iter) {
@@ -683,7 +697,6 @@ void VaapiVideoDecodeAccelerator::AssignPictureBuffers(
           picture->Allocate(vaapi_picture_factory_->GetBufferFormat()),
           "Failed to allocate memory for a VaapiPicture", PLATFORM_FAILURE, );
       available_picture_buffers_.push_back(buffers[i].id());
-
       VASurfaceID va_surface_id = picture->va_surface_id();
       if (va_surface_id != VA_INVALID_ID)
         va_surface_ids.push_back(va_surface_id);
@@ -695,6 +708,8 @@ void VaapiVideoDecodeAccelerator::AssignPictureBuffers(
     surfaces_available_.Signal();
   }
 
+  base::RepeatingCallback<void(VASurfaceID)> va_surface_release_cb;
+
   // If we aren't in BufferAllocationMode::kNone, we use |va_surface_ids| for
   // decode, otherwise ask |vaapi_wrapper_| to allocate them for us.
   if (buffer_allocation_mode_ == BufferAllocationMode::kNone) {
@@ -703,6 +718,8 @@ void VaapiVideoDecodeAccelerator::AssignPictureBuffers(
         vaapi_wrapper_->CreateContext(requested_pic_size_),
         "Failed creating VA Context", PLATFORM_FAILURE, );
     DCHECK_EQ(va_surface_ids.size(), buffers.size());
+
+    va_surface_release_cb = base::DoNothing();
   } else {
     const size_t requested_num_surfaces =
         IsBufferAllocationModeReducedOrSuperReduced()
@@ -710,15 +727,22 @@ void VaapiVideoDecodeAccelerator::AssignPictureBuffers(
             : pictures_.size();
     CHECK_NE(requested_num_surfaces, 0u);
     va_surface_ids.clear();
+
     RETURN_AND_NOTIFY_ON_FAILURE(
         vaapi_wrapper_->CreateContextAndSurfaces(
             va_surface_format_, requested_pic_size_,
             VaapiWrapper::SurfaceUsageHint::kVideoDecoder,
             requested_num_surfaces, &va_surface_ids),
         "Failed creating VA Surfaces", PLATFORM_FAILURE, );
+
+    va_surface_release_cb =
+        base::BindRepeating(&VaapiWrapper::DestroySurface, vaapi_wrapper_);
   }
 
-  available_va_surfaces_.assign(va_surface_ids.begin(), va_surface_ids.end());
+  for (const VASurfaceID va_surface_id : va_surface_ids) {
+    available_va_surfaces_.emplace_back(std::make_unique<ScopedVASurfaceID>(
+        va_surface_id, va_surface_release_cb));
+  }
 
   // Resume DecodeTask if it is still in decoding state.
   if (state_ == kDecoding) {
@@ -976,14 +1000,13 @@ void VaapiVideoDecodeAccelerator::Cleanup() {
     base::AutoUnlock auto_unlock(lock_);
     decoder_thread_.Stop();
   }
-  if (vaapi_wrapper_) {
-    if (buffer_allocation_mode_ != BufferAllocationMode::kNone) {
-      vaapi_wrapper_->DestroyContextAndSurfaces(std::vector<VASurfaceID>(
-          available_va_surfaces_.begin(), available_va_surfaces_.end()));
-    } else {
-      vaapi_wrapper_->DestroyContext();
-    }
-  }
+  if (buffer_allocation_mode_ != BufferAllocationMode::kNone)
+    available_va_surfaces_.clear();
+
+  vaapi_wrapper_->DestroyContext();
+
+  if (vpp_vaapi_wrapper_)
+    vpp_vaapi_wrapper_->DestroyContext();
   state_ = kUninitialized;
 }
 
@@ -1037,7 +1060,8 @@ scoped_refptr<VASurface> VaapiVideoDecodeAccelerator::CreateSurface() {
   DCHECK_NE(VA_INVALID_ID, va_surface_format_);
   DCHECK(!awaiting_va_surfaces_recycle_);
   if (buffer_allocation_mode_ != BufferAllocationMode::kNone) {
-    const VASurfaceID id = available_va_surfaces_.front();
+    auto va_surface = std::move(available_va_surfaces_.front());
+    const VASurfaceID id = va_surface->va_surface_id();
     available_va_surfaces_.pop_front();
 
     TRACE_COUNTER_ID2("media,gpu", "Vaapi VASurfaceIDs", this, "used",
@@ -1047,36 +1071,44 @@ scoped_refptr<VASurface> VaapiVideoDecodeAccelerator::CreateSurface() {
                           available_va_surfaces_.size(),
                       "available", available_va_surfaces_.size());
 
-    return new VASurface(id, requested_pic_size_, va_surface_format_,
-                         base::BindOnce(va_surface_release_cb_));
+    return new VASurface(
+        id, requested_pic_size_, va_surface_format_,
+        base::BindOnce(va_surface_recycle_cb_, std::move(va_surface)));
   }
 
   // Find the first |available_va_surfaces_| id such that the associated
   // |pictures_| entry is marked as |available_picture_buffers_|. In practice,
   // we will quickly find an available |va_surface_id|.
-  for (const VASurfaceID va_surface_id : available_va_surfaces_) {
+  for (auto it = available_va_surfaces_.begin();
+       it != available_va_surfaces_.end(); ++it) {
+    const VASurfaceID va_surface_id = (*it)->va_surface_id();
     for (const auto& id_and_picture : pictures_) {
       if (id_and_picture.second->va_surface_id() == va_surface_id &&
           base::Contains(available_picture_buffers_, id_and_picture.first)) {
         // Remove |va_surface_id| from the list of availables, and use the id
         // to return a new VASurface.
-        base::Erase(available_va_surfaces_, va_surface_id);
-        return new VASurface(va_surface_id, requested_pic_size_,
-                             va_surface_format_,
-                             base::BindOnce(va_surface_release_cb_));
+        auto va_surface = std::move(*it);
+        available_va_surfaces_.erase(it);
+        return new VASurface(
+            va_surface_id, requested_pic_size_, va_surface_format_,
+            base::BindOnce(va_surface_recycle_cb_, std::move(va_surface)));
       }
     }
   }
   return nullptr;
 }
 
-void VaapiVideoDecodeAccelerator::RecycleVASurfaceID(
-    VASurfaceID va_surface_id) {
+void VaapiVideoDecodeAccelerator::RecycleVASurface(
+    std::unique_ptr<ScopedVASurfaceID> va_surface,
+    // We don't use |va_surface_id| but it must be here because this method is
+    // bound as VASurface::ReleaseCB.
+    VASurfaceID /*va_surface_id*/) {
   DCHECK(task_runner_->BelongsToCurrentThread());
 
   {
     base::AutoLock auto_lock(lock_);
-    available_va_surfaces_.push_back(va_surface_id);
+    available_va_surfaces_.push_back(std::move(va_surface));
+
     if (buffer_allocation_mode_ != BufferAllocationMode::kNone) {
       TRACE_COUNTER_ID2("media,gpu", "Vaapi VASurfaceIDs", this, "used",
                         (IsBufferAllocationModeReducedOrSuperReduced()
diff --git a/chromium/media/gpu/vaapi/vaapi_video_decode_accelerator.h b/chromium/media/gpu/vaapi/vaapi_video_decode_accelerator.h
index c1a63e43cb9..73d4ae695f2 100644
--- a/chromium/media/gpu/vaapi/vaapi_video_decode_accelerator.h
+++ b/chromium/media/gpu/vaapi/vaapi_video_decode_accelerator.h
@@ -104,6 +104,8 @@ class MEDIA_GPU_EXPORT VaapiVideoDecodeAccelerator
 
   // An input buffer with id provided by the client and awaiting consumption.
   class InputBuffer;
+  // A self-cleaning VASurfaceID.
+  class ScopedVASurfaceID;
 
   // Notify the client that an error has occurred and decoding cannot continue.
   void NotifyError(Error error);
@@ -173,10 +175,11 @@ class MEDIA_GPU_EXPORT VaapiVideoDecodeAccelerator
   // Try to OutputPicture() if we have both a ready surface and picture.
   void TryOutputPicture();
 
-  // Called when a VASurface is no longer in use by the decoder or is not being
-  // synced/waiting to be synced to a picture. Returns it to the
-  // |available_va_surfaces_|
-  void RecycleVASurfaceID(VASurfaceID va_surface_id);
+  // Called when a VASurface is no longer in use by |decoder_| nor |client_|.
+  // Returns it to |available_va_surfaces_|. |va_surface_id| is not used but it
+  // must be here to bind this method as VASurface::ReleaseCB.
+  void RecycleVASurface(std::unique_ptr<ScopedVASurfaceID> va_surface,
+                        VASurfaceID va_surface_id);
 
   // Request a new set of |num_pics| PictureBuffers to be allocated by
   // |client_|. Up to |num_reference_frames| out of |num_pics_| might be needed
@@ -264,9 +267,10 @@ class MEDIA_GPU_EXPORT VaapiVideoDecodeAccelerator
   // OutputPicture() (|client_| returns them via ReusePictureBuffer()).
   std::list<int32_t> available_picture_buffers_ GUARDED_BY(lock_);
 
-  // VASurfaceIDs no longer in use that can be passed back to |decoder_| for
-  // reuse, once it requests them.
-  std::list<VASurfaceID> available_va_surfaces_ GUARDED_BY(lock_);
+  // VASurfaces available and that can be passed to |decoder_| for its use upon
+  // CreateSurface() request (and then returned via RecycleVASurface()).
+  std::list<std::unique_ptr<ScopedVASurfaceID>> available_va_surfaces_
+      GUARDED_BY(lock_);
   // Signalled when output surfaces are queued into |available_va_surfaces_|.
   base::ConditionVariable surfaces_available_;
   // VASurfaceIDs format, filled in when created.
@@ -291,8 +295,9 @@ class MEDIA_GPU_EXPORT VaapiVideoDecodeAccelerator
   // decoder thread to the ChildThread should use |weak_this_|.
   base::WeakPtr<VaapiVideoDecodeAccelerator> weak_this_;
 
-  // Callback used when creating VASurface objects. Only used on |task_runner_|.
-  base::RepeatingCallback<void(VASurfaceID)> va_surface_release_cb_;
+  // Callback used to recycle VASurfaces. Only used on |task_runner_|.
+  base::RepeatingCallback<void(std::unique_ptr<ScopedVASurfaceID>, VASurfaceID)>
+      va_surface_recycle_cb_;
 
   // To expose client callbacks from VideoDecodeAccelerator. Used only on
   // |task_runner_|.
diff --git a/chromium/media/gpu/vaapi/vaapi_video_decode_accelerator_unittest.cc b/chromium/media/gpu/vaapi/vaapi_video_decode_accelerator_unittest.cc
index ee1aefe78b4..51e7ed9cde9 100644
--- a/chromium/media/gpu/vaapi/vaapi_video_decode_accelerator_unittest.cc
+++ b/chromium/media/gpu/vaapi/vaapi_video_decode_accelerator_unittest.cc
@@ -76,7 +76,8 @@ class MockVaapiWrapper : public VaapiWrapper {
                     size_t,
                     std::vector<VASurfaceID>*));
   MOCK_METHOD1(CreateContext, bool(const gfx::Size&));
-  MOCK_METHOD1(DestroyContextAndSurfaces, void(std::vector<VASurfaceID>));
+  MOCK_METHOD0(DestroyContext, void());
+  MOCK_METHOD1(DestroySurface, void(VASurfaceID));
 
  private:
   ~MockVaapiWrapper() override = default;
@@ -239,12 +240,7 @@ class VaapiVideoDecodeAcceleratorTest : public TestWithParam<TestParams>,
         .WillOnce(Return(kNumReferenceFrames));
     EXPECT_CALL(*mock_decoder_, GetVisibleRect())
         .WillOnce(Return(gfx::Rect(picture_size)));
-    if (vda_.buffer_allocation_mode_ !=
-        VaapiVideoDecodeAccelerator::BufferAllocationMode::kNone) {
-      EXPECT_CALL(*mock_vaapi_wrapper_, DestroyContextAndSurfaces(_));
-    } else {
-      // TODO(crbug.com/971891): Make virtual and expect DestroyContext().
-    }
+    EXPECT_CALL(*mock_vaapi_wrapper_, DestroyContext());
 
     if (expect_dismiss_picture_buffers) {
       EXPECT_CALL(*this, DismissPictureBuffer(_))
@@ -309,6 +305,10 @@ class VaapiVideoDecodeAcceleratorTest : public TestWithParam<TestParams>,
                 va_surface_ids->resize(kNumReferenceFrames);
               })),
               Return(true)));
+      EXPECT_CALL(*mock_vaapi_wrapper_, DestroySurface(_))
+          .Times(kNumReferenceFrames);
+      EXPECT_CALL(*mock_decoder_, GetVisibleRect())
+          .WillRepeatedly(Return(gfx::Rect(picture_size)));
       EXPECT_CALL(*mock_vaapi_picture_factory_,
                   MockCreateVaapiPicture(_, picture_size))
           .Times(num_pictures);
diff --git a/chromium/media/gpu/vaapi/vaapi_video_encode_accelerator.cc b/chromium/media/gpu/vaapi/vaapi_video_encode_accelerator.cc
index f3bab4098ab..b6dbf1dbc8d 100644
--- a/chromium/media/gpu/vaapi/vaapi_video_encode_accelerator.cc
+++ b/chromium/media/gpu/vaapi/vaapi_video_encode_accelerator.cc
@@ -463,11 +463,14 @@ void VaapiVideoEncodeAccelerator::ExecuteEncode(VASurfaceID va_surface_id) {
     NOTIFY_ERROR(kPlatformFailureError, "Failed to execute encode");
 }
 
-void VaapiVideoEncodeAccelerator::UploadFrame(scoped_refptr<VideoFrame> frame,
-                                              VASurfaceID va_surface_id) {
+void VaapiVideoEncodeAccelerator::UploadFrame(
+    scoped_refptr<VideoFrame> frame,
+    VASurfaceID va_surface_id,
+    const gfx::Size& va_surface_size) {
   DCHECK(encoder_thread_task_runner_->BelongsToCurrentThread());
   DVLOGF(4) << "frame is uploading: " << va_surface_id;
-  if (!vaapi_wrapper_->UploadVideoFrameToSurface(*frame, va_surface_id))
+  if (!vaapi_wrapper_->UploadVideoFrameToSurface(*frame, va_surface_id,
+                                                 va_surface_size))
     NOTIFY_ERROR(kPlatformFailureError, "Failed to upload frame");
 }
 
@@ -686,9 +689,9 @@ std::unique_ptr<VaapiEncodeJob> VaapiVideoEncodeAccelerator::CreateEncodeJob(
       input_surface, std::move(reconstructed_surface), coded_buffer_id);
 
   if (!native_input_mode_) {
-    job->AddSetupCallback(
-        base::BindOnce(&VaapiVideoEncodeAccelerator::UploadFrame,
-                       base::Unretained(this), frame, input_surface->id()));
+    job->AddSetupCallback(base::BindOnce(
+        &VaapiVideoEncodeAccelerator::UploadFrame, base::Unretained(this), frame,
+        input_surface->id(), input_surface->size()));
   }
 
   return job;
diff --git a/chromium/media/gpu/vaapi/vaapi_video_encode_accelerator.h b/chromium/media/gpu/vaapi/vaapi_video_encode_accelerator.h
index 47f10e36969..386bc10c5d7 100644
--- a/chromium/media/gpu/vaapi/vaapi_video_encode_accelerator.h
+++ b/chromium/media/gpu/vaapi/vaapi_video_encode_accelerator.h
@@ -103,7 +103,9 @@ class MEDIA_GPU_EXPORT VaapiVideoEncodeAccelerator
   void EncodePendingInputs();
 
   // Uploads image data from |frame| to |va_surface_id|.
-  void UploadFrame(scoped_refptr<VideoFrame> frame, VASurfaceID va_surface_id);
+  void UploadFrame(scoped_refptr<VideoFrame> frame,
+                   VASurfaceID va_surface_id,
+                   const gfx::Size& va_surface_size);
 
   // Executes encode in hardware. This does not block and may return before
   // the job is finished.
diff --git a/chromium/media/gpu/vaapi/vaapi_wrapper.cc b/chromium/media/gpu/vaapi/vaapi_wrapper.cc
index 0468d00504a..f7683a0e9ca 100644
--- a/chromium/media/gpu/vaapi/vaapi_wrapper.cc
+++ b/chromium/media/gpu/vaapi/vaapi_wrapper.cc
@@ -19,6 +19,7 @@
 
 #include "base/bind.h"
 #include "base/bind_helpers.h"
+#include "base/bits.h"
 #include "base/callback_helpers.h"
 #include "base/environment.h"
 #include "base/files/scoped_file.h"
@@ -141,6 +142,69 @@ namespace media {
 
 namespace {
 
+bool GetNV12VisibleWidthBytes(int visible_width,
+                              uint32_t plane,
+                              size_t* bytes) {
+  if (plane == 0) {
+    *bytes = base::checked_cast<size_t>(visible_width);
+    return true;
+  }
+
+  *bytes = base::checked_cast<size_t>(visible_width);
+  return visible_width % 2 == 0 ||
+         base::CheckAdd<int>(visible_width, 1).AssignIfValid(bytes);
+}
+
+// Fill 0 on VAImage's non visible area.
+bool ClearNV12Padding(const VAImage& image,
+                      const gfx::Size& visible_size,
+                      uint8_t* data) {
+  DCHECK_EQ(2u, image.num_planes);
+  DCHECK_EQ(image.format.fourcc, static_cast<uint32_t>(VA_FOURCC_NV12));
+
+  size_t visible_width_bytes[2] = {};
+  if (!GetNV12VisibleWidthBytes(visible_size.width(), 0u,
+                                &visible_width_bytes[0]) ||
+      !GetNV12VisibleWidthBytes(visible_size.width(), 1u,
+                                &visible_width_bytes[1])) {
+    return false;
+  }
+
+  for (uint32_t plane = 0; plane < image.num_planes; plane++) {
+    size_t row_bytes = base::strict_cast<size_t>(image.pitches[plane]);
+    if (row_bytes == visible_width_bytes[plane])
+      continue;
+
+    CHECK_GT(row_bytes, visible_width_bytes[plane]);
+    int visible_height = visible_size.height();
+    if (plane == 1 && !(base::CheckAdd<int>(visible_size.height(), 1) / 2)
+                           .AssignIfValid(&visible_height)) {
+      return false;
+    }
+
+    const size_t padding_bytes = row_bytes - visible_width_bytes[plane];
+    uint8_t* plane_data = data + image.offsets[plane];
+    for (int row = 0; row < visible_height; row++, plane_data += row_bytes)
+      memset(plane_data + visible_width_bytes[plane], 0, padding_bytes);
+
+    CHECK_GE(base::strict_cast<int>(image.height), visible_height);
+    size_t image_height = base::strict_cast<size_t>(image.height);
+    if (plane == 1 && !(base::CheckAdd<size_t>(image.height, 1) / 2)
+                           .AssignIfValid(&image_height)) {
+      return false;
+    }
+
+    base::CheckedNumeric<size_t> remaining_area(image_height);
+    remaining_area -= base::checked_cast<size_t>(visible_height);
+    remaining_area *= row_bytes;
+    if (!remaining_area.IsValid())
+      return false;
+    memset(plane_data, 0, remaining_area.ValueOrDie());
+  }
+
+  return true;
+}
+
 // Maximum framerate of encoded profile. This value is an arbitary limit
 // and not taken from HW documentation.
 constexpr int kMaxEncoderFramerate = 30;
@@ -1745,12 +1809,20 @@ std::unique_ptr<ScopedVAImage> VaapiWrapper::CreateVaImage(
 }
 
 bool VaapiWrapper::UploadVideoFrameToSurface(const VideoFrame& frame,
-                                             VASurfaceID va_surface_id) {
+                                             VASurfaceID va_surface_id,
+                                             const gfx::Size& va_surface_size) {
   TRACE_EVENT0("media,gpu", "VaapiWrapper::UploadVideoFrameToSurface");
   base::AutoLock auto_lock(*va_lock_);
   TRACE_EVENT0("media,gpu", "VaapiWrapper::UploadVideoFrameToSurfaceLocked");
 
-  const gfx::Size size = frame.coded_size();
+  if (frame.visible_rect().origin() != gfx::Point(0, 0)) {
+    LOG(ERROR) << "The origin of the frame's visible rectangle is not (0, 0), "
+               << "frame.visible_rect().origin()="
+               << frame.visible_rect().origin().ToString();
+    return false;
+  }
+
+  const gfx::Size visible_size = frame.visible_rect().size();
   bool va_create_put_fallback = false;
   VAImage image;
   VAStatus va_res = vaDeriveImage(va_display_, va_surface_id, &image);
@@ -1762,8 +1834,8 @@ bool VaapiWrapper::UploadVideoFrameToSurface(const VideoFrame& frame,
                                              .bits_per_pixel = 12};
     VAImageFormat image_format = kImageFormatNV12;
 
-    va_res = vaCreateImage(va_display_, &image_format, size.width(),
-                           size.height(), &image);
+    va_res = vaCreateImage(va_display_, &image_format, va_surface_size.width(),
+                           va_surface_size.height(), &image);
     VA_SUCCESS_OR_RETURN(va_res, "vaCreateImage failed", false);
   }
   base::ScopedClosureRunner vaimage_deleter(
@@ -1774,7 +1846,13 @@ bool VaapiWrapper::UploadVideoFrameToSurface(const VideoFrame& frame,
     return false;
   }
 
-  if (gfx::Rect(image.width, image.height) < gfx::Rect(size)) {
+  if (image.width % 2 != 0 || image.height % 2 != 0) {
+    LOG(ERROR) << "Buffer's width and height are not even, "
+               << "width=" << image.width << ", height=" << image.height;
+    return false;
+  }
+
+  if (!gfx::Rect(image.width, image.height).Contains(gfx::Rect(visible_size))) {
     LOG(ERROR) << "Buffer too small to fit the frame.";
     return false;
   }
@@ -1784,6 +1862,11 @@ bool VaapiWrapper::UploadVideoFrameToSurface(const VideoFrame& frame,
     return false;
   uint8_t* image_ptr = static_cast<uint8_t*>(mapping.data());
 
+  if (!ClearNV12Padding(image, visible_size, image_ptr)) {
+    LOG(ERROR) << "Failed to clear non visible area of VAImage";
+    return false;
+  }
+
   int ret = 0;
   {
     base::AutoUnlock auto_unlock(*va_lock_);
@@ -1794,19 +1877,32 @@ bool VaapiWrapper::UploadVideoFrameToSurface(const VideoFrame& frame,
             frame.data(VideoFrame::kUPlane), frame.stride(VideoFrame::kUPlane),
             frame.data(VideoFrame::kVPlane), frame.stride(VideoFrame::kVPlane),
             image_ptr + image.offsets[0], image.pitches[0],
-            image_ptr + image.offsets[1], image.pitches[1], image.width,
-            image.height);
+            image_ptr + image.offsets[1], image.pitches[1],
+            visible_size.width(), visible_size.height());
         break;
-      case PIXEL_FORMAT_NV12:
+      case PIXEL_FORMAT_NV12: {
+        int uv_width = visible_size.width();
+        if (visible_size.width() % 2 != 0 &&
+            !base::CheckAdd<int>(visible_size.width(), 1)
+                 .AssignIfValid(&uv_width)) {
+          return false;
+        }
+
+        int uv_height = 0;
+        if (!(base::CheckAdd<int>(visible_size.height(), 1) / 2)
+                 .AssignIfValid(&uv_height)) {
+          return false;
+        }
+
         libyuv::CopyPlane(frame.data(VideoFrame::kYPlane),
                           frame.stride(VideoFrame::kYPlane),
                           image_ptr + image.offsets[0], image.pitches[0],
-                          image.width, image.height);
+                          visible_size.width(), visible_size.height());
         libyuv::CopyPlane(frame.data(VideoFrame::kUVPlane),
                           frame.stride(VideoFrame::kUVPlane),
                           image_ptr + image.offsets[1], image.pitches[1],
-                          image.width, image.height / 2);
-        break;
+                          uv_width, uv_height);
+      } break;
       default:
         LOG(ERROR) << "Unsupported pixel format: " << frame.format();
         return false;
@@ -1814,8 +1910,8 @@ bool VaapiWrapper::UploadVideoFrameToSurface(const VideoFrame& frame,
   }
   if (va_create_put_fallback) {
     va_res = vaPutImage(va_display_, va_surface_id, image.image_id, 0, 0,
-                        size.width(), size.height(), 0, 0, size.width(),
-                        size.height());
+                        visible_size.width(), visible_size.height(), 0, 0,
+                        visible_size.width(), visible_size.height());
     VA_SUCCESS_OR_RETURN(va_res, "vaPutImage failed", false);
   }
   return ret == 0;
diff --git a/chromium/media/gpu/vaapi/vaapi_wrapper.h b/chromium/media/gpu/vaapi/vaapi_wrapper.h
index 94df9640f09..54f73dd10f3 100644
--- a/chromium/media/gpu/vaapi/vaapi_wrapper.h
+++ b/chromium/media/gpu/vaapi/vaapi_wrapper.h
@@ -228,7 +228,7 @@ class MEDIA_GPU_EXPORT VaapiWrapper
       const base::Optional<gfx::Size>& visible_size = base::nullopt);
 
   // Releases the |va_surfaces| and destroys |va_context_id_|.
-  virtual void DestroyContextAndSurfaces(std::vector<VASurfaceID> va_surfaces);
+  void DestroyContextAndSurfaces(std::vector<VASurfaceID> va_surfaces);
 
   // Creates a VA Context of |size| and sets |va_context_id_|. In the case of a
   // VPP VaapiWrapper, |size| is ignored and 0x0 is used to create the context.
@@ -237,7 +237,7 @@ class MEDIA_GPU_EXPORT VaapiWrapper
   virtual bool CreateContext(const gfx::Size& size);
 
   // Destroys the context identified by |va_context_id_|.
-  void DestroyContext();
+  virtual void DestroyContext();
 
   // Requests a VA surface of size |size| and |va_rt_format|. Returns a
   // self-cleaning ScopedVASurface or nullptr if creation failed. If
@@ -344,7 +344,8 @@ class MEDIA_GPU_EXPORT VaapiWrapper
 
   // Upload contents of |frame| into |va_surface_id| for encode.
   bool UploadVideoFrameToSurface(const VideoFrame& frame,
-                                 VASurfaceID va_surface_id);
+                                 VASurfaceID va_surface_id,
+                                 const gfx::Size& va_surface_size);
 
   // Create a buffer of |size| bytes to be used as encode output.
   bool CreateVABuffer(size_t size, VABufferID* buffer_id);
@@ -389,7 +390,7 @@ class MEDIA_GPU_EXPORT VaapiWrapper
 
   // vaDestroySurfaces() a vector or a single VASurfaceID.
   void DestroySurfaces(std::vector<VASurfaceID> va_surfaces);
-  void DestroySurface(VASurfaceID va_surface_id);
+  virtual void DestroySurface(VASurfaceID va_surface_id);
 
  protected:
   VaapiWrapper(CodecMode mode);
diff --git a/chromium/media/mojo/services/mojo_video_encode_accelerator_service.cc b/chromium/media/mojo/services/mojo_video_encode_accelerator_service.cc
index aa1fb3c8031..be05a2d9a12 100644
--- a/chromium/media/mojo/services/mojo_video_encode_accelerator_service.cc
+++ b/chromium/media/mojo/services/mojo_video_encode_accelerator_service.cc
@@ -49,11 +49,16 @@ void MojoVideoEncodeAcceleratorService::Initialize(
     InitializeCallback success_callback) {
   DVLOG(1) << __func__ << " " << config.AsHumanReadableString();
   DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
-  DCHECK(!encoder_);
   DCHECK(config.input_format == PIXEL_FORMAT_I420 ||
          config.input_format == PIXEL_FORMAT_NV12)
       << "Only I420 or NV12 format supported";
 
+  if (encoder_) {
+    DLOG(ERROR) << __func__ << " VEA is already initialized";
+    std::move(success_callback).Run(false);
+    return;
+  }
+
   if (!client) {
     DLOG(ERROR) << __func__ << "null |client|";
     std::move(success_callback).Run(false);
diff --git a/chromium/net/http/http_cache_transaction.cc b/chromium/net/http/http_cache_transaction.cc
index 2973940d197..a769e2ff9a8 100644
--- a/chromium/net/http/http_cache_transaction.cc
+++ b/chromium/net/http/http_cache_transaction.cc
@@ -1432,7 +1432,8 @@ int HttpCache::Transaction::DoDoneHeadersAddToEntryComplete(int result) {
   cache_pending_ = false;
   done_headers_create_new_entry_ = false;
 
-  // Speculative fix for rare crash. crbug.com/959194
+  // It is unclear exactly how this state is reached with an ERR_CACHE_RACE, but
+  // this check appears to fix a rare crash. See crbug.com/959194.
   if (result == ERR_CACHE_RACE) {
     TransitionToState(STATE_HEADERS_PHASE_CANNOT_PROCEED);
     return OK;
diff --git a/chromium/skia/ext/skia_commit_hash.h b/chromium/skia/ext/skia_commit_hash.h
index 43f3174dda7..d54c54974ef 100644
--- a/chromium/skia/ext/skia_commit_hash.h
+++ b/chromium/skia/ext/skia_commit_hash.h
@@ -3,6 +3,6 @@
 #ifndef SKIA_EXT_SKIA_COMMIT_HASH_H_
 #define SKIA_EXT_SKIA_COMMIT_HASH_H_
 
-#define SKIA_COMMIT_HASH "ac0e515499dbbfd8de62ed1eb7b5d0f2ad6a7679"
+#define SKIA_COMMIT_HASH "a91f9f612e5eeb93cf40a3c0ce7d7c6ddf838feb"
 
 #endif  // SKIA_EXT_SKIA_COMMIT_HASH_H_
diff --git a/chromium/third_party/blink/public/mojom/worker/dedicated_worker_host_factory.mojom b/chromium/third_party/blink/public/mojom/worker/dedicated_worker_host_factory.mojom
index 7c6ca2eff2e..831bfa8ec59 100644
--- a/chromium/third_party/blink/public/mojom/worker/dedicated_worker_host_factory.mojom
+++ b/chromium/third_party/blink/public/mojom/worker/dedicated_worker_host_factory.mojom
@@ -14,7 +14,6 @@ import "third_party/blink/public/mojom/worker/dedicated_worker_host.mojom";
 import "third_party/blink/public/mojom/worker/worker_main_script_load_params.mojom";
 import "third_party/blink/public/mojom/service_worker/controller_service_worker.mojom";
 import "third_party/blink/public/mojom/service_worker/service_worker_provider.mojom";
-import "url/mojom/origin.mojom";
 import "url/mojom/url.mojom";
 
 // The name of the InterfaceProviderSpec in service manifests used by the
@@ -74,11 +73,7 @@ interface DedicatedWorkerHostFactory {
   //
   // Creates a new DedicatedWorkerHost, and requests |browser_interface_broker|
   // to provide the worker access to mojo interfaces.
-  // |origin| must either be
-  // unique or match the origin of the creating context (Document or
-  // DedicatedWorkerGlobalScope).
   CreateWorkerHost(
-      url.mojom.Origin origin,
       pending_receiver<blink.mojom.BrowserInterfaceBroker>
           browser_interface_broker,
       pending_receiver<DedicatedWorkerHost> host);
@@ -90,14 +85,11 @@ interface DedicatedWorkerHostFactory {
   // Creates a new DedicatedWorkerHost, and requests to start top-level worker
   // script loading for |script_url| using |credentials_mode| and
   // |outside_fetch_client_settings_object|.
-  // |origin| must either be unique or match the origin of the creating context
-  // (Document or DedicatedWorkerGlobalScope).
   // |blob_url_token| should be non-null when |script_url| is a blob URL.
   // |client| is used for notifying the renderer process of results of worker
   // host creation and script loading.
   CreateWorkerHostAndStartScriptLoad(
       url.mojom.Url script_url,
-      url.mojom.Origin origin,
       network.mojom.CredentialsMode credentials_mode,
       blink.mojom.FetchClientSettingsObject
           outside_fetch_client_settings_object,
diff --git a/chromium/third_party/blink/public/platform/web_dedicated_worker_host_factory_client.h b/chromium/third_party/blink/public/platform/web_dedicated_worker_host_factory_client.h
index f3a7c6c90b7..c86f5429654 100644
--- a/chromium/third_party/blink/public/platform/web_dedicated_worker_host_factory_client.h
+++ b/chromium/third_party/blink/public/platform/web_dedicated_worker_host_factory_client.h
@@ -19,7 +19,6 @@ class SingleThreadTaskRunner;
 
 namespace blink {
 
-class WebSecurityOrigin;
 class WebURL;
 class WebWorkerFetchContext;
 
@@ -32,17 +31,11 @@ class WebDedicatedWorkerHostFactoryClient {
   // Requests the creation of DedicatedWorkerHost in the browser process.
   // For non-PlzDedicatedWorker. This will be removed once PlzDedicatedWorker is
   // enabled by default.
-  virtual void CreateWorkerHostDeprecated(
-      const blink::WebSecurityOrigin& script_origin) = 0;
+  virtual void CreateWorkerHostDeprecated() = 0;
   // For PlzDedicatedWorker.
-  // |fetch_client_security_origin| is intentionally separated from
-  // |fetch_client_settings_object| as it shouldn't be passed from renderer
-  // process from the security perspective.
   virtual void CreateWorkerHost(
       const blink::WebURL& script_url,
-      const blink::WebSecurityOrigin& script_origin,
       network::mojom::CredentialsMode credentials_mode,
-      const blink::WebSecurityOrigin& fetch_client_security_origin,
       const blink::WebFetchClientSettingsObject& fetch_client_settings_object,
       mojo::ScopedMessagePipeHandle blob_url_token) = 0;
 
diff --git a/chromium/third_party/blink/renderer/core/workers/dedicated_worker.cc b/chromium/third_party/blink/renderer/core/workers/dedicated_worker.cc
index 35af0a0dc06..19da6821016 100644
--- a/chromium/third_party/blink/renderer/core/workers/dedicated_worker.cc
+++ b/chromium/third_party/blink/renderer/core/workers/dedicated_worker.cc
@@ -246,18 +246,14 @@ void DedicatedWorker::Start() {
 
     factory_client_->CreateWorkerHost(
         script_request_url_,
-        WebSecurityOrigin(GetExecutionContext()->GetSecurityOrigin()),
         credentials_mode,
-        WebSecurityOrigin(
-            outside_fetch_client_settings_object_->GetSecurityOrigin()),
         WebFetchClientSettingsObject(*outside_fetch_client_settings_object_),
         blob_url_token.PassPipe());
     // Continue in OnScriptLoadStarted() or OnScriptLoadStartFailed().
     return;
   }
 
-  factory_client_->CreateWorkerHostDeprecated(
-      WebSecurityOrigin(GetExecutionContext()->GetSecurityOrigin()));
+  factory_client_->CreateWorkerHostDeprecated();
 
   if (options_->type() == "classic") {
     // Legacy code path (to be deprecated, see https://crbug.com/835717):
diff --git a/chromium/third_party/blink/renderer/modules/webaudio/audio_scheduled_source_node.cc b/chromium/third_party/blink/renderer/modules/webaudio/audio_scheduled_source_node.cc
index 9594f5fe1c2..8e9c4c60163 100644
--- a/chromium/third_party/blink/renderer/modules/webaudio/audio_scheduled_source_node.cc
+++ b/chromium/third_party/blink/renderer/modules/webaudio/audio_scheduled_source_node.cc
@@ -250,7 +250,7 @@ void AudioScheduledSourceHandler::Finish() {
   PostCrossThreadTask(
       *task_runner_, FROM_HERE,
       CrossThreadBindOnce(&AudioScheduledSourceHandler::NotifyEnded,
-                          WrapRefCounted(this)));
+                          AsWeakPtr()));
 }
 
 void AudioScheduledSourceHandler::NotifyEnded() {
diff --git a/chromium/third_party/blink/renderer/modules/webaudio/audio_scheduled_source_node.h b/chromium/third_party/blink/renderer/modules/webaudio/audio_scheduled_source_node.h
index 2fdb9bac867..d526a776c4c 100644
--- a/chromium/third_party/blink/renderer/modules/webaudio/audio_scheduled_source_node.h
+++ b/chromium/third_party/blink/renderer/modules/webaudio/audio_scheduled_source_node.h
@@ -30,6 +30,7 @@
 #define THIRD_PARTY_BLINK_RENDERER_MODULES_WEBAUDIO_AUDIO_SCHEDULED_SOURCE_NODE_H_
 
 #include <atomic>
+#include "base/memory/weak_ptr.h"
 #include "third_party/blink/renderer/bindings/core/v8/active_script_wrappable.h"
 #include "third_party/blink/renderer/modules/webaudio/audio_node.h"
 
@@ -38,7 +39,9 @@ namespace blink {
 class BaseAudioContext;
 class AudioBus;
 
-class AudioScheduledSourceHandler : public AudioHandler {
+class AudioScheduledSourceHandler
+    : public AudioHandler,
+      public base::SupportsWeakPtr<AudioScheduledSourceHandler> {
  public:
   // These are the possible states an AudioScheduledSourceNode can be in:
   //
diff --git a/chromium/third_party/blink/renderer/modules/webaudio/base_audio_context.cc b/chromium/third_party/blink/renderer/modules/webaudio/base_audio_context.cc
index 0da688b3725..34f2c6d63eb 100644
--- a/chromium/third_party/blink/renderer/modules/webaudio/base_audio_context.cc
+++ b/chromium/third_party/blink/renderer/modules/webaudio/base_audio_context.cc
@@ -181,6 +181,12 @@ void BaseAudioContext::Uninitialize() {
   DCHECK_EQ(resume_resolvers_.size(), 0u);
 }
 
+void BaseAudioContext::Dispose() {
+  // BaseAudioContext is going away, so remove the context from the orphan
+  // handlers.
+  GetDeferredTaskHandler().ClearContextFromOrphanHandlers();
+}
+
 void BaseAudioContext::ContextLifecycleStateChanged(
     mojom::FrameLifecycleState state) {
   // Don't need to do anything for an offline context.
diff --git a/chromium/third_party/blink/renderer/modules/webaudio/base_audio_context.h b/chromium/third_party/blink/renderer/modules/webaudio/base_audio_context.h
index d6e4fe5e25f..a99b2dddad4 100644
--- a/chromium/third_party/blink/renderer/modules/webaudio/base_audio_context.h
+++ b/chromium/third_party/blink/renderer/modules/webaudio/base_audio_context.h
@@ -96,6 +96,7 @@ class MODULES_EXPORT BaseAudioContext
       public InspectorHelperMixin {
   USING_GARBAGE_COLLECTED_MIXIN(BaseAudioContext);
   DEFINE_WRAPPERTYPEINFO();
+  USING_PRE_FINALIZER(BaseAudioContext, Dispose);
 
  public:
   // The state of an audio context.  On creation, the state is Suspended. The
@@ -115,6 +116,8 @@ class MODULES_EXPORT BaseAudioContext
     return dest ? dest->GetAudioDestinationHandler().IsInitialized() : false;
   }
 
+  void Dispose();
+
   // Document notification
   void ContextLifecycleStateChanged(mojom::FrameLifecycleState) override;
   void ContextDestroyed(ExecutionContext*) override;
diff --git a/chromium/third_party/blink/renderer/modules/webaudio/biquad_filter_node.cc b/chromium/third_party/blink/renderer/modules/webaudio/biquad_filter_node.cc
index a7444a1774b..f0cf1ae8610 100644
--- a/chromium/third_party/blink/renderer/modules/webaudio/biquad_filter_node.cc
+++ b/chromium/third_party/blink/renderer/modules/webaudio/biquad_filter_node.cc
@@ -88,7 +88,7 @@ void BiquadFilterHandler::Process(uint32_t frames_to_process) {
       PostCrossThreadTask(
           *task_runner_, FROM_HERE,
           CrossThreadBindOnce(&BiquadFilterHandler::NotifyBadState,
-                              WrapRefCounted(this)));
+                              AsWeakPtr()));
     }
   }
 }
diff --git a/chromium/third_party/blink/renderer/modules/webaudio/biquad_filter_node.h b/chromium/third_party/blink/renderer/modules/webaudio/biquad_filter_node.h
index 318e0d2edce..07c0c455ecb 100644
--- a/chromium/third_party/blink/renderer/modules/webaudio/biquad_filter_node.h
+++ b/chromium/third_party/blink/renderer/modules/webaudio/biquad_filter_node.h
@@ -26,6 +26,7 @@
 #ifndef THIRD_PARTY_BLINK_RENDERER_MODULES_WEBAUDIO_BIQUAD_FILTER_NODE_H_
 #define THIRD_PARTY_BLINK_RENDERER_MODULES_WEBAUDIO_BIQUAD_FILTER_NODE_H_
 
+#include "base/memory/weak_ptr.h"
 #include "third_party/blink/renderer/core/typed_arrays/array_buffer_view_helpers.h"
 #include "third_party/blink/renderer/core/typed_arrays/dom_typed_array.h"
 #include "third_party/blink/renderer/modules/webaudio/audio_basic_processor_handler.h"
@@ -38,7 +39,8 @@ class BaseAudioContext;
 class AudioParam;
 class BiquadFilterOptions;
 
-class BiquadFilterHandler : public AudioBasicProcessorHandler {
+class BiquadFilterHandler : public AudioBasicProcessorHandler,
+                            public base::SupportsWeakPtr<BiquadFilterHandler> {
  public:
   static scoped_refptr<BiquadFilterHandler> Create(AudioNode&,
                                                    float sample_rate,
diff --git a/chromium/third_party/blink/renderer/modules/webaudio/deferred_task_handler.cc b/chromium/third_party/blink/renderer/modules/webaudio/deferred_task_handler.cc
index 9fd38f0dde7..2afb5cf60f7 100644
--- a/chromium/third_party/blink/renderer/modules/webaudio/deferred_task_handler.cc
+++ b/chromium/third_party/blink/renderer/modules/webaudio/deferred_task_handler.cc
@@ -77,9 +77,9 @@ void DeferredTaskHandler::BreakConnections() {
   // connection.
   wtf_size_t size = finished_source_handlers_.size();
   if (size > 0) {
-    for (auto* finished : finished_source_handlers_) {
-      active_source_handlers_.erase(finished);
+    for (auto finished : finished_source_handlers_) {
       finished->BreakConnectionWithLock();
+      active_source_handlers_.erase(finished);
     }
     finished_source_handlers_.clear();
   }
@@ -132,6 +132,7 @@ void DeferredTaskHandler::HandleDirtyAudioNodeOutputs() {
 
 void DeferredTaskHandler::AddAutomaticPullNode(
     scoped_refptr<AudioHandler> node) {
+  DCHECK(IsAudioThread());
   AssertGraphOwner();
 
   if (!automatic_pull_handlers_.Contains(node)) {
@@ -151,11 +152,16 @@ void DeferredTaskHandler::RemoveAutomaticPullNode(AudioHandler* node) {
 }
 
 void DeferredTaskHandler::UpdateAutomaticPullNodes() {
+  DCHECK(IsAudioThread());
   AssertGraphOwner();
 
   if (automatic_pull_handlers_need_updating_) {
-    CopyToVector(automatic_pull_handlers_, rendering_automatic_pull_handlers_);
-    automatic_pull_handlers_need_updating_ = false;
+    MutexTryLocker try_locker(automatic_pull_handlers_lock_);
+    if (try_locker.Locked()) {
+      CopyToVector(automatic_pull_handlers_,
+                   rendering_automatic_pull_handlers_);
+      automatic_pull_handlers_need_updating_ = false;
+    }
   }
 }
 
@@ -163,9 +169,12 @@ void DeferredTaskHandler::ProcessAutomaticPullNodes(
     uint32_t frames_to_process) {
   DCHECK(IsAudioThread());
 
-  for (unsigned i = 0; i < rendering_automatic_pull_handlers_.size(); ++i) {
-    rendering_automatic_pull_handlers_[i]->ProcessIfNecessary(
-        frames_to_process);
+  MutexTryLocker try_locker(automatic_pull_handlers_lock_);
+  if (try_locker.Locked()) {
+    for (auto& rendering_automatic_pull_handler :
+         rendering_automatic_pull_handlers_) {
+      rendering_automatic_pull_handler->ProcessIfNecessary(frames_to_process);
+    }
   }
 }
 
@@ -293,10 +302,7 @@ void DeferredTaskHandler::HandleDeferredTasks() {
 }
 
 void DeferredTaskHandler::ContextWillBeDestroyed() {
-  for (auto& handler : rendering_orphan_handlers_)
-    handler->ClearContext();
-  for (auto& handler : deletable_orphan_handlers_)
-    handler->ClearContext();
+  ClearContextFromOrphanHandlers();
   ClearHandlersToBeDeleted();
   // Some handlers might live because of their cross thread tasks.
 }
@@ -350,15 +356,34 @@ void DeferredTaskHandler::DeleteHandlersOnMainThread() {
 
 void DeferredTaskHandler::ClearHandlersToBeDeleted() {
   DCHECK(IsMainThread());
+
+  {
+    MutexLocker locker(automatic_pull_handlers_lock_);
+    rendering_automatic_pull_handlers_.clear();
+  }
+
   GraphAutoLocker locker(*this);
   tail_processing_handlers_.clear();
   rendering_orphan_handlers_.clear();
   deletable_orphan_handlers_.clear();
   automatic_pull_handlers_.clear();
-  rendering_automatic_pull_handlers_.clear();
+  finished_source_handlers_.clear();
   active_source_handlers_.clear();
 }
 
+void DeferredTaskHandler::ClearContextFromOrphanHandlers() {
+  DCHECK(IsMainThread());
+
+  // |rendering_orphan_handlers_| and |deletable_orphan_handlers_| can
+  // be modified on the audio thread.
+  GraphAutoLocker locker(*this);
+
+  for (auto& handler : rendering_orphan_handlers_)
+    handler->ClearContext();
+  for (auto& handler : deletable_orphan_handlers_)
+    handler->ClearContext();
+}
+
 void DeferredTaskHandler::SetAudioThreadToCurrentThread() {
   DCHECK(!IsMainThread());
   audio_thread_.store(CurrentThread(), std::memory_order_relaxed);
diff --git a/chromium/third_party/blink/renderer/modules/webaudio/deferred_task_handler.h b/chromium/third_party/blink/renderer/modules/webaudio/deferred_task_handler.h
index 0ede5f5b5da..7d13eeb1a58 100644
--- a/chromium/third_party/blink/renderer/modules/webaudio/deferred_task_handler.h
+++ b/chromium/third_party/blink/renderer/modules/webaudio/deferred_task_handler.h
@@ -109,6 +109,9 @@ class MODULES_EXPORT DeferredTaskHandler final
   void RequestToDeleteHandlersOnMainThread();
   void ClearHandlersToBeDeleted();
 
+  // Clear the context from the rendering and deletable orphan handlers.
+  void ClearContextFromOrphanHandlers();
+
   bool AcceptsTailProcessing() const { return accepts_tail_processing_; }
   void StopAcceptingTailProcessing() { accepts_tail_processing_ = false; }
 
@@ -188,7 +191,7 @@ class MODULES_EXPORT DeferredTaskHandler final
     return &active_source_handlers_;
   }
 
-  Vector<AudioHandler*>* GetFinishedSourceHandlers() {
+  Vector<scoped_refptr<AudioHandler>>* GetFinishedSourceHandlers() {
     return &finished_source_handlers_;
   }
 
@@ -257,12 +260,17 @@ class MODULES_EXPORT DeferredTaskHandler final
   // connection and elements here are removed from |active_source_handlers_|.
   //
   // This must be accessed only from the audio thread.
-  Vector<AudioHandler*> finished_source_handlers_;
+  Vector<scoped_refptr<AudioHandler>> finished_source_handlers_;
 
   scoped_refptr<base::SingleThreadTaskRunner> task_runner_;
 
   // Graph locking.
   RecursiveMutex context_graph_mutex_;
+
+  // Protects |rendering_automatic_pull_handlers| when updating, processing, and
+  // clearing. (See crbug.com/1061018)
+  mutable Mutex automatic_pull_handlers_lock_;
+
   std::atomic<base::PlatformThreadId> audio_thread_;
 };
 
diff --git a/chromium/third_party/blink/renderer/modules/webaudio/iir_filter_node.cc b/chromium/third_party/blink/renderer/modules/webaudio/iir_filter_node.cc
index c20271248b4..7606049afa3 100644
--- a/chromium/third_party/blink/renderer/modules/webaudio/iir_filter_node.cc
+++ b/chromium/third_party/blink/renderer/modules/webaudio/iir_filter_node.cc
@@ -104,9 +104,9 @@ void IIRFilterHandler::Process(uint32_t frames_to_process) {
     if (HasNonFiniteOutput()) {
       did_warn_bad_filter_state_ = true;
 
-      PostCrossThreadTask(*task_runner_, FROM_HERE,
-                          CrossThreadBindOnce(&IIRFilterHandler::NotifyBadState,
-                                              WrapRefCounted(this)));
+      PostCrossThreadTask(
+          *task_runner_, FROM_HERE,
+          CrossThreadBindOnce(&IIRFilterHandler::NotifyBadState, AsWeakPtr()));
     }
   }
 }
diff --git a/chromium/third_party/blink/renderer/modules/webaudio/iir_filter_node.h b/chromium/third_party/blink/renderer/modules/webaudio/iir_filter_node.h
index 76266a88c15..cc2c09b6d9d 100644
--- a/chromium/third_party/blink/renderer/modules/webaudio/iir_filter_node.h
+++ b/chromium/third_party/blink/renderer/modules/webaudio/iir_filter_node.h
@@ -5,6 +5,7 @@
 #ifndef THIRD_PARTY_BLINK_RENDERER_MODULES_WEBAUDIO_IIR_FILTER_NODE_H_
 #define THIRD_PARTY_BLINK_RENDERER_MODULES_WEBAUDIO_IIR_FILTER_NODE_H_
 
+#include "base/memory/weak_ptr.h"
 #include "base/single_thread_task_runner.h"
 #include "third_party/blink/renderer/core/typed_arrays/array_buffer_view_helpers.h"
 #include "third_party/blink/renderer/core/typed_arrays/dom_typed_array.h"
@@ -18,7 +19,8 @@ class BaseAudioContext;
 class ExceptionState;
 class IIRFilterOptions;
 
-class IIRFilterHandler : public AudioBasicProcessorHandler {
+class IIRFilterHandler : public AudioBasicProcessorHandler,
+                         public base::SupportsWeakPtr<IIRFilterHandler> {
  public:
   static scoped_refptr<IIRFilterHandler> Create(
       AudioNode&,
diff --git a/chromium/third_party/blink/renderer/modules/webgl/webgl_rendering_context_base.cc b/chromium/third_party/blink/renderer/modules/webgl/webgl_rendering_context_base.cc
index f5c04766b8a..4e518f9dfbb 100644
--- a/chromium/third_party/blink/renderer/modules/webgl/webgl_rendering_context_base.cc
+++ b/chromium/third_party/blink/renderer/modules/webgl/webgl_rendering_context_base.cc
@@ -7542,7 +7542,7 @@ void WebGLRenderingContextBase::PrintGLErrorToConsole(const String& message) {
 
 void WebGLRenderingContextBase::PrintWarningToConsole(const String& message) {
   blink::ExecutionContext* context = Host()->GetTopExecutionContext();
-  if (context) {
+  if (context && !context->IsContextDestroyed()) {
     context->AddConsoleMessage(
         ConsoleMessage::Create(mojom::ConsoleMessageSource::kRendering,
                                mojom::ConsoleMessageLevel::kWarning, message));
diff --git a/chromium/third_party/skia/PRESUBMIT.py b/chromium/third_party/skia/PRESUBMIT.py
index 0b7e31f7862..666074454ab 100644
--- a/chromium/third_party/skia/PRESUBMIT.py
+++ b/chromium/third_party/skia/PRESUBMIT.py
@@ -21,11 +21,8 @@ import traceback
 
 REVERT_CL_SUBJECT_PREFIX = 'Revert '
 
-SKIA_TREE_STATUS_URL = 'http://skia-tree-status.appspot.com'
-
 # Please add the complete email address here (and not just 'xyz@' or 'xyz').
 PUBLIC_API_OWNERS = (
-    'mtklein@chromium.org',
     'mtklein@google.com',
     'reed@chromium.org',
     'reed@google.com',
@@ -40,7 +37,7 @@ PUBLIC_API_OWNERS = (
 AUTHORS_FILE_NAME = 'AUTHORS'
 RELEASE_NOTES_FILE_NAME = 'RELEASE_NOTES.txt'
 
-DOCS_PREVIEW_URL = 'https://skia.org/?cl='
+DOCS_PREVIEW_URL = 'https://skia.org/?cl={issue}'
 GOLD_TRYBOT_URL = 'https://gold.skia.org/search?issue='
 
 SERVICE_ACCOUNT_SUFFIX = [
@@ -50,11 +47,11 @@ SERVICE_ACCOUNT_SUFFIX = [
 
 
 def _CheckChangeHasEol(input_api, output_api, source_file_filter=None):
-  """Checks that files end with atleast one \n (LF)."""
+  """Checks that files end with at least one \n (LF)."""
   eof_files = []
   for f in input_api.AffectedSourceFiles(source_file_filter):
     contents = input_api.ReadFile(f, 'rb')
-    # Check that the file ends in atleast one newline character.
+    # Check that the file ends in at least one newline character.
     if len(contents) > 1 and contents[-1:] != '\n':
       eof_files.append(f.LocalPath())
 
@@ -147,17 +144,6 @@ def _CopyrightChecks(input_api, output_api, source_file_filter=None):
   return results
 
 
-def _ToolFlags(input_api, output_api):
-  """Make sure `{dm,nanobench}_flags.py test` passes if modified."""
-  results = []
-  sources = lambda x: ('dm_flags.py'        in x.LocalPath() or
-                       'nanobench_flags.py' in x.LocalPath())
-  for f in input_api.AffectedSourceFiles(sources):
-    if 0 != subprocess.call(['python', f.LocalPath(), 'test']):
-      results.append(output_api.PresubmitError('`python %s test` failed' % f))
-  return results
-
-
 def _InfraTests(input_api, output_api):
   """Run the infra tests."""
   results = []
@@ -176,18 +162,30 @@ def _InfraTests(input_api, output_api):
 
 def _CheckGNFormatted(input_api, output_api):
   """Make sure any .gn files we're changing have been formatted."""
-  results = []
+  files = []
   for f in input_api.AffectedFiles():
-    if (not f.LocalPath().endswith('.gn') and
-        not f.LocalPath().endswith('.gni')):
-      continue
+    if (f.LocalPath().endswith('.gn') or
+        f.LocalPath().endswith('.gni')):
+      files.append(f)
+  if not files:
+    return []
+
+  cmd = ['python', os.path.join('bin', 'fetch-gn')]
+  try:
+    subprocess.check_output(cmd)
+  except subprocess.CalledProcessError as e:
+    return [output_api.PresubmitError(
+        '`%s` failed:\n%s' % (' '.join(cmd), e.output))]
 
-    gn = 'gn.bat' if 'win32' in sys.platform else 'gn'
+  results = []
+  for f in files:
+    gn = 'gn.exe' if 'win32' in sys.platform else 'gn'
+    gn = os.path.join(input_api.PresubmitLocalPath(), 'bin', gn)
     cmd = [gn, 'format', '--dry-run', f.LocalPath()]
     try:
       subprocess.check_output(cmd)
     except subprocess.CalledProcessError:
-      fix = 'gn format ' + f.LocalPath()
+      fix = 'bin/gn format ' + f.LocalPath()
       results.append(output_api.PresubmitError(
           '`%s` failed, try\n\t%s' % (' '.join(cmd), fix)))
   return results
@@ -277,7 +275,6 @@ def _CommonChecks(input_api, output_api):
   results.extend(_IfDefChecks(input_api, output_api))
   results.extend(_CopyrightChecks(input_api, output_api,
                                   source_file_filter=sources))
-  results.extend(_ToolFlags(input_api, output_api))
   results.extend(_CheckCompileIsolate(input_api, output_api))
   results.extend(_CheckDEPSValid(input_api, output_api))
   results.extend(_CheckIncludesFormatted(input_api, output_api))
@@ -285,11 +282,7 @@ def _CommonChecks(input_api, output_api):
 
 
 def CheckChangeOnUpload(input_api, output_api):
-  """Presubmit checks for the change on upload.
-
-  The following are the presubmit checks:
-  * Check change has one and only one EOL.
-  """
+  """Presubmit checks for the change on upload."""
   results = []
   results.extend(_CommonChecks(input_api, output_api))
   # Run on upload, not commit, since the presubmit bot apparently doesn't have
@@ -301,44 +294,6 @@ def CheckChangeOnUpload(input_api, output_api):
   return results
 
 
-def _CheckTreeStatus(input_api, output_api, json_url):
-  """Check whether to allow commit.
-
-  Args:
-    input_api: input related apis.
-    output_api: output related apis.
-    json_url: url to download json style status.
-  """
-  tree_status_results = input_api.canned_checks.CheckTreeIsOpen(
-      input_api, output_api, json_url=json_url)
-  if not tree_status_results:
-    # Check for caution state only if tree is not closed.
-    connection = input_api.urllib_request.urlopen(json_url)
-    status = input_api.json.loads(connection.read())
-    connection.close()
-    if ('caution' in status['message'].lower() and
-        os.isatty(sys.stdout.fileno())):
-      # Display a prompt only if we are in an interactive shell. Without this
-      # check the commit queue behaves incorrectly because it considers
-      # prompts to be failures.
-      short_text = 'Tree state is: ' + status['general_state']
-      long_text = status['message'] + '\n' + json_url
-      tree_status_results.append(
-          output_api.PresubmitPromptWarning(
-              message=short_text, long_text=long_text))
-  else:
-    # Tree status is closed. Put in message about contacting sheriff.
-    connection = input_api.urllib_request.urlopen(
-        SKIA_TREE_STATUS_URL + '/current-sheriff')
-    sheriff_details = input_api.json.loads(connection.read())
-    if sheriff_details:
-      tree_status_results[0]._message += (
-          '\n\nPlease contact the current Skia sheriff (%s) if you are trying '
-          'to submit a build fix\nand do not know how to submit because the '
-          'tree is closed') % sheriff_details['username']
-  return tree_status_results
-
-
 class CodeReview(object):
   """Abstracts which codereview tool is used for the specified issue."""
 
@@ -355,10 +310,6 @@ class CodeReview(object):
   def GetDescription(self):
     return self._gerrit.GetChangeDescription(self._issue)
 
-  def IsDryRun(self):
-    return self._gerrit.GetChangeInfo(
-        self._issue)['labels']['Commit-Queue'].get('value', 0) == 1
-
   def GetReviewers(self):
     code_review_label = (
         self._gerrit.GetChangeInfo(self._issue)['labels']['Code-Review'])
@@ -465,11 +416,6 @@ def _CheckLGTMsForPublicAPI(input_api, output_api):
       # It is a revert CL, ignore the public api owners check.
       return results
 
-    if cr.IsDryRun():
-      # Ignore public api owners check for dry run CLs since they are not
-      # going to be committed.
-      return results
-
     if input_api.gerrit:
       for reviewer in cr.GetReviewers():
         if reviewer in PUBLIC_API_OWNERS:
@@ -509,91 +455,74 @@ def _CheckLGTMsForPublicAPI(input_api, output_api):
   return results
 
 
-def _FooterExists(footers, key, value):
-  for k, v in footers:
-    if k == key and v == value:
-      return True
-  return False
-
-
-def PostUploadHook(cl, change, output_api):
+def PostUploadHook(gerrit, change, output_api):
   """git cl upload will call this hook after the issue is created/modified.
 
   This hook does the following:
   * Adds a link to preview docs changes if there are any docs changes in the CL.
   * Adds 'No-Try: true' if the CL contains only docs changes.
   """
+  if not change.issue:
+    return []
+
+  # Skip PostUploadHooks for all auto-commit service account bots. New
+  # patchsets (caused due to PostUploadHooks) invalidates the CQ+2 vote from
+  # the "--use-commit-queue" flag to "git cl upload".
+  for suffix in SERVICE_ACCOUNT_SUFFIX:
+    if change.author_email.endswith(suffix):
+      return []
 
   results = []
-  atleast_one_docs_change = False
+  at_least_one_docs_change = False
   all_docs_changes = True
   for affected_file in change.AffectedFiles():
     affected_file_path = affected_file.LocalPath()
     file_path, _ = os.path.splitext(affected_file_path)
     if 'site' == file_path.split(os.path.sep)[0]:
-      atleast_one_docs_change = True
+      at_least_one_docs_change = True
     else:
       all_docs_changes = False
-    if atleast_one_docs_change and not all_docs_changes:
+    if at_least_one_docs_change and not all_docs_changes:
       break
 
-  issue = cl.issue
-  if issue:
-    # Skip PostUploadHooks for all auto-commit service account bots. New
-    # patchsets (caused due to PostUploadHooks) invalidates the CQ+2 vote from
-    # the "--use-commit-queue" flag to "git cl upload".
-    for suffix in SERVICE_ACCOUNT_SUFFIX:
-      if cl.GetIssueOwner().endswith(suffix):
-        return results
+  footers = change.GitFootersFromDescription()
+  description_changed = False
 
-    original_description_lines, footers = cl.GetDescriptionFooters()
-    new_description_lines = list(original_description_lines)
-
-    # If the change includes only doc changes then add No-Try: true in the
-    # CL's description if it does not exist yet.
-    if all_docs_changes and not _FooterExists(footers, 'No-Try', 'true'):
-      new_description_lines.append('No-Try: true')
-      results.append(
-          output_api.PresubmitNotifyResult(
-              'This change has only doc changes. Automatically added '
-              '\'No-Try: true\' to the CL\'s description'))
-
-    # If there is atleast one docs change then add preview link in the CL's
-    # description if it does not already exist there.
-    docs_preview_link = '%s%s' % (DOCS_PREVIEW_URL, issue)
-    docs_preview_line = 'Docs-Preview: %s' % docs_preview_link
-    if (atleast_one_docs_change and
-        not _FooterExists(footers, 'Docs-Preview', docs_preview_link)):
-      # Automatically add a link to where the docs can be previewed.
-      new_description_lines.append(docs_preview_line)
-      results.append(
-          output_api.PresubmitNotifyResult(
-              'Automatically added a link to preview the docs changes to the '
-              'CL\'s description'))
-
-    # If the description has changed update it.
-    if new_description_lines != original_description_lines:
-      # Add a new line separating the new contents from the old contents.
-      new_description_lines.insert(len(original_description_lines), '')
-      cl.UpdateDescriptionFooters(new_description_lines, footers)
+  # If the change includes only doc changes then add No-Try: true in the
+  # CL's description if it does not exist yet.
+  if all_docs_changes and 'true' not in footers.get('No-Try', []):
+    description_changed = True
+    change.AddDescriptionFooter('No-Try', 'true')
+    results.append(
+        output_api.PresubmitNotifyResult(
+            'This change has only doc changes. Automatically added '
+            '\'No-Try: true\' to the CL\'s description'))
+
+  # If there is at least one docs change then add preview link in the CL's
+  # description if it does not already exist there.
+  docs_preview_link = DOCS_PREVIEW_URL.format(issue=change.issue)
+  if (at_least_one_docs_change
+      and docs_preview_link not in footers.get('Docs-Preview', [])):
+    # Automatically add a link to where the docs can be previewed.
+    description_changed = True
+    change.AddDescriptionFooter('Docs-Preview', docs_preview_link)
+    results.append(
+        output_api.PresubmitNotifyResult(
+            'Automatically added a link to preview the docs changes to the '
+            'CL\'s description'))
 
-    return results
+  # If the description has changed update it.
+  if description_changed:
+    gerrit.UpdateDescription(
+        change.FullDescriptionText(), change.issue)
+
+  return results
 
 
 def CheckChangeOnCommit(input_api, output_api):
-  """Presubmit checks for the change on commit.
-
-  The following are the presubmit checks:
-  * Check change has one and only one EOL.
-  * Ensures that the Skia tree is open in
-    http://skia-tree-status.appspot.com/. Shows a warning if it is in 'Caution'
-    state and an error if it is in 'Closed' state.
-  """
+  """Presubmit checks for the change on commit."""
   results = []
   results.extend(_CommonChecks(input_api, output_api))
-  results.extend(
-      _CheckTreeStatus(input_api, output_api, json_url=(
-          SKIA_TREE_STATUS_URL + '/banner-status?format=json')))
   results.extend(_CheckLGTMsForPublicAPI(input_api, output_api))
   results.extend(_CheckOwnerIsInAuthorsFile(input_api, output_api))
   # Checks for the presence of 'DO NOT''SUBMIT' in CL description and in
diff --git a/chromium/third_party/usrsctp/usrsctplib/usrsctplib/netinet/sctp_auth.c b/chromium/third_party/usrsctp/usrsctplib/usrsctplib/netinet/sctp_auth.c
index 5e5813b3f17..bc645b36d90 100755
--- a/chromium/third_party/usrsctp/usrsctplib/usrsctplib/netinet/sctp_auth.c
+++ b/chromium/third_party/usrsctp/usrsctplib/usrsctplib/netinet/sctp_auth.c
@@ -34,7 +34,7 @@
 
 #ifdef __FreeBSD__
 #include <sys/cdefs.h>
-__FBSDID("$FreeBSD: head/sys/netinet/sctp_auth.c 334532 2018-06-02 16:28:10Z tuexen $");
+__FBSDID("$FreeBSD: head/sys/netinet/sctp_auth.c 355931 2019-12-20 15:25:08Z tuexen $");
 #endif
 
 #include <netinet/sctp_os.h>
@@ -1455,7 +1455,8 @@ sctp_auth_get_cookie_params(struct sctp_tcb *stcb, struct mbuf *m,
 		ptype = ntohs(phdr->param_type);
 		plen = ntohs(phdr->param_length);
 
-		if ((plen == 0) || (offset + plen > length))
+		if ((plen < sizeof(struct sctp_paramhdr)) ||
+		    (offset + plen > length))
 			break;
 
 		if (ptype == SCTP_RANDOM) {
diff --git a/chromium/third_party/usrsctp/usrsctplib/usrsctplib/netinet/sctp_pcb.c b/chromium/third_party/usrsctp/usrsctplib/usrsctplib/netinet/sctp_pcb.c
index 6efcbab91e8..355686fb904 100755
--- a/chromium/third_party/usrsctp/usrsctplib/usrsctplib/netinet/sctp_pcb.c
+++ b/chromium/third_party/usrsctp/usrsctplib/usrsctplib/netinet/sctp_pcb.c
@@ -34,7 +34,7 @@
 
 #ifdef __FreeBSD__
 #include <sys/cdefs.h>
-__FBSDID("$FreeBSD: head/sys/netinet/sctp_pcb.c 334532 2018-06-02 16:28:10Z tuexen $");
+__FBSDID("$FreeBSD: head/sys/netinet/sctp_pcb.c 355931 2019-12-20 15:25:08Z tuexen $");
 #endif
 
 #include <netinet/sctp_os.h>
@@ -7246,7 +7246,7 @@ sctp_load_addresses_from_init(struct sctp_tcb *stcb, struct mbuf *m,
 		if (offset + plen > limit) {
 			break;
 		}
-		if (plen == 0) {
+		if (plen < sizeof(struct sctp_paramhdr)) {
 			break;
 		}
 #ifdef INET
@@ -7462,6 +7462,9 @@ sctp_load_addresses_from_init(struct sctp_tcb *stcb, struct mbuf *m,
 			if (plen > sizeof(lstore)) {
 				return (-23);
 			}
+			if (plen < sizeof(struct sctp_asconf_addrv4_param)) {
+				return (-101);
+			}
 			phdr = sctp_get_next_param(m, offset,
 						   (struct sctp_paramhdr *)&lstore,
 						   plen);
diff --git a/chromium/third_party/webrtc/modules/audio_coding/acm2/audio_coding_module.cc b/chromium/third_party/webrtc/modules/audio_coding/acm2/audio_coding_module.cc
index b68579b1cba..ee31900db3e 100644
--- a/chromium/third_party/webrtc/modules/audio_coding/acm2/audio_coding_module.cc
+++ b/chromium/third_party/webrtc/modules/audio_coding/acm2/audio_coding_module.cc
@@ -38,6 +38,8 @@ namespace {
 // 48 kHz data.
 constexpr size_t kInitialInputDataBufferSize = 6 * 480;
 
+constexpr int32_t kMaxInputSampleRateHz = 192000;
+
 class AudioCodingModuleImpl final : public AudioCodingModule {
  public:
   explicit AudioCodingModuleImpl(const AudioCodingModule::Config& config);
@@ -348,7 +350,7 @@ int AudioCodingModuleImpl::Add10MsDataInternal(const AudioFrame& audio_frame,
     return -1;
   }
 
-  if (audio_frame.sample_rate_hz_ > 192000) {
+  if (audio_frame.sample_rate_hz_ > kMaxInputSampleRateHz) {
     assert(false);
     RTC_LOG(LS_ERROR) << "Cannot Add 10 ms audio, input frequency not valid";
     return -1;
@@ -465,20 +467,25 @@ int AudioCodingModuleImpl::PreprocessToAddData(const AudioFrame& in_frame,
   *ptr_out = &preprocess_frame_;
   preprocess_frame_.num_channels_ = in_frame.num_channels_;
   preprocess_frame_.samples_per_channel_ = in_frame.samples_per_channel_;
-  std::array<int16_t, WEBRTC_10MS_PCM_AUDIO> audio;
-  const int16_t* src_ptr_audio = in_frame.data();
+  std::array<int16_t, AudioFrame::kMaxDataSizeSamples> audio;
+  const int16_t* src_ptr_audio;
   if (down_mix) {
-    // If a resampling is required the output of a down-mix is written into a
+    // If a resampling is required, the output of a down-mix is written into a
     // local buffer, otherwise, it will be written to the output frame.
     int16_t* dest_ptr_audio =
         resample ? audio.data() : preprocess_frame_.mutable_data();
+    RTC_DCHECK_GE(audio.size(), preprocess_frame_.samples_per_channel_);
     RTC_DCHECK_GE(audio.size(), in_frame.samples_per_channel_);
     DownMixFrame(in_frame,
                  rtc::ArrayView<int16_t>(
                      dest_ptr_audio, preprocess_frame_.samples_per_channel_));
     preprocess_frame_.num_channels_ = 1;
-    // Set the input of the resampler is the down-mixed signal.
+
+    // Set the input of the resampler to the down-mixed signal.
     src_ptr_audio = audio.data();
+  } else {
+    // Set the input of the resampler to the original data.
+    src_ptr_audio = in_frame.data();
   }
 
   preprocess_frame_.timestamp_ = expected_codec_ts_;
diff --git a/chromium/third_party/webrtc/modules/audio_coding/include/audio_coding_module.h b/chromium/third_party/webrtc/modules/audio_coding/include/audio_coding_module.h
index d8c92600770..4d751729bc9 100644
--- a/chromium/third_party/webrtc/modules/audio_coding/include/audio_coding_module.h
+++ b/chromium/third_party/webrtc/modules/audio_coding/include/audio_coding_module.h
@@ -33,8 +33,6 @@ class AudioEncoder;
 class AudioFrame;
 struct RTPHeader;
 
-#define WEBRTC_10MS_PCM_AUDIO 960  // 16 bits super wideband 48 kHz
-
 // Callback class used for sending data ready to be packetized
 class AudioPacketizationCallback {
  public:
diff --git a/chromium/third_party/webrtc/modules/audio_coding/test/EncodeDecodeTest.cc b/chromium/third_party/webrtc/modules/audio_coding/test/EncodeDecodeTest.cc
index 20e415d2836..7633dc22d08 100644
--- a/chromium/third_party/webrtc/modules/audio_coding/test/EncodeDecodeTest.cc
+++ b/chromium/third_party/webrtc/modules/audio_coding/test/EncodeDecodeTest.cc
@@ -24,6 +24,12 @@
 
 namespace webrtc {
 
+namespace {
+// Buffer size for stereo 48 kHz audio.
+constexpr size_t kWebRtc10MsPcmAudio = 960;
+
+}  // namespace
+
 TestPacketization::TestPacketization(RTPStream* rtpStream, uint16_t frequency)
     : _rtpStream(rtpStream), _frequency(frequency), _seqNo(0) {}
 
@@ -91,7 +97,7 @@ void Sender::Run() {
 }
 
 Receiver::Receiver()
-    : _playoutLengthSmpls(WEBRTC_10MS_PCM_AUDIO),
+    : _playoutLengthSmpls(kWebRtc10MsPcmAudio),
       _payloadSizeBytes(MAX_INCOMING_PAYLOAD) {}
 
 void Receiver::Setup(AudioCodingModule* acm,
@@ -138,7 +144,7 @@ void Receiver::Setup(AudioCodingModule* acm,
   _pcmFile.Open(file_name, 32000, "wb+");
 
   _realPayloadSizeBytes = 0;
-  _playoutBuffer = new int16_t[WEBRTC_10MS_PCM_AUDIO];
+  _playoutBuffer = new int16_t[kWebRtc10MsPcmAudio];
   _frequency = playSampFreq;
   _acm = acm;
   _firstTime = true;
diff --git a/chromium/third_party/webrtc/modules/desktop_capture/win/dxgi_output_duplicator.cc b/chromium/third_party/webrtc/modules/desktop_capture/win/dxgi_output_duplicator.cc
index db7ba251c23..2d56b9af36e 100644
--- a/chromium/third_party/webrtc/modules/desktop_capture/win/dxgi_output_duplicator.cc
+++ b/chromium/third_party/webrtc/modules/desktop_capture/win/dxgi_output_duplicator.cc
@@ -275,7 +275,7 @@ bool DxgiOutputDuplicator::DoDetectUpdatedRegion(
 
   if (metadata_.capacity() < frame_info.TotalMetadataBufferSize) {
     metadata_.clear();  // Avoid data copy
-    metadata_.reserve(frame_info.TotalMetadataBufferSize);
+    metadata_.resize(frame_info.TotalMetadataBufferSize);
   }
 
   UINT buff_size = 0;
diff --git a/chromium/v8/include/v8-version.h b/chromium/v8/include/v8-version.h
index 94cbf3d1e00..21ff321bd30 100644
--- a/chromium/v8/include/v8-version.h
+++ b/chromium/v8/include/v8-version.h
@@ -11,7 +11,7 @@
 #define V8_MAJOR_VERSION 8
 #define V8_MINOR_VERSION 0
 #define V8_BUILD_NUMBER 426
-#define V8_PATCH_LEVEL 26
+#define V8_PATCH_LEVEL 30
 
 // Use 1 for candidates and 0 otherwise.
 // (Boolean macro values are not supported by all preprocessors.)
diff --git a/chromium/v8/infra/mb/mb_config.pyl b/chromium/v8/infra/mb/mb_config.pyl
index b579c42368b..67032505ca2 100644
--- a/chromium/v8/infra/mb/mb_config.pyl
+++ b/chromium/v8/infra/mb/mb_config.pyl
@@ -164,24 +164,34 @@
       'V8 Linux - s390x - sim': 'release_simulate_s390x',
     },
     'client.v8.branches': {
+      'V8 Linux - previous branch': 'release_x86',
+      'V8 Linux - previous branch - debug': 'debug_x86',
       'V8 Linux - beta branch': 'release_x86',
       'V8 Linux - beta branch - debug': 'debug_x86',
       'V8 Linux - stable branch': 'release_x86',
       'V8 Linux - stable branch - debug': 'debug_x86',
+      'V8 Linux64 - previous branch': 'release_x64',
+      'V8 Linux64 - previous branch - debug': 'debug_x64',
       'V8 Linux64 - beta branch': 'release_x64',
       'V8 Linux64 - beta branch - debug': 'debug_x64',
       'V8 Linux64 - stable branch': 'release_x64',
       'V8 Linux64 - stable branch - debug': 'debug_x64',
+      'V8 arm - sim - previous branch': 'release_simulate_arm',
+      'V8 arm - sim - previous branch - debug': 'debug_simulate_arm',
       'V8 arm - sim - beta branch': 'release_simulate_arm',
       'V8 arm - sim - beta branch - debug': 'debug_simulate_arm',
       'V8 arm - sim - stable branch': 'release_simulate_arm',
       'V8 arm - sim - stable branch - debug': 'debug_simulate_arm',
+      'V8 mips64el - sim - previous branch': 'release_simulate_mips64el',
       'V8 mips64el - sim - beta branch': 'release_simulate_mips64el',
       'V8 mips64el - sim - stable branch': 'release_simulate_mips64el',
+      'V8 mipsel - sim - previous branch': 'release_simulate_mipsel',
       'V8 mipsel - sim - beta branch': 'release_simulate_mipsel',
       'V8 mipsel - sim - stable branch': 'release_simulate_mipsel',
+      'V8 ppc64 - sim - previous branch': 'release_simulate_ppc64',
       'V8 ppc64 - sim - beta branch': 'release_simulate_ppc64',
       'V8 ppc64 - sim - stable branch': 'release_simulate_ppc64',
+      'V8 s390x - sim - previous branch': 'release_simulate_s390x',
       'V8 s390x - sim - beta branch': 'release_simulate_s390x',
       'V8 s390x - sim - stable branch': 'release_simulate_s390x',
     },
diff --git a/chromium/v8/infra/testing/builders.pyl b/chromium/v8/infra/testing/builders.pyl
index 91897111ac9..1ae89891f93 100644
--- a/chromium/v8/infra/testing/builders.pyl
+++ b/chromium/v8/infra/testing/builders.pyl
@@ -1686,6 +1686,26 @@
       {'name': 'v8testing', 'shards': 3},
     ],
   },
+  'V8 Linux - previous branch': {
+    'swarming_dimensions': {
+      'os': 'Ubuntu-16.04',
+    },
+    'tests': [
+      {'name': 'mozilla'},
+      {'name': 'test262', 'variant': 'default'},
+      {'name': 'v8testing'},
+    ],
+  },
+  'V8 Linux - previous branch - debug': {
+    'swarming_dimensions': {
+      'os': 'Ubuntu-16.04',
+    },
+    'tests': [
+      {'name': 'mozilla'},
+      {'name': 'test262', 'variant': 'default'},
+      {'name': 'v8testing', 'shards': 3},
+    ],
+  },
   'V8 Linux64 - beta branch': {
     'swarming_dimensions': {
       'os': 'Ubuntu-16.04',
@@ -1726,6 +1746,26 @@
       {'name': 'v8testing', 'shards': 3},
     ],
   },
+  'V8 Linux64 - previous branch': {
+    'swarming_dimensions': {
+      'os': 'Ubuntu-16.04',
+    },
+    'tests': [
+      {'name': 'mozilla'},
+      {'name': 'test262', 'variant': 'default'},
+      {'name': 'v8testing'},
+    ],
+  },
+  'V8 Linux64 - previous branch - debug': {
+    'swarming_dimensions': {
+      'os': 'Ubuntu-16.04',
+    },
+    'tests': [
+      {'name': 'mozilla'},
+      {'name': 'test262', 'variant': 'default'},
+      {'name': 'v8testing', 'shards': 3},
+    ],
+  },
   'V8 arm - sim - beta branch': {
     'swarming_dimensions': {
       'os': 'Ubuntu-16.04',
@@ -1766,6 +1806,26 @@
       {'name': 'v8testing', 'shards': 10},
     ],
   },
+  'V8 arm - sim - previous branch': {
+    'swarming_dimensions': {
+      'os': 'Ubuntu-16.04',
+    },
+    'tests': [
+      {'name': 'mozilla'},
+      {'name': 'test262', 'variant': 'default'},
+      {'name': 'v8testing', 'shards': 4},
+    ],
+  },
+  'V8 arm - sim - previous branch - debug': {
+    'swarming_dimensions': {
+      'os': 'Ubuntu-16.04',
+    },
+    'tests': [
+      {'name': 'mozilla', 'shards': 2},
+      {'name': 'test262', 'variant': 'default', 'shards': 2},
+      {'name': 'v8testing', 'shards': 10},
+    ],
+  },
   'V8 mips64el - sim - beta branch': {
     'swarming_dimensions': {
       'os': 'Ubuntu-16.04',
@@ -1782,6 +1842,14 @@
       {'name': 'unittests'},
     ],
   },
+  'V8 mips64el - sim - previous branch': {
+    'swarming_dimensions': {
+      'os': 'Ubuntu-16.04',
+    },
+    'tests': [
+      {'name': 'unittests'},
+    ],
+  },
   'V8 mipsel - sim - beta branch': {
     'swarming_dimensions': {
       'os': 'Ubuntu-16.04',
@@ -1798,6 +1866,14 @@
       {'name': 'v8testing', 'shards': 4},
     ],
   },
+  'V8 mipsel - sim - previous branch': {
+    'swarming_dimensions': {
+      'os': 'Ubuntu-16.04',
+    },
+    'tests': [
+      {'name': 'v8testing', 'shards': 4},
+    ],
+  },
   'V8 ppc64 - sim - beta branch': {
     'swarming_dimensions': {
       'os': 'Ubuntu-16.04',
@@ -1814,6 +1890,14 @@
       {'name': 'unittests'},
     ],
   },
+  'V8 ppc64 - sim - previous branch': {
+    'swarming_dimensions': {
+      'os': 'Ubuntu-16.04',
+    },
+    'tests': [
+      {'name': 'unittests'},
+    ],
+  },
   'V8 s390x - sim - beta branch': {
     'swarming_dimensions': {
       'os': 'Ubuntu-16.04',
@@ -1830,4 +1914,12 @@
       {'name': 'unittests'},
     ],
   },
+  'V8 s390x - sim - previous branch': {
+    'swarming_dimensions': {
+      'os': 'Ubuntu-16.04',
+    },
+    'tests': [
+      {'name': 'unittests'},
+    ],
+  },
 }
diff --git a/chromium/v8/src/builtins/builtins-function.cc b/chromium/v8/src/builtins/builtins-function.cc
index 9fe1e006213..57a0e33bf1e 100644
--- a/chromium/v8/src/builtins/builtins-function.cc
+++ b/chromium/v8/src/builtins/builtins-function.cc
@@ -2,6 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+#include "src/api/api-inl.h"
 #include "src/builtins/builtins-utils-inl.h"
 #include "src/builtins/builtins.h"
 #include "src/codegen/code-factory.h"
@@ -31,7 +32,12 @@ MaybeHandle<Object> CreateDynamicFunction(Isolate* isolate,
 
   if (!Builtins::AllowDynamicFunction(isolate, target, target_global_proxy)) {
     isolate->CountUsage(v8::Isolate::kFunctionConstructorReturnedUndefined);
-    return isolate->factory()->undefined_value();
+    // TODO(verwaest): We would like to throw using the calling context instead
+    // of the entered context but we don't currently have access to that.
+    HandleScopeImplementer* impl = isolate->handle_scope_implementer();
+    SaveAndSwitchContext save(
+        isolate, impl->LastEnteredOrMicrotaskContext()->native_context());
+    THROW_NEW_ERROR(isolate, NewTypeError(MessageTemplate::kNoAccess), Object);
   }
 
   // Build the source string.
diff --git a/chromium/v8/src/builtins/builtins-intl.cc b/chromium/v8/src/builtins/builtins-intl.cc
index afa7ef2d30b..3b624af91b1 100644
--- a/chromium/v8/src/builtins/builtins-intl.cc
+++ b/chromium/v8/src/builtins/builtins-intl.cc
@@ -265,13 +265,11 @@ Object LegacyFormatConstructor(BuiltinArguments args, Isolate* isolate,
 
   // [[Construct]]
   Handle<JSFunction> target = args.target();
-
   Handle<Object> locales = args.atOrUndefined(isolate, 1);
   Handle<Object> options = args.atOrUndefined(isolate, 2);
 
   // 2. Let format be ? OrdinaryCreateFromConstructor(newTarget,
   // "%<T>Prototype%", ...).
-
   Handle<Map> map;
   ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
       isolate, map, JSFunction::GetDerivedMap(isolate, target, new_target));
@@ -281,45 +279,42 @@ Object LegacyFormatConstructor(BuiltinArguments args, Isolate* isolate,
   ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
       isolate, format, T::New(isolate, map, locales, options, method));
   // 4. Let this be the this value.
-  Handle<Object> receiver = args.receiver();
-
-  // 5. If NewTarget is undefined and ? InstanceofOperator(this, %<T>%)
-  // is true, then
-  //
-  // Look up the intrinsic value that has been stored on the context.
-  // Call the instanceof function
-  Handle<Object> is_instance_of_obj;
-  ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
-      isolate, is_instance_of_obj,
-      Object::InstanceOf(isolate, receiver, constructor));
-
-  // Get the boolean value of the result
-  bool is_instance_of = is_instance_of_obj->BooleanValue(isolate);
-
-  if (args.new_target()->IsUndefined(isolate) && is_instance_of) {
-    if (!receiver->IsJSReceiver()) {
-      THROW_NEW_ERROR_RETURN_FAILURE(
-          isolate,
-          NewTypeError(MessageTemplate::kIncompatibleMethodReceiver,
-                       isolate->factory()->NewStringFromAsciiChecked(method),
-                       receiver));
+  if (args.new_target()->IsUndefined(isolate)) {
+    Handle<Object> receiver = args.receiver();
+
+    // 5. If NewTarget is undefined and ? InstanceofOperator(this, %<T>%)
+    // is true, then Look up the intrinsic value that has been stored on
+    // the context.
+    Handle<Object> is_instance_of_obj;
+    ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
+        isolate, is_instance_of_obj,
+        Object::InstanceOf(isolate, receiver, constructor));
+
+    if (is_instance_of_obj->BooleanValue(isolate)) {
+      if (!receiver->IsJSReceiver()) {
+        THROW_NEW_ERROR_RETURN_FAILURE(
+            isolate,
+            NewTypeError(MessageTemplate::kIncompatibleMethodReceiver,
+                         isolate->factory()->NewStringFromAsciiChecked(method),
+                         receiver));
+      }
+      Handle<JSReceiver> rec = Handle<JSReceiver>::cast(receiver);
+      // a. Perform ? DefinePropertyOrThrow(this,
+      // %Intl%.[[FallbackSymbol]], PropertyDescriptor{ [[Value]]: format,
+      // [[Writable]]: false, [[Enumerable]]: false, [[Configurable]]: false }).
+      PropertyDescriptor desc;
+      desc.set_value(format);
+      desc.set_writable(false);
+      desc.set_enumerable(false);
+      desc.set_configurable(false);
+      Maybe<bool> success = JSReceiver::DefineOwnProperty(
+          isolate, rec, isolate->factory()->intl_fallback_symbol(), &desc,
+          Just(kThrowOnError));
+      MAYBE_RETURN(success, ReadOnlyRoots(isolate).exception());
+      CHECK(success.FromJust());
+      // b. b. Return this.
+      return *receiver;
     }
-    Handle<JSReceiver> rec = Handle<JSReceiver>::cast(receiver);
-    // a. Perform ? DefinePropertyOrThrow(this,
-    // %Intl%.[[FallbackSymbol]], PropertyDescriptor{ [[Value]]: format,
-    // [[Writable]]: false, [[Enumerable]]: false, [[Configurable]]: false }).
-    PropertyDescriptor desc;
-    desc.set_value(format);
-    desc.set_writable(false);
-    desc.set_enumerable(false);
-    desc.set_configurable(false);
-    Maybe<bool> success = JSReceiver::DefineOwnProperty(
-        isolate, rec, isolate->factory()->intl_fallback_symbol(), &desc,
-        Just(kThrowOnError));
-    MAYBE_RETURN(success, ReadOnlyRoots(isolate).exception());
-    CHECK(success.FromJust());
-    // b. b. Return this.
-    return *receiver;
   }
   // 6. Return format.
   return *format;