BASELINE: Update Chromium to 86.0.4240.124

Change-Id: Ide0ff151e94cd665ae6521a446995d34a9d1d644
Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>

23 files changed, 329 insertions, 106 deletions

diff --git a/chromium/content/browser/loader/cached_navigation_url_loader.cc b/chromium/content/browser/loader/cached_navigation_url_loader.cc
index 4f387dd0f7e..88e233d3fe3 100644
--- a/chromium/content/browser/loader/cached_navigation_url_loader.cc
+++ b/chromium/content/browser/loader/cached_navigation_url_loader.cc
@@ -56,7 +56,7 @@ void CachedNavigationURLLoader::FollowRedirect(
     const std::vector<std::string>& removed_headers,
     const net::HttpRequestHeaders& modified_headers,
     const net::HttpRequestHeaders& modified_cors_exempt_headers,
-    PreviewsState new_previews_state) {
+    blink::PreviewsState new_previews_state) {
   NOTREACHED();
 }
 }  // namespace content
diff --git a/chromium/content/browser/loader/cached_navigation_url_loader.h b/chromium/content/browser/loader/cached_navigation_url_loader.h
index 65bd30d0d18..0ee6d35e2d8 100644
--- a/chromium/content/browser/loader/cached_navigation_url_loader.h
+++ b/chromium/content/browser/loader/cached_navigation_url_loader.h
@@ -28,7 +28,7 @@ class CachedNavigationURLLoader : public NavigationURLLoader {
       const std::vector<std::string>& removed_headers,
       const net::HttpRequestHeaders& modified_headers,
       const net::HttpRequestHeaders& modified_cors_exempt_headers,
-      PreviewsState new_previews_state) override;
+      blink::PreviewsState new_previews_state) override;
 
  private:
   void OnResponseStarted();
diff --git a/chromium/content/browser/loader/content_security_notifier.cc b/chromium/content/browser/loader/content_security_notifier.cc
new file mode 100644
index 00000000000..c2e27e767dc
--- /dev/null
+++ b/chromium/content/browser/loader/content_security_notifier.cc
@@ -0,0 +1,52 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "content/browser/loader/content_security_notifier.h"
+
+#include "content/browser/frame_host/render_frame_host_impl.h"
+#include "content/browser/web_contents/web_contents_impl.h"
+
+namespace content {
+
+ContentSecurityNotifier::ContentSecurityNotifier(
+    GlobalFrameRoutingId render_frame_host_id)
+    : render_frame_host_id_(render_frame_host_id) {}
+
+void ContentSecurityNotifier::NotifyContentWithCertificateErrorsRan() {
+  auto* render_frame_host = RenderFrameHostImpl::FromID(render_frame_host_id_);
+  if (!render_frame_host)
+    return;
+  auto* web_contents = static_cast<WebContentsImpl*>(
+      WebContents::FromRenderFrameHost(render_frame_host));
+  if (!web_contents)
+    return;
+  web_contents->OnDidRunContentWithCertificateErrors(render_frame_host);
+}
+
+void ContentSecurityNotifier::NotifyContentWithCertificateErrorsDisplayed() {
+  auto* render_frame_host = RenderFrameHostImpl::FromID(render_frame_host_id_);
+  if (!render_frame_host)
+    return;
+  auto* web_contents = static_cast<WebContentsImpl*>(
+      WebContents::FromRenderFrameHost(render_frame_host));
+  if (!web_contents)
+    return;
+  web_contents->OnDidDisplayContentWithCertificateErrors();
+}
+
+void ContentSecurityNotifier::NotifyInsecureContentRan(
+    const GURL& origin,
+    const GURL& insecure_url) {
+  auto* render_frame_host = RenderFrameHostImpl::FromID(render_frame_host_id_);
+  if (!render_frame_host)
+    return;
+  auto* web_contents = static_cast<WebContentsImpl*>(
+      WebContents::FromRenderFrameHost(render_frame_host));
+  if (!web_contents)
+    return;
+  web_contents->OnDidRunInsecureContent(render_frame_host, origin,
+                                        insecure_url);
+}
+
+}  // namespace content
diff --git a/chromium/content/browser/loader/content_security_notifier.h b/chromium/content/browser/loader/content_security_notifier.h
new file mode 100644
index 00000000000..1df3163afc4
--- /dev/null
+++ b/chromium/content/browser/loader/content_security_notifier.h
@@ -0,0 +1,37 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_BROWSER_LOADER_CONTENT_SECURITY_NOTIFIER_H_
+#define CONTENT_BROWSER_LOADER_CONTENT_SECURITY_NOTIFIER_H_
+
+#include "content/public/browser/global_routing_id.h"
+#include "third_party/blink/public/mojom/loader/content_security_notifier.mojom.h"
+
+namespace content {
+
+// This is the implementation of blink::mojom::ContentSecurityNotifier that
+// forwards notifications about content security (e.g., mixed contents,
+// certificate errors) from a renderer process to WebContents.
+class ContentSecurityNotifier final
+    : public blink::mojom::ContentSecurityNotifier {
+ public:
+  explicit ContentSecurityNotifier(GlobalFrameRoutingId render_frame_host_id);
+  ~ContentSecurityNotifier() override = default;
+
+  ContentSecurityNotifier(const ContentSecurityNotifier&) = delete;
+  ContentSecurityNotifier& operator=(const ContentSecurityNotifier&) = delete;
+
+  // blink::mojom::ContentSecurityNotifier implementation.
+  void NotifyContentWithCertificateErrorsRan() override;
+  void NotifyContentWithCertificateErrorsDisplayed() override;
+  void NotifyInsecureContentRan(const GURL& origin,
+                                const GURL& insecure_url) override;
+
+ private:
+  const GlobalFrameRoutingId render_frame_host_id_;
+};
+
+}  // namespace content
+
+#endif  // CONTENT_BROWSER_LOADER_CONTENT_SECURITY_NOTIFIER_H_
diff --git a/chromium/content/browser/loader/cors_file_origin_browsertest.cc b/chromium/content/browser/loader/cors_file_origin_browsertest.cc
index 222759c2b14..8739ca790a1 100644
--- a/chromium/content/browser/loader/cors_file_origin_browsertest.cc
+++ b/chromium/content/browser/loader/cors_file_origin_browsertest.cc
@@ -244,7 +244,7 @@ IN_PROC_BROWSER_TEST_F(CorsFileOriginBrowserTest, AccessToAnotherFileUrl) {
 
 // TODO(lukasza, nasko): https://crbug.com/981018: Enable this test on Macs
 // after understanding what makes it flakily fail on the mac-rel trybot.
-#if defined(OS_MACOSX)
+#if defined(OS_MAC)
 #define MAYBE_UniversalAccessFromFileUrls DISABLED_UniversalAccessFromFileUrls
 #else
 #define MAYBE_UniversalAccessFromFileUrls UniversalAccessFromFileUrls
@@ -261,10 +261,9 @@ IN_PROC_BROWSER_TEST_F(CorsFileOriginBrowserTest,
       JsReplace(kScript, embedded_test_server()->GetURL("/title2.html"));
 
   // Activate the preference to allow universal access from file URLs.
-  RenderViewHost* rvh = shell()->web_contents()->GetRenderViewHost();
-  WebPreferences prefs = rvh->GetWebkitPreferences();
+  WebPreferences prefs = shell()->web_contents()->GetOrCreateWebPreferences();
   prefs.allow_universal_access_from_file_urls = true;
-  rvh->UpdateWebkitPreferences(prefs);
+  shell()->web_contents()->SetWebPreferences(prefs);
 
   // Navigate to a file: test page.
   GURL page_url = GetTestUrl(nullptr, "title1.html");
diff --git a/chromium/content/browser/loader/cross_origin_read_blocking_checker.cc b/chromium/content/browser/loader/cross_origin_read_blocking_checker.cc
index 003f89024a5..fa15cb57741 100644
--- a/chromium/content/browser/loader/cross_origin_read_blocking_checker.cc
+++ b/chromium/content/browser/loader/cross_origin_read_blocking_checker.cc
@@ -9,7 +9,7 @@
 #include "content/public/browser/browser_thread.h"
 #include "net/base/io_buffer.h"
 #include "net/base/mime_sniffer.h"
-#include "services/network/cross_origin_read_blocking.h"
+#include "services/network/public/cpp/cross_origin_read_blocking.h"
 #include "services/network/public/cpp/resource_request.h"
 #include "services/network/public/mojom/url_response_head.mojom.h"
 #include "storage/browser/blob/blob_data_handle.h"
@@ -96,7 +96,7 @@ class CrossOriginReadBlockingChecker::BlobIOState {
 CrossOriginReadBlockingChecker::CrossOriginReadBlockingChecker(
     const network::ResourceRequest& request,
     const network::mojom::URLResponseHead& response,
-    const url::Origin& request_initiator_site_lock,
+    const url::Origin& request_initiator_origin_lock,
     const storage::BlobDataHandle& blob_data_handle,
     base::OnceCallback<void(Result)> callback)
     : callback_(std::move(callback)) {
@@ -115,7 +115,7 @@ CrossOriginReadBlockingChecker::CrossOriginReadBlockingChecker(
   corb_analyzer_ =
       std::make_unique<network::CrossOriginReadBlocking::ResponseAnalyzer>(
           request.url, request.request_initiator, response,
-          request_initiator_site_lock, request.mode, isolated_world_origin,
+          request_initiator_origin_lock, request.mode, isolated_world_origin,
           network_service_client);
   if (corb_analyzer_->ShouldBlock()) {
     OnBlocked();
diff --git a/chromium/content/browser/loader/cross_origin_read_blocking_checker.h b/chromium/content/browser/loader/cross_origin_read_blocking_checker.h
index b6ec7d85b82..c292ca9aab2 100644
--- a/chromium/content/browser/loader/cross_origin_read_blocking_checker.h
+++ b/chromium/content/browser/loader/cross_origin_read_blocking_checker.h
@@ -9,7 +9,7 @@
 #include "base/macros.h"
 #include "base/memory/weak_ptr.h"
 #include "net/base/net_errors.h"
-#include "services/network/cross_origin_read_blocking.h"
+#include "services/network/public/cpp/cross_origin_read_blocking.h"
 #include "services/network/public/mojom/url_response_head.mojom-forward.h"
 
 namespace net {
@@ -43,7 +43,7 @@ class CrossOriginReadBlockingChecker {
   CrossOriginReadBlockingChecker(
       const network::ResourceRequest& request,
       const network::mojom::URLResponseHead& response,
-      const url::Origin& request_initiator_site_lock,
+      const url::Origin& request_initiator_origin_lock,
       const storage::BlobDataHandle& blob_data_handle,
       base::OnceCallback<void(Result)> callback);
   ~CrossOriginReadBlockingChecker();
diff --git a/chromium/content/browser/loader/cross_site_document_blocking_browsertest.cc b/chromium/content/browser/loader/cross_site_document_blocking_browsertest.cc
index bc26b111691..a91f1271b45 100644
--- a/chromium/content/browser/loader/cross_site_document_blocking_browsertest.cc
+++ b/chromium/content/browser/loader/cross_site_document_blocking_browsertest.cc
@@ -47,7 +47,7 @@
 #include "mojo/public/cpp/test_support/test_utils.h"
 #include "net/test/embedded_test_server/controllable_http_response.h"
 #include "net/test/embedded_test_server/embedded_test_server.h"
-#include "services/network/cross_origin_read_blocking.h"
+#include "services/network/public/cpp/cross_origin_read_blocking.h"
 #include "services/network/public/cpp/features.h"
 #include "services/network/public/cpp/initiator_lock_compatibility.h"
 #include "services/network/public/cpp/network_switches.h"
@@ -775,9 +775,14 @@ IN_PROC_BROWSER_TEST_P(CrossSiteDocumentBlockingTest, BackToAboutBlank) {
   }
 }
 
+#if defined(OS_ANDROID)
 // Test is flaky on Android, see crbug.com/1075663
+#define MAYBE_BlockForVariousTargets DISABLED_BlockForVariousTargets
+#else
+#define MAYBE_BlockForVariousTargets BlockForVariousTargets
+#endif
 IN_PROC_BROWSER_TEST_P(CrossSiteDocumentBlockingTest,
-                       DISABLED_BlockForVariousTargets) {
+                       MAYBE_BlockForVariousTargets) {
   // This webpage loads a cross-site HTML page in different targets such as
   // <img>,<link>,<embed>, etc. Since the requested document is blocked, and one
   // character string (' ') is returned instead, this tests that the renderer
@@ -1422,9 +1427,9 @@ IN_PROC_BROWSER_TEST_P(CrossSiteDocumentBlockingTest, PrefetchIsNotImpacted) {
 
 // This test covers a scenario where foo.com document HTML-Imports a bar.com
 // document.  Because of historical reasons, bar.com fetches use foo.com's
-// URLLoaderFactory.  This means that |request_initiator_site_lock| enforcement
-// can incorrectly classify such fetches as malicious (kIncorrectLock).
-// This test ensures that UMAs properly detect such mishaps.
+// URLLoaderFactory.  This means that |request_initiator_origin_lock|
+// enforcement can incorrectly classify such fetches as malicious
+// (kIncorrectLock). This test ensures that UMAs properly detect such mishaps.
 //
 // TODO(lukasza, yoichio): https://crbug.com/766694: Remove this test once HTML
 // Imports are removed from the codebase.
@@ -1450,7 +1455,7 @@ IN_PROC_BROWSER_TEST_P(CrossSiteDocumentBlockingTest,
   // perform a fetch of nosniff.json same-origin (bar.com) via <script> element.
   // CORB should normally allow such fetch (request_initiator == bar.com ==
   // origin_of_fetch_target), but here the fetch will be blocked, because
-  // request_initiator_site_lock (a.com) will differ from request_initiator.
+  // request_initiator_origin_lock (a.com) will differ from request_initiator.
   // Such mishap is okay, because CORB only blocks HTML/XML/JSON and such
   // content type wouldn't have worked in <script> (or other non-XHR/fetch
   // context) anyway.
@@ -1469,7 +1474,7 @@ IN_PROC_BROWSER_TEST_P(CrossSiteDocumentBlockingTest,
     ExecuteScriptAsync(shell()->web_contents(), script);
     interceptor.WaitForRequestCompletion();
 
-    // NetworkService enforices |request_initiator_site_lock| for CORB,
+    // NetworkService enforces |request_initiator_origin_lock| for CORB,
     // which means that legitimate fetches from HTML Imported scripts may get
     // incorrectly blocked.
     interceptor.Verify(CorbExpectations::kShouldBeBlockedWithoutSniffing,
@@ -1486,8 +1491,8 @@ IN_PROC_BROWSER_TEST_P(CrossSiteDocumentBlockingTest,
 //    - CORB sees that the request was made from bar.com and blocks it.
 //
 // The test helps show that the bug above means that in XHR/fetch scenarios
-// request_initiator is accidentally compatible with request_initiator_site_lock
-// and therefore the lock can be safely enforced.
+// request_initiator is accidentally compatible with
+// request_initiator_origin_lock and therefore the lock can be safely enforced.
 //
 // There are 2 almost identical tests here:
 // - HtmlImports_CompatibleLock1
@@ -1553,8 +1558,8 @@ IN_PROC_BROWSER_TEST_P(CrossSiteDocumentBlockingTest,
 //    - CORB sees that the request was made from bar.com and blocks it.
 //
 // The test helps show that the bug above means that in XHR/fetch scenarios
-// request_initiator is accidentally compatible with request_initiator_site_lock
-// and therefore the lock can be safely enforced.
+// request_initiator is accidentally compatible with
+// request_initiator_origin_lock and therefore the lock can be safely enforced.
 //
 // There are 2 almost identical tests here:
 // - HtmlImports_CompatibleLock1
diff --git a/chromium/content/browser/loader/derived_origin_in_fetch_browsertest.cc b/chromium/content/browser/loader/derived_origin_in_fetch_browsertest.cc
new file mode 100644
index 00000000000..2ec4ac8a84e
--- /dev/null
+++ b/chromium/content/browser/loader/derived_origin_in_fetch_browsertest.cc
@@ -0,0 +1,45 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "base/optional.h"
+#include "content/public/common/content_switches.h"
+#include "content/public/test/browser_test.h"
+#include "content/public/test/content_browser_test.h"
+#include "content/public/test/content_browser_test_utils.h"
+#include "content/public/test/url_loader_monitor.h"
+#include "content/shell/browser/shell.h"
+#include "services/network/public/cpp/resource_request.h"
+#include "testing/gtest/include/gtest/gtest.h"
+#include "url/gurl.h"
+#include "url/origin.h"
+
+namespace content {
+
+using DerivedOriginInFetchBrowserTest = ContentBrowserTest;
+
+// A fetch originating in a context with a file:/// origin should have its
+// initiator derived from the originating context's origin.
+IN_PROC_BROWSER_TEST_F(DerivedOriginInFetchBrowserTest,
+                       FetchFromFileOriginProducesDerivedOrigin) {
+  // The request will be intercepted, so this page doesn't need to exist:
+  GURL destination("https://destination.irrelevant");
+  // This needs to be created before navigating to the source page.
+  URLLoaderMonitor monitor({destination});
+
+  GURL starting_file_url = GetTestUrl(/*dir=*/nullptr, "title1.html");
+  ASSERT_TRUE(starting_file_url.SchemeIsFile());
+  ASSERT_TRUE(NavigateToURL(shell(), starting_file_url));
+
+  EXPECT_TRUE(ExecJs(shell(), JsReplace("fetch($1);", destination)));
+  monitor.WaitForUrls();
+  base::Optional<network::ResourceRequest> request =
+      monitor.GetRequestInfo(destination);
+
+  ASSERT_TRUE(request);
+  const base::Optional<url::Origin>& initiator = request->request_initiator;
+  ASSERT_TRUE(initiator);
+  EXPECT_TRUE(initiator->CanBeDerivedFrom(starting_file_url));
+}
+
+}  // namespace content
diff --git a/chromium/content/browser/loader/file_url_loader_factory.cc b/chromium/content/browser/loader/file_url_loader_factory.cc
index c550b8b5060..3385eadf40f 100644
--- a/chromium/content/browser/loader/file_url_loader_factory.cc
+++ b/chromium/content/browser/loader/file_url_loader_factory.cc
@@ -11,6 +11,7 @@
 
 #include "base/bind.h"
 #include "base/callback_forward.h"
+#include "base/command_line.h"
 #include "base/feature_list.h"
 #include "base/files/file.h"
 #include "base/files/file_path.h"
@@ -37,6 +38,7 @@
 #include "content/public/common/content_switches.h"
 #include "mojo/public/cpp/bindings/receiver.h"
 #include "mojo/public/cpp/bindings/remote.h"
+#include "mojo/public/cpp/bindings/self_owned_receiver.h"
 #include "mojo/public/cpp/system/data_pipe.h"
 #include "mojo/public/cpp/system/data_pipe_producer.h"
 #include "mojo/public/cpp/system/file_data_source.h"
@@ -786,12 +788,21 @@ FileURLLoaderFactory::FileURLLoaderFactory(
     const base::FilePath& profile_path,
     scoped_refptr<SharedCorsOriginAccessList> shared_cors_origin_access_list,
     base::TaskPriority task_priority)
+    : FileURLLoaderFactory(
+          profile_path,
+          std::move(shared_cors_origin_access_list),
+          base::ThreadPool::CreateSequencedTaskRunner(
+              {base::MayBlock(), task_priority,
+               base::TaskShutdownBehavior::SKIP_ON_SHUTDOWN})) {}
+
+FileURLLoaderFactory::FileURLLoaderFactory(
+    const base::FilePath& profile_path,
+    scoped_refptr<SharedCorsOriginAccessList> shared_cors_origin_access_list,
+    scoped_refptr<base::SequencedTaskRunner> task_runner)
     : profile_path_(profile_path),
       shared_cors_origin_access_list_(
           std::move(shared_cors_origin_access_list)),
-      task_runner_(base::ThreadPool::CreateSequencedTaskRunner(
-          {base::MayBlock(), task_priority,
-           base::TaskShutdownBehavior::SKIP_ON_SHUTDOWN})) {}
+      task_runner_(std::move(task_runner)) {}
 
 FileURLLoaderFactory::~FileURLLoaderFactory() = default;
 
@@ -890,10 +901,14 @@ void FileURLLoaderFactory::CreateLoaderAndStartInternal(
 }
 
 void FileURLLoaderFactory::Clone(
-    mojo::PendingReceiver<network::mojom::URLLoaderFactory> loader) {
+    mojo::PendingReceiver<network::mojom::URLLoaderFactory> pending_receiver) {
   DCHECK_CALLED_ON_VALID_THREAD(thread_checker_);
 
-  receivers_.Add(this, std::move(loader));
+  std::unique_ptr<content::FileURLLoaderFactory> new_factory(
+      new content::FileURLLoaderFactory(
+          profile_path_, shared_cors_origin_access_list_, task_runner_));
+  mojo::MakeSelfOwnedReceiver(std::move(new_factory),
+                              std::move(pending_receiver));
 }
 
 void CreateFileURLLoaderBypassingSecurityChecks(
diff --git a/chromium/content/browser/loader/file_url_loader_factory.h b/chromium/content/browser/loader/file_url_loader_factory.h
index a12284d075f..a79ddf4e83b 100644
--- a/chromium/content/browser/loader/file_url_loader_factory.h
+++ b/chromium/content/browser/loader/file_url_loader_factory.h
@@ -39,7 +39,6 @@ class CONTENT_EXPORT FileURLLoaderFactory
       base::TaskPriority task_priority);
   ~FileURLLoaderFactory() override;
 
- private:
   // network::mojom::URLLoaderFactory:
   void CreateLoaderAndStart(
       mojo::PendingReceiver<network::mojom::URLLoader> loader,
@@ -50,8 +49,14 @@ class CONTENT_EXPORT FileURLLoaderFactory
       mojo::PendingRemote<network::mojom::URLLoaderClient> client,
       const net::MutableNetworkTrafficAnnotationTag& traffic_annotation)
       override;
-  void Clone(
-      mojo::PendingReceiver<network::mojom::URLLoaderFactory> loader) override;
+  void Clone(mojo::PendingReceiver<network::mojom::URLLoaderFactory>
+                 pending_receiver) override;
+
+ private:
+  FileURLLoaderFactory(
+      const base::FilePath& profile_path,
+      scoped_refptr<SharedCorsOriginAccessList> shared_cors_origin_access_list,
+      scoped_refptr<base::SequencedTaskRunner> task_runner);
 
   void CreateLoaderAndStartInternal(
       const network::ResourceRequest request,
@@ -63,7 +68,6 @@ class CONTENT_EXPORT FileURLLoaderFactory
   const scoped_refptr<SharedCorsOriginAccessList>
       shared_cors_origin_access_list_;
   const scoped_refptr<base::SequencedTaskRunner> task_runner_;
-  mojo::ReceiverSet<network::mojom::URLLoaderFactory> receivers_;
 
   THREAD_CHECKER(thread_checker_);
 
diff --git a/chromium/content/browser/loader/file_url_loader_factory_browsertest.cc b/chromium/content/browser/loader/file_url_loader_factory_browsertest.cc
index ab2a755ec1e..49926e8dcf4 100644
--- a/chromium/content/browser/loader/file_url_loader_factory_browsertest.cc
+++ b/chromium/content/browser/loader/file_url_loader_factory_browsertest.cc
@@ -401,5 +401,69 @@ IN_PROC_BROWSER_TEST_F(FileURLLoaderFactoryBrowserTest,
   EXPECT_TRUE(test_browser_client.access_allowed_args().empty());
 }
 
+// The test below opens a |popup| in a way that doesn't trigger a
+// RenderFrameImpl::CommitNavigation.  This means that the popup will depend on
+// inheriting URLLoaderFactoryBundle from the opener.
+//
+// Before triggering any subresource fetches in the popup, the test closes the
+// opener window.  If the URLLoaderFactoryBundle hasn't been inherited at this
+// point yet, then we might run into trouble later.  Another way how we might
+// get into trouble is if FileURLLoaderFactory's clone doesn't survive closing
+// of the opener.
+//
+// Finally, the test triggers a subresource fetch in the popup.  We expect that
+// this fetch should use the right URLLoaderFactoryBundle - one that contains
+// a functional FileURLLoaderFactory.
+//
+// This is a regression test for https://crbug.com/1106995
+IN_PROC_BROWSER_TEST_F(FileURLLoaderFactoryBrowserTest,
+                       LifetimeOfClonedFactory) {
+  GURL opener_url(GetTestUrl("", "title1.html"));
+  EXPECT_TRUE(NavigateToURL(shell(), opener_url));
+
+  // Open a |popup| in a way that doesn't trigger RFI::CommitNavigation.
+  WebContentsAddedObserver popup_observer;
+  ASSERT_TRUE(ExecJs(shell(), "window.open('', '_blank')"));
+  WebContents* popup = popup_observer.GetWebContents();
+
+  // Close the opener and make sure that the |popup| actually sees that the
+  // |opener| has closed.
+  //
+  // This test step means that we cannot rely on the |opener| being alive when
+  // the first subresource fetch happens in the |popup| (in the next test step
+  // below).
+  EXPECT_EQ(true, EvalJs(popup, "!!window.opener"));
+  shell()->Close();
+  const char kScriptToWaitForNoOpener[] = R"(
+      new Promise(function (resolve, reject) {
+          function CheckAndWaitMoreIfNeeded() {
+            if (!window.opener)
+              resolve('OPENER GONE');
+
+            setTimeout(CheckAndWaitMoreIfNeeded, 50);
+          }
+
+          CheckAndWaitMoreIfNeeded();
+      });
+  )";
+  EXPECT_EQ("OPENER GONE", EvalJs(popup, kScriptToWaitForNoOpener));
+
+  // Trigger a subresource fetch in the popup.  This is the main test step - it
+  // verifies that at this point the popup has access to a functional
+  // FileURLLoaderFactory.
+  const char kScriptTemplateToTriggerSubresourceFetch[] = R"(
+      new Promise(function (resolve, reject) {
+          var img = document.createElement('img');
+          img.src = $1;
+          img.onload = _ => resolve('OK');
+          img.onerror = e => resolve('ERR: ' + e);
+      });
+  )";
+  GURL img_url = GetTestUrl("site_isolation", "png-corp.png");
+  EXPECT_EQ("OK",
+            EvalJs(popup, JsReplace(kScriptTemplateToTriggerSubresourceFetch,
+                                    img_url)));
+}
+
 }  // namespace
 }  // namespace content
diff --git a/chromium/content/browser/loader/loader_browsertest.cc b/chromium/content/browser/loader/loader_browsertest.cc
index a229d260140..a3f7d53794c 100644
--- a/chromium/content/browser/loader/loader_browsertest.cc
+++ b/chromium/content/browser/loader/loader_browsertest.cc
@@ -27,7 +27,6 @@
 #include "content/public/browser/web_contents.h"
 #include "content/public/common/content_client.h"
 #include "content/public/common/network_service_util.h"
-#include "content/public/common/previews_state.h"
 #include "content/public/common/url_constants.h"
 #include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
@@ -50,6 +49,7 @@
 #include "net/test/url_request/url_request_mock_http_job.h"
 #include "services/network/public/cpp/features.h"
 #include "testing/gmock/include/gmock/gmock.h"
+#include "third_party/blink/public/common/loader/previews_state.h"
 #include "third_party/blink/public/common/loader/url_loader_throttle.h"
 #include "url/gurl.h"
 
@@ -240,7 +240,7 @@ IN_PROC_BROWSER_TEST_F(LoaderBrowserTest, SyncXMLHttpRequest_Disallowed) {
 // downloadable) would trigger download and hang the renderer process,
 // if executed while navigating to a new page.
 // Disabled on Mac: see http://crbug.com/56264
-#if defined(OS_MACOSX)
+#if defined(OS_MAC)
 #define MAYBE_SyncXMLHttpRequest_DuringUnload \
   DISABLED_SyncXMLHttpRequest_DuringUnload
 #else
@@ -291,7 +291,13 @@ std::unique_ptr<net::test_server::HttpResponse> CancelOnRequest(
 // Tests the case where the request is cancelled by a layer above the
 // URLRequest, which passes the error on ResourceLoader teardown, rather than in
 // response to call to AsyncResourceHandler::OnResponseComplete.
-IN_PROC_BROWSER_TEST_F(LoaderBrowserTest, SyncXMLHttpRequest_Cancelled) {
+// Failed on Android M builder. See crbug/1111427.
+#if defined(OS_ANDROID)
+#define MAYBE_SyncXMLHttpRequest_Cancelled DISABLED_SyncXMLHttpRequest_Cancelled
+#else
+#define MAYBE_SyncXMLHttpRequest_Cancelled SyncXMLHttpRequest_Cancelled
+#endif
+IN_PROC_BROWSER_TEST_F(LoaderBrowserTest, MAYBE_SyncXMLHttpRequest_Cancelled) {
   // If network service is running in-process, we can't simulate a crash.
   if (IsInProcessNetworkService())
     return;
@@ -401,7 +407,7 @@ IN_PROC_BROWSER_TEST_F(LoaderBrowserTest, CrossSiteNoUnloadOn204) {
 // app isn't stripped of debug symbols, this takes about five minutes to
 // complete and isn't conducive to quick turnarounds. As we don't currently
 // strip the app on the build bots, this is bad times.
-#if defined(OS_MACOSX)
+#if defined(OS_MAC)
 #define MAYBE_CrossSiteAfterCrash DISABLED_CrossSiteAfterCrash
 #else
 #define MAYBE_CrossSiteAfterCrash CrossSiteAfterCrash
@@ -925,7 +931,7 @@ IN_PROC_BROWSER_TEST_F(RequestDataBrowserTest, SameOriginAuxiliary) {
       &success));
   EXPECT_TRUE(success);
   Shell* new_shell = new_shell_observer.GetShell();
-  WaitForLoadStop(new_shell->web_contents());
+  EXPECT_TRUE(WaitForLoadStop(new_shell->web_contents()));
 
   auto requests = data();
   EXPECT_EQ(2u, requests.size());
@@ -969,7 +975,7 @@ IN_PROC_BROWSER_TEST_F(RequestDataBrowserTest, CrossOriginAuxiliary) {
       &success));
   EXPECT_TRUE(success);
   Shell* new_shell = new_shell_observer.GetShell();
-  WaitForLoadStop(new_shell->web_contents());
+  EXPECT_TRUE(WaitForLoadStop(new_shell->web_contents()));
 
   auto requests = data();
   EXPECT_EQ(2u, requests.size());
diff --git a/chromium/content/browser/loader/merkle_integrity_source_stream.cc b/chromium/content/browser/loader/merkle_integrity_source_stream.cc
index 77497667434..1061b2f6e7f 100644
--- a/chromium/content/browser/loader/merkle_integrity_source_stream.cc
+++ b/chromium/content/browser/loader/merkle_integrity_source_stream.cc
@@ -9,6 +9,7 @@
 #include "base/base64.h"
 #include "base/big_endian.h"
 #include "base/numerics/safe_conversions.h"
+#include "base/strings/string_util.h"
 #include "net/base/io_buffer.h"
 
 namespace content {
@@ -39,7 +40,7 @@ MerkleIntegritySourceStream::MerkleIntegritySourceStream(
     // TODO(ksakamoto): Use appropriate SourceType.
     : net::FilterSourceStream(SourceStream::TYPE_NONE, std::move(upstream)) {
   std::string next_proof;
-  if (!digest_header_value.starts_with(kMiSha256Header) ||
+  if (!base::StartsWith(digest_header_value, kMiSha256Header) ||
       !base::Base64Decode(digest_header_value.substr(kMiSha256HeaderLength),
                           &next_proof) ||
       next_proof.size() != SHA256_DIGEST_LENGTH) {
diff --git a/chromium/content/browser/loader/navigation_url_loader.h b/chromium/content/browser/loader/navigation_url_loader.h
index 7322f606e4e..35299f5380e 100644
--- a/chromium/content/browser/loader/navigation_url_loader.h
+++ b/chromium/content/browser/loader/navigation_url_loader.h
@@ -13,7 +13,7 @@
 #include "base/optional.h"
 #include "content/browser/loader/navigation_loader_interceptor.h"
 #include "content/common/content_export.h"
-#include "content/public/common/previews_state.h"
+#include "third_party/blink/public/common/loader/previews_state.h"
 
 namespace net {
 class HttpRequestHeaders;
@@ -76,7 +76,7 @@ class CONTENT_EXPORT NavigationURLLoader {
       const std::vector<std::string>& removed_headers,
       const net::HttpRequestHeaders& modified_headers,
       const net::HttpRequestHeaders& modified_cors_exempt_headers,
-      PreviewsState new_previews_state) = 0;
+      blink::PreviewsState new_previews_state) = 0;
 
  protected:
   NavigationURLLoader() {}
diff --git a/chromium/content/browser/loader/navigation_url_loader_impl.cc b/chromium/content/browser/loader/navigation_url_loader_impl.cc
index 6eb68513704..2b94b8b2839 100644
--- a/chromium/content/browser/loader/navigation_url_loader_impl.cc
+++ b/chromium/content/browser/loader/navigation_url_loader_impl.cc
@@ -79,8 +79,6 @@
 #include "net/ssl/ssl_info.h"
 #include "net/traffic_annotation/network_traffic_annotation.h"
 #include "net/url_request/redirect_util.h"
-#include "net/url_request/url_request.h"
-#include "net/url_request/url_request_context.h"
 #include "ppapi/buildflags/buildflags.h"
 #include "services/network/public/cpp/constants.h"
 #include "services/network/public/cpp/features.h"
@@ -334,8 +332,7 @@ uint32_t NavigationURLLoaderImpl::GetURLLoaderOptions(bool is_main_frame) {
 }
 
 void NavigationURLLoaderImpl::Start(
-    std::unique_ptr<network::PendingSharedURLLoaderFactory>
-        pending_network_loader_factory,
+    scoped_refptr<network::SharedURLLoaderFactory> network_loader_factory,
     AppCacheNavigationHandle* appcache_handle,
     scoped_refptr<PrefetchedSignedExchangeCache>
         prefetched_signed_exchange_cache,
@@ -356,8 +353,7 @@ void NavigationURLLoaderImpl::Start(
                      weak_factory_.GetWeakPtr(), base::TimeTicks::Now()));
 
   // TODO(kinuko): This can likely be initialized in the ctor.
-  network_loader_factory_ = network::SharedURLLoaderFactory::Create(
-      std::move(pending_network_loader_factory));
+  network_loader_factory_ = network_loader_factory;
   if (needs_loader_factory_interceptor && g_loader_factory_interceptor.Get()) {
     mojo::PendingRemote<network::mojom::URLLoaderFactory> factory;
     mojo::PendingReceiver<network::mojom::URLLoaderFactory> receiver =
@@ -419,7 +415,8 @@ void NavigationURLLoaderImpl::CreateInterceptors(
   if (prefetched_signed_exchange_cache) {
     std::unique_ptr<NavigationLoaderInterceptor>
         prefetched_signed_exchange_interceptor =
-            prefetched_signed_exchange_cache->MaybeCreateInterceptor(url_);
+            prefetched_signed_exchange_cache->MaybeCreateInterceptor(
+                url_, frame_tree_node_id_);
     if (prefetched_signed_exchange_interceptor) {
       interceptors_.push_back(
           std::move(prefetched_signed_exchange_interceptor));
@@ -697,7 +694,7 @@ void NavigationURLLoaderImpl::FollowRedirectInternal(
     const std::vector<std::string>& removed_headers,
     const net::HttpRequestHeaders& modified_headers,
     const net::HttpRequestHeaders& modified_cors_exempt_headers,
-    PreviewsState new_previews_state,
+    blink::PreviewsState new_previews_state,
     base::Time ui_post_time) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
   DCHECK(!redirect_info_.new_url.is_empty());
@@ -1153,22 +1150,26 @@ NavigationURLLoaderImpl::NavigationURLLoaderImpl(
         &factory_receiver, nullptr /* header_client */,
         nullptr /* bypass_redirect_checks */, nullptr /* disable_secure_dns */,
         nullptr /* factory_override */);
-    CreateWebUIURLLoaderBinding(frame_tree_node->current_frame_host(), scheme,
+    CreateWebUIURLLoaderBinding(frame_tree_node, scheme,
                                 std::move(factory_receiver));
   }
 
   mojo::PendingRemote<network::mojom::TrustedURLLoaderHeaderClient>
       header_client;
+  // |frame_tree_node| may be null in some unit test environments.
   if (frame_tree_node) {
     // Initialize proxied factory remote/receiver if necessary.
     // This also populates |bypass_redirect_checks_|.
     DCHECK(frame_tree_node->navigation_request());
 
-    // |frame_tree_node| may be null in some unit test environments.
     GetContentClient()
         ->browser()
         ->RegisterNonNetworkNavigationURLLoaderFactories(
-            frame_tree_node_id_, &non_network_url_loader_factories_);
+            frame_tree_node_id_,
+            base::UkmSourceId::FromOtherId(
+                frame_tree_node->navigation_request()->GetNavigationId(),
+                base::UkmSourceId::Type::NAVIGATION_ID),
+            &non_network_url_loader_factories_);
 
     // The embedder may want to proxy all network-bound URLLoaderFactory
     // receivers that it can. If it elects to do so, those proxies will be
@@ -1214,8 +1215,10 @@ NavigationURLLoaderImpl::NavigationURLLoaderImpl(
       std::make_unique<FileURLLoaderFactory>(
           browser_context_->GetPath(),
           browser_context_->GetSharedCorsOriginAccessList(),
-          // USER_VISIBLE because loaded file resources may affect the UI.
-          base::TaskPriority::USER_VISIBLE);
+          // USER_BLOCKING because this scenario is exactly one of the examples
+          // given by the doc comment for USER_BLOCKING:
+          // Loading and rendering a web page after the user clicks a link.
+          base::TaskPriority::USER_BLOCKING);
 
   if (frame_tree_node) {  // May be nullptr in some unit tests.
     devtools_instrumentation::WillCreateURLLoaderFactory(
@@ -1239,21 +1242,20 @@ NavigationURLLoaderImpl::NavigationURLLoaderImpl(
     known_schemes_.insert(iter.first);
 
   bool needs_loader_factory_interceptor = false;
-  std::unique_ptr<network::PendingSharedURLLoaderFactory>
-      pending_network_factory =
-          storage_partition_->GetURLLoaderFactoryForBrowserProcess()->Clone();
+  scoped_refptr<network::SharedURLLoaderFactory> network_factory =
+      storage_partition_->GetURLLoaderFactoryForBrowserProcess();
   if (header_client) {
     needs_loader_factory_interceptor = true;
     mojo::PendingRemote<network::mojom::URLLoaderFactory> factory_remote;
     CreateURLLoaderFactoryWithHeaderClient(
         std::move(header_client),
         factory_remote.InitWithNewPipeAndPassReceiver(), storage_partition_);
-    pending_network_factory =
-        std::make_unique<network::WrapperPendingSharedURLLoaderFactory>(
+    network_factory =
+        base::MakeRefCounted<network::WrapperSharedURLLoaderFactory>(
             std::move(factory_remote));
   }
 
-  Start(std::move(pending_network_factory), appcache_handle,
+  Start(network_factory, appcache_handle,
         std::move(prefetched_signed_exchange_cache),
         std::move(signed_exchange_prefetch_metric_recorder),
         std::move(factory_for_webui), std::move(accept_langs),
@@ -1264,7 +1266,7 @@ void NavigationURLLoaderImpl::FollowRedirect(
     const std::vector<std::string>& removed_headers,
     const net::HttpRequestHeaders& modified_headers,
     const net::HttpRequestHeaders& modified_cors_exempt_headers,
-    PreviewsState new_previews_state) {
+    blink::PreviewsState new_previews_state) {
   FollowRedirectInternal(removed_headers, modified_headers,
                          modified_cors_exempt_headers, new_previews_state,
                          base::Time::Now());
diff --git a/chromium/content/browser/loader/navigation_url_loader_impl.h b/chromium/content/browser/loader/navigation_url_loader_impl.h
index fea2619adc1..38dda15df95 100644
--- a/chromium/content/browser/loader/navigation_url_loader_impl.h
+++ b/chromium/content/browser/loader/navigation_url_loader_impl.h
@@ -16,12 +16,13 @@
 #include "content/public/browser/content_browser_client.h"
 #include "content/public/browser/global_request_id.h"
 #include "content/public/browser/ssl_status.h"
-#include "content/public/common/previews_state.h"
 #include "mojo/public/cpp/bindings/pending_receiver.h"
 #include "mojo/public/cpp/bindings/pending_remote.h"
+#include "net/url_request/url_request.h"
 #include "services/network/public/mojom/url_loader.mojom.h"
 #include "services/network/public/mojom/url_loader_factory.mojom.h"
 #include "services/network/public/mojom/url_response_head.mojom.h"
+#include "third_party/blink/public/common/loader/previews_state.h"
 
 namespace net {
 struct RedirectInfo;
@@ -68,8 +69,7 @@ class CONTENT_EXPORT NavigationURLLoaderImpl
   // This is called only once (while Restart can be called multiple times).
   // Sets |started_| true.
   void Start(
-      std::unique_ptr<network::PendingSharedURLLoaderFactory>
-          pending_network_loader_factory,
+      scoped_refptr<network::SharedURLLoaderFactory> network_loader_factory,
       AppCacheNavigationHandle* appcache_handle,
       scoped_refptr<PrefetchedSignedExchangeCache>
           prefetched_signed_exchange_cache,
@@ -111,7 +111,7 @@ class CONTENT_EXPORT NavigationURLLoaderImpl
       const std::vector<std::string>& removed_headers,
       const net::HttpRequestHeaders& modified_headers,
       const net::HttpRequestHeaders& modified_cors_exempt_headers,
-      PreviewsState new_previews_state,
+      blink::PreviewsState new_previews_state,
       base::Time ui_post_time);
 
   // network::mojom::URLLoaderClient implementation:
@@ -159,7 +159,7 @@ class CONTENT_EXPORT NavigationURLLoaderImpl
       const std::vector<std::string>& removed_headers,
       const net::HttpRequestHeaders& modified_headers,
       const net::HttpRequestHeaders& modified_cors_exempt_headers,
-      PreviewsState new_previews_state) override;
+      blink::PreviewsState new_previews_state) override;
 
   void NotifyRequestStarted(base::TimeTicks timestamp);
   void NotifyResponseStarted(
diff --git a/chromium/content/browser/loader/navigation_url_loader_impl_unittest.cc b/chromium/content/browser/loader/navigation_url_loader_impl_unittest.cc
index c474d0e8fab..62524b5fde3 100644
--- a/chromium/content/browser/loader/navigation_url_loader_impl_unittest.cc
+++ b/chromium/content/browser/loader/navigation_url_loader_impl_unittest.cc
@@ -138,9 +138,10 @@ class TestNavigationLoaderInterceptor : public NavigationLoaderInterceptor {
 class NavigationURLLoaderImplTest : public testing::Test {
  public:
   NavigationURLLoaderImplTest()
-      : network_change_notifier_(
-            net::test::MockNetworkChangeNotifier::Create()),
-        task_environment_(BrowserTaskEnvironment::IO_MAINLOOP) {
+      : task_environment_(std::make_unique<BrowserTaskEnvironment>(
+            base::test::TaskEnvironment::MainThreadType::IO)),
+        network_change_notifier_(
+            net::test::MockNetworkChangeNotifier::Create()) {
     // Because the network service is enabled we need a system Connector or
     // BrowserContext::GetDefaultStoragePartition will segfault when
     // ContentBrowserClient::CreateNetworkContext tries to call
@@ -161,6 +162,11 @@ class NavigationURLLoaderImplTest : public testing::Test {
   ~NavigationURLLoaderImplTest() override {
     browser_context_.reset();
     SetSystemConnectorForTesting(nullptr);
+    // Reset the BrowserTaskEnvironment to force destruction of the local
+    // NetworkService, which is held in SequenceLocalStorage. This must happen
+    // before destruction of |network_change_notifier_|, to allow observers to
+    // be unregistered.
+    task_environment_.reset();
   }
 
   std::unique_ptr<NavigationURLLoader> CreateTestLoader(
@@ -185,7 +191,9 @@ class NavigationURLLoaderImplTest : public testing::Test {
             GURL() /* client_side_redirect_url */,
             base::nullopt /* devtools_initiator_info */,
             false /* attach_same_site_cookie */,
-            nullptr /* trust_token_params */, base::nullopt /* impression */);
+            nullptr /* trust_token_params */, base::nullopt /* impression */,
+            base::TimeTicks() /* renderer_before_unload_start */,
+            base::TimeTicks() /* renderer_before_unload_end */);
 
     auto common_params = CreateCommonNavigationParams();
     common_params->url = url;
@@ -243,7 +251,7 @@ class NavigationURLLoaderImplTest : public testing::Test {
                            redirect_url.GetOrigin().spec().c_str()),
         request_method, &delegate);
     delegate.WaitForRequestRedirected();
-    loader->FollowRedirect({}, {}, {}, PREVIEWS_OFF);
+    loader->FollowRedirect({}, {}, {}, blink::PreviewsTypes::PREVIEWS_OFF);
 
     EXPECT_EQ(expected_redirect_method, delegate.redirect_info().new_method);
 
@@ -284,7 +292,7 @@ class NavigationURLLoaderImplTest : public testing::Test {
                            url.GetOrigin().spec().c_str()),
         "GET", &delegate, NavigationDownloadPolicy(), is_main_frame);
     delegate.WaitForRequestRedirected();
-    loader->FollowRedirect({}, {}, {}, PREVIEWS_OFF);
+    loader->FollowRedirect({}, {}, {}, blink::PreviewsTypes::PREVIEWS_OFF);
     delegate.WaitForResponseStarted();
 
     return most_recent_resource_request_.value().priority;
@@ -301,7 +309,7 @@ class NavigationURLLoaderImplTest : public testing::Test {
         "GET", &delegate, NavigationDownloadPolicy(), true /*is_main_frame*/,
         upgrade_if_insecure);
     delegate.WaitForRequestRedirected();
-    loader->FollowRedirect({}, {}, {}, PREVIEWS_OFF);
+    loader->FollowRedirect({}, {}, {}, blink::PreviewsTypes::PREVIEWS_OFF);
     if (expect_request_fail) {
       delegate.WaitForRequestFailed();
     } else {
@@ -311,9 +319,9 @@ class NavigationURLLoaderImplTest : public testing::Test {
   }
 
  protected:
+  std::unique_ptr<BrowserTaskEnvironment> task_environment_;
   std::unique_ptr<net::test::MockNetworkChangeNotifier>
       network_change_notifier_;
-  BrowserTaskEnvironment task_environment_;
   std::unique_ptr<TestBrowserContext> browser_context_;
   net::EmbeddedTestServer http_test_server_;
   base::Optional<network::ResourceRequest> most_recent_resource_request_;
@@ -469,7 +477,8 @@ TEST_F(NavigationURLLoaderImplTest, RedirectModifiedHeaders) {
   net::HttpRequestHeaders redirect_headers;
   redirect_headers.SetHeader("Header2", "");
   redirect_headers.SetHeader("Header3", "Value3");
-  loader->FollowRedirect({}, redirect_headers, {}, PREVIEWS_OFF);
+  loader->FollowRedirect({}, redirect_headers, {},
+                         blink::PreviewsTypes::PREVIEWS_OFF);
   delegate.WaitForResponseStarted();
 
   // Redirected request should also have modified headers.
diff --git a/chromium/content/browser/loader/navigation_url_loader_unittest.cc b/chromium/content/browser/loader/navigation_url_loader_unittest.cc
index 4701e28d871..85434360fd3 100644
--- a/chromium/content/browser/loader/navigation_url_loader_unittest.cc
+++ b/chromium/content/browser/loader/navigation_url_loader_unittest.cc
@@ -30,8 +30,6 @@
 #include "net/test/embedded_test_server/embedded_test_server.h"
 #include "net/traffic_annotation/network_traffic_annotation_test_helper.h"
 #include "net/url_request/redirect_info.h"
-#include "net/url_request/url_request.h"
-#include "net/url_request/url_request_test_util.h"
 #include "services/network/public/cpp/features.h"
 #include "services/network/public/mojom/network_context.mojom.h"
 #include "testing/gtest/include/gtest/gtest.h"
@@ -71,7 +69,9 @@ class NavigationURLLoaderTest : public testing::Test {
             GURL() /* client_side_redirect_url */,
             base::nullopt /* devtools_initiator_info */,
             false /* force_ignore_site_for_cookies */,
-            nullptr /* trust_token_params */, base::nullopt /* impression */);
+            nullptr /* trust_token_params */, base::nullopt /* impression */,
+            base::TimeTicks() /* renderer_before_unload_start */,
+            base::TimeTicks() /* renderer_before_unload_end */);
     auto common_params = CreateCommonNavigationParams();
     common_params->url = url;
     common_params->initiator_origin = url::Origin::Create(url);
diff --git a/chromium/content/browser/loader/prefetch_browsertest.cc b/chromium/content/browser/loader/prefetch_browsertest.cc
index 3244122bd0f..70a7bd9fbb0 100644
--- a/chromium/content/browser/loader/prefetch_browsertest.cc
+++ b/chromium/content/browser/loader/prefetch_browsertest.cc
@@ -142,16 +142,7 @@ IN_PROC_BROWSER_TEST_P(PrefetchBrowserTestPrivacyChanges, RedirectNotFollowed) {
   EXPECT_EQ(1, main_page_counter->GetRequestCount());
 
   NavigateToURLAndWaitTitle(destination_url, "Prefetch Target");
-  // PrefetchPrivacyChanges relies on kError redirect_mode, and it is handled
-  // in CorsURLLoader which code path is activated only if OOR-CORS is enabled.
-  // OOR-CORS enabled case is running only at linux-oor-cors-rel bot until the
-  // feature is enabled by default.
-  // See https://ci.chromium.org/p/chromium/builders/ci/linux-oor-cors-rel.
-  const int expected_request_count =
-      (privacy_changes_enabled_ &&
-       network::features::ShouldEnableOutOfBlinkCorsForTesting())
-          ? 1
-          : 2;
+  const int expected_request_count = privacy_changes_enabled_ ? 1 : 2;
   EXPECT_EQ(expected_request_count, destination_counter->GetRequestCount());
   EXPECT_TRUE(embedded_test_server()->ShutdownAndWaitUntilComplete());
 }
diff --git a/chromium/content/browser/loader/prefetch_url_loader.cc b/chromium/content/browser/loader/prefetch_url_loader.cc
index 9c4462083d2..c68df8a1f0c 100644
--- a/chromium/content/browser/loader/prefetch_url_loader.cc
+++ b/chromium/content/browser/loader/prefetch_url_loader.cc
@@ -137,10 +137,8 @@ void PrefetchURLLoader::OnReceiveResponse(
       signed_exchange_utils::ShouldHandleAsSignedHTTPExchange(
           resource_request_.url, *response)) {
     DCHECK(!signed_exchange_prefetch_handler_);
-    if (prefetched_signed_exchange_cache_adapter_) {
-      prefetched_signed_exchange_cache_adapter_->OnReceiveOuterResponse(
-          response.Clone());
-    }
+    const bool keep_entry_for_prefetch_cache =
+        !!prefetched_signed_exchange_cache_adapter_;
     // Note that after this point this doesn't directly get upcalls from the
     // network. (Until |this| calls the handler's FollowRedirect.)
     signed_exchange_prefetch_handler_ =
@@ -149,7 +147,8 @@ void PrefetchURLLoader::OnReceiveResponse(
             mojo::ScopedDataPipeConsumerHandle(), loader_.Unbind(),
             client_receiver_.Unbind(), network_loader_factory_,
             url_loader_throttles_getter_, this,
-            signed_exchange_prefetch_metric_recorder_, accept_langs_);
+            signed_exchange_prefetch_metric_recorder_, accept_langs_,
+            keep_entry_for_prefetch_cache);
     return;
   }
 
@@ -168,12 +167,6 @@ void PrefetchURLLoader::OnReceiveResponse(
     response->recursive_prefetch_token = recursive_prefetch_token;
   }
 
-  if (prefetched_signed_exchange_cache_adapter_ &&
-      signed_exchange_prefetch_handler_) {
-    prefetched_signed_exchange_cache_adapter_->OnReceiveInnerResponse(
-        response.Clone());
-  }
-
   forwarding_client_->OnReceiveResponse(std::move(response));
 }
 
@@ -182,10 +175,9 @@ void PrefetchURLLoader::OnReceiveRedirect(
     network::mojom::URLResponseHeadPtr head) {
   if (prefetched_signed_exchange_cache_adapter_ &&
       signed_exchange_prefetch_handler_) {
-    prefetched_signed_exchange_cache_adapter_->OnReceiveRedirect(
-        redirect_info.new_url,
-        signed_exchange_prefetch_handler_->ComputeHeaderIntegrity(),
-        signed_exchange_prefetch_handler_->GetSignatureExpireTime());
+    prefetched_signed_exchange_cache_adapter_->OnReceiveSignedExchange(
+        signed_exchange_prefetch_handler_
+            ->TakePrefetchedSignedExchangeCacheEntry());
   }
 
   resource_request_.url = redirect_info.new_url;
diff --git a/chromium/content/browser/loader/prefetch_url_loader_service.cc b/chromium/content/browser/loader/prefetch_url_loader_service.cc
index 7f222002556..b3da44a297a 100644
--- a/chromium/content/browser/loader/prefetch_url_loader_service.cc
+++ b/chromium/content/browser/loader/prefetch_url_loader_service.cc
@@ -117,8 +117,6 @@ void PrefetchURLLoaderService::CreateLoaderAndStart(
   // request.
   network::ResourceRequest resource_request = resource_request_in;
 
-  DCHECK_EQ(static_cast<int>(blink::mojom::ResourceType::kPrefetch),
-            resource_request.resource_type);
   BindContext& current_context = *current_bind_context();
 
   if (!current_context.render_frame_host) {
@@ -247,8 +245,8 @@ bool PrefetchURLLoaderService::IsValidCrossOriginPrefetch(
     return false;
   }
 
-  // The request initiator has to match the request_initiator_site_lock - it has
-  // to be the same origin as the last committed origin in the frame.
+  // The request initiator has to match the request_initiator_origin_lock - it
+  // has to be the same origin as the last committed origin in the frame.
   const BindContext& current_context = *current_bind_context();
   // Presence of |render_frame_host| is guaranteed by the caller - the caller
   // calls earlier EnsureCrossOriginFactory which has the same DCHECK.
diff --git a/chromium/content/browser/loader/url_loader_throttles.cc b/chromium/content/browser/loader/url_loader_throttles.cc
index 3ab0ea5b489..84a1360ad07 100644
--- a/chromium/content/browser/loader/url_loader_throttles.cc
+++ b/chromium/content/browser/loader/url_loader_throttles.cc
@@ -25,6 +25,9 @@ CreateContentBrowserURLLoaderThrottles(
           request, browser_context, wc_getter, navigation_ui_data,
           frame_tree_node_id);
   variations::OmniboxURLLoaderThrottle::AppendThrottleIfNeeded(&throttles);
+  // TODO(crbug.com/1094303): Consider whether we want to use the WebContents to
+  // determine the value for variations::Owner. Alternatively, this is the
+  // browser side, and we might be fine with Owner::kUnknown.
   variations::VariationsURLLoaderThrottle::AppendThrottleIfNeeded(
       browser_context->GetVariationsClient(), &throttles);
   return throttles;