Update chromium to branch 1599.

Change-Id: I04e775a946a208bb4500d3b722bcb05c82b9d7cb
Reviewed-by: Andras Becsi <andras.becsi@digia.com>

21 files changed, 168 insertions, 464 deletions

diff --git a/chromium/content/browser/renderer_host/clipboard_message_filter.cc b/chromium/content/browser/renderer_host/clipboard_message_filter.cc
index 2ad35468244..0e2426bf224 100644
--- a/chromium/content/browser/renderer_host/clipboard_message_filter.cc
+++ b/chromium/content/browser/renderer_host/clipboard_message_filter.cc
@@ -115,23 +115,24 @@ void ClipboardMessageFilter::OnWriteObjectsSync(
 
 void ClipboardMessageFilter::OnWriteObjectsAsync(
     const ui::Clipboard::ObjectMap& objects) {
+  // This async message doesn't support shared-memory based bitmaps; they must
+  // be removed otherwise we might dereference a rubbish pointer.
+  scoped_ptr<ui::Clipboard::ObjectMap> sanitized_objects(
+      new ui::Clipboard::ObjectMap(objects));
+  sanitized_objects->erase(ui::Clipboard::CBF_SMBITMAP);
+
 #if defined(OS_WIN)
   // We cannot write directly from the IO thread, and cannot service the IPC
   // on the UI thread. We'll copy the relevant data and post a task to preform
   // the write on the UI thread.
-  ui::Clipboard::ObjectMap* long_living_objects =
-      new ui::Clipboard::ObjectMap(objects);
-
-  // This async message doesn't support shared-memory based bitmaps; they must
-  // be removed otherwise we might dereference a rubbish pointer.
-  long_living_objects->erase(ui::Clipboard::CBF_SMBITMAP);
-
   BrowserThread::PostTask(
       BrowserThread::UI,
       FROM_HERE,
-      base::Bind(&WriteObjectsOnUIThread, base::Owned(long_living_objects)));
+      base::Bind(
+          &WriteObjectsOnUIThread, base::Owned(sanitized_objects.release())));
 #else
-  GetClipboard()->WriteObjects(ui::Clipboard::BUFFER_STANDARD, objects);
+  GetClipboard()->WriteObjects(
+      ui::Clipboard::BUFFER_STANDARD, *sanitized_objects.get());
 #endif
 }
 
@@ -198,6 +199,7 @@ void ClipboardMessageFilter::OnReadImageReply(
     const SkBitmap& bitmap, IPC::Message* reply_msg) {
   base::SharedMemoryHandle image_handle = base::SharedMemory::NULLHandle();
   uint32 image_size = 0;
+  std::string reply_data;
   if (!bitmap.isNull()) {
     std::vector<unsigned char> png_data;
     SkAutoLockPixels lock(bitmap);
diff --git a/chromium/content/browser/renderer_host/compositor_impl_android.cc b/chromium/content/browser/renderer_host/compositor_impl_android.cc
index 94ab1393c84..53c42e4277a 100644
--- a/chromium/content/browser/renderer_host/compositor_impl_android.cc
+++ b/chromium/content/browser/renderer_host/compositor_impl_android.cc
@@ -394,9 +394,8 @@ scoped_ptr<cc::OutputSurface> CompositorImpl::CreateOutputSurface(
         false,
         CAUSE_FOR_GPU_LAUNCH_WEBGRAPHICSCONTEXT3DCOMMANDBUFFERIMPL_INITIALIZE,
         64 * 1024,  // command buffer size
-        std::min(full_screen_texture_size_in_bytes,
-        kDefaultStartTransferBufferSize),
-        kDefaultMinTransferBufferSize,
+        64 * 1024,  // start transfer buffer size
+        64 * 1024,  // min transfer buffer size
         std::min(3 * full_screen_texture_size_in_bytes,
                  kDefaultMaxTransferBufferSize))) {
       LOG(ERROR) << "Failed to create 3D context for compositor.";
diff --git a/chromium/content/browser/renderer_host/image_transport_factory_android.cc b/chromium/content/browser/renderer_host/image_transport_factory_android.cc
index efe9235f170..39071c9bec3 100644
--- a/chromium/content/browser/renderer_host/image_transport_factory_android.cc
+++ b/chromium/content/browser/renderer_host/image_transport_factory_android.cc
@@ -125,9 +125,8 @@ CmdBufferImageTransportFactory::CmdBufferImageTransportFactory() {
       false,
       CAUSE_FOR_GPU_LAUNCH_WEBGRAPHICSCONTEXT3DCOMMANDBUFFERIMPL_INITIALIZE,
       64 * 1024,  // command buffer size
-      std::min(full_screen_texture_size_in_bytes,
-               kDefaultStartTransferBufferSize),
-      kDefaultMinTransferBufferSize,
+      64 * 1024,  // starting buffer size
+      64 * 1024,  // min buffer size
       std::min(3 * full_screen_texture_size_in_bytes,
                kDefaultMaxTransferBufferSize));
 
diff --git a/chromium/content/browser/renderer_host/input/immediate_input_router.cc b/chromium/content/browser/renderer_host/input/immediate_input_router.cc
index 368619cc1e6..96e8bb9ac44 100644
--- a/chromium/content/browser/renderer_host/input/immediate_input_router.cc
+++ b/chromium/content/browser/renderer_host/input/immediate_input_router.cc
@@ -85,9 +85,6 @@ ImmediateInputRouter::ImmediateInputRouter(
       has_touch_handler_(false),
       touch_event_queue_(new TouchEventQueue(this)),
       gesture_event_filter_(new GestureEventFilter(this)) {
-  enable_no_touch_to_renderer_while_scrolling_ =
-      CommandLine::ForCurrentProcess()->GetSwitchValueASCII(
-          switches::kNoTouchToRendererWhileScrolling) == "1";
   DCHECK(process);
   DCHECK(client);
 }
@@ -202,7 +199,6 @@ void ImmediateInputRouter::SendKeyboardEvent(
 
 void ImmediateInputRouter::SendGestureEvent(
     const GestureEventWithLatencyInfo& gesture_event) {
-  HandleGestureScroll(gesture_event);
   if (!client_->OnSendGestureEvent(gesture_event))
     return;
   FilterAndSendWebInputEvent(gesture_event.event, gesture_event.latency, false);
@@ -256,7 +252,6 @@ void ImmediateInputRouter::SendTouchEventImmediately(
 
 void ImmediateInputRouter::SendGestureEventImmediately(
     const GestureEventWithLatencyInfo& gesture_event) {
-  HandleGestureScroll(gesture_event);
   if (!client_->OnSendGestureEventImmediately(gesture_event))
     return;
   FilterAndSendWebInputEvent(gesture_event.event, gesture_event.latency, false);
@@ -561,19 +556,4 @@ void ImmediateInputRouter::ProcessTouchAck(
   touch_event_queue_->ProcessTouchAck(ack_result, latency_info);
 }
 
-void ImmediateInputRouter::HandleGestureScroll(
-    const GestureEventWithLatencyInfo& gesture_event) {
-  if (!enable_no_touch_to_renderer_while_scrolling_)
-    return;
-
-  // Once scrolling is started stop forwarding touch move events to renderer.
-  if (gesture_event.event.type == WebInputEvent::GestureScrollBegin)
-    touch_event_queue_->set_no_touch_move_to_renderer(true);
-
-  if (gesture_event.event.type == WebInputEvent::GestureScrollEnd ||
-      gesture_event.event.type == WebInputEvent::GestureFlingStart) {
-    touch_event_queue_->set_no_touch_move_to_renderer(false);
-  }
-}
-
 }  // namespace content
diff --git a/chromium/content/browser/renderer_host/input/immediate_input_router.h b/chromium/content/browser/renderer_host/input/immediate_input_router.h
index 0bfa19f111e..270ca3dc67e 100644
--- a/chromium/content/browser/renderer_host/input/immediate_input_router.h
+++ b/chromium/content/browser/renderer_host/input/immediate_input_router.h
@@ -73,8 +73,6 @@ class CONTENT_EXPORT ImmediateInputRouter
   }
 
 private:
-  friend class ImmediateInputRouterTest;
-
   // TouchEventQueueClient
   virtual void OnTouchEventAck(const TouchEventWithLatencyInfo& event,
                                InputEventAckState ack_result) OVERRIDE;
@@ -129,9 +127,6 @@ private:
   void ProcessTouchAck(InputEventAckState ack_result,
                        const ui::LatencyInfo& latency_info);
 
-  void HandleGestureScroll(
-      const GestureEventWithLatencyInfo& gesture_event);
-
   int routing_id() const { return routing_id_; }
 
 
@@ -191,10 +186,6 @@ private:
   // not sent to the renderer.
   bool has_touch_handler_;
 
-  // Whether enabling the optimization that sending no touch move events to
-  // renderer while scrolling.
-  bool enable_no_touch_to_renderer_while_scrolling_;
-
   scoped_ptr<TouchEventQueue> touch_event_queue_;
   scoped_ptr<GestureEventFilter> gesture_event_filter_;
 
diff --git a/chromium/content/browser/renderer_host/input/immediate_input_router_unittest.cc b/chromium/content/browser/renderer_host/input/immediate_input_router_unittest.cc
index 371e02e01b3..ed725ee1a10 100644
--- a/chromium/content/browser/renderer_host/input/immediate_input_router_unittest.cc
+++ b/chromium/content/browser/renderer_host/input/immediate_input_router_unittest.cc
@@ -548,14 +548,6 @@ class ImmediateInputRouterTest : public testing::Test {
     return touch_event_queue()->GetLatestEvent().event;
   }
 
-  void EnableNoTouchToRendererWhileScrolling() {
-    input_router_->enable_no_touch_to_renderer_while_scrolling_ = true;
-  }
-
-  bool no_touch_move_to_renderer() {
-    return touch_event_queue()->no_touch_move_to_renderer_;
-  }
-
   TouchEventQueue* touch_event_queue() const {
     return input_router_->touch_event_queue();
   }
@@ -2173,93 +2165,4 @@ TEST_F(ImmediateInputRouterTest, UnhandledWheelEvent) {
   EXPECT_EQ(client_->acked_wheel_event().deltaY, -5);
 }
 
-// Tests that no touch move events are sent to renderer during scrolling.
-TEST_F(ImmediateInputRouterTest, NoTouchMoveWhileScroll) {
-  EnableNoTouchToRendererWhileScrolling();
-  set_debounce_interval_time_ms(0);
-  input_router_->OnMessageReceived(ViewHostMsg_HasTouchEventHandlers(0, true));
-  process_->sink().ClearMessages();
-
-  // First touch press.
-  PressTouchPoint(0, 1);
-  SendTouchEvent();
-  EXPECT_EQ(1U, process_->sink().message_count());
-  process_->sink().ClearMessages();
-  SendInputEventACK(WebInputEvent::TouchStart,
-                    INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
-
-  // Touch move will trigger scroll.
-  MoveTouchPoint(0, 20, 5);
-  SendTouchEvent();
-  EXPECT_EQ(1U, process_->sink().message_count());
-  process_->sink().ClearMessages();
-  SendInputEventACK(WebInputEvent::TouchMove,
-                    INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
-
-  SimulateGestureEvent(WebInputEvent::GestureScrollBegin,
-                       WebGestureEvent::Touchscreen);
-  EXPECT_EQ(1U, process_->sink().message_count());
-  EXPECT_TRUE(no_touch_move_to_renderer());
-  process_->sink().ClearMessages();
-  SendInputEventACK(WebInputEvent::GestureScrollBegin,
-                    INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
-
-  // Touch move should not be sent to renderer.
-  MoveTouchPoint(0, 30, 5);
-  SendTouchEvent();
-  EXPECT_EQ(0U, process_->sink().message_count());
-  process_->sink().ClearMessages();
-
-  // Touch moves become ScrollUpdate.
-  SimulateGestureScrollUpdateEvent(20, 4, 0);
-  EXPECT_TRUE(no_touch_move_to_renderer());
-  process_->sink().ClearMessages();
-  SendInputEventACK(WebInputEvent::GestureScrollUpdate,
-                    INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
-
-  // Touch move should not be sent to renderer.
-  MoveTouchPoint(0, 65, 10);
-  SendTouchEvent();
-  EXPECT_EQ(0U, process_->sink().message_count());
-  process_->sink().ClearMessages();
-
-  // Touch end should still be sent to renderer.
-  ReleaseTouchPoint(0);
-  SendTouchEvent();
-  EXPECT_EQ(1U, process_->sink().message_count());
-  process_->sink().ClearMessages();
-  SendInputEventACK(WebInputEvent::TouchEnd,
-                    INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
-
-  // On GestureScrollEnd, resume sending touch moves to renderer.
-  SimulateGestureEvent(WebKit::WebInputEvent::GestureScrollEnd,
-                       WebGestureEvent::Touchscreen);
-  EXPECT_EQ(1U, process_->sink().message_count());
-  EXPECT_FALSE(no_touch_move_to_renderer());
-  process_->sink().ClearMessages();
-  SendInputEventACK(WebInputEvent::GestureScrollEnd,
-                    INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
-
-  // Now touch events should come through to renderer.
-  PressTouchPoint(80, 10);
-  SendTouchEvent();
-  EXPECT_EQ(1U, process_->sink().message_count());
-  process_->sink().ClearMessages();
-  SendInputEventACK(WebInputEvent::TouchStart,
-                    INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
-
-  MoveTouchPoint(0, 80, 20);
-  SendTouchEvent();
-  EXPECT_EQ(1U, process_->sink().message_count());
-  process_->sink().ClearMessages();
-  SendInputEventACK(WebInputEvent::TouchMove,
-                    INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
-
-  ReleaseTouchPoint(0);
-  SendTouchEvent();
-  EXPECT_EQ(1U, process_->sink().message_count());
-  process_->sink().ClearMessages();
-  SendInputEventACK(WebInputEvent::TouchEnd,
-                    INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
-}
 }  // namespace content
diff --git a/chromium/content/browser/renderer_host/input/touch_event_queue.cc b/chromium/content/browser/renderer_host/input/touch_event_queue.cc
index e22c05d0f80..c1675b9952d 100644
--- a/chromium/content/browser/renderer_host/input/touch_event_queue.cc
+++ b/chromium/content/browser/renderer_host/input/touch_event_queue.cc
@@ -91,8 +91,7 @@ class CoalescedWebTouchEvent {
 
 TouchEventQueue::TouchEventQueue(TouchEventQueueClient* client)
     : client_(client),
-      dispatching_touch_ack_(false),
-      no_touch_move_to_renderer_(false) {
+      dispatching_touch_ack_(false) {
   DCHECK(client);
 }
 
@@ -213,10 +212,6 @@ bool TouchEventQueue::ShouldForwardToRenderer(
   if (event.type == WebKit::WebInputEvent::TouchStart)
     return true;
 
-  if (event.type == WebKit::WebInputEvent::TouchMove &&
-      no_touch_move_to_renderer_)
-    return false;
-
   for (unsigned int i = 0; i < event.touchesLength; ++i) {
     const WebKit::WebTouchPoint& point = event.touches[i];
     // If a point has been stationary, then don't take it into account.
diff --git a/chromium/content/browser/renderer_host/input/touch_event_queue.h b/chromium/content/browser/renderer_host/input/touch_event_queue.h
index 358fae9c50d..23dda66c38b 100644
--- a/chromium/content/browser/renderer_host/input/touch_event_queue.h
+++ b/chromium/content/browser/renderer_host/input/touch_event_queue.h
@@ -61,10 +61,6 @@ class TouchEventQueue {
     return touch_queue_.empty();
   }
 
-  void set_no_touch_move_to_renderer(bool value) {
-    no_touch_move_to_renderer_ = value;
-  }
-
  private:
   friend class MockRenderWidgetHost;
   friend class ImmediateInputRouterTest;
@@ -92,11 +88,6 @@ class TouchEventQueue {
   // Used to defer touch forwarding when ack dispatch triggers |QueueEvent()|.
   bool dispatching_touch_ack_;
 
-  // Don't send touch move events to renderer. This is enabled when the page
-  // is scrolling. This behaviour is currently enabled only on aura behind a
-  // flag.
-  bool no_touch_move_to_renderer_;
-
   DISALLOW_COPY_AND_ASSIGN(TouchEventQueue);
 };
 
diff --git a/chromium/content/browser/renderer_host/input/web_input_event_builders_win.cc b/chromium/content/browser/renderer_host/input/web_input_event_builders_win.cc
index a5a9b20f615..ba081fd429b 100644
--- a/chromium/content/browser/renderer_host/input/web_input_event_builders_win.cc
+++ b/chromium/content/browser/renderer_host/input/web_input_event_builders_win.cc
@@ -428,20 +428,22 @@ WebMouseWheelEventBuilder::Build(HWND hwnd, UINT message,
   // reading articles.
   static const float kScrollbarPixelsPerLine = 100.0f / 3.0f;
   wheel_delta /= WHEEL_DELTA;
-  float scroll_delta = wheel_delta * kScrollbarPixelsPerLine;
+  float scroll_delta = wheel_delta;
   if (horizontal_scroll) {
     unsigned long scroll_chars = kDefaultScrollCharsPerWheelDelta;
     SystemParametersInfo(SPI_GETWHEELSCROLLCHARS, 0, &scroll_chars, 0);
     // TODO(pkasting): Should probably have a different multiplier
     // scrollbarPixelsPerChar here.
-    scroll_delta *= static_cast<float>(scroll_chars);
+    scroll_delta *= static_cast<float>(scroll_chars) * kScrollbarPixelsPerLine;
   } else {
     unsigned long scroll_lines = kDefaultScrollLinesPerWheelDelta;
     SystemParametersInfo(SPI_GETWHEELSCROLLLINES, 0, &scroll_lines, 0);
     if (scroll_lines == WHEEL_PAGESCROLL)
       result.scrollByPage = true;
-    if (!result.scrollByPage)
-      scroll_delta *= static_cast<float>(scroll_lines);
+    if (!result.scrollByPage) {
+      scroll_delta *=
+          static_cast<float>(scroll_lines) * kScrollbarPixelsPerLine;
+    }
   }
 
   // Set scroll amount based on above calculations.  WebKit expects positive
diff --git a/chromium/content/browser/renderer_host/media/desktop_capture_device.cc b/chromium/content/browser/renderer_host/media/desktop_capture_device.cc
index 9549633e80d..5a03e465533 100644
--- a/chromium/content/browser/renderer_host/media/desktop_capture_device.cc
+++ b/chromium/content/browser/renderer_host/media/desktop_capture_device.cc
@@ -23,19 +23,7 @@
 namespace content {
 
 namespace {
-
 const int kBytesPerPixel = 4;
-
-webrtc::DesktopRect ComputeLetterboxRect(
-    const webrtc::DesktopSize& max_size,
-    const webrtc::DesktopSize& source_size) {
-  gfx::Rect result = media::ComputeLetterboxRegion(
-      gfx::Rect(0, 0, max_size.width(), max_size.height()),
-      gfx::Size(source_size.width(), source_size.height()));
-  return webrtc::DesktopRect::MakeLTRB(
-      result.x(), result.y(), result.right(), result.bottom());
-}
-
 }  // namespace
 
 class DesktopCaptureDevice::Core
@@ -46,7 +34,8 @@ class DesktopCaptureDevice::Core
        scoped_ptr<webrtc::DesktopCapturer> capturer);
 
   // Implementation of VideoCaptureDevice methods.
-  void Allocate(const media::VideoCaptureCapability& capture_format,
+  void Allocate(int width, int height,
+                int frame_rate,
                 EventHandler* event_handler);
   void Start();
   void Stop();
@@ -62,16 +51,11 @@ class DesktopCaptureDevice::Core
 
   // Helper methods that run on the |task_runner_|. Posted from the
   // corresponding public methods.
-  void DoAllocate(const media::VideoCaptureCapability& capture_format);
+  void DoAllocate(int width, int height, int frame_rate);
   void DoStart();
   void DoStop();
   void DoDeAllocate();
 
-  // Chooses new output properties based on the supplied source size and the
-  // properties requested to Allocate(), and dispatches OnFrameInfo[Changed]
-  // notifications.
-  void RefreshCaptureFormat(const webrtc::DesktopSize& frame_size);
-
   // Helper to schedule capture tasks.
   void ScheduleCaptureTimer();
 
@@ -94,23 +78,24 @@ class DesktopCaptureDevice::Core
   base::Lock event_handler_lock_;
   EventHandler* event_handler_;
 
-  // Requested video capture format (width, height, frame rate, etc).
-  media::VideoCaptureCapability requested_format_;
+  // Requested size specified to Allocate().
+  webrtc::DesktopSize requested_size_;
 
-  // Actual video capture format being generated.
-  media::VideoCaptureCapability capture_format_;
+  // Frame rate specified to Allocate().
+  int frame_rate_;
 
-  // Size of frame most recently captured from the source.
-  webrtc::DesktopSize previous_frame_size_;
+  // Empty until the first frame has been captured, and the output dimensions
+  // chosen based on the capture frame's size, and any caller-supplied
+  // size constraints.
+  webrtc::DesktopSize output_size_;
 
-  // DesktopFrame into which captured frames are down-scaled and/or letterboxed,
-  // depending upon the caller's requested capture capabilities. If frames can
-  // be returned to the caller directly then this is NULL.
-  scoped_ptr<webrtc::DesktopFrame> output_frame_;
+  // Size of the most recently received frame.
+  webrtc::DesktopSize previous_frame_size_;
 
-  // Sub-rectangle of |output_frame_| into which the source will be scaled
-  // and/or letterboxed.
-  webrtc::DesktopRect output_rect_;
+  // DesktopFrame into which captured frames are scaled, if the source size does
+  // not match |output_size_|. If the source and output have the same dimensions
+  // then this is NULL.
+  scoped_ptr<webrtc::DesktopFrame> scaled_frame_;
 
   // True between DoStart() and DoStop(). Can't just check |event_handler_|
   // because |event_handler_| is used on the caller thread.
@@ -140,12 +125,12 @@ DesktopCaptureDevice::Core::Core(
 DesktopCaptureDevice::Core::~Core() {
 }
 
-void DesktopCaptureDevice::Core::Allocate(
-    const media::VideoCaptureCapability& capture_format,
-    EventHandler* event_handler) {
-  DCHECK_GT(capture_format.width, 0);
-  DCHECK_GT(capture_format.height, 0);
-  DCHECK_GT(capture_format.frame_rate, 0);
+void DesktopCaptureDevice::Core::Allocate(int width, int height,
+                                         int frame_rate,
+                                         EventHandler* event_handler) {
+  DCHECK_GT(width, 0);
+  DCHECK_GT(height, 0);
+  DCHECK_GT(frame_rate, 0);
 
   {
     base::AutoLock auto_lock(event_handler_lock_);
@@ -154,7 +139,7 @@ void DesktopCaptureDevice::Core::Allocate(
 
   task_runner_->PostTask(
       FROM_HERE,
-      base::Bind(&Core::DoAllocate, this, capture_format));
+      base::Bind(&Core::DoAllocate, this, width, height, frame_rate));
 }
 
 void DesktopCaptureDevice::Core::Start() {
@@ -195,76 +180,95 @@ void DesktopCaptureDevice::Core::OnCaptureCompleted(
 
   scoped_ptr<webrtc::DesktopFrame> owned_frame(frame);
 
-  // Handle initial frame size and size changes.
-  RefreshCaptureFormat(frame->size());
+  // If an |output_size_| hasn't yet been chosen then choose one, based upon
+  // the source frame size and the requested size supplied to Allocate().
+  if (output_size_.is_empty()) {
+    // Treat the requested size as upper bounds on width & height.
+    // TODO(wez): Constraints should be passed from getUserMedia to Allocate.
+    output_size_.set(
+        std::min(frame->size().width(), requested_size_.width()),
+        std::min(frame->size().height(), requested_size_.height()));
+
+    // Inform the EventHandler of the output dimensions, format and frame rate.
+    media::VideoCaptureCapability caps;
+    caps.width = output_size_.width();
+    caps.height = output_size_.height();
+    caps.frame_rate = frame_rate_;
+    caps.color = media::VideoCaptureCapability::kARGB;
+    caps.expected_capture_delay =
+        base::Time::kMillisecondsPerSecond / frame_rate_;
+    caps.interlaced = false;
+
+    base::AutoLock auto_lock(event_handler_lock_);
+    if (event_handler_)
+      event_handler_->OnFrameInfo(caps);
+  }
 
   if (!started_)
     return;
 
-  webrtc::DesktopSize output_size(capture_format_.width,
-                                  capture_format_.height);
-  size_t output_bytes = output_size.width() * output_size.height() *
+  size_t output_bytes = output_size_.width() * output_size_.height() *
       webrtc::DesktopFrame::kBytesPerPixel;
-  const uint8_t* output_data = NULL;
 
-  if (frame->size().equals(output_size)) {
+  if (frame->size().equals(output_size_)) {
     // If the captured frame matches the output size, we can return the pixel
     // data directly, without scaling.
-    output_data = frame->data();
-  } else {
-    // Otherwise we need to down-scale and/or letterbox to the target format.
-
-    // Allocate a buffer of the correct size to scale the frame into.
-    // |output_frame_| is cleared whenever |output_rect_| changes, so we don't
-    // need to worry about clearing out stale pixel data in letterboxed areas.
-    if (!output_frame_) {
-      output_frame_.reset(new webrtc::BasicDesktopFrame(output_size));
-      memset(output_frame_->data(), 0, output_bytes);
+    scaled_frame_.reset();
+
+    base::AutoLock auto_lock(event_handler_lock_);
+    if (event_handler_) {
+      event_handler_->OnIncomingCapturedFrame(
+          frame->data(), output_bytes, base::Time::Now(), 0, false, false);
     }
-    DCHECK(output_frame_->size().equals(output_size));
-
-    // TODO(wez): Optimize this to scale only changed portions of the output,
-    // using ARGBScaleClip().
-    uint8_t* output_rect_data = output_frame_->data() +
-        output_frame_->stride() * output_rect_.top() +
-        webrtc::DesktopFrame::kBytesPerPixel * output_rect_.left();
-    libyuv::ARGBScale(frame->data(), frame->stride(),
-                      frame->size().width(), frame->size().height(),
-                      output_rect_data, output_frame_->stride(),
-                      output_rect_.width(), output_rect_.height(),
-                      libyuv::kFilterBilinear);
-    output_data = output_frame_->data();
+    return;
+  }
+
+  // If the output size differs from the frame size (e.g. the source has changed
+  // from its original dimensions, or the caller specified size constraints)
+  // then we need to scale the image.
+  if (!scaled_frame_)
+    scaled_frame_.reset(new webrtc::BasicDesktopFrame(output_size_));
+  DCHECK(scaled_frame_->size().equals(output_size_));
+
+  // If the source frame size changed then clear |scaled_frame_|'s pixels.
+  if (!previous_frame_size_.equals(frame->size())) {
+    previous_frame_size_ = frame->size();
+    memset(scaled_frame_->data(), 0, output_bytes);
   }
 
+  // Determine the output size preserving aspect, and center in output buffer.
+  gfx::Rect scaled_rect = media::ComputeLetterboxRegion(
+      gfx::Rect(0, 0, output_size_.width(), output_size_.height()),
+      gfx::Size(frame->size().width(), frame->size().height()));
+  uint8* scaled_data = scaled_frame_->data() +
+      scaled_frame_->stride() * scaled_rect.y() +
+      webrtc::DesktopFrame::kBytesPerPixel * scaled_rect.x();
+
+  // TODO(wez): Optimize this to scale only changed portions of the output,
+  // using ARGBScaleClip().
+  libyuv::ARGBScale(frame->data(), frame->stride(),
+                    frame->size().width(), frame->size().height(),
+                    scaled_data, scaled_frame_->stride(),
+                    scaled_rect.width(), scaled_rect.height(),
+                    libyuv::kFilterBilinear);
+
   base::AutoLock auto_lock(event_handler_lock_);
   if (event_handler_) {
-    event_handler_->OnIncomingCapturedFrame(output_data, output_bytes,
-                                            base::Time::Now(), 0, false, false);
+    event_handler_->OnIncomingCapturedFrame(
+        scaled_frame_->data(), output_bytes,
+        base::Time::Now(), 0, false, false);
   }
 }
 
-void DesktopCaptureDevice::Core::DoAllocate(
-    const media::VideoCaptureCapability& capture_format) {
+void DesktopCaptureDevice::Core::DoAllocate(int width,
+                                            int height,
+                                            int frame_rate) {
   DCHECK(task_runner_->RunsTasksOnCurrentThread());
   DCHECK(desktop_capturer_);
 
-  requested_format_ = capture_format;
-
-  // Store requested frame rate and calculate expected delay.
-  capture_format_.frame_rate = requested_format_.frame_rate;
-  capture_format_.expected_capture_delay =
-      base::Time::kMillisecondsPerSecond / requested_format_.frame_rate;
-
-  // Support dynamic changes in resolution only if requester also does.
-  if (requested_format_.frame_size_type ==
-      media::VariableResolutionVideoCaptureDevice) {
-    capture_format_.frame_size_type =
-        media::VariableResolutionVideoCaptureDevice;
-  }
-
-  // This capturer always outputs ARGB, non-interlaced.
-  capture_format_.color = media::VideoCaptureCapability::kARGB;
-  capture_format_.interlaced = false;
+  requested_size_.set(width, height);
+  output_size_.set(0, 0);
+  frame_rate_ = frame_rate;
 
   desktop_capturer_->Start(this);
 
@@ -284,63 +288,14 @@ void DesktopCaptureDevice::Core::DoStart() {
 void DesktopCaptureDevice::Core::DoStop() {
   DCHECK(task_runner_->RunsTasksOnCurrentThread());
   started_ = false;
-  output_frame_.reset();
-  previous_frame_size_.set(0, 0);
+  scaled_frame_.reset();
 }
 
 void DesktopCaptureDevice::Core::DoDeAllocate() {
   DCHECK(task_runner_->RunsTasksOnCurrentThread());
   DoStop();
   desktop_capturer_.reset();
-}
-
-void DesktopCaptureDevice::Core::RefreshCaptureFormat(
-    const webrtc::DesktopSize& frame_size) {
-  if (previous_frame_size_.equals(frame_size))
-    return;
-
-  // Clear the output frame, if any, since it will either need resizing, or
-  // clearing of stale data in letterbox areas, anyway.
-  output_frame_.reset();
-
-  if (previous_frame_size_.is_empty() ||
-      requested_format_.frame_size_type ==
-          media::VariableResolutionVideoCaptureDevice) {
-    // If this is the first frame, or the receiver supports variable resolution
-    // then determine the output size by treating the requested width & height
-    // as maxima.
-    if (frame_size.width() > requested_format_.width ||
-        frame_size.height() > requested_format_.height) {
-      output_rect_ = ComputeLetterboxRect(
-          webrtc::DesktopSize(requested_format_.width,
-                              requested_format_.height),
-          frame_size);
-      output_rect_.Translate(-output_rect_.left(), -output_rect_.top());
-    } else {
-      output_rect_ = webrtc::DesktopRect::MakeSize(frame_size);
-    }
-    capture_format_.width = output_rect_.width();
-    capture_format_.height = output_rect_.height();
-
-    {
-      base::AutoLock auto_lock(event_handler_lock_);
-      if (event_handler_) {
-        if (previous_frame_size_.is_empty()) {
-          event_handler_->OnFrameInfo(capture_format_);
-        } else {
-          event_handler_->OnFrameInfoChanged(capture_format_);
-        }
-      }
-    }
-  } else {
-    // Otherwise the output frame size cannot change, so just scale and
-    // letterbox.
-    output_rect_ = ComputeLetterboxRect(
-        webrtc::DesktopSize(capture_format_.width, capture_format_.height),
-        frame_size);
-  }
-
-  previous_frame_size_ = frame_size;
+  output_size_.set(0, 0);
 }
 
 void DesktopCaptureDevice::Core::ScheduleCaptureTimer() {
@@ -348,7 +303,7 @@ void DesktopCaptureDevice::Core::ScheduleCaptureTimer() {
   capture_task_posted_ = true;
   task_runner_->PostDelayedTask(
       FROM_HERE, base::Bind(&Core::OnCaptureTimer, this),
-      base::TimeDelta::FromSeconds(1) / capture_format_.frame_rate);
+      base::TimeDelta::FromSeconds(1) / frame_rate_);
 }
 
 void DesktopCaptureDevice::Core::OnCaptureTimer() {
@@ -439,8 +394,11 @@ DesktopCaptureDevice::~DesktopCaptureDevice() {
 
 void DesktopCaptureDevice::Allocate(
     const media::VideoCaptureCapability& capture_format,
-    EventHandler* event_handler) {
-  core_->Allocate(capture_format, event_handler);
+    EventHandler* observer) {
+  core_->Allocate(capture_format.width,
+                  capture_format.height,
+                  capture_format.frame_rate,
+                  observer);
 }
 
 void DesktopCaptureDevice::Start() {
diff --git a/chromium/content/browser/renderer_host/media/desktop_capture_device_unittest.cc b/chromium/content/browser/renderer_host/media/desktop_capture_device_unittest.cc
index cf050f5a210..0f14585ea90 100644
--- a/chromium/content/browser/renderer_host/media/desktop_capture_device_unittest.cc
+++ b/chromium/content/browser/renderer_host/media/desktop_capture_device_unittest.cc
@@ -17,9 +17,7 @@
 #include "third_party/webrtc/modules/desktop_capture/screen_capturer.h"
 
 using ::testing::_;
-using ::testing::AnyNumber;
 using ::testing::DoAll;
-using ::testing::Expectation;
 using ::testing::InvokeWithoutArgs;
 using ::testing::SaveArg;
 
@@ -27,10 +25,6 @@ namespace content {
 
 namespace {
 
-MATCHER_P2(EqualsCaptureCapability, width, height, "") {
-  return arg.width == width && arg.height == height;
-}
-
 const int kTestFrameWidth1 = 100;
 const int kTestFrameHeight1 = 100;
 const int kTestFrameWidth2 = 200;
@@ -44,8 +38,6 @@ class MockFrameObserver : public media::VideoCaptureDevice::EventHandler {
   MOCK_METHOD0(ReserveOutputBuffer, scoped_refptr<media::VideoFrame>());
   MOCK_METHOD0(OnError, void());
   MOCK_METHOD1(OnFrameInfo, void(const media::VideoCaptureCapability& info));
-  MOCK_METHOD1(OnFrameInfoChanged,
-      void(const media::VideoCaptureCapability& info));
   MOCK_METHOD6(OnIncomingCapturedFrame, void(const uint8* data,
                                              int length,
                                              base::Time timestamp,
@@ -149,9 +141,8 @@ TEST_F(DesktopCaptureDeviceTest, MAYBE_Capture) {
   EXPECT_EQ(caps.width * caps.height * 4, frame_size);
 }
 
-// Test that screen capturer behaves correctly if the source frame size changes
-// but the caller cannot cope with variable resolution output.
-TEST_F(DesktopCaptureDeviceTest, ScreenResolutionChangeConstantResolution) {
+// Test that screen capturer can handle resolution change without crashing.
+TEST_F(DesktopCaptureDeviceTest, ScreenResolutionChange) {
   FakeScreenCapturer* mock_capturer = new FakeScreenCapturer();
 
   DesktopCaptureDevice capture_device(
@@ -163,14 +154,11 @@ TEST_F(DesktopCaptureDeviceTest, ScreenResolutionChangeConstantResolution) {
   int frame_size;
 
   MockFrameObserver frame_observer;
-  Expectation frame_info_called = EXPECT_CALL(frame_observer, OnFrameInfo(_))
+  EXPECT_CALL(frame_observer, OnFrameInfo(_))
       .WillOnce(SaveArg<0>(&caps));
-  EXPECT_CALL(frame_observer, OnFrameInfoChanged(_))
-      .Times(0);
   EXPECT_CALL(frame_observer, OnError())
       .Times(0);
   EXPECT_CALL(frame_observer, OnIncomingCapturedFrame(_, _, _, _, _, _))
-      .After(frame_info_called)
       .WillRepeatedly(DoAll(
           SaveArg<1>(&frame_size),
           InvokeWithoutArgs(&done_event, &base::WaitableEvent::Signal)));
@@ -183,16 +171,13 @@ TEST_F(DesktopCaptureDeviceTest, ScreenResolutionChangeConstantResolution) {
       0,
       false,
       media::ConstantResolutionVideoCaptureDevice);
-
   capture_device.Allocate(capture_format, &frame_observer);
   capture_device.Start();
-
-  // Capture at least two frames, to ensure that the source frame size has
-  // changed while capturing.
+  // Capture first frame.
   EXPECT_TRUE(done_event.TimedWait(TestTimeouts::action_max_timeout()));
   done_event.Reset();
+  // Capture second frame.
   EXPECT_TRUE(done_event.TimedWait(TestTimeouts::action_max_timeout()));
-
   capture_device.Stop();
   capture_device.DeAllocate();
 
@@ -205,67 +190,4 @@ TEST_F(DesktopCaptureDeviceTest, ScreenResolutionChangeConstantResolution) {
   EXPECT_EQ(caps.width * caps.height * 4, frame_size);
 }
 
-// Test that screen capturer behaves correctly if the source frame size changes
-// and the caller can cope with variable resolution output.
-TEST_F(DesktopCaptureDeviceTest, ScreenResolutionChangeVariableResolution) {
-  FakeScreenCapturer* mock_capturer = new FakeScreenCapturer();
-
-  DesktopCaptureDevice capture_device(
-      worker_pool_->GetSequencedTaskRunner(worker_pool_->GetSequenceToken()),
-      scoped_ptr<webrtc::DesktopCapturer>(mock_capturer));
-
-  media::VideoCaptureCapability caps;
-  base::WaitableEvent done_event(false, false);
-
-  MockFrameObserver frame_observer;
-  Expectation frame_info_called = EXPECT_CALL(frame_observer, OnFrameInfo(_))
-      .WillOnce(SaveArg<0>(&caps));
-  Expectation first_info_changed = EXPECT_CALL(frame_observer,
-      OnFrameInfoChanged(EqualsCaptureCapability(kTestFrameWidth2,
-                                                 kTestFrameHeight2)))
-      .After(frame_info_called);
-  Expectation second_info_changed = EXPECT_CALL(frame_observer,
-      OnFrameInfoChanged(EqualsCaptureCapability(kTestFrameWidth1,
-                                                 kTestFrameHeight1)))
-      .After(first_info_changed);
-  EXPECT_CALL(frame_observer, OnFrameInfoChanged(_))
-      .Times(AnyNumber())
-      .After(second_info_changed);
-  EXPECT_CALL(frame_observer, OnError())
-      .Times(0);
-  EXPECT_CALL(frame_observer, OnIncomingCapturedFrame(_, _, _, _, _, _))
-      .After(frame_info_called)
-      .WillRepeatedly(
-          InvokeWithoutArgs(&done_event, &base::WaitableEvent::Signal));
-
-  media::VideoCaptureCapability capture_format(
-      kTestFrameWidth2,
-      kTestFrameHeight2,
-      kFrameRate,
-      media::VideoCaptureCapability::kI420,
-      0,
-      false,
-      media::VariableResolutionVideoCaptureDevice);
-
-  capture_device.Allocate(capture_format, &frame_observer);
-  capture_device.Start();
-
-  // Capture at least three frames, to ensure that the source frame size has
-  // changed at least twice while capturing.
-  EXPECT_TRUE(done_event.TimedWait(TestTimeouts::action_max_timeout()));
-  done_event.Reset();
-  EXPECT_TRUE(done_event.TimedWait(TestTimeouts::action_max_timeout()));
-  done_event.Reset();
-  EXPECT_TRUE(done_event.TimedWait(TestTimeouts::action_max_timeout()));
-
-  capture_device.Stop();
-  capture_device.DeAllocate();
-
-  EXPECT_EQ(kTestFrameWidth1, caps.width);
-  EXPECT_EQ(kTestFrameHeight1, caps.height);
-  EXPECT_EQ(kFrameRate, caps.frame_rate);
-  EXPECT_EQ(media::VideoCaptureCapability::kARGB, caps.color);
-  EXPECT_FALSE(caps.interlaced);
-}
-
 }  // namespace content
diff --git a/chromium/content/browser/renderer_host/p2p/OWNERS b/chromium/content/browser/renderer_host/p2p/OWNERS
index f12c2d60e83..17c3a1e6983 100644
--- a/chromium/content/browser/renderer_host/p2p/OWNERS
+++ b/chromium/content/browser/renderer_host/p2p/OWNERS
@@ -1,3 +1,2 @@
-hclam@chromium.org
-mallinath@chromium.org
 sergeyu@chromium.org
+hclam@chromium.org
diff --git a/chromium/content/browser/renderer_host/p2p/socket_host_tcp.cc b/chromium/content/browser/renderer_host/p2p/socket_host_tcp.cc
index 314026e2438..8e13bf8f5b5 100644
--- a/chromium/content/browser/renderer_host/p2p/socket_host_tcp.cc
+++ b/chromium/content/browser/renderer_host/p2p/socket_host_tcp.cc
@@ -136,9 +136,7 @@ void P2PSocketHostTcpBase::OnConnected(int result) {
     StartTls();
   } else {
     if (IsPseudoTlsClientSocket(type_)) {
-      scoped_ptr<net::StreamSocket> transport_socket = socket_.Pass();
-      socket_.reset(
-          new jingle_glue::FakeSSLClientSocket(transport_socket.Pass()));
+      socket_.reset(new jingle_glue::FakeSSLClientSocket(socket_.release()));
     }
 
     // If we are not doing TLS, we are ready to send data now.
@@ -157,7 +155,7 @@ void P2PSocketHostTcpBase::StartTls() {
 
   scoped_ptr<net::ClientSocketHandle> socket_handle(
       new net::ClientSocketHandle());
-  socket_handle->SetSocket(socket_.Pass());
+  socket_handle->set_socket(socket_.release());
 
   net::SSLClientSocketContext context;
   context.cert_verifier = url_context_->GetURLRequestContext()->cert_verifier();
@@ -173,8 +171,8 @@ void P2PSocketHostTcpBase::StartTls() {
       net::ClientSocketFactory::GetDefaultFactory();
   DCHECK(socket_factory);
 
-  socket_ = socket_factory->CreateSSLClientSocket(
-      socket_handle.Pass(), dest_host_port_pair, ssl_config, context);
+  socket_.reset(socket_factory->CreateSSLClientSocket(
+      socket_handle.release(), dest_host_port_pair, ssl_config, context));
   int status = socket_->Connect(
       base::Bind(&P2PSocketHostTcpBase::ProcessTlsConnectDone,
                  base::Unretained(this)));
diff --git a/chromium/content/browser/renderer_host/pepper/pepper_tcp_socket.cc b/chromium/content/browser/renderer_host/pepper/pepper_tcp_socket.cc
index 05b2e09993a..f05be8783ed 100644
--- a/chromium/content/browser/renderer_host/pepper/pepper_tcp_socket.cc
+++ b/chromium/content/browser/renderer_host/pepper/pepper_tcp_socket.cc
@@ -141,16 +141,16 @@ void PepperTCPSocket::SSLHandshake(
   connection_state_ = SSL_HANDSHAKE_IN_PROGRESS;
   // TODO(raymes,rsleevi): Use trusted/untrusted certificates when connecting.
 
-  scoped_ptr<net::ClientSocketHandle> handle(new net::ClientSocketHandle());
-  handle->SetSocket(socket_.Pass());
+  net::ClientSocketHandle* handle = new net::ClientSocketHandle();
+  handle->set_socket(socket_.release());
   net::ClientSocketFactory* factory =
       net::ClientSocketFactory::GetDefaultFactory();
   net::HostPortPair host_port_pair(server_name, server_port);
   net::SSLClientSocketContext ssl_context;
   ssl_context.cert_verifier = manager_->GetCertVerifier();
   ssl_context.transport_security_state = manager_->GetTransportSecurityState();
-  socket_ = factory->CreateSSLClientSocket(
-      handle.Pass(), host_port_pair, manager_->ssl_config(), ssl_context);
+  socket_.reset(factory->CreateSSLClientSocket(
+      handle, host_port_pair, manager_->ssl_config(), ssl_context));
   if (!socket_) {
     LOG(WARNING) << "Failed to create an SSL client socket.";
     OnSSLHandshakeCompleted(net::ERR_UNEXPECTED);
diff --git a/chromium/content/browser/renderer_host/render_message_filter.cc b/chromium/content/browser/renderer_host/render_message_filter.cc
index fc84eabf2bd..29e1e1f199a 100644
--- a/chromium/content/browser/renderer_host/render_message_filter.cc
+++ b/chromium/content/browser/renderer_host/render_message_filter.cc
@@ -459,6 +459,7 @@ void RenderMessageFilter::OnCreateWindow(
   bool can_create_window =
       GetContentClient()->browser()->CanCreateWindow(
           params.opener_url,
+          params.opener_top_level_frame_url,
           params.opener_security_origin,
           params.window_container_type,
           params.target_url,
diff --git a/chromium/content/browser/renderer_host/render_process_host_impl.cc b/chromium/content/browser/renderer_host/render_process_host_impl.cc
index e31aff2afc6..2dd784a4e69 100644
--- a/chromium/content/browser/renderer_host/render_process_host_impl.cc
+++ b/chromium/content/browser/renderer_host/render_process_host_impl.cc
@@ -943,7 +943,6 @@ void RenderProcessHostImpl::PropagateBrowserCommandLineToRenderer(
     switches::kEnableWebRtcAecRecordings,
     switches::kEnableWebRtcTcpServerSocket,
     switches::kEnableWebRtcHWDecoding,
-    switches::kEnableWebRtcHWEncoding,
 #endif
     switches::kDisableWebKitMediaSource,
     switches::kEnableOverscrollNotifications,
diff --git a/chromium/content/browser/renderer_host/render_view_host_manager_browsertest.cc b/chromium/content/browser/renderer_host/render_view_host_manager_browsertest.cc
index f5ebb76fc0a..4053d6593f2 100644
--- a/chromium/content/browser/renderer_host/render_view_host_manager_browsertest.cc
+++ b/chromium/content/browser/renderer_host/render_view_host_manager_browsertest.cc
@@ -86,7 +86,7 @@ IN_PROC_BROWSER_TEST_F(RenderViewHostManagerTest,
   // Wait for the navigation in the new window to finish, if it hasn't.
   WaitForLoadStop(new_shell->web_contents());
   EXPECT_EQ("/files/navigate_opener.html",
-            new_shell->web_contents()->GetLastCommittedURL().path());
+            new_shell->web_contents()->GetURL().path());
 
   // Should have the same SiteInstance.
   scoped_refptr<SiteInstance> blank_site_instance(
@@ -153,8 +153,7 @@ IN_PROC_BROWSER_TEST_F(RenderViewHostManagerTest,
   // Wait for the window to open.
   Shell* new_shell = new_shell_observer.GetShell();
 
-  EXPECT_EQ("/files/title2.html",
-            new_shell->web_contents()->GetVisibleURL().path());
+  EXPECT_EQ("/files/title2.html", new_shell->web_contents()->GetURL().path());
 
   // Wait for the cross-site transition in the new tab to finish.
   WaitForLoadStop(new_shell->web_contents());
@@ -208,8 +207,7 @@ IN_PROC_BROWSER_TEST_F(RenderViewHostManagerTest,
   Shell* new_shell = new_shell_observer.GetShell();
 
   // Opens in new window.
-  EXPECT_EQ("/files/title2.html",
-            new_shell->web_contents()->GetVisibleURL().path());
+  EXPECT_EQ("/files/title2.html", new_shell->web_contents()->GetURL().path());
 
   // Wait for the cross-site transition in the new tab to finish.
   WaitForLoadStop(new_shell->web_contents());
@@ -264,7 +262,7 @@ IN_PROC_BROWSER_TEST_F(RenderViewHostManagerTest,
   // Wait for the cross-site transition in the new tab to finish.
   WaitForLoadStop(new_shell->web_contents());
   EXPECT_EQ("/files/title2.html",
-            new_shell->web_contents()->GetLastCommittedURL().path());
+            new_shell->web_contents()->GetURL().path());
 
   // Should have the same SiteInstance.
   scoped_refptr<SiteInstance> blank_site_instance(
@@ -310,8 +308,7 @@ IN_PROC_BROWSER_TEST_F(RenderViewHostManagerTest,
 
   // Opens in same window.
   EXPECT_EQ(1u, Shell::windows().size());
-  EXPECT_EQ("/files/title2.html",
-            shell()->web_contents()->GetLastCommittedURL().path());
+  EXPECT_EQ("/files/title2.html", shell()->web_contents()->GetURL().path());
 
   // Should have the same SiteInstance.
   scoped_refptr<SiteInstance> noref_site_instance(
@@ -379,7 +376,7 @@ IN_PROC_BROWSER_TEST_F(RenderViewHostManagerTest,
   // Wait for the navigation in the new tab to finish, if it hasn't.
   WaitForLoadStop(new_shell->web_contents());
   EXPECT_EQ("/files/navigate_opener.html",
-            new_shell->web_contents()->GetLastCommittedURL().path());
+            new_shell->web_contents()->GetURL().path());
 
   // Should have the same SiteInstance.
   scoped_refptr<SiteInstance> blank_site_instance(
@@ -459,7 +456,7 @@ IN_PROC_BROWSER_TEST_F(RenderViewHostManagerTest, DisownOpener) {
   // Wait for the navigation in the new tab to finish, if it hasn't.
   WaitForLoadStop(new_shell->web_contents());
   EXPECT_EQ("/files/title2.html",
-            new_shell->web_contents()->GetLastCommittedURL().path());
+            new_shell->web_contents()->GetURL().path());
 
   // Should have the same SiteInstance.
   scoped_refptr<SiteInstance> blank_site_instance(
@@ -565,8 +562,7 @@ IN_PROC_BROWSER_TEST_F(RenderViewHostManagerTest,
   // send it to post_message.html on a different site.
   WebContents* foo_contents = new_shell->web_contents();
   WaitForLoadStop(foo_contents);
-  EXPECT_EQ("/files/navigate_opener.html",
-            foo_contents->GetLastCommittedURL().path());
+  EXPECT_EQ("/files/navigate_opener.html", foo_contents->GetURL().path());
   NavigateToURL(new_shell, https_server.GetURL("files/post_message.html"));
   scoped_refptr<SiteInstance> foo_site_instance(
       foo_contents->GetSiteInstance());
@@ -585,7 +581,7 @@ IN_PROC_BROWSER_TEST_F(RenderViewHostManagerTest,
   Shell* new_shell2 = new_shell_observer2.GetShell();
   WebContents* new_contents = new_shell2->web_contents();
   WaitForLoadStop(new_contents);
-  EXPECT_EQ("/files/title2.html", new_contents->GetLastCommittedURL().path());
+  EXPECT_EQ("/files/title2.html", new_contents->GetURL().path());
   NavigateToURL(new_shell2, test_server()->GetURL("files/post_message.html"));
   EXPECT_EQ(orig_site_instance, new_contents->GetSiteInstance());
   RenderViewHostManager* new_manager =
@@ -702,7 +698,7 @@ IN_PROC_BROWSER_TEST_F(RenderViewHostManagerTest,
   // Wait for the navigation in the new window to finish, if it hasn't.
   WaitForLoadStop(new_shell->web_contents());
   EXPECT_EQ("/files/navigate_opener.html",
-            new_shell->web_contents()->GetLastCommittedURL().path());
+            new_shell->web_contents()->GetURL().path());
 
   // Should have the same SiteInstance.
   scoped_refptr<SiteInstance> blank_site_instance(
@@ -769,7 +765,7 @@ IN_PROC_BROWSER_TEST_F(RenderViewHostManagerTest,
   // Wait for the navigation in the new window to finish, if it hasn't.
   WaitForLoadStop(new_shell->web_contents());
   EXPECT_EQ("/files/navigate_opener.html",
-            new_shell->web_contents()->GetLastCommittedURL().path());
+            new_shell->web_contents()->GetURL().path());
 
   // Should have the same SiteInstance.
   scoped_refptr<SiteInstance> opened_site_instance(
@@ -833,8 +829,7 @@ IN_PROC_BROWSER_TEST_F(RenderViewHostManagerTest, ClickLinkAfter204Error) {
   scoped_refptr<SiteInstance> post_nav_site_instance(
       shell()->web_contents()->GetSiteInstance());
   EXPECT_EQ(orig_site_instance, post_nav_site_instance);
-  EXPECT_EQ("/nocontent",
-            shell()->web_contents()->GetVisibleURL().path());
+  EXPECT_EQ("/nocontent", shell()->web_contents()->GetURL().path());
   EXPECT_EQ("/files/click-noreferrer-links.html",
             shell()->web_contents()->GetController().
                 GetLastCommittedEntry()->GetVirtualURL().path());
@@ -852,8 +847,7 @@ IN_PROC_BROWSER_TEST_F(RenderViewHostManagerTest, ClickLinkAfter204Error) {
 
   // Opens in same tab.
   EXPECT_EQ(1u, Shell::windows().size());
-  EXPECT_EQ("/files/title2.html",
-            shell()->web_contents()->GetLastCommittedURL().path());
+  EXPECT_EQ("/files/title2.html", shell()->web_contents()->GetURL().path());
 
   // Should have the same SiteInstance.
   scoped_refptr<SiteInstance> noref_site_instance(
@@ -1079,7 +1073,7 @@ IN_PROC_BROWSER_TEST_F(RenderViewHostManagerTest,
   // Wait for the navigation in the new tab to finish, if it hasn't.
   WaitForLoadStop(new_shell->web_contents());
   EXPECT_EQ("/files/navigate_opener.html",
-            new_shell->web_contents()->GetLastCommittedURL().path());
+            new_shell->web_contents()->GetURL().path());
 
   RenderViewHost* rvh = new_shell->web_contents()->GetRenderViewHost();
 
@@ -1110,7 +1104,7 @@ IN_PROC_BROWSER_TEST_F(RenderViewHostManagerTest,
   }
 
   EXPECT_EQ("/files/navigate_opener.html",
-            new_shell->web_contents()->GetLastCommittedURL().path());
+            new_shell->web_contents()->GetURL().path());
 
   EXPECT_EQ(rvh, new_shell->web_contents()->GetRenderViewHost());
 
@@ -1193,7 +1187,7 @@ IN_PROC_BROWSER_TEST_F(RenderViewHostManagerTest, LeakingRenderViewHosts) {
   // view-source URL, we create a new SiteInstance.
   RenderViewHost* blank_rvh = shell()->web_contents()->GetRenderViewHost();
   SiteInstance* blank_site_instance = blank_rvh->GetSiteInstance();
-  EXPECT_EQ(shell()->web_contents()->GetLastCommittedURL(), GURL::EmptyGURL());
+  EXPECT_EQ(shell()->web_contents()->GetURL(), GURL::EmptyGURL());
   EXPECT_EQ(blank_site_instance->GetSiteURL(), GURL::EmptyGURL());
   rvh_observers.AddObserverToRVH(blank_rvh);
 
@@ -1275,7 +1269,7 @@ IN_PROC_BROWSER_TEST_F(RenderViewHostManagerTest,
   // Wait for the navigation in the new window to finish, if it hasn't.
   WaitForLoadStop(new_shell->web_contents());
   EXPECT_EQ("/files/title1.html",
-            new_shell->web_contents()->GetLastCommittedURL().path());
+            new_shell->web_contents()->GetURL().path());
 
   // Should have the same SiteInstance.
   EXPECT_EQ(orig_site_instance, new_shell->web_contents()->GetSiteInstance());
@@ -1292,7 +1286,7 @@ IN_PROC_BROWSER_TEST_F(RenderViewHostManagerTest,
   // Make sure it ends up at the right page.
   WaitForLoadStop(shell()->web_contents());
   EXPECT_EQ(https_server.GetURL("files/title1.html"),
-            shell()->web_contents()->GetLastCommittedURL());
+            shell()->web_contents()->GetURL());
   EXPECT_EQ(new_site_instance, shell()->web_contents()->GetSiteInstance());
 }
 
diff --git a/chromium/content/browser/renderer_host/render_widget_host_browsertest.cc b/chromium/content/browser/renderer_host/render_widget_host_browsertest.cc
index 2a9ef56a7c9..9f11299b1a6 100644
--- a/chromium/content/browser/renderer_host/render_widget_host_browsertest.cc
+++ b/chromium/content/browser/renderer_host/render_widget_host_browsertest.cc
@@ -46,14 +46,8 @@ class RenderWidgetHostBrowserTest : public ContentBrowserTest {
   base::FilePath test_dir_;
 };
 
-// Disabled on Windows and CrOS because it is flaky: crbug.com/272379.
-#if defined(OS_WIN) || defined(OS_CHROMEOS)
-#define MAYBE_GetSnapshotFromRendererTest DISABLED_GetSnapshotFromRendererTest
-#else
-#define MAYBE_GetSnapshotFromRendererTest GetSnapshotFromRendererTest
-#endif
 IN_PROC_BROWSER_TEST_F(RenderWidgetHostBrowserTest,
-                       MAYBE_GetSnapshotFromRendererTest) {
+                       GetSnapshotFromRendererTest) {
   base::RunLoop run_loop;
 
   NavigateToURL(shell(), GURL(net::FilePathToFileURL(
diff --git a/chromium/content/browser/renderer_host/render_widget_host_view_aura.cc b/chromium/content/browser/renderer_host/render_widget_host_view_aura.cc
index 8c52017ed59..33ee9524e73 100644
--- a/chromium/content/browser/renderer_host/render_widget_host_view_aura.cc
+++ b/chromium/content/browser/renderer_host/render_widget_host_view_aura.cc
@@ -2525,32 +2525,6 @@ void RenderWidgetHostViewAura::OnKeyEvent(ui::KeyEvent* event) {
       host_->Shutdown();
     }
   } else {
-    // Windows does not have a specific key code for AltGr and sends
-    // left-Control and right-Alt when the AltGr key is pressed. Also
-    // Windows translates AltGr modifier to Ctrl+Alt modifier. To be compatible
-    // with this behavior, we re-write keyboard event from AltGr to Alt + Ctrl
-    // key event here.
-    if (event->key_code() == ui::VKEY_ALTGR) {
-      // Synthesize Ctrl & Alt events.
-      NativeWebKeyboardEvent ctrl_webkit_event(
-          event->type(),
-          false,
-          ui::VKEY_CONTROL,
-          event->flags(),
-          ui::EventTimeForNow().InSecondsF());
-      host_->ForwardKeyboardEvent(ctrl_webkit_event);
-
-      NativeWebKeyboardEvent alt_webkit_event(
-          event->type(),
-          false,
-          ui::VKEY_MENU,
-          event->flags(),
-          ui::EventTimeForNow().InSecondsF());
-      host_->ForwardKeyboardEvent(alt_webkit_event);
-      event->SetHandled();
-      return;
-    }
-
     // We don't have to communicate with an input method here.
     if (!event->HasNativeEvent()) {
       NativeWebKeyboardEvent webkit_event(
diff --git a/chromium/content/browser/renderer_host/render_widget_host_view_guest.cc b/chromium/content/browser/renderer_host/render_widget_host_view_guest.cc
index 097468fb848..b49ca41054e 100644
--- a/chromium/content/browser/renderer_host/render_widget_host_view_guest.cc
+++ b/chromium/content/browser/renderer_host/render_widget_host_view_guest.cc
@@ -67,14 +67,22 @@ RenderWidgetHost* RenderWidgetHostViewGuest::GetRenderWidgetHost() const {
 }
 
 void RenderWidgetHostViewGuest::WasShown() {
-  if (!is_hidden_)
+  // If the WebContents associated with us showed an interstitial page in the
+  // beginning, the teardown path might call WasShown() while |host_| is in
+  // the process of destruction. Avoid calling WasShown below in this case.
+  // TODO(lazyboy): We shouldn't be showing interstitial pages in guests in the
+  // first place: http://crbug.com/273089.
+  //
+  // |guest_| is NULL during test.
+  if (!is_hidden_ || (guest_ && guest_->is_in_destruction()))
     return;
   is_hidden_ = false;
   host_->WasShown();
 }
 
 void RenderWidgetHostViewGuest::WasHidden() {
-  if (is_hidden_)
+  // |guest_| is NULL during test.
+  if (is_hidden_ || (guest_ && guest_->is_in_destruction()))
     return;
   is_hidden_ = true;
   host_->WasHidden();
diff --git a/chromium/content/browser/renderer_host/ui_events_helper.cc b/chromium/content/browser/renderer_host/ui_events_helper.cc
index afbbf990176..89242946cab 100644
--- a/chromium/content/browser/renderer_host/ui_events_helper.cc
+++ b/chromium/content/browser/renderer_host/ui_events_helper.cc
@@ -238,11 +238,6 @@ WebKit::WebGestureEvent MakeWebGestureEventFromUIEvent(
 int EventFlagsToWebEventModifiers(int flags) {
   int modifiers = 0;
 
-  // Translate AltGr modifier to Ctrl+Alt first.
-  if (flags & ui::EF_ALTGR_DOWN) {
-    modifiers |= WebKit::WebInputEvent::ControlKey |
-        WebKit::WebInputEvent::AltKey;
-  }
   if (flags & ui::EF_SHIFT_DOWN)
     modifiers |= WebKit::WebInputEvent::ShiftKey;
   if (flags & ui::EF_CONTROL_DOWN)