BASELINE: Update Chromium to 85.0.4183.14085-based

Change-Id: Iaa42f4680837c57725b1344f108c0196741f6057 Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>
author: Allan Sandfeld Jensen <allan.jensen@qt.io> 2020-10-12 14:27:29 +0200
committer: Allan Sandfeld Jensen <allan.jensen@qt.io> 2020-10-13 09:35:20 +0000
commit: c30a6232df03e1efbd9f3b226777b07e087a1122 (patch)
tree: e992f45784689f373bcc38d1b79a239ebe17ee23 /chromium/content/public/browser
parent: 7b5b123ac58f58ffde0f4f6e488bcd09aa4decd3 (diff)
download: qtwebengine-chromium-85-based.tar.gz
73 files changed, 1235 insertions, 579 deletions
diff --git a/chromium/content/public/browser/BUILD.gn b/chromium/content/public/browser/BUILD.gn
index fa2aeab0a4a..17d0782de13 100644
--- a/chromium/content/public/browser/BUILD.gn
+++ b/chromium/content/public/browser/BUILD.gn
@@ -6,6 +6,7 @@ import("//build/config/jumbo.gni")
 import("//build/config/ui.gni")
 import("//device/vr/buildflags/buildflags.gni")
 import("//ppapi/buildflags/buildflags.gni")
+import("//third_party/protobuf/proto_library.gni")
 import("//third_party/webrtc/webrtc.gni")
 
 if (is_android) {
@@ -50,8 +51,6 @@ jumbo_source_set("browser_sources") {
     "audio_service_info.cc",
     "audio_service_info.h",
     "authenticator_environment.h",
-    "authenticator_request_client_delegate.cc",
-    "authenticator_request_client_delegate.h",
     "ax_event_notification_details.cc",
     "ax_event_notification_details.h",
     "back_forward_cache.h",
@@ -130,8 +129,6 @@ jumbo_source_set("browser_sources") {
     "cookie_access_details.cc",
     "cookie_access_details.h",
     "cookie_store_factory.h",
-    "cors_exempt_headers.cc",
-    "cors_exempt_headers.h",
     "cors_origin_pattern_setter.cc",
     "cors_origin_pattern_setter.h",
     "dedicated_worker_id.h",
@@ -238,6 +235,7 @@ jumbo_source_set("browser_sources") {
     "navigation_entry.h",
     "navigation_handle.cc",
     "navigation_handle.h",
+    "navigation_handle_timing.h",
     "navigation_throttle.cc",
     "navigation_throttle.h",
     "navigation_type.h",
@@ -320,6 +318,8 @@ jumbo_source_set("browser_sources") {
     "service_process_host.h",
     "service_process_info.cc",
     "service_process_info.h",
+    "service_worker_client_info.cc",
+    "service_worker_client_info.h",
     "service_worker_context.h",
     "service_worker_context_observer.h",
     "service_worker_external_request_result.h",
@@ -351,6 +351,8 @@ jumbo_source_set("browser_sources") {
     "startup_data.h",
     "storage_notification_service.h",
     "storage_partition.h",
+    "storage_partition_config.cc",
+    "storage_partition_config.h",
     "storage_usage_info.h",
     "stored_payment_app.cc",
     "stored_payment_app.h",
@@ -365,12 +367,12 @@ jumbo_source_set("browser_sources") {
     "tracing_delegate.h",
     "tracing_service.h",
     "tts_controller.h",
-    "tts_controller_delegate.h",
     "tts_platform.h",
     "tts_utterance.h",
     "url_data_source.cc",
     "url_data_source.h",
     "url_loader_request_interceptor.h",
+    "url_loader_throttles.h",
     "video_capture_device_launcher.cc",
     "video_capture_device_launcher.h",
     "video_capture_service.h",
@@ -434,6 +436,7 @@ jumbo_source_set("browser_sources") {
     "//mojo/public/cpp/bindings",
     "//mojo/public/cpp/system",
     "//services/audio/public/mojom",
+    "//services/cert_verifier/public/mojom",
     "//services/content/public/mojom",
     "//services/data_decoder/public/mojom",
     "//services/device/public/mojom:device_service",
@@ -504,23 +507,30 @@ jumbo_source_set("browser_sources") {
     sources += [ "remote_cocoa.h" ]
   }
 
+  if (is_linux) {
+    sources += [ "zygote_host/zygote_host_linux.h" ]
+  }
+
   if (!is_android) {
     sources += [
+      "authenticator_request_client_delegate.cc",
+      "authenticator_request_client_delegate.h",
       "host_zoom_map.h",
       "zoom_level_delegate.h",
     ]
   }
 
   if (is_chromeos) {
-    sources +=
-        [ "chromeos/delegate_to_browser_gpu_service_accelerator_factory.h" ]
+    sources += [
+      "chromeos/delegate_to_browser_gpu_service_accelerator_factory.h",
+      "tts_controller_delegate.cc",
+      "tts_controller_delegate.h",
+    ]
   }
 
   if (enable_vr) {
     sources += [
       "browser_xr_runtime.h",
-      "xr_consent_helper.h",
-      "xr_consent_prompt_level.h",
       "xr_install_helper.h",
       "xr_integration_client.cc",
       "xr_integration_client.h",
@@ -539,3 +549,7 @@ if (is_android) {
     sources = [ "contacts_picker_properties_requested.h" ]
   }
 }
+
+proto_library("proto") {
+  sources = [ "google_streaming_api.proto" ]
+}
diff --git a/chromium/content/public/browser/accessibility_tree_formatter.h b/chromium/content/public/browser/accessibility_tree_formatter.h
index cecbbe42921..b954cce0aca 100644
--- a/chromium/content/public/browser/accessibility_tree_formatter.h
+++ b/chromium/content/public/browser/accessibility_tree_formatter.h
@@ -56,15 +56,31 @@ class AccessibilityTestExpectationsLocator {
 class CONTENT_EXPORT AccessibilityTreeFormatter
     : public AccessibilityTestExpectationsLocator {
  public:
-  // A single property filter specification. See GetAllowString() and
-  // GetDenyString() for more information.
-  struct PropertyFilter {
+  // A single property filter specification. Represents a parsed string of the
+  // filter_str;match_str format, where `filter_str` has
+  // :line_num_0,...:line_num_N format, `match_str` has format of
+  // property_str=value_str. For example, :1,:3;AXDOMClassList=*.
+  //
+  // Longer version: `filter_str` is a comma separated list of the line
+  // indexes from the output accessible tree, and serves to narrow down the
+  // property calls to the accessible object placed on those line indexes only;
+  // `match_str` is used to match properties by property name and value.
+  // For example, :1,:3;AXDOMClassList=*
+  // will query a AXDOMClassList attribute on accessible objects placed at 1st
+  // and 3rd lines in the output accessible tree.
+  // Also see
+  // DumpAccessibilityTestBase::ParseHtmlForExtraDirectives() for more
+  // information.
+  struct CONTENT_EXPORT PropertyFilter {
     enum Type { ALLOW, ALLOW_EMPTY, DENY };
+
     base::string16 match_str;
+    base::string16 property_str;
+    base::string16 filter_str;
     Type type;
 
-    PropertyFilter(base::string16 match_str, Type type)
-        : match_str(match_str), type(type) {}
+    PropertyFilter(const base::string16& str, Type type);
+    PropertyFilter(const PropertyFilter&);
   };
 
   // A single node filter specification  which will exclude any node where the
diff --git a/chromium/content/public/browser/android/compositor.h b/chromium/content/public/browser/android/compositor.h
index fd0018b2703..babee38df15 100644
--- a/chromium/content/public/browser/android/compositor.h
+++ b/chromium/content/public/browser/android/compositor.h
@@ -68,6 +68,9 @@ class CONTENT_EXPORT Compositor {
   // Set the output surface bounds.
   virtual void SetWindowBounds(const gfx::Size& size) = 0;
 
+  // Return the last size set with |SetWindowBounds|.
+  virtual const gfx::Size& GetWindowBounds() = 0;
+
   // Set the output surface which the compositor renders into.
   virtual void SetSurface(jobject surface,
                           bool can_be_used_with_surface_control) = 0;
diff --git a/chromium/content/public/browser/authenticator_request_client_delegate.h b/chromium/content/public/browser/authenticator_request_client_delegate.h
index e184e0f6fb9..f90abf0419a 100644
--- a/chromium/content/public/browser/authenticator_request_client_delegate.h
+++ b/chromium/content/public/browser/authenticator_request_client_delegate.h
@@ -50,6 +50,7 @@ class CONTENT_EXPORT AuthenticatorRequestClientDelegate
     kAuthenticatorRemovedDuringPINEntry,
     kAuthenticatorMissingResidentKeys,
     kAuthenticatorMissingUserVerification,
+    kNoCommonAlgorithms,
     // kStorageFull indicates that a resident credential could not be created
     // because the authenticator has insufficient storage.
     kStorageFull,
diff --git a/chromium/content/public/browser/browser_context.h b/chromium/content/public/browser/browser_context.h
index 8140c9b0468..429b7d0188e 100644
--- a/chromium/content/public/browser/browser_context.h
+++ b/chromium/content/public/browser/browser_context.h
@@ -92,6 +92,7 @@ class SharedCorsOriginAccessList;
 class SiteInstance;
 class StorageNotificationService;
 class StoragePartition;
+class StoragePartitionConfig;
 class SSLHostStateDelegate;
 
 // A mapping from the scheme name to the protocol handler that services its
@@ -130,10 +131,25 @@ class CONTENT_EXPORT BrowserContext : public base::SupportsUserData {
   static StoragePartition* GetStoragePartition(BrowserContext* browser_context,
                                                SiteInstance* site_instance,
                                                bool can_create = true);
+
+  // Returns a StoragePartition for the given StoragePartitionConfig. By
+  // default this will create a new StoragePartition if it doesn't exist,
+  // unless |can_create| is false.
+  static StoragePartition* GetStoragePartition(
+      BrowserContext* browser_context,
+      const StoragePartitionConfig& storage_partition_config,
+      bool can_create = true);
+
+  // Deprecated. Do not add new callers. Use the SiteInstance or
+  // StoragePartitionConfig methods above instead.
+  // Returns a StoragePartition for the given site URL. By default this will
+  // create a new StoragePartition if it doesn't exist, unless |can_create| is
+  // false.
   static StoragePartition* GetStoragePartitionForSite(
       BrowserContext* browser_context,
       const GURL& site,
       bool can_create = true);
+
   using StoragePartitionCallback =
       base::RepeatingCallback<void(StoragePartition*)>;
   static void ForEachStoragePartition(BrowserContext* browser_context,
diff --git a/chromium/content/public/browser/browser_or_resource_context.h b/chromium/content/public/browser/browser_or_resource_context.h
index 48a2f568d5a..62906464ad4 100644
--- a/chromium/content/public/browser/browser_or_resource_context.h
+++ b/chromium/content/public/browser/browser_or_resource_context.h
@@ -8,7 +8,7 @@
 #include <cstddef>
 #include <type_traits>
 
-#include "base/logging.h"
+#include "base/check_op.h"
 #include "content/public/browser/browser_thread.h"
 
 namespace content {
diff --git a/chromium/content/public/browser/browser_task_traits.h b/chromium/content/public/browser/browser_task_traits.h
index df30a2ebbdc..281a791e13e 100644
--- a/chromium/content/public/browser/browser_task_traits.h
+++ b/chromium/content/public/browser/browser_task_traits.h
@@ -49,10 +49,10 @@ enum class BrowserTaskType {
 // to a BrowserThread.
 //
 // To post a task to the UI thread (analogous for IO thread):
-//     base::PostTask(FROM_HERE, {BrowserThread::UI}, task);
+//     GetUIThreadTaskRunner({})->PostTask(FROM_HERE, task);
 //
 // To obtain a TaskRunner for the UI thread (analogous for the IO thread):
-//     base::CreateSingleThreadTaskRunner({BrowserThread::UI});
+//     GetUIThreadTaskRunner({});
 //
 // Tasks posted to the same BrowserThread with the same traits will be executed
 // in the order they were posted, regardless of the TaskRunners they were
@@ -152,6 +152,12 @@ class CONTENT_EXPORT BrowserTaskTraits : public base::TaskTraits {
     // TODO(1026641): Reconsider whether BrowserTaskTraits should really be
     // supporting base::TaskPriority.
     ValidTrait(base::TaskPriority);
+
+    // TODO(1026641): These traits are meaningless on BrowserThreads but some
+    // callers of post_task.h had been using them in conjunction with
+    // BrowserThread::ID traits. Remove such usage post-migration.
+    ValidTrait(base::MayBlock);
+    ValidTrait(base::TaskShutdownBehavior);
   };
 
   // TODO(1026641): Get rid of BrowserTaskTraitsExtension and store its members
diff --git a/chromium/content/public/browser/browsing_data_remover.h b/chromium/content/public/browser/browsing_data_remover.h
index 586ecaa5d32..3d474a7675a 100644
--- a/chromium/content/public/browser/browsing_data_remover.h
+++ b/chromium/content/public/browser/browsing_data_remover.h
@@ -63,7 +63,7 @@ class BrowsingDataRemoverDelegate;
 class BrowsingDataRemover {
  public:
   // Mask used for Remove.
-  enum DataType {
+  enum DataType : uint64_t {
     // Storage datatypes.
     DATA_TYPE_APP_CACHE = 1 << 0,
     DATA_TYPE_FILE_SYSTEMS = 1 << 1,
@@ -115,7 +115,7 @@ class BrowsingDataRemover {
     DATA_TYPE_CONTENT_END = DATA_TYPE_CONVERSIONS,
   };
 
-  enum OriginType {
+  enum OriginType : uint64_t {
     // Web storage origins that StoragePartition recognizes as NOT protected
     // according to its special storage policy.
     ORIGIN_TYPE_UNPROTECTED_WEB = 1 << 0,
@@ -159,7 +159,7 @@ class BrowsingDataRemover {
   // Determines whether |origin| matches the |origin_type_mask| according to
   // the |special_storage_policy|.
   virtual bool DoesOriginMatchMaskForTesting(
-      int origin_type_mask,
+      uint64_t origin_type_mask,
       const url::Origin& origin,
       storage::SpecialStoragePolicy* special_storage_policy) = 0;
 
@@ -167,15 +167,15 @@ class BrowsingDataRemover {
   // specified by |remove_mask| and origin types by |origin_type_mask|.
   virtual void Remove(const base::Time& delete_begin,
                       const base::Time& delete_end,
-                      int remove_mask,
-                      int origin_type_mask) = 0;
+                      uint64_t remove_mask,
+                      uint64_t origin_type_mask) = 0;
 
   // A version of the above that in addition informs the |observer| when the
   // removal task is finished.
   virtual void RemoveAndReply(const base::Time& delete_begin,
                               const base::Time& delete_end,
-                              int remove_mask,
-                              int origin_type_mask,
+                              uint64_t remove_mask,
+                              uint64_t origin_type_mask,
                               Observer* observer) = 0;
 
   // A version of the above that in addition informs the |observer| when the
@@ -183,8 +183,8 @@ class BrowsingDataRemover {
   virtual void RemoveWithFilterAndReply(
       const base::Time& delete_begin,
       const base::Time& delete_end,
-      int remove_mask,
-      int origin_type_mask,
+      uint64_t remove_mask,
+      uint64_t origin_type_mask,
       std::unique_ptr<BrowsingDataFilterBuilder> filter_builder,
       Observer* observer) = 0;
 
@@ -207,8 +207,8 @@ class BrowsingDataRemover {
   // consider simplifying this interface by removing these methods and changing
   // the tests to record the parameters using GMock instead.
   virtual const base::Time& GetLastUsedBeginTimeForTesting() = 0;
-  virtual int GetLastUsedRemovalMaskForTesting() = 0;
-  virtual int GetLastUsedOriginTypeMaskForTesting() = 0;
+  virtual uint64_t GetLastUsedRemovalMaskForTesting() = 0;
+  virtual uint64_t GetLastUsedOriginTypeMaskForTesting() = 0;
 };
 
 }  // namespace content
diff --git a/chromium/content/public/browser/browsing_data_remover_delegate.h b/chromium/content/public/browser/browsing_data_remover_delegate.h
index 4774cb1b099..b06d2399deb 100644
--- a/chromium/content/public/browser/browsing_data_remover_delegate.h
+++ b/chromium/content/public/browser/browsing_data_remover_delegate.h
@@ -5,6 +5,8 @@
 #ifndef CONTENT_PUBLIC_BROWSER_BROWSING_DATA_REMOVER_DELEGATE_H_
 #define CONTENT_PUBLIC_BROWSER_BROWSING_DATA_REMOVER_DELEGATE_H_
 
+#include <string>
+#include <vector>
 #include "base/callback_forward.h"
 
 namespace base {
@@ -28,12 +30,17 @@ class BrowsingDataRemoverDelegate {
   // Determines whether |origin| matches |origin_type_mask| given
   // the |special_storage_policy|.
   using EmbedderOriginTypeMatcher =
-      base::RepeatingCallback<bool(int origin_type_mask,
+      base::RepeatingCallback<bool(uint64_t origin_type_mask,
                                    const url::Origin& origin,
                                    storage::SpecialStoragePolicy* policy)>;
 
   virtual ~BrowsingDataRemoverDelegate() {}
 
+  // The embedder can define domains, for which cookies are only deleted
+  // after all other deletions are finished.
+  virtual std::vector<std::string> GetDomainsForDeferredCookieDeletion(
+      uint64_t remove_mask) = 0;
+
   // Returns a MaskMatcherFunction to match embedder's origin types.
   // This MaskMatcherFunction will be called with an |origin_type_mask|
   // parameter containing ONLY embedder-defined origin types, and must be able
@@ -47,9 +54,9 @@ class BrowsingDataRemoverDelegate {
   // Removes embedder-specific data.
   virtual void RemoveEmbedderData(const base::Time& delete_begin,
                                   const base::Time& delete_end,
-                                  int remove_mask,
+                                  uint64_t remove_mask,
                                   BrowsingDataFilterBuilder* filter_builder,
-                                  int origin_type_mask,
+                                  uint64_t origin_type_mask,
                                   base::OnceClosure callback) = 0;
 };
 
diff --git a/chromium/content/public/browser/child_process_termination_info.h b/chromium/content/public/browser/child_process_termination_info.h
index 1edb82c008c..deb21d02650 100644
--- a/chromium/content/public/browser/child_process_termination_info.h
+++ b/chromium/content/public/browser/child_process_termination_info.h
@@ -46,6 +46,9 @@ struct CONTENT_EXPORT ChildProcessTerminationInfo {
   // True if child service was explicitly killed by browser.
   bool was_killed_intentionally_by_browser = false;
 
+  // True if child process threw an exception before calling into main.
+  bool threw_exception_during_init = false;
+
   // True if the child shut itself down cleanly by quitting the main runloop.
   bool clean_exit = false;
 
diff --git a/chromium/content/public/browser/content_browser_client.cc b/chromium/content/public/browser/content_browser_client.cc
index c8c1e668d08..87375b2ef10 100644
--- a/chromium/content/public/browser/content_browser_client.cc
+++ b/chromium/content/public/browser/content_browser_client.cc
@@ -9,7 +9,7 @@
 // declarations instead of including more headers. If that is infeasible, adjust
 // the limit. For more info, see
 // https://chromium.googlesource.com/chromium/src/+/HEAD/docs/wmax_tokens.md
-#pragma clang max_tokens_here 840000
+#pragma clang max_tokens_here 860000
 
 #include <utility>
 
@@ -165,6 +165,12 @@ bool ContentBrowserClient::ShouldIgnoreSameSiteCookieRestrictionsWhenTopLevel(
   return false;
 }
 
+std::string ContentBrowserClient::GetSiteDisplayNameForCdmProcess(
+    BrowserContext* browser_context,
+    const GURL& site_url) {
+  return site_url.spec();
+}
+
 void ContentBrowserClient::OverrideURLLoaderFactoryParams(
     BrowserContext* browser_context,
     const url::Origin& origin,
@@ -406,6 +412,11 @@ std::string ContentBrowserClient::GetWebBluetoothBlocklist() {
   return std::string();
 }
 
+bool ContentBrowserClient::AllowConversionMeasurement(
+    content::BrowserContext* browser_context) {
+  return true;
+}
+
 scoped_refptr<QuotaPermissionContext>
 ContentBrowserClient::CreateQuotaPermissionContext() {
   return nullptr;
@@ -485,18 +496,12 @@ bool ContentBrowserClient::IsValidStoragePartitionId(
   return partition_id.empty();
 }
 
-void ContentBrowserClient::GetStoragePartitionConfigForSite(
+StoragePartitionConfig ContentBrowserClient::GetStoragePartitionConfigForSite(
     BrowserContext* browser_context,
-    const GURL& site,
-    bool can_be_default,
-    std::string* partition_domain,
-    std::string* partition_name,
-    bool* in_memory) {
+    const GURL& site) {
   DCHECK(browser_context);
 
-  partition_domain->clear();
-  partition_name->clear();
-  *in_memory = false;
+  return StoragePartitionConfig::CreateDefault();
 }
 
 MediaObserver* ContentBrowserClient::GetMediaObserver() {
@@ -536,9 +541,11 @@ ContentBrowserClient::CreateSpeechRecognitionManagerDelegate() {
   return nullptr;
 }
 
+#if defined(OS_CHROMEOS)
 TtsControllerDelegate* ContentBrowserClient::GetTtsControllerDelegate() {
   return nullptr;
 }
+#endif
 
 TtsPlatform* ContentBrowserClient::GetTtsPlatform() {
   return nullptr;
@@ -663,10 +670,6 @@ void ContentBrowserClient::OpenURL(
   std::move(callback).Run(nullptr);
 }
 
-std::string ContentBrowserClient::GetMetricSuffixForURL(const GURL& url) {
-  return std::string();
-}
-
 std::vector<std::unique_ptr<NavigationThrottle>>
 ContentBrowserClient::CreateThrottlesForNavigation(
     NavigationHandle* navigation_handle) {
@@ -723,10 +726,6 @@ std::vector<std::string> ContentBrowserClient::GetStartupServices() {
   return std::vector<std::string>();
 }
 
-::rappor::RapporService* ContentBrowserClient::GetRapporService() {
-  return nullptr;
-}
-
 std::vector<std::unique_ptr<blink::URLLoaderThrottle>>
 ContentBrowserClient::CreateURLLoaderThrottles(
     const network::ResourceRequest& request,
@@ -889,11 +888,13 @@ bool ContentBrowserClient::ShouldCreateThreadPool() {
   return true;
 }
 
+#if !defined(OS_ANDROID)
 std::unique_ptr<AuthenticatorRequestClientDelegate>
 ContentBrowserClient::GetWebAuthenticationRequestDelegate(
     RenderFrameHost* render_frame_host) {
   return std::make_unique<AuthenticatorRequestClientDelegate>();
 }
+#endif
 
 std::unique_ptr<net::ClientCertStore>
 ContentBrowserClient::CreateClientCertStore(BrowserContext* browser_context) {
@@ -1089,9 +1090,16 @@ bool ContentBrowserClient::IsOriginTrialRequiredForAppCache(
       blink::features::kAppCacheRequireOriginTrial);
 }
 
+void ContentBrowserClient::BindBrowserControlInterface(
+    mojo::GenericPendingReceiver receiver) {}
+
 bool ContentBrowserClient::ShouldInheritCrossOriginEmbedderPolicyImplicitly(
     const GURL& url) {
   return false;
 }
 
+ukm::UkmService* ContentBrowserClient::GetUkmService() {
+  return nullptr;
+}
+
 }  // namespace content
diff --git a/chromium/content/public/browser/content_browser_client.h b/chromium/content/public/browser/content_browser_client.h
index b211fea9879..edf60410ba5 100644
--- a/chromium/content/public/browser/content_browser_client.h
+++ b/chromium/content/public/browser/content_browser_client.h
@@ -28,6 +28,7 @@
 #include "content/public/browser/allow_service_worker_result.h"
 #include "content/public/browser/certificate_request_result_type.h"
 #include "content/public/browser/generated_code_cache_settings.h"
+#include "content/public/browser/storage_partition_config.h"
 #include "content/public/common/page_visibility_state.h"
 #include "content/public/common/previews_state.h"
 #include "content/public/common/window_container_type.mojom-forward.h"
@@ -148,10 +149,6 @@ class TrustedURLLoaderHeaderClient;
 struct ResourceRequest;
 }  // namespace network
 
-namespace rappor {
-class RapporService;
-}  // namespace rappor
-
 namespace sandbox {
 class TargetPolicy;
 }  // namespace sandbox
@@ -161,6 +158,10 @@ class SelectFilePolicy;
 class ClipboardFormatType;
 }  // namespace ui
 
+namespace ukm {
+class UkmService;
+}  // namespace ukm
+
 namespace url {
 class Origin;
 }  // namespace url
@@ -202,7 +203,6 @@ class SiteInstance;
 class SpeechRecognitionManagerDelegate;
 class StoragePartition;
 class TracingDelegate;
-class TtsControllerDelegate;
 class TtsPlatform;
 class URLLoaderRequestInterceptor;
 class VpnServiceProxy;
@@ -219,6 +219,10 @@ struct Referrer;
 struct SocketPermissionRequest;
 struct WebPreferences;
 
+#if defined(OS_CHROMEOS)
+class TtsControllerDelegate;
+#endif
+
 // Embedder API (or SPI) for participating in browser logic, to be implemented
 // by the client of the content browser. See ChromeContentBrowserClient for the
 // principal implementation. The methods are assumed to be called on the UI
@@ -396,6 +400,12 @@ class CONTENT_EXPORT ContentBrowserClient {
       base::StringPiece scheme,
       bool is_embedded_origin_secure);
 
+  // Gets a user friendly display name for a given |site_url| to be used in the
+  // CDM process name.
+  virtual std::string GetSiteDisplayNameForCdmProcess(
+      BrowserContext* browser_context,
+      const GURL& site_url);
+
   // This method allows the //content embedder to override |factory_params| with
   // |origin|-specific properties (e.g. with relaxed Cross-Origin Read Blocking
   // enforcement as needed by some extensions, or with extension-specific CORS
@@ -706,6 +716,14 @@ class CONTENT_EXPORT ContentBrowserClient {
   // "1812:e, 00001800-0000-1000-8000-00805f9b34fb:w, ignored:1, alsoignored."
   virtual std::string GetWebBluetoothBlocklist();
 
+  // Allows the embedder to control the conversion measurement API.
+  // This gates the following behaviors:
+  // - Impression registration
+  // - Conversion registration
+  // - Conversion reports
+  virtual bool AllowConversionMeasurement(
+      content::BrowserContext* browser_context);
+
 #if defined(OS_CHROMEOS)
   // Notification that a trust anchor was used by the given user.
   virtual void OnTrustAnchorUsed(BrowserContext* browser_context) {}
@@ -751,27 +769,13 @@ class CONTENT_EXPORT ContentBrowserClient {
   virtual bool IsValidStoragePartitionId(BrowserContext* browser_context,
                                          const std::string& partition_id);
 
-  // Allows the embedder to provide a storage parititon configuration for a
+  // Allows the embedder to provide a storage partition configuration for a
   // site. A storage partition configuration includes a domain of the embedder's
   // choice, an optional name within that domain, and whether the partition is
   // in-memory only.
-  //
-  // If |can_be_default| is false, the caller is telling the embedder that the
-  // |site| is known to not be in the default partition. This is useful in
-  // some shutdown situations where the bookkeeping logic that maps sites to
-  // their partition configuration are no longer valid.
-  //
-  // The |partition_domain| is [a-z]* UTF-8 string, specifying the domain in
-  // which partitions live (similar to namespace). Within a domain, partitions
-  // can be uniquely identified by the combination of |partition_name| and
-  // |in_memory| values. When a partition is not to be persisted, the
-  // |in_memory| value must be set to true.
-  virtual void GetStoragePartitionConfigForSite(BrowserContext* browser_context,
-                                                const GURL& site,
-                                                bool can_be_default,
-                                                std::string* partition_domain,
-                                                std::string* partition_name,
-                                                bool* in_memory);
+  virtual StoragePartitionConfig GetStoragePartitionConfigForSite(
+      BrowserContext* browser_context,
+      const GURL& site);
 
   // Create and return a new quota permission context.
   virtual scoped_refptr<QuotaPermissionContext> CreateQuotaPermissionContext();
@@ -854,8 +858,10 @@ class CONTENT_EXPORT ContentBrowserClient {
   virtual SpeechRecognitionManagerDelegate*
   CreateSpeechRecognitionManagerDelegate();
 
+#if defined(OS_CHROMEOS)
   // Allows the embedder to return a delegate for the TtsController.
   virtual TtsControllerDelegate* GetTtsControllerDelegate();
+#endif
 
   // Allows the embedder to return a TTS platform implementation.
   virtual TtsPlatform* GetTtsPlatform();
@@ -928,10 +934,10 @@ class CONTENT_EXPORT ContentBrowserClient {
   virtual void GetAdditionalAllowedSchemesForFileSystem(
       std::vector<std::string>* additional_schemes) {}
 
-  // |schemes| is a return value parameter that gets a whitelist of schemes that
-  // should bypass the Is Privileged Context check.
+  // |schemes| is a return value parameter that gets an allowlist of schemes
+  // that should bypass the Is Privileged Context check.
   // See http://www.w3.org/TR/powerful-features/#settings-privileged
-  virtual void GetSchemesBypassingSecureContextCheckWhitelist(
+  virtual void GetSchemesBypassingSecureContextCheckAllowlist(
       std::set<std::string>* schemes) {}
 
   // Returns auto mount handlers for URL requests for FileSystem APIs.
@@ -995,12 +1001,6 @@ class CONTENT_EXPORT ContentBrowserClient {
                                         mojo::GenericPendingReceiver receiver) {
   }
 
-  // Called when RenderFrameHostImpl connects to the Media service. Expose
-  // interfaces to the service using |registry|.
-  virtual void ExposeInterfacesToMediaService(
-      service_manager::BinderRegistry* registry,
-      RenderFrameHost* render_frame_host) {}
-
   // The Media Service can run in many different types of configurations
   // (typically in the GPU process or its own isolated process), but some
   // clients want an additional dedicated instance to use for specific
@@ -1039,6 +1039,10 @@ class CONTENT_EXPORT ContentBrowserClient {
   // process. Called on the IO thread.
   virtual void BindGpuHostReceiver(mojo::GenericPendingReceiver receiver) {}
 
+  // Handles an unhandled incoming interface binding request from a Utility
+  // process. Called on the IO thread.
+  virtual void BindUtilityHostReceiver(mojo::GenericPendingReceiver receiver) {}
+
   // Called on the main thread to handle an unhandled interface receiver binding
   // request from a render process. See |RenderThread::BindHostReceiver()|.
   virtual void BindHostReceiverForRenderer(
@@ -1109,16 +1113,6 @@ class CONTENT_EXPORT ContentBrowserClient {
                        const OpenURLParams& params,
                        base::OnceCallback<void(WebContents*)> callback);
 
-  // Allows the embedder to record |metric| for a specific |url|.
-  virtual void RecordURLMetric(const std::string& metric, const GURL& url) {}
-
-  // Allows the embedder to map URLs to strings, intended to be used as suffixes
-  // for metric names. For example, the embedder can map
-  // "my-special-site-with-a-complicated-name.example.com/and-complicated-path"
-  // to the string "MySpecialSite", which will cause some UMA involving that URL
-  // to be logged as "UmaName.MySpecialSite".
-  virtual std::string GetMetricSuffixForURL(const GURL& url);
-
   // Allows the embedder to register one or more NavigationThrottles for the
   // navigation indicated by |navigation_handle|.  A NavigationThrottle is used
   // to control the flow of a navigation on the UI thread. The embedder is
@@ -1192,19 +1186,18 @@ class CONTENT_EXPORT ContentBrowserClient {
       mojo::PendingRemote<media::mojom::RemotingSource> source,
       mojo::PendingReceiver<media::mojom::Remoter> receiver) {}
 
-  // Returns the RapporService from the browser process.
-  virtual ::rappor::RapporService* GetRapporService();
-
-  // Allows the embedder to register one or more URLLoaderThrottles for one of
-  // the following requests:
-  // 1) A navigation request.
-  // 2) A request for a dedicated worker's main script (when PlzDedicatedWorker
-  //    is enabled).
-  // 3) A request for a shared worker's main script.
+  // Allows the embedder to register one or more URLLoaderThrottles for a
+  // browser-initiated request. These include navigation requests and requests
+  // for web worker scripts.
   //
-  // For a request for worker's main script, |wc_getter|, |navigation_ui_data|,
-  // and |frame_tree_node_id| take a callback returning a nullptr, nullptr, and
-  // RenderFrameHost::kNoFrameTreeNodeId respectively.
+  // |wc_getter| returns the WebContents of the context of the |request| when
+  // available. It can return nullptr for requests for which it there are no
+  // WebContents (e.g., requests for web workers).
+  //
+  // |navigation_ui_data| is only valid if this is a navigation request.
+  //
+  // |frame_tree_node_id| is also invalid (kNoFrameTreeNodeId) in some cases
+  // (e.g., requests for web workers).
   //
   // This is called on the UI thread.
   virtual std::vector<std::unique_ptr<blink::URLLoaderThrottle>>
@@ -1466,6 +1459,12 @@ class CONTENT_EXPORT ContentBrowserClient {
   // BrowserContext's StoragePartition. StoragePartition will use the
   // NetworkService to create a new NetworkContext using these params.
   //
+  // If the CertVerifierService is enabled, the CertVerifierCreationParams will
+  // be used to create a new CertVerifierService, which will be passed to the
+  // network service in NetworkContextParams. Otherwise, the
+  // CertVerifierCreationParams will be placed in the NetworkContextParams and
+  // sent directly to the NetworkService for in-process CertVerifier creation.
+  //
   // If |in_memory| is true, |relative_partition_path| is still a path that
   // uniquely identifies the storage partition, though nothing should be written
   // to it.
@@ -1558,8 +1557,10 @@ class CONTENT_EXPORT ContentBrowserClient {
   // destroyed before the RenderFrame goes out of scope. The embedder may choose
   // to return nullptr to indicate that the request cannot be serviced right
   // now.
+#if !defined(OS_ANDROID)
   virtual std::unique_ptr<AuthenticatorRequestClientDelegate>
   GetWebAuthenticationRequestDelegate(RenderFrameHost* render_frame_host);
+#endif
 
   // Get platform ClientCertStore. May return nullptr. Called on the UI thread.
   virtual std::unique_ptr<net::ClientCertStore> CreateClientCertStore(
@@ -1831,10 +1832,19 @@ class CONTENT_EXPORT ContentBrowserClient {
   virtual bool IsOriginTrialRequiredForAppCache(
       content::BrowserContext* browser_text);
 
+  // External applications and services may launch the browser in a mode which
+  // exposes browser control interfaces via Mojo. Any such interface binding
+  // request received from an external client is passed to this method.
+  virtual void BindBrowserControlInterface(
+      mojo::GenericPendingReceiver receiver);
+
   // Returns true when a context (e.g., iframe) whose URL is |url| should
   // inherit the parent COEP value implicitly, similar to "blob:"
   virtual bool ShouldInheritCrossOriginEmbedderPolicyImplicitly(
       const GURL& url);
+
+  // Returns the URL-Keyed Metrics service for chrome:ukm.
+  virtual ukm::UkmService* GetUkmService();
 };
 
 }  // namespace content
diff --git a/chromium/content/public/browser/context_menu_params.h b/chromium/content/public/browser/context_menu_params.h
index 5d54099d2a6..2e4d14eb2dd 100644
--- a/chromium/content/public/browser/context_menu_params.h
+++ b/chromium/content/public/browser/context_menu_params.h
@@ -37,6 +37,9 @@ struct CONTENT_EXPORT ContextMenuParams
   // This is the URL of the subframe that the context menu was invoked on.
   GURL frame_url;
 
+  // Extra properties for the context menu.
+  std::map<std::string, std::string> properties;
+
  private:
   // RenderFrameHostImpl is responsible for validating and sanitizing
   // UntrustworthyContextMenuParams into ContextMenuParams and therefore is a
diff --git a/chromium/content/public/browser/cors_exempt_headers.cc b/chromium/content/public/browser/cors_exempt_headers.cc
deleted file mode 100644
index 6faee524304..00000000000
--- a/chromium/content/public/browser/cors_exempt_headers.cc
+++ /dev/null
@@ -1,19 +0,0 @@
-// Copyright 2019 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "content/public/browser/cors_exempt_headers.h"
-
-#include "content/public/common/content_constants.h"
-
-namespace content {
-
-void UpdateCorsExemptHeader(network::mojom::NetworkContextParams* params) {
-  // Note: This mechanism will be deprecated in the near future. You can find
-  // a recommended alternative approach on URLRequest::cors_exempt_headers at
-  // services/network/public/mojom/url_loader.mojom.
-  params->cors_exempt_header_list.push_back(kCorsExemptPurposeHeaderName);
-  params->cors_exempt_header_list.push_back(kCorsExemptRequestedWithHeaderName);
-}
-
-}  // namespace content
diff --git a/chromium/content/public/browser/cors_exempt_headers.h b/chromium/content/public/browser/cors_exempt_headers.h
deleted file mode 100644
index c9b5cf13f04..00000000000
--- a/chromium/content/public/browser/cors_exempt_headers.h
+++ /dev/null
@@ -1,21 +0,0 @@
-// Copyright 2019 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef CONTENT_PUBLIC_BROWSER_CORS_EXEMPT_HEADERS_H_
-#define CONTENT_PUBLIC_BROWSER_CORS_EXEMPT_HEADERS_H_
-
-#include "content/common/content_export.h"
-#include "services/network/public/mojom/network_context.mojom.h"
-
-namespace content {
-
-// Updates |cors_exempt_header_list| field of the given |param| to register
-// headers that are used in content for special purpose and should not be
-// blocked by CORS checks.
-CONTENT_EXPORT void UpdateCorsExemptHeader(
-    network::mojom::NetworkContextParams* params);
-
-}  // namespace content
-
-#endif  // CONTENT_PUBLIC_BROWSER_CORS_EXEMPT_HEADERS_H_
diff --git a/chromium/content/public/browser/dedicated_worker_service.h b/chromium/content/public/browser/dedicated_worker_service.h
index 4c5dae9e6df..b062f04825f 100644
--- a/chromium/content/public/browser/dedicated_worker_service.h
+++ b/chromium/content/public/browser/dedicated_worker_service.h
@@ -20,12 +20,14 @@ class CONTENT_EXPORT DedicatedWorkerService {
  public:
   class Observer : public base::CheckedObserver {
    public:
-    // Called when a dedicated worker has started/stopped.
-    virtual void OnWorkerStarted(
+    // Called when a dedicated worker is created/destroyed. Note that it is not
+    // yet started in the renderer since its script still has to be downloaded
+    // and evaluated.
+    virtual void OnWorkerCreated(
         DedicatedWorkerId dedicated_worker_id,
         int worker_process_id,
         GlobalFrameRoutingId ancestor_render_frame_host_id) = 0;
-    virtual void OnBeforeWorkerTerminated(
+    virtual void OnBeforeWorkerDestroyed(
         DedicatedWorkerId dedicated_worker_id,
         GlobalFrameRoutingId ancestor_render_frame_host_id) = 0;
 
@@ -42,13 +44,13 @@ class CONTENT_EXPORT DedicatedWorkerService {
   virtual void AddObserver(Observer* observer) = 0;
   virtual void RemoveObserver(Observer* observer) = 0;
 
-  // Invokes OnWorkerStarted() on |observer| for all existing dedicated workers.
+  // Invokes OnWorkerCreated() on |observer| for all existing dedicated workers.
   //
   // This function must be invoked in conjunction with AddObserver(). It is
   // meant to be used by an observer that dynamically subscribes to the
   // DedicatedWorkerService while some workers are already running. It avoids
-  // receiving a OnBeforeWorkerTerminated() event without having received the
-  // corresponding OnWorkerStart() event.
+  // receiving a OnBeforeWorkerDestroyed() event without having received the
+  // corresponding OnWorkerCreated() event.
   virtual void EnumerateDedicatedWorkers(Observer* observer) = 0;
 
  protected:
diff --git a/chromium/content/public/browser/download_manager_delegate.cc b/chromium/content/public/browser/download_manager_delegate.cc
index bea2e24ba8e..3d9cfe542f0 100644
--- a/chromium/content/public/browser/download_manager_delegate.cc
+++ b/chromium/content/public/browser/download_manager_delegate.cc
@@ -8,6 +8,7 @@
 #include "base/bind_helpers.h"
 #include "base/threading/thread_task_runner_handle.h"
 #include "components/download/public/common/download_item.h"
+#include "content/public/browser/web_contents_delegate.h"
 
 namespace content {
 
@@ -69,11 +70,33 @@ void DownloadManagerDelegate::CheckDownloadAllowed(
     bool from_download_cross_origin_redirect,
     bool content_initiated,
     CheckDownloadAllowedCallback check_download_allowed_cb) {
-  // TODO: once hook up delegate callback, make sure sync run of it doesn't
-  // crash and test it
+  // TODO: Do this directly, if it doesn't crash.
 
   base::ThreadTaskRunnerHandle::Get()->PostTask(
-      FROM_HERE, base::BindOnce(std::move(check_download_allowed_cb), true));
+      FROM_HERE,
+      base::BindOnce(
+          [](const WebContents::Getter& web_contents_getter, const GURL& url,
+             const std::string& request_method,
+             CheckDownloadAllowedCallback check_download_allowed_cb) {
+            WebContents* contents = web_contents_getter.Run();
+            if (!contents) {
+              // The contents was closed.
+              std::move(check_download_allowed_cb).Run(false);
+              return;
+            }
+
+            WebContentsDelegate* delegate = contents->GetDelegate();
+            if (!delegate) {
+              // The default behavior is to allow it.
+              std::move(check_download_allowed_cb).Run(true);
+              return;
+            }
+
+            delegate->CanDownload(url, request_method,
+                                  std::move(check_download_allowed_cb));
+          },
+          web_contents_getter, url, request_method,
+          std::move(check_download_allowed_cb)));
 }
 
 download::QuarantineConnectionCallback
diff --git a/chromium/content/public/browser/download_manager_delegate.h b/chromium/content/public/browser/download_manager_delegate.h
index 5105f4c80c8..100a2e498bc 100644
--- a/chromium/content/public/browser/download_manager_delegate.h
+++ b/chromium/content/public/browser/download_manager_delegate.h
@@ -9,11 +9,11 @@
 
 #include "base/callback.h"
 #include "base/files/file_path.h"
-#include "base/logging.h"
 #include "base/optional.h"
 #include "base/time/time.h"
 #include "components/download/public/common/download_danger_type.h"
 #include "components/download/public/common/download_item.h"
+#include "components/download/public/common/download_schedule.h"
 #include "components/download/public/common/download_url_parameters.h"
 #include "components/download/public/common/quarantine_connection.h"
 #include "content/common/content_export.h"
@@ -67,6 +67,7 @@ using DownloadTargetCallback = base::OnceCallback<void(
     download::DownloadDangerType danger_type,
     download::DownloadItem::MixedContentStatus mixed_content_status,
     const base::FilePath& intermediate_path,
+    base::Optional<download::DownloadSchedule> download_schedule,
     download::DownloadInterruptReason interrupt_reason)>;
 
 // Called when a download delayed by the delegate has completed.
diff --git a/chromium/content/public/browser/google_streaming_api.proto b/chromium/content/public/browser/google_streaming_api.proto
new file mode 100644
index 00000000000..ce1b8d98a49
--- /dev/null
+++ b/chromium/content/public/browser/google_streaming_api.proto
@@ -0,0 +1,76 @@
+// Copyright (c) 2012 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+syntax = "proto2";
+option optimize_for = LITE_RUNTIME;
+
+// TODO(hans): Commented out due to compilation errors.
+// option cc_api_version = 2;
+
+package content.proto;
+
+// SpeechRecognitionEvent is the only message type sent to client.
+//
+// The first SpeechRecognitionEvent is an empty (default) message to indicate
+// as early as possible that the stream connection has been established.
+message SpeechRecognitionEvent {
+  enum StatusCode {
+    // Note: in JavaScript API SpeechRecognitionError 0 is "OTHER" error.
+    STATUS_SUCCESS = 0;
+    STATUS_NO_SPEECH = 1;
+    STATUS_ABORTED = 2;
+    STATUS_AUDIO_CAPTURE = 3;
+    STATUS_NETWORK = 4;
+    STATUS_NOT_ALLOWED = 5;
+    STATUS_SERVICE_NOT_ALLOWED = 6;
+    STATUS_BAD_GRAMMAR = 7;
+    STATUS_LANGUAGE_NOT_SUPPORTED = 8;
+  }
+  optional StatusCode status = 1 [default = STATUS_SUCCESS];
+
+  // May contain zero or one final=true result (the newly settled portion).
+  // May also contain zero or more final=false results.
+  // (Note that this differs from JavaScript API resultHistory in that no more
+  // than one final=true result is returned, so client must accumulate
+  // resultHistory by concatenating the final=true results.)
+  repeated SpeechRecognitionResult result = 2;
+
+  enum EndpointerEventType {
+    START_OF_SPEECH = 0;
+    END_OF_SPEECH = 1;
+    END_OF_AUDIO = 2;  // End of audio stream has been reached.
+    // End of utterance indicates that no more speech segments are expected.
+    END_OF_UTTERANCE = 3;
+  }
+
+  optional EndpointerEventType endpoint = 4;
+};
+
+message SpeechRecognitionResult {
+  repeated SpeechRecognitionAlternative alternative = 1;
+
+  // True if this is the final time the speech service will return this
+  // particular SpeechRecognitionResult. If false, then this represents an
+  // interim result that could still be changed.
+  optional bool final = 2 [default = false];
+
+  // An estimate of the probability that the recognizer will not change its
+  // guess about this interim result.  Values range from 0.0 (completely
+  // unstable) to 1.0 (completely stable).  Note that this is not the same as
+  // "confidence", which estimate the probability that a recognition result
+  // is correct. This field is only provided for interim (final=false) results.
+  optional float stability = 3;
+};
+
+// Item in N-best list.
+message SpeechRecognitionAlternative {
+  // Spoken text.
+  optional string transcript = 1;
+
+  // The confidence estimate between 0.0 and 1.0.  A higher number means the
+  // system is more confident that the recognition is correct.
+  // This field is typically provided only for the top hypothesis and only for
+  // final results.
+  optional float confidence = 2;
+}
diff --git a/chromium/content/public/browser/gpu_data_manager.h b/chromium/content/public/browser/gpu_data_manager.h
index d9207f2b050..a54dab6ca68 100644
--- a/chromium/content/public/browser/gpu_data_manager.h
+++ b/chromium/content/public/browser/gpu_data_manager.h
@@ -32,8 +32,11 @@ enum GpuProcessKind {
 
 enum GpuInfoRequest {
   kGpuInfoRequestDxDiag = 1 << 0,
-  kGpuInfoRequestDx12Vulkan = 1 << 1,
-  kGpuInfoRequestAll = kGpuInfoRequestDxDiag | kGpuInfoRequestDx12Vulkan,
+  kGpuInfoRequestDx12 = 1 << 1,
+  kGpuInfoRequestVulkan = 1 << 2,
+  kGpuInfoRequestDx12Vulkan = kGpuInfoRequestVulkan | kGpuInfoRequestDx12,
+  kGpuInfoRequestAll =
+      kGpuInfoRequestDxDiag | kGpuInfoRequestDx12 | kGpuInfoRequestVulkan,
 };
 
 class GpuDataManagerObserver;
diff --git a/chromium/content/public/browser/gpu_utils.cc b/chromium/content/public/browser/gpu_utils.cc
index 438d5f19ace..89f1ebcd559 100644
--- a/chromium/content/public/browser/gpu_utils.cc
+++ b/chromium/content/public/browser/gpu_utils.cc
@@ -41,6 +41,12 @@ void StopGpuProcessImpl(base::OnceClosure callback,
     std::move(callback).Run();
 }
 
+void KillGpuProcessImpl(content::GpuProcessHost* host) {
+  if (host) {
+    host->ForceShutdown();
+  }
+}
+
 }  // namespace
 
 namespace content {
@@ -131,6 +137,11 @@ void StopGpuProcess(base::OnceClosure callback) {
                                     std::move(callback))));
 }
 
+void KillGpuProcess() {
+  GpuProcessHost::CallOnIO(GPU_PROCESS_KIND_SANDBOXED, false /* force_create */,
+                           base::BindOnce(&KillGpuProcessImpl));
+}
+
 gpu::GpuChannelEstablishFactory* GetGpuChannelEstablishFactory() {
   return BrowserMainLoop::GetInstance()->gpu_channel_establish_factory();
 }
diff --git a/chromium/content/public/browser/gpu_utils.h b/chromium/content/public/browser/gpu_utils.h
index b35ec8ea2c5..31d96e83d9b 100644
--- a/chromium/content/public/browser/gpu_utils.h
+++ b/chromium/content/public/browser/gpu_utils.h
@@ -20,6 +20,10 @@ CONTENT_EXPORT const gpu::GpuPreferences GetGpuPreferencesFromCommandLine();
 
 CONTENT_EXPORT void StopGpuProcess(base::OnceClosure callback);
 
+// Kills the GPU process with a normal termination status.
+// TODO(crbug.com/1095977): Combine with StopGpuProcess
+CONTENT_EXPORT void KillGpuProcess();
+
 CONTENT_EXPORT gpu::GpuChannelEstablishFactory* GetGpuChannelEstablishFactory();
 
 #if BUILDFLAG(CLANG_PROFILING_INSIDE_SANDBOX)
diff --git a/chromium/content/public/browser/hid_delegate.h b/chromium/content/public/browser/hid_delegate.h
index e4cc2905082..758fdbf3a8d 100644
--- a/chromium/content/public/browser/hid_delegate.h
+++ b/chromium/content/public/browser/hid_delegate.h
@@ -8,6 +8,7 @@
 #include <memory>
 #include <vector>
 
+#include "base/observer_list_types.h"
 #include "content/common/content_export.h"
 #include "content/public/browser/hid_chooser.h"
 #include "services/device/public/mojom/hid.mojom-forward.h"
@@ -26,6 +27,18 @@ class CONTENT_EXPORT HidDelegate {
  public:
   virtual ~HidDelegate() = default;
 
+  class Observer : public base::CheckedObserver {
+   public:
+    // Events forwarded from HidChooserContext::DeviceObserver:
+    virtual void OnDeviceAdded(const device::mojom::HidDeviceInfo&) = 0;
+    virtual void OnDeviceRemoved(const device::mojom::HidDeviceInfo&) = 0;
+    virtual void OnHidManagerConnectionError() = 0;
+
+    // Event forwarded from permissions::ChooserContextBase::PermissionObserver:
+    virtual void OnPermissionRevoked(const url::Origin& requesting_origin,
+                                     const url::Origin& embedding_origin) = 0;
+  };
+
   // Shows a chooser for the user to select a HID device. |callback| will be
   // run when the prompt is closed. Deleting the returned object will cancel the
   // prompt.
@@ -58,6 +71,11 @@ class CONTENT_EXPORT HidDelegate {
   // possible.
   virtual device::mojom::HidManager* GetHidManager(
       WebContents* web_contents) = 0;
+
+  // Functions to manage the set of Observer instances registered to this
+  // object.
+  virtual void AddObserver(RenderFrameHost* frame, Observer* observer) = 0;
+  virtual void RemoveObserver(RenderFrameHost* frame, Observer* observer) = 0;
 };
 
 }  // namespace content
diff --git a/chromium/content/public/browser/mhtml_generation_result.h b/chromium/content/public/browser/mhtml_generation_result.h
index a6cc0748029..fc2e706c2d0 100644
--- a/chromium/content/public/browser/mhtml_generation_result.h
+++ b/chromium/content/public/browser/mhtml_generation_result.h
@@ -5,6 +5,8 @@
 #ifndef CONTENT_PUBLIC_BROWSER_MHTML_GENERATION_RESULT_H_
 #define CONTENT_PUBLIC_BROWSER_MHTML_GENERATION_RESULT_H_
 
+#include <string>
+
 #include "base/callback_forward.h"
 #include "base/optional.h"
 #include "content/common/content_export.h"
diff --git a/chromium/content/public/browser/native_file_system_entry_factory.h b/chromium/content/public/browser/native_file_system_entry_factory.h
index d7c42af8122..a61442e0388 100644
--- a/chromium/content/public/browser/native_file_system_entry_factory.h
+++ b/chromium/content/public/browser/native_file_system_entry_factory.h
@@ -9,6 +9,7 @@
 #include "base/memory/ref_counted.h"
 #include "content/common/content_export.h"
 #include "content/public/browser/browser_thread.h"
+#include "content/public/browser/global_routing_id.h"
 #include "ipc/ipc_message.h"
 #include "third_party/blink/public/mojom/native_file_system/native_file_system_directory_handle.mojom-forward.h"
 #include "url/gurl.h"
@@ -23,25 +24,24 @@ class CONTENT_EXPORT NativeFileSystemEntryFactory
                                         BrowserThread::DeleteOnUIThread> {
  public:
   // Context from which a created handle is going to be used. This is used for
-  // security and permission checks. Pass in MSG_ROUTING_NONE as frame_id if
-  // the context is a worker, otherwise use the routing id of the relevant
-  // RenderFrameHost. Pass in the URL most relevant as the url parameter.
-  // This url will be used for verifications later for SafeBrowsing and
-  // Quarantine Service if used for writes.
+  // security and permission checks. Pass in the URL most relevant as the url
+  // parameter. This url will be used for verifications later for SafeBrowsing
+  // and Quarantine Service if used for writes.
   struct CONTENT_EXPORT BindingContext {
     BindingContext(const url::Origin& origin,
                    const GURL& url,
-                   int process_id,
-                   int frame_id)
+                   GlobalFrameRoutingId frame_id)
+        : origin(origin), url(url), frame_id(frame_id) {}
+    BindingContext(const url::Origin& origin,
+                   const GURL& url,
+                   int worker_process_id)
         : origin(origin),
           url(url),
-          process_id(process_id),
-          frame_id(frame_id) {}
+          frame_id(worker_process_id, MSG_ROUTING_NONE) {}
     url::Origin origin;
     GURL url;
-    int process_id;
-    int frame_id;
-    bool is_worker() const { return frame_id == MSG_ROUTING_NONE; }
+    GlobalFrameRoutingId frame_id;
+    bool is_worker() const { return !frame_id; }
   };
 
   // Creates a new NativeFileSystemEntryPtr from the path to a file. Assumes the
diff --git a/chromium/content/public/browser/native_file_system_permission_context.h b/chromium/content/public/browser/native_file_system_permission_context.h
index 558801ab48f..ebad6b1d994 100644
--- a/chromium/content/public/browser/native_file_system_permission_context.h
+++ b/chromium/content/public/browser/native_file_system_permission_context.h
@@ -6,6 +6,7 @@
 #define CONTENT_PUBLIC_BROWSER_NATIVE_FILE_SYSTEM_PERMISSION_CONTEXT_H_
 
 #include "base/files/file_path.h"
+#include "content/public/browser/global_routing_id.h"
 #include "content/public/browser/native_file_system_permission_grant.h"
 #include "content/public/browser/native_file_system_write_item.h"
 #include "url/origin.h"
@@ -37,17 +38,10 @@ class NativeFileSystemPermissionContext {
   };
 
   // Returns the read permission grant to use for a particular path.
-  // |process_id| and |frame_id| are the frame in which the handle is used. Once
-  // postMessage is implemented this isn't meaningful anymore and should be
-  // removed, but until then they can be used for more accurate usage tracking.
-  // TODO(https://crbug.com/984769): Eliminate process_id and frame_id from
-  // this method when grants stop being scoped to a frame.
   virtual scoped_refptr<NativeFileSystemPermissionGrant> GetReadPermissionGrant(
       const url::Origin& origin,
       const base::FilePath& path,
       bool is_directory,
-      int process_id,
-      int frame_id,
       UserAction user_action) = 0;
 
   // Returns the permission grant to use for a particular path. This could be a
@@ -55,17 +49,10 @@ class NativeFileSystemPermissionContext {
   // user has already granted write access to a directory, this method could
   // return that existing grant when figuring the grant to use for a file in
   // that directory.
-  // |process_id| and |frame_id| are the frame in which the handle is used. Once
-  // postMessage is implemented this isn't meaningful anymore and should be
-  // removed, but until then they can be used for more accurate usage tracking.
-  // TODO(https://crbug.com/984769): Eliminate process_id and frame_id from
-  // this method when grants stop being scoped to a frame.
   virtual scoped_refptr<NativeFileSystemPermissionGrant>
   GetWritePermissionGrant(const url::Origin& origin,
                           const base::FilePath& path,
                           bool is_directory,
-                          int process_id,
-                          int frame_id,
                           UserAction user_action) = 0;
 
   // Displays a dialog to confirm that the user intended to give read access to
@@ -74,8 +61,7 @@ class NativeFileSystemPermissionContext {
   virtual void ConfirmDirectoryReadAccess(
       const url::Origin& origin,
       const base::FilePath& path,
-      int process_id,
-      int frame_id,
+      GlobalFrameRoutingId frame_id,
       base::OnceCallback<void(PermissionStatus)> callback) = 0;
 
   // These values are persisted to logs. Entries should not be renumbered and
@@ -95,8 +81,7 @@ class NativeFileSystemPermissionContext {
       const url::Origin& origin,
       const std::vector<base::FilePath>& paths,
       bool is_directory,
-      int process_id,
-      int frame_id,
+      GlobalFrameRoutingId frame_id,
       base::OnceCallback<void(SensitiveDirectoryResult)> callback) = 0;
 
   enum class AfterWriteCheckResult { kAllow, kBlock };
@@ -104,8 +89,7 @@ class NativeFileSystemPermissionContext {
   // or other security checks to determine if the write should be allowed.
   virtual void PerformAfterWriteChecks(
       std::unique_ptr<NativeFileSystemWriteItem> item,
-      int process_id,
-      int frame_id,
+      GlobalFrameRoutingId frame_id,
       base::OnceCallback<void(AfterWriteCheckResult)> callback) = 0;
 
   // Returns whether the give |origin| already allows write permission, or it is
diff --git a/chromium/content/public/browser/native_file_system_permission_grant.h b/chromium/content/public/browser/native_file_system_permission_grant.h
index 0f8e51057eb..70c54f2faa5 100644
--- a/chromium/content/public/browser/native_file_system_permission_grant.h
+++ b/chromium/content/public/browser/native_file_system_permission_grant.h
@@ -10,6 +10,7 @@
 #include "base/observer_list.h"
 #include "base/observer_list_types.h"
 #include "content/common/content_export.h"
+#include "content/public/browser/global_routing_id.h"
 #include "third_party/blink/public/mojom/permissions/permission_status.mojom-forward.h"
 
 namespace content {
@@ -52,8 +53,7 @@ class CONTENT_EXPORT NativeFileSystemPermissionGrant
   // should be called after the status of this grant has been updated with
   // the outcome of the request.
   virtual void RequestPermission(
-      int process_id,
-      int frame_id,
+      GlobalFrameRoutingId frame_id,
       base::OnceCallback<void(PermissionRequestOutcome)> callback) = 0;
 
   // This observer can be used to be notified of changes to the permission
diff --git a/chromium/content/public/browser/navigation_controller.h b/chromium/content/public/browser/navigation_controller.h
index 754d13e9688..e9c849418a8 100644
--- a/chromium/content/public/browser/navigation_controller.h
+++ b/chromium/content/public/browser/navigation_controller.h
@@ -294,24 +294,18 @@ class NavigationController {
   // has not been responded to, the NavigationEntry is pending. Once data is
   // received for that entry, that NavigationEntry is committed.
 
-  // A transient entry is an entry that, when the user navigates away, is
-  // removed and discarded rather than being added to the back-forward list.
-  // Transient entries are useful for interstitial pages and the like.
-
   // Active entry --------------------------------------------------------------
 
   // THIS IS DEPRECATED. DO NOT USE. Use GetVisibleEntry instead.
   // See http://crbug.com/273710.
   //
-  // Returns the active entry, which is the transient entry if any, the pending
-  // entry if a navigation is in progress or the last committed entry otherwise.
-  // NOTE: This can be nullptr!!
+  // Returns the active entry, which is the pending entry if a navigation is in
+  // progress or the last committed entry otherwise. NOTE: This can be nullptr!!
   virtual NavigationEntry* GetActiveEntry() = 0;
 
   // Returns the entry that should be displayed to the user in the address bar.
-  // This is the transient entry if any, the pending entry if a navigation is
-  // in progress *and* is safe to display to the user (see below), or the last
-  // committed entry otherwise.
+  // This is the pending entry if a navigation is in progress *and* is safe to
+  // display to the user (see below), or the last committed entry otherwise.
   // NOTE: This can be nullptr if no entry has committed!
   //
   // A pending entry is safe to display if it started in the browser process or
@@ -329,8 +323,7 @@ class NavigationController {
   virtual NavigationEntry* GetLastCommittedEntry() = 0;
 
   // Returns the index of the last committed entry.  It will be -1 if there are
-  // no entries, or if there is a transient entry before the first entry
-  // commits.
+  // no entries.
   virtual int GetLastCommittedEntryIndex() = 0;
 
   // Returns true if the source for the current entry can be viewed.
@@ -339,8 +332,7 @@ class NavigationController {
   // Navigation list -----------------------------------------------------------
 
   // Returns the number of entries in the NavigationController, excluding
-  // the pending entry if there is one, but including the transient entry if
-  // any.
+  // the pending entry if there is one.
   virtual int GetEntryCount() = 0;
 
   virtual NavigationEntry* GetEntryAtIndex(int index) = 0;
@@ -351,7 +343,7 @@ class NavigationController {
 
   // Pending entry -------------------------------------------------------------
 
-  // Discards the pending and transient entries if any.
+  // Discards the pending entry if any.
   virtual void DiscardNonCommittedEntries() = 0;
 
   // Returns the pending entry corresponding to the navigation that is
@@ -362,22 +354,6 @@ class NavigationController {
   // corresponds to a new navigation (created via LoadURL).
   virtual int GetPendingEntryIndex() = 0;
 
-  // Transient entry -----------------------------------------------------------
-
-  // Returns the transient entry if any. This is an entry which is removed and
-  // discarded if any navigation occurs. Note that the returned entry is owned
-  // by the navigation controller and may be deleted at any time.
-  virtual NavigationEntry* GetTransientEntry() = 0;
-
-  // Adds an entry that is returned by GetActiveEntry(). The entry is
-  // transient: any navigation causes it to be removed and discarded.  The
-  // NavigationController becomes the owner of |entry| and deletes it when
-  // it discards it. This is useful with interstitial pages that need to be
-  // represented as an entry, but should go away when the user navigates away
-  // from them.
-  // Note that adding a transient entry does not change the active contents.
-  virtual void SetTransientEntry(std::unique_ptr<NavigationEntry> entry) = 0;
-
   // New navigations -----------------------------------------------------------
 
   // Loads the specified URL, specifying extra http headers to add to the
@@ -428,8 +404,7 @@ class NavigationController {
   // |check_for_repost| is true and the current entry has POST data the user is
   // prompted to see if they really want to reload the page.  In nearly all
   // cases pass in true in production code, but would do false for testing, or
-  // in cases where no user interface is available for prompting.  If a
-  // transient entry is showing, initiates a new navigation to its URL.
+  // in cases where no user interface is available for prompting.
   // NOTE: |reload_type| should never be NONE.
   virtual void Reload(ReloadType reload_type, bool check_for_repost) = 0;
 
@@ -437,11 +412,11 @@ class NavigationController {
 
   // Removes the entry at the specified |index|.  If the index is the last
   // committed index or the pending entry, this does nothing and returns false.
-  // Otherwise this call discards any transient or pending entries.
+  // Otherwise this call discards any pending entry.
   virtual bool RemoveEntryAtIndex(int index) = 0;
 
-  // Discards any transient or pending entries, then discards all entries after
-  // the current entry index.
+  // Discards any pending entry, then discards all entries after the current
+  // entry index.
   virtual void PruneForwardEntries() = 0;
 
   // Random --------------------------------------------------------------------
@@ -500,23 +475,20 @@ class NavigationController {
   // If there is a pending entry after *G* in |this|, it is also preserved.
   // If |replace_entry| is true, the current entry in |source| is replaced. So
   // the result above would be A B *G*.
-  // This ignores any pending or transient entries in |source|.  Callers must
-  // ensure that |CanPruneAllButLastCommitted| returns true before calling this,
-  // or it will crash.
+  // This ignores any pending entry in |source|.  Callers must ensure that
+  // |CanPruneAllButLastCommitted| returns true before calling this, or it will
+  // crash.
   virtual void CopyStateFromAndPrune(NavigationController* source,
                                      bool replace_entry) = 0;
 
   // Returns whether it is safe to call PruneAllButLastCommitted or
-  // CopyStateFromAndPrune.  There must be a last committed entry, no transient
-  // entry, and if there is a pending entry, it must be new and not an existing
-  // entry.
+  // CopyStateFromAndPrune.  There must be a last committed entry, and if there
+  // is a pending entry, it must be new and not an existing entry.
   //
   // If there were no last committed entry, the pending entry might not commit,
   // leaving us with a blank page.  This is unsafe when used with
   // |CopyStateFromAndPrune|, which would show an existing entry above the blank
   // page.
-  // If there were a transient entry, we would not want to prune the other
-  // entries, which the transient entry could be referring to.
   // If there were an existing pending entry, we could not prune the last
   // committed entry, in case it did not commit.  That would leave us with no
   // sensible place to put the pending entry when it did commit, after all other
diff --git a/chromium/content/public/browser/navigation_handle.h b/chromium/content/public/browser/navigation_handle.h
index b9accb65fe4..d3907d288e0 100644
--- a/chromium/content/public/browser/navigation_handle.h
+++ b/chromium/content/public/browser/navigation_handle.h
@@ -9,6 +9,7 @@
 #include <string>
 
 #include "content/common/content_export.h"
+#include "content/public/browser/navigation_handle_timing.h"
 #include "content/public/browser/navigation_throttle.h"
 #include "content/public/browser/reload_type.h"
 #include "content/public/browser/restore_type.h"
@@ -22,6 +23,7 @@
 #include "net/dns/public/resolve_error_info.h"
 #include "net/http/http_response_info.h"
 #include "services/network/public/cpp/resource_request_body.h"
+#include "third_party/blink/public/mojom/referrer.mojom.h"
 #include "ui/base/page_transition_types.h"
 
 class GURL;
@@ -124,13 +126,8 @@ class CONTENT_EXPORT NavigationHandle {
   // set if unknown.
   virtual base::TimeTicks NavigationInputStart() = 0;
 
-  // The time the first HTTP request is sent.
-  // See comments on |NavigationRequest::first_request_start_| for details.
-  virtual base::TimeTicks FirstRequestStart() = 0;
-
-  // The time the headers of the first HTTP response is received.
-  // See comments on |NavigationRequest::first_response_start_| for details.
-  virtual base::TimeTicks FirstResponseStart() = 0;
+  // The timing information of loading for the navigation.
+  virtual const NavigationHandleTiming& GetNavigationHandleTiming() = 0;
 
   // Whether or not the navigation was started within a context menu.
   virtual bool WasStartedFromContextMenu() = 0;
@@ -164,6 +161,12 @@ class CONTENT_EXPORT NavigationHandle {
   // Returns a sanitized version of the referrer for this request.
   virtual const blink::mojom::Referrer& GetReferrer() = 0;
 
+  // Sets the referrer. The referrer may only be set during start and redirect
+  // phases. If the referer is set in navigation start, it is reset during the
+  // redirect. In other words, if you need to set a referer that applies to
+  // redirects, then this must be called during DidRedirectNavigation().
+  virtual void SetReferrer(blink::mojom::ReferrerPtr referrer) = 0;
+
   // Whether the navigation was initiated by a user gesture. Note that this
   // will return false for browser-initiated navigations.
   // TODO(clamy): This should return true for browser-initiated navigations.
@@ -227,7 +230,11 @@ class CONTENT_EXPORT NavigationHandle {
   // errors that leave the user on the previous page.
   virtual bool HasCommitted() = 0;
 
-  // Whether the navigation resulted in an error page.
+  // Whether the navigation committed an error page.
+  //
+  // DO NOT use this before the navigation commit. It would always return false.
+  // You can use it from WebContentsObserver::DidFinishNavigation().
+  //
   // Note that if an error page reloads, this will return true even though
   // GetNetErrorCode will be net::OK.
   virtual bool IsErrorPage() = 0;
diff --git a/chromium/content/public/browser/navigation_handle_timing.h b/chromium/content/public/browser/navigation_handle_timing.h
new file mode 100644
index 00000000000..84042db93b3
--- /dev/null
+++ b/chromium/content/public/browser/navigation_handle_timing.h
@@ -0,0 +1,91 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_PUBLIC_BROWSER_NAVIGATION_HANDLE_TIMING_H_
+#define CONTENT_PUBLIC_BROWSER_NAVIGATION_HANDLE_TIMING_H_
+
+#include "base/time/time.h"
+#include "content/common/content_export.h"
+
+namespace content {
+
+// NavigationHandleTiming contains timing information of loading for navigation
+// recorded in NavigationHandle. This is used for UMAs, not exposed to
+// JavaScript via Navigation Timing API etc unlike mojom::NavigationTiming. See
+// the design doc for details.
+// https://docs.google.com/document/d/16oqu9lyPbfgZIjQsRaCfaKE8r1Cdlb3d4GVSdth4AN8/edit?usp=sharing
+struct CONTENT_EXPORT NavigationHandleTiming {
+  // The time the first HTTP request was sent. This is filled with
+  // net::LoadTimingInfo::send_start during navigation.
+  //
+  // In some cases, this can be the time an internal request started that did
+  // not go to the networking layer. For example,
+  // - Service Worker: the time the fetch event was ready to be dispatched, see
+  //   content::ServiceWorkerMainResourceLoader::DidPrepareFetchEvent()).
+  // - HSTS: the time the internal redirect was handled.
+  // - Signed Exchange: the time the SXG was handled.
+  base::TimeTicks first_request_start_time;
+
+  // The time the headers of the first HTTP response were received. This is
+  // filled with net::LoadTimingInfo::receive_headers_start on the first HTTP
+  // response during navigation.
+  //
+  // In some cases, this can be the time an internal response was received that
+  // did not come from the networking layer. For example,
+  // - Service Worker: the time the response from the service worker was
+  //   received, see content::ServiceWorkerMainResourceLoader::StartResponse().
+  // - HSTS: the time the internal redirect was handled.
+  // - Signed Exchange: the time the SXG was handled.
+  base::TimeTicks first_response_start_time;
+
+  // The time a callback for the navigation loader was first invoked. The time
+  // between this and |first_response_start_time| includes any throttling or
+  // process/thread hopping between the network stack receiving the response and
+  // the navigation loader receiving it.
+  base::TimeTicks first_loader_callback_time;
+
+  // The time the final HTTP request was sent. This is filled with
+  // net::LoadTimingInfo::send_start during navigation.
+  //
+  // In some cases, this can be the time an internal request started that did
+  // not go to the networking layer. See the comment for
+  // |first_request_start_time|.
+  //
+  // This is equal to |first_request_start_time| if there is no redirection.
+  base::TimeTicks final_request_start_time;
+
+  // The time the headers of the final HTTP response were received. This is
+  // filled with net::LoadTimingInfo::receive_headers_start on the final HTTP
+  // response during navigation.
+  //
+  // In some cases, this can be the time an internal response was received that
+  // did not come from the networking layer. See the comment for
+  // |first_response_start_time|.
+  //
+  // This is equal to |first_response_start_time| if there is no redirection.
+  base::TimeTicks final_response_start_time;
+
+  // The time a callback for the navigation loader was last invoked. The time
+  // between this and |final_response_start_time| includes any throttling or
+  // process/thread hopping between the network stack receiving the response and
+  // the navigation loader receiving it.
+  //
+  // This is equal to |first_loader_callback_time| if there is no redirection.
+  base::TimeTicks final_loader_callback_time;
+
+  // The time the navigation commit message was sent to a renderer process.
+  base::TimeTicks navigation_commit_sent_time;
+
+  // The time the headers of the first HTTP response whose status code is
+  // 103 was received for the first/final request. This is filled with
+  // net::LoadTimingInfo::first_early_hints_time during navigation.
+  // These must only be used for 103 Early Hints experiment
+  // (https://crbug.com/1093693).
+  base::TimeTicks early_hints_for_first_request_time;
+  base::TimeTicks early_hints_for_final_request_time;
+};
+
+}  // namespace content
+
+#endif  // CONTENT_PUBLIC_BROWSER_NAVIGATION_HANDLE_TIMING_H_
diff --git a/chromium/content/public/browser/network_service_instance.h b/chromium/content/public/browser/network_service_instance.h
index 90d1f8d4970..3ca5329affa 100644
--- a/chromium/content/public/browser/network_service_instance.h
+++ b/chromium/content/public/browser/network_service_instance.h
@@ -11,7 +11,9 @@
 #include "base/callback_list.h"
 #include "build/build_config.h"
 #include "content/common/content_export.h"
+#include "services/cert_verifier/public/mojom/cert_verifier_service_factory.mojom-forward.h"
 #include "services/network/public/cpp/network_connection_tracker.h"
+#include "services/network/public/mojom/network_context.mojom-forward.h"
 
 namespace base {
 class SequencedTaskRunner;
@@ -77,6 +79,25 @@ CONTENT_EXPORT void SetNetworkConnectionTrackerForTesting(
 CONTENT_EXPORT const scoped_refptr<base::SequencedTaskRunner>&
 GetNetworkTaskRunner();
 
+// Returns a CertVerifierParams that can be placed into a new
+// network::mojom::NetworkContextParams.
+//
+// If the CertVerifierService feature is enabled, the
+// |cert_verifier_creation_params| will be used to configure a new
+// CertVerifierService, and a pipe to the new CertVerifierService will be placed
+// in the CertVerifierParams.
+//
+// Otherwise, |cert_verifier_creation_params| will just be placed directly into
+// the CertVerifierParams to configure an in-network-service CertVerifier.
+CONTENT_EXPORT network::mojom::CertVerifierParamsPtr GetCertVerifierParams(
+    network::mojom::CertVerifierCreationParamsPtr
+        cert_verifier_creation_params);
+
+// Sets the CertVerifierServiceFactory used to instantiate
+// CertVerifierServices.
+CONTENT_EXPORT void SetCertVerifierServiceFactoryForTesting(
+    cert_verifier::mojom::CertVerifierServiceFactory* service_factory);
+
 }  // namespace content
 
 #endif  // CONTENT_PUBLIC_BROWSER_NETWORK_SERVICE_INSTANCE_H_
diff --git a/chromium/content/public/browser/overlay_window.h b/chromium/content/public/browser/overlay_window.h
index 361f8e10162..644e5a4d42e 100644
--- a/chromium/content/public/browser/overlay_window.h
+++ b/chromium/content/public/browser/overlay_window.h
@@ -56,7 +56,7 @@ class OverlayWindow {
   virtual gfx::Rect GetBounds() = 0;
   virtual void UpdateVideoSize(const gfx::Size& natural_size) = 0;
   virtual void SetPlaybackState(PlaybackState playback_state) = 0;
-  virtual void SetAlwaysHidePlayPauseButton(bool is_visible) = 0;
+  virtual void SetPlayPauseButtonVisibility(bool is_visible) = 0;
   virtual void SetSkipAdButtonVisibility(bool is_visible) = 0;
   virtual void SetNextTrackButtonVisibility(bool is_visible) = 0;
   virtual void SetPreviousTrackButtonVisibility(bool is_visible) = 0;
diff --git a/chromium/content/public/browser/payment_app_provider.h b/chromium/content/public/browser/payment_app_provider.h
index 2489ae9a82e..a31725765e9 100644
--- a/chromium/content/public/browser/payment_app_provider.h
+++ b/chromium/content/public/browser/payment_app_provider.h
@@ -49,12 +49,14 @@ class CONTENT_EXPORT PaymentAppProvider {
   using CanMakePaymentCallback =
       base::OnceCallback<void(payments::mojom::CanMakePaymentResponsePtr)>;
   using AbortCallback = base::OnceCallback<void(bool)>;
+  using UpdatePaymentAppIconCallback =
+      base::OnceCallback<void(payments::mojom::PaymentHandlerStatus status)>;
 
   // Should be accessed only on the UI thread.
   virtual void GetAllPaymentApps(BrowserContext* browser_context,
                                  GetAllPaymentAppsCallback callback) = 0;
   virtual void InvokePaymentApp(
-      BrowserContext* browser_context,
+      WebContents* web_contents,
       int64_t registration_id,
       const url::Origin& sw_origin,
       payments::mojom::PaymentRequestEventDataPtr event_data,
@@ -71,14 +73,23 @@ class CONTENT_EXPORT PaymentAppProvider {
       const SupportedDelegations& supported_delegations,
       RegistrationIdCallback registration_id_callback,
       InvokePaymentAppCallback callback) = 0;
-  virtual void CanMakePayment(
+  virtual void UpdatePaymentAppIcon(
       BrowserContext* browser_context,
       int64_t registration_id,
+      const std::string& instrument_key,
+      const std::string& name,
+      const std::string& string_encoded_icon,
+      const std::string& method_name,
+      const SupportedDelegations& supported_delegations,
+      UpdatePaymentAppIconCallback callback) = 0;
+  virtual void CanMakePayment(
+      WebContents* web_contents,
+      int64_t registration_id,
       const url::Origin& sw_origin,
       const std::string& payment_request_id,
       payments::mojom::CanMakePaymentEventDataPtr event_data,
       CanMakePaymentCallback callback) = 0;
-  virtual void AbortPayment(BrowserContext* browser_context,
+  virtual void AbortPayment(WebContents* web_contents,
                             int64_t registration_id,
                             const url::Origin& sw_origin,
                             const std::string& payment_request_id,
@@ -89,12 +100,12 @@ class CONTENT_EXPORT PaymentAppProvider {
   // previously opened window in the same browser context will be closed after
   // calling this interface.
   virtual void SetOpenedWindow(WebContents* web_contents) = 0;
-  virtual void CloseOpenedWindow(BrowserContext* browser_context) = 0;
+  virtual void CloseOpenedWindow() = 0;
 
   // Notify the opened payment handler window is closing or closed by user so as
   // to abort payment request.
   virtual void OnClosingOpenedWindow(
-      BrowserContext* browser_context,
+      WebContents* web_contents,
       payments::mojom::PaymentEventResponseType reason) = 0;
 
   // Check whether given |sw_js_url| from |manifest_url| is allowed to register
diff --git a/chromium/content/public/browser/picture_in_picture_window_controller.h b/chromium/content/public/browser/picture_in_picture_window_controller.h
index f7c80a3f2e2..1a54e5ad5de 100644
--- a/chromium/content/public/browser/picture_in_picture_window_controller.h
+++ b/chromium/content/public/browser/picture_in_picture_window_controller.h
@@ -12,16 +12,16 @@ class OverlayWindow;
 class WebContents;
 
 // Interface for Picture in Picture window controllers. This is currently tied
-// to a WebContents |initiator| and created when a Picture in Picture window is
-// to be shown. This allows creation of a single window for the initiator
+// to a WebContents |web_contents| and created when a Picture in Picture window
+// is to be shown. This allows creation of a single window for the WebContents
 // WebContents.
 class PictureInPictureWindowController {
  public:
-  // Gets a reference to the controller associated with |initiator| and creates
-  // one if it does not exist. The returned pointer is guaranteed to be
+  // Gets a reference to the controller associated with |web_contents| and
+  // creates one if it does not exist. The returned pointer is guaranteed to be
   // non-null.
   CONTENT_EXPORT static PictureInPictureWindowController*
-  GetOrCreateForWebContents(WebContents* initiator);
+  GetOrCreateForWebContents(WebContents* web_contents);
 
   virtual ~PictureInPictureWindowController() = default;
 
@@ -43,10 +43,9 @@ class PictureInPictureWindowController {
   virtual OverlayWindow* GetWindowForTesting() = 0;
   virtual void UpdateLayerBounds() = 0;
   virtual bool IsPlayerActive() = 0;
-  virtual WebContents* GetInitiatorWebContents() = 0;
+  virtual WebContents* GetWebContents() = 0;
   virtual void UpdatePlaybackState(bool is_playing,
                                    bool reached_end_of_stream) = 0;
-  virtual void SetAlwaysHidePlayPauseButton(bool is_visible) = 0;
 
   // Called when the user interacts with the "Skip Ad" control.
   virtual void SkipAd() = 0;
diff --git a/chromium/content/public/browser/render_document_host_user_data.h b/chromium/content/public/browser/render_document_host_user_data.h
index a138fd60aa2..4bdb1e77097 100644
--- a/chromium/content/public/browser/render_document_host_user_data.h
+++ b/chromium/content/public/browser/render_document_host_user_data.h
@@ -85,6 +85,14 @@ class RenderDocumentHostUserData : public base::SupportsUserData::Data {
     return static_cast<T*>(GetRenderDocumentHostUserData(rfh, UserDataKey()));
   }
 
+  static T* GetOrCreateForCurrentDocument(RenderFrameHost* rfh) {
+    DCHECK(rfh);
+    if (!GetForCurrentDocument(rfh)) {
+      CreateForCurrentDocument(rfh);
+    }
+    return GetForCurrentDocument(rfh);
+  }
+
   static void DeleteForCurrentDocument(RenderFrameHost* rfh) {
     DCHECK(rfh);
     DCHECK(GetForCurrentDocument(rfh));
diff --git a/chromium/content/public/browser/render_frame_host.h b/chromium/content/public/browser/render_frame_host.h
index 94ba0f61dec..a45f1208331 100644
--- a/chromium/content/public/browser/render_frame_host.h
+++ b/chromium/content/public/browser/render_frame_host.h
@@ -50,7 +50,7 @@ enum class FeaturePolicyFeature;
 namespace base {
 class UnguessableToken;
 class Value;
-}
+}  // namespace base
 
 namespace features {
 CONTENT_EXPORT extern const base::Feature kCrashReporting;
@@ -123,6 +123,9 @@ class CONTENT_EXPORT RenderFrameHost : public IPC::Listener,
   // Returns the route id for this frame.
   virtual int GetRoutingID() = 0;
 
+  // Returns the frame token for this frame.
+  virtual const base::UnguessableToken& GetFrameToken() = 0;
+
   // Returns the accessibility tree ID for this RenderFrameHost.
   virtual ui::AXTreeID GetAXTreeID() = 0;
 
@@ -197,12 +200,16 @@ class CONTENT_EXPORT RenderFrameHost : public IPC::Listener,
   // never used to look up the FrameTreeNode instance.
   virtual base::UnguessableToken GetDevToolsFrameToken() = 0;
 
-  // Returns the embedding token for the current document in this
-  // RenderFrameHost. This token is used by a remote parent to uniquely identify
-  // it. The token will be changed when a new document commits in this
-  // RenderFrameHost. This will be null if the document is:
-  // - not embedded by a parent
-  // - a local child
+  // This token is present on all frames. For frames with parents, it allows
+  // identification of embedding relationships between parent and child. For
+  // main frames, it also allows generalization of the embedding relationship
+  // when the WebContents itself is embedded in another context such as the rest
+  // of the browser UI. This will be nullopt prior to the RenderFrameHost
+  // committing a navigation. After the first navigation commits this
+  // will return the token for the last committed document.
+  //
+  // TODO(crbug/1098283): Remove the nullopt scenario by creating the token in
+  // CreateChildFrame() or similar.
   virtual base::Optional<base::UnguessableToken> GetEmbeddingToken() = 0;
 
   // Returns the assigned name of the frame, the name of the iframe tag
@@ -430,13 +437,6 @@ class CONTENT_EXPORT RenderFrameHost : public IPC::Listener,
   // RenderFrameHost.
   virtual void ViewSource() = 0;
 
-  // Starts pausing subresource loading on this frame and returns
-  // PauseSubresourceLoadingHandle that controls the pausing behavior.  As long
-  // as this handle is live, pausing will continue until an internal
-  // navigation happens in the frame.
-  virtual mojo::Remote<blink::mojom::PauseSubresourceLoadingHandle>
-  PauseSubresourceLoading() = 0;
-
   // Run the given action on the media player location at the given point.
   virtual void ExecuteMediaPlayerActionAtLocation(
       const gfx::Point& location,
@@ -572,6 +572,14 @@ class CONTENT_EXPORT RenderFrameHost : public IPC::Listener,
   // same as the id for the main frame.
   virtual ukm::SourceId GetPageUkmSourceId() = 0;
 
+  // Report an inspector issue to devtools due the frame using an excessive
+  // amount of resources (cpu or network).  Invoked only for ad frames.
+  // TODO(crbug.com/1091720): This reporting should be done directly in the
+  // chrome layer in the future.
+  virtual void ReportHeavyAdIssue(
+      blink::mojom::HeavyAdResolutionStatus resolution,
+      blink::mojom::HeavyAdReason reason) = 0;
+
  private:
   // This interface should only be implemented inside content.
   friend class RenderFrameHostImpl;
diff --git a/chromium/content/public/browser/render_frame_metadata_provider.h b/chromium/content/public/browser/render_frame_metadata_provider.h
index 1b372e58a2b..139e9c268cb 100644
--- a/chromium/content/public/browser/render_frame_metadata_provider.h
+++ b/chromium/content/public/browser/render_frame_metadata_provider.h
@@ -6,6 +6,7 @@
 #define CONTENT_PUBLIC_BROWSER_RENDER_FRAME_METADATA_PROVIDER_H_
 
 #include "base/macros.h"
+#include "build/build_config.h"
 #include "cc/trees/render_frame_metadata.h"
 #include "content/common/content_export.h"
 
@@ -40,6 +41,10 @@ class CONTENT_EXPORT RenderFrameMetadataProvider {
     // to pass in Viz.
     virtual void OnLocalSurfaceIdChanged(
         const cc::RenderFrameMetadata& metadata) = 0;
+#if defined(OS_ANDROID)
+    virtual void OnRootScrollOffsetChanged(
+        const gfx::Vector2dF& root_scroll_offset) {}
+#endif
   };
 
   RenderFrameMetadataProvider() = default;
diff --git a/chromium/content/public/browser/render_process_host.h b/chromium/content/public/browser/render_process_host.h
index 675f9251fea..99cd8e9d8a5 100644
--- a/chromium/content/public/browser/render_process_host.h
+++ b/chromium/content/public/browser/render_process_host.h
@@ -468,6 +468,10 @@ class CONTENT_EXPORT RenderProcessHost : public IPC::Sender,
   virtual void LockToOrigin(const IsolationContext& isolation_context,
                             const GURL& lock_url) = 0;
 
+  // Returns true if this process is locked to a particular 'origin'.  See the
+  // LockToOrigin() call above.
+  virtual bool IsLockedToOriginForTesting() = 0;
+
   // The following several methods are for internal use only, and are only
   // exposed here to support MockRenderProcessHost usage in tests.
   virtual void BindCacheStorage(
@@ -572,6 +576,16 @@ class CONTENT_EXPORT RenderProcessHost : public IPC::Sender,
   // globally-used spare RenderProcessHost at any time.
   static RenderProcessHost* GetSpareRenderProcessHostForTesting();
 
+  // Registers a callback to be notified when the spare RenderProcessHost is
+  // changed. If a new spare RenderProcessHost is created, the callback is made
+  // when the host is ready (RenderProcessHostObserver::RenderProcessReady). If
+  // the spare RenderProcessHost is promoted to be a "real" RenderProcessHost or
+  // discarded for any reason, the callback is made with a null pointer.
+  static std::unique_ptr<
+      base::CallbackList<void(RenderProcessHost*)>::Subscription>
+  RegisterSpareRenderProcessHostChangedCallback(
+      const base::RepeatingCallback<void(RenderProcessHost*)>& cb);
+
   // Flag to run the renderer in process.  This is primarily
   // for debugging purposes.  When running "in process", the
   // browser maintains a single RenderProcessHost which communicates
@@ -598,12 +612,6 @@ class CONTENT_EXPORT RenderProcessHost : public IPC::Sender,
   static RenderProcessHost* FromRendererInstanceId(
       const base::Token& instance_id);
 
-  // Returns whether the process-per-site model is in use (globally or just for
-  // the current site), in which case we should ensure there is only one
-  // RenderProcessHost per site for the entire browser context.
-  static bool ShouldUseProcessPerSite(content::BrowserContext* browser_context,
-                                      const GURL& site_url);
-
   // Returns true if the caller should attempt to use an existing
   // RenderProcessHost rather than creating a new one.
   static bool ShouldTryToUseExistingProcessHost(
diff --git a/chromium/content/public/browser/render_view_host.h b/chromium/content/public/browser/render_view_host.h
index 893c45a5c71..dfd856eb481 100644
--- a/chromium/content/public/browser/render_view_host.h
+++ b/chromium/content/public/browser/render_view_host.h
@@ -12,8 +12,8 @@
 #include "content/public/common/page_zoom.h"
 #include "ipc/ipc_sender.h"
 #include "mojo/public/cpp/system/core.h"
+#include "third_party/blink/public/common/page/web_drag_operation.h"
 #include "third_party/blink/public/mojom/frame/frame.mojom-forward.h"
-#include "third_party/blink/public/platform/web_drag_operation.h"
 
 namespace gfx {
 class Point;
diff --git a/chromium/content/public/browser/render_widget_host.h b/chromium/content/public/browser/render_widget_host.h
index 435461c0953..d930028fe53 100644
--- a/chromium/content/public/browser/render_widget_host.h
+++ b/chromium/content/public/browser/render_widget_host.h
@@ -21,8 +21,8 @@
 #include "ipc/ipc_sender.h"
 #include "third_party/blink/public/common/input/web_gesture_event.h"
 #include "third_party/blink/public/common/input/web_input_event.h"
+#include "third_party/blink/public/common/page/web_drag_operation.h"
 #include "third_party/blink/public/mojom/input/input_event_result.mojom-shared.h"
-#include "third_party/blink/public/platform/web_drag_operation.h"
 #include "ui/base/ui_base_types.h"
 #include "ui/surface/transport_dib.h"
 
diff --git a/chromium/content/public/browser/render_widget_host_view.h b/chromium/content/public/browser/render_widget_host_view.h
index 3e5bf09f1cf..4810a45aa4b 100644
--- a/chromium/content/public/browser/render_widget_host_view.h
+++ b/chromium/content/public/browser/render_widget_host_view.h
@@ -267,9 +267,6 @@ class CONTENT_EXPORT RenderWidgetHostView {
   // |destination_is_loaded| is true when
   //   ResourceCoordinatorTabHelper::IsLoaded() is true for the new tab
   //   contents.
-  // |destination_is_frozen| is true when
-  //   ResourceCoordinatorTabHelper::IsFrozen() is true for the new tab
-  //   contents.
   // |show_reason_tab_switching| is true when tab switch event should be
   //   reported.
   // |show_reason_unoccluded| is true when "unoccluded" event should be
@@ -279,7 +276,6 @@ class CONTENT_EXPORT RenderWidgetHostView {
   virtual void SetRecordContentToVisibleTimeRequest(
       base::TimeTicks start_time,
       base::Optional<bool> destination_is_loaded,
-      base::Optional<bool> destination_is_frozen,
       bool show_reason_tab_switching,
       bool show_reason_unoccluded,
       bool show_reason_bfcache_restore) = 0;
diff --git a/chromium/content/public/browser/service_process_host.cc b/chromium/content/public/browser/service_process_host.cc
index e03e0f4dc17..842b7afc4f5 100644
--- a/chromium/content/public/browser/service_process_host.cc
+++ b/chromium/content/public/browser/service_process_host.cc
@@ -15,12 +15,6 @@ ServiceProcessHost::Options::~Options() = default;
 
 ServiceProcessHost::Options::Options(Options&&) = default;
 
-ServiceProcessHost::Options& ServiceProcessHost::Options::WithSandboxType(
-    SandboxType type) {
-  sandbox_type = type;
-  return *this;
-}
-
 ServiceProcessHost::Options& ServiceProcessHost::Options::WithDisplayName(
     const std::string& name) {
   display_name = base::UTF8ToUTF16(name);
diff --git a/chromium/content/public/browser/service_process_host.h b/chromium/content/public/browser/service_process_host.h
index 5bf31c75cf6..2cd87b2da28 100644
--- a/chromium/content/public/browser/service_process_host.h
+++ b/chromium/content/public/browser/service_process_host.h
@@ -60,11 +60,6 @@ class CONTENT_EXPORT ServiceProcessHost {
 
     Options(Options&&);
 
-    // Specifies the sandbox type with which to launch the service process.
-    // Defaults to a generic, restrictive utility process sandbox.
-    // TODO(1065087) Deprecate.
-    Options& WithSandboxType(SandboxType type);
-
     // Specifies the display name of the service process. This should generally
     // be a human readable and meaningful application or service name and will
     // appear in places like the system task viewer.
@@ -126,9 +121,7 @@ class CONTENT_EXPORT ServiceProcessHost {
   template <typename Interface>
   static void Launch(mojo::PendingReceiver<Interface> receiver,
                      Options options = {}) {
-    // TODO(1065087) remove this test once all services are migrated.
-    if (options.sandbox_type == SandboxType::kUtility)
-      options.sandbox_type = content::GetServiceSandboxType<Interface>();
+    options.sandbox_type = content::GetServiceSandboxType<Interface>();
     Launch(mojo::GenericPendingReceiver(std::move(receiver)),
            std::move(options));
   }
@@ -139,9 +132,7 @@ class CONTENT_EXPORT ServiceProcessHost {
   // May be called from any thread.
   template <typename Interface>
   static mojo::Remote<Interface> Launch(Options options = {}) {
-    // TODO(1065087) remove this test once all services are migrated.
-    if (options.sandbox_type == SandboxType::kUtility)
-      options.sandbox_type = content::GetServiceSandboxType<Interface>();
+    options.sandbox_type = content::GetServiceSandboxType<Interface>();
     mojo::Remote<Interface> remote;
     Launch(remote.BindNewPipeAndPassReceiver(), std::move(options));
     return remote;
diff --git a/chromium/content/public/browser/service_worker_client_info.cc b/chromium/content/public/browser/service_worker_client_info.cc
new file mode 100644
index 00000000000..d38de92e232
--- /dev/null
+++ b/chromium/content/public/browser/service_worker_client_info.cc
@@ -0,0 +1,44 @@
+// Copyright 2018 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "content/public/browser/service_worker_client_info.h"
+
+namespace content {
+
+ServiceWorkerClientInfo::ServiceWorkerClientInfo(int frame_tree_node_id)
+    : type_(blink::mojom::ServiceWorkerClientType::kWindow),
+      frame_tree_node_id_(frame_tree_node_id) {}
+ServiceWorkerClientInfo::ServiceWorkerClientInfo(
+    DedicatedWorkerId dedicated_worker_id)
+    : type_(blink::mojom::ServiceWorkerClientType::kDedicatedWorker),
+      dedicated_worker_id_(dedicated_worker_id) {}
+ServiceWorkerClientInfo::ServiceWorkerClientInfo(
+    SharedWorkerId shared_worker_id)
+    : type_(blink::mojom::ServiceWorkerClientType::kSharedWorker),
+      shared_worker_id_(shared_worker_id) {}
+
+ServiceWorkerClientInfo::ServiceWorkerClientInfo(
+    const ServiceWorkerClientInfo& other) = default;
+
+ServiceWorkerClientInfo& ServiceWorkerClientInfo::operator=(
+    const ServiceWorkerClientInfo& other) = default;
+
+ServiceWorkerClientInfo::~ServiceWorkerClientInfo() = default;
+
+int ServiceWorkerClientInfo::GetFrameTreeNodeId() const {
+  DCHECK_EQ(type_, blink::mojom::ServiceWorkerClientType::kWindow);
+  return frame_tree_node_id_;
+}
+
+DedicatedWorkerId ServiceWorkerClientInfo::GetDedicatedWorkerId() const {
+  DCHECK_EQ(type_, blink::mojom::ServiceWorkerClientType::kDedicatedWorker);
+  return dedicated_worker_id_;
+}
+
+SharedWorkerId ServiceWorkerClientInfo::GetSharedWorkerId() const {
+  DCHECK_EQ(type_, blink::mojom::ServiceWorkerClientType::kSharedWorker);
+  return shared_worker_id_;
+}
+
+}  // namespace content
diff --git a/chromium/content/public/browser/service_worker_client_info.h b/chromium/content/public/browser/service_worker_client_info.h
new file mode 100644
index 00000000000..2a5f02e0042
--- /dev/null
+++ b/chromium/content/public/browser/service_worker_client_info.h
@@ -0,0 +1,52 @@
+// Copyright 2018 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_PUBLIC_BROWSER_SERVICE_WORKER_CLIENT_INFO_H_
+#define CONTENT_PUBLIC_BROWSER_SERVICE_WORKER_CLIENT_INFO_H_
+
+#include "content/common/content_export.h"
+#include "content/public/browser/dedicated_worker_id.h"
+#include "content/public/browser/render_frame_host.h"
+#include "content/public/browser/shared_worker_id.h"
+#include "third_party/blink/public/mojom/service_worker/service_worker_client.mojom.h"
+
+namespace content {
+
+// Holds information about a single service worker client:
+// https://w3c.github.io/ServiceWorker/#client
+class CONTENT_EXPORT ServiceWorkerClientInfo {
+ public:
+  explicit ServiceWorkerClientInfo(int frame_tree_node_id);
+  explicit ServiceWorkerClientInfo(DedicatedWorkerId dedicated_worker_id);
+  explicit ServiceWorkerClientInfo(SharedWorkerId shared_worker_id);
+
+  ServiceWorkerClientInfo(const ServiceWorkerClientInfo& other);
+  ServiceWorkerClientInfo& operator=(const ServiceWorkerClientInfo& other);
+
+  ~ServiceWorkerClientInfo();
+
+  // Returns the type of this client.
+  blink::mojom::ServiceWorkerClientType type() const { return type_; }
+
+  int GetFrameTreeNodeId() const;
+  DedicatedWorkerId GetDedicatedWorkerId() const;
+  SharedWorkerId GetSharedWorkerId() const;
+
+ private:
+  // The client type.
+  blink::mojom::ServiceWorkerClientType type_;
+
+  // The frame tree node ID, if this is a window client.
+  int frame_tree_node_id_ = content::RenderFrameHost::kNoFrameTreeNodeId;
+
+  // The ID of the client, if this is a dedicated worker client.
+  DedicatedWorkerId dedicated_worker_id_;
+
+  // The ID of the client, if this is a shared worker client.
+  SharedWorkerId shared_worker_id_;
+};
+
+}  // namespace content
+
+#endif  // CONTENT_PUBLIC_BROWSER_SERVICE_WORKER_CLIENT_INFO_H_
diff --git a/chromium/content/public/browser/service_worker_context.h b/chromium/content/public/browser/service_worker_context.h
index 7dd43ecf735..6022b2b75ee 100644
--- a/chromium/content/public/browser/service_worker_context.h
+++ b/chromium/content/public/browser/service_worker_context.h
@@ -157,6 +157,21 @@ class CONTENT_EXPORT ServiceWorkerContext {
       const GURL& origin,
       CountExternalRequestsCallback callback) = 0;
 
+  // Whether |origin| has any registrations. Uninstalling and uninstalled
+  // registrations do not cause this to return true, that is, only registrations
+  // with status ServiceWorkerRegistration::Status::kIntact are considered, such
+  // as even if the corresponding live registrations may still exist. Also,
+  // returns true if it doesn't know (registrations are not yet initialized).
+  // Must be called on the UI thread.
+  virtual bool MaybeHasRegistrationForOrigin(const url::Origin& origin) = 0;
+
+  // TODO(nidhijaju): Remove the ForTest() functions here and the tests that
+  // need it (e.g. in IsolatedPrerender) should use FakeServiceWorkerContext
+  // instead.
+  virtual void WaitForRegistrationsInitializedForTest() = 0;
+  virtual void AddRegistrationToRegisteredOriginsForTest(
+      const url::Origin& origin) = 0;
+
   // May be called from any thread, and the callback is called on that thread.
   virtual void GetAllOriginsInfo(GetUsageInfoCallback callback) = 0;
 
diff --git a/chromium/content/public/browser/service_worker_context_observer.h b/chromium/content/public/browser/service_worker_context_observer.h
index dd930c28bcb..bdc6acf5b62 100644
--- a/chromium/content/public/browser/service_worker_context_observer.h
+++ b/chromium/content/public/browser/service_worker_context_observer.h
@@ -5,6 +5,10 @@
 #ifndef CONTENT_PUBLIC_BROWSER_SERVICE_WORKER_CONTEXT_OBSERVER_H_
 #define CONTENT_PUBLIC_BROWSER_SERVICE_WORKER_CONTEXT_OBSERVER_H_
 
+#include <string>
+
+#include "content/public/browser/global_routing_id.h"
+#include "content/public/browser/service_worker_client_info.h"
 #include "url/gurl.h"
 
 namespace content {
@@ -52,10 +56,27 @@ class ServiceWorkerContextObserver {
       const ServiceWorkerRunningInfo& running_info) {}
   virtual void OnVersionStoppedRunning(int64_t version_id) {}
 
+  // Called when a controllee is added/removed for the service worker with id
+  // |version_id|.
+  virtual void OnControlleeAdded(int64_t version_id,
+                                 const std::string& client_uuid,
+                                 const ServiceWorkerClientInfo& client_info) {}
+  virtual void OnControlleeRemoved(int64_t version_id,
+                                   const std::string& client_uuid) {}
+
   // Called when there are no more controllees for the service worker with id
   // |version_id|.
   virtual void OnNoControllees(int64_t version_id, const GURL& scope) {}
 
+  // Called when the navigation for a window client commits to a render frame
+  // host. At this point, if there was a previous controllee attached to that
+  // render frame host, it has already been removed and OnControlleeRemoved()
+  // has been called.
+  virtual void OnControlleeNavigationCommitted(
+      int64_t version_id,
+      const std::string& client_uuid,
+      GlobalFrameRoutingId render_frame_host_id) {}
+
   // Called when a console message is reported for the service worker with id
   // |version_id|.
   virtual void OnReportConsoleMessage(int64_t version_id,
diff --git a/chromium/content/public/browser/shared_worker_service.h b/chromium/content/public/browser/shared_worker_service.h
index f4fe6dbfe21..807d4f28a98 100644
--- a/chromium/content/public/browser/shared_worker_service.h
+++ b/chromium/content/public/browser/shared_worker_service.h
@@ -31,16 +31,14 @@ class CONTENT_EXPORT SharedWorkerService {
  public:
   class Observer : public base::CheckedObserver {
    public:
-    // Called when a shared worker has started/stopped. This means that Start()
-    // was called for that worker and it got assigned its DevTools token. Note
-    // that it may still be evaluating the script and thus it could not be yet
-    // running in the renderer. This differs a bit from the "started" state of
-    // the embedded worker.
-    virtual void OnWorkerStarted(
+    // Called when a shared worker is created/destroyed. Note that it is not yet
+    // started in the renderer since its script still has to be downloaded and
+    // evaluated.
+    virtual void OnWorkerCreated(
         SharedWorkerId shared_worker_id,
         int worker_process_id,
         const base::UnguessableToken& dev_tools_token) = 0;
-    virtual void OnBeforeWorkerTerminated(SharedWorkerId shared_worker_id) = 0;
+    virtual void OnBeforeWorkerDestroyed(SharedWorkerId shared_worker_id) = 0;
 
     // Called when the final response URL (the URL after redirects) was
     // determined when fetching the worker's script.
@@ -50,7 +48,7 @@ class CONTENT_EXPORT SharedWorkerService {
                                               const GURL& url) {}
 
     // Called when a frame starts/stop being a client of a shared worker. It is
-    // guaranteed that OnWorkerStarted() is called before receiving these
+    // guaranteed that OnWorkerCreated() is called before receiving these
     // notifications.
     virtual void OnClientAdded(
         SharedWorkerId shared_worker_id,
@@ -64,13 +62,13 @@ class CONTENT_EXPORT SharedWorkerService {
   virtual void AddObserver(Observer* observer) = 0;
   virtual void RemoveObserver(Observer* observer) = 0;
 
-  // Invokes OnWorkerStarted() on |observer| for all existing shared workers.
+  // Invokes OnWorkerCreated() on |observer| for all existing shared workers.
   //
   // This function must be invoked in conjunction with AddObserver(). It is
   // meant to be used by an observer that dynamically subscribe to the
-  // SharedWorkerService while some workers are already running. It avoids
-  // receiving a OnBeforeWorkerTerminated() event without having received the
-  // corresponding OnWorkerStart() event.
+  // SharedWorkerService while some workers already exist. It avoids
+  // receiving a OnBeforeWorkerDestroyed() event without having received the
+  // corresponding OnWorkerCreated() event.
   //
   // Note: Due to current callers not needing it, this function does NOT call
   //       OnClientAdded() for each worker's clients.
diff --git a/chromium/content/public/browser/site_instance.h b/chromium/content/public/browser/site_instance.h
index 0a5aec6455a..82b5d4c25ad 100644
--- a/chromium/content/public/browser/site_instance.h
+++ b/chromium/content/public/browser/site_instance.h
@@ -157,8 +157,8 @@ class CONTENT_EXPORT SiteInstance : public base::RefCounted<SiteInstance> {
   virtual bool IsGuest() = 0;
 
   // Factory method to create a new SiteInstance.  This will create a new
-  // new BrowsingInstance, so it should only be used when creating a new tab
-  // from scratch (or similar circumstances).
+  // BrowsingInstance, so it should only be used when creating a new tab from
+  // scratch (or similar circumstances).
   //
   // The render process host factory may be nullptr.  See SiteInstance
   // constructor.
diff --git a/chromium/content/public/browser/storage_partition_config.cc b/chromium/content/public/browser/storage_partition_config.cc
new file mode 100644
index 00000000000..b33b589e877
--- /dev/null
+++ b/chromium/content/public/browser/storage_partition_config.cc
@@ -0,0 +1,74 @@
+// Copyright (c) 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "content/public/browser/storage_partition_config.h"
+
+#include "base/check.h"
+
+namespace content {
+
+StoragePartitionConfig::StoragePartitionConfig(const StoragePartitionConfig&) =
+    default;
+StoragePartitionConfig& StoragePartitionConfig::operator=(
+    const StoragePartitionConfig&) = default;
+
+// static
+StoragePartitionConfig StoragePartitionConfig::CreateDefault() {
+  return StoragePartitionConfig("", "", false);
+}
+
+// static
+StoragePartitionConfig StoragePartitionConfig::Create(
+    const std::string& partition_domain,
+    const std::string& partition_name,
+    bool in_memory) {
+  // If a caller tries to pass an empty partition_domain something is seriously
+  // wrong or the calling code is not explicitly signalling its desire to create
+  // a default partition by calling CreateDefault().
+  CHECK(!partition_domain.empty());
+  return StoragePartitionConfig(partition_domain, partition_name, in_memory);
+}
+
+StoragePartitionConfig::StoragePartitionConfig(
+    const std::string& partition_domain,
+    const std::string& partition_name,
+    bool in_memory)
+    : partition_domain_(partition_domain),
+      partition_name_(partition_name),
+      in_memory_(in_memory) {}
+
+StoragePartitionConfig StoragePartitionConfig::CopyWithInMemorySet() const {
+  if (in_memory_)
+    return *this;
+
+  return StoragePartitionConfig(partition_domain_, partition_name_,
+                                true /* in_memory */);
+}
+
+bool StoragePartitionConfig::operator<(
+    const StoragePartitionConfig& rhs) const {
+  if (partition_domain_ != rhs.partition_domain_)
+    return partition_domain_ < rhs.partition_domain_;
+
+  if (partition_name_ != rhs.partition_name_)
+    return partition_name_ < rhs.partition_name_;
+
+  if (in_memory_ != rhs.in_memory_)
+    return in_memory_ < rhs.in_memory_;
+
+  return false;
+}
+
+bool StoragePartitionConfig::operator==(
+    const StoragePartitionConfig& rhs) const {
+  return partition_domain_ == rhs.partition_domain_ &&
+         partition_name_ == rhs.partition_name_ && in_memory_ == rhs.in_memory_;
+}
+
+bool StoragePartitionConfig::operator!=(
+    const StoragePartitionConfig& rhs) const {
+  return !(*this == rhs);
+}
+
+}  // namespace content
diff --git a/chromium/content/public/browser/storage_partition_config.h b/chromium/content/public/browser/storage_partition_config.h
new file mode 100644
index 00000000000..c19719d815f
--- /dev/null
+++ b/chromium/content/public/browser/storage_partition_config.h
@@ -0,0 +1,68 @@
+// Copyright (c) 2012 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_PUBLIC_BROWSER_STORAGE_PARTITION_CONFIG_H_
+#define CONTENT_PUBLIC_BROWSER_STORAGE_PARTITION_CONFIG_H_
+
+#include <string>
+
+#include "base/gtest_prod_util.h"
+#include "content/common/content_export.h"
+
+namespace content {
+
+// Each StoragePartition is uniquely identified by which partition domain
+// it belongs to (such as an app or the browser itself), the user supplied
+// partition name and the bit indicating whether it should be persisted on
+// disk or not. This structure contains those elements and is used as
+// uniqueness key to lookup StoragePartition objects in the global map.
+class CONTENT_EXPORT StoragePartitionConfig {
+ public:
+  StoragePartitionConfig(const StoragePartitionConfig&);
+  StoragePartitionConfig& operator=(const StoragePartitionConfig&);
+
+  static StoragePartitionConfig CreateDefault();
+
+  // Creates a config tied to a specific domain.
+  // The |partition_domain| is [a-z]* UTF-8 string, specifying the domain in
+  // which partitions live (similar to namespace). |partition_domain| must NOT
+  // be an empty string. Within a domain, partitions can be uniquely identified
+  // by the combination of |partition_name| and |in_memory| values. When a
+  // partition is not to be persisted, the |in_memory| value must be set to
+  // true.
+  static StoragePartitionConfig Create(const std::string& partition_domain,
+                                       const std::string& partition_name,
+                                       bool in_memory);
+
+  std::string partition_domain() const { return partition_domain_; }
+  std::string partition_name() const { return partition_name_; }
+  bool in_memory() const { return in_memory_; }
+
+  // Returns true if this config was created by CreateDefault() or is
+  // a copy of a config created with that method.
+  bool is_default() const { return partition_domain_.empty(); }
+
+  // Returns a copy of this config that has the same partition_domain
+  // and partition_name, but the in_memeory field is always set to true.
+  StoragePartitionConfig CopyWithInMemorySet() const;
+
+  bool operator<(const StoragePartitionConfig& rhs) const;
+  bool operator==(const StoragePartitionConfig& rhs) const;
+  bool operator!=(const StoragePartitionConfig& rhs) const;
+
+ private:
+  FRIEND_TEST_ALL_PREFIXES(StoragePartitionConfigTest, OperatorLess);
+
+  StoragePartitionConfig(const std::string& partition_domain,
+                         const std::string& partition_name,
+                         bool in_memory);
+
+  std::string partition_domain_;
+  std::string partition_name_;
+  bool in_memory_ = false;
+};
+
+}  // namespace content
+
+#endif  // CONTENT_PUBLIC_BROWSER_STORAGE_PARTITION_CONFIG_H_
diff --git a/chromium/content/public/browser/storage_partition_config_unittest.cc b/chromium/content/public/browser/storage_partition_config_unittest.cc
new file mode 100644
index 00000000000..1805097c8f6
--- /dev/null
+++ b/chromium/content/public/browser/storage_partition_config_unittest.cc
@@ -0,0 +1,56 @@
+// Copyright (c) 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "content/public/browser/storage_partition_config.h"
+
+#include "testing/gtest/include/gtest/gtest.h"
+
+namespace content {
+
+// Test that the Less comparison function is implemented properly to uniquely
+// identify storage partitions used as keys in a std::map.
+TEST(StoragePartitionConfigTest, OperatorLess) {
+  StoragePartitionConfig c1(std::string(), std::string(), false);
+  StoragePartitionConfig c2(std::string(), std::string(), false);
+  StoragePartitionConfig c3(std::string(), std::string(), true);
+  StoragePartitionConfig c4("a", std::string(), true);
+  StoragePartitionConfig c5("b", std::string(), true);
+  StoragePartitionConfig c6(std::string(), "abc", false);
+  StoragePartitionConfig c7(std::string(), "abc", true);
+  StoragePartitionConfig c8("a", "abc", false);
+  StoragePartitionConfig c9("a", "abc", true);
+
+  // Let's ensure basic comparison works.
+  EXPECT_TRUE(c1 < c3);
+  EXPECT_TRUE(c1 < c4);
+  EXPECT_TRUE(c3 < c4);
+  EXPECT_TRUE(c4 < c5);
+  EXPECT_TRUE(c4 < c8);
+  EXPECT_TRUE(c6 < c4);
+  EXPECT_TRUE(c6 < c7);
+  EXPECT_TRUE(c8 < c9);
+
+  // Now, ensure antisymmetry for each pair we've tested.
+  EXPECT_FALSE(c3 < c1);
+  EXPECT_FALSE(c4 < c1);
+  EXPECT_FALSE(c4 < c3);
+  EXPECT_FALSE(c5 < c4);
+  EXPECT_FALSE(c8 < c4);
+  EXPECT_FALSE(c4 < c6);
+  EXPECT_FALSE(c7 < c6);
+  EXPECT_FALSE(c9 < c8);
+
+  // Check for irreflexivity.
+  EXPECT_FALSE(c1 < c1);
+  EXPECT_TRUE(c8 == c8);
+  EXPECT_FALSE(c8 != c8);
+
+  // Check for transitivity.
+  EXPECT_TRUE(c1 < c4);
+
+  // Let's enforce that two identical elements obey strict weak ordering.
+  EXPECT_TRUE(!(c1 < c2) && !(c2 < c1));
+}
+
+}  // namespace content
diff --git a/chromium/content/public/browser/tts_controller.h b/chromium/content/public/browser/tts_controller.h
index ced4805ea76..66f4b443d4b 100644
--- a/chromium/content/public/browser/tts_controller.h
+++ b/chromium/content/public/browser/tts_controller.h
@@ -147,6 +147,10 @@ class CONTENT_EXPORT TtsController {
   // embedder.
   virtual TtsEngineDelegate* GetTtsEngineDelegate() = 0;
 
+  // Sets whether speech should stop if the WebContents the utterance
+  // originated from is hidden. The default is false.
+  virtual void SetStopSpeakingWhenHidden(bool value) = 0;
+
   // Visible for testing.
   virtual void SetTtsPlatform(TtsPlatform* tts_platform) = 0;
   virtual int QueueSize() = 0;
diff --git a/chromium/content/public/browser/tts_controller_delegate.cc b/chromium/content/public/browser/tts_controller_delegate.cc
new file mode 100644
index 00000000000..996b2704517
--- /dev/null
+++ b/chromium/content/public/browser/tts_controller_delegate.cc
@@ -0,0 +1,29 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "content/public/browser/tts_controller_delegate.h"
+
+namespace content {
+
+TtsControllerDelegate::PreferredVoiceId::PreferredVoiceId(
+    const std::string& name,
+    const std::string& id)
+    : name(name), id(id) {}
+
+TtsControllerDelegate::PreferredVoiceId::PreferredVoiceId() = default;
+
+TtsControllerDelegate::PreferredVoiceId::~PreferredVoiceId() = default;
+
+TtsControllerDelegate::PreferredVoiceIds::PreferredVoiceIds() = default;
+
+TtsControllerDelegate::PreferredVoiceIds::PreferredVoiceIds(
+    const PreferredVoiceIds&) = default;
+
+TtsControllerDelegate::PreferredVoiceIds&
+TtsControllerDelegate::PreferredVoiceIds::operator=(const PreferredVoiceIds&) =
+    default;
+
+TtsControllerDelegate::PreferredVoiceIds::~PreferredVoiceIds() = default;
+
+}  // namespace content
diff --git a/chromium/content/public/browser/tts_controller_delegate.h b/chromium/content/public/browser/tts_controller_delegate.h
index 57b1c3200b2..d5c73556267 100644
--- a/chromium/content/public/browser/tts_controller_delegate.h
+++ b/chromium/content/public/browser/tts_controller_delegate.h
@@ -5,18 +5,55 @@
 #ifndef CONTENT_PUBLIC_BROWSER_TTS_CONTROLLER_DELEGATE_H_
 #define CONTENT_PUBLIC_BROWSER_TTS_CONTROLLER_DELEGATE_H_
 
-#include "content/public/browser/tts_controller.h"
-#include "content/public/browser/tts_utterance.h"
+#include <memory>
+#include <string>
+
+#include "base/optional.h"
+#include "content/common/content_export.h"
 
 namespace content {
 
-// Allows embedders to access the current state of text-to-speech.
-class TtsControllerDelegate {
+class TtsUtterance;
+
+// Allows embedders to control certain aspects of tts. This is only used on
+// ChromeOS.
+class CONTENT_EXPORT TtsControllerDelegate {
  public:
-  // Given an utterance and a vector of voices, return the
-  // index of the voice that best matches the utterance.
-  virtual int GetMatchingVoice(TtsUtterance* utterance,
-                               std::vector<VoiceData>& voices) = 0;
+  // Used in picking the best Voice for an Utterance.
+  struct CONTENT_EXPORT PreferredVoiceId {
+    PreferredVoiceId(const std::string& name, const std::string& id);
+    PreferredVoiceId();
+    ~PreferredVoiceId();
+
+    // Matches against Voice::name.
+    std::string name;
+    // Matches against Voice::engine_id.
+    std::string id;
+  };
+
+  struct CONTENT_EXPORT PreferredVoiceIds {
+    PreferredVoiceIds();
+    PreferredVoiceIds(const PreferredVoiceIds&);
+    PreferredVoiceIds& operator=(const PreferredVoiceIds&);
+    ~PreferredVoiceIds();
+
+    // The voice ID that matches the language of the utterance, if the user
+    // has picked a preferred voice for that language.
+    base::Optional<PreferredVoiceId> lang_voice_id;
+
+    // The voice ID that matches the language of the system locale, if the user
+    // has picked a preferred voice for that locale.
+    base::Optional<PreferredVoiceId> locale_voice_id;
+
+    // The voice ID that the user has chosen to use when no language code is
+    // specified, which can be used to match against any locale.
+    base::Optional<PreferredVoiceId> any_locale_voice_id;
+  };
+
+  // Returns the PreferredVoiceIds for an utterance. PreferredVoiceIds are used
+  // in determining which Voice is used for an Utterance.
+  virtual std::unique_ptr<PreferredVoiceIds> GetPreferredVoiceIdsForUtterance(
+      TtsUtterance* utterance) = 0;
 
   // Uses the user preferences to update the |rate|, |pitch| and |volume| for
   // a given |utterance|.
@@ -24,15 +61,6 @@ class TtsControllerDelegate {
                                                 double* rate,
                                                 double* pitch,
                                                 double* volume) = 0;
-
-  // Set the delegate that processes TTS requests with user-installed
-  // extensions.
-  virtual void SetTtsEngineDelegate(TtsEngineDelegate* delegate) = 0;
-
-  // Get the delegate that processes TTS requests with user-installed
-  // extensions.
-  virtual TtsEngineDelegate* GetTtsEngineDelegate() = 0;
-
  protected:
   virtual ~TtsControllerDelegate() {}
 };
diff --git a/chromium/content/public/browser/url_data_source.cc b/chromium/content/public/browser/url_data_source.cc
index e5b60a8179e..16b1b50842a 100644
--- a/chromium/content/public/browser/url_data_source.cc
+++ b/chromium/content/public/browser/url_data_source.cc
@@ -7,6 +7,9 @@
 #include <utility>
 
 #include "base/memory/ptr_util.h"
+#include "base/no_destructor.h"
+#include "base/strings/strcat.h"
+#include "base/strings/string_util.h"
 #include "base/task_runner_util.h"
 #include "content/browser/webui/url_data_manager.h"
 #include "content/browser/webui/url_data_manager_backend.h"
@@ -16,6 +19,20 @@
 #include "content/public/browser/browser_thread.h"
 #include "content/public/common/url_constants.h"
 #include "net/url_request/url_request.h"
+#include "services/network/public/mojom/content_security_policy.mojom.h"
+
+namespace {
+// A chrome-untrusted data source's name starts with chrome-untrusted://.
+bool IsChromeUntrustedDataSource(content::URLDataSource* source) {
+  static const base::NoDestructor<std::string> kChromeUntrustedSourceNamePrefix(
+      base::StrCat(
+          {content::kChromeUIUntrustedScheme, url::kStandardSchemeSeparator}));
+
+  return base::StartsWith(source->GetSource(),
+                          *kChromeUntrustedSourceNamePrefix,
+                          base::CompareCase::SENSITIVE);
+}
+}  // namespace
 
 namespace content {
 
@@ -58,38 +75,33 @@ bool URLDataSource::ShouldAddContentSecurityPolicy() {
   return true;
 }
 
-std::string URLDataSource::GetContentSecurityPolicyChildSrc() {
-  return "child-src 'none';";
-}
-
-std::string URLDataSource::GetContentSecurityPolicyDefaultSrc() {
-  return std::string();
-}
-
-std::string URLDataSource::GetContentSecurityPolicyImgSrc() {
-  return std::string();
-}
-
-std::string URLDataSource::GetContentSecurityPolicyObjectSrc() {
-  return "object-src 'none';";
-}
-
-std::string URLDataSource::GetContentSecurityPolicyScriptSrc() {
-  // Note: Do not add 'unsafe-eval' here. Instead override CSP for the
-  // specific pages that need it, see context http://crbug.com/525224.
-  return "script-src chrome://resources 'self';";
-}
-
-std::string URLDataSource::GetContentSecurityPolicyStyleSrc() {
-  return std::string();
-}
-
-std::string URLDataSource::GetContentSecurityPolicyWorkerSrc() {
-  return std::string();
-}
-
-std::string URLDataSource::GetContentSecurityPolicyFrameAncestors() {
-  return "frame-ancestors 'none';";
+std::string URLDataSource::GetContentSecurityPolicy(
+    network::mojom::CSPDirectiveName directive) {
+  switch (directive) {
+    case network::mojom::CSPDirectiveName::ChildSrc:
+      return "child-src 'none';";
+    case network::mojom::CSPDirectiveName::DefaultSrc:
+      return IsChromeUntrustedDataSource(this) ? "default-src 'self';"
+                                               : std::string();
+    case network::mojom::CSPDirectiveName::ObjectSrc:
+      return "object-src 'none';";
+    case network::mojom::CSPDirectiveName::ScriptSrc:
+      // Note: Do not add 'unsafe-eval' here. Instead override CSP for the
+      // specific pages that need it, see context http://crbug.com/525224.
+      return "script-src chrome://resources 'self';";
+    case network::mojom::CSPDirectiveName::FrameAncestors:
+      return "frame-ancestors 'none';";
+    case network::mojom::CSPDirectiveName::ConnectSrc:
+    case network::mojom::CSPDirectiveName::FormAction:
+    case network::mojom::CSPDirectiveName::FrameSrc:
+    case network::mojom::CSPDirectiveName::ImgSrc:
+    case network::mojom::CSPDirectiveName::MediaSrc:
+    case network::mojom::CSPDirectiveName::NavigateTo:
+    case network::mojom::CSPDirectiveName::StyleSrc:
+    case network::mojom::CSPDirectiveName::WorkerSrc:
+    case network::mojom::CSPDirectiveName::Unknown:
+      return std::string();
+  }
 }
 
 bool URLDataSource::ShouldDenyXFrameOptions() {
diff --git a/chromium/content/public/browser/url_data_source.h b/chromium/content/public/browser/url_data_source.h
index b386897a5ff..cf4df700f44 100644
--- a/chromium/content/public/browser/url_data_source.h
+++ b/chromium/content/public/browser/url_data_source.h
@@ -13,6 +13,7 @@
 #include "base/single_thread_task_runner.h"
 #include "content/common/content_export.h"
 #include "content/public/browser/web_contents.h"
+#include "content/public/browser/web_ui_data_source.h"
 #include "ui/base/template_expressions.h"
 
 class GURL;
@@ -94,32 +95,15 @@ class CONTENT_EXPORT URLDataSource {
   // is delivered through the data manager backend. Do not disable CSP on your
   // page without first contacting the chrome security team.
   virtual bool ShouldAddContentSecurityPolicy();
-  // For pre-existing code, enabling CSP with relaxed script-src attributes
-  // may be marginally better than disabling CSP outright.
-  // Do not override this method without first contacting the chrome security
-  // team.
-  // By default, "script-src chrome://resources 'self';" is added to CSP.
-  // Override to change this.
-  virtual std::string GetContentSecurityPolicyScriptSrc();
-
-  // It is OK to override the following methods to a custom CSP directive
-  // thereby slightly reducing the protection applied to the page.
-
-  // By default, "child-src 'none';" is added to CSP. Override to change this.
-  virtual std::string GetContentSecurityPolicyChildSrc();
-  // By default empty. Override to change this.
-  virtual std::string GetContentSecurityPolicyDefaultSrc();
-  // By default empty. Override to change this.
-  virtual std::string GetContentSecurityPolicyImgSrc();
-  // By default, "object-src 'none';" is added to CSP. Override to change this.
-  virtual std::string GetContentSecurityPolicyObjectSrc();
-  // By default empty. Override to change this.
-  virtual std::string GetContentSecurityPolicyStyleSrc();
-  // By default empty. Override to change this.
-  virtual std::string GetContentSecurityPolicyWorkerSrc();
-  // By default, "frame ancestors: 'none'" is added to the CSP unless
-  // ShouldDenyXFrameOptions() returns false.
-  virtual std::string GetContentSecurityPolicyFrameAncestors();
+
+  // By default, the following CSPs are added. Override to change this.
+  //  - "child-src 'none';"
+  //  - "object-src 'none';"
+  //  - "frame ancestors: 'none'" is added to the CSP unless
+  //    ShouldDenyXFrameOptions() returns false
+  //  - "script-src chrome://resources 'self';"
+  virtual std::string GetContentSecurityPolicy(
+      network::mojom::CSPDirectiveName directive);
 
   // By default, the "X-Frame-Options: DENY" header is sent. To stop this from
   // happening, return false. It is OK to return false as needed.
diff --git a/chromium/content/public/browser/url_loader_throttles.h b/chromium/content/public/browser/url_loader_throttles.h
new file mode 100644
index 00000000000..0e67d38f73a
--- /dev/null
+++ b/chromium/content/public/browser/url_loader_throttles.h
@@ -0,0 +1,38 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_PUBLIC_BROWSER_URL_LOADER_THROTTLES_H_
+#define CONTENT_PUBLIC_BROWSER_URL_LOADER_THROTTLES_H_
+
+#include "base/callback.h"
+#include "content/common/content_export.h"
+
+namespace blink {
+class URLLoaderThrottle;
+}  // namespace blink
+
+namespace network {
+struct ResourceRequest;
+}  // namespace network
+
+namespace content {
+
+class BrowserContext;
+class NavigationUIData;
+class WebContents;
+
+// Wrapper around ContentBrowserClient::CreateURLLoaderThrottles which inserts
+// additional content specific throttles.
+CONTENT_EXPORT
+std::vector<std::unique_ptr<blink::URLLoaderThrottle>>
+CreateContentBrowserURLLoaderThrottles(
+    const network::ResourceRequest& request,
+    BrowserContext* browser_context,
+    const base::RepeatingCallback<WebContents*()>& wc_getter,
+    NavigationUIData* navigation_ui_data,
+    int frame_tree_node_id);
+
+}  // namespace content
+
+#endif  // CONTENT_PUBLIC_BROWSER_URL_LOADER_THROTTLES_H_
diff --git a/chromium/content/public/browser/web_contents.h b/chromium/content/public/browser/web_contents.h
index 039f001f129..c5d3d6a2004 100644
--- a/chromium/content/public/browser/web_contents.h
+++ b/chromium/content/public/browser/web_contents.h
@@ -82,7 +82,6 @@ class BrowserContext;
 class BrowserPluginGuestDelegate;
 class RenderFrameHost;
 class RenderViewHost;
-class RenderWidgetHost;
 class RenderWidgetHostView;
 class WebContentsDelegate;
 class WebUI;
@@ -291,10 +290,7 @@ class WebContents : public PageNavigator,
 
   // Gets the virtual URL currently being displayed in the URL bar, if there is
   // one. This URL might be a pending navigation that hasn't committed yet, so
-  // it is not guaranteed to match the current page in this WebContents. A
-  // typical example of this is interstitials, which show the URL of the
-  // new/loading page (active) but the security context is of the old page (last
-  // committed).
+  // it is not guaranteed to match the current page in this WebContents.
   virtual const GURL& GetVisibleURL() = 0;
 
   // Gets the virtual URL of the last committed page in this WebContents.
@@ -428,12 +424,15 @@ class WebContents : public PageNavigator,
   using AccessibilityEventCallback =
       base::RepeatingCallback<void(const std::string&)>;
 
-  // Starts or stops recording accessibility events. While accessibility events
-  // are being recorded, the callback will be called when an accessibility
-  // event is received. The start paramater says whether the recording is
-  // starting or stopping.
-  virtual void RecordAccessibilityEvents(AccessibilityEventCallback callback,
-                                         bool start) = 0;
+  // Starts or stops recording accessibility events. |start_recording| is true
+  // when recording should start and false when recording should stop.
+  // |callback| is an optional function which is called when an accessibility
+  // event is received while accessibility events are being recorded. When
+  // |start_recording| is true, it is expected that |callback| has a value; when
+  // |start_recording| is false, it is expected that |callback| does not.
+  virtual void RecordAccessibilityEvents(
+      bool start_recording,
+      base::Optional<AccessibilityEventCallback> callback) = 0;
 
   // Tab navigation state ------------------------------------------------------
 
@@ -509,6 +508,9 @@ class WebContents : public PageNavigator,
                                       bool stay_hidden) = 0;
   virtual void DecrementCapturerCount(bool stay_hidden) = 0;
   virtual bool IsBeingCaptured() = 0;
+  // Returns true if there is any active capturer that called
+  // IncrementCaptureCount() with |stay_hidden|==false.
+  virtual bool IsBeingVisiblyCaptured() = 0;
 
   // Indicates/Sets whether all audio output from this WebContents is muted.
   virtual bool IsAudioMuted() = 0;
@@ -533,18 +535,6 @@ class WebContents : public PageNavigator,
   // handles.
   virtual bool HasNativeFileSystemHandles() = 0;
 
-  // Indicates whether any frame in the WebContents has native file system
-  // directory handles.
-  virtual bool HasNativeFileSystemDirectoryHandles() = 0;
-
-  // Returns the paths of all the native file system directory handles frames in
-  // this WebContents have access to.
-  virtual std::vector<base::FilePath> GetNativeFileSystemDirectoryHandles() = 0;
-
-  // Indicates whether any frame in the WebContents has writable native file
-  // system handles.
-  virtual bool HasWritableNativeFileSystemHandles() = 0;
-
   // Indicates whether a video is in Picture-in-Picture for |this|.
   virtual bool HasPictureInPictureVideo() = 0;
 
@@ -628,6 +618,10 @@ class WebContents : public PageNavigator,
   // This value may change over time due to portal activation and adoption.
   virtual bool IsPortal() = 0;
 
+  // If |IsPortal()| is true, returns this WebContents' portal host's
+  // WebContents. Otherwise, returns nullptr.
+  virtual WebContents* GetPortalHostWebContents() = 0;
+
   // Returns the outer WebContents frame, the same frame that this WebContents
   // was attached in AttachToOuterWebContentsFrame().
   virtual RenderFrameHost* GetOuterWebContentsFrame() = 0;
@@ -684,13 +678,6 @@ class WebContents : public PageNavigator,
   // Reloads the focused frame.
   virtual void ReloadFocusedFrame() = 0;
 
-  // Attains PauseSubresourceLoadingHandles for each frame in the web contents.
-  // As long as these handles are not deleted, subresources will continue to be
-  // deferred until an internal navigation happens in the frame. Holding handles
-  // for deleted or re-navigated frames has no effect.
-  virtual std::vector<mojo::Remote<blink::mojom::PauseSubresourceLoadingHandle>>
-  PauseSubresourceLoading() = 0;
-
   // Editing commands ----------------------------------------------------------
 
   virtual void Undo() = 0;
@@ -769,11 +756,6 @@ class WebContents : public PageNavigator,
   // is true when using Shift-Tab).
   virtual void FocusThroughTabTraversal(bool reverse) = 0;
 
-  // Interstitials -------------------------------------------------------------
-
-  // Various other systems need to know about our interstitials.
-  virtual bool ShowingInterstitialPage() = 0;
-
   // Misc state & callbacks ----------------------------------------------------
 
   // Check whether we can do the saving page operation this page given its MIME
@@ -832,9 +814,6 @@ class WebContents : public PageNavigator,
   // Returns the contents MIME type after a navigation.
   virtual const std::string& GetContentsMimeType() = 0;
 
-  // Returns true if this WebContents will notify about disconnection.
-  virtual bool WillNotifyDisconnection() = 0;
-
   // Returns the settings which get passed to the renderer.
   virtual blink::mojom::RendererPreferences* GetMutableRendererPrefs() = 0;
 
@@ -842,10 +821,6 @@ class WebContents : public PageNavigator,
   // out of nested run loops.
   virtual void Close() = 0;
 
-  // A render view-originated drag has ended. Informs the render view host and
-  // WebContentsDelegate.
-  virtual void SystemDragEnded(RenderWidgetHost* source_rwh) = 0;
-
   // Indicates if this tab was explicitly closed by the user (control-w, close
   // tab menu item...). This is false for actions that indirectly close the tab,
   // such as closing the window.  The setter is maintained by TabStripModel, and
diff --git a/chromium/content/public/browser/web_contents_delegate.cc b/chromium/content/public/browser/web_contents_delegate.cc
index 6017278cc0f..50936cd961b 100644
--- a/chromium/content/public/browser/web_contents_delegate.cc
+++ b/chromium/content/public/browser/web_contents_delegate.cc
@@ -353,6 +353,11 @@ WebContents* WebContentsDelegate::GetResponsibleWebContents(
   return web_contents;
 }
 
+device::mojom::GeolocationContext*
+WebContentsDelegate::GetInstalledWebappGeolocationContext() {
+  return nullptr;
+}
+
 base::WeakPtr<WebContentsDelegate> WebContentsDelegate::GetDelegateWeakPtr() {
   return nullptr;
 }
diff --git a/chromium/content/public/browser/web_contents_delegate.h b/chromium/content/public/browser/web_contents_delegate.h
index 7757c772040..e545ff70c61 100644
--- a/chromium/content/public/browser/web_contents_delegate.h
+++ b/chromium/content/public/browser/web_contents_delegate.h
@@ -26,12 +26,12 @@
 #include "content/public/common/previews_state.h"
 #include "content/public/common/window_container_type.mojom-forward.h"
 #include "third_party/blink/public/common/mediastream/media_stream_request.h"
+#include "third_party/blink/public/common/page/web_drag_operation.h"
 #include "third_party/blink/public/common/security/security_style.h"
 #include "third_party/blink/public/mojom/choosers/color_chooser.mojom-forward.h"
 #include "third_party/blink/public/mojom/frame/blocked_navigation_types.mojom.h"
 #include "third_party/blink/public/mojom/frame/fullscreen.mojom-forward.h"
 #include "third_party/blink/public/mojom/manifest/display_mode.mojom.h"
-#include "third_party/blink/public/platform/web_drag_operation.h"
 #include "third_party/skia/include/core/SkColor.h"
 #include "ui/base/window_open_disposition.h"
 #include "ui/gfx/geometry/rect_f.h"
@@ -73,6 +73,12 @@ struct Referrer;
 struct SecurityStyleExplanations;
 }  // namespace content
 
+namespace device {
+namespace mojom {
+class GeolocationContext;
+}
+}  // namespace device
+
 namespace gfx {
 class Rect;
 class Size;
@@ -448,12 +454,9 @@ class CONTENT_EXPORT WebContentsDelegate {
   virtual bool EmbedsFullscreenWidget();
 
   // Called when the renderer puts a tab into fullscreen mode.
-  // |origin| is the origin of the initiating frame inside the |web_contents|.
-  // |origin| can be empty in which case the |web_contents| last committed
-  // URL's origin should be used.
+  // |requesting_frame| is the specific content frame requesting fullscreen.
   virtual void EnterFullscreenModeForTab(
-      WebContents* web_contents,
-      const GURL& origin,
+      RenderFrameHost* requesting_frame,
       const blink::mojom::FullscreenOptions& options) {}
 
   // Called when the renderer puts a tab out of fullscreen mode.
@@ -732,6 +735,12 @@ class CONTENT_EXPORT WebContentsDelegate {
   // Invoked when media playback is interrupted or completed.
   virtual void MediaWatchTimeChanged(const MediaPlayerWatchTime& watch_time) {}
 
+  // Returns a  InstalledWebappGeolocationContext if this web content is running
+  // in a installed webapp and geolocation should be deleagted from the
+  // installed webapp; otherwise returns nullptr.
+  virtual device::mojom::GeolocationContext*
+  GetInstalledWebappGeolocationContext();
+
   // Returns a weak ptr to the web contents delegate.
   virtual base::WeakPtr<WebContentsDelegate> GetDelegateWeakPtr();
 
diff --git a/chromium/content/public/browser/web_contents_observer.h b/chromium/content/public/browser/web_contents_observer.h
index f0f6c11f599..231047ad1fe 100644
--- a/chromium/content/public/browser/web_contents_observer.h
+++ b/chromium/content/public/browser/web_contents_observer.h
@@ -214,6 +214,14 @@ class CONTENT_EXPORT WebContentsObserver : public IPC::Listener {
   // so do not keep a reference to it afterward.
   virtual void DidFinishNavigation(NavigationHandle* navigation_handle) {}
 
+  // Called after the contents replaces the |predecessor_contents| in its
+  // container due to portal activation. The |predecessor_contents| is now a
+  // portal pending adoption. |predecessor_contents| is non-null, but may
+  // subsequently be destroyed if it is not adopted.
+  // |activation_time| is the time the activation happened.
+  virtual void DidActivatePortal(WebContents* predecessor_web_contents,
+                                 base::TimeTicks activation_time) {}
+
   // Document load events ------------------------------------------------------
 
   // These three methods correspond to the points in time when a document starts
@@ -419,6 +427,20 @@ class CONTENT_EXPORT WebContentsObserver : public IPC::Listener {
   // added to the WebContents tree at this point, but can be observed safely.
   virtual void InnerWebContentsCreated(WebContents* inner_web_contents) {}
 
+  // Notifies that an |inner_web_contents| instance has been attached to the
+  // provided |render_frame_host|. By the time this is called the
+  // |inner_web_contents| will have been added to the WebContents tree.
+  virtual void InnerWebContentsAttached(WebContents* inner_web_contents,
+                                        RenderFrameHost* render_frame_host,
+                                        bool is_full_page) {}
+
+  // Notifies that an |inner_web_contents| instance has been detached from this
+  // WebContents. InnerWebContentsAttached() will already have been called for
+  // the |inner_web_contents|. By the time this is called the
+  // |inner_web_contents| will have been removed from the WebContents tree, but
+  // will still be alive and is safe to observe.
+  virtual void InnerWebContentsDetached(WebContents* inner_web_contents) {}
+
   // Invoked when WebContents::Clone() was used to clone a WebContents.
   virtual void DidCloneToNewWebContents(WebContents* old_web_contents,
                                         WebContents* new_web_contents) {}
@@ -436,12 +458,20 @@ class CONTENT_EXPORT WebContentsObserver : public IPC::Listener {
   // the renderer process. If the instance is created after the page is loaded,
   // it is recommended to call WebContents::GetFaviconURLs() to get the current
   // list as this callback will not be executed unless there is an update.
+  // |render_frame_host| is the main render frame host.
   virtual void DidUpdateFaviconURL(
+      RenderFrameHost* render_frame_host,
       const std::vector<blink::mojom::FaviconURLPtr>& candidates) {}
 
-  // Called when an audio change occurs.
+  // Called when an audio change occurs to this WebContents. If |audible| is
+  // true then one or more frames or child contents are emitting audio; if
+  // false, then no frames or child contents are emitting audio. See
+  // OnFrameAudioStateChanged for per-frame information.
   virtual void OnAudioStateChanged(bool audible) {}
 
+  // Called when the audio state of an individual frame changes.
+  virtual void OnFrameAudioStateChanged(RenderFrameHost* rfh, bool audible) {}
+
   // Called when the connected to Bluetooth device state changes.
   virtual void OnIsConnectedToBluetoothDeviceChanged(
       bool is_connected_to_bluetooth_device) {}
@@ -466,10 +496,6 @@ class CONTENT_EXPORT WebContentsObserver : public IPC::Listener {
   //     this frame own the current fullscreen element again.
   virtual void DidAcquireFullscreen(RenderFrameHost* rfh) {}
 
-  // Invoked when an interstitial page is attached or detached.
-  virtual void DidAttachInterstitialPage() {}
-  virtual void DidDetachInterstitialPage() {}
-
   // Invoked when the vertical scroll direction of the root layer is changed.
   // Note that if a scroll in a given direction occurs, the scroll is completed,
   // and then another scroll in the *same* direction occurs, we will not
@@ -546,6 +572,7 @@ class CONTENT_EXPORT WebContentsObserver : public IPC::Listener {
   virtual void MediaEffectivelyFullscreenChanged(bool is_fullscreen) {}
   virtual void MediaPictureInPictureChanged(bool is_picture_in_picture) {}
   virtual void MediaMutedStatusChanged(const MediaPlayerId& id, bool muted) {}
+  virtual void MediaBufferUnderflow(const MediaPlayerId& id) {}
 
   // Invoked when the renderer process changes the page scale factor.
   virtual void OnPageScaleFactorChanged(float page_scale_factor) {}
@@ -580,6 +607,7 @@ class CONTENT_EXPORT WebContentsObserver : public IPC::Listener {
   // document has both a manifest and a favicon, DidUpdateWebManifestURL() will
   // be invoked before DidUpdateFaviconURL().
   virtual void DidUpdateWebManifestURL(
+      RenderFrameHost* target_frame,
       const base::Optional<GURL>& manifest_url) {}
 
   // DEPRECATED. Please register interface binders with BrowserInterfaceBroker
@@ -598,12 +626,6 @@ class CONTENT_EXPORT WebContentsObserver : public IPC::Listener {
   virtual void AudioContextPlaybackStopped(
       const AudioContextId& audio_context_id) {}
 
-  // Called after the contents replaces the |predecessor_contents| in its
-  // container due to portal activation. The |predecessor_contents| is now a
-  // portal pending adoption. |predecessor_contents| is non-null, but may
-  // subsequently be destroyed if it is not adopted.
-  virtual void DidActivatePortal(WebContents* predecessor_contents) {}
-
   // Called when the RenderFrameHost tries to use a ServiceWorker
   // (e.g. via navigation.serviceWorker API).
   virtual void OnServiceWorkerAccessed(RenderFrameHost* render_frame_host,
diff --git a/chromium/content/public/browser/web_contents_user_data.h b/chromium/content/public/browser/web_contents_user_data.h
index 28996e5253e..6f5718e5d4b 100644
--- a/chromium/content/public/browser/web_contents_user_data.h
+++ b/chromium/content/public/browser/web_contents_user_data.h
@@ -5,7 +5,7 @@
 #ifndef CONTENT_PUBLIC_BROWSER_WEB_CONTENTS_USER_DATA_H_
 #define CONTENT_PUBLIC_BROWSER_WEB_CONTENTS_USER_DATA_H_
 
-#include "base/logging.h"
+#include "base/check.h"
 #include "base/memory/ptr_util.h"
 #include "base/supports_user_data.h"
 #include "content/public/browser/web_contents.h"
diff --git a/chromium/content/public/browser/web_ui.h b/chromium/content/public/browser/web_ui.h
index 4e6aa0e28d9..fa6f10c1bff 100644
--- a/chromium/content/public/browser/web_ui.h
+++ b/chromium/content/public/browser/web_ui.h
@@ -138,22 +138,6 @@ class CONTENT_EXPORT WebUI {
   template <typename T>
   static T GetValue(const base::Value& value);
 
-  template <>
-  inline bool GetValue<bool>(const base::Value& value) {
-    return value.GetBool();
-  }
-
-  template <>
-  inline int GetValue<int>(const base::Value& value) {
-    return value.GetInt();
-  }
-
-  template <>
-  inline const std::string& GetValue<const std::string&>(
-      const base::Value& value) {
-    return value.GetString();
-  }
-
   template <typename Is, typename... Args>
   struct Call;
 
@@ -169,6 +153,22 @@ class CONTENT_EXPORT WebUI {
   };
 };
 
+template <>
+inline bool WebUI::GetValue<bool>(const base::Value& value) {
+  return value.GetBool();
+}
+
+template <>
+inline int WebUI::GetValue<int>(const base::Value& value) {
+  return value.GetInt();
+}
+
+template <>
+inline const std::string& WebUI::GetValue<const std::string&>(
+    const base::Value& value) {
+  return value.GetString();
+}
+
 }  // namespace content
 
 #endif  // CONTENT_PUBLIC_BROWSER_WEB_UI_H_
diff --git a/chromium/content/public/browser/web_ui_controller.h b/chromium/content/public/browser/web_ui_controller.h
index bf308f1bb32..1c7d8216217 100644
--- a/chromium/content/public/browser/web_ui_controller.h
+++ b/chromium/content/public/browser/web_ui_controller.h
@@ -5,7 +5,9 @@
 #ifndef CONTENT_PUBLIC_BROWSER_WEB_UI_CONTROLLER_H_
 #define CONTENT_PUBLIC_BROWSER_WEB_UI_CONTROLLER_H_
 
-#include "base/logging.h"
+#include <ostream>
+
+#include "base/check.h"
 #include "base/strings/string16.h"
 #include "content/common/content_export.h"
 
diff --git a/chromium/content/public/browser/web_ui_data_source.h b/chromium/content/public/browser/web_ui_data_source.h
index e963d50a0ff..0c97a5c422d 100644
--- a/chromium/content/public/browser/web_ui_data_source.h
+++ b/chromium/content/public/browser/web_ui_data_source.h
@@ -15,6 +15,7 @@
 #include "base/strings/string16.h"
 #include "base/strings/string_piece.h"
 #include "content/common/content_export.h"
+#include "services/network/public/mojom/content_security_policy.mojom-forward.h"
 #include "url/gurl.h"
 
 namespace base {
@@ -111,19 +112,12 @@ class WebUIDataSource {
   // Currently only used by embedders for WebUIs with multiple instances.
   virtual void DisableReplaceExistingSource() = 0;
   virtual void DisableContentSecurityPolicy() = 0;
-  virtual void OverrideContentSecurityPolicyChildSrc(
-      const std::string& data) = 0;
-  virtual void OverrideContentSecurityPolicyDefaultSrc(
-      const std::string& data) = 0;
-  virtual void OverrideContentSecurityPolicyImgSrc(const std::string& data) = 0;
-  virtual void OverrideContentSecurityPolicyObjectSrc(
-      const std::string& data) = 0;
-  virtual void OverrideContentSecurityPolicyScriptSrc(
-      const std::string& data) = 0;
-  virtual void OverrideContentSecurityPolicyStyleSrc(
-      const std::string& data) = 0;
-  virtual void OverrideContentSecurityPolicyWorkerSrc(
-      const std::string& data) = 0;
+
+  // Overrides the content security policy for a certain directive.
+  virtual void OverrideContentSecurityPolicy(
+      network::mojom::CSPDirectiveName directive,
+      const std::string& value) = 0;
+
   // This method is deprecated and AddFrameAncestors should be used instead.
   virtual void DisableDenyXFrameOptions() = 0;
   virtual void AddFrameAncestor(const GURL& frame_ancestor) = 0;
diff --git a/chromium/content/public/browser/web_ui_message_handler.h b/chromium/content/public/browser/web_ui_message_handler.h
index e75b710f04b..f1be7363b66 100644
--- a/chromium/content/public/browser/web_ui_message_handler.h
+++ b/chromium/content/public/browser/web_ui_message_handler.h
@@ -7,8 +7,8 @@
 
 #include <vector>
 
+#include "base/check.h"
 #include "base/gtest_prod_util.h"
-#include "base/logging.h"
 #include "base/strings/string16.h"
 #include "base/values.h"
 #include "content/common/content_export.h"
diff --git a/chromium/content/public/browser/xr_consent_helper.h b/chromium/content/public/browser/xr_consent_helper.h
deleted file mode 100644
index 1af0df38c68..00000000000
--- a/chromium/content/public/browser/xr_consent_helper.h
+++ /dev/null
@@ -1,51 +0,0 @@
-// Copyright 2019 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef CONTENT_PUBLIC_BROWSER_XR_CONSENT_HELPER_H_
-#define CONTENT_PUBLIC_BROWSER_XR_CONSENT_HELPER_H_
-
-#include "base/callback_forward.h"
-#include "content/common/content_export.h"
-#include "content/public/browser/xr_consent_prompt_level.h"
-
-namespace content {
-
-using OnXrUserConsentCallback =
-    base::OnceCallback<void(XrConsentPromptLevel, bool)>;
-
-// Interface class to provide the opportunity for runtimes to ensure that any
-// necessary UI is shown to request the appropriate level of user consent
-// for the requested session. This is acquired via the |XrInstallHelperFactory|.
-// Generally, these steps are specific per runtime, so likely this should be
-// implemented for each runtime that has browser-specific installation steps.
-// This should be implemented by embedders.
-class CONTENT_EXPORT XrConsentHelper {
- public:
-  virtual ~XrConsentHelper() = default;
-
-  XrConsentHelper(const XrConsentHelper&) = delete;
-  XrConsentHelper& operator=(const XrConsentHelper&) = delete;
-
-  // Shows UI necessary to prompt the user for the given level of consent.
-  // render_process_id and render_frame_id are passed in order to ensure that
-  // any tab specific UI can be shown.
-  // The callback should be guaranteed to run in the event that the object is
-  // destroyed, and the object should handle being destroyed as an indication
-  // that any displayed UI should be cleaned up.
-  // The Callback should return either the highest level of consent that was
-  // granted and true (if e.g. the user only granted consent to a lower level
-  // than was initially requested), or the requested level of consent and false,
-  // if the user denied consent.
-  virtual void ShowConsentPrompt(int render_process_id,
-                                 int render_frame_id,
-                                 XrConsentPromptLevel consent_level,
-                                 OnXrUserConsentCallback) = 0;
-
- protected:
-  XrConsentHelper() = default;
-};
-
-}  // namespace content
-
-#endif  // CONTENT_PUBLIC_BROWSER_XR_CONSENT_HELPER_H_
diff --git a/chromium/content/public/browser/xr_consent_prompt_level.h b/chromium/content/public/browser/xr_consent_prompt_level.h
deleted file mode 100644
index 1bce74d4e25..00000000000
--- a/chromium/content/public/browser/xr_consent_prompt_level.h
+++ /dev/null
@@ -1,38 +0,0 @@
-// Copyright 2019 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef CONTENT_PUBLIC_BROWSER_XR_CONSENT_PROMPT_LEVEL_H_
-#define CONTENT_PUBLIC_BROWSER_XR_CONSENT_PROMPT_LEVEL_H_
-namespace content {
-
-// Consent levels are incremental, granting consent for a higher level
-// automatically grants consent for all levels below it.  For that reason,
-// these levels should not be used in histograms so that new levels can be
-// added in between the existing levels.
-// GENERATED_JAVA_ENUM_PACKAGE: org.chromium.content_public.browser
-enum class XrConsentPromptLevel : int {
-  // No consent is needed, typically this is due to the fact that no sensitive
-  // information is exposed (all sensitive information is emulated, or not
-  // available, such as in the "viewer" reference space).
-  kNone = 0,
-  // A default level of consent is needed, with no special features that need to
-  // be explicitly called out.  This is typically used for entering an immersive
-  // session, where there may not be an easy way out, and we want to ensure the
-  // user is aware that they are doing so.
-  kDefault = 1,
-  // At this level of consent, the user is warned that their physical features
-  // (such as height) could be exposed to the site. This is the case when a
-  // site requests a "local-floor" reference space for example, where the site
-  // can detect the height of the headset from the ground.
-  kVRFeatures = 2,
-  // At this level of consent, the user is warned that the site may be able to
-  // determine the layout of their room, due to specific geometries being given
-  // to the site. All methods of exposing these geometries inherently also can
-  // expose the user's height, and thus this supersedes/includes features
-  // being potentially exposed.
-  kVRFloorPlan = 3
-};
-
-}  // namespace content
-#endif  // CONTENT_PUBLIC_BROWSER_XR_CONSENT_PROMPT_LEVEL_H_
diff --git a/chromium/content/public/browser/xr_integration_client.cc b/chromium/content/public/browser/xr_integration_client.cc
index 4b617dcc7a1..14a74340197 100644
--- a/chromium/content/public/browser/xr_integration_client.cc
+++ b/chromium/content/public/browser/xr_integration_client.cc
@@ -4,7 +4,6 @@
 
 #include "content/public/browser/xr_integration_client.h"
 
-#include "content/public/browser/xr_consent_helper.h"
 #include "content/public/browser/xr_install_helper.h"
 #include "device/vr/public/cpp/vr_device_provider.h"
 #include "device/vr/public/mojom/vr_service.mojom-shared.h"
@@ -16,11 +15,6 @@ std::unique_ptr<XrInstallHelper> XrIntegrationClient::GetInstallHelper(
   return nullptr;
 }
 
-std::unique_ptr<XrConsentHelper> XrIntegrationClient::GetConsentHelper(
-    device::mojom::XRDeviceId device_id) {
-  return nullptr;
-}
-
 XRProviderList XrIntegrationClient::GetAdditionalProviders() {
   return {};
 }
diff --git a/chromium/content/public/browser/xr_integration_client.h b/chromium/content/public/browser/xr_integration_client.h
index bfdf231cd50..7da3f0af7f7 100644
--- a/chromium/content/public/browser/xr_integration_client.h
+++ b/chromium/content/public/browser/xr_integration_client.h
@@ -21,7 +21,6 @@ class VRDeviceProvider;
 }
 
 namespace content {
-class XrConsentHelper;
 class XrInstallHelper;
 
 using XRProviderList = std::vector<std::unique_ptr<device::VRDeviceProvider>>;
@@ -56,12 +55,6 @@ class CONTENT_EXPORT XrIntegrationClient {
   virtual std::unique_ptr<XrInstallHelper> GetInstallHelper(
       device::mojom::XRDeviceId device_id);
 
-  // Returns the |XrConsentHelper| for the corresponding |XRDeviceId|, or
-  // nullptr if the requested |XRDeviceId| cannot prompt for consent.
-  // In this case, consent is assumed to have been denied.
-  virtual std::unique_ptr<XrConsentHelper> GetConsentHelper(
-      device::mojom::XRDeviceId device_id);
-
   // Returns a vector of device providers that should be used in addition to
   // any default providers built-in to //content.
   virtual XRProviderList GetAdditionalProviders();
diff --git a/chromium/content/public/browser/zygote_host/OWNERS b/chromium/content/public/browser/zygote_host/OWNERS
new file mode 100644
index 00000000000..eb4b322bdf5
--- /dev/null
+++ b/chromium/content/public/browser/zygote_host/OWNERS
@@ -0,0 +1,4 @@
+file://content/zygote/OWNERS
+
+# TEAM: security-dev@chromium.org
+# COMPONENT: Internals>Sandbox
diff --git a/chromium/content/public/browser/zygote_host/zygote_host_linux.h b/chromium/content/public/browser/zygote_host/zygote_host_linux.h
new file mode 100644
index 00000000000..449ccf7b3ce
--- /dev/null
+++ b/chromium/content/public/browser/zygote_host/zygote_host_linux.h
@@ -0,0 +1,42 @@
+// Copyright (c) 2012 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_PUBLIC_BROWSER_ZYGOTE_HOST_ZYGOTE_HOST_LINUX_H_
+#define CONTENT_PUBLIC_BROWSER_ZYGOTE_HOST_ZYGOTE_HOST_LINUX_H_
+
+#include <unistd.h>
+
+#include "base/process/process.h"
+#include "content/common/content_export.h"
+
+namespace content {
+
+// https://chromium.googlesource.com/chromium/src/+/master/docs/linux/zygote.md
+
+// The zygote host is an interface, in the browser process, to the zygote
+// process.
+class ZygoteHost {
+ public:
+  // Returns the singleton instance.
+  static CONTENT_EXPORT ZygoteHost* GetInstance();
+
+  virtual ~ZygoteHost() {}
+
+  // Returns the pid of the Zygote process.
+  virtual bool IsZygotePid(pid_t pid) = 0;
+
+  // Returns an int which is a bitmask of kSandboxLinux* values. Only valid
+  // after the first render has been forked.
+  virtual int GetRendererSandboxStatus() = 0;
+
+  // Adjust the OOM score of the given renderer's PID.  The allowed
+  // range for the score is [0, 1000], where higher values are more
+  // likely to be killed by the OOM killer.
+  virtual void AdjustRendererOOMScore(base::ProcessHandle process_handle,
+                                      int score) = 0;
+};
+
+}  // namespace content
+
+#endif  // CONTENT_PUBLIC_BROWSER_ZYGOTE_HOST_ZYGOTE_HOST_LINUX_H_
author	Allan Sandfeld Jensen <allan.jensen@qt.io>	2020-10-12 14:27:29 +0200
committer	Allan Sandfeld Jensen <allan.jensen@qt.io>	2020-10-13 09:35:20 +0000
commit	c30a6232df03e1efbd9f3b226777b07e087a1122 (patch)
tree	e992f45784689f373bcc38d1b79a239ebe17ee23 /chromium/content/public/browser
parent	7b5b123ac58f58ffde0f4f6e488bcd09aa4decd3 (diff)
download	qtwebengine-chromium-85-based.tar.gz