Merge branch 'upstream-master' into 51-based

Change-Id: I08d36e04494c3bb0c04641ad7c8e53bf418975db

33 files changed, 234 insertions, 87 deletions

diff --git a/chromium/third_party/WebKit/Source/bindings/core/v8/V8AbstractEventListener.cpp b/chromium/third_party/WebKit/Source/bindings/core/v8/V8AbstractEventListener.cpp
index 22730512346..33a880305a2 100644
--- a/chromium/third_party/WebKit/Source/bindings/core/v8/V8AbstractEventListener.cpp
+++ b/chromium/third_party/WebKit/Source/bindings/core/v8/V8AbstractEventListener.cpp
@@ -102,14 +102,14 @@ void V8AbstractEventListener::handleEvent(ScriptState* scriptState, Event* event
 void V8AbstractEventListener::setListenerObject(v8::Local<v8::Object> listener)
 {
     ASSERT(m_listener.isEmpty());
-    // Balanced in secondWeakCallback xor clearListenerObject.
+    // Balanced in wrapperCleared xor clearListenerObject.
     if (m_workerGlobalScope) {
         m_workerGlobalScope->registerEventListener(this);
     } else {
         m_keepAlive = this;
     }
     m_listener.set(isolate(), listener);
-    m_listener.setWeak(this, &setWeakCallback);
+    m_listener.setWeak(this, &wrapperCleared);
 }
 
 void V8AbstractEventListener::invokeEventHandler(ScriptState* scriptState, Event* event, v8::Local<v8::Value> jsEvent)
@@ -199,19 +199,9 @@ void V8AbstractEventListener::clearListenerObject()
     }
 }
 
-void V8AbstractEventListener::setWeakCallback(const v8::WeakCallbackInfo<V8AbstractEventListener>& data)
+void V8AbstractEventListener::wrapperCleared(const v8::WeakCallbackInfo<V8AbstractEventListener>& data)
 {
-    data.GetParameter()->m_listener.clear();
-    data.SetSecondPassCallback(secondWeakCallback);
-}
-
-void V8AbstractEventListener::secondWeakCallback(const v8::WeakCallbackInfo<V8AbstractEventListener>& data)
-{
-    if (data.GetParameter()->m_workerGlobalScope) {
-        data.GetParameter()->m_workerGlobalScope->deregisterEventListener(data.GetParameter());
-    } else {
-        data.GetParameter()->m_keepAlive.clear();
-    }
+    data.GetParameter()->clearListenerObject();
 }
 
 DEFINE_TRACE(V8AbstractEventListener)
diff --git a/chromium/third_party/WebKit/Source/bindings/core/v8/V8AbstractEventListener.h b/chromium/third_party/WebKit/Source/bindings/core/v8/V8AbstractEventListener.h
index 26cc8470890..8be789dc692 100644
--- a/chromium/third_party/WebKit/Source/bindings/core/v8/V8AbstractEventListener.h
+++ b/chromium/third_party/WebKit/Source/bindings/core/v8/V8AbstractEventListener.h
@@ -136,8 +136,7 @@ private:
 
     virtual bool shouldPreventDefault(v8::Local<v8::Value> returnValue);
 
-    static void setWeakCallback(const v8::WeakCallbackInfo<V8AbstractEventListener>&);
-    static void secondWeakCallback(const v8::WeakCallbackInfo<V8AbstractEventListener>&);
+    static void wrapperCleared(const v8::WeakCallbackInfo<V8AbstractEventListener>&);
 
     ScopedPersistent<v8::Object> m_listener;
 
diff --git a/chromium/third_party/WebKit/Source/core/css/CSSPrimitiveValue.cpp b/chromium/third_party/WebKit/Source/core/css/CSSPrimitiveValue.cpp
index 6883f6a6be0..f0b1dca664c 100644
--- a/chromium/third_party/WebKit/Source/core/css/CSSPrimitiveValue.cpp
+++ b/chromium/third_party/WebKit/Source/core/css/CSSPrimitiveValue.cpp
@@ -408,7 +408,7 @@ template<> unsigned short CSSPrimitiveValue::computeLength(const CSSToLengthConv
 
 template<> float CSSPrimitiveValue::computeLength(const CSSToLengthConversionData& conversionData) const
 {
-    return static_cast<float>(computeLengthDouble(conversionData));
+    return clampTo<float>(computeLengthDouble(conversionData));
 }
 
 template<> double CSSPrimitiveValue::computeLength(const CSSToLengthConversionData& conversionData) const
diff --git a/chromium/third_party/WebKit/Source/core/css/ComputedStyleCSSValueMapping.cpp b/chromium/third_party/WebKit/Source/core/css/ComputedStyleCSSValueMapping.cpp
index 9ec10b7bc0a..b0fb7a28b0d 100644
--- a/chromium/third_party/WebKit/Source/core/css/ComputedStyleCSSValueMapping.cpp
+++ b/chromium/third_party/WebKit/Source/core/css/ComputedStyleCSSValueMapping.cpp
@@ -2433,10 +2433,6 @@ CSSValue* ComputedStyleCSSValueMapping::get(CSSPropertyID propertyID, const Comp
     case CSSPropertyTextOrientation:
         return CSSPrimitiveValue::create(style.getTextOrientation());
     case CSSPropertyContent:
-        if (style.styleType() == PseudoIdNone)
-            return cssValuePool().createIdentifierValue(CSSValueNormal);
-        if (!style.hasContent() && (style.styleType() == PseudoIdBefore || style.styleType() == PseudoIdAfter))
-            return cssValuePool().createIdentifierValue(CSSValueNone);
         return valueForContentData(style);
     case CSSPropertyCounterIncrement:
         return valueForCounterDirectives(style, propertyID);
diff --git a/chromium/third_party/WebKit/Source/core/dom/IntersectionObserver.cpp b/chromium/third_party/WebKit/Source/core/dom/IntersectionObserver.cpp
index b0b42f34f12..dfab75ba445 100644
--- a/chromium/third_party/WebKit/Source/core/dom/IntersectionObserver.cpp
+++ b/chromium/third_party/WebKit/Source/core/dom/IntersectionObserver.cpp
@@ -177,7 +177,11 @@ void IntersectionObserver::observe(Element* target)
     if (target->ensureIntersectionObserverData().getObservationFor(*this))
         return;
 
-    bool shouldReportRootBounds = target->document().frame()->securityContext()->getSecurityOrigin()->canAccess(rootNode()->document().frame()->securityContext()->getSecurityOrigin());
+    bool shouldReportRootBounds = false;
+    LocalFrame* targetFrame = target->document().frame();
+    LocalFrame* rootFrame = rootNode()->document().frame();
+    if (targetFrame && rootFrame)
+        shouldReportRootBounds = targetFrame->securityContext()->getSecurityOrigin()->canAccess(rootFrame->securityContext()->getSecurityOrigin());
     IntersectionObservation* observation = new IntersectionObservation(*this, *target, shouldReportRootBounds);
     target->ensureIntersectionObserverData().addObservation(*observation);
     m_observations.add(observation);
diff --git a/chromium/third_party/WebKit/Source/core/fetch/RawResource.cpp b/chromium/third_party/WebKit/Source/core/fetch/RawResource.cpp
index 4812927f5af..465fdc24b29 100644
--- a/chromium/third_party/WebKit/Source/core/fetch/RawResource.cpp
+++ b/chromium/third_party/WebKit/Source/core/fetch/RawResource.cpp
@@ -105,20 +105,21 @@ void RawResource::didAddClient(ResourceClient* c)
         return;
     ASSERT(RawResourceClient::isExpectedType(c));
     RawResourceClient* client = static_cast<RawResourceClient*>(c);
+    WeakPtr<RawResourceClient> clientWeak = client->createWeakPtr();
     for (const auto& redirect : redirectChain()) {
         ResourceRequest request(redirect.m_request);
         client->redirectReceived(this, request, redirect.m_redirectResponse);
-        if (!hasClient(c))
+        if (!clientWeak || !hasClient(c))
             return;
     }
 
     if (!m_response.isNull())
         client->responseReceived(this, m_response, nullptr);
-    if (!hasClient(c))
+    if (!clientWeak || !hasClient(c))
         return;
     if (m_data)
         client->dataReceived(this, m_data->data(), m_data->size());
-    if (!hasClient(c))
+    if (!clientWeak || !hasClient(c))
         return;
     Resource::didAddClient(client);
 }
diff --git a/chromium/third_party/WebKit/Source/core/fetch/RawResource.h b/chromium/third_party/WebKit/Source/core/fetch/RawResource.h
index 46f8cc036bc..84b702679db 100644
--- a/chromium/third_party/WebKit/Source/core/fetch/RawResource.h
+++ b/chromium/third_party/WebKit/Source/core/fetch/RawResource.h
@@ -28,6 +28,7 @@
 #include "core/fetch/ResourceClient.h"
 #include "public/platform/WebDataConsumerHandle.h"
 #include "wtf/PassOwnPtr.h"
+#include "wtf/WeakPtr.h"
 
 namespace blink {
 class FetchRequest;
@@ -103,6 +104,9 @@ inline RawResource* toRawResource(Resource* resource)
 
 class CORE_EXPORT RawResourceClient : public ResourceClient {
 public:
+    RawResourceClient()
+        : m_weakFactory(this) { }
+    WeakPtr<RawResourceClient> createWeakPtr() { return m_weakFactory.createWeakPtr(); }
     ~RawResourceClient() override {}
     static bool isExpectedType(ResourceClient* client) { return client->getResourceClientType() == RawResourceType; }
     ResourceClientType getResourceClientType() const final { return RawResourceType; }
@@ -115,6 +119,9 @@ public:
     virtual void redirectBlocked() {}
     virtual void dataDownloaded(Resource*, int) { }
     virtual void didReceiveResourceTiming(Resource*, const ResourceTimingInfo&) { }
+
+private:
+    WeakPtrFactory<RawResourceClient> m_weakFactory;
 };
 
 } // namespace blink
diff --git a/chromium/third_party/WebKit/Source/core/fetch/ResourceFetcher.cpp b/chromium/third_party/WebKit/Source/core/fetch/ResourceFetcher.cpp
index 6d7168caac6..d3f18b3c76c 100644
--- a/chromium/third_party/WebKit/Source/core/fetch/ResourceFetcher.cpp
+++ b/chromium/third_party/WebKit/Source/core/fetch/ResourceFetcher.cpp
@@ -589,10 +589,12 @@ Resource* ResourceFetcher::createResourceForLoading(FetchRequest& request, const
 
 void ResourceFetcher::storeResourceTimingInitiatorInformation(Resource* resource)
 {
-    if (resource->options().initiatorInfo.name == FetchInitiatorTypeNames::internal)
+    const AtomicString& fetchInitiator = resource->options().initiatorInfo.name;
+    if (fetchInitiator == FetchInitiatorTypeNames::internal)
         return;
 
-    OwnPtr<ResourceTimingInfo> info = ResourceTimingInfo::create(resource->options().initiatorInfo.name, monotonicallyIncreasingTime(), resource->getType() == Resource::MainResource);
+    bool isMainResource = resource->getType() == Resource::MainResource;
+    OwnPtr<ResourceTimingInfo> info = ResourceTimingInfo::create(fetchInitiator, monotonicallyIncreasingTime(), isMainResource);
 
     if (resource->isCacheValidator()) {
         const AtomicString& timingAllowOrigin = resource->response().httpHeaderField(HTTPNames::Timing_Allow_Origin);
@@ -600,7 +602,7 @@ void ResourceFetcher::storeResourceTimingInitiatorInformation(Resource* resource
             info->setOriginalTimingAllowOrigin(timingAllowOrigin);
     }
 
-    if (resource->getType() != Resource::MainResource || context().updateTimingInfoForIFrameNavigation(info.get()))
+    if (!isMainResource || context().updateTimingInfoForIFrameNavigation(info.get()))
         m_resourceTimingInfoMap.add(resource, info.release());
 }
 
@@ -903,13 +905,11 @@ void ResourceFetcher::didFinishLoading(Resource* resource, double finishTime, in
 {
     TRACE_EVENT_ASYNC_END0("blink.net", "Resource", resource);
     // The ResourceLoader might be in |m_nonBlockingLoaders| for multipart responses.
+    ASSERT(resource);
     ASSERT(!(m_loaders && m_loaders->contains(resource->loader())));
 
-    if (resource && resource->response().isHTTP() && resource->response().httpStatusCode() < 400) {
-        ResourceTimingInfoMap::iterator it = m_resourceTimingInfoMap.find(resource);
-        if (it != m_resourceTimingInfoMap.end()) {
-            OwnPtr<ResourceTimingInfo> info = it->value.release();
-            m_resourceTimingInfoMap.remove(it);
+    if (OwnPtr<ResourceTimingInfo> info = m_resourceTimingInfoMap.take(resource)) {
+        if (resource->response().isHTTP() && resource->response().httpStatusCode() < 400) {
             populateResourceTiming(info.get(), resource, false);
             if (resource->options().requestInitiatorContext == DocumentContext)
                 context().addResourceTiming(*info);
@@ -923,6 +923,7 @@ void ResourceFetcher::didFailLoading(const Resource* resource, const ResourceErr
 {
     TRACE_EVENT_ASYNC_END0("blink.net", "Resource", resource);
     removeResourceLoader(resource->loader());
+    m_resourceTimingInfoMap.take(const_cast<Resource*>(resource));
     bool isInternalRequest = resource->options().initiatorInfo.name == FetchInitiatorTypeNames::internal;
     context().dispatchDidFail(resource->identifier(), error, isInternalRequest);
 }
diff --git a/chromium/third_party/WebKit/Source/core/frame/UseCounter.h b/chromium/third_party/WebKit/Source/core/frame/UseCounter.h
index 9eeda5d869d..c124f48faac 100644
--- a/chromium/third_party/WebKit/Source/core/frame/UseCounter.h
+++ b/chromium/third_party/WebKit/Source/core/frame/UseCounter.h
@@ -1118,6 +1118,7 @@ public:
         URLMethodRevokeObjectURLServiceWorker = 1340,
         ProgressElementWithNoneAppearance = 1345,
         ProgressElementWithProgressBarAppearance = 1346,
+        OpacityWithPreserve3DQuirk = 1376,
 
         // Add new features immediately above this line. Don't change assigned
         // numbers of any item, and don't reuse removed slots.
diff --git a/chromium/third_party/WebKit/Source/core/html/HTMLAnchorElement.cpp b/chromium/third_party/WebKit/Source/core/html/HTMLAnchorElement.cpp
index 83266a0f36c..f50c9c1f69d 100644
--- a/chromium/third_party/WebKit/Source/core/html/HTMLAnchorElement.cpp
+++ b/chromium/third_party/WebKit/Source/core/html/HTMLAnchorElement.cpp
@@ -357,6 +357,8 @@ void HTMLAnchorElement::handleClick(Event* event)
         }
         if (hasRel(RelationNoOpener))
             frameRequest.setShouldSetOpener(NeverSetOpener);
+        // TODO(japhet): Link clicks can be emulated via JS without a user gesture.
+        // Why doesn't this go through NavigationScheduler?
         frame->loader().load(frameRequest);
     }
 }
diff --git a/chromium/third_party/WebKit/Source/core/html/HTMLSelectElement.cpp b/chromium/third_party/WebKit/Source/core/html/HTMLSelectElement.cpp
index f6d1a5bd1eb..e898eb6afb9 100644
--- a/chromium/third_party/WebKit/Source/core/html/HTMLSelectElement.cpp
+++ b/chromium/third_party/WebKit/Source/core/html/HTMLSelectElement.cpp
@@ -36,6 +36,9 @@
 #include "core/dom/Attribute.h"
 #include "core/dom/ElementTraversal.h"
 #include "core/dom/ExecutionContextTask.h"
+#include "core/dom/MutationCallback.h"
+#include "core/dom/MutationObserver.h"
+#include "core/dom/MutationObserverInit.h"
 #include "core/dom/NodeComputedStyle.h"
 #include "core/dom/NodeListsNodeData.h"
 #include "core/dom/NodeTraversal.h"
@@ -925,7 +928,7 @@ void HTMLSelectElement::setSuggestedIndex(int suggestedIndex)
         scrollToOption(item(listToOptionIndex(suggestedIndex)));
     }
     if (popupIsVisible())
-        m_popup->updateFromElement();
+        m_popup->updateFromElement(PopupMenu::BySelectionChange);
 }
 
 void HTMLSelectElement::scrollToOption(HTMLOptionElement* option)
@@ -1047,7 +1050,7 @@ void HTMLSelectElement::selectOption(HTMLOptionElement* element, int optionIndex
         layoutObject->updateFromElement();
     // PopupMenu::updateFromElement() posts an O(N) task.
     if (popupIsVisible())
-        m_popup->updateFromElement();
+        m_popup->updateFromElement(PopupMenu::BySelectionChange);
 
     scrollToSelection();
     setNeedsValidityCheck();
@@ -1827,6 +1830,7 @@ DEFINE_TRACE(HTMLSelectElement)
     visitor->trace(m_activeSelectionEnd);
     visitor->trace(m_optionToScrollTo);
     visitor->trace(m_popup);
+    visitor->trace(m_popupUpdater);
     HTMLFormControlElementWithState::trace(visitor);
 }
 
@@ -1900,6 +1904,7 @@ LayoutUnit HTMLSelectElement::clientPaddingRight() const
 void HTMLSelectElement::popupDidHide()
 {
     m_popupIsVisible = false;
+    unobserveTreeMutation();
     if (AXObjectCache* cache = document().existingAXObjectCache()) {
         if (layoutObject() && layoutObject()->isMenuList())
             cache->didHideMenuListPopup(toLayoutMenuList(layoutObject()));
@@ -1957,6 +1962,7 @@ void HTMLSelectElement::showPopup()
     if (!m_popup)
         m_popup = document().frameHost()->chromeClient().openPopupMenu(*document().frame(), *this);
     m_popupIsVisible = true;
+    observeTreeMutation();
 
     LayoutMenuList* menuList = toLayoutMenuList(layoutObject());
     m_popup->show();
@@ -1974,7 +1980,7 @@ void HTMLSelectElement::didRecalcStyle(StyleRecalcChange change)
 {
     HTMLFormControlElementWithState::didRecalcStyle(change);
     if (popupIsVisible())
-        m_popup->updateFromElement();
+        m_popup->updateFromElement(PopupMenu::ByStyleChange);
 }
 
 void HTMLSelectElement::detach(const AttachContext& context)
@@ -1984,6 +1990,7 @@ void HTMLSelectElement::detach(const AttachContext& context)
         m_popup->disconnectClient();
     m_popupIsVisible = false;
     m_popup = nullptr;
+    unobserveTreeMutation();
 }
 
 void HTMLSelectElement::resetTypeAheadSessionForTesting()
@@ -1991,4 +1998,71 @@ void HTMLSelectElement::resetTypeAheadSessionForTesting()
     m_typeAhead.resetSession();
 }
 
+// PopupUpdater notifies updates of the specified SELECT element subtree to
+// a PopupMenu object.
+class HTMLSelectElement::PopupUpdater : public MutationCallback {
+public:
+    explicit PopupUpdater(HTMLSelectElement&);
+    DECLARE_VIRTUAL_TRACE();
+
+    void dispose()
+    {
+        m_observer->disconnect();
+    }
+
+private:
+    void call(const HeapVector<Member<MutationRecord>>&, MutationObserver*) override
+    {
+        m_select->didMutateSubtree();
+    }
+
+    ExecutionContext* getExecutionContext() const override
+    {
+        return &m_select->document();
+    }
+
+    Member<HTMLSelectElement> m_select;
+    Member<MutationObserver> m_observer;
+};
+
+HTMLSelectElement::PopupUpdater::PopupUpdater(HTMLSelectElement& select)
+    : m_select(select)
+{
+    m_observer = MutationObserver::create(this);
+    MutationObserverInit init;
+    init.setAttributes(true);
+    init.setCharacterData(true);
+    init.setChildList(true);
+    init.setSubtree(true);
+    m_observer->observe(&select, init, ASSERT_NO_EXCEPTION);
+}
+
+DEFINE_TRACE(HTMLSelectElement::PopupUpdater)
+{
+    visitor->trace(m_select);
+    visitor->trace(m_observer);
+    MutationCallback::trace(visitor);
+}
+
+void HTMLSelectElement::observeTreeMutation()
+{
+    DCHECK(!m_popupUpdater);
+    m_popupUpdater = new PopupUpdater(*this);
+}
+
+void HTMLSelectElement::unobserveTreeMutation()
+{
+    if (!m_popupUpdater)
+        return;
+    m_popupUpdater->dispose();
+    m_popupUpdater = nullptr;
+}
+
+void HTMLSelectElement::didMutateSubtree()
+{
+    DCHECK(popupIsVisible());
+    DCHECK(m_popup);
+    m_popup->updateFromElement(PopupMenu::ByDOMChange);
+}
+
 } // namespace blink
diff --git a/chromium/third_party/WebKit/Source/core/html/HTMLSelectElement.h b/chromium/third_party/WebKit/Source/core/html/HTMLSelectElement.h
index 19ae08d8cb9..c39e8ab27e1 100644
--- a/chromium/third_party/WebKit/Source/core/html/HTMLSelectElement.h
+++ b/chromium/third_party/WebKit/Source/core/html/HTMLSelectElement.h
@@ -152,6 +152,7 @@ public:
     void showPopup();
     void hidePopup();
     PopupMenu* popup() const { return m_popup.get(); }
+    void didMutateSubtree();
 
     void resetTypeAheadSessionForTesting();
 
@@ -249,6 +250,9 @@ private:
     int optionCount() const override;
     String optionAtIndex(int index) const override;
 
+    void observeTreeMutation();
+    void unobserveTreeMutation();
+
     // m_listItems contains HTMLOptionElement, HTMLOptGroupElement, and
     // HTMLHRElement objects.
     mutable ListItems m_listItems;
@@ -266,6 +270,8 @@ private:
     int m_suggestedIndex;
     bool m_isAutofilledByPreview;
 
+    class PopupUpdater;
+    Member<PopupUpdater> m_popupUpdater;
     Member<PopupMenu> m_popup;
     int m_indexToSelectOnCancel;
     bool m_popupIsVisible;
diff --git a/chromium/third_party/WebKit/Source/core/layout/LayoutBlockFlowLine.cpp b/chromium/third_party/WebKit/Source/core/layout/LayoutBlockFlowLine.cpp
index 2fa89d395b1..33ab32f3777 100644
--- a/chromium/third_party/WebKit/Source/core/layout/LayoutBlockFlowLine.cpp
+++ b/chromium/third_party/WebKit/Source/core/layout/LayoutBlockFlowLine.cpp
@@ -1302,7 +1302,6 @@ void LayoutBlockFlow::computeInlinePreferredLogicalWidths(LayoutUnit& minLogical
             // values (if any of them are larger than our current min/max). We then look at
             // the width of the last non-breakable run and use that to start a new line
             // (unless we end in whitespace).
-            const ComputedStyle& childStyle = child->styleRef();
             LayoutUnit childMin;
             LayoutUnit childMax;
 
@@ -1330,6 +1329,7 @@ void LayoutBlockFlow::computeInlinePreferredLogicalWidths(LayoutUnit& minLogical
 
                 bool clearPreviousFloat;
                 if (child->isFloating()) {
+                    const ComputedStyle& childStyle = child->styleRef();
                     clearPreviousFloat = (prevFloat
                         && ((prevFloat->styleRef().floating() == LeftFloat && (childStyle.clear() & ClearLeft))
                             || (prevFloat->styleRef().floating() == RightFloat && (childStyle.clear() & ClearRight))));
diff --git a/chromium/third_party/WebKit/Source/core/layout/LayoutBox.cpp b/chromium/third_party/WebKit/Source/core/layout/LayoutBox.cpp
index 53caeacc5a9..8c1538dce01 100644
--- a/chromium/third_party/WebKit/Source/core/layout/LayoutBox.cpp
+++ b/chromium/third_party/WebKit/Source/core/layout/LayoutBox.cpp
@@ -620,7 +620,7 @@ LayoutUnit LayoutBox::constrainContentBoxLogicalHeightByMinMax(LayoutUnit logica
             LayoutUnit availableLogicalHeight(logicalHeight / styleToUse.logicalHeight().value() * 100);
             logicalHeight = std::min(logicalHeight, valueForLength(styleToUse.logicalMaxHeight(), availableLogicalHeight));
         } else {
-            LayoutUnit maxHeight(computeContentLogicalHeight(MaxSize, styleToUse.logicalMaxHeight(), LayoutUnit(-1)));
+            LayoutUnit maxHeight(computeContentLogicalHeight(MaxSize, styleToUse.logicalMaxHeight(), intrinsicContentHeight));
             if (maxHeight != -1)
                 logicalHeight = std::min(logicalHeight, maxHeight);
         }
@@ -2579,8 +2579,6 @@ LayoutUnit LayoutBox::computeIntrinsicLogicalContentHeightUsing(const Length& lo
     if (logicalHeightLength.isMinContent() || logicalHeightLength.isMaxContent() || logicalHeightLength.isFitContent()) {
         if (isAtomicInlineLevel())
             return intrinsicSize().height();
-        if (m_intrinsicContentLogicalHeight != -1)
-            return m_intrinsicContentLogicalHeight;
         return intrinsicContentHeight;
     }
     if (logicalHeightLength.isFillAvailable())
@@ -2892,6 +2890,7 @@ LayoutUnit LayoutBox::computeReplacedLogicalHeightUsing(SizeType sizeType, const
 LayoutUnit LayoutBox::availableLogicalHeight(AvailableLogicalHeightType heightType) const
 {
     // http://www.w3.org/TR/CSS2/visudet.html#propdef-height - We are interested in the content height.
+    // FIXME: Should we pass intrinsicContentLogicalHeight() instead of -1 here?
     return constrainContentBoxLogicalHeightByMinMax(availableLogicalHeightUsing(style()->logicalHeight(), heightType), LayoutUnit(-1));
 }
 
@@ -2918,6 +2917,7 @@ LayoutUnit LayoutBox::availableLogicalHeightUsing(const Length& h, AvailableLogi
         return adjustContentBoxLogicalHeightForBoxSizing(valueForLength(h, availableHeight));
     }
 
+    // FIXME: Should we pass intrinsicContentLogicalHeight() instead of -1 here?
     LayoutUnit heightIncludingScrollbar = computeContentAndScrollbarLogicalHeightUsing(MainOrPreferredSize, h, LayoutUnit(-1));
     if (heightIncludingScrollbar != -1)
         return std::max(LayoutUnit(), adjustContentBoxLogicalHeightForBoxSizing(heightIncludingScrollbar) - scrollbarLogicalHeight());
diff --git a/chromium/third_party/WebKit/Source/core/layout/LayoutFlexibleBox.cpp b/chromium/third_party/WebKit/Source/core/layout/LayoutFlexibleBox.cpp
index 679c4aa66cb..38189cda225 100644
--- a/chromium/third_party/WebKit/Source/core/layout/LayoutFlexibleBox.cpp
+++ b/chromium/third_party/WebKit/Source/core/layout/LayoutFlexibleBox.cpp
@@ -465,7 +465,9 @@ LayoutUnit LayoutFlexibleBox::computeMainAxisExtentForChild(const LayoutBox& chi
         // We don't have to check for "auto" here - computeContentLogicalHeight will just return -1 for that case anyway.
         // It's safe to access scrollbarLogicalHeight here because computeNextFlexLine will have already
         // forced layout on the child.
-        return child.computeContentLogicalHeight(sizeType, size, child.contentLogicalHeight()) + child.scrollbarLogicalHeight();
+        // We previously layed out the child if necessary (see computeNextFlexLine and the call to childHasIntrinsicMainAxisSize)
+        // so we can be sure that the two height calls here will return up-to-date data.
+        return child.computeContentLogicalHeight(sizeType, size, child.intrinsicContentLogicalHeight()) + child.scrollbarLogicalHeight();
     }
     // computeLogicalWidth always re-computes the intrinsic widths. However, when our logical width is auto,
     // we can just use our cached value. So let's do that here. (Compare code in LayoutBlock::computePreferredLogicalWidths)
@@ -1175,7 +1177,7 @@ bool LayoutFlexibleBox::computeNextFlexLine(OrderedFlexItemList& orderedChildren
             continue;
         }
 
-        // If this condition is true, then computeMainAxisExtentForChild will call child.contentLogicalHeight()
+        // If this condition is true, then computeMainAxisExtentForChild will call child.intrinsicContentLogicalHeight()
         // and child.scrollbarLogicalHeight(), so if the child has intrinsic min/max/preferred size,
         // run layout on it now to make sure its logical height and scroll bars are up-to-date.
         if (childHasIntrinsicMainAxisSize(*child) && child->needsLayout()) {
diff --git a/chromium/third_party/WebKit/Source/core/layout/compositing/CompositedLayerMapping.cpp b/chromium/third_party/WebKit/Source/core/layout/compositing/CompositedLayerMapping.cpp
index 36fd72053d6..05c034e6de2 100644
--- a/chromium/third_party/WebKit/Source/core/layout/compositing/CompositedLayerMapping.cpp
+++ b/chromium/third_party/WebKit/Source/core/layout/compositing/CompositedLayerMapping.cpp
@@ -35,6 +35,7 @@
 #include "core/html/HTMLCanvasElement.h"
 #include "core/html/HTMLIFrameElement.h"
 #include "core/html/HTMLMediaElement.h"
+#include "core/html/HTMLVideoElement.h"
 #include "core/html/canvas/CanvasRenderingContext.h"
 #include "core/inspector/InspectorInstrumentation.h"
 #include "core/layout/LayoutEmbeddedObject.h"
@@ -400,6 +401,7 @@ bool CompositedLayerMapping::updateGraphicsLayerConfiguration()
 
     PaintLayerCompositor* compositor = this->compositor();
     LayoutObject* layoutObject = this->layoutObject();
+    const ComputedStyle& style = layoutObject->styleRef();
 
     bool layerConfigChanged = false;
     setBackgroundLayerPaintsFixedRootBackground(compositor->needsFixedRootBackgroundLayer(&m_owningLayer));
@@ -438,10 +440,7 @@ bool CompositedLayerMapping::updateGraphicsLayerConfiguration()
     if (updateOverflowControlsLayers(requiresHorizontalScrollbarLayer(), requiresVerticalScrollbarLayer(), requiresScrollCornerLayer(), needsAncestorClip))
         layerConfigChanged = true;
 
-    bool hasPerspective = false;
-    // FIXME: Can |style| be really null that late in the DocumentCycle?
-    if (const ComputedStyle* style = layoutObject->style())
-        hasPerspective = style->hasPerspective();
+    bool hasPerspective = style.hasPerspective();
     bool needsChildTransformLayer = hasPerspective && layoutObject->isBox();
     if (updateChildTransformLayer(needsChildTransformLayer))
         layerConfigChanged = true;
@@ -471,8 +470,8 @@ bool CompositedLayerMapping::updateGraphicsLayerConfiguration()
     bool hasChildClippingLayer = compositor->clipsCompositingDescendants(&m_owningLayer) && (hasClippingLayer() || hasScrollingLayer());
     // If we have a border radius or clip path on a scrolling layer, we need a clipping mask to properly
     // clip the scrolled contents, even if there are no composited descendants.
-    bool hasClipPath = layoutObject->style()->clipPath();
-    bool needsChildClippingMask = (hasClipPath || layoutObject->style()->hasBorderRadius()) && (hasChildClippingLayer || isAcceleratedContents(layoutObject) || hasScrollingLayer());
+    bool hasClipPath = style.clipPath();
+    bool needsChildClippingMask = (hasClipPath || style.hasBorderRadius()) && (hasChildClippingLayer || isAcceleratedContents(layoutObject) || hasScrollingLayer());
 
     GraphicsLayer* layerToApplyChildClippingMask = nullptr;
     bool shouldApplyChildClippingMaskOnContents = false;
@@ -556,6 +555,10 @@ bool CompositedLayerMapping::updateGraphicsLayerConfiguration()
 
     updateElementIdAndCompositorMutableProperties();
 
+    m_owningLayer.update3DTransformedDescendantStatus();
+    if (style.preserves3D() && style.hasOpacity() && m_owningLayer.has3DTransformedDescendant())
+        UseCounter::count(layoutObject->document(), UseCounter::OpacityWithPreserve3DQuirk);
+
     return layerConfigChanged;
 }
 
@@ -766,7 +769,11 @@ void CompositedLayerMapping::updateMainGraphicsLayerGeometry(const IntRect& rela
     // descendants. So, the visibility flag for m_graphicsLayer should be true if there are any
     // non-compositing visible layers.
     bool contentsVisible = m_owningLayer.hasVisibleContent() || hasVisibleNonCompositingDescendant(&m_owningLayer);
-
+    if (layoutObject()->isVideo()) {
+        HTMLVideoElement* videoElement = toHTMLVideoElement(layoutObject()->node());
+        if (videoElement->isFullscreen() && videoElement->usesOverlayFullscreenVideo())
+            contentsVisible = false;
+    }
     m_graphicsLayer->setContentsVisible(contentsVisible);
 
     m_graphicsLayer->setBackfaceVisibility(layoutObject()->style()->backfaceVisibility() == BackfaceVisibilityVisible);
diff --git a/chromium/third_party/WebKit/Source/core/layout/svg/SVGTextMetricsBuilder.cpp b/chromium/third_party/WebKit/Source/core/layout/svg/SVGTextMetricsBuilder.cpp
index 82557fd256b..49681b6edbe 100644
--- a/chromium/third_party/WebKit/Source/core/layout/svg/SVGTextMetricsBuilder.cpp
+++ b/chromium/third_party/WebKit/Source/core/layout/svg/SVGTextMetricsBuilder.cpp
@@ -40,7 +40,7 @@ inline bool characterStartsSurrogatePair(const TextRun& run, unsigned index)
 {
     if (!U16_IS_LEAD(run[index]))
         return false;
-    if (index + 1 >= static_cast<unsigned>(run.charactersLength()))
+    if (index + 1 >= static_cast<unsigned>(run.length()))
         return false;
     return U16_IS_TRAIL(run[index + 1]);
 }
diff --git a/chromium/third_party/WebKit/Source/core/loader/DocumentThreadableLoader.cpp b/chromium/third_party/WebKit/Source/core/loader/DocumentThreadableLoader.cpp
index aba263d5cb7..104f36bd804 100644
--- a/chromium/third_party/WebKit/Source/core/loader/DocumentThreadableLoader.cpp
+++ b/chromium/third_party/WebKit/Source/core/loader/DocumentThreadableLoader.cpp
@@ -789,6 +789,12 @@ void DocumentThreadableLoader::loadActualRequest()
 
     clearResource();
 
+    // Explicitly set the SkipServiceWorker flag here. Even if the page was not
+    // controlled by a SW when the preflight request was sent, a new SW may be
+    // controlling the page now by calling clients.claim(). We should not send
+    // the actual request to the SW. https://crbug.com/604583
+    actualRequest.setSkipServiceWorker(true);
+
     loadRequest(actualRequest, actualOptions);
     // |this| may be dead here in async mode.
 }
diff --git a/chromium/third_party/WebKit/Source/core/loader/EmptyClients.cpp b/chromium/third_party/WebKit/Source/core/loader/EmptyClients.cpp
index a8057604aba..dabcaa50370 100644
--- a/chromium/third_party/WebKit/Source/core/loader/EmptyClients.cpp
+++ b/chromium/third_party/WebKit/Source/core/loader/EmptyClients.cpp
@@ -65,7 +65,7 @@ class EmptyPopupMenu : public PopupMenu {
 public:
     void show() override { }
     void hide() override { }
-    void updateFromElement() override { }
+    void updateFromElement(UpdateReason) override { }
     void disconnectClient() override { }
 };
 
diff --git a/chromium/third_party/WebKit/Source/core/loader/FrameLoader.cpp b/chromium/third_party/WebKit/Source/core/loader/FrameLoader.cpp
index b165a2e7883..c090baac93f 100644
--- a/chromium/third_party/WebKit/Source/core/loader/FrameLoader.cpp
+++ b/chromium/third_party/WebKit/Source/core/loader/FrameLoader.cpp
@@ -1378,7 +1378,10 @@ void FrameLoader::startLoad(FrameLoadRequest& frameLoadRequest, FrameLoadType ty
         return;
 
     m_frame->document()->cancelParsing();
-    detachDocumentLoader(m_provisionalDocumentLoader);
+    if (m_provisionalDocumentLoader) {
+        FrameNavigationDisabler navigationDisabler(*m_frame);
+        detachDocumentLoader(m_provisionalDocumentLoader);
+    }
 
     // beforeunload fired above, and detaching a DocumentLoader can fire
     // events, which can detach this frame.
diff --git a/chromium/third_party/WebKit/Source/core/paint/PaintLayer.h b/chromium/third_party/WebKit/Source/core/paint/PaintLayer.h
index c24a277c369..89792b6cf4a 100644
--- a/chromium/third_party/WebKit/Source/core/paint/PaintLayer.h
+++ b/chromium/third_party/WebKit/Source/core/paint/PaintLayer.h
@@ -682,6 +682,11 @@ public:
     }
     void clearClipRectsCache() const { m_clipRectsCache.clear(); }
 
+    void dirty3DTransformedDescendantStatus();
+    // Both updates the status, and returns true if descendants of this have 3d.
+    bool update3DTransformedDescendantStatus();
+    bool has3DTransformedDescendant() const { DCHECK(!m_3DTransformedDescendantStatusDirty); return m_has3DTransformedDescendant; }
+
 private:
     // Bounding box in the coordinates of this layer.
     LayoutRect logicalBoundingBox() const;
@@ -745,10 +750,6 @@ private:
     bool attemptDirectCompositingUpdate(StyleDifference, const ComputedStyle* oldStyle);
     void updateTransform(const ComputedStyle* oldStyle, const ComputedStyle& newStyle);
 
-    void dirty3DTransformedDescendantStatus();
-    // Both updates the status, and returns true if descendants of this have 3d.
-    bool update3DTransformedDescendantStatus();
-
     void updateOrRemoveFilterClients();
 
     void updatePaginationRecursive(bool needsPaginationUpdate = false);
diff --git a/chromium/third_party/WebKit/Source/devtools/front_end/devtools.js b/chromium/third_party/WebKit/Source/devtools/front_end/devtools.js
index dcbcd758dbd..f9c05b2c744 100644
--- a/chromium/third_party/WebKit/Source/devtools/front_end/devtools.js
+++ b/chromium/third_party/WebKit/Source/devtools/front_end/devtools.js
@@ -964,8 +964,28 @@ function installObjectObserve()
 /**
  * @suppressGlobalPropertiesCheck
  */
+function sanitizeRemoteFrontendUrl()
+{
+    var queryParams = location.search;
+    if (!queryParams)
+        return;
+    var params = queryParams.substring(1).split("&");
+    for (var i = 0; i < params.length; ++i) {
+        var pair = params[i].split("=");
+        var name = pair.shift();
+        var value = pair.join("=");
+        if (name === "remoteFrontendUrl" && !value.startsWith("https://chrome-devtools-frontend.appspot.com/"))
+            location.search = "";
+    }
+}
+
+/**
+ * @suppressGlobalPropertiesCheck
+ */
 function installBackwardsCompatibility()
 {
+    sanitizeRemoteFrontendUrl();
+
     if (window.location.search.indexOf("remoteFrontend") === -1)
         return;
 
@@ -1021,6 +1041,7 @@ function windowLoaded()
     installBackwardsCompatibility();
 }
 
+sanitizeRemoteFrontendUrl();
 if (window.document.head && (window.document.readyState === "complete" || window.document.readyState === "interactive"))
     installBackwardsCompatibility();
 else
diff --git a/chromium/third_party/WebKit/Source/devtools/front_end/formatter_worker/CSSFormatter.js b/chromium/third_party/WebKit/Source/devtools/front_end/formatter_worker/CSSFormatter.js
index 3476327b90b..5164e545bfe 100644
--- a/chromium/third_party/WebKit/Source/devtools/front_end/formatter_worker/CSSFormatter.js
+++ b/chromium/third_party/WebKit/Source/devtools/front_end/formatter_worker/CSSFormatter.js
@@ -52,7 +52,9 @@ WebInspector.CSSFormatter.prototype = {
         this._lastLine = -1;
         this._state = {};
         var tokenize = WebInspector.createTokenizer("text/css");
+        var oldEnforce = this._builder.setEnforceSpaceBetweenWords(false);
         tokenize(text.substring(this._fromOffset, this._toOffset), this._tokenCallback.bind(this));
+        this._builder.setEnforceSpaceBetweenWords(oldEnforce);
     },
 
     /**
diff --git a/chromium/third_party/WebKit/Source/devtools/front_end/formatter_worker/FormattedContentBuilder.js b/chromium/third_party/WebKit/Source/devtools/front_end/formatter_worker/FormattedContentBuilder.js
index 3d1d266e87b..dfc4efae869 100644
--- a/chromium/third_party/WebKit/Source/devtools/front_end/formatter_worker/FormattedContentBuilder.js
+++ b/chromium/third_party/WebKit/Source/devtools/front_end/formatter_worker/FormattedContentBuilder.js
@@ -25,17 +25,29 @@ WebInspector.FormattedContentBuilder = function(indentString)
     this._newLines = 0;
     this._softSpace = false;
     this._hardSpaces = 0;
+    this._enforceSpaceBetweenWords = true;
 }
 
 WebInspector.FormattedContentBuilder.prototype = {
     /**
+     * @param {boolean} value
+     * @return {boolean}
+     */
+    setEnforceSpaceBetweenWords: function(value)
+    {
+        var oldValue = this._enforceSpaceBetweenWords;
+        this._enforceSpaceBetweenWords = value;
+        return oldValue;
+    },
+
+    /**
      * @param {string} token
      * @param {number} offset
      */
     addToken: function(token, offset)
     {
         var last = this._formattedContent.peekLast();
-        if (last && /\w/.test(last[last.length - 1]) && /\w/.test(token))
+        if (this._enforceSpaceBetweenWords && last && /\w/.test(last[last.length - 1]) && /\w/.test(token))
             this.addSoftSpace();
 
         this._appendFormatting();
diff --git a/chromium/third_party/WebKit/Source/modules/accessibility/AXTable.cpp b/chromium/third_party/WebKit/Source/modules/accessibility/AXTable.cpp
index 42593b1dfc7..ed3790f868a 100644
--- a/chromium/third_party/WebKit/Source/modules/accessibility/AXTable.cpp
+++ b/chromium/third_party/WebKit/Source/modules/accessibility/AXTable.cpp
@@ -470,8 +470,11 @@ void AXTable::columnHeaders(AXObjectVector& headers)
 
     updateChildrenIfNecessary();
     unsigned columnCount = m_columns.size();
-    for (unsigned c = 0; c < columnCount; c++)
-        toAXTableColumn(m_columns[c].get())->headerObjectsForColumn(headers);
+    for (unsigned c = 0; c < columnCount; c++) {
+        AXObject* column = m_columns[c].get();
+        if (column->isTableCol())
+            toAXTableColumn(column)->headerObjectsForColumn(headers);
+    }
 }
 
 void AXTable::rowHeaders(AXObjectVector& headers)
@@ -481,8 +484,11 @@ void AXTable::rowHeaders(AXObjectVector& headers)
 
     updateChildrenIfNecessary();
     unsigned rowCount = m_rows.size();
-    for (unsigned r = 0; r < rowCount; r++)
-        toAXTableRow(m_rows[r].get())->headerObjectsForRow(headers);
+    for (unsigned r = 0; r < rowCount; r++) {
+        AXObject* row = m_rows[r].get();
+        if (row->isTableRow())
+            toAXTableRow(m_rows[r].get())->headerObjectsForRow(headers);
+    }
 }
 
 unsigned AXTable::columnCount()
diff --git a/chromium/third_party/WebKit/Source/modules/credentialmanager/CredentialsContainer.cpp b/chromium/third_party/WebKit/Source/modules/credentialmanager/CredentialsContainer.cpp
index 98dc149bacb..2ca7a1772b9 100644
--- a/chromium/third_party/WebKit/Source/modules/credentialmanager/CredentialsContainer.cpp
+++ b/chromium/third_party/WebKit/Source/modules/credentialmanager/CredentialsContainer.cpp
@@ -170,7 +170,8 @@ ScriptPromise CredentialsContainer::store(ScriptState* scriptState, Credential*
     if (!checkBoilerplate(resolver))
         return promise;
 
-    CredentialManagerClient::from(scriptState->getExecutionContext())->dispatchStore(WebCredential::create(credential->getPlatformCredential()), new NotificationCallbacks(resolver));
+    auto web_credential = WebCredential::create(credential->getPlatformCredential());
+    CredentialManagerClient::from(scriptState->getExecutionContext())->dispatchStore(*web_credential, new NotificationCallbacks(resolver));
     return promise;
 }
 
diff --git a/chromium/third_party/WebKit/Source/platform/PopupMenu.h b/chromium/third_party/WebKit/Source/platform/PopupMenu.h
index 98a4757de10..41c8f4d003c 100644
--- a/chromium/third_party/WebKit/Source/platform/PopupMenu.h
+++ b/chromium/third_party/WebKit/Source/platform/PopupMenu.h
@@ -33,7 +33,12 @@ public:
     DEFINE_INLINE_VIRTUAL_TRACE() { }
     virtual void show() = 0;
     virtual void hide() = 0;
-    virtual void updateFromElement() = 0;
+    enum UpdateReason {
+        BySelectionChange,
+        ByStyleChange,
+        ByDOMChange,
+    };
+    virtual void updateFromElement(UpdateReason) = 0;
     virtual void disconnectClient() = 0;
 };
 
diff --git a/chromium/third_party/WebKit/Source/platform/exported/WebCredential.cpp b/chromium/third_party/WebKit/Source/platform/exported/WebCredential.cpp
index 11125ecd1d4..759f9fb48d1 100644
--- a/chromium/third_party/WebKit/Source/platform/exported/WebCredential.cpp
+++ b/chromium/third_party/WebKit/Source/platform/exported/WebCredential.cpp
@@ -7,23 +7,22 @@
 #include "platform/credentialmanager/PlatformCredential.h"
 #include "public/platform/WebFederatedCredential.h"
 #include "public/platform/WebPasswordCredential.h"
+#include "wtf/PtrUtil.h"
 
 namespace blink {
 
-WebCredential WebCredential::create(PlatformCredential* credential)
+std::unique_ptr<WebCredential> WebCredential::create(PlatformCredential* credential)
 {
     if (credential->isPassword()) {
-        WebPasswordCredential password(credential);
-        return password;
+        return WTF::wrapUnique(new WebPasswordCredential(credential));
     }
 
     if (credential->isFederated()) {
-        WebFederatedCredential federated(credential);
-        return federated;
+        return WTF::wrapUnique(new WebFederatedCredential(credential));
     }
 
     ASSERT_NOT_REACHED();
-    return WebCredential(credential);
+    return nullptr;
 }
 
 WebCredential::WebCredential(const WebString& id, const WebString& name, const WebURL& iconURL)
diff --git a/chromium/third_party/WebKit/Source/web/ExternalPopupMenu.cpp b/chromium/third_party/WebKit/Source/web/ExternalPopupMenu.cpp
index 09125ee44ff..44e44b1747b 100644
--- a/chromium/third_party/WebKit/Source/web/ExternalPopupMenu.cpp
+++ b/chromium/third_party/WebKit/Source/web/ExternalPopupMenu.cpp
@@ -95,10 +95,7 @@ bool ExternalPopupMenu::showInternal()
         FloatQuad quad(toLayoutBox(layoutObject)->localToAbsoluteQuad(FloatQuad(toLayoutBox(layoutObject)->borderBoundingBox())));
         IntRect rect(quad.enclosingBoundingBox());
         IntRect rectInViewport = m_localFrame->view()->soonToBeRemovedContentsToUnscaledViewport(rect);
-        // TODO(tkent): If the anchor rectangle is not visible, we should not
-        // show a popup.
         m_webExternalPopupMenu->show(rectInViewport);
-        m_shownDOMTreeVersion = m_ownerElement->document().domTreeVersion();
         return true;
     } else {
         // The client might refuse to create a popup (when there is already one pending to be shown for example).
@@ -142,17 +139,23 @@ void ExternalPopupMenu::hide()
     m_webExternalPopupMenu = 0;
 }
 
-void ExternalPopupMenu::updateFromElement()
+void ExternalPopupMenu::updateFromElement(UpdateReason reason)
 {
-    if (m_needsUpdate)
-        return;
-    // TOOD(tkent): Even if DOMTreeVersion is not changed, we should update the
-    // popup location/content in some cases.  e.g. Updating ComputedStyle of the
-    // SELECT element affects popup position and OPTION style.
-    if (m_shownDOMTreeVersion == m_ownerElement->document().domTreeVersion())
-        return;
-    m_needsUpdate = true;
-    m_ownerElement->document().postTask(BLINK_FROM_HERE, createSameThreadTask(&ExternalPopupMenu::update, RawPtr<ExternalPopupMenu>(this)));
+    switch (reason) {
+    case BySelectionChange:
+    case ByDOMChange:
+        if (m_needsUpdate)
+            return;
+        m_needsUpdate = true;
+        m_ownerElement->document().postTask(BLINK_FROM_HERE, createSameThreadTask(&ExternalPopupMenu::update, this));
+        break;
+
+    case ByStyleChange:
+        // TOOD(tkent): We should update the popup location/content in some
+        // cases.  e.g. Updating ComputedStyle of the SELECT element affects
+        // popup position and OPTION style.
+        break;
+    }
 }
 
 void ExternalPopupMenu::update()
diff --git a/chromium/third_party/WebKit/Source/web/ExternalPopupMenu.h b/chromium/third_party/WebKit/Source/web/ExternalPopupMenu.h
index a637cf7bcb3..e11ef4b9308 100644
--- a/chromium/third_party/WebKit/Source/web/ExternalPopupMenu.h
+++ b/chromium/third_party/WebKit/Source/web/ExternalPopupMenu.h
@@ -69,7 +69,7 @@ private:
     // PopupMenu methods:
     void show() override;
     void hide() override;
-    void updateFromElement() override;
+    void updateFromElement(UpdateReason) override;
     void disconnectClient() override;
 
     // WebExternalPopupClient methods:
@@ -89,7 +89,6 @@ private:
     Timer<ExternalPopupMenu> m_dispatchEventTimer;
     // The actual implementor of the show menu.
     WebExternalPopupMenu* m_webExternalPopupMenu;
-    uint64_t m_shownDOMTreeVersion = 0;
     bool m_needsUpdate = false;
 };
 
diff --git a/chromium/third_party/WebKit/Source/web/PopupMenuImpl.cpp b/chromium/third_party/WebKit/Source/web/PopupMenuImpl.cpp
index 8334670156b..fc3e634e12c 100644
--- a/chromium/third_party/WebKit/Source/web/PopupMenuImpl.cpp
+++ b/chromium/third_party/WebKit/Source/web/PopupMenuImpl.cpp
@@ -481,7 +481,7 @@ void PopupMenuImpl::hide()
         m_chromeClient->closePagePopup(m_popup);
 }
 
-void PopupMenuImpl::updateFromElement()
+void PopupMenuImpl::updateFromElement(UpdateReason)
 {
     if (m_needsUpdate)
         return;
diff --git a/chromium/third_party/WebKit/Source/web/PopupMenuImpl.h b/chromium/third_party/WebKit/Source/web/PopupMenuImpl.h
index 9ed6b1381c6..fe630f9dc90 100644
--- a/chromium/third_party/WebKit/Source/web/PopupMenuImpl.h
+++ b/chromium/third_party/WebKit/Source/web/PopupMenuImpl.h
@@ -41,7 +41,7 @@ private:
     void show() override;
     void hide() override;
     void disconnectClient() override;
-    void updateFromElement() override;
+    void updateFromElement(UpdateReason) override;
 
     // PagePopupClient functions:
     void writeDocument(SharedBuffer*) override;
diff --git a/chromium/third_party/WebKit/Source/web/WebViewImpl.cpp b/chromium/third_party/WebKit/Source/web/WebViewImpl.cpp
index e906bb7b5a1..22c0a1e4dd6 100644
--- a/chromium/third_party/WebKit/Source/web/WebViewImpl.cpp
+++ b/chromium/third_party/WebKit/Source/web/WebViewImpl.cpp
@@ -3467,7 +3467,6 @@ float WebViewImpl::maximumPageScaleFactor() const
 
 void WebViewImpl::resetScaleStateImmediately()
 {
-    page()->frameHost().visualViewport().setScale(1);
     pageScaleConstraintsSet().setNeedsReset(true);
 }