BASELINE: Update Chromium to 77.0.3865.129

Change-Id: Ie569f0076f8854e83485a9beee9a3eb2f50d3362
Reviewed-by: Michal Klocek <michal.klocek@qt.io>

40 files changed, 391 insertions, 134 deletions

diff --git a/chromium/DEPS b/chromium/DEPS
index d6d3cb1f992..c24d9c43c53 100644
--- a/chromium/DEPS
+++ b/chromium/DEPS
@@ -146,11 +146,11 @@ vars = {
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling Skia
   # and whatever else without interference from each other.
-  'skia_revision': 'a10014304cba4f24b7af17191f59490faa8aee77',
+  'skia_revision': 'f721da7dc93cbf42084b92f673ce8b6c23452d3f',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling V8
   # and whatever else without interference from each other.
-  'v8_revision': '027689dbfcb2a9bbc8ceec4db2631c558e879633',
+  'v8_revision': '02a3469f07e23c4ebb473818dcb9d29949f966f6',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling swarming_client
   # and whatever else without interference from each other.
@@ -1417,7 +1417,7 @@ deps = {
     Var('chromium_git') + '/v8/v8.git' + '@' +  Var('v8_revision'),
 
   'src-internal': {
-    'url': 'https://chrome-internal.googlesource.com/chrome/src-internal.git@18095bdf3eb60c3e121aac53a2c92eba6c37c3a9',
+    'url': 'https://chrome-internal.googlesource.com/chrome/src-internal.git@28df5657cf1856cb41acc3ff1a67038fafc226c2',
     'condition': 'checkout_src_internal',
   },
 
diff --git a/chromium/build/util/LASTCHANGE b/chromium/build/util/LASTCHANGE
index 033ddb4ac97..5b36acf8c0c 100644
--- a/chromium/build/util/LASTCHANGE
+++ b/chromium/build/util/LASTCHANGE
@@ -1 +1 @@
-LASTCHANGE=89700f0d311d189a766a3532c1e6de2c94d429f9-refs/branch-heads/3865@{#842}
+LASTCHANGE=fe7e45714819aa4827cfe9524ec9d004791214aa-refs/branch-heads/3865@{#893}
diff --git a/chromium/build/util/LASTCHANGE.committime b/chromium/build/util/LASTCHANGE.committime
index 27cab847d5e..0a6ee3df769 100644
--- a/chromium/build/util/LASTCHANGE.committime
+++ b/chromium/build/util/LASTCHANGE.committime
@@ -1 +1 @@
-1569197526
\ No newline at end of file
+1571357708
\ No newline at end of file
diff --git a/chromium/chrome/VERSION b/chromium/chrome/VERSION
index 2ba5d0d4c2a..e31bc0ecbd7 100644
--- a/chromium/chrome/VERSION
+++ b/chromium/chrome/VERSION
@@ -1,4 +1,4 @@
 MAJOR=77
 MINOR=0
 BUILD=3865
-PATCH=98
+PATCH=129
diff --git a/chromium/content/browser/frame_host/render_frame_host_impl.cc b/chromium/content/browser/frame_host/render_frame_host_impl.cc
index a6d5d13fe80..f9b3a9a12b6 100644
--- a/chromium/content/browser/frame_host/render_frame_host_impl.cc
+++ b/chromium/content/browser/frame_host/render_frame_host_impl.cc
@@ -1082,6 +1082,13 @@ RenderFrameHostImpl::~RenderFrameHostImpl() {
   if (owned_render_widget_host_)
     owned_render_widget_host_->ShutdownAndDestroyWidget(false);
 
+  // TODO(https://crbug.com/1005077): There is no known reason for removing the
+  // RenderViewHostImpl here instead of automatically at the end of the
+  // destructor. In practise, not doing it here will prevent android WebView to
+  // display a new page after a long sequence of WebView creation / deletion.
+  // The real reason why this is needed needs to be investigated.
+  render_view_host_.reset();
+
   // If another frame is waiting for a beforeunload ACK from this frame,
   // simulate it now.
   RenderFrameHostImpl* beforeunload_initiator = GetBeforeUnloadInitiator();
diff --git a/chromium/content/browser/frame_host/render_frame_host_impl.h b/chromium/content/browser/frame_host/render_frame_host_impl.h
index d0f858a41cb..f60ce3a1a01 100644
--- a/chromium/content/browser/frame_host/render_frame_host_impl.h
+++ b/chromium/content/browser/frame_host/render_frame_host_impl.h
@@ -1712,7 +1712,7 @@ class CONTENT_EXPORT RenderFrameHostImpl
   //
   // TODO(creis): RenderViewHost will eventually go away and be replaced with
   // some form of page context.
-  const scoped_refptr<RenderViewHostImpl> render_view_host_;
+  scoped_refptr<RenderViewHostImpl> render_view_host_;
 
   RenderFrameHostDelegate* const delegate_;
 
diff --git a/chromium/content/browser/indexed_db/indexed_db_cursor.cc b/chromium/content/browser/indexed_db/indexed_db_cursor.cc
index 3c7c2bbf606..cdd7fe10309 100644
--- a/chromium/content/browser/indexed_db/indexed_db_cursor.cc
+++ b/chromium/content/browser/indexed_db/indexed_db_cursor.cc
@@ -62,8 +62,6 @@ IndexedDBCursor::IndexedDBCursor(
 }
 
 IndexedDBCursor::~IndexedDBCursor() {
-  if (transaction_)
-    transaction_->UnregisterOpenCursor(this);
   // Call to make sure we complete our lifetime trace.
   Close();
 }
@@ -405,6 +403,8 @@ void IndexedDBCursor::Close() {
   closed_ = true;
   cursor_.reset();
   saved_cursor_.reset();
+  if (transaction_)
+    transaction_->UnregisterOpenCursor(this);
   transaction_.reset();
 }
 
diff --git a/chromium/content/browser/indexed_db/indexed_db_transaction.cc b/chromium/content/browser/indexed_db/indexed_db_transaction.cc
index 11783f25063..53f198ae218 100644
--- a/chromium/content/browser/indexed_db/indexed_db_transaction.cc
+++ b/chromium/content/browser/indexed_db/indexed_db_transaction.cc
@@ -585,9 +585,13 @@ void IndexedDBTransaction::CloseOpenCursorBindings() {
 
 void IndexedDBTransaction::CloseOpenCursors() {
   IDB_TRACE1("IndexedDBTransaction::CloseOpenCursors", "txn.id", id());
-  for (auto* cursor : open_cursors_)
-    cursor->Close();
+
+  // IndexedDBCursor::Close() indirectly mutates |open_cursors_|, when it calls
+  // IndexedDBTransaction::UnregisterOpenCursor().
+  std::set<IndexedDBCursor*> open_cursors = std::move(open_cursors_);
   open_cursors_.clear();
+  for (auto* cursor : open_cursors)
+    cursor->Close();
 }
 
 void IndexedDBTransaction::AddPendingObserver(
diff --git a/chromium/content/browser/web_contents/web_contents_view_aura.cc b/chromium/content/browser/web_contents/web_contents_view_aura.cc
index 68f268efe02..965204410f9 100644
--- a/chromium/content/browser/web_contents/web_contents_view_aura.cc
+++ b/chromium/content/browser/web_contents/web_contents_view_aura.cc
@@ -412,6 +412,7 @@ class WebContentsViewAura::AsyncDropNavigationObserver
  public:
   AsyncDropNavigationObserver(WebContents* watched_contents,
                               std::unique_ptr<DropData> drop_data,
+                              base::ScopedClosureRunner end_drag_runner,
                               RenderWidgetHostImpl* target_rwh,
                               const gfx::PointF& client_pt,
                               const gfx::PointF& screen_pt,
@@ -436,6 +437,7 @@ class WebContentsViewAura::AsyncDropNavigationObserver
   // Data cached at the start of the drop operation and needed to complete the
   // drop.
   std::unique_ptr<DropData> drop_data_;
+  base::ScopedClosureRunner end_drag_runner_;
   base::WeakPtr<RenderWidgetHostImpl> target_rwh_;
   const gfx::PointF client_pt_;
   const gfx::PointF screen_pt_;
@@ -447,6 +449,7 @@ class WebContentsViewAura::AsyncDropNavigationObserver
 WebContentsViewAura::AsyncDropNavigationObserver::AsyncDropNavigationObserver(
     WebContents* watched_contents,
     std::unique_ptr<DropData> drop_data,
+    base::ScopedClosureRunner end_drag_runner,
     RenderWidgetHostImpl* target_rwh,
     const gfx::PointF& client_pt,
     const gfx::PointF& screen_pt,
@@ -454,6 +457,7 @@ WebContentsViewAura::AsyncDropNavigationObserver::AsyncDropNavigationObserver(
     : WebContentsObserver(watched_contents),
       drop_allowed_(true),
       drop_data_(std::move(drop_data)),
+      end_drag_runner_(std::move(end_drag_runner)),
       target_rwh_(target_rwh->GetWeakPtr()),
       client_pt_(client_pt),
       screen_pt_(screen_pt),
@@ -1097,7 +1101,15 @@ void WebContentsViewAura::StartDragging(
     return;
   }
 
-  EndDrag(source_rwh_weak_ptr.get(), ConvertToWeb(result_op));
+  // If drag is still in progress that means we haven't received drop targeting
+  // callback yet. So we have to make sure to delay calling EndDrag until drop
+  // is done.
+  if (!drag_in_progress_)
+    EndDrag(source_rwh_weak_ptr.get(), ConvertToWeb(result_op));
+  else
+    end_drag_runner_ = base::ScopedClosureRunner(base::BindOnce(
+        &WebContentsViewAura::EndDrag, weak_ptr_factory_.GetWeakPtr(),
+        source_rwh_weak_ptr.get(), ConvertToWeb(result_op)));
 }
 
 void WebContentsViewAura::UpdateDragCursor(blink::WebDragOperation operation) {
@@ -1391,6 +1403,8 @@ void WebContentsViewAura::PerformDropCallback(
     base::WeakPtr<RenderWidgetHostViewBase> target,
     base::Optional<gfx::PointF> transformed_pt) {
   drag_in_progress_ = false;
+  base::ScopedClosureRunner end_drag_runner(std::move(end_drag_runner_));
+
   if (!target)
     return;
   RenderWidgetHostImpl* target_rwh =
@@ -1411,9 +1425,8 @@ void WebContentsViewAura::PerformDropCallback(
     DragEnteredCallback(event, std::move(drop_data), target, transformed_pt);
   }
 
-  if (!current_drop_data_) {
+  if (!current_drop_data_)
     return;
-  }
 
   const int key_modifiers = ui::EventFlagsToWebEventModifiers(event.flags());
 #if defined(OS_WIN)
@@ -1438,8 +1451,9 @@ void WebContentsViewAura::PerformDropCallback(
       // operation completes.
       async_drop_navigation_observer_ =
           std::make_unique<AsyncDropNavigationObserver>(
-              web_contents_, std::move(current_drop_data_), target_rwh,
-              transformed_pt.value(), screen_pt, key_modifiers);
+              web_contents_, std::move(current_drop_data_),
+              std::move(end_drag_runner), target_rwh, transformed_pt.value(),
+              screen_pt, key_modifiers);
       return;
     }
   }
diff --git a/chromium/content/browser/web_contents/web_contents_view_aura.h b/chromium/content/browser/web_contents/web_contents_view_aura.h
index ed3c8d86cac..428c5afe4cd 100644
--- a/chromium/content/browser/web_contents/web_contents_view_aura.h
+++ b/chromium/content/browser/web_contents/web_contents_view_aura.h
@@ -9,6 +9,7 @@
 #include <utility>
 #include <vector>
 
+#include "base/callback_helpers.h"
 #include "base/gtest_prod_util.h"
 #include "base/macros.h"
 #include "base/memory/ref_counted.h"
@@ -245,6 +246,10 @@ class CONTENT_EXPORT WebContentsViewAura
 #endif
   DropCallbackForTesting drop_callback_for_testing_;
 
+  // If this callback is initialized it must be run after the drop operation is
+  // done to send dragend event in EndDrag function.
+  base::ScopedClosureRunner end_drag_runner_;
+
   std::unique_ptr<aura::Window> window_;
 
   std::unique_ptr<WindowObserver> window_observer_;
diff --git a/chromium/content/renderer/media/webrtc/rtc_peer_connection_handler.cc b/chromium/content/renderer/media/webrtc/rtc_peer_connection_handler.cc
index e0c2d352f2a..784831c465f 100644
--- a/chromium/content/renderer/media/webrtc/rtc_peer_connection_handler.cc
+++ b/chromium/content/renderer/media/webrtc/rtc_peer_connection_handler.cc
@@ -1235,13 +1235,17 @@ void RTCPeerConnectionHandler::SetLocalDescription(
     reason_str.append(" ");
     reason_str.append(error.description);
     LOG(ERROR) << reason_str;
-    request.RequestFailed(webrtc::RTCError(webrtc::RTCErrorType::INTERNAL_ERROR,
-                                           std::move(reason_str)));
     if (peer_connection_tracker_) {
       peer_connection_tracker_->TrackSessionDescriptionCallback(
           this, PeerConnectionTracker::ACTION_SET_LOCAL_DESCRIPTION,
           "OnFailure", reason_str);
     }
+    // Warning: this line triggers the error callback to be executed, causing
+    // arbitrary JavaScript to be executed synchronously. As a result, it is
+    // possible for |this| to be deleted after this line. See
+    // https://crbug.com/1005251.
+    request.RequestFailed(webrtc::RTCError(webrtc::RTCErrorType::INTERNAL_ERROR,
+                                           std::move(reason_str)));
     return;
   }
 
@@ -1303,13 +1307,17 @@ void RTCPeerConnectionHandler::SetRemoteDescription(
     reason_str.append(" ");
     reason_str.append(error.description);
     LOG(ERROR) << reason_str;
-    request.RequestFailed(webrtc::RTCError(
-        webrtc::RTCErrorType::UNSUPPORTED_OPERATION, std::move(reason_str)));
     if (peer_connection_tracker_) {
       peer_connection_tracker_->TrackSessionDescriptionCallback(
           this, PeerConnectionTracker::ACTION_SET_REMOTE_DESCRIPTION,
           "OnFailure", reason_str);
     }
+    // Warning: this line triggers the error callback to be executed, causing
+    // arbitrary JavaScript to be executed synchronously. As a result, it is
+    // possible for |this| to be deleted after this line. See
+    // https://crbug.com/1005251.
+    request.RequestFailed(webrtc::RTCError(
+        webrtc::RTCErrorType::UNSUPPORTED_OPERATION, std::move(reason_str)));
     return;
   }
 
diff --git a/chromium/gpu/config/gpu_lists_version.h b/chromium/gpu/config/gpu_lists_version.h
index 8a83655f9c0..6cc00e0eeed 100644
--- a/chromium/gpu/config/gpu_lists_version.h
+++ b/chromium/gpu/config/gpu_lists_version.h
@@ -3,6 +3,6 @@
 #ifndef GPU_CONFIG_GPU_LISTS_VERSION_H_
 #define GPU_CONFIG_GPU_LISTS_VERSION_H_
 
-#define GPU_LISTS_VERSION "89700f0d311d189a766a3532c1e6de2c94d429f9"
+#define GPU_LISTS_VERSION "fe7e45714819aa4827cfe9524ec9d004791214aa"
 
 #endif  // GPU_CONFIG_GPU_LISTS_VERSION_H_
diff --git a/chromium/media/mojo/services/mojo_audio_decoder_service.cc b/chromium/media/mojo/services/mojo_audio_decoder_service.cc
index d3d05728902..2434f712481 100644
--- a/chromium/media/mojo/services/mojo_audio_decoder_service.cc
+++ b/chromium/media/mojo/services/mojo_audio_decoder_service.cc
@@ -40,13 +40,16 @@ void MojoAudioDecoderService::Initialize(const AudioDecoderConfig& config,
   // Get CdmContext from cdm_id if the stream is encrypted.
   CdmContext* cdm_context = nullptr;
   if (config.is_encrypted()) {
-    cdm_context_ref_ = mojo_cdm_service_context_->GetCdmContextRef(cdm_id);
-    if (!cdm_context_ref_) {
+    auto cdm_context_ref = mojo_cdm_service_context_->GetCdmContextRef(cdm_id);
+    if (!cdm_context_ref) {
       DVLOG(1) << "CdmContextRef not found for CDM id: " << cdm_id;
       std::move(callback).Run(false, false);
       return;
     }
 
+    // |cdm_context_ref_| must be kept as long as |cdm_context| is used by the
+    // |decoder_|.
+    cdm_context_ref_ = std::move(cdm_context_ref);
     cdm_context = cdm_context_ref_->GetCdmContext();
     DCHECK(cdm_context);
   }
diff --git a/chromium/media/mojo/services/mojo_renderer_service.cc b/chromium/media/mojo/services/mojo_renderer_service.cc
index df09a776a54..00ca2bbc2e6 100644
--- a/chromium/media/mojo/services/mojo_renderer_service.cc
+++ b/chromium/media/mojo/services/mojo_renderer_service.cc
@@ -127,13 +127,16 @@ void MojoRendererService::SetCdm(int32_t cdm_id, SetCdmCallback callback) {
     return;
   }
 
-  cdm_context_ref_ = mojo_cdm_service_context_->GetCdmContextRef(cdm_id);
-  if (!cdm_context_ref_) {
+  auto cdm_context_ref = mojo_cdm_service_context_->GetCdmContextRef(cdm_id);
+  if (!cdm_context_ref) {
     DVLOG(1) << "CdmContextRef not found for CDM ID: " << cdm_id;
     std::move(callback).Run(false);
     return;
   }
 
+  // |cdm_context_ref_| must be kept as long as |cdm_context| is used by the
+  // |renderer_|.
+  cdm_context_ref_ = std::move(cdm_context_ref);
   auto* cdm_context = cdm_context_ref_->GetCdmContext();
   DCHECK(cdm_context);
 
diff --git a/chromium/media/mojo/services/mojo_video_decoder_service.cc b/chromium/media/mojo/services/mojo_video_decoder_service.cc
index 43b86504577..660250017b5 100644
--- a/chromium/media/mojo/services/mojo_video_decoder_service.cc
+++ b/chromium/media/mojo/services/mojo_video_decoder_service.cc
@@ -178,13 +178,16 @@ void MojoVideoDecoderService::Initialize(const VideoDecoderConfig& config,
   // Get CdmContext from cdm_id if the stream is encrypted.
   CdmContext* cdm_context = nullptr;
   if (cdm_id != CdmContext::kInvalidCdmId) {
-    cdm_context_ref_ = mojo_cdm_service_context_->GetCdmContextRef(cdm_id);
-    if (!cdm_context_ref_) {
+    auto cdm_context_ref = mojo_cdm_service_context_->GetCdmContextRef(cdm_id);
+    if (!cdm_context_ref) {
       DVLOG(1) << "CdmContextRef not found for CDM id: " << cdm_id;
       OnDecoderInitialized(false);
       return;
     }
 
+    // |cdm_context_ref_| must be kept as long as |cdm_context| is used by the
+    // |decoder_|.
+    cdm_context_ref_ = std::move(cdm_context_ref);
     cdm_context = cdm_context_ref_->GetCdmContext();
     DCHECK(cdm_context);
   }
diff --git a/chromium/services/network/websocket_throttler.h b/chromium/services/network/websocket_throttler.h
index 510c0575f4c..fa6fbac1566 100644
--- a/chromium/services/network/websocket_throttler.h
+++ b/chromium/services/network/websocket_throttler.h
@@ -47,9 +47,7 @@ class COMPONENT_EXPORT(NETWORK_SERVICE) WebSocketPerProcessThrottler final {
   ~WebSocketPerProcessThrottler();
 
   // Returns if there are too many pending connections.
-  bool HasTooManyPendingConnections() const {
-    return num_pending_connections_ >= kMaxPendingWebSocketConnections;
-  }
+  bool HasTooManyPendingConnections() const { return false; }
 
   // Returns the delay which should be used to throttle opening websocket
   // connections.
diff --git a/chromium/services/network/websocket_throttler_unittest.cc b/chromium/services/network/websocket_throttler_unittest.cc
index 5fdb0038020..710824e72cb 100644
--- a/chromium/services/network/websocket_throttler_unittest.cc
+++ b/chromium/services/network/websocket_throttler_unittest.cc
@@ -107,7 +107,7 @@ TEST(WebSocketPerProcessThrottlerTest, Failed) {
   EXPECT_EQ(base::TimeDelta(), throttler.CalculateDelay());
 }
 
-TEST(WebSocketPerProcessThrottlerTest, TooManyPendingConnections) {
+TEST(WebSocketPerProcessThrottlerTest, DISABLED_TooManyPendingConnections) {
   constexpr int limit = 255;
   WebSocketPerProcessThrottler throttler;
 
@@ -312,7 +312,7 @@ TEST_F(WebSocketThrottlerTest, InitialState) {
   EXPECT_EQ(0u, throttler.GetSizeForTesting());
 }
 
-TEST_F(WebSocketThrottlerTest, TooManyPendingConnections) {
+TEST_F(WebSocketThrottlerTest, DISABLED_TooManyPendingConnections) {
   constexpr int process1 = 1;
   constexpr int process2 = 2;
   constexpr int limit = 255;
diff --git a/chromium/skia/ext/skia_commit_hash.h b/chromium/skia/ext/skia_commit_hash.h
index 57779c35afb..e9bb49cbde0 100644
--- a/chromium/skia/ext/skia_commit_hash.h
+++ b/chromium/skia/ext/skia_commit_hash.h
@@ -3,6 +3,6 @@
 #ifndef SKIA_EXT_SKIA_COMMIT_HASH_H_
 #define SKIA_EXT_SKIA_COMMIT_HASH_H_
 
-#define SKIA_COMMIT_HASH "a10014304cba4f24b7af17191f59490faa8aee77"
+#define SKIA_COMMIT_HASH "f721da7dc93cbf42084b92f673ce8b6c23452d3f"
 
 #endif  // SKIA_EXT_SKIA_COMMIT_HASH_H_
diff --git a/chromium/storage/browser/quota/quota_settings.cc b/chromium/storage/browser/quota/quota_settings.cc
index 1f05a066c4b..a73334ec724 100644
--- a/chromium/storage/browser/quota/quota_settings.cc
+++ b/chromium/storage/browser/quota/quota_settings.cc
@@ -140,7 +140,7 @@ void GetNominalDynamicSettings(const base::FilePath& partition_path,
                                OptionalQuotaSettingsCallback callback) {
   base::PostTaskWithTraitsAndReplyWithResult(
       FROM_HERE,
-      {base::MayBlock(), base::TaskPriority::BEST_EFFORT,
+      {base::MayBlock(), base::TaskPriority::USER_VISIBLE,
        base::TaskShutdownBehavior::CONTINUE_ON_SHUTDOWN},
       base::BindOnce(&CalculateNominalDynamicSettings, partition_path,
                      is_incognito, base::Unretained(disk_info_helper)),
diff --git a/chromium/third_party/blink/renderer/platform/graphics/canvas_resource_provider.cc b/chromium/third_party/blink/renderer/platform/graphics/canvas_resource_provider.cc
index 47385b86531..4a54239d3c3 100644
--- a/chromium/third_party/blink/renderer/platform/graphics/canvas_resource_provider.cc
+++ b/chromium/third_party/blink/renderer/platform/graphics/canvas_resource_provider.cc
@@ -7,6 +7,7 @@
 #include "base/bind.h"
 #include "base/metrics/histogram_functions.h"
 #include "base/stl_util.h"
+#include "build/build_config.h"
 #include "cc/paint/decode_stashing_image_provider.h"
 #include "cc/tiles/software_image_decode_cache.h"
 #include "components/viz/common/resources/resource_format_utils.h"
@@ -901,6 +902,11 @@ std::unique_ptr<CanvasResourceProvider> CanvasResourceProvider::Create(
   const Vector<CanvasResourceType>& fallback_list =
       GetResourceTypeFallbackList(usage);
 
+#if defined(OS_ANDROID)
+  // TODO(khushalsagar): Re-enable these if we're using SurfaceControl and
+  // GMBs allow us to overlay these resources.
+  const bool is_gpu_memory_buffer_image_allowed = false;
+#else
   const bool is_gpu_memory_buffer_image_allowed =
       SharedGpuContext::IsGpuCompositingEnabled() && context_provider_wrapper &&
       presentation_mode == kAllowImageChromiumPresentationMode &&
@@ -909,6 +915,7 @@ std::unique_ptr<CanvasResourceProvider> CanvasResourceProvider::Create(
       gpu::IsImageFromGpuMemoryBufferFormatSupported(
           color_params.GetBufferFormat(),
           context_provider_wrapper->ContextProvider()->GetCapabilities());
+#endif
 
   // TODO(ashithasantosh): Include checks for capabilities, format and size.
   const bool is_swap_chain_allowed =
diff --git a/chromium/third_party/blink/renderer/platform/graphics/canvas_resource_provider_test.cc b/chromium/third_party/blink/renderer/platform/graphics/canvas_resource_provider_test.cc
index 151c37bf277..5ed39ea7523 100644
--- a/chromium/third_party/blink/renderer/platform/graphics/canvas_resource_provider_test.cc
+++ b/chromium/third_party/blink/renderer/platform/graphics/canvas_resource_provider_test.cc
@@ -142,6 +142,13 @@ class CanvasResourceProviderTest : public Test {
         ->SetCapabilities(capabilities);
   }
 
+  bool PlatformSupportsGMBs() {
+#if defined(OS_ANDROID)
+    return false;
+#endif
+    return true;
+  }
+
  protected:
   base::WeakPtr<WebGraphicsContext3DProviderWrapper> context_provider_wrapper_;
   ScopedTestingPlatformSupport<GpuMemoryBufferTestPlatform> platform_;
@@ -164,7 +171,7 @@ TEST_F(CanvasResourceProviderTest,
   EXPECT_TRUE(provider->IsValid());
   EXPECT_TRUE(provider->IsAccelerated());
   EXPECT_TRUE(provider->SupportsDirectCompositing());
-  EXPECT_TRUE(provider->SupportsSingleBuffering());
+  EXPECT_EQ(provider->SupportsSingleBuffering(), PlatformSupportsGMBs());
   EXPECT_EQ(provider->ColorParams().ColorSpace(), kColorParams.ColorSpace());
   EXPECT_EQ(provider->ColorParams().PixelFormat(), kColorParams.PixelFormat());
   EXPECT_EQ(provider->ColorParams().GetOpacityMode(),
@@ -172,7 +179,7 @@ TEST_F(CanvasResourceProviderTest,
 
   EXPECT_FALSE(provider->IsSingleBuffered());
   provider->TryEnableSingleBuffering();
-  EXPECT_TRUE(provider->IsSingleBuffered());
+  EXPECT_EQ(provider->IsSingleBuffered(), PlatformSupportsGMBs());
 }
 
 TEST_F(CanvasResourceProviderTest, CanvasResourceProviderTexture) {
@@ -216,8 +223,8 @@ TEST_F(CanvasResourceProviderTest,
   EXPECT_EQ(provider->Size(), kSize);
   EXPECT_TRUE(provider->IsValid());
   EXPECT_FALSE(provider->IsAccelerated());
-  EXPECT_TRUE(provider->SupportsDirectCompositing());
-  EXPECT_TRUE(provider->SupportsSingleBuffering());
+  EXPECT_EQ(provider->SupportsDirectCompositing(), PlatformSupportsGMBs());
+  EXPECT_EQ(provider->SupportsSingleBuffering(), PlatformSupportsGMBs());
   EXPECT_EQ(provider->ColorParams().ColorSpace(), kColorParams.ColorSpace());
   EXPECT_EQ(provider->ColorParams().PixelFormat(), kColorParams.PixelFormat());
   EXPECT_EQ(provider->ColorParams().GetOpacityMode(),
@@ -412,7 +419,7 @@ TEST_F(CanvasResourceProviderTest,
   EXPECT_TRUE(provider->IsValid());
   EXPECT_TRUE(provider->IsAccelerated());
   EXPECT_TRUE(provider->SupportsDirectCompositing());
-  EXPECT_TRUE(provider->SupportsSingleBuffering());
+  EXPECT_EQ(provider->SupportsSingleBuffering(), PlatformSupportsGMBs());
   EXPECT_EQ(provider->ColorParams().ColorSpace(), kColorParams.ColorSpace());
   EXPECT_EQ(provider->ColorParams().PixelFormat(), kColorParams.PixelFormat());
   EXPECT_EQ(provider->ColorParams().GetOpacityMode(),
@@ -420,7 +427,7 @@ TEST_F(CanvasResourceProviderTest,
 
   EXPECT_FALSE(provider->IsSingleBuffered());
   provider->TryEnableSingleBuffering();
-  EXPECT_TRUE(provider->IsSingleBuffered());
+  EXPECT_EQ(provider->IsSingleBuffered(), PlatformSupportsGMBs());
 }
 
 TEST_F(CanvasResourceProviderTest,
@@ -441,7 +448,7 @@ TEST_F(CanvasResourceProviderTest,
   EXPECT_TRUE(provider->IsValid());
   EXPECT_TRUE(provider->IsAccelerated());
   EXPECT_TRUE(provider->SupportsDirectCompositing());
-  EXPECT_TRUE(provider->SupportsSingleBuffering());
+  EXPECT_EQ(provider->SupportsSingleBuffering(), PlatformSupportsGMBs());
   EXPECT_EQ(provider->ColorParams().ColorSpace(), kColorParams.ColorSpace());
   EXPECT_EQ(provider->ColorParams().PixelFormat(), kColorParams.PixelFormat());
   EXPECT_EQ(provider->ColorParams().GetOpacityMode(),
@@ -449,8 +456,10 @@ TEST_F(CanvasResourceProviderTest,
 
   EXPECT_FALSE(provider->IsSingleBuffered());
   provider->TryEnableSingleBuffering();
-  EXPECT_TRUE(provider->IsSingleBuffered());
+  EXPECT_EQ(provider->IsSingleBuffered(), PlatformSupportsGMBs());
 
+  if (!PlatformSupportsGMBs())
+    return;
   gpu::Mailbox mailbox = gpu::Mailbox::Generate();
   scoped_refptr<ExternalCanvasResource> resource =
       ExternalCanvasResource::Create(
diff --git a/chromium/third_party/blink/renderer/platform/loader/fetch/resource_fetcher.cc b/chromium/third_party/blink/renderer/platform/loader/fetch/resource_fetcher.cc
index acd624b57b1..77ca7a74c0b 100644
--- a/chromium/third_party/blink/renderer/platform/loader/fetch/resource_fetcher.cc
+++ b/chromium/third_party/blink/renderer/platform/loader/fetch/resource_fetcher.cc
@@ -1791,8 +1791,7 @@ void ResourceFetcher::HandleLoaderFinish(
 
   if (scoped_refptr<ResourceTimingInfo> info =
           resource_timing_info_map_.Take(resource)) {
-    if (resource->GetResponse().IsHTTP() &&
-        resource->GetResponse().HttpStatusCode() < 400) {
+    if (resource->GetResponse().IsHTTP()) {
       info->SetInitialURL(resource->GetResourceRequest()
                                   .GetInitialUrlForResourceTiming()
                                   .IsNull()
diff --git a/chromium/third_party/opus/README.chromium b/chromium/third_party/opus/README.chromium
index d02e51cb111..ec97cd22243 100644
--- a/chromium/third_party/opus/README.chromium
+++ b/chromium/third_party/opus/README.chromium
@@ -22,3 +22,4 @@ Local changes:
   reverted when updating to v1.3
 * Apply https://github.com/xiph/opus/commit/4f4b11c2398e96134dc62ee794bfe33ecd6e9bd2
 * Apply https://git.xiph.org/?p=opus.git;a=commit;h=812ae3fb5c589aaafe761b8ebf86bcbbb8f0ed76
+* Apply https://git.xiph.org/?p=opus.git;a=commit;h=cd529ed
diff --git a/chromium/third_party/opus/src/silk/fixed/arm/warped_autocorrelation_FIX_neon_intr.c b/chromium/third_party/opus/src/silk/fixed/arm/warped_autocorrelation_FIX_neon_intr.c
index 00a70cb51ff..6f3be025cc3 100644
--- a/chromium/third_party/opus/src/silk/fixed/arm/warped_autocorrelation_FIX_neon_intr.c
+++ b/chromium/third_party/opus/src/silk/fixed/arm/warped_autocorrelation_FIX_neon_intr.c
@@ -84,7 +84,9 @@ void silk_warped_autocorrelation_FIX_neon(
         silk_assert( ( order & 1 ) == 0 );
         silk_assert( 2 * QS - QC >= 0 );
 
-        ALLOC( input_QST, length + 2 * MAX_SHAPE_LPC_ORDER, opus_int32 );
+        /* The additional +4 is to ensure a later vld1q_s32 call does not overflow.               */
+        /* Strictly, only +3 is needed but +4 simplifies initialization using the 4x32 neon load. */
+        ALLOC( input_QST, length + 2 * MAX_SHAPE_LPC_ORDER + 4, opus_int32 );
 
         input_QS = input_QST;
         /* input_QS has zero paddings in the beginning and end. */
@@ -121,6 +123,8 @@ void silk_warped_autocorrelation_FIX_neon(
         vst1q_s32( input_QS, vdupq_n_s32( 0 ) );
         input_QS += 4;
         vst1q_s32( input_QS, vdupq_n_s32( 0 ) );
+        input_QS += 4;
+        vst1q_s32( input_QS, vdupq_n_s32( 0 ) );
         input_QS = input_QST + MAX_SHAPE_LPC_ORDER - orderT;
 
         /* The following loop runs ( length + order ) times, with ( order ) extra epilogues.                  */
@@ -153,7 +157,8 @@ void silk_warped_autocorrelation_FIX_neon(
             opus_int o = orderT;
             int32x4_t state_QS_s32x4[ 3 ][ 2 ];
 
-            ALLOC( state, length + orderT, opus_int32 );
+            /* The additional +4 is to ensure a later vld1q_s32 call does not overflow. */
+            ALLOC( state, length + order + 4, opus_int32 );
             state_QS_s32x4[ 2 ][ 1 ] = vdupq_n_s32( 0 );
 
             /* Calculate 8 taps of all inputs in each loop. */
diff --git a/chromium/third_party/sqlite/amalgamation/sqlite3.c b/chromium/third_party/sqlite/amalgamation/sqlite3.c
index 41dcdb3dc8f..59bdd500ff2 100644
--- a/chromium/third_party/sqlite/amalgamation/sqlite3.c
+++ b/chromium/third_party/sqlite/amalgamation/sqlite3.c
@@ -106663,6 +106663,7 @@ static void detachFunc(
   sqlite3 *db = sqlite3_context_db_handle(context);
   int i;
   Db *pDb = 0;
+  HashElem *pEntry;
   char zErr[128];
 
   UNUSED_PARAMETER(NotUsed);
@@ -106687,6 +106688,18 @@ static void detachFunc(
     goto detach_error;
   }
 
+  /* If any TEMP triggers reference the schema being detached, move those
+  ** triggers to reference the TEMP schema itself. */
+  assert( db->aDb[1].pSchema );
+  pEntry = sqliteHashFirst(&db->aDb[1].pSchema->trigHash);
+  while( pEntry ){
+    Trigger *pTrig = (Trigger*)sqliteHashData(pEntry);
+    if( pTrig->pTabSchema==pDb->pSchema ){
+      pTrig->pTabSchema = pTrig->pSchema;
+    }
+    pEntry = sqliteHashNext(pEntry);
+  }
+
   sqlite3BtreeClose(pDb->pBt);
   pDb->pBt = 0;
   pDb->pSchema = 0;
@@ -132584,10 +132597,9 @@ SQLITE_PRIVATE void sqlite3DropTriggerPtr(Parse *pParse, Trigger *pTrigger){
   iDb = sqlite3SchemaToIndex(pParse->db, pTrigger->pSchema);
   assert( iDb>=0 && iDb<db->nDb );
   pTable = tableOfTrigger(pTrigger);
-  assert( pTable );
-  assert( pTable->pSchema==pTrigger->pSchema || iDb==1 );
+  assert( (pTable && pTable->pSchema==pTrigger->pSchema) || iDb==1 );
 #ifndef SQLITE_OMIT_AUTHORIZATION
-  {
+  if( pTable ){
     int code = SQLITE_DROP_TRIGGER;
     const char *zDb = db->aDb[iDb].zDbSName;
     const char *zTab = SCHEMA_TABLE(iDb);
@@ -132601,7 +132613,6 @@ SQLITE_PRIVATE void sqlite3DropTriggerPtr(Parse *pParse, Trigger *pTrigger){
 
   /* Generate code to destroy the database record of the trigger.
   */
-  assert( pTable!=0 );
   if( (v = sqlite3GetVdbe(pParse))!=0 ){
     sqlite3NestedParse(pParse,
        "DELETE FROM %Q.%s WHERE name=%Q AND type='trigger'",
@@ -132625,9 +132636,11 @@ SQLITE_PRIVATE void sqlite3UnlinkAndDeleteTrigger(sqlite3 *db, int iDb, const ch
   if( ALWAYS(pTrigger) ){
     if( pTrigger->pSchema==pTrigger->pTabSchema ){
       Table *pTab = tableOfTrigger(pTrigger);
-      Trigger **pp;
-      for(pp=&pTab->pTrigger; *pp!=pTrigger; pp=&((*pp)->pNext));
-      *pp = (*pp)->pNext;
+      if( pTab ){
+        Trigger **pp;
+        for(pp=&pTab->pTrigger; *pp!=pTrigger; pp=&((*pp)->pNext));
+        *pp = (*pp)->pNext;
+      }
     }
     sqlite3DeleteTrigger(db, pTrigger);
     db->mDbFlags |= DBFLAG_SchemaChange;
@@ -223275,7 +223288,7 @@ SQLITE_API int sqlite3_stmt_init(
 #endif /* !defined(SQLITE_CORE) || defined(SQLITE_ENABLE_STMTVTAB) */
 
 /************** End of stmt.c ************************************************/
-#if __LINE__!=223278
+#if __LINE__!=223291
 #undef SQLITE_SOURCE_ID
 #define SQLITE_SOURCE_ID      "2019-07-10 17:32:03 fc82b73eaac8b36950e527f12c4b5dc1e147e6f4ad2217ae43ad82882a88alt2"
 #endif
diff --git a/chromium/third_party/sqlite/patched/src/attach.c b/chromium/third_party/sqlite/patched/src/attach.c
index 347680fd4be..ef0700fd483 100644
--- a/chromium/third_party/sqlite/patched/src/attach.c
+++ b/chromium/third_party/sqlite/patched/src/attach.c
@@ -299,6 +299,7 @@ static void detachFunc(
   sqlite3 *db = sqlite3_context_db_handle(context);
   int i;
   Db *pDb = 0;
+  HashElem *pEntry;
   char zErr[128];
 
   UNUSED_PARAMETER(NotUsed);
@@ -323,6 +324,18 @@ static void detachFunc(
     goto detach_error;
   }
 
+  /* If any TEMP triggers reference the schema being detached, move those
+  ** triggers to reference the TEMP schema itself. */
+  assert( db->aDb[1].pSchema );
+  pEntry = sqliteHashFirst(&db->aDb[1].pSchema->trigHash);
+  while( pEntry ){
+    Trigger *pTrig = (Trigger*)sqliteHashData(pEntry);
+    if( pTrig->pTabSchema==pDb->pSchema ){
+      pTrig->pTabSchema = pTrig->pSchema;
+    }
+    pEntry = sqliteHashNext(pEntry);
+  }
+
   sqlite3BtreeClose(pDb->pBt);
   pDb->pBt = 0;
   pDb->pSchema = 0;
diff --git a/chromium/third_party/sqlite/patched/src/trigger.c b/chromium/third_party/sqlite/patched/src/trigger.c
index fba75d8fb4d..2c27ea3ecfc 100644
--- a/chromium/third_party/sqlite/patched/src/trigger.c
+++ b/chromium/third_party/sqlite/patched/src/trigger.c
@@ -613,10 +613,9 @@ void sqlite3DropTriggerPtr(Parse *pParse, Trigger *pTrigger){
   iDb = sqlite3SchemaToIndex(pParse->db, pTrigger->pSchema);
   assert( iDb>=0 && iDb<db->nDb );
   pTable = tableOfTrigger(pTrigger);
-  assert( pTable );
-  assert( pTable->pSchema==pTrigger->pSchema || iDb==1 );
+  assert( (pTable && pTable->pSchema==pTrigger->pSchema) || iDb==1 );
 #ifndef SQLITE_OMIT_AUTHORIZATION
-  {
+  if( pTable ){
     int code = SQLITE_DROP_TRIGGER;
     const char *zDb = db->aDb[iDb].zDbSName;
     const char *zTab = SCHEMA_TABLE(iDb);
@@ -630,7 +629,6 @@ void sqlite3DropTriggerPtr(Parse *pParse, Trigger *pTrigger){
 
   /* Generate code to destroy the database record of the trigger.
   */
-  assert( pTable!=0 );
   if( (v = sqlite3GetVdbe(pParse))!=0 ){
     sqlite3NestedParse(pParse,
        "DELETE FROM %Q.%s WHERE name=%Q AND type='trigger'",
@@ -654,9 +652,11 @@ void sqlite3UnlinkAndDeleteTrigger(sqlite3 *db, int iDb, const char *zName){
   if( ALWAYS(pTrigger) ){
     if( pTrigger->pSchema==pTrigger->pTabSchema ){
       Table *pTab = tableOfTrigger(pTrigger);
-      Trigger **pp;
-      for(pp=&pTab->pTrigger; *pp!=pTrigger; pp=&((*pp)->pNext));
-      *pp = (*pp)->pNext;
+      if( pTab ){
+        Trigger **pp;
+        for(pp=&pTab->pTrigger; *pp!=pTrigger; pp=&((*pp)->pNext));
+        *pp = (*pp)->pNext;
+      }
     }
     sqlite3DeleteTrigger(db, pTrigger);
     db->mDbFlags |= DBFLAG_SchemaChange;
diff --git a/chromium/third_party/sqlite/patches/0001-Call-ioctl-with-the-correct-signature-on-both-Androi.patch b/chromium/third_party/sqlite/patches/0001-Call-ioctl-with-the-correct-signature-on-both-Androi.patch
index d07d2a0033a..11f8c6a92d6 100644
--- a/chromium/third_party/sqlite/patches/0001-Call-ioctl-with-the-correct-signature-on-both-Androi.patch
+++ b/chromium/third_party/sqlite/patches/0001-Call-ioctl-with-the-correct-signature-on-both-Androi.patch
@@ -1,7 +1,7 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Sarthak Kukreti <sarthakkukreti@chromium.org>
 Date: Mon, 15 Jul 2019 17:23:45 -0700
-Subject: [PATCH 1/5] Call ioctl() with the correct signature on both Android
+Subject: [PATCH 1/6] Call ioctl() with the correct signature on both Android
  and stock Linux.
 
 This backports https://sqlite.org/src/info/68e12e063fe41bcd
@@ -32,5 +32,5 @@ index 52ef64116444..894c725b5265 100644
  }; /* End of the overrideable system calls */
  
 -- 
-2.22.0.657.g960e92d24f-goog
+2.23.0.351.gc4317032e6-goog
 
diff --git a/chromium/third_party/sqlite/patches/0002-Fix-Heap-Buffer-Overflow.patch b/chromium/third_party/sqlite/patches/0002-Fix-Heap-Buffer-Overflow.patch
index 50fcbb0aed4..342c633e7ea 100644
--- a/chromium/third_party/sqlite/patches/0002-Fix-Heap-Buffer-Overflow.patch
+++ b/chromium/third_party/sqlite/patches/0002-Fix-Heap-Buffer-Overflow.patch
@@ -1,7 +1,7 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Darwin Huang <huangdarwin@chromium.org>
 Date: Wed, 17 Jul 2019 14:52:39 -0700
-Subject: [PATCH 2/5] Fix Heap-Buffer-Overflow
+Subject: [PATCH 2/6] Fix Heap-Buffer-Overflow
 
     Backports https://www.sqlite.org/src/info/bd9a47a3a2997bfb
 
@@ -130,5 +130,5 @@ index 000000000000..500f2bd157cd
 +finish_test
 +
 -- 
-2.22.0.657.g960e92d24f-goog
+2.23.0.351.gc4317032e6-goog
 
diff --git a/chromium/third_party/sqlite/patches/0003-Fix-ASSERT-memIsValid-hit.patch b/chromium/third_party/sqlite/patches/0003-Fix-ASSERT-memIsValid-hit.patch
index 8593b759805..d6a8184c5e5 100644
--- a/chromium/third_party/sqlite/patches/0003-Fix-ASSERT-memIsValid-hit.patch
+++ b/chromium/third_party/sqlite/patches/0003-Fix-ASSERT-memIsValid-hit.patch
@@ -1,7 +1,7 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Darwin Huang <huangdarwin@chromium.org>
 Date: Wed, 17 Jul 2019 15:22:41 -0700
-Subject: [PATCH 3/5] Fix ASSERT memIsValid hit
+Subject: [PATCH 3/6] Fix ASSERT memIsValid hit
 
 Backports https://www.sqlite.org/src/info/7ef7b23cbb1b9ace
 
@@ -228,5 +228,5 @@ index 000000000000..126e68751b28
 +finish_test
 \ No newline at end of file
 -- 
-2.22.0.657.g960e92d24f-goog
+2.23.0.351.gc4317032e6-goog
 
diff --git a/chromium/third_party/sqlite/patches/0004-Fix-incorrect-assert.patch b/chromium/third_party/sqlite/patches/0004-Fix-incorrect-assert.patch
index 5aa12cb4e46..e1b056bcc61 100644
--- a/chromium/third_party/sqlite/patches/0004-Fix-incorrect-assert.patch
+++ b/chromium/third_party/sqlite/patches/0004-Fix-incorrect-assert.patch
@@ -1,7 +1,7 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Darwin Huang <huangdarwin@chromium.org>
 Date: Wed, 17 Jul 2019 15:24:25 -0700
-Subject: [PATCH 4/5] Fix incorrect assert
+Subject: [PATCH 4/6] Fix incorrect assert
 
 Backports https://www.sqlite.org/src/info/59c9e73f86b89ee1
 
@@ -29,5 +29,5 @@ index c0ae8f00922e..23cb6bb3b083 100644
    if( pPage->nOverflow || sz+2>pPage->nFree ){
      if( pTemp ){
 -- 
-2.22.0.657.g960e92d24f-goog
+2.23.0.351.gc4317032e6-goog
 
diff --git a/chromium/third_party/sqlite/patches/0005-Fix-bad-chrome_sqlite3_free.patch b/chromium/third_party/sqlite/patches/0005-Fix-bad-chrome_sqlite3_free.patch
index 0ac3ad6b817..a5fb6f80d24 100644
--- a/chromium/third_party/sqlite/patches/0005-Fix-bad-chrome_sqlite3_free.patch
+++ b/chromium/third_party/sqlite/patches/0005-Fix-bad-chrome_sqlite3_free.patch
@@ -1,7 +1,7 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Darwin Huang <huangdarwin@chromium.org>
 Date: Tue, 23 Jul 2019 15:11:19 -0700
-Subject: [PATCH 5/5] Fix bad chrome_sqlite3_free
+Subject: [PATCH 5/6] Fix bad chrome_sqlite3_free
 
 Backports https://www.sqlite.org/src/info/f60a83069168899d
 
@@ -29,5 +29,5 @@ index 23cb6bb3b083..887be63bd7d0 100644
        return SQLITE_OK;
      }
 -- 
-2.22.0.657.g960e92d24f-goog
+2.23.0.351.gc4317032e6-goog
 
diff --git a/chromium/third_party/sqlite/patches/0006-Avoid-dangling-schema-pointer.patch b/chromium/third_party/sqlite/patches/0006-Avoid-dangling-schema-pointer.patch
new file mode 100644
index 00000000000..5a0157a5a9a
--- /dev/null
+++ b/chromium/third_party/sqlite/patches/0006-Avoid-dangling-schema-pointer.patch
@@ -0,0 +1,111 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Darwin Huang <huangdarwin@chromium.org>
+Date: Wed, 25 Sep 2019 14:58:51 -0700
+Subject: [PATCH 6/6] Avoid dangling schema pointer
+
+Backports https://www.sqlite.org/src/info/069c2f4c61f06211
+
+Bug 990234
+---
+ third_party/sqlite/patched/src/attach.c       | 13 +++++++++++++
+ third_party/sqlite/patched/src/trigger.c      | 14 +++++++-------
+ third_party/sqlite/patched/test/trigger1.test | 14 ++++++++++++++
+ 3 files changed, 34 insertions(+), 7 deletions(-)
+
+diff --git a/third_party/sqlite/patched/src/attach.c b/third_party/sqlite/patched/src/attach.c
+index 347680fd4be2..ef0700fd483b 100644
+--- a/third_party/sqlite/patched/src/attach.c
++++ b/third_party/sqlite/patched/src/attach.c
+@@ -299,6 +299,7 @@ static void detachFunc(
+   sqlite3 *db = sqlite3_context_db_handle(context);
+   int i;
+   Db *pDb = 0;
++  HashElem *pEntry;
+   char zErr[128];
+ 
+   UNUSED_PARAMETER(NotUsed);
+@@ -323,6 +324,18 @@ static void detachFunc(
+     goto detach_error;
+   }
+ 
++  /* If any TEMP triggers reference the schema being detached, move those
++  ** triggers to reference the TEMP schema itself. */
++  assert( db->aDb[1].pSchema );
++  pEntry = sqliteHashFirst(&db->aDb[1].pSchema->trigHash);
++  while( pEntry ){
++    Trigger *pTrig = (Trigger*)sqliteHashData(pEntry);
++    if( pTrig->pTabSchema==pDb->pSchema ){
++      pTrig->pTabSchema = pTrig->pSchema;
++    }
++    pEntry = sqliteHashNext(pEntry);
++  }
++
+   sqlite3BtreeClose(pDb->pBt);
+   pDb->pBt = 0;
+   pDb->pSchema = 0;
+diff --git a/third_party/sqlite/patched/src/trigger.c b/third_party/sqlite/patched/src/trigger.c
+index fba75d8fb4de..2c27ea3ecfc9 100644
+--- a/third_party/sqlite/patched/src/trigger.c
++++ b/third_party/sqlite/patched/src/trigger.c
+@@ -613,10 +613,9 @@ void sqlite3DropTriggerPtr(Parse *pParse, Trigger *pTrigger){
+   iDb = sqlite3SchemaToIndex(pParse->db, pTrigger->pSchema);
+   assert( iDb>=0 && iDb<db->nDb );
+   pTable = tableOfTrigger(pTrigger);
+-  assert( pTable );
+-  assert( pTable->pSchema==pTrigger->pSchema || iDb==1 );
++  assert( (pTable && pTable->pSchema==pTrigger->pSchema) || iDb==1 );
+ #ifndef SQLITE_OMIT_AUTHORIZATION
+-  {
++  if( pTable ){
+     int code = SQLITE_DROP_TRIGGER;
+     const char *zDb = db->aDb[iDb].zDbSName;
+     const char *zTab = SCHEMA_TABLE(iDb);
+@@ -630,7 +629,6 @@ void sqlite3DropTriggerPtr(Parse *pParse, Trigger *pTrigger){
+ 
+   /* Generate code to destroy the database record of the trigger.
+   */
+-  assert( pTable!=0 );
+   if( (v = sqlite3GetVdbe(pParse))!=0 ){
+     sqlite3NestedParse(pParse,
+        "DELETE FROM %Q.%s WHERE name=%Q AND type='trigger'",
+@@ -654,9 +652,11 @@ void sqlite3UnlinkAndDeleteTrigger(sqlite3 *db, int iDb, const char *zName){
+   if( ALWAYS(pTrigger) ){
+     if( pTrigger->pSchema==pTrigger->pTabSchema ){
+       Table *pTab = tableOfTrigger(pTrigger);
+-      Trigger **pp;
+-      for(pp=&pTab->pTrigger; *pp!=pTrigger; pp=&((*pp)->pNext));
+-      *pp = (*pp)->pNext;
++      if( pTab ){
++        Trigger **pp;
++        for(pp=&pTab->pTrigger; *pp!=pTrigger; pp=&((*pp)->pNext));
++        *pp = (*pp)->pNext;
++      }
+     }
+     sqlite3DeleteTrigger(db, pTrigger);
+     db->mDbFlags |= DBFLAG_SchemaChange;
+diff --git a/third_party/sqlite/patched/test/trigger1.test b/third_party/sqlite/patched/test/trigger1.test
+index 3cfd2fa2f0ab..489a51e2e5a0 100644
+--- a/third_party/sqlite/patched/test/trigger1.test
++++ b/third_party/sqlite/patched/test/trigger1.test
+@@ -768,4 +768,18 @@ do_execsql_test trigger1-19.1 {
+   SELECT * FROM t19;
+ } {1 2 2}
+ 
++# 2019-08-26 Chromium sqlite3_fts3_lpm_fuzzer find.
++#
++db close
++sqlite3 db :memory:
++do_execsql_test trigger1-20.1 {
++  CREATE TABLE t20_1(x);
++  ATTACH ':memory:' AS aux;
++  CREATE TABLE aux.t20_2(y);
++  CREATE TABLE aux.t20_3(z);
++  CREATE TEMP TRIGGER r20_3 AFTER INSERT ON t20_2 BEGIN UPDATE t20_3 SET z=z+1; END;
++  DETACH aux;
++  DROP TRIGGER r20_3;
++} {}
++
+ finish_test
+-- 
+2.23.0.351.gc4317032e6-goog
+
diff --git a/chromium/tools/metrics/histograms/histograms.xml b/chromium/tools/metrics/histograms/histograms.xml
index 9a5e6f5dfbf..5bf74b01450 100644
--- a/chromium/tools/metrics/histograms/histograms.xml
+++ b/chromium/tools/metrics/histograms/histograms.xml
@@ -139254,14 +139254,24 @@ should be kept until we use this API.  -->
   </summary>
 </histogram>
 
-<histogram name="Tabs.ScrubDistance" units="tabs" expires_after="2018-08-30">
-  <owner>Please list the metric's owners. Add more owner tags as needed.</owner>
+<histogram name="Tabs.ScrubDistance" units="tabs" expires_after="M90">
+  <owner>afakhry@chromium.org</owner>
+  <owner>tclaiborne@chromium.org</owner>
   <summary>
-    The distance a user 3 finger scrubbed to change tabs. Always positive
+    The distance a user multi-finger scrubbed to change tabs. Always positive
     (ignores left / right).
   </summary>
 </histogram>
 
+<histogram name="Tabs.ScrubDuration" units="ms" expires_after="M90">
+  <owner>afakhry@chromium.org</owner>
+  <owner>tclaiborne@chromium.org</owner>
+  <summary>
+    The duration a user spent doing multi-finger scrubbing to change tabs before
+    a different tab than the currently active one was actually activated.
+  </summary>
+</histogram>
+
 <histogram name="Tabs.SpeculativeRestoreApplicability"
     enum="SpeculativeRestoreApplicability" expires_after="2019-01-16">
   <obsolete>
diff --git a/chromium/ui/base/x/x11_window.cc b/chromium/ui/base/x/x11_window.cc
index 7df0a3a8ed2..ec9484ce33d 100644
--- a/chromium/ui/base/x/x11_window.cc
+++ b/chromium/ui/base/x/x11_window.cc
@@ -1350,7 +1350,7 @@ void XWindow::OnConfigureEvent(XEvent* xev) {
     delegate_->OnXWindowMoved(bounds_in_pixels_.origin());
 
   if (size_changed)
-    delegate_->OnXWindowSizeChanged(bounds_in_pixels_.size());
+    DispatchResize();
 }
 
 void XWindow::SetWMSpecState(bool enabled, XAtom state1, XAtom state2) {
diff --git a/chromium/v8/include/v8-version.h b/chromium/v8/include/v8-version.h
index 0406f65b08e..97c4dd85fe8 100644
--- a/chromium/v8/include/v8-version.h
+++ b/chromium/v8/include/v8-version.h
@@ -11,7 +11,7 @@
 #define V8_MAJOR_VERSION 7
 #define V8_MINOR_VERSION 7
 #define V8_BUILD_NUMBER 299
-#define V8_PATCH_LEVEL 11
+#define V8_PATCH_LEVEL 14
 
 // Use 1 for candidates and 0 otherwise.
 // (Boolean macro values are not supported by all preprocessors.)
diff --git a/chromium/v8/infra/testing/builders.pyl b/chromium/v8/infra/testing/builders.pyl
index 13a73f3e94c..965300da773 100644
--- a/chromium/v8/infra/testing/builders.pyl
+++ b/chromium/v8/infra/testing/builders.pyl
@@ -43,7 +43,7 @@
       {'name': 'v8testing', 'variant': 'default', 'shards': 4},
       {'name': 'v8testing', 'variant': 'trusted', 'shards': 4},
       {'name': 'mozilla', 'variant': 'default'},
-      {'name': 'test262_variants', 'variant': 'default', 'shards': 7},
+      {'name': 'test262', 'variant': 'default', 'shards': 7},
     ],
   },
   ##############################################################################
@@ -59,7 +59,7 @@
       {'name': 'mjsunit_sp_frame_access'},
       {'name': 'mozilla'},
       {'name': 'mozilla', 'variant': 'extra'},
-      {'name': 'test262', 'shards': 2},
+      {'name': 'test262', 'variant': 'default', 'shards': 2},
       {'name': 'test262_variants', 'variant': 'extra', 'shards': 3},
       {'name': 'v8testing', 'shards': 3},
       {'name': 'v8testing', 'variant': 'extra', 'shards': 2},
@@ -175,6 +175,7 @@
       {
         'name': 'test262',
         'suffix': 'nosse3',
+        'variant': 'default',
         'test_args': [
           '--extra-flags',
           '--noenable-sse3 --noenable-ssse3 --noenable-sse4-1 --noenable-avx',
@@ -198,6 +199,7 @@
       {
         'name': 'test262',
         'suffix': 'nosse4',
+        'variant': 'default',
         'test_args': ['--extra-flags', '--noenable-sse4-1 --noenable-avx'],
       },
       {
@@ -225,7 +227,7 @@
     'tests': [
       {'name': 'mjsunit_sp_frame_access'},
       {'name': 'mozilla'},
-      {'name': 'test262'},
+      {'name': 'test262', 'variant': 'default'},
       {'name': 'v8testing', 'shards': 7},
       {'name': 'v8testing', 'variant': 'extra', 'shards': 3},
       {'name': 'v8testing', 'variant': 'trusted', 'shards': 2},
@@ -246,7 +248,7 @@
     'tests': [
       {'name': 'mjsunit_sp_frame_access', 'shards': 2},
       {'name': 'mozilla', 'shards': 2},
-      {'name': 'test262', 'shards': 2},
+      {'name': 'test262', 'variant': 'default', 'shards': 2},
       {'name': 'v8testing', 'shards': 10},
       {'name': 'v8testing', 'variant': 'extra', 'shards': 8},
       {'name': 'v8testing', 'variant': 'trusted', 'shards': 2},
@@ -273,7 +275,7 @@
       {'name': 'benchmarks'},
       {'name': 'mozilla'},
       {'name': 'optimize_for_size'},
-      {'name': 'test262'},
+      {'name': 'test262', 'variant': 'default'},
       {'name': 'v8testing', 'shards': 2},
     ],
   },
@@ -288,7 +290,7 @@
       {'name': 'mjsunit_sp_frame_access'},
       {'name': 'mozilla'},
       {'name': 'mozilla', 'variant': 'extra'},
-      {'name': 'test262'},
+      {'name': 'test262', 'variant': 'default'},
       {'name': 'test262_variants', 'variant': 'extra', 'shards': 3},
       {'name': 'v8testing', 'shards': 3},
       {'name': 'v8testing', 'variant': 'extra', 'shards': 2},
@@ -325,7 +327,7 @@
       'os': 'Ubuntu-16.04',
     },
     'tests': [
-      {'name': 'test262', 'shards': 2},
+      {'name': 'test262', 'variant': 'default', 'shards': 2},
       {'name': 'v8testing', 'shards': 5},
     ],
   },
@@ -413,7 +415,7 @@
     'tests': [
       {'name': 'benchmarks'},
       {'name': 'mozilla'},
-      {'name': 'test262', 'shards': 3},
+      {'name': 'test262', 'variant': 'default', 'shards': 3},
       {'name': 'v8testing', 'shards': 5},
       {'name': 'v8testing', 'variant': 'extra', 'shards': 3},
       {'name': 'v8testing', 'variant': 'slow_path'},
@@ -452,7 +454,7 @@
     'tests': [
       {'name': 'mjsunit_sp_frame_access'},
       {'name': 'mozilla', 'shards': 2},
-      {'name': 'test262', 'shards': 2},
+      {'name': 'test262', 'variant': 'default', 'shards': 2},
       {'name': 'v8testing', 'shards': 10},
       {'name': 'v8testing', 'variant': 'extra', 'shards': 6},
       {'name': 'v8testing', 'variant': 'trusted', 'shards': 3},
@@ -473,7 +475,7 @@
     'tests': [
       {'name': 'mjsunit_sp_frame_access', 'shards': 2},
       {'name': 'mozilla', 'shards': 2},
-      {'name': 'test262', 'shards': 2},
+      {'name': 'test262', 'variant': 'default', 'shards': 2},
       {'name': 'v8testing', 'shards': 12},
       {'name': 'v8testing', 'variant': 'extra', 'shards': 8},
       {'name': 'v8testing', 'variant': 'trusted', 'shards': 3},
@@ -538,7 +540,7 @@
     },
     'tests': [
       {'name': 'mozilla'},
-      {'name': 'test262', 'shards': 2},
+      {'name': 'test262', 'variant': 'default', 'shards': 2},
       {'name': 'v8testing', 'shards': 2},
     ],
   },
@@ -559,7 +561,7 @@
     },
     'tests': [
       {'name': 'mozilla'},
-      {'name': 'test262', 'shards': 2},
+      {'name': 'test262', 'variant': 'default', 'shards': 2},
       {'name': 'v8testing', 'shards': 3},
       {'name': 'v8testing', 'variant': 'extra', 'shards': 2},
     ],
@@ -571,7 +573,7 @@
     },
     'tests': [
       {'name': 'mozilla'},
-      {'name': 'test262'},
+      {'name': 'test262', 'variant': 'default'},
       {'name': 'v8testing', 'shards': 2},
     ],
   },
@@ -582,7 +584,7 @@
     },
     'tests': [
       {'name': 'mozilla'},
-      {'name': 'test262'},
+      {'name': 'test262', 'variant': 'default'},
       {'name': 'v8testing', 'shards': 2},
       {'name': 'v8testing', 'variant': 'extra'},
     ],
@@ -605,7 +607,7 @@
     },
     'tests': [
       {'name': 'mozilla'},
-      {'name': 'test262', 'shards': 2},
+      {'name': 'test262', 'variant': 'default', 'shards': 2},
       {'name': 'v8testing', 'shards': 3},
       {'name': 'v8testing', 'variant': 'extra', 'shards': 2},
     ],
@@ -626,7 +628,7 @@
     },
     'tests': [
       {'name': 'mozilla'},
-      {'name': 'test262', 'shards': 2},
+      {'name': 'test262', 'variant': 'default', 'shards': 2},
       {'name': 'v8testing', 'shards': 2},
       {'name': 'v8testing', 'variant': 'extra'},
     ],
@@ -696,7 +698,7 @@
       'os': 'Ubuntu-16.04',
     },
     'tests': [
-      {'name': 'test262', 'shards': 3},
+      {'name': 'test262', 'variant': 'default', 'shards': 3},
       {'name': 'v8testing', 'shards': 4},
     ],
   },
@@ -735,6 +737,7 @@
       {
         'name': 'test262',
         'suffix': 'nosse3',
+        'variant': 'default',
         'test_args': ['--extra-flags', '--noenable-sse3 --noenable-ssse3 --noenable-sse4-1 --noenable-avx']
       },
       {
@@ -752,6 +755,7 @@
       {
         'name': 'test262',
         'suffix': 'nosse4',
+        'variant': 'default',
         'test_args': ['--extra-flags', '--noenable-sse4-1 --noenable-avx']
       },
       {
@@ -863,7 +867,7 @@
     },
     'tests': [
       {'name': 'mozilla'},
-      {'name': 'test262'},
+      {'name': 'test262', 'variant': 'default'},
       {'name': 'v8testing'},
     ],
   },
@@ -916,6 +920,7 @@
       {
         'name': 'test262',
         'suffix': 'noavx',
+        'variant': 'default',
         'test_args': ['--extra-flags', '--noenable-avx']
       },
       {
@@ -933,7 +938,7 @@
       {'name': 'benchmarks'},
       {'name': 'mozilla'},
       {'name': 'optimize_for_size'},
-      {'name': 'test262'},
+      {'name': 'test262', 'variant': 'default'},
       {'name': 'v8testing'},
     ],
   },
@@ -972,6 +977,7 @@
       {
         'name': 'test262',
         'suffix': 'noavx',
+        'variant': 'default',
         'test_args': ['--extra-flags', '--noenable-avx']
       },
       {
@@ -1049,7 +1055,7 @@
     },
     'tests': [
       {'name': 'mozilla'},
-      {'name': 'test262'},
+      {'name': 'test262', 'variant': 'default'},
       {'name': 'v8testing'},
     ],
   },
@@ -1091,7 +1097,7 @@
     'tests': [
       {'name': 'benchmarks'},
       {'name': 'mozilla'},
-      {'name': 'test262', 'shards': 3},
+      {'name': 'test262', 'variant': 'default', 'shards': 3},
       {'name': 'v8testing', 'shards': 5},
       {'name': 'v8testing', 'variant': 'extra', 'shards': 3},
       {'name': 'v8testing', 'variant': 'slow_path', 'shards': 1},
@@ -1117,6 +1123,7 @@
       },
       {
         'name': 'test262',
+        'variant': 'default',
         'test_args': ['--extra-flags=--stress-incremental-marking'],
         'shards': 4,
       },
@@ -1141,7 +1148,7 @@
     },
     'tests': [
       {'name': 'mozilla'},
-      {'name': 'test262', 'shards': 2},
+      {'name': 'test262', 'variant': 'default', 'shards': 2},
       {'name': 'v8testing'},
       {'name': 'v8testing', 'variant': 'extra'},
     ],
@@ -1153,7 +1160,7 @@
     },
     'tests': [
       {'name': 'mozilla'},
-      {'name': 'test262', 'shards': 2},
+      {'name': 'test262', 'variant': 'default', 'shards': 2},
       {'name': 'v8testing', 'shards': 2},
       {'name': 'v8testing', 'variant': 'extra'},
     ],
@@ -1165,7 +1172,7 @@
     },
     'tests': [
       {'name': 'mozilla'},
-      {'name': 'test262', 'shards': 2},
+      {'name': 'test262', 'variant': 'default', 'shards': 2},
       {'name': 'v8testing', 'shards': 4},
       {'name': 'v8testing', 'variant': 'extra', 'shards': 2},
     ],
@@ -1195,7 +1202,7 @@
     },
     'tests': [
       {'name': 'mozilla'},
-      {'name': 'test262'},
+      {'name': 'test262', 'variant': 'default'},
       {'name': 'v8testing'},
     ],
   },
@@ -1206,7 +1213,7 @@
     },
     'tests': [
       {'name': 'mozilla'},
-      {'name': 'test262'},
+      {'name': 'test262', 'variant': 'default'},
       {'name': 'v8testing', 'shards': 5},
     ],
   },
@@ -1225,7 +1232,7 @@
     },
     'tests': [
       {'name': 'mozilla'},
-      {'name': 'test262'},
+      {'name': 'test262', 'variant': 'default'},
       {'name': 'v8testing'},
       {'name': 'v8testing', 'variant': 'extra'},
     ],
@@ -1236,7 +1243,7 @@
     },
     'tests': [
       {'name': 'mozilla'},
-      {'name': 'test262'},
+      {'name': 'test262', 'variant': 'default'},
       {'name': 'v8testing', 'shards': 4},
       {'name': 'v8testing', 'variant': 'extra', 'shards': 3},
     ],
@@ -1247,7 +1254,7 @@
     },
     'tests': [
       {'name': 'mozilla'},
-      {'name': 'test262'},
+      {'name': 'test262', 'variant': 'default'},
       {'name': 'v8testing'},
     ],
   },
@@ -1358,7 +1365,7 @@
     'tests': [
       {'name': 'mjsunit_sp_frame_access'},
       {'name': 'mozilla'},
-      {'name': 'test262'},
+      {'name': 'test262', 'variant': 'default'},
       {'name': 'v8testing', 'shards': 4},
       {'name': 'v8testing', 'variant': 'extra'},
       {'name': 'v8testing', 'variant': 'trusted'},
@@ -1371,6 +1378,7 @@
       {
         'name': 'test262',
         'suffix': 'armv8-a',
+        'variant': 'default',
         'test_args': ['--extra-flags', '--enable-armv8']
       },
       {
@@ -1380,8 +1388,17 @@
         'shards': 4
       },
       # Novfp3.
-      {'name': 'mozilla', 'suffix': 'novfp3', 'test_args': ['--novfp3']},
-      {'name': 'test262', 'suffix': 'novfp3', 'test_args': ['--novfp3']},
+      {
+        'name': 'mozilla',
+        'suffix': 'novfp3',
+        'test_args': ['--novfp3'],
+      },
+      {
+        'name': 'test262',
+        'suffix': 'novfp3',
+        'variant': 'default',
+        'test_args': ['--novfp3'],
+      },
       {
         'name': 'v8testing',
         'suffix': 'novfp3',
@@ -1397,7 +1414,7 @@
     'tests': [
       {'name': 'mjsunit_sp_frame_access'},
       {'name': 'mozilla'},
-      {'name': 'test262'},
+      {'name': 'test262', 'variant': 'default'},
       {'name': 'v8testing', 'shards': 8},
       {'name': 'v8testing', 'variant': 'extra', 'shards': 4},
       {'name': 'v8testing', 'variant': 'trusted', 'shards': 2},
@@ -1411,6 +1428,7 @@
       {
         'name': 'test262',
         'suffix': 'armv8-a',
+        'variant': 'default',
         'test_args': ['--extra-flags', '--enable-armv8'],
         'shards': 2,
       },
@@ -1465,7 +1483,7 @@
     'tests': [
       {'name': 'mjsunit_sp_frame_access'},
       {'name': 'mozilla'},
-      {'name': 'test262'},
+      {'name': 'test262', 'variant': 'default'},
       {'name': 'v8testing', 'shards': 3},
       {'name': 'v8testing', 'variant': 'extra'},
       {'name': 'v8testing', 'variant': 'trusted'},
@@ -1482,7 +1500,7 @@
     'tests': [
       {'name': 'mjsunit_sp_frame_access'},
       {'name': 'mozilla', 'shards': 2},
-      {'name': 'test262', 'shards': 2},
+      {'name': 'test262', 'variant': 'default', 'shards': 2},
       {'name': 'v8testing', 'shards': 10},
       {'name': 'v8testing', 'variant': 'extra', 'shards': 6},
       {'name': 'v8testing', 'variant': 'trusted', 'shards': 2},
@@ -1515,7 +1533,7 @@
       'priority': 35,
     },
     'tests': [
-      {'name': 'test262'},
+      {'name': 'test262', 'variant': 'default'},
       {'name': 'v8testing', 'shards': 4},
     ],
   },
@@ -1529,7 +1547,7 @@
       'priority': 35,
     },
     'tests': [
-      {'name': 'test262'},
+      {'name': 'test262', 'variant': 'default'},
       {'name': 'v8testing', 'shards': 4},
     ],
   },
@@ -1715,7 +1733,7 @@
     },
     'tests': [
       {'name': 'mozilla'},
-      {'name': 'test262'},
+      {'name': 'test262', 'variant': 'default'},
       {'name': 'v8testing'},
     ],
   },
@@ -1725,7 +1743,7 @@
     },
     'tests': [
       {'name': 'mozilla'},
-      {'name': 'test262'},
+      {'name': 'test262', 'variant': 'default'},
       {'name': 'v8testing', 'shards': 3},
     ],
   },
@@ -1735,7 +1753,7 @@
     },
     'tests': [
       {'name': 'mozilla'},
-      {'name': 'test262'},
+      {'name': 'test262', 'variant': 'default'},
       {'name': 'v8testing'},
     ],
   },
@@ -1745,7 +1763,7 @@
     },
     'tests': [
       {'name': 'mozilla'},
-      {'name': 'test262'},
+      {'name': 'test262', 'variant': 'default'},
       {'name': 'v8testing', 'shards': 3},
     ],
   },
@@ -1755,7 +1773,7 @@
     },
     'tests': [
       {'name': 'mozilla'},
-      {'name': 'test262'},
+      {'name': 'test262', 'variant': 'default'},
       {'name': 'v8testing'},
     ],
   },
@@ -1765,7 +1783,7 @@
     },
     'tests': [
       {'name': 'mozilla'},
-      {'name': 'test262'},
+      {'name': 'test262', 'variant': 'default'},
       {'name': 'v8testing', 'shards': 3},
     ],
   },
@@ -1775,7 +1793,7 @@
     },
     'tests': [
       {'name': 'mozilla'},
-      {'name': 'test262'},
+      {'name': 'test262', 'variant': 'default'},
       {'name': 'v8testing'},
     ],
   },
@@ -1785,7 +1803,7 @@
     },
     'tests': [
       {'name': 'mozilla'},
-      {'name': 'test262'},
+      {'name': 'test262', 'variant': 'default'},
       {'name': 'v8testing', 'shards': 3},
     ],
   },
@@ -1795,7 +1813,7 @@
     },
     'tests': [
       {'name': 'mozilla'},
-      {'name': 'test262'},
+      {'name': 'test262', 'variant': 'default'},
       {'name': 'v8testing', 'shards': 4},
     ],
   },
@@ -1805,7 +1823,7 @@
     },
     'tests': [
       {'name': 'mozilla'},
-      {'name': 'test262'},
+      {'name': 'test262', 'variant': 'default'},
       {'name': 'v8testing', 'shards': 8},
     ],
   },
@@ -1815,7 +1833,7 @@
     },
     'tests': [
       {'name': 'mozilla'},
-      {'name': 'test262'},
+      {'name': 'test262', 'variant': 'default'},
       {'name': 'v8testing', 'shards': 4},
     ],
   },
@@ -1825,7 +1843,7 @@
     },
     'tests': [
       {'name': 'mozilla'},
-      {'name': 'test262'},
+      {'name': 'test262', 'variant': 'default'},
       {'name': 'v8testing', 'shards': 8},
     ],
   },
diff --git a/chromium/v8/src/execution/frames.cc b/chromium/v8/src/execution/frames.cc
index 126cb9530ee..f88e4c2788c 100644
--- a/chromium/v8/src/execution/frames.cc
+++ b/chromium/v8/src/execution/frames.cc
@@ -1136,11 +1136,11 @@ void JavaScriptFrame::Summarize(std::vector<FrameSummary>* functions) const {
   DCHECK(functions->empty());
   Code code = LookupCode();
   int offset = static_cast<int>(pc() - code.InstructionStart());
-  AbstractCode abstract_code = AbstractCode::cast(code);
+  Handle<AbstractCode> abstract_code(AbstractCode::cast(code), isolate());
   Handle<FixedArray> params = GetParameters();
   FrameSummary::JavaScriptFrameSummary summary(
-      isolate(), receiver(), function(), abstract_code, offset, IsConstructor(),
-      *params);
+      isolate(), receiver(), function(), *abstract_code, offset,
+      IsConstructor(), *params);
   functions->push_back(summary);
 }
 
@@ -1813,10 +1813,11 @@ void InterpretedFrame::WriteInterpreterRegister(int register_index,
 
 void InterpretedFrame::Summarize(std::vector<FrameSummary>* functions) const {
   DCHECK(functions->empty());
-  AbstractCode abstract_code = AbstractCode::cast(GetBytecodeArray());
+  Handle<AbstractCode> abstract_code(AbstractCode::cast(GetBytecodeArray()),
+                                     isolate());
   Handle<FixedArray> params = GetParameters();
   FrameSummary::JavaScriptFrameSummary summary(
-      isolate(), receiver(), function(), abstract_code, GetBytecodeOffset(),
+      isolate(), receiver(), function(), *abstract_code, GetBytecodeOffset(),
       IsConstructor(), *params);
   functions->push_back(summary);
 }
diff --git a/chromium/v8/tools/testrunner/base_runner.py b/chromium/v8/tools/testrunner/base_runner.py
index 7f9b43435ff..9ad6d852358 100644
--- a/chromium/v8/tools/testrunner/base_runner.py
+++ b/chromium/v8/tools/testrunner/base_runner.py
@@ -162,6 +162,7 @@ MODES = {
 
 PROGRESS_INDICATORS = {
   'verbose': progress.VerboseProgressIndicator,
+  'ci': progress.CIProgressIndicator,
   'dots': progress.DotsProgressIndicator,
   'color': progress.ColorProgressIndicator,
   'mono': progress.MonochromeProgressIndicator,
@@ -352,6 +353,10 @@ class BaseTestRunner(object):
     parser.add_option("--exit-after-n-failures", type="int", default=100,
                       help="Exit after the first N failures instead of "
                            "running all tests. Pass 0 to disable this feature.")
+    parser.add_option("--ci-test-completion",
+                      help="Path to a file for logging test completion in the "
+                           "context of CI progress indicator. Ignored if "
+                           "progress indicator is other than 'ci'.")
 
     # Rerun
     parser.add_option("--rerun-failures-count", default=0, type=int,
@@ -799,6 +804,9 @@ class BaseTestRunner(object):
         self.mode_options.execution_mode))
 
     for proc in procs:
+      proc.configure(options)
+
+    for proc in procs:
       try:
         proc.set_test_count(test_count)
       except AttributeError:
diff --git a/chromium/v8/tools/testrunner/testproc/progress.py b/chromium/v8/tools/testrunner/testproc/progress.py
index aad6740c1c9..4db073c6453 100644
--- a/chromium/v8/tools/testrunner/testproc/progress.py
+++ b/chromium/v8/tools/testrunner/testproc/progress.py
@@ -56,9 +56,16 @@ class ResultsTracker(base.TestProcObserver):
 
 
 class ProgressIndicator(base.TestProcObserver):
+  def __init__(self):
+    super(base.TestProcObserver, self).__init__()
+    self.options = None
+
   def finished(self):
     pass
 
+  def configure(self, options):
+    self.options = options
+
 
 class SimpleProgressIndicator(ProgressIndicator):
   def __init__(self):
@@ -113,8 +120,7 @@ class VerboseProgressIndicator(SimpleProgressIndicator):
     sys.stdout.flush()
     self._last_printed_time = time.time()
 
-  def _on_result_for(self, test, result):
-    super(VerboseProgressIndicator, self)._on_result_for(test, result)
+  def _message(self, test, result):
     # TODO(majeski): Support for dummy/grouped results
     if result.has_unexpected_output:
       if result.output.HasCrashed():
@@ -123,9 +129,12 @@ class VerboseProgressIndicator(SimpleProgressIndicator):
         outcome = 'FAIL'
     else:
       outcome = 'pass'
+    return 'Done running %s %s: %s' % (
+      test, test.variant or 'default', outcome)
 
-    self._print('Done running %s %s: %s' % (
-      test, test.variant or 'default', outcome))
+  def _on_result_for(self, test, result):
+    super(VerboseProgressIndicator, self)._on_result_for(test, result)
+    self._print(self._message(test, result))
 
   # TODO(machenbach): Remove this platform specific hack and implement a proper
   # feedback channel from the workers, providing which tests are currently run.
@@ -150,6 +159,14 @@ class VerboseProgressIndicator(SimpleProgressIndicator):
       self._print_processes_linux()
 
 
+class CIProgressIndicator(VerboseProgressIndicator):
+  def _on_result_for(self, test, result):
+    super(VerboseProgressIndicator, self)._on_result_for(test, result)
+    if self.options.ci_test_completion:
+      with open(self.options.ci_test_completion, "a") as f:
+        f.write(self._message(test, result) + "\n")
+
+
 class DotsProgressIndicator(SimpleProgressIndicator):
   def __init__(self):
     super(DotsProgressIndicator, self).__init__()