Update Chromium to beta version 37.0.2062.68

Change-Id: I188e3b5aff1bec75566014291b654eb19f5bc8ca
Reviewed-by: Andras Becsi <andras.becsi@digia.com>

217 files changed, 4186 insertions, 2515 deletions

diff --git a/chromium/content/public/OWNERS b/chromium/content/public/OWNERS
deleted file mode 100644
index e1e8d2c89fb..00000000000
--- a/chromium/content/public/OWNERS
+++ /dev/null
@@ -1,10 +0,0 @@
-joi@chromium.org
-
-# Please include jam@ on all reviews that are adding new interfaces.
-# For other reviews (modifying existing APIs), prefer avi@ or joi@.
-
-# While the Content API is being worked on (see
-# http://dev.chromium.org/developers/content-module/content-api), we have a very
-# limited set of owners to ensure that the API is consistent. Once the
-# implementation is complete, more owners will be added. If this is holding you
-# up, IM one of the owners above.
diff --git a/chromium/content/public/android/OWNERS b/chromium/content/public/android/OWNERS
index 29d0acf8c4e..6d043f42934 100644
--- a/chromium/content/public/android/OWNERS
+++ b/chromium/content/public/android/OWNERS
@@ -1,3 +1,7 @@
+benm@chromium.org
 bulach@chromium.org
 tedchoc@chromium.org
 yfriedman@chromium.org
+
+per-file *.aidl=set noparent
+per-file *.aidl=palmer@chromium.org
diff --git a/chromium/content/public/app/BUILD.gn b/chromium/content/public/app/BUILD.gn
new file mode 100644
index 00000000000..37d2847278c
--- /dev/null
+++ b/chromium/content/public/app/BUILD.gn
@@ -0,0 +1,25 @@
+# Copyright 2014 The Chromium Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+source_set("app") {
+  sources = [
+    "android_library_loader_hooks.h",
+    "content_main.h",
+    "content_main_delegate.cc",
+    "content_main_delegate.h",
+    "content_main_runner.h",
+    "startup_helper_win.h",
+  ]
+
+  configs += [ "//content:content_implementation" ]
+
+  deps = [
+    "//base",
+    "//base:i18n",
+    "//content:export",
+    "//content/public/plugin",
+    "//content/public/renderer",
+    "//content/public/utility",
+  ]
+}
diff --git a/chromium/content/public/app/android_library_loader_hooks.h b/chromium/content/public/app/android_library_loader_hooks.h
index 2ec5a194cfd..b815f080705 100644
--- a/chromium/content/public/app/android_library_loader_hooks.h
+++ b/chromium/content/public/app/android_library_loader_hooks.h
@@ -12,25 +12,17 @@
 
 namespace content {
 
-// Registers the callbacks that allows the entry point of the library to be
-// exposed to the calling java code.  This handles only registering the content
-// specific callbacks.  Any application specific JNI bindings should happen
-// once the native library has fully loaded.
-CONTENT_EXPORT bool RegisterLibraryLoaderEntryHook(JNIEnv* env);
-
 // Register all content JNI functions now, rather than waiting for the process
-// of fully loading the native library to complete.  This must only be called
-// during JNI_OnLoad.
+// of fully loading the native library to complete.
 CONTENT_EXPORT bool EnsureJniRegistered(JNIEnv* env);
 
-// Pass the version name to Content. This used to check that the library version
-// matches the version expected by Java before completing JNI registration.
-// Note: argument must remain valid at least until library loading is complete.
-CONTENT_EXPORT void SetVersionNumber(const char* version_number);
-
-// Call on exit to delete the AtExitManager which OnLibraryLoadedOnUIThread
-// created.
-CONTENT_EXPORT void LibraryLoaderExitHook();
+// Do the intialization of content needed immediately after the native library
+// has loaded.
+// This is designed to be used as a hook function to be passed to
+// base::android::SetLibraryLoadedHook
+CONTENT_EXPORT bool LibraryLoaded(JNIEnv* env,
+                                  jclass clazz,
+                                  jobjectArray init_command_line);
 
 }  // namespace content
 
diff --git a/chromium/content/public/app/content_main.h b/chromium/content/public/app/content_main.h
index 5016edd56aa..201fca72112 100644
--- a/chromium/content/public/app/content_main.h
+++ b/chromium/content/public/app/content_main.h
@@ -5,6 +5,9 @@
 #ifndef CONTENT_PUBLIC_APP_CONTENT_MAIN_H_
 #define CONTENT_PUBLIC_APP_CONTENT_MAIN_H_
 
+#include <stddef.h>
+
+#include "base/callback_forward.h"
 #include "build/build_config.h"
 #include "content/common/content_export.h"
 
@@ -17,21 +20,40 @@ struct SandboxInterfaceInfo;
 }
 
 namespace content {
-
 class ContentMainDelegate;
 
-// ContentMain should be called from the embedder's main() function to do the
-// initial setup for every process. The embedder has a chance to customize
-// startup using the ContentMainDelegate interface. The embedder can also pass
-// in NULL for |delegate| if they don't want to override default startup.
+struct ContentMainParams {
+  explicit ContentMainParams(ContentMainDelegate* delegate)
+      : delegate(delegate),
+#if defined(OS_WIN)
+        instance(NULL),
+        sandbox_info(NULL),
+#elif !defined(OS_ANDROID)
+        argc(0),
+        argv(NULL),
+#endif
+        ui_task(NULL) {
+  }
+
+  ContentMainDelegate* delegate;
+
 #if defined(OS_WIN)
+  HINSTANCE instance;
+
+  // |sandbox_info| should be initialized using InitializeSandboxInfo from
+  // content_main_win.h
+  sandbox::SandboxInterfaceInfo* sandbox_info;
+#elif !defined(OS_ANDROID)
+  int argc;
+  const char** argv;
+#endif
 
-// |sandbox_info| should be initialized using InitializeSandboxInfo from
-// content_main_win.h
-CONTENT_EXPORT int ContentMain(HINSTANCE instance,
-                               sandbox::SandboxInterfaceInfo* sandbox_info,
-                               ContentMainDelegate* delegate);
-#elif defined(OS_ANDROID)
+  // Used by browser_tests. If non-null BrowserMain schedules this task to run
+  // on the MessageLoop. It's owned by the test code.
+  base::Closure* ui_task;
+};
+
+#if defined(OS_ANDROID)
 // In the Android, the content main starts from ContentMain.java, This function
 // provides a way to set the |delegate| as ContentMainDelegate for
 // ContentMainRunner.
@@ -39,10 +61,12 @@ CONTENT_EXPORT int ContentMain(HINSTANCE instance,
 // The ownership of |delegate| is transferred.
 CONTENT_EXPORT void SetContentMainDelegate(ContentMainDelegate* delegate);
 #else
-CONTENT_EXPORT int ContentMain(int argc,
-                               const char** argv,
-                               ContentMainDelegate* delegate);
-#endif  // defined(OS_WIN)
+// ContentMain should be called from the embedder's main() function to do the
+// initial setup for every process. The embedder has a chance to customize
+// startup using the ContentMainDelegate interface. The embedder can also pass
+// in NULL for |delegate| if they don't want to override default startup.
+CONTENT_EXPORT int ContentMain(const ContentMainParams& params);
+#endif
 
 }  // namespace content
 
diff --git a/chromium/content/public/app/content_main_delegate.cc b/chromium/content/public/app/content_main_delegate.cc
index 88ce4aa912c..433300cfd8b 100644
--- a/chromium/content/public/app/content_main_delegate.cc
+++ b/chromium/content/public/app/content_main_delegate.cc
@@ -42,8 +42,8 @@ bool ContentMainDelegate::DelaySandboxInitialization(
 
 #elif defined(OS_POSIX) && !defined(OS_ANDROID) && !defined(OS_IOS)
 
-ZygoteForkDelegate* ContentMainDelegate::ZygoteStarting() {
-  return NULL;
+void ContentMainDelegate::ZygoteStarting(
+    ScopedVector<ZygoteForkDelegate>* delegates) {
 }
 
 #endif
diff --git a/chromium/content/public/app/content_main_delegate.h b/chromium/content/public/app/content_main_delegate.h
index 9b94b98d46c..6191d7815e6 100644
--- a/chromium/content/public/app/content_main_delegate.h
+++ b/chromium/content/public/app/content_main_delegate.h
@@ -10,6 +10,9 @@
 #include "build/build_config.h"
 #include "content/common/content_export.h"
 
+template <typename>
+class ScopedVector;
+
 namespace content {
 
 class ContentBrowserClient;
@@ -65,8 +68,9 @@ class CONTENT_EXPORT ContentMainDelegate {
 
 #elif defined(OS_POSIX) && !defined(OS_ANDROID) && !defined(OS_IOS)
   // Tells the embedder that the zygote process is starting, and allows it to
-  // specify a zygote delegate if it wishes.
-  virtual ZygoteForkDelegate* ZygoteStarting();
+  // specify one or more zygote delegates if it wishes by storing them in
+  // |*delegates|.
+  virtual void ZygoteStarting(ScopedVector<ZygoteForkDelegate>* delegates);
 
   // Called every time the zygote process forks.
   virtual void ZygoteForked() {}
diff --git a/chromium/content/public/app/content_main_runner.h b/chromium/content/public/app/content_main_runner.h
index bed5ff2715c..5fec99790b5 100644
--- a/chromium/content/public/app/content_main_runner.h
+++ b/chromium/content/public/app/content_main_runner.h
@@ -5,24 +5,14 @@
 #ifndef CONTENT_PUBLIC_APP_CONTENT_MAIN_RUNNER_H_
 #define CONTENT_PUBLIC_APP_CONTENT_MAIN_RUNNER_H_
 
-#include <string>
-
 #include "build/build_config.h"
-
-#if defined(OS_WIN)
-#include <windows.h>
-#endif
-
-namespace sandbox {
-struct SandboxInterfaceInfo;
-}
+#include "content/common/content_export.h"
 
 namespace content {
-
-class ContentMainDelegate;
+struct ContentMainParams;
 
 // This class is responsible for content initialization, running and shutdown.
-class ContentMainRunner {
+class CONTENT_EXPORT ContentMainRunner {
  public:
   virtual ~ContentMainRunner() {}
 
@@ -30,19 +20,7 @@ class ContentMainRunner {
   static ContentMainRunner* Create();
 
   // Initialize all necessary content state.
-#if defined(OS_WIN)
-  // The |sandbox_info| and |delegate| objects must outlive this class.
-  // |sandbox_info| should be initialized using InitializeSandboxInfo from
-  // content_main_win.h.
-  virtual int Initialize(HINSTANCE instance,
-                         sandbox::SandboxInterfaceInfo* sandbox_info,
-                         ContentMainDelegate* delegate) = 0;
-#else
-  // The |delegate| object must outlive this class.
-  virtual int Initialize(int argc,
-                         const char** argv,
-                         ContentMainDelegate* delegate) = 0;
-#endif
+  virtual int Initialize(const ContentMainParams& params) = 0;
 
   // Perform the default run logic.
   virtual int Run() = 0;
diff --git a/chromium/content/public/app/startup_helper_win.h b/chromium/content/public/app/startup_helper_win.h
index e3a796a6c2c..6a26b20bf84 100644
--- a/chromium/content/public/app/startup_helper_win.h
+++ b/chromium/content/public/app/startup_helper_win.h
@@ -5,7 +5,9 @@
 #ifndef CONTENT_PUBLIC_APP_STARTUP_HELPER_WIN_H_
 #define CONTENT_PUBLIC_APP_STARTUP_HELPER_WIN_H_
 
+namespace base {
 class CommandLine;
+}
 
 namespace sandbox {
 struct SandboxInterfaceInfo;
@@ -28,7 +30,7 @@ void InitializeSandboxInfo(sandbox::SandboxInterfaceInfo* sandbox_info);
 void RegisterInvalidParamHandler();
 
 // Sets up the CRT's debugging macros to output to stdout.
-void SetupCRT(const CommandLine& command_line);
+void SetupCRT(const base::CommandLine& command_line);
 
 }  // namespace content
 
diff --git a/chromium/content/public/browser/BUILD.gn b/chromium/content/public/browser/BUILD.gn
new file mode 100644
index 00000000000..05cb6f19096
--- /dev/null
+++ b/chromium/content/public/browser/BUILD.gn
@@ -0,0 +1,39 @@
+# Copyright 2014 The Chromium Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+import("//content/browser/browser.gni")
+import("//build/config/ui.gni")
+
+source_set("browser") {
+  if (is_ios) {
+    # iOS doesn't get the normal file list and only takes these whitelisted
+    # files.
+    sources = [
+      "browser_main_parts.cc",
+      "content_browser_client.cc",
+      "favicon_status.cc",
+      "navigation_details.cc",
+      "notification_registrar.cc",
+      "page_navigator.cc",
+      "web_ui_controller.cc",
+    ]
+  } else {
+    sources = rebase_path(content_browser_gypi_values.public_browser_sources,
+                          ".", "//content")
+  }
+
+  if (use_aura) {
+    sources -= [ "context_factory.h" ]
+  }
+
+  configs += [ "//content:content_implementation" ]
+
+  deps = [
+    "//content/browser",
+    "//skia",
+  ]
+
+  # We expose skia headers in the public API.
+  forward_dependent_configs_from = [ "//skia" ]
+}
diff --git a/chromium/content/public/browser/android/OWNERS b/chromium/content/public/browser/android/OWNERS
index 29d0acf8c4e..1df84db9b51 100644
--- a/chromium/content/public/browser/android/OWNERS
+++ b/chromium/content/public/browser/android/OWNERS
@@ -1,3 +1,4 @@
 bulach@chromium.org
+mkosiba@chromium.org
 tedchoc@chromium.org
 yfriedman@chromium.org
diff --git a/chromium/content/public/browser/android/compositor.h b/chromium/content/public/browser/android/compositor.h
index eb0c96e6413..a8f734cf7d5 100644
--- a/chromium/content/public/browser/android/compositor.h
+++ b/chromium/content/public/browser/android/compositor.h
@@ -7,13 +7,13 @@
 
 #include "base/callback.h"
 #include "cc/resources/ui_resource_bitmap.h"
-#include "cc/resources/ui_resource_client.h"
 #include "content/common/content_export.h"
+#include "content/public/browser/android/ui_resource_provider.h"
 #include "ui/gfx/native_widget_types.h"
 #include "ui/gfx/rect.h"
 #include "ui/gfx/size.h"
 
-#include "third_party/WebKit/public/platform/WebGraphicsContext3D.h"
+class SkBitmap;
 
 namespace cc {
 class Layer;
@@ -25,6 +25,7 @@ class JavaBitmap;
 
 namespace content {
 class CompositorClient;
+class UIResourceProvider;
 
 // An interface to the browser-side compositor.
 class CONTENT_EXPORT Compositor {
@@ -61,46 +62,16 @@ class CONTENT_EXPORT Compositor {
   // Set the output surface which the compositor renders into.
   virtual void SetSurface(jobject surface) = 0;
 
-  // Attempts to composite and read back the result into the provided buffer.
-  // The buffer must be at least window width * height * 4 (RGBA) bytes large.
-  // The buffer is not modified if false is returned.
-  virtual bool CompositeAndReadback(void *pixels, const gfx::Rect& rect) = 0;
-
-  // Composite immediately. Used in single-threaded mode.
-  virtual void Composite() = 0;
-
-  // Generates a UIResource and returns a UIResourceId.  May return 0.
-  virtual cc::UIResourceId GenerateUIResource(
-      const cc::UIResourceBitmap& bitmap) = 0;
-
-  // Deletes a UIResource.
-  virtual void DeleteUIResource(cc::UIResourceId resource_id) = 0;
-
-  // Generates an OpenGL texture and returns a texture handle.  May return 0
-  // if the current context is lost.
-  virtual blink::WebGLId GenerateTexture(gfx::JavaBitmap& bitmap) = 0;
-
-  // Generates an OpenGL compressed texture and returns a texture handle.  May
-  // return 0 if the current context is lost.
-  virtual blink::WebGLId GenerateCompressedTexture(gfx::Size& size,
-                                                    int data_size,
-                                                    void* data) = 0;
-
-  // Deletes an OpenGL texture.
-  virtual void DeleteTexture(blink::WebGLId texture_id) = 0;
-
-  // Grabs a copy of |texture_id| and saves it into |bitmap|.  No scaling is
-  // done.  It is assumed that the texture size matches that of the bitmap.
-  virtual bool CopyTextureToBitmap(blink::WebGLId texture_id,
-                                   gfx::JavaBitmap& bitmap) = 0;
-
-  // Grabs a copy of |texture_id| and saves it into |bitmap|.  No scaling is
-  // done. |src_rect| allows the caller to specify which rect of |texture_id|
-  // to copy to |bitmap|.  It needs to match the size of |bitmap|.  Returns
-  // true if the |texture_id| was copied into |bitmap|, false if not.
-  virtual bool CopyTextureToBitmap(blink::WebGLId texture_id,
-                                   const gfx::Rect& src_rect,
-                                   gfx::JavaBitmap& bitmap) = 0;
+  // Tells the view tree to assume a transparent background when rendering.
+  virtual void SetHasTransparentBackground(bool flag) = 0;
+
+  // Request layout and draw. You only need to call this if you need to trigger
+  // Composite *without* having modified the layer tree.
+  virtual void SetNeedsComposite() = 0;
+
+  // Returns the UI resource provider associated with the compositor.
+  virtual UIResourceProvider& GetUIResourceProvider() = 0;
+
  protected:
   Compositor() {}
 };
diff --git a/chromium/content/public/browser/android/compositor_client.h b/chromium/content/public/browser/android/compositor_client.h
index d835de199d7..84a263e0ed6 100644
--- a/chromium/content/public/browser/android/compositor_client.h
+++ b/chromium/content/public/browser/android/compositor_client.h
@@ -11,24 +11,15 @@ namespace content {
 
 class CONTENT_EXPORT CompositorClient {
  public:
-  // Tells the client that it should schedule a composite.
-  virtual void ScheduleComposite() = 0;
+  // Gives the client a chance for layout changes before compositing.
+  virtual void Layout() {}
 
   // The compositor has completed swapping a frame.
-  virtual void OnSwapBuffersCompleted() {}
-
-  // The compositor will eventually swap a frame.
-  virtual void OnSwapBuffersPosted() {}
+  virtual void OnSwapBuffersCompleted(int pending_swap_buffers) {}
 
   // Tells the client that GL resources were lost and need to be reinitialized.
   virtual void DidLoseResources() {}
 
-  // Tells the client that UI resources were lost and need to be reinitialized.
-  virtual void DidLoseUIResources() {}
-
-  // Mark the UI Resources as being invalid for use.
-  virtual void UIResourcesAreInvalid() {}
-
  protected:
   CompositorClient() {}
   virtual ~CompositorClient() {}
diff --git a/chromium/content/public/browser/android/content_view_core.h b/chromium/content/public/browser/android/content_view_core.h
index 9adaf4c39ce..cf620c0136e 100644
--- a/chromium/content/public/browser/android/content_view_core.h
+++ b/chromium/content/public/browser/android/content_view_core.h
@@ -11,13 +11,15 @@
 #include "base/callback.h"
 #include "content/common/content_export.h"
 #include "content/public/browser/navigation_controller.h"
+#include "ui/gfx/rect.h"
+
+class SkBitmap;
 
 namespace cc {
 class Layer;
 }
 
 namespace gfx {
-class Rect;
 class Size;
 class SizeF;
 class Vector2dF;
@@ -46,14 +48,17 @@ class CONTENT_EXPORT ContentViewCore {
   virtual ui::WindowAndroid* GetWindowAndroid() const = 0;
   virtual scoped_refptr<cc::Layer> GetLayer() const = 0;
   virtual void LoadUrl(NavigationController::LoadURLParams& params) = 0;
-  virtual jint GetCurrentRenderProcessId(JNIEnv* env, jobject obj) = 0;
   virtual void ShowPastePopup(int x, int y) = 0;
-  virtual unsigned int GetScaledContentTexture(
+
+  // Request a scaled content readback. The result is passed through the
+  // callback. The boolean parameter indicates whether the readback was a
+  // success or not. The content is passed through the SkBitmap parameter.
+  virtual void GetScaledContentBitmap(
       float scale,
-      gfx::Size* out_size) = 0;
+      jobject bitmap_config,
+      gfx::Rect src_rect,
+      const base::Callback<void(bool, const SkBitmap&)>& result_callback) = 0;
   virtual float GetDpiScale() const = 0;
-  virtual void RequestContentClipping(const gfx::Rect& clipping,
-                                      const gfx::Size& content_size) = 0;
   virtual void PauseVideo() = 0;
   virtual void PauseOrResumeGeolocation(bool should_pause) = 0;
 
@@ -63,6 +68,13 @@ class CONTENT_EXPORT ContentViewCore {
       const gfx::Vector2dF& scroll_offset,
       float page_scale_factor)> UpdateFrameInfoCallback;
 
+  // Text surrounding selection.
+  virtual void RequestTextSurroundingSelection(
+      int max_length,
+      const base::Callback<void(const base::string16& content,
+                                int start_offset,
+                                int end_offset)>& callback) = 0;
+
  protected:
   virtual ~ContentViewCore() {};
 };
diff --git a/chromium/content/public/browser/android/external_video_surface_container.h b/chromium/content/public/browser/android/external_video_surface_container.h
new file mode 100644
index 00000000000..38cbe5987ba
--- /dev/null
+++ b/chromium/content/public/browser/android/external_video_surface_container.h
@@ -0,0 +1,52 @@
+// Copyright 2014 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_PUBLIC_BROWSER_ANDROID_EXTERNAL_VIDEO_SURFACE_CONTAINER_H_
+#define CONTENT_PUBLIC_BROWSER_ANDROID_EXTERNAL_VIDEO_SURFACE_CONTAINER_H_
+
+#include <jni.h>
+
+#include "base/callback.h"
+#include "content/common/content_export.h"
+
+namespace gfx {
+class RectF;
+}
+
+namespace content {
+class WebContents;
+
+// An interface used for managing the video surface for the hole punching.
+class CONTENT_EXPORT ExternalVideoSurfaceContainer {
+ public:
+  typedef base::Callback<void(int, jobject)> SurfaceCreatedCB;
+  typedef base::Callback<void(int)> SurfaceDestroyedCB;
+
+  // Called when a media player wants to request an external video surface.
+  // Whenever the surface is created and visible, |surface_created_cb| will be
+  // called.  And whenever it is destroyed or invisible, |surface_destroyed_cb|
+  // will be called.
+  virtual void RequestExternalVideoSurface(
+      int player_id,
+      const SurfaceCreatedCB& surface_created_cb,
+      const SurfaceDestroyedCB& surface_destroyed_cb) = 0;
+
+  // Called when a media player wants to release an external video surface.
+  virtual void ReleaseExternalVideoSurface(int player_id) = 0;
+
+  // Called when the position and size of the video element which uses
+  // the external video surface is changed.
+  // |rect| contains the new position and size in css pixels.
+  virtual void OnExternalVideoSurfacePositionChanged(
+      int player_id, const gfx::RectF& rect) = 0;
+
+  // Called when the page that contains the video element is scrolled or zoomed.
+  virtual void OnFrameInfoUpdated() = 0;
+
+  virtual ~ExternalVideoSurfaceContainer() {}
+};
+
+}  // namespace content
+
+#endif  // CONTENT_PUBLIC_BROWSER_ANDROID_EXTERNAL_VIDEO_SURFACE_CONTAINER_H_
diff --git a/chromium/content/public/browser/android/layer_tree_build_helper.h b/chromium/content/public/browser/android/layer_tree_build_helper.h
new file mode 100644
index 00000000000..4f23a4bed12
--- /dev/null
+++ b/chromium/content/public/browser/android/layer_tree_build_helper.h
@@ -0,0 +1,31 @@
+// Copyright 2014 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_PUBLIC_BROWSER_ANDROID_LAYER_TREE_BUILD_HELPER_H_
+#define CONTENT_PUBLIC_BROWSER_ANDROID_LAYER_TREE_BUILD_HELPER_H_
+
+#include "base/memory/ref_counted.h"
+
+namespace cc {
+class Layer;
+}
+
+namespace content {
+
+// A Helper class to build a layer tree to be composited
+// given a content root layer.
+class LayerTreeBuildHelper {
+ public:
+  LayerTreeBuildHelper() {};
+  virtual scoped_refptr<cc::Layer> GetLayerTree(
+      scoped_refptr<cc::Layer> content_root_layer) = 0;
+  virtual ~LayerTreeBuildHelper() {};
+
+ private:
+  DISALLOW_COPY_AND_ASSIGN(LayerTreeBuildHelper);
+};
+
+}
+
+#endif  // CONTENT_PUBLIC_BROWSER_ANDROID_LAYER_TREE_BUILD_HELPER_H_
diff --git a/chromium/content/public/browser/android/synchronous_compositor.h b/chromium/content/public/browser/android/synchronous_compositor.h
index c77d2a87100..62485f155f8 100644
--- a/chromium/content/public/browser/android/synchronous_compositor.h
+++ b/chromium/content/public/browser/android/synchronous_compositor.h
@@ -7,21 +7,29 @@
 
 #include "base/memory/ref_counted.h"
 #include "content/common/content_export.h"
+#include "gpu/command_buffer/service/in_process_command_buffer.h"
 #include "ui/gfx/rect.h"
 #include "ui/gfx/size.h"
 
 class SkCanvas;
 
+namespace cc {
+class CompositorFrame;
+class CompositorFrameAck;
+}
+
 namespace gfx {
-class GLSurface;
 class Transform;
 };
 
-namespace content {
+namespace gpu {
+class GLInProcessContext;
+}
 
-class WebContents;
+namespace content {
 
 class SynchronousCompositorClient;
+class WebContents;
 
 struct CONTENT_EXPORT SynchronousCompositorMemoryPolicy {
   // Memory limit for rendering and pre-rendering.
@@ -52,27 +60,42 @@ class CONTENT_EXPORT SynchronousCompositor {
   // the caller.
   virtual void SetClient(SynchronousCompositorClient* client) = 0;
 
+  static void SetGpuService(
+      scoped_refptr<gpu::InProcessCommandBuffer::Service> service);
+
+  // By default, synchronous compopsitor records the full layer, not only
+  // what is inside and around the view port. This can be used to switch
+  // between this record-full-layer behavior and normal record-around-viewport
+  // behavior.
+  static void SetRecordFullDocument(bool record_full_document);
+
   // Synchronously initialize compositor for hardware draw. Can only be called
   // while compositor is in software only mode, either after compositor is
   // first created or after ReleaseHwDraw is called. It is invalid to
-  // DemandDrawHw before this returns true. |surface| is the GLSurface that
-  // should be used to create the underlying hardware context.
-  virtual bool InitializeHwDraw(scoped_refptr<gfx::GLSurface> surface) = 0;
+  // DemandDrawHw before this returns true.
+  virtual bool InitializeHwDraw() = 0;
 
   // Reverse of InitializeHwDraw above. Can only be called while hardware draw
   // is already initialized. Brings compositor back to software only mode and
   // releases all hardware resources.
   virtual void ReleaseHwDraw() = 0;
 
+  // Get the share context of the compositor. The returned context is owned
+  // by the compositor and is only valid between InitializeHwDraw and
+  // ReleaseHwDraw.
+  virtual gpu::GLInProcessContext* GetShareContext() = 0;
+
   // "On demand" hardware draw. The content is first clipped to |damage_area|,
-  // then transformed through |transform|, and finally clipped to |view_size|
-  // and by the existing stencil buffer if any.
-  virtual bool DemandDrawHw(
+  // then transformed through |transform|, and finally clipped to |view_size|.
+  virtual scoped_ptr<cc::CompositorFrame> DemandDrawHw(
       gfx::Size surface_size,
       const gfx::Transform& transform,
       gfx::Rect viewport,
-      gfx::Rect clip,
-      bool stencil_enabled) = 0;
+      gfx::Rect clip) = 0;
+
+  // For delegated rendering, return resources from parent compositor to this.
+  // Note that all resources must be returned before ReleaseHwDraw.
+  virtual void ReturnResources(const cc::CompositorFrameAck& frame_ack) = 0;
 
   // "On demand" SW draw, into the supplied canvas (observing the transform
   // and clip set there-in).
diff --git a/chromium/content/public/browser/android/synchronous_compositor_client.h b/chromium/content/public/browser/android/synchronous_compositor_client.h
index fd57c6d49a7..2247f3d9b98 100644
--- a/chromium/content/public/browser/android/synchronous_compositor_client.h
+++ b/chromium/content/public/browser/android/synchronous_compositor_client.h
@@ -6,6 +6,7 @@
 #define CONTENT_PUBLIC_BROWSER_ANDROID_SYNCHRONOUS_COMPOSITOR_CLIENT_H_
 
 #include "base/basictypes.h"
+#include "ui/gfx/geometry/size_f.h"
 #include "ui/gfx/vector2d_f.h"
 
 namespace content {
@@ -25,13 +26,14 @@ class SynchronousCompositorClient {
   virtual void DidDestroyCompositor(SynchronousCompositor* compositor) = 0;
 
   // See LayerScrollOffsetDelegate for details.
-  virtual void SetMaxRootLayerScrollOffset(
-      gfx::Vector2dF max_scroll_offset) = 0;
-  virtual void SetTotalRootLayerScrollOffset(gfx::Vector2dF new_value) = 0;
   virtual gfx::Vector2dF GetTotalRootLayerScrollOffset() = 0;
+  virtual void UpdateRootLayerState(const gfx::Vector2dF& total_scroll_offset,
+                                    const gfx::Vector2dF& max_scroll_offset,
+                                    const gfx::SizeF& scrollable_size,
+                                    float page_scale_factor,
+                                    float min_page_scale_factor,
+                                    float max_page_scale_factor) = 0;
   virtual bool IsExternalFlingActive() const = 0;
-  virtual void SetRootLayerPageScaleFactor(float page_scale_factor) = 0;
-  virtual void SetRootLayerScrollableSize(gfx::SizeF scrollable_size) = 0;
 
   virtual void DidOverscroll(gfx::Vector2dF accumulated_overscroll,
                              gfx::Vector2dF latest_overscroll_delta,
diff --git a/chromium/content/public/browser/android/ui_resource_client_android.h b/chromium/content/public/browser/android/ui_resource_client_android.h
new file mode 100644
index 00000000000..83228bd0f56
--- /dev/null
+++ b/chromium/content/public/browser/android/ui_resource_client_android.h
@@ -0,0 +1,30 @@
+// Copyright 2014 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_PUBLIC_BROWSER_ANDROID_UI_RESOURCE_CLIENT_ANDROID_H_
+#define CONTENT_PUBLIC_BROWSER_ANDROID_UI_RESOURCE_CLIENT_ANDROID_H_
+
+#include "cc/resources/ui_resource_client.h"
+#include "content/common/content_export.h"
+
+namespace content {
+
+class UIResourceProvider;
+
+// Android's UIResourceClient has one extra callback (UIResourceIsInvalid).
+// This signal is intended for the case when the LayerTreeHost is cleared and
+// the user needs to recreate their resources.
+// TODO(powei): This interface can be removed once crbug.com/374906 has been
+// addressed.
+class CONTENT_EXPORT UIResourceClientAndroid : public cc::UIResourceClient {
+ public:
+  // This method indicates that the UI resource the user holds is no longer
+  // valid. The user should not call DeleteUIResource on any resource generated
+  // before this signal.
+  virtual void UIResourceIsInvalid() = 0;
+};
+
+}  // namespace content
+
+#endif  // CONTENT_PUBLIC_BROWSER_ANDROID_UI_RESOURCE_CLIENT_ANDROID_H_
diff --git a/chromium/content/public/browser/android/ui_resource_provider.h b/chromium/content/public/browser/android/ui_resource_provider.h
new file mode 100644
index 00000000000..38511e13436
--- /dev/null
+++ b/chromium/content/public/browser/android/ui_resource_provider.h
@@ -0,0 +1,27 @@
+// Copyright 2014 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_PUBLIC_BROWSER_ANDROID_UI_RESOURCE_PROVIDER_H_
+#define CONTENT_PUBLIC_BROWSER_ANDROID_UI_RESOURCE_PROVIDER_H_
+
+#include "cc/resources/ui_resource_client.h"
+#include "content/common/content_export.h"
+
+namespace content {
+
+class UIResourceClientAndroid;
+
+class CONTENT_EXPORT UIResourceProvider {
+ public:
+  virtual ~UIResourceProvider() {}
+
+  virtual cc::UIResourceId CreateUIResource(
+      UIResourceClientAndroid* client) = 0;
+
+  virtual void DeleteUIResource(cc::UIResourceId resource_id) = 0;
+};
+
+}  // namespace content
+
+#endif  // CONTENT_PUBLIC_BROWSER_ANDROID_UI_RESOURCE_PROVIDER_H_
diff --git a/chromium/content/public/browser/ax_event_notification_details.cc b/chromium/content/public/browser/ax_event_notification_details.cc
new file mode 100644
index 00000000000..87ff4df41ee
--- /dev/null
+++ b/chromium/content/public/browser/ax_event_notification_details.cc
@@ -0,0 +1,23 @@
+// Copyright 2014 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "content/public/browser/ax_event_notification_details.h"
+
+namespace content {
+
+AXEventNotificationDetails::AXEventNotificationDetails(
+    const std::vector<ui::AXNodeData>& nodes,
+    ui::AXEvent event_type,
+    int id,
+    int process_id,
+    int routing_id)
+    : nodes(nodes),
+      event_type(event_type),
+      id(id),
+      process_id(process_id),
+      routing_id(routing_id) {}
+
+AXEventNotificationDetails::~AXEventNotificationDetails() {}
+
+}  // namespace content
diff --git a/chromium/content/public/browser/ax_event_notification_details.h b/chromium/content/public/browser/ax_event_notification_details.h
new file mode 100644
index 00000000000..3065e59d52f
--- /dev/null
+++ b/chromium/content/public/browser/ax_event_notification_details.h
@@ -0,0 +1,37 @@
+// Copyright 2014 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_PUBLIC_BROWSER_AX_EVENT_NOTIFICATION_DETAILS_H_
+#define CONTENT_PUBLIC_BROWSER_AX_EVENT_NOTIFICATION_DETAILS_H_
+
+#include <vector>
+
+#include "content/common/content_export.h"
+#include "ui/accessibility/ax_enums.h"
+#include "ui/accessibility/ax_node_data.h"
+
+namespace content {
+
+// Use this object in conjunction with the
+// |WebContentsObserver::AccessibilityEventReceived| method.
+struct CONTENT_EXPORT AXEventNotificationDetails {
+ public:
+  AXEventNotificationDetails(const std::vector<ui::AXNodeData>& nodes,
+                             ui::AXEvent event_type,
+                             int id,
+                             int process_id,
+                             int routing_id);
+
+  ~AXEventNotificationDetails();
+
+  std::vector<ui::AXNodeData> nodes;
+  ui::AXEvent event_type;
+  int id;
+  int process_id;
+  int routing_id;
+};
+
+}  // namespace content
+
+#endif  // CONTENT_PUBLIC_BROWSER_AX_EVENT_NOTIFICATION_DETAILS_H_
diff --git a/chromium/content/public/browser/blob_handle.h b/chromium/content/public/browser/blob_handle.h
new file mode 100644
index 00000000000..e4d7a2de9f9
--- /dev/null
+++ b/chromium/content/public/browser/blob_handle.h
@@ -0,0 +1,25 @@
+// Copyright 2014 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_PUBLIC_BROWSER_BLOB_HANDLE_H_
+#define CONTENT_PUBLIC_BROWSER_BLOB_HANDLE_H_
+
+#include <string>
+
+namespace content {
+
+// A handle to Blobs that can be stored outside of content/. This class holds
+// a reference to the Blob and should be used to keep alive a Blob.
+class BlobHandle {
+ public:
+  virtual ~BlobHandle() {}
+  virtual std::string GetUUID() = 0;
+
+ protected:
+  BlobHandle() {}
+};
+
+}  // namespace content
+
+#endif  // CONTENT_PUBLIC_BROWSER_BLOB_HANDLE_H_
diff --git a/chromium/content/public/browser/browser_accessibility_state.h b/chromium/content/public/browser/browser_accessibility_state.h
index 6f8d6d2c8c1..6c91e1b7b76 100644
--- a/chromium/content/public/browser/browser_accessibility_state.h
+++ b/chromium/content/public/browser/browser_accessibility_state.h
@@ -24,9 +24,15 @@ class CONTENT_EXPORT BrowserAccessibilityState {
   // Enables accessibility for all running tabs.
   virtual void EnableAccessibility() = 0;
 
-  // Disables accessibility for all running tabs.
+  // Disables accessibility for all running tabs. (Only if accessibility is not
+  // required by a command line flag or by a platform requirement.)
   virtual void DisableAccessibility() = 0;
 
+  // Resets accessibility to the platform default for all running tabs.
+  // This is probably off, but may be on, if --force_renderer_accessibility is
+  // passed, or EditableTextOnly if this is Win7.
+  virtual void ResetAccessibilityMode() = 0;
+
   // Called when screen reader client is detected.
   virtual void OnScreenReaderDetected() = 0;
 
diff --git a/chromium/content/public/browser/browser_child_process_host.h b/chromium/content/public/browser/browser_child_process_host.h
index 7776a0d3df5..078eb860cf0 100644
--- a/chromium/content/public/browser/browser_child_process_host.h
+++ b/chromium/content/public/browser/browser_child_process_host.h
@@ -15,9 +15,8 @@
 #include "content/public/common/process_type.h"
 #include "ipc/ipc_sender.h"
 
-class CommandLine;
-
 namespace base {
+class CommandLine;
 class FilePath;
 }
 
@@ -44,13 +43,8 @@ class CONTENT_EXPORT BrowserChildProcessHost : public IPC::Sender {
   // Derived classes call this to launch the child process asynchronously.
   // Takes ownership of |cmd_line| and |delegate|.
   virtual void Launch(
-#if defined(OS_WIN)
       SandboxedProcessLauncherDelegate* delegate,
-#elif defined(OS_POSIX)
-      bool use_zygote,
-      const base::EnvironmentMap& environ,
-#endif
-      CommandLine* cmd_line) = 0;
+      base::CommandLine* cmd_line) = 0;
 
   virtual const ChildProcessData& GetData() const = 0;
 
diff --git a/chromium/content/public/browser/browser_child_process_host_delegate.h b/chromium/content/public/browser/browser_child_process_host_delegate.h
index 2efbeab7469..25ff00a4cb4 100644
--- a/chromium/content/public/browser/browser_child_process_host_delegate.h
+++ b/chromium/content/public/browser/browser_child_process_host_delegate.h
@@ -24,6 +24,10 @@ class CONTENT_EXPORT BrowserChildProcessHostDelegate : public IPC::Listener {
   // Called when the process has been started.
   virtual void OnProcessLaunched() {}
 
+  // Called if the process failed to launch.  In this case the process never
+  // started so there is no available exit code.
+  virtual void OnProcessLaunchFailed() {}
+
   // Called if the process crashed. |exit_code| is the status returned when the
   // process crashed (for posix, as returned from waitpid(), for Windows, as
   // returned from GetExitCodeProcess()).
diff --git a/chromium/content/public/browser/browser_child_process_observer.h b/chromium/content/public/browser/browser_child_process_observer.h
index 12e4355c762..41c9c9d5b08 100644
--- a/chromium/content/public/browser/browser_child_process_observer.h
+++ b/chromium/content/public/browser/browser_child_process_observer.h
@@ -11,8 +11,9 @@ namespace content {
 
 struct ChildProcessData;
 
-// An observer API implemented by classes which are interested
-// in browser child process events.
+// An observer API implemented by classes which are interested in browser child
+// process events. Note that render processes cannot be observed through this
+// interface; use RenderProcessHostObserver instead.
 class CONTENT_EXPORT BrowserChildProcessObserver {
  public:
   // Called when a child process host has connected to a child process.
diff --git a/chromium/content/public/browser/browser_context.h b/chromium/content/public/browser/browser_context.h
index d6d89501039..1c09777f42b 100644
--- a/chromium/content/public/browser/browser_context.h
+++ b/chromium/content/public/browser/browser_context.h
@@ -31,10 +31,12 @@ class SpecialStoragePolicy;
 
 namespace content {
 
+class BlobHandle;
+class BrowserPluginGuestManager;
 class DownloadManager;
 class DownloadManagerDelegate;
-class GeolocationPermissionContext;
 class IndexedDBContext;
+class PushMessagingService;
 class ResourceContext;
 class SiteInstance;
 class StoragePartition;
@@ -76,6 +78,13 @@ class CONTENT_EXPORT BrowserContext : public base::SupportsUserData {
   static content::StoragePartition* GetDefaultStoragePartition(
       BrowserContext* browser_context);
 
+  typedef base::Callback<void(scoped_ptr<BlobHandle>)> BlobCallback;
+
+  // |callback| returns a NULL scoped_ptr on failure.
+  static void CreateMemoryBackedBlob(BrowserContext* browser_context,
+                                     const char* data, size_t length,
+                                     const BlobCallback& callback);
+
   // Ensures that the corresponding ResourceContext is initialized. Normally the
   // BrowserContext initializs the corresponding getters when its objects are
   // created, but if the embedder wants to pass the ResourceContext to another
@@ -87,9 +96,6 @@ class CONTENT_EXPORT BrowserContext : public base::SupportsUserData {
   // across the next restart.
   static void SaveSessionState(BrowserContext* browser_context);
 
-  // Tells the HTML5 objects on this context to purge any uneeded memory.
-  static void PurgeMemory(BrowserContext* browser_context);
-
   virtual ~BrowserContext();
 
   // Returns the path of the directory where this context's data is stored.
@@ -125,24 +131,6 @@ class CONTENT_EXPORT BrowserContext : public base::SupportsUserData {
           const base::FilePath& partition_path,
           bool in_memory) = 0;
 
-  typedef base::Callback<void(bool)> MIDISysExPermissionCallback;
-
-  // Requests a permission to use system exclusive messages in MIDI events.
-  // |callback| will be invoked when the request is resolved.
-  virtual void RequestMIDISysExPermission(
-      int render_process_id,
-      int render_view_id,
-      int bridge_id,
-      const GURL& requesting_frame,
-      const MIDISysExPermissionCallback& callback) = 0;
-
-  // Cancels a pending MIDI permission request.
-  virtual void CancelMIDISysExPermissionRequest(
-      int render_process_id,
-      int render_view_id,
-      int bridge_id,
-      const GURL& requesting_frame) = 0;
-
   // Returns the resource context.
   virtual ResourceContext* GetResourceContext() = 0;
 
@@ -151,12 +139,16 @@ class CONTENT_EXPORT BrowserContext : public base::SupportsUserData {
   // ensuring that it outlives DownloadManager. It's valid to return NULL.
   virtual DownloadManagerDelegate* GetDownloadManagerDelegate() = 0;
 
-  // Returns the geolocation permission context for this context. It's valid to
-  // return NULL, in which case geolocation requests will always be allowed.
-  virtual GeolocationPermissionContext* GetGeolocationPermissionContext() = 0;
+  // Returns the guest manager for this context.
+  virtual BrowserPluginGuestManager* GetGuestManager() = 0;
 
   // Returns a special storage policy implementation, or NULL.
   virtual quota::SpecialStoragePolicy* GetSpecialStoragePolicy() = 0;
+
+  // Returns a push messaging service. The embedder owns the service, and is
+  // responsible for ensuring that it outlives RenderProcessHost. It's valid to
+  // return NULL.
+  virtual PushMessagingService* GetPushMessagingService() = 0;
 };
 
 }  // namespace content
diff --git a/chromium/content/public/browser/browser_main_runner.h b/chromium/content/public/browser/browser_main_runner.h
index 4340687796e..dcde509e583 100644
--- a/chromium/content/public/browser/browser_main_runner.h
+++ b/chromium/content/public/browser/browser_main_runner.h
@@ -21,7 +21,8 @@ class CONTENT_EXPORT BrowserMainRunner {
   static BrowserMainRunner* Create();
 
   // Initialize all necessary browser state. The |parameters| values will be
-  // copied.
+  // copied. Returning a non-negative value indicates that initialization
+  // failed, and the returned value is used as the exit code for the process.
   virtual int Initialize(const content::MainFunctionParams& parameters) = 0;
 
   // Perform the default run logic.
diff --git a/chromium/content/public/browser/browser_message_filter.cc b/chromium/content/public/browser/browser_message_filter.cc
index cca9d309f01..6b3432204b9 100644
--- a/chromium/content/public/browser/browser_message_filter.cc
+++ b/chromium/content/public/browser/browser_message_filter.cc
@@ -11,26 +11,28 @@
 #include "base/process/kill.h"
 #include "base/process/process_handle.h"
 #include "base/task_runner.h"
+#include "content/browser/browser_child_process_host_impl.h"
 #include "content/public/browser/user_metrics.h"
 #include "content/public/common/content_switches.h"
 #include "content/public/common/result_codes.h"
 #include "ipc/ipc_sync_message.h"
+#include "ipc/message_filter.h"
 
 using content::BrowserMessageFilter;
 
 namespace content {
 
-class BrowserMessageFilter::Internal : public IPC::ChannelProxy::MessageFilter {
+class BrowserMessageFilter::Internal : public IPC::MessageFilter {
  public:
   explicit Internal(BrowserMessageFilter* filter) : filter_(filter) {}
 
  private:
   virtual ~Internal() {}
 
-  // IPC::ChannelProxy::MessageFilter implementation:
-  virtual void OnFilterAdded(IPC::Channel* channel) OVERRIDE {
-    filter_->channel_ = channel;
-    filter_->OnFilterAdded(channel);
+  // IPC::MessageFilter implementation:
+  virtual void OnFilterAdded(IPC::Sender* sender) OVERRIDE {
+    filter_->sender_ = sender;
+    filter_->OnFilterAdded(sender);
   }
 
   virtual void OnFilterRemoved() OVERRIDE {
@@ -38,7 +40,7 @@ class BrowserMessageFilter::Internal : public IPC::ChannelProxy::MessageFilter {
   }
 
   virtual void OnChannelClosing() OVERRIDE {
-    filter_->channel_ = NULL;
+    filter_->sender_ = NULL;
     filter_->OnChannelClosing();
   }
 
@@ -76,17 +78,19 @@ class BrowserMessageFilter::Internal : public IPC::ChannelProxy::MessageFilter {
     return true;
   }
 
+  virtual bool GetSupportedMessageClasses(
+      std::vector<uint32>* supported_message_classes) const OVERRIDE {
+    supported_message_classes->assign(
+        filter_->message_classes_to_filter().begin(),
+        filter_->message_classes_to_filter().end());
+    return true;
+  }
+
   // Dispatches a message to the derived class.
   bool DispatchMessage(const IPC::Message& message) {
-    bool message_was_ok = true;
-    bool rv = filter_->OnMessageReceived(message, &message_was_ok);
+    bool rv = filter_->OnMessageReceived(message);
     DCHECK(BrowserThread::CurrentlyOn(BrowserThread::IO) || rv) <<
         "Must handle messages that were dispatched to another thread!";
-    if (!message_was_ok) {
-      content::RecordAction(UserMetricsAction("BadMessageTerminate_BMF"));
-      filter_->BadMessageReceived();
-    }
-
     return rv;
   }
 
@@ -95,12 +99,28 @@ class BrowserMessageFilter::Internal : public IPC::ChannelProxy::MessageFilter {
   DISALLOW_COPY_AND_ASSIGN(Internal);
 };
 
-BrowserMessageFilter::BrowserMessageFilter()
-    : internal_(NULL), channel_(NULL),
+BrowserMessageFilter::BrowserMessageFilter(uint32 message_class_to_filter)
+    : internal_(NULL),
+      sender_(NULL),
 #if defined(OS_WIN)
       peer_handle_(base::kNullProcessHandle),
 #endif
-      peer_pid_(base::kNullProcessId) {
+      peer_pid_(base::kNullProcessId),
+      message_classes_to_filter_(1, message_class_to_filter) {}
+
+BrowserMessageFilter::BrowserMessageFilter(
+    const uint32* message_classes_to_filter,
+    size_t num_message_classes_to_filter)
+    : internal_(NULL),
+      sender_(NULL),
+#if defined(OS_WIN)
+      peer_handle_(base::kNullProcessHandle),
+#endif
+      peer_pid_(base::kNullProcessId),
+      message_classes_to_filter_(
+          message_classes_to_filter,
+          message_classes_to_filter + num_message_classes_to_filter) {
+  DCHECK(num_message_classes_to_filter);
 }
 
 base::ProcessHandle BrowserMessageFilter::PeerHandle() {
@@ -141,8 +161,8 @@ bool BrowserMessageFilter::Send(IPC::Message* message) {
     return true;
   }
 
-  if (channel_)
-    return channel_->Send(message);
+  if (sender_)
+    return sender_->Send(message);
 
   delete message;
   return false;
@@ -180,11 +200,13 @@ bool BrowserMessageFilter::CheckCanDispatchOnUI(const IPC::Message& message,
 
 void BrowserMessageFilter::BadMessageReceived() {
   CommandLine* command_line = CommandLine::ForCurrentProcess();
+  if (command_line->HasSwitch(switches::kDisableKillAfterBadIPC))
+    return;
 
-  if (!command_line->HasSwitch(switches::kDisableKillAfterBadIPC)) {
-    base::KillProcess(PeerHandle(), content::RESULT_CODE_KILLED_BAD_MESSAGE,
-                      false);
-  }
+  BrowserChildProcessHostImpl::HistogramBadMessageTerminated(
+      PROCESS_TYPE_RENDERER);
+  base::KillProcess(PeerHandle(), content::RESULT_CODE_KILLED_BAD_MESSAGE,
+                    false);
 }
 
 BrowserMessageFilter::~BrowserMessageFilter() {
@@ -194,7 +216,7 @@ BrowserMessageFilter::~BrowserMessageFilter() {
 #endif
 }
 
-IPC::ChannelProxy::MessageFilter* BrowserMessageFilter::GetFilter() {
+IPC::MessageFilter* BrowserMessageFilter::GetFilter() {
   // We create this on demand so that if a filter is used in a unit test but
   // never attached to a channel, we don't leak Internal and this;
   DCHECK(!internal_) << "Should only be called once.";
diff --git a/chromium/content/public/browser/browser_message_filter.h b/chromium/content/public/browser/browser_message_filter.h
index ad1f0693790..81f06a90343 100644
--- a/chromium/content/public/browser/browser_message_filter.h
+++ b/chromium/content/public/browser/browser_message_filter.h
@@ -19,6 +19,10 @@ namespace base {
 class TaskRunner;
 }
 
+namespace IPC {
+class MessageFilter;
+}
+
 namespace content {
 struct BrowserMessageFilterTraits;
 
@@ -29,11 +33,13 @@ class CONTENT_EXPORT BrowserMessageFilter
           BrowserMessageFilter, BrowserMessageFilterTraits>,
       public IPC::Sender {
  public:
-  BrowserMessageFilter();
+  explicit BrowserMessageFilter(uint32 message_class_to_filter);
+  BrowserMessageFilter(const uint32* message_classes_to_filter,
+                       size_t num_message_classes_to_filter);
 
-  // These match the corresponding IPC::ChannelProxy::MessageFilter methods and
-  // are always called on the IO thread.
-  virtual void OnFilterAdded(IPC::Channel* channel) {}
+  // These match the corresponding IPC::MessageFilter methods and are always
+  // called on the IO thread.
+  virtual void OnFilterAdded(IPC::Sender* sender) {}
   virtual void OnFilterRemoved() {}
   virtual void OnChannelClosing() {}
   virtual void OnChannelConnected(int32 peer_pid) {}
@@ -69,8 +75,7 @@ class CONTENT_EXPORT BrowserMessageFilter
   // Your function will normally be called on the IO thread.  However, if your
   // OverrideXForMessage modifies the thread used to dispatch the message,
   // your function will be called on the requested thread.
-  virtual bool OnMessageReceived(const IPC::Message& message,
-                                 bool* message_was_ok) = 0;
+  virtual bool OnMessageReceived(const IPC::Message& message) = 0;
 
   // Can be called on any thread, after OnChannelConnected is called.
   base::ProcessHandle PeerHandle();
@@ -91,6 +96,10 @@ class CONTENT_EXPORT BrowserMessageFilter
   // Can be called on any thread.
   virtual void BadMessageReceived();
 
+  const std::vector<uint32>& message_classes_to_filter() const {
+    return message_classes_to_filter_;
+  }
+
  protected:
   virtual ~BrowserMessageFilter();
 
@@ -106,17 +115,19 @@ class CONTENT_EXPORT BrowserMessageFilter
   // This is private because the only classes that need access to it are made
   // friends above. This is only guaranteed to be valid on creation, after that
   // this class could outlive the filter.
-  IPC::ChannelProxy::MessageFilter* GetFilter();
+  IPC::MessageFilter* GetFilter();
 
-  // This implements IPC::ChannelProxy::MessageFilter so that we can hide that
-  // from child classes. Internal keeps a reference to this class, which is why
-  // there's a weak pointer back. This class could outlive Internal based on
-  // what the child class does in its OnDestruct method.
+  // This implements IPC::MessageFilter so that we can hide that from child
+  // classes. Internal keeps a reference to this class, which is why there's a
+  // weak pointer back. This class could outlive Internal based on what the
+  // child class does in its OnDestruct method.
   Internal* internal_;
 
-  IPC::Channel* channel_;
+  IPC::Sender* sender_;
   base::ProcessId peer_pid_;
 
+  std::vector<uint32> message_classes_to_filter_;
+
 #if defined(OS_WIN)
   base::Lock peer_handle_lock_;
   base::ProcessHandle peer_handle_;
diff --git a/chromium/content/public/browser/browser_plugin_guest_delegate.cc b/chromium/content/public/browser/browser_plugin_guest_delegate.cc
deleted file mode 100644
index 52577612aa1..00000000000
--- a/chromium/content/public/browser/browser_plugin_guest_delegate.cc
+++ /dev/null
@@ -1,34 +0,0 @@
-// Copyright 2013 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "content/public/browser/browser_plugin_guest_delegate.h"
-
-namespace content {
-
-bool BrowserPluginGuestDelegate::HandleKeyboardEvent(
-    const NativeWebKeyboardEvent& event) {
-  return false;
-}
-
-bool BrowserPluginGuestDelegate::IsDragAndDropEnabled() {
-  return false;
-}
-
-bool BrowserPluginGuestDelegate::IsOverridingUserAgent() const {
-  return false;
-}
-
-bool BrowserPluginGuestDelegate::RequestPermission(
-    BrowserPluginPermissionType permission_type,
-    const base::DictionaryValue& request_info,
-    const PermissionResponseCallback& callback,
-    bool allowed_by_default) {
-  return false;
-}
-
-GURL BrowserPluginGuestDelegate::ResolveURL(const std::string& src) {
-  return GURL(src);
-}
-
-}  // namespace content
diff --git a/chromium/content/public/browser/browser_plugin_guest_delegate.h b/chromium/content/public/browser/browser_plugin_guest_delegate.h
index c0d2ded0290..7abd7371a25 100644
--- a/chromium/content/public/browser/browser_plugin_guest_delegate.h
+++ b/chromium/content/public/browser/browser_plugin_guest_delegate.h
@@ -7,16 +7,19 @@
 
 #include "base/callback_forward.h"
 #include "base/process/kill.h"
-#include "base/strings/string16.h"
-#include "base/values.h"
 #include "content/common/content_export.h"
-#include "content/public/common/browser_plugin_permission_type.h"
-#include "ui/gfx/size.h"
-#include "url/gurl.h"
+
+namespace base {
+class DictionaryValue;
+}  // namespace base
+
+namespace gfx {
+class Size;
+}  // namespace gfx
 
 namespace content {
 
-struct NativeWebKeyboardEvent;
+class WebContents;
 
 // Objects implement this interface to get notified about changes in the guest
 // WebContents and to provide necessary functionality.
@@ -24,70 +27,34 @@ class CONTENT_EXPORT BrowserPluginGuestDelegate {
  public:
   virtual ~BrowserPluginGuestDelegate() {}
 
-  // Add a message to the console.
-  virtual void AddMessageToConsole(int32 level,
-                                   const base::string16& message,
-                                   int32 line_no,
-                                   const base::string16& source_id) {}
-
-  // Request the delegate to close this guest, and do whatever cleanup it needs
-  // to do.
-  virtual void Close() {}
+  // Notification that the embedder will begin attachment. This is called
+  // prior to resuming resource loads.
+  virtual void WillAttach(content::WebContents* embedder_web_contents,
+                          const base::DictionaryValue& extra_params) {}
 
   // Notification that the embedder has completed attachment.
   virtual void DidAttach() {}
 
-  // Informs the delegate that the guest render process is gone. |status|
-  // indicates whether the guest was killed, crashed, or was terminated
-  // gracefully.
-  virtual void GuestProcessGone(base::TerminationStatus status) {}
-
-  // Informs the delegate that the embedder has been destroyed.
-  virtual void EmbedderDestroyed() {}
-
-  virtual bool HandleKeyboardEvent(const NativeWebKeyboardEvent& event);
-
-  virtual bool IsDragAndDropEnabled();
-
-  // Returns whether the user agent for the guest is being overridden.
-  virtual bool IsOverridingUserAgent() const;
-
-  // Notification that a load in the guest resulted in abort. Note that |url|
-  // may be invalid.
-  virtual void LoadAbort(bool is_top_level,
-                         const GURL& url,
-                         const std::string& error_type) {}
-
-  // Notification that the page has made some progress loading. |progress| is a
-  // value between 0.0 (nothing loaded) and 1.0 (page loaded completely).
-  virtual void LoadProgressed(double progress) {}
-
-  // Notification that the guest is no longer hung.
-  virtual void RendererResponsive() {}
-
-  // Notification that the guest is hung.
-  virtual void RendererUnresponsive() {}
-
-  typedef base::Callback<void(bool /* allow */,
-                              const std::string& /* user_input */)>
-      PermissionResponseCallback;
-
-  // Request permission from the delegate to perform an action of the provided
-  // |permission_type|. Details of the permission request are found in
-  // |request_info|. A |callback| is provided to make the decision.
-  // Returns whether the delegate has, or will handle the permission request.
-  virtual bool RequestPermission(
-      BrowserPluginPermissionType permission_type,
-      const base::DictionaryValue& request_info,
-      const PermissionResponseCallback& callback,
-      bool allowed_by_default);
-
-  // Requests resolution of a potentially relative URL.
-  virtual GURL ResolveURL(const std::string& src);
-
   // Notifies that the content size of the guest has changed in autosize mode.
   virtual void SizeChanged(const gfx::Size& old_size,
                            const gfx::Size& new_size) {}
+
+  // Asks the delegate if the given guest can lock the pointer.
+  // Invoking the |callback| synchronously is OK.
+  virtual void RequestPointerLockPermission(
+      bool user_gesture,
+      bool last_unlocked_by_target,
+      const base::Callback<void(bool)>& callback) {}
+
+  // Requests that the delegate destroy itself along with its associated
+  // WebContents.
+  virtual void Destroy() {}
+
+  // Registers a |callback| with the delegate that the delegate would call when
+  // it is about to be destroyed.
+  typedef base::Callback<void()> DestructionCallback;
+  virtual void RegisterDestructionCallback(
+      const DestructionCallback& callback) {}
 };
 
 }  // namespace content
diff --git a/chromium/content/public/browser/browser_plugin_guest_manager.cc b/chromium/content/public/browser/browser_plugin_guest_manager.cc
new file mode 100644
index 00000000000..abb0bb06e16
--- /dev/null
+++ b/chromium/content/public/browser/browser_plugin_guest_manager.cc
@@ -0,0 +1,29 @@
+// Copyright 2014 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "content/public/browser/browser_plugin_guest_manager.h"
+
+#include "base/values.h"
+
+namespace content {
+
+content::WebContents* BrowserPluginGuestManager::CreateGuest(
+    SiteInstance* embedder_site_instance,
+    int instance_id,
+    scoped_ptr<base::DictionaryValue> extra_params) {
+  return NULL;
+}
+
+int BrowserPluginGuestManager::GetNextInstanceID() {
+  return 0;
+}
+
+bool BrowserPluginGuestManager::ForEachGuest(
+    WebContents* embedder_web_contents,
+    const GuestCallback& callback) {
+  return false;
+}
+
+}  // content
+
diff --git a/chromium/content/public/browser/browser_plugin_guest_manager.h b/chromium/content/public/browser/browser_plugin_guest_manager.h
new file mode 100644
index 00000000000..3e7dd26fb57
--- /dev/null
+++ b/chromium/content/public/browser/browser_plugin_guest_manager.h
@@ -0,0 +1,63 @@
+// Copyright 2014 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_PUBLIC_BROWSER_BROWSER_PLUGIN_GUEST_MANAGER_H_
+#define CONTENT_PUBLIC_BROWSER_BROWSER_PLUGIN_GUEST_MANAGER_H_
+
+#include <string>
+
+#include "base/callback.h"
+#include "content/common/content_export.h"
+
+class GURL;
+
+namespace base {
+class DictionaryValue;
+}  // namespace base
+
+namespace content {
+
+class SiteInstance;
+class WebContents;
+
+// A BrowserPluginGuestManager offloads guest management and routing
+// operations outside of the content layer.
+class CONTENT_EXPORT BrowserPluginGuestManager {
+ public:
+  virtual ~BrowserPluginGuestManager() {}
+
+  // Requests the allocation of a new guest WebContents.
+  virtual content::WebContents* CreateGuest(
+      content::SiteInstance* embedder_site_instance,
+      int instance_id,
+      scoped_ptr<base::DictionaryValue> extra_params);
+
+  // Return a new instance ID.
+  // TODO(fsamuel): Remove this. Once the instance ID concept is moved
+  // entirely out of content and into chrome, this API will be unnecessary.
+  virtual int GetNextInstanceID();
+
+  typedef base::Callback<void(WebContents*)> GuestByInstanceIDCallback;
+  // Requests a guest WebContents associated with the provided
+  // |guest_instance_id|. If a guest associated with the provided ID
+  // does not exist, then the |callback| will be called with a NULL
+  // WebContents. If the provided |embedder_render_process_id| does
+  // not own the requested guest, then the embedder will be killed,
+  // and the |callback| will not be called.
+  virtual void MaybeGetGuestByInstanceIDOrKill(
+      int guest_instance_id,
+      int embedder_render_process_id,
+      const GuestByInstanceIDCallback& callback) {}
+
+  // Iterates over all WebContents belonging to a given |embedder_web_contents|,
+  // calling |callback| for each. If one of the callbacks returns true, then
+  // the iteration exits early.
+  typedef base::Callback<bool(WebContents*)> GuestCallback;
+  virtual bool ForEachGuest(WebContents* embedder_web_contents,
+                            const GuestCallback& callback);
+};
+
+}  // namespace content
+
+#endif  // CONTENT_PUBLIC_BROWSER_BROWSER_PLUGIN_GUEST_MANAGER_H_
diff --git a/chromium/content/public/browser/browser_ppapi_host.h b/chromium/content/public/browser/browser_ppapi_host.h
index 45f997ea06b..81b78b69141 100644
--- a/chromium/content/public/browser/browser_ppapi_host.h
+++ b/chromium/content/public/browser/browser_ppapi_host.h
@@ -34,6 +34,17 @@ namespace content {
 // lives entirely on the I/O thread.
 class CONTENT_EXPORT BrowserPpapiHost {
  public:
+  struct OnKeepaliveInstanceStruct {
+    int render_process_id;
+    int render_frame_id;
+    GURL document_url;
+  };
+  typedef std::vector<OnKeepaliveInstanceStruct> OnKeepaliveInstanceData;
+  typedef base::Callback<
+      void (const OnKeepaliveInstanceData& instance_data,
+            const base::FilePath& profile_data_directory)>
+      OnKeepaliveCallback;
+
   // Creates a browser host and sets up an out-of-process proxy for an external
   // pepper plugin process.
   static BrowserPpapiHost* CreateExternalPluginProcess(
@@ -56,7 +67,7 @@ class CONTENT_EXPORT BrowserPpapiHost {
   // Returns true if the given PP_Instance is valid.
   virtual bool IsValidInstance(PP_Instance instance) const = 0;
 
-  // Retrieves the process/view Ids associated with the RenderView containing
+  // Retrieves the process/frame Ids associated with the RenderFrame containing
   // the given instance and returns true on success. If the instance is
   // invalid, the ids will be 0 and false will be returned.
   //
@@ -64,10 +75,10 @@ class CONTENT_EXPORT BrowserPpapiHost {
   // validated, and the resource hosts will be deleted when the resource is
   // destroyed. So it should not generally be necessary to check for errors
   // from this function except as a last-minute sanity check if you convert the
-  // IDs to a RenderView/ProcessHost on the UI thread.
-  virtual bool GetRenderViewIDsForInstance(PP_Instance instance,
-                                           int* render_process_id,
-                                           int* render_view_id) const = 0;
+  // IDs to a RenderFrame/ProcessHost on the UI thread.
+  virtual bool GetRenderFrameIDsForInstance(PP_Instance instance,
+                                            int* render_process_id,
+                                            int* render_frame_id) const = 0;
 
   // Returns the name of the plugin.
   virtual const std::string& GetPluginName() = 0;
@@ -81,6 +92,10 @@ class CONTENT_EXPORT BrowserPpapiHost {
   // Get the Document/Plugin URLs for the given PP_Instance.
   virtual GURL GetDocumentURLForInstance(PP_Instance instance) = 0;
   virtual GURL GetPluginURLForInstance(PP_Instance instance) = 0;
+
+  // Sets a callback the BrowserPpapiHost will run when the plugin messages
+  // that it is active.
+  virtual void SetOnKeepaliveCallback(const OnKeepaliveCallback& callback) = 0;
 };
 
 }  // namespace content
diff --git a/chromium/content/public/browser/browser_thread.h b/chromium/content/public/browser/browser_thread.h
index 55cb62b2235..6c83633e1f5 100644
--- a/chromium/content/public/browser/browser_thread.h
+++ b/chromium/content/public/browser/browser_thread.h
@@ -10,15 +10,12 @@
 #include "base/basictypes.h"
 #include "base/callback.h"
 #include "base/location.h"
+#include "base/logging.h"
 #include "base/message_loop/message_loop_proxy.h"
 #include "base/task_runner_util.h"
 #include "base/time/time.h"
 #include "content/common/content_export.h"
 
-#if defined(UNIT_TEST)
-#include "base/logging.h"
-#endif  // UNIT_TEST
-
 namespace base {
 class MessageLoop;
 class SequencedWorkerPool;
@@ -30,6 +27,13 @@ namespace content {
 class BrowserThreadDelegate;
 class BrowserThreadImpl;
 
+// Use DCHECK_CURRENTLY_ON(BrowserThread::ID) to assert that a function can only
+// be called on the named BrowserThread.
+#define DCHECK_CURRENTLY_ON(thread_identifier)                      \
+  (DCHECK(::content::BrowserThread::CurrentlyOn(thread_identifier)) \
+   << ::content::BrowserThread::GetDCheckCurrentlyOnErrorMessage(   \
+          thread_identifier))
+
 ///////////////////////////////////////////////////////////////////////////////
 // BrowserThread
 //
@@ -181,24 +185,24 @@ class CONTENT_EXPORT BrowserThread {
   // Returns the thread pool used for blocking file I/O. Use this object to
   // perform random blocking operations such as file writes or querying the
   // Windows registry.
-  static base::SequencedWorkerPool* GetBlockingPool();
+  static base::SequencedWorkerPool* GetBlockingPool() WARN_UNUSED_RESULT;
 
   // Callable on any thread.  Returns whether the given well-known thread is
   // initialized.
-  static bool IsThreadInitialized(ID identifier);
+  static bool IsThreadInitialized(ID identifier) WARN_UNUSED_RESULT;
 
   // Callable on any thread.  Returns whether you're currently on a particular
-  // thread.
-  static bool CurrentlyOn(ID identifier);
+  // thread.  To DCHECK this, use the DCHECK_CURRENTLY_ON() macro above.
+  static bool CurrentlyOn(ID identifier) WARN_UNUSED_RESULT;
 
   // Callable on any thread.  Returns whether the threads message loop is valid.
   // If this returns false it means the thread is in the process of shutting
   // down.
-  static bool IsMessageLoopValid(ID identifier);
+  static bool IsMessageLoopValid(ID identifier) WARN_UNUSED_RESULT;
 
   // If the current message loop is one of the known threads, returns true and
   // sets identifier to its ID.  Otherwise returns false.
-  static bool GetCurrentThreadIdentifier(ID* identifier);
+  static bool GetCurrentThreadIdentifier(ID* identifier) WARN_UNUSED_RESULT;
 
   // Callers can hold on to a refcounted MessageLoopProxy beyond the lifetime
   // of the thread.
@@ -266,6 +270,9 @@ class CONTENT_EXPORT BrowserThread {
   struct DeleteOnFileThread : public DeleteOnThread<FILE> { };
   struct DeleteOnDBThread : public DeleteOnThread<DB> { };
 
+  // Returns an appropriate error message for when DCHECK_CURRENTLY_ON() fails.
+  static std::string GetDCheckCurrentlyOnErrorMessage(ID expected);
+
  private:
   friend class BrowserThreadImpl;
 
diff --git a/chromium/content/public/browser/child_process_data.h b/chromium/content/public/browser/child_process_data.h
index 3683be9c330..395c4876b8d 100644
--- a/chromium/content/public/browser/child_process_data.h
+++ b/chromium/content/public/browser/child_process_data.h
@@ -25,7 +25,9 @@ struct ChildProcessData {
   // one run of the browser.
   int id;
 
-  // The handle to the process.
+  // The handle to the process. May have value kNullProcessHandle if no process
+  // exists - either because it hasn't been started yet or it's running in the
+  // current process.
   base::ProcessHandle handle;
 
   explicit ChildProcessData(int process_type)
diff --git a/chromium/content/public/browser/child_process_security_policy.h b/chromium/content/public/browser/child_process_security_policy.h
index 2f462b28a18..261bf58f181 100644
--- a/chromium/content/public/browser/child_process_security_policy.h
+++ b/chromium/content/public/browser/child_process_security_policy.h
@@ -51,6 +51,12 @@ class ChildProcessSecurityPolicy {
   virtual void GrantCreateReadWriteFile(int child_id,
                                         const base::FilePath& file) = 0;
 
+  // This permission grants copy-into permission for |dir|.
+  virtual void GrantCopyInto(int child_id, const base::FilePath& dir) = 0;
+
+  // This permission grants delete permission for |dir|.
+  virtual void GrantDeleteFrom(int child_id, const base::FilePath& dir) = 0;
+
   // These methods verify whether or not the child process has been granted
   // permissions perform these functions on |file|.
 
diff --git a/chromium/content/public/browser/content_browser_client.cc b/chromium/content/public/browser/content_browser_client.cc
index acb9fe849ff..e8da55e8aff 100644
--- a/chromium/content/public/browser/content_browser_client.cc
+++ b/chromium/content/public/browser/content_browser_client.cc
@@ -15,12 +15,6 @@ BrowserMainParts* ContentBrowserClient::CreateBrowserMainParts(
   return NULL;
 }
 
-WebContentsViewPort* ContentBrowserClient::OverrideCreateWebContentsView(
-    WebContents* web_contents,
-    RenderViewHostDelegateView** render_view_host_delegate_view) {
-  return NULL;
-}
-
 WebContentsViewDelegate* ContentBrowserClient::GetWebContentsViewDelegate(
     WebContents* web_contents) {
   return NULL;
@@ -38,7 +32,8 @@ bool ContentBrowserClient::ShouldUseProcessPerSite(
 
 net::URLRequestContextGetter* ContentBrowserClient::CreateRequestContext(
     BrowserContext* browser_context,
-    ProtocolHandlerMap* protocol_handlers) {
+    ProtocolHandlerMap* protocol_handlers,
+    URLRequestInterceptorScopedVector request_interceptors) {
   return NULL;
 }
 
@@ -47,7 +42,8 @@ ContentBrowserClient::CreateRequestContextForStoragePartition(
     BrowserContext* browser_context,
     const base::FilePath& partition_path,
     bool in_memory,
-    ProtocolHandlerMap* protocol_handlers) {
+    ProtocolHandlerMap* protocol_handlers,
+    URLRequestInterceptorScopedVector request_interceptors) {
   return NULL;
 }
 
@@ -70,6 +66,10 @@ bool ContentBrowserClient::IsSuitableHost(RenderProcessHost* process_host,
   return true;
 }
 
+bool ContentBrowserClient::MayReuseHost(RenderProcessHost* process_host) {
+  return true;
+}
+
 bool ContentBrowserClient::ShouldTryToUseExistingProcessHost(
       BrowserContext* browser_context, const GURL& url) {
   return false;
@@ -105,7 +105,7 @@ std::string ContentBrowserClient::GetAcceptLangs(BrowserContext* context) {
   return std::string();
 }
 
-gfx::ImageSkia* ContentBrowserClient::GetDefaultFavicon() {
+const gfx::ImageSkia* ContentBrowserClient::GetDefaultFavicon() {
   static gfx::ImageSkia* empty = new gfx::ImageSkia();
   return empty;
 }
@@ -121,7 +121,7 @@ bool ContentBrowserClient::AllowGetCookie(const GURL& url,
                                           const net::CookieList& cookie_list,
                                           ResourceContext* context,
                                           int render_process_id,
-                                          int render_view_id) {
+                                          int render_frame_id) {
   return true;
 }
 
@@ -130,7 +130,7 @@ bool ContentBrowserClient::AllowSetCookie(const GURL& url,
                                           const std::string& cookie_line,
                                           ResourceContext* context,
                                           int render_process_id,
-                                          int render_view_id,
+                                          int render_frame_id,
                                           net::CookieOptions* options) {
   return true;
 }
@@ -145,14 +145,14 @@ bool ContentBrowserClient::AllowWorkerDatabase(
     const base::string16& display_name,
     unsigned long estimated_size,
     ResourceContext* context,
-    const std::vector<std::pair<int, int> >& render_views) {
+    const std::vector<std::pair<int, int> >& render_frames) {
   return true;
 }
 
 bool ContentBrowserClient::AllowWorkerFileSystem(
     const GURL& url,
     ResourceContext* context,
-    const std::vector<std::pair<int, int> >& render_views) {
+    const std::vector<std::pair<int, int> >& render_frames) {
   return true;
 }
 
@@ -160,7 +160,7 @@ bool ContentBrowserClient::AllowWorkerIndexedDB(
     const GURL& url,
     const base::string16& name,
     ResourceContext* context,
-    const std::vector<std::pair<int, int> >& render_views) {
+    const std::vector<std::pair<int, int> >& render_frames) {
   return true;
 }
 
@@ -211,20 +211,47 @@ blink::WebNotificationPresenter::Permission
   return blink::WebNotificationPresenter::PermissionAllowed;
 }
 
+void ContentBrowserClient::RequestGeolocationPermission(
+    WebContents* web_contents,
+    int bridge_id,
+    const GURL& requesting_frame,
+    bool user_gesture,
+    base::Callback<void(bool)> result_callback,
+    base::Closure* cancel_callback) {
+  result_callback.Run(true);
+}
+
+void ContentBrowserClient::RequestMidiSysExPermission(
+    WebContents* web_contents,
+    int bridge_id,
+    const GURL& requesting_frame,
+    bool user_gesture,
+    base::Callback<void(bool)> result_callback,
+    base::Closure* cancel_callback) {
+  result_callback.Run(true);
+}
+
+void ContentBrowserClient::RequestProtectedMediaIdentifierPermission(
+    WebContents* web_contents,
+    const GURL& origin,
+    base::Callback<void(bool)> result_callback,
+    base::Closure* cancel_callback) {
+  result_callback.Run(true);
+}
+
 bool ContentBrowserClient::CanCreateWindow(
     const GURL& opener_url,
     const GURL& opener_top_level_frame_url,
     const GURL& source_origin,
     WindowContainerType container_type,
     const GURL& target_url,
-    const content::Referrer& referrer,
+    const Referrer& referrer,
     WindowOpenDisposition disposition,
     const blink::WebWindowFeatures& features,
     bool user_gesture,
     bool opener_suppressed,
-    content::ResourceContext* context,
+    ResourceContext* context,
     int render_process_id,
-    bool is_guest,
     int opener_id,
     bool* no_javascript_access) {
   *no_javascript_access = false;
@@ -266,11 +293,6 @@ BrowserPpapiHost*
   return NULL;
 }
 
-bool ContentBrowserClient::SupportsBrowserPlugin(
-    BrowserContext* browser_context, const GURL& site_url) {
-  return false;
-}
-
 bool ContentBrowserClient::AllowPepperSocketAPI(
     BrowserContext* browser_context,
     const GURL& url,
@@ -292,20 +314,39 @@ VibrationProvider* ContentBrowserClient::OverrideVibrationProvider() {
   return NULL;
 }
 
-#if defined(OS_WIN)
-const wchar_t* ContentBrowserClient::GetResourceDllName() {
+DevToolsManagerDelegate* ContentBrowserClient::GetDevToolsManagerDelegate() {
   return NULL;
 }
-#endif
 
 bool ContentBrowserClient::IsPluginAllowedToCallRequestOSFileHandle(
-    content::BrowserContext* browser_context,
+    BrowserContext* browser_context,
     const GURL& url) {
   return false;
 }
 
-bool ContentBrowserClient::IsPluginAllowedToUseDevChannelAPIs() {
+bool ContentBrowserClient::IsPluginAllowedToUseDevChannelAPIs(
+    BrowserContext* browser_context,
+    const GURL& url) {
   return false;
 }
 
+net::CookieStore* ContentBrowserClient::OverrideCookieStoreForRenderProcess(
+    int render_process_id) {
+  return NULL;
+}
+
+#if defined(OS_WIN)
+const wchar_t* ContentBrowserClient::GetResourceDllName() {
+  return NULL;
+}
+#endif
+
+#if defined(VIDEO_HOLE)
+ExternalVideoSurfaceContainer*
+ContentBrowserClient::OverrideCreateExternalVideoSurfaceContainer(
+    WebContents* web_contents) {
+  return NULL;
+}
+#endif
+
 }  // namespace content
diff --git a/chromium/content/public/browser/content_browser_client.h b/chromium/content/public/browser/content_browser_client.h
index 8633105ed1a..d355596d8f7 100644
--- a/chromium/content/public/browser/content_browser_client.h
+++ b/chromium/content/public/browser/content_browser_client.h
@@ -16,40 +16,46 @@
 #include "base/memory/scoped_vector.h"
 #include "base/values.h"
 #include "content/public/browser/certificate_request_result_type.h"
-#include "content/public/browser/file_descriptor_info.h"
 #include "content/public/common/content_client.h"
 #include "content/public/common/socket_permission_request.h"
 #include "content/public/common/window_container_type.h"
 #include "net/base/mime_util.h"
 #include "net/cookies/canonical_cookie.h"
+#include "net/url_request/url_request_interceptor.h"
 #include "net/url_request/url_request_job_factory.h"
 #include "third_party/WebKit/public/web/WebNotificationPresenter.h"
 #include "ui/base/window_open_disposition.h"
+#include "webkit/browser/fileapi/file_system_context.h"
 #include "webkit/common/resource_type.h"
 
 #if defined(OS_POSIX) && !defined(OS_MACOSX)
 #include "base/posix/global_descriptors.h"
 #endif
 
-class CommandLine;
+#if defined(OS_POSIX)
+#include "content/public/browser/file_descriptor_info.h"
+#endif
+
 class GURL;
 struct WebPreferences;
 
-namespace blink {
-struct WebWindowFeatures;
-}
-
 namespace base {
+class CommandLine;
 class DictionaryValue;
 class FilePath;
 }
 
+namespace blink {
+struct WebWindowFeatures;
+}
+
 namespace gfx {
 class ImageSkia;
 }
 
 namespace net {
 class CookieOptions;
+class CookieStore;
 class HttpNetworkSession;
 class NetLog;
 class SSLCertRequestInfo;
@@ -82,19 +88,21 @@ class BrowserMainParts;
 class BrowserPluginGuestDelegate;
 class BrowserPpapiHost;
 class BrowserURLHandler;
+class DesktopNotificationDelegate;
+class DevToolsManagerDelegate;
+class ExternalVideoSurfaceContainer;
 class LocationProvider;
 class MediaObserver;
 class QuotaPermissionContext;
+class RenderFrameHost;
 class RenderProcessHost;
 class RenderViewHost;
-class RenderViewHostDelegateView;
 class ResourceContext;
 class SiteInstance;
 class SpeechRecognitionManagerDelegate;
 class VibrationProvider;
 class WebContents;
 class WebContentsViewDelegate;
-class WebContentsViewPort;
 struct MainFunctionParams;
 struct Referrer;
 struct ShowDesktopNotificationHostMsgParams;
@@ -105,6 +113,10 @@ typedef std::map<
   std::string, linked_ptr<net::URLRequestJobFactory::ProtocolHandler> >
     ProtocolHandlerMap;
 
+// A scoped vector of protocol interceptors.
+typedef ScopedVector<net::URLRequestInterceptor>
+    URLRequestInterceptorScopedVector;
+
 // Embedder API (or SPI) for participating in browser logic, to be implemented
 // by the client of the content browser. See ChromeContentBrowserClient for the
 // principal implementation. The methods are assumed to be called on the UI
@@ -123,14 +135,6 @@ class CONTENT_EXPORT ContentBrowserClient {
   virtual BrowserMainParts* CreateBrowserMainParts(
       const MainFunctionParams& parameters);
 
-  // Allows an embedder to return their own WebContentsViewPort implementation.
-  // Return NULL to let the default one for the platform be created. Otherwise
-  // |render_view_host_delegate_view| also needs to be provided, and it is
-  // owned by the embedder.
-  virtual WebContentsViewPort* OverrideCreateWebContentsView(
-      WebContents* web_contents,
-      RenderViewHostDelegateView** render_view_host_delegate_view);
-
   // If content creates the WebContentsView implementation, it will ask the
   // embedder to return an (optional) delegate to customize it. The view will
   // own the delegate.
@@ -148,26 +152,17 @@ class CONTENT_EXPORT ContentBrowserClient {
   // the delegate in the content embedder that will service the guest in the
   // content layer. The content layer takes ownership of the |guest_delegate|.
   virtual void GuestWebContentsCreated(
+      int guest_instance_id,
       SiteInstance* guest_site_instance,
       WebContents* guest_web_contents,
       WebContents* opener_web_contents,
       BrowserPluginGuestDelegate** guest_delegate,
       scoped_ptr<base::DictionaryValue> extra_params) {}
 
-  // Notifies that a guest WebContents has been attached to a BrowserPlugin.
-  // A guest is attached to a BrowserPlugin when the guest has acquired an
-  // embedder WebContents. This happens on initial navigation or when a new
-  // window is attached to a BrowserPlugin. |extra_params| are params sent
-  // from javascript.
-  virtual void GuestWebContentsAttached(
-      WebContents* guest_web_contents,
-      WebContents* embedder_web_contents,
-      const base::DictionaryValue& extra_params) {}
-
-  // Notifies that a RenderProcessHost has been created. This is called before
+  // Notifies that a render process will be created. This is called before
   // the content layer adds its own BrowserMessageFilters, so that the
   // embedder's IPC filters have priority.
-  virtual void RenderProcessHostCreated(RenderProcessHost* host) {}
+  virtual void RenderProcessWillLaunch(RenderProcessHost* host) {}
 
   // Notifies that a BrowserChildProcessHost has been created.
   virtual void BrowserChildProcessHostCreated(BrowserChildProcessHost* host) {}
@@ -185,16 +180,23 @@ class CONTENT_EXPORT ContentBrowserClient {
   // Returns a list additional WebUI schemes, if any.  These additional schemes
   // act as aliases to the chrome: scheme.  The additional schemes may or may
   // not serve specific WebUI pages depending on the particular URLDataSource
-  // and its override of URLDataSource::ShouldServiceRequest.
+  // and its override of URLDataSource::ShouldServiceRequest. For all schemes
+  // returned here, view-source is allowed.
   virtual void GetAdditionalWebUISchemes(
       std::vector<std::string>* additional_schemes) {}
 
+  // Returns a list of webUI hosts to ignore the storage partition check in
+  // URLRequestChromeJob::CheckStoragePartitionMatches.
+  virtual void GetAdditionalWebUIHostsToIgnoreParititionCheck(
+      std::vector<std::string>* hosts) {}
+
   // Creates the main net::URLRequestContextGetter. Should only be called once
   // per ContentBrowserClient object.
   // TODO(ajwong): Remove once http://crbug.com/159193 is resolved.
   virtual net::URLRequestContextGetter* CreateRequestContext(
       BrowserContext* browser_context,
-      ProtocolHandlerMap* protocol_handlers);
+      ProtocolHandlerMap* protocol_handlers,
+      URLRequestInterceptorScopedVector request_interceptors);
 
   // Creates the net::URLRequestContextGetter for a StoragePartition. Should
   // only be called once per partition_path per ContentBrowserClient object.
@@ -203,7 +205,8 @@ class CONTENT_EXPORT ContentBrowserClient {
       BrowserContext* browser_context,
       const base::FilePath& partition_path,
       bool in_memory,
-      ProtocolHandlerMap* protocol_handlers);
+      ProtocolHandlerMap* protocol_handlers,
+      URLRequestInterceptorScopedVector request_interceptors);
 
   // Returns whether a specified URL is handled by the embedder's internal
   // protocol handlers.
@@ -224,6 +227,10 @@ class CONTENT_EXPORT ContentBrowserClient {
   virtual bool IsSuitableHost(RenderProcessHost* process_host,
                               const GURL& site_url);
 
+  // Returns whether a new view for a new site instance can be added to a
+  // given |process_host|.
+  virtual bool MayReuseHost(RenderProcessHost* process_host);
+
   // Returns whether a new process should be created or an existing one should
   // be reused based on the URL we want to load. This should return false,
   // unless there is a good reason otherwise.
@@ -236,6 +243,14 @@ class CONTENT_EXPORT ContentBrowserClient {
   // Called from a site instance's destructor.
   virtual void SiteInstanceDeleting(SiteInstance* site_instance) {}
 
+  // Called when a worker process is created.
+  virtual void WorkerProcessCreated(SiteInstance* site_instance,
+                                    int worker_process_id) {}
+
+  // Called when a worker process is terminated.
+  virtual void WorkerProcessTerminated(SiteInstance* site_instance,
+                                       int worker_process_id) {}
+
   // Returns true if for the navigation from |current_url| to |new_url|
   // in |site_instance|, a new SiteInstance and BrowsingInstance should be
   // created (even if we are in a process model that doesn't usually swap.)
@@ -263,7 +278,7 @@ class CONTENT_EXPORT ContentBrowserClient {
 
   // Allows the embedder to pass extra command line flags.
   // switches::kProcessType will already be set at this point.
-  virtual void AppendExtraCommandLineSwitches(CommandLine* command_line,
+  virtual void AppendExtraCommandLineSwitches(base::CommandLine* command_line,
                                               int child_process_id) {}
 
   // Returns the locale used by the application.
@@ -275,7 +290,7 @@ class CONTENT_EXPORT ContentBrowserClient {
   virtual std::string GetAcceptLangs(BrowserContext* context);
 
   // Returns the default favicon.  The callee doesn't own the given bitmap.
-  virtual gfx::ImageSkia* GetDefaultFavicon();
+  virtual const gfx::ImageSkia* GetDefaultFavicon();
 
   // Allow the embedder to control if an AppCache can be used for the given url.
   // This is called on the IO thread.
@@ -290,7 +305,7 @@ class CONTENT_EXPORT ContentBrowserClient {
                               const net::CookieList& cookie_list,
                               ResourceContext* context,
                               int render_process_id,
-                              int render_view_id);
+                              int render_frame_id);
 
   // Allow the embedder to control if the given cookie can be set.
   // This is called on the IO thread.
@@ -299,15 +314,15 @@ class CONTENT_EXPORT ContentBrowserClient {
                               const std::string& cookie_line,
                               ResourceContext* context,
                               int render_process_id,
-                              int render_view_id,
+                              int render_frame_id,
                               net::CookieOptions* options);
 
   // This is called on the IO thread.
   virtual bool AllowSaveLocalState(ResourceContext* context);
 
   // Allow the embedder to control if access to web database by a shared worker
-  // is allowed. |render_views| is a vector of pairs of
-  // RenderProcessID/RenderViewID of RenderViews that are using this worker.
+  // is allowed. |render_frame| is a vector of pairs of
+  // RenderProcessID/RenderFrameID of RenderFrame that are using this worker.
   // This is called on the IO thread.
   virtual bool AllowWorkerDatabase(
       const GURL& url,
@@ -315,7 +330,7 @@ class CONTENT_EXPORT ContentBrowserClient {
       const base::string16& display_name,
       unsigned long estimated_size,
       ResourceContext* context,
-      const std::vector<std::pair<int, int> >& render_views);
+      const std::vector<std::pair<int, int> >& render_frames);
 
   // Allow the embedder to control if access to file system by a shared worker
   // is allowed.
@@ -323,7 +338,7 @@ class CONTENT_EXPORT ContentBrowserClient {
   virtual bool AllowWorkerFileSystem(
       const GURL& url,
       ResourceContext* context,
-      const std::vector<std::pair<int, int> >& render_views);
+      const std::vector<std::pair<int, int> >& render_frames);
 
   // Allow the embedder to control if access to IndexedDB by a shared worker
   // is allowed.
@@ -332,7 +347,7 @@ class CONTENT_EXPORT ContentBrowserClient {
       const GURL& url,
       const base::string16& name,
       ResourceContext* context,
-      const std::vector<std::pair<int, int> >& render_views);
+      const std::vector<std::pair<int, int> >& render_frames);
 
   // Allow the embedder to override the request context based on the URL for
   // certain operations, like cookie access. Returns NULL to indicate the
@@ -344,7 +359,7 @@ class CONTENT_EXPORT ContentBrowserClient {
   // Allow the embedder to specify a string version of the storage partition
   // config with a site.
   virtual std::string GetStoragePartitionIdForSite(
-      content::BrowserContext* browser_context,
+      BrowserContext* browser_context,
       const GURL& site);
 
   // Allows the embedder to provide a validation check for |partition_id|s.
@@ -369,7 +384,7 @@ class CONTENT_EXPORT ContentBrowserClient {
   // |in_memory| values. When a partition is not to be persisted, the
   // |in_memory| value must be set to true.
   virtual void GetStoragePartitionConfigForSite(
-      content::BrowserContext* browser_context,
+      BrowserContext* browser_context,
       const GURL& site,
       bool can_be_default,
       std::string* partition_domain,
@@ -387,7 +402,7 @@ class CONTENT_EXPORT ContentBrowserClient {
   // or denied immediately, and the callback won't be run.
   virtual void AllowCertificateError(
       int render_process_id,
-      int render_view_id,
+      int render_frame_id,
       int cert_error,
       const net::SSLInfo& ssl_info,
       const GURL& request_url,
@@ -401,7 +416,7 @@ class CONTENT_EXPORT ContentBrowserClient {
   // certificate was selected NULL is returned to the |callback|.
   virtual void SelectClientCertificate(
       int render_process_id,
-      int render_view_id,
+      int render_frame_id,
       const net::HttpNetworkSession* network_session,
       net::SSLCertRequestInfo* cert_request_info,
       const base::Callback<void(net::X509Certificate*)>& callback) {}
@@ -409,25 +424,23 @@ class CONTENT_EXPORT ContentBrowserClient {
   // Adds a new installable certificate or private key.
   // Typically used to install an X.509 user certificate.
   // Note that it's up to the embedder to verify that the data is
-  // well-formed. |cert_data| will be NULL if file_size is 0.
-  virtual void AddCertificate(
-      net::URLRequest* request,
-      net::CertificateMimeType cert_type,
-      const void* cert_data,
-      size_t cert_size,
-      int render_process_id,
-      int render_view_id) {}
+  // well-formed. |cert_data| will be NULL if |cert_size| is 0.
+  virtual void AddCertificate(net::CertificateMimeType cert_type,
+                              const void* cert_data,
+                              size_t cert_size,
+                              int render_process_id,
+                              int render_frame_id) {}
 
   // Returns a class to get notifications about media event. The embedder can
   // return NULL if they're not interested.
   virtual MediaObserver* GetMediaObserver();
 
-  // Asks permission to show desktop notifications.
+  // Asks permission to show desktop notifications. |callback| needs to be run
+  // when the user approves the request.
   virtual void RequestDesktopNotificationPermission(
       const GURL& source_origin,
-      int callback_context,
-      int render_process_id,
-      int render_view_id) {}
+      RenderFrameHost* render_frame_host,
+      const base::Closure& callback) {}
 
   // Checks if the given page has permission to show desktop notifications.
   // This is called on the IO thread.
@@ -437,19 +450,46 @@ class CONTENT_EXPORT ContentBrowserClient {
           ResourceContext* context,
           int render_process_id);
 
-  // Show a desktop notification.  If |worker| is true, the request came from an
-  // HTML5 web worker, otherwise, it came from a renderer.
+  // Show a desktop notification. If |cancel_callback| is non-null, it's set to
+  // a callback which can be used to cancel the notification.
   virtual void ShowDesktopNotification(
       const ShowDesktopNotificationHostMsgParams& params,
-      int render_process_id,
-      int render_view_id,
-      bool worker) {}
-
-  // Cancels a displayed desktop notification.
-  virtual void CancelDesktopNotification(
-      int render_process_id,
-      int render_view_id,
-      int notification_id) {}
+      RenderFrameHost* render_frame_host,
+      DesktopNotificationDelegate* delegate,
+      base::Closure* cancel_callback) {}
+
+  // The renderer is requesting permission to use Geolocation. When the answer
+  // to a permission request has been determined, |result_callback| should be
+  // called with the result. If |cancel_callback| is non-null, it's set to a
+  // callback which can be used to cancel the permission request.
+  virtual void RequestGeolocationPermission(
+      WebContents* web_contents,
+      int bridge_id,
+      const GURL& requesting_frame,
+      bool user_gesture,
+      base::Callback<void(bool)> result_callback,
+      base::Closure* cancel_callback);
+
+  // Requests a permission to use system exclusive messages in MIDI events.
+  // |result_callback| will be invoked when the request is resolved. If
+  // |cancel_callback| is non-null, it's set to a callback which can be used to
+  // cancel the permission request.
+  virtual void RequestMidiSysExPermission(
+      WebContents* web_contents,
+      int bridge_id,
+      const GURL& requesting_frame,
+      bool user_gesture,
+      base::Callback<void(bool)> result_callback,
+      base::Closure* cancel_callback);
+
+  // Request permission to access protected media identifier. |result_callback
+  // will tell whether it's permitted. If |cancel_callback| is non-null, it's
+  // set to a callback which can be used to cancel the permission request.
+  virtual void RequestProtectedMediaIdentifierPermission(
+      WebContents* web_contents,
+      const GURL& origin,
+      base::Callback<void(bool)> result_callback,
+      base::Closure* cancel_callback);
 
   // Returns true if the given page is allowed to open a window of the given
   // type. If true is returned, |no_javascript_access| will indicate whether
@@ -460,14 +500,13 @@ class CONTENT_EXPORT ContentBrowserClient {
                                const GURL& source_origin,
                                WindowContainerType container_type,
                                const GURL& target_url,
-                               const content::Referrer& referrer,
+                               const Referrer& referrer,
                                WindowOpenDisposition disposition,
                                const blink::WebWindowFeatures& features,
                                bool user_gesture,
                                bool opener_suppressed,
-                               content::ResourceContext* context,
+                               ResourceContext* context,
                                int render_process_id,
-                               bool is_guest,
                                int opener_id,
                                bool* no_javascript_access);
 
@@ -531,14 +570,9 @@ class CONTENT_EXPORT ContentBrowserClient {
   virtual void DidCreatePpapiPlugin(BrowserPpapiHost* browser_host) {}
 
   // Gets the host for an external out-of-process plugin.
-  virtual content::BrowserPpapiHost* GetExternalBrowserPpapiHost(
+  virtual BrowserPpapiHost* GetExternalBrowserPpapiHost(
       int plugin_child_id);
 
-  // Returns true if the given browser_context and site_url support hosting
-  // BrowserPlugins.
-  virtual bool SupportsBrowserPlugin(BrowserContext* browser_context,
-                                     const GURL& site_url);
-
   // Returns true if the socket operation specified by |params| is allowed from
   // the given |browser_context| and |url|. If |params| is NULL, this method
   // checks the basic "socket" permission, which is for those operations that
@@ -559,6 +593,10 @@ class CONTENT_EXPORT ContentBrowserClient {
   virtual void GetAdditionalAllowedSchemesForFileSystem(
       std::vector<std::string>* additional_schemes) {}
 
+  // Returns auto mount handlers for URL requests for FileSystem APIs.
+  virtual void GetURLRequestAutoMountHandlers(
+      std::vector<fileapi::URLRequestAutoMountHandler>* handlers) {}
+
   // Returns additional file system backends for FileSystem API.
   // |browser_context| is needed in the additional FileSystemBackends.
   // It has mount points to create objects returned by additional
@@ -582,11 +620,32 @@ class CONTENT_EXPORT ContentBrowserClient {
   // information.
   virtual VibrationProvider* OverrideVibrationProvider();
 
+  // Creates a new DevToolsManagerDelegate. The caller owns the returned value.
+  // It's valid to return NULL.
+  virtual DevToolsManagerDelegate* GetDevToolsManagerDelegate();
+
+  // Returns true if plugin referred to by the url can use
+  // pp::FileIO::RequestOSFileHandle.
+  virtual bool IsPluginAllowedToCallRequestOSFileHandle(
+      BrowserContext* browser_context,
+      const GURL& url);
+
+  // Returns true if dev channel APIs are available for plugins.
+  virtual bool IsPluginAllowedToUseDevChannelAPIs(
+      BrowserContext* browser_context,
+      const GURL& url);
+
+  // Returns a special cookie store to use for a given render process, or NULL
+  // if the default cookie store should be used
+  // This is called on the IO thread.
+  virtual net::CookieStore* OverrideCookieStoreForRenderProcess(
+      int render_process_id);
+
 #if defined(OS_POSIX) && !defined(OS_MACOSX)
   // Populates |mappings| with all files that need to be mapped before launching
   // a child process.
   virtual void GetAdditionalMappedFilesForChildProcess(
-      const CommandLine& command_line,
+      const base::CommandLine& command_line,
       int child_process_id,
       std::vector<FileDescriptorInfo>* mappings) {}
 #endif
@@ -602,14 +661,12 @@ class CONTENT_EXPORT ContentBrowserClient {
                                 bool* success) {}
 #endif
 
-  // Returns true if plugin referred to by the url can use
-  // pp::FileIO::RequestOSFileHandle.
-  virtual bool IsPluginAllowedToCallRequestOSFileHandle(
-      content::BrowserContext* browser_context,
-      const GURL& url);
-
-  // Returns true if dev channel APIs are available for plugins.
-  virtual bool IsPluginAllowedToUseDevChannelAPIs();
+#if defined(VIDEO_HOLE)
+  // Allows an embedder to provide its own ExternalVideoSurfaceContainer
+  // implementation.  Return NULL to disable external surface video.
+  virtual ExternalVideoSurfaceContainer*
+  OverrideCreateExternalVideoSurfaceContainer(WebContents* web_contents);
+#endif
 };
 
 }  // namespace content
diff --git a/chromium/content/public/browser/context_factory.h b/chromium/content/public/browser/context_factory.h
new file mode 100644
index 00000000000..07f2462279b
--- /dev/null
+++ b/chromium/content/public/browser/context_factory.h
@@ -0,0 +1,22 @@
+// Copyright 2014 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_PUBLIC_BROWSER_CONTEXT_FACTORY_H_
+#define CONTENT_PUBLIC_BROWSER_CONTEXT_FACTORY_H_
+
+#include "content/common/content_export.h"
+
+namespace ui {
+class ContextFactory;
+}
+
+namespace content {
+
+// Returns the singleton ContextFactory used by content. The return value is
+// owned by content.
+CONTENT_EXPORT ui::ContextFactory* GetContextFactory();
+
+}  // namespace content
+
+#endif  // CONTENT_PUBLIC_BROWSER_CONTEXT_FACTORY_H_
diff --git a/chromium/content/public/browser/cookie_store_factory.h b/chromium/content/public/browser/cookie_store_factory.h
index 300178ed85c..ec2243fcb10 100644
--- a/chromium/content/public/browser/cookie_store_factory.h
+++ b/chromium/content/public/browser/cookie_store_factory.h
@@ -5,11 +5,17 @@
 #ifndef CONTENT_PUBLIC_BROWSER_COOKIE_STORE_FACTORY_H_
 #define CONTENT_PUBLIC_BROWSER_COOKIE_STORE_FACTORY_H_
 
+#include "base/files/file_path.h"
+#include "base/memory/ref_counted.h"
 #include "content/common/content_export.h"
-#include "net/cookies/cookie_monster.h"
 
 namespace base {
-class FilePath;
+class SequencedTaskRunner;
+}
+
+namespace net {
+class CookieMonsterDelegate;
+class CookieStore;
 }
 
 namespace quota {
@@ -19,24 +25,72 @@ class SpecialStoragePolicy;
 namespace content {
 class CookieCryptoDelegate;
 
-// All blocking database accesses will be performed on |background_task_runner|.
-// Callbacks for data load events will be performed on |client_task_runner|.
-CONTENT_EXPORT net::CookieStore* CreatePersistentCookieStore(
-    const base::FilePath& path,
-    bool restore_old_session_cookies,
-    quota::SpecialStoragePolicy* storage_policy,
-    net::CookieMonster::Delegate* cookie_monster_delegate,
-    const scoped_refptr<base::SequencedTaskRunner>& client_task_runner,
-    const scoped_refptr<base::SequencedTaskRunner>& background_task_runner,
-    scoped_ptr<CookieCryptoDelegate> crypto_delegate);
-
-// Uses the default client_task_runner and background_task_runner.
-CONTENT_EXPORT net::CookieStore* CreatePersistentCookieStore(
-    const base::FilePath& path,
-    bool restore_old_session_cookies,
-    quota::SpecialStoragePolicy* storage_policy,
-    net::CookieMonster::Delegate* cookie_monster_delegate,
-    scoped_ptr<CookieCryptoDelegate> crypto_delegate);
+struct CONTENT_EXPORT CookieStoreConfig {
+  // Specifies how session cookies are persisted in the backing data store.
+  //
+  // EPHEMERAL_SESSION_COOKIES specifies session cookies will not be written
+  // out in a manner that allows for restoration.
+  //
+  // PERSISTANT_SESSION_COOKIES specifies that session cookies are not restored
+  // when the cookie store is opened, however they will be written in a manner
+  // that allows for them to be restored if the cookie store is opened again
+  // using RESTORED_SESSION_COOKIES.
+  //
+  // RESTORED_SESSION_COOKIES is the: same as PERSISTANT_SESSION_COOKIES
+  // except when the cookie store is opened, the previously written session
+  // cookies are loaded first.
+  enum SessionCookieMode {
+    EPHEMERAL_SESSION_COOKIES,
+    PERSISTANT_SESSION_COOKIES,
+    RESTORED_SESSION_COOKIES
+  };
+
+  // Convenience constructor for an in-memory cookie store with no delegate.
+  CookieStoreConfig();
+
+  // If |path| is empty, then this specifies an in-memory cookie store.
+  // With in-memory cookie stores, |session_cookie_mode| must be
+  // EPHEMERAL_SESSION_COOKIES.
+  //
+  // Note: If |crypto_delegate| is non-NULL, it must outlive any CookieStores
+  // created using this config.
+  CookieStoreConfig(const base::FilePath& path,
+                    SessionCookieMode session_cookie_mode,
+                    quota::SpecialStoragePolicy* storage_policy,
+                    net::CookieMonsterDelegate* cookie_delegate);
+  ~CookieStoreConfig();
+
+  const base::FilePath path;
+  const SessionCookieMode session_cookie_mode;
+  const scoped_refptr<quota::SpecialStoragePolicy> storage_policy;
+  const scoped_refptr<net::CookieMonsterDelegate> cookie_delegate;
+
+  // The following are infrequently used cookie store parameters.
+  // Rather than clutter the constructor API, these are assigned a default
+  // value on CookieStoreConfig construction. Clients should then override
+  // them as necessary.
+
+  // Used to provide encryption hooks for the cookie store. The
+  // CookieCryptoDelegate must outlive any cookie store created with this
+  // config.
+  content::CookieCryptoDelegate* crypto_delegate;
+
+  // Callbacks for data load events will be performed on |client_task_runner|.
+  // If NULL, uses the task runner for BrowserThread::IO.
+  //
+  // Only used for persistent cookie stores.
+  scoped_refptr<base::SequencedTaskRunner> client_task_runner;
+
+  // All blocking database accesses will be performed on
+  // |background_task_runner|.  If NULL, uses a SequencedTaskRunner from the
+  // BrowserThread blocking pool.
+  //
+  // Only used for persistent cookie stores.
+  scoped_refptr<base::SequencedTaskRunner> background_task_runner;
+};
+
+CONTENT_EXPORT net::CookieStore* CreateCookieStore(
+    const CookieStoreConfig& config);
 
 }  // namespace content
 
diff --git a/chromium/content/public/browser/desktop_notification_delegate.h b/chromium/content/public/browser/desktop_notification_delegate.h
new file mode 100644
index 00000000000..27c5fd7f28c
--- /dev/null
+++ b/chromium/content/public/browser/desktop_notification_delegate.h
@@ -0,0 +1,31 @@
+// Copyright 2014 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_PUBLIC_BROWSER_DESKTOP_NOTIFICATION_DELEGATE_H_
+#define CONTENT_PUBLIC_BROWSER_DESKTOP_NOTIFICATION_DELEGATE_H_
+
+namespace content {
+
+// A delegate used by ContentBrowserClient::ShowDesktopNotification to report
+// the result of a desktop notification.
+class DesktopNotificationDelegate {
+ public:
+  virtual ~DesktopNotificationDelegate() {}
+
+  // The notification was shown.
+  virtual void NotificationDisplayed() = 0;
+
+  // The notification couldn't be shown due to an error.
+  virtual void NotificationError() = 0;
+
+  // The notification was closed.
+  virtual void NotificationClosed(bool by_user) = 0;
+
+  // The user clicked on the notification.
+  virtual void NotificationClick() = 0;
+};
+
+}  // namespace content
+
+#endif  // CONTENT_PUBLIC_BROWSER_DESKTOP_NOTIFICATION_DELEGATE_H_
diff --git a/chromium/content/public/browser/devtools_agent_host.h b/chromium/content/public/browser/devtools_agent_host.h
index 3b0881c1ab7..dd18a53886b 100644
--- a/chromium/content/public/browser/devtools_agent_host.h
+++ b/chromium/content/public/browser/devtools_agent_host.h
@@ -14,6 +14,7 @@
 
 namespace content {
 
+class DevToolsExternalAgentProxyDelegate;
 class RenderViewHost;
 class WebContents;
 
@@ -24,6 +25,11 @@ class CONTENT_EXPORT DevToolsAgentHost
   // Returns DevToolsAgentHost with a given |id| or NULL of it does not exist.
   static scoped_refptr<DevToolsAgentHost> GetForId(const std::string& id);
 
+  // Returns DevToolsAgentHost that can be used for inspecting |web_contents|.
+  // New DevToolsAgentHost will be created if it does not exist.
+  static scoped_refptr<DevToolsAgentHost> GetOrCreateFor(
+      WebContents* web_contents);
+
   // Returns DevToolsAgentHost that can be used for inspecting |rvh|.
   // New DevToolsAgentHost will be created if it does not exist.
   static scoped_refptr<DevToolsAgentHost> GetOrCreateFor(RenderViewHost* rvh);
@@ -37,10 +43,11 @@ class CONTENT_EXPORT DevToolsAgentHost
   static scoped_refptr<DevToolsAgentHost> GetForWorker(int worker_process_id,
                                                        int worker_route_id);
 
-  // Returns true iff an instance of DevToolsAgentHost exists for the shared
-  // worker with given process host id and routing id.
-  static bool HasForWorker(int worker_process_id,
-                           int worker_route_id);
+  // Creates DevToolsAgentHost that communicates to the target by means of
+  // provided |delegate|. |delegate| ownership is passed to the created agent
+  // host.
+  static scoped_refptr<DevToolsAgentHost> Create(
+      DevToolsExternalAgentProxyDelegate* delegate);
 
   static bool IsDebuggerAttached(WebContents* web_contents);
 
@@ -66,6 +73,9 @@ class CONTENT_EXPORT DevToolsAgentHost
   // Attaches render view host to this host.
   virtual void ConnectRenderViewHost(RenderViewHost* rvh) = 0;
 
+  // Returns true if DevToolsAgentHost is for worker.
+  virtual bool IsWorker() const = 0;
+
  protected:
   friend class base::RefCounted<DevToolsAgentHost>;
   virtual ~DevToolsAgentHost() {}
diff --git a/chromium/content/public/browser/devtools_external_agent_proxy.h b/chromium/content/public/browser/devtools_external_agent_proxy.h
index 25d701688b3..d95fd7ab32b 100644
--- a/chromium/content/public/browser/devtools_external_agent_proxy.h
+++ b/chromium/content/public/browser/devtools_external_agent_proxy.h
@@ -17,15 +17,6 @@ class DevToolsExternalAgentProxyDelegate;
 // Describes interface for communication with an external DevTools agent.
 class DevToolsExternalAgentProxy {
  public:
-  // Creates DevToolsExternalAgentProxy to communicate with an agent
-  // via the provided |delegate|.
-  // Caller get the proxy ownership and keeps the |delegate| ownership.
-  static CONTENT_EXPORT DevToolsExternalAgentProxy* Create(
-      DevToolsExternalAgentProxyDelegate* delegate);
-
-  // Returns the local DevToolsAgentHost for the external agent.
-  virtual scoped_refptr<DevToolsAgentHost> GetAgentHost() = 0;
-
   // Sends the message to the client host.
   virtual void DispatchOnClientHost(const std::string& message) = 0;
 
diff --git a/chromium/content/public/browser/devtools_external_agent_proxy_delegate.h b/chromium/content/public/browser/devtools_external_agent_proxy_delegate.h
index d68854f23ce..3d55c9a7ec5 100644
--- a/chromium/content/public/browser/devtools_external_agent_proxy_delegate.h
+++ b/chromium/content/public/browser/devtools_external_agent_proxy_delegate.h
@@ -11,20 +11,21 @@
 
 namespace content {
 
+class DevToolsExternalAgentProxy;
+
 // Describes the interface for sending messages to an external DevTools agent.
 class DevToolsExternalAgentProxyDelegate {
  public:
+   virtual ~DevToolsExternalAgentProxyDelegate() {}
+
    // Informs the agent that a client host has attached.
-   virtual void Attach() = 0;
+   virtual void Attach(DevToolsExternalAgentProxy* proxy) = 0;
 
    // Informs the agent that a client host has detached.
    virtual void Detach() = 0;
 
    // Sends a message to the agent.
    virtual void SendMessageToBackend(const std::string& message) = 0;
-
- protected:
-  virtual ~DevToolsExternalAgentProxyDelegate() {}
 };
 
 }  // namespace content
diff --git a/chromium/content/public/browser/devtools_http_handler.h b/chromium/content/public/browser/devtools_http_handler.h
index 4af55059da9..cdceff8dfd4 100644
--- a/chromium/content/public/browser/devtools_http_handler.h
+++ b/chromium/content/public/browser/devtools_http_handler.h
@@ -7,6 +7,7 @@
 
 #include <string>
 
+#include "base/files/file_path.h"
 #include "content/common/content_export.h"
 
 class GURL;
@@ -34,10 +35,15 @@ class DevToolsHttpHandler {
       const std::string& name);
 
   // Takes ownership over |socket_factory| and |delegate|.
+  // If |active_port_output_directory| is non-empty, it is assumed the
+  // socket_factory was initialized with an ephemeral port (0). The
+  // port selected by the OS will be written to a well-known file in
+  // the output directory.
   CONTENT_EXPORT static DevToolsHttpHandler* Start(
       const net::StreamListenSocketFactory* socket_factory,
       const std::string& frontend_url,
-      DevToolsHttpHandlerDelegate* delegate);
+      DevToolsHttpHandlerDelegate* delegate,
+      const base::FilePath& active_port_output_directory);
 
   // Called from the main thread in order to stop protocol handler.
   // Automatically destroys the handler instance.
diff --git a/chromium/content/public/browser/devtools_manager_delegate.h b/chromium/content/public/browser/devtools_manager_delegate.h
new file mode 100644
index 00000000000..d34e7af3957
--- /dev/null
+++ b/chromium/content/public/browser/devtools_manager_delegate.h
@@ -0,0 +1,36 @@
+// Copyright 2014 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_PUBLIC_BROWSER_DEVTOOLS_MANAGER_DELEGATE_H_
+#define CONTENT_PUBLIC_BROWSER_DEVTOOLS_MANAGER_DELEGATE_H_
+
+namespace base {
+class DictionaryValue;
+}
+
+namespace content {
+
+class BrowserContext;
+class DevToolsAgentHost;
+
+class DevToolsManagerDelegate {
+ public:
+  virtual ~DevToolsManagerDelegate() {}
+
+  // Opens the inspector for |agent_host|.
+  virtual void Inspect(BrowserContext* browser_context,
+                       DevToolsAgentHost* agent_host) = 0;
+
+  virtual void DevToolsAgentStateChanged(DevToolsAgentHost* agent_host,
+                                         bool attached) = 0;
+
+  // Result ownership is passed to the caller.
+  virtual base::DictionaryValue* HandleCommand(
+      DevToolsAgentHost* agent_host,
+      base::DictionaryValue* command) = 0;
+};
+
+}  // namespace content
+
+#endif  // CONTENT_PUBLIC_BROWSER_DEVTOOLS_MANAGER_DELEGATE_H_
diff --git a/chromium/content/public/browser/devtools_protocol_constants_generator.py b/chromium/content/public/browser/devtools_protocol_constants_generator.py
new file mode 100755
index 00000000000..3447fb1dfbf
--- /dev/null
+++ b/chromium/content/public/browser/devtools_protocol_constants_generator.py
@@ -0,0 +1,211 @@
+#!/usr/bin/python
+# Copyright 2014 The Chromium Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+import sys
+import string
+import json
+
+package = sys.argv[1]
+output_cc_path = sys.argv[2]
+output_h_path = sys.argv[3]
+blink_protocol_path = sys.argv[4]
+browser_protocol_path = sys.argv[5] if len(sys.argv) > 5 else None
+
+template_h = string.Template("""\
+// Copyright 2013 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef ${PACKAGE}_BROWSER_DEVTOOLS_DEVTOOLS_PROTOCOL_CONSTANTS_H_
+#define ${PACKAGE}_BROWSER_DEVTOOLS_DEVTOOLS_PROTOCOL_CONSTANTS_H_
+
+// THIS FILE IS AUTOGENERATED. DO NOT EDIT.
+// Generated by
+//  content/public/browser/devtools_protocol_constants_generator.py from
+//  third_party/WebKit/Source/devtools/protocol.json and
+//  content/browser/devtools/browser_protocol.json
+
+#include <string>
+
+namespace $package {
+namespace devtools {
+
+extern const char kProtocolVersion[];
+
+bool IsSupportedProtocolVersion(const std::string& version);
+
+extern const char kResult[];
+$contents
+
+}  // devtools
+}  // $package
+
+#endif  // ${PACKAGE}_BROWSER_DEVTOOLS_DEVTOOLS_PROTOCOL_CONSTANTS_H_
+""")
+
+template_cc = string.Template("""\
+// Copyright 2013 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// THIS FILE IS AUTOGENERATED. DO NOT EDIT.
+// Generated by
+//  content/public/browser/devtools_protocol_constants_generator.py from
+//  third_party/WebKit/Source/devtools/protocol.json and
+//  content/browser/devtools/browser_protocol.json
+
+#include "base/strings/string_number_conversions.h"
+#include "base/strings/string_util.h"
+#include "$package/browser/devtools/devtools_protocol_constants.h"
+
+namespace $package {
+namespace devtools {
+
+const char kProtocolVersion[] = "$major.$minor";
+
+bool IsSupportedProtocolVersion(const std::string& version) {
+  std::vector<std::string> tokens;
+  Tokenize(version, ".", &tokens);
+  int major, minor;
+  return tokens.size() == 2 &&
+      base::StringToInt(tokens[0], &major) && major == $major &&
+      base::StringToInt(tokens[1], &minor) && minor <= $minor;
+}
+
+const char kResult[] = "result";
+$contents
+
+}  // devtools
+}  // $package
+""")
+
+def Capitalize(s):
+  return s[:1].capitalize() + s[1:]
+
+references = []
+
+def CreateNamespace(domain_name, data, keys, prefixes, name = None):
+  result = {}
+  if name:
+    result["kName"] = name
+  for i, key in enumerate(keys):
+    if key in data:
+      for parameter in data[key]:
+        parameter_name = parameter["name"];
+        result[prefixes[i] + Capitalize(parameter_name)] = parameter_name
+        if "enum" in parameter:
+          enum_name = Capitalize(parameter_name)
+          result[enum_name] = {}
+          for enum in parameter["enum"]:
+            result[enum_name]["kEnum" + Capitalize(enum)] = enum
+        reference = ""
+        if "$ref" in parameter:
+          reference = parameter["$ref"]
+        if "items" in parameter and "$ref" in parameter["items"]:
+          reference = parameter["items"]["$ref"]
+        if reference:
+          if not "." in reference:
+            reference = domain_name + "." + reference
+          references.append(reference)
+  return result
+
+def IsHandledInBrowser(item):
+  return "handlers" in item and "browser" in item["handlers"]
+
+def FormatContents(tree, indent, format_string):
+  outer = dict((key, value) for key, value in tree.iteritems()
+                if not isinstance(value, dict))
+  inner = dict((key, value) for key, value in tree.iteritems()
+              if isinstance(value, dict))
+  body = ""
+  body += "".join(indent + format_string.format(key, value)
+                 for (key, value) in sorted(outer.items()))
+  body += "".join(FormatNamespace(key, value, indent, format_string)
+                 for (key, value) in sorted(inner.items()))
+  return body
+
+def FormatNamespace(title, tree, indent, format_string):
+  if (not tree):
+    return ""
+  body = '\n' + indent + "namespace " + title + " {\n"
+  body += FormatContents(tree, indent + "  ", format_string)
+  body += indent + "} // " + title + "\n"
+  return body
+
+def CreateHeader(tree, output_file):
+  contents = FormatContents(tree, "", "extern const char {0}[];\n")
+  output_file.write(template_h.substitute({
+      "contents": contents,
+      "package": package,
+      "PACKAGE": package.upper()
+  }))
+
+def CreateBody(tree, version, output_file):
+  contents = FormatContents(tree, "", "const char {0}[] = \"{1}\";\n")
+  output_file.write(template_cc.substitute({
+      "major": version["major"],
+      "minor": version["minor"],
+      "contents": contents,
+      "package": package
+  }))
+
+blink_protocol_data = open(blink_protocol_path).read()
+blink_protocol = json.loads(blink_protocol_data)
+blink_version = blink_protocol["version"]
+
+domains = blink_protocol["domains"]
+
+if browser_protocol_path:
+  browser_protocol_data = open(browser_protocol_path).read()
+  browser_protocol = json.loads(browser_protocol_data)
+  domains = domains + browser_protocol["domains"]
+
+namespace_tree = {}
+
+for domain in domains:
+  domain_value = {}
+  domain_namespace_name = Capitalize(domain["domain"])
+  if "commands" in domain:
+    for command in domain["commands"]:
+      if (IsHandledInBrowser(command)):
+        domain_value[command["name"]] = CreateNamespace(domain["domain"],
+            command, ["parameters", "returns"], ["kParam", "kResponse"],
+            domain_namespace_name + "." + command["name"])
+
+  if "events" in domain:
+    for event in domain["events"]:
+      if IsHandledInBrowser(event):
+        domain_value[event["name"]] = CreateNamespace(domain["domain"],
+            event, ["parameters"], ["kParam"],
+            domain_namespace_name + "." + event["name"])
+  if domain_value:
+    namespace_tree[domain_namespace_name] = domain_value
+
+while (references):
+  reference = references.pop();
+  path = reference.split(".");
+  parent_namespace = namespace_tree;
+  for path_segment in path[0:-1]:
+    if path_segment not in parent_namespace:
+      parent_namespace[path_segment] = {}
+    parent_namespace = parent_namespace[path_segment]
+  if (path[-1] not in parent_namespace):
+    try:
+      domain = [d for d in domains if d["domain"] == path[0]][0]
+      ref_type = [t for t in domain["types"] if t["id"] == path[1]][0]
+      parent_namespace[ref_type["id"]] = CreateNamespace(path[0],
+          ref_type, ["properties"], ["kParam"])
+    except IndexError:
+      sys.stderr.write("Failed to resolve type [{0}].\n".format(reference))
+      sys.exit(1)
+
+for (namespace_name, namespace) in namespace_tree.items():
+  namespace["kName"] = namespace_name
+
+with open(output_cc_path, "w") as f:
+  CreateBody(namespace_tree, blink_version, f)
+
+with open(output_h_path, "w") as f:
+  CreateHeader(namespace_tree, f)
diff --git a/chromium/content/public/browser/devtools_target.h b/chromium/content/public/browser/devtools_target.h
index 3fcac0572f3..80085350ae1 100644
--- a/chromium/content/public/browser/devtools_target.h
+++ b/chromium/content/public/browser/devtools_target.h
@@ -28,6 +28,9 @@ class DevToolsTarget {
   // Returns the unique target id.
   virtual std::string GetId() const = 0;
 
+  // Returns the id of the parent target, or empty string if no parent.
+  virtual std::string GetParentId() const = 0;
+
   // Returns the target type.
   virtual std::string GetType() const = 0;
 
@@ -38,10 +41,10 @@ class DevToolsTarget {
   virtual std::string GetDescription() const = 0;
 
   // Returns the url associated with this target.
-  virtual GURL GetUrl() const = 0;
+  virtual GURL GetURL() const = 0;
 
   // Returns the favicon url for this target.
-  virtual GURL GetFaviconUrl() const = 0;
+  virtual GURL GetFaviconURL() const = 0;
 
   // Returns the time when the target was last active.
   virtual base::TimeTicks GetLastActivityTime() const = 0;
diff --git a/chromium/content/public/browser/download_interrupt_reason_values.h b/chromium/content/public/browser/download_interrupt_reason_values.h
index fcfa74aa636..b05207a5fb9 100644
--- a/chromium/content/public/browser/download_interrupt_reason_values.h
+++ b/chromium/content/public/browser/download_interrupt_reason_values.h
@@ -70,6 +70,12 @@ INTERRUPT_REASON(NETWORK_DISCONNECTED, 22)
 // "Server Down".
 INTERRUPT_REASON(NETWORK_SERVER_DOWN, 23)
 
+// The network request was invalid. This may be due to the original URL or a
+// redirected URL:
+// - Having an unsupported scheme.
+// - Being an invalid URL.
+// - Being disallowed by policy.
+INTERRUPT_REASON(NETWORK_INVALID_REQUEST, 24)
 
 // Server responses.
 
diff --git a/chromium/content/public/browser/download_interrupt_reasons.h b/chromium/content/public/browser/download_interrupt_reasons.h
index ebeef3a9b3d..78a81a035e4 100644
--- a/chromium/content/public/browser/download_interrupt_reasons.h
+++ b/chromium/content/public/browser/download_interrupt_reasons.h
@@ -21,7 +21,7 @@ enum DownloadInterruptReason {
 #undef INTERRUPT_REASON
 };
 
-std::string CONTENT_EXPORT InterruptReasonDebugString(
+std::string CONTENT_EXPORT DownloadInterruptReasonToString(
     DownloadInterruptReason error);
 
 }  // namespace content
diff --git a/chromium/content/public/browser/download_item.h b/chromium/content/public/browser/download_item.h
index 5ef9597a05f..1e66f8b8a0d 100644
--- a/chromium/content/public/browser/download_item.h
+++ b/chromium/content/public/browser/download_item.h
@@ -181,6 +181,8 @@ class CONTENT_EXPORT DownloadItem : public base::SupportsUserData {
   virtual const std::vector<GURL>& GetUrlChain() const = 0;
   virtual const GURL& GetOriginalUrl() const = 0;
   virtual const GURL& GetReferrerUrl() const = 0;
+  virtual const GURL& GetTabUrl() const = 0;
+  virtual const GURL& GetTabReferrerUrl() const = 0;
   virtual std::string GetSuggestedFilename() const = 0;
   virtual std::string GetContentDisposition() const = 0;
   virtual std::string GetMimeType() const = 0;
@@ -236,10 +238,16 @@ class CONTENT_EXPORT DownloadItem : public base::SupportsUserData {
   virtual bool GetFileExternallyRemoved() const = 0;
 
   // If the file is successfully deleted, then GetFileExternallyRemoved() will
-  // become true and DownloadItem::OnDownloadUpdated() will be called. Does
-  // nothing if GetState() == COMPLETE or GetFileExternallyRemoved() is already
-  // true.
-  virtual void DeleteFile() = 0;
+  // become true, GetFullPath() will become empty, and
+  // DownloadItem::OnDownloadUpdated() will be called. Does nothing if
+  // GetState() == COMPLETE or GetFileExternallyRemoved() is already true or
+  // GetFullPath() is already empty. The callback is always run, and it is
+  // always run asynchronously. It will be passed true if the file is
+  // successfully deleted or if GetFilePath() was already empty or if
+  // GetFileExternallyRemoved() was already true. The callback will be passed
+  // false if the DownloadItem was not yet complete or if the file could not be
+  // deleted for any reason.
+  virtual void DeleteFile(const base::Callback<void(bool)>& callback) = 0;
 
   // True if the file that will be written by the download is dangerous
   // and we will require a call to ValidateDangerousDownload() to complete.
diff --git a/chromium/content/public/browser/download_manager.h b/chromium/content/public/browser/download_manager.h
index 6bb1f35156d..0c9bbacaa47 100644
--- a/chromium/content/public/browser/download_manager.h
+++ b/chromium/content/public/browser/download_manager.h
@@ -142,6 +142,8 @@ class CONTENT_EXPORT DownloadManager : public base::SupportsUserData::Data {
       const base::FilePath& target_path,
       const std::vector<GURL>& url_chain,
       const GURL& referrer_url,
+      const std::string& mime_type,
+      const std::string& original_mime_type,
       const base::Time& start_time,
       const base::Time& end_time,
       const std::string& etag,
diff --git a/chromium/content/public/browser/download_save_info.h b/chromium/content/public/browser/download_save_info.h
index 1f449111f09..0912461da98 100644
--- a/chromium/content/public/browser/download_save_info.h
+++ b/chromium/content/public/browser/download_save_info.h
@@ -5,10 +5,9 @@
 #ifndef CONTENT_PUBLIC_BROWSER_DOWNLOAD_SAVE_INFO_H_
 #define CONTENT_PUBLIC_BROWSER_DOWNLOAD_SAVE_INFO_H_
 
+#include "base/files/file.h"
 #include "base/files/file_path.h"
-#include "base/memory/linked_ptr.h"
 #include "content/common/content_export.h"
-#include "net/base/file_stream.h"
 
 namespace content {
 
@@ -29,8 +28,8 @@ struct CONTENT_EXPORT DownloadSaveInfo {
   // a path (only a filename), and is only effective if |file_path| is empty.
   base::string16 suggested_name;
 
-  // If non-NULL, contains the source data stream for the file contents.
-  scoped_ptr<net::FileStream> file_stream;
+  // If valid, contains the source data stream for the file contents.
+  base::File file;
 
   // The file offset at which to start the download.  May be 0.
   int64 offset;
diff --git a/chromium/content/public/browser/download_url_parameters.h b/chromium/content/public/browser/download_url_parameters.h
index b48bc2a2e15..fbf298410e1 100644
--- a/chromium/content/public/browser/download_url_parameters.h
+++ b/chromium/content/public/browser/download_url_parameters.h
@@ -10,9 +10,9 @@
 
 #include "base/basictypes.h"
 #include "base/callback.h"
+#include "content/public/browser/download_interrupt_reasons.h"
 #include "content/public/browser/download_save_info.h"
 #include "content/public/common/referrer.h"
-#include "net/base/net_errors.h"
 #include "url/gurl.h"
 
 namespace content {
@@ -39,7 +39,8 @@ class WebContents;
 class CONTENT_EXPORT DownloadUrlParameters {
  public:
   // If there is an error, then |item| will be NULL.
-  typedef base::Callback<void(DownloadItem*, net::Error)> OnStartedCallback;
+  typedef base::Callback<void(DownloadItem*, DownloadInterruptReason)>
+      OnStartedCallback;
 
   typedef std::pair<std::string, std::string> RequestHeadersNameValuePair;
   typedef std::vector<RequestHeadersNameValuePair> RequestHeadersType;
@@ -97,15 +98,15 @@ class CONTENT_EXPORT DownloadUrlParameters {
     save_info_.hash_state = hash_state;
   }
   void set_prompt(bool prompt) { save_info_.prompt_for_save_location = prompt; }
-  void set_file_stream(scoped_ptr<net::FileStream> file_stream) {
-    save_info_.file_stream = file_stream.Pass();
+  void set_file(base::File file) {
+    save_info_.file = file.Pass();
   }
 
   const OnStartedCallback& callback() const { return callback_; }
   bool content_initiated() const { return content_initiated_; }
   int load_flags() const { return load_flags_; }
-  const std::string& last_modified() { return last_modified_; }
-  const std::string& etag() { return etag_; }
+  const std::string& last_modified() const { return last_modified_; }
+  const std::string& etag() const { return etag_; }
   const std::string& method() const { return method_; }
   const std::string& post_body() const { return post_body_; }
   int64 post_id() const { return post_id_; }
@@ -135,10 +136,8 @@ class CONTENT_EXPORT DownloadUrlParameters {
   const GURL& url() const { return url_; }
 
   // Note that this is state changing--the DownloadUrlParameters object
-  // will not have a file_stream attached to it after this call.
-  scoped_ptr<net::FileStream> GetFileStream() {
-    return save_info_.file_stream.Pass();
-  }
+  // will not have a file attached to it after this call.
+  base::File GetFile() { return save_info_.file.Pass(); }
 
  private:
   OnStartedCallback callback_;
diff --git a/chromium/content/public/browser/geolocation_permission_context.h b/chromium/content/public/browser/geolocation_permission_context.h
deleted file mode 100644
index e1faa09a32a..00000000000
--- a/chromium/content/public/browser/geolocation_permission_context.h
+++ /dev/null
@@ -1,48 +0,0 @@
-// Copyright (c) 2012 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef CONTENT_BROWSER_GEOLOCATION_GEOLOCATION_PERMISSION_CONTEXT_H_
-#define CONTENT_BROWSER_GEOLOCATION_GEOLOCATION_PERMISSION_CONTEXT_H_
-
-#include "base/callback.h"
-#include "base/memory/ref_counted.h"
-#include "content/common/content_export.h"
-
-class GURL;
-
-namespace content {
-
-// GeolocationPermissionContext must be implemented by the embedder, to provide
-// the policy and logic for the Geolocation permissions flow.
-// This includes both prompting the user and persisting results, as required.
-class CONTENT_EXPORT GeolocationPermissionContext
-    : public base::RefCountedThreadSafe<GeolocationPermissionContext> {
- public:
-  // The renderer is requesting permission to use Geolocation.
-  // When the answer to a permission request has been determined, |callback|
-  // should be called with the result.
-  virtual void RequestGeolocationPermission(
-      int render_process_id,
-      int render_view_id,
-      int bridge_id,
-      const GURL& requesting_frame,
-      base::Callback<void(bool)> callback) = 0;
-
-  // The renderer is cancelling a pending permission request.
-  virtual void CancelGeolocationPermissionRequest(
-      int render_process_id,
-      int render_view_id,
-      int bridge_id,
-      const GURL& requesting_frame) = 0;
-
- protected:
-   virtual ~GeolocationPermissionContext() {}
-
- private:
-  friend class base::RefCountedThreadSafe<GeolocationPermissionContext>;
-};
-
-}  // namespace content
-
-#endif  // CONTENT_BROWSER_GEOLOCATION_GEOLOCATION_PERMISSION_CONTEXT_H_
diff --git a/chromium/content/public/browser/geolocation_provider.h b/chromium/content/public/browser/geolocation_provider.h
index 5e27db48880..dea3c7ee3f4 100644
--- a/chromium/content/public/browser/geolocation_provider.h
+++ b/chromium/content/public/browser/geolocation_provider.h
@@ -5,33 +5,36 @@
 #ifndef CONTENT_PUBLIC_BROWSER_GEOLOCATION_PROVIDER_H_
 #define CONTENT_PUBLIC_BROWSER_GEOLOCATION_PROVIDER_H_
 
-#include "base/callback_forward.h"
+#include "base/callback_list.h"
 #include "content/common/content_export.h"
 
 namespace content {
 struct Geoposition;
 
-class CONTENT_EXPORT GeolocationProvider {
+// This is the main API to the geolocation subsystem. The application will hold
+// a single instance of this class and can register multiple clients to be
+// notified of location changes:
+// * Callbacks are registered by AddLocationUpdateCallback() and will keep
+//   receiving updates until the returned subscription object is destructed.
+// The application must instantiate the GeolocationProvider on the UI thread and
+// must communicate with it on the same thread.
+// The underlying location arbitrator will only be enabled whilst there is at
+// least one registered observer or pending callback (and only after
+// UserDidOptIntoLocationServices). The arbitrator and the location providers it
+// uses run on a separate Geolocation thread.
+class GeolocationProvider {
  public:
-  // This method, and all below, can only be called on the IO thread unless
-  // otherwise specified.
-  static GeolocationProvider* GetInstance();
+  CONTENT_EXPORT static GeolocationProvider* GetInstance();
 
   typedef base::Callback<void(const Geoposition&)> LocationUpdateCallback;
+  typedef base::CallbackList<void(const Geoposition&)>::Subscription
+      Subscription;
 
   // |use_high_accuracy| is used as a 'hint' for the provider preferences for
   // this particular observer, however the observer could receive updates for
   // best available locations from any active provider whilst it is registered.
-  // If an existing observer is added a second time, its options are updated
-  // but only a single call to RemoveLocationUpdateCallback() is required to
-  // remove it.
-  virtual void AddLocationUpdateCallback(const LocationUpdateCallback& callback,
-                                         bool use_high_accuracy) = 0;
-
-  // Remove a previously registered observer. No-op if not previously registered
-  // via AddLocationUpdateCallback(). Returns true if the observer was removed.
-  virtual bool RemoveLocationUpdateCallback(
-      const LocationUpdateCallback& callback) = 0;
+  virtual scoped_ptr<Subscription> AddLocationUpdateCallback(
+      const LocationUpdateCallback& callback, bool use_high_accuracy) = 0;
 
   // Calling this method indicates the user has opted into using location
   // services, including sending network requests to [Google servers to] resolve
@@ -39,21 +42,17 @@ class CONTENT_EXPORT GeolocationProvider {
   // go/chrome-privacy-doc.
   virtual void UserDidOptIntoLocationServices() = 0;
 
-  // Overrides the current location for testing. This function may be called on
-  // any thread. The completion callback will be invoked asynchronously on the
-  // calling thread when the override operation is completed.
+  // Overrides the current location for testing.
   //
-  // This function allows the current location to be faked without having to
-  // manually instantiate a GeolocationProvider backed by a MockLocationProvider
-  // that serves a fake location.
+  // Overrides the location for automation/testing. Suppresses any further
+  // updates from the actual providers and sends an update with the overridden
+  // position to all registered clients.
   //
   // Do not use this function in unit tests. The function instantiates the
   // singleton geolocation stack in the background and manipulates it to report
   // a fake location. Neither step can be undone, breaking unit test isolation
   // (crbug.com/125931).
-  static void OverrideLocationForTesting(
-      const Geoposition& position,
-      const base::Closure& completion_callback);
+  virtual void OverrideLocationForTesting(const Geoposition& position) = 0;
 
  protected:
   virtual~GeolocationProvider() {}
diff --git a/chromium/content/public/browser/host_zoom_map.h b/chromium/content/public/browser/host_zoom_map.h
index 72c9a1fb62f..e65b443d2b4 100644
--- a/chromium/content/public/browser/host_zoom_map.h
+++ b/chromium/content/public/browser/host_zoom_map.h
@@ -18,6 +18,7 @@ namespace content {
 
 class BrowserContext;
 class ResourceContext;
+class WebContents;
 
 // Maps hostnames to custom zoom levels.  Written on the UI thread and read on
 // any thread.  One instance per browser context. Must be created on the UI
@@ -49,9 +50,20 @@ class HostZoomMap {
     double zoom_level;
   };
 
+  typedef std::vector<ZoomLevelChange> ZoomLevelVector;
+
   CONTENT_EXPORT static HostZoomMap* GetForBrowserContext(
       BrowserContext* browser_context);
 
+  // Returns the current zoom level for the specified WebContents. May be
+  // temporary or host-specific.
+  CONTENT_EXPORT static double GetZoomLevel(const WebContents* web_contents);
+
+  // Sets the current zoom level for the specified WebContents. The level may
+  // be temporary or host-specific depending on the particular WebContents.
+  CONTENT_EXPORT static void SetZoomLevel(const WebContents* web_contents,
+                                          double level);
+
   // Copy the zoom levels from the given map. Can only be called on the UI
   // thread.
   virtual void CopyFrom(HostZoomMap* copy) = 0;
@@ -66,6 +78,16 @@ class HostZoomMap {
       const std::string& scheme,
       const std::string& host) const = 0;
 
+  // Returns true if the specified |scheme| and/or |host| has a zoom level
+  // currently set.
+  //
+  // This may be called on any thread.
+  virtual bool HasZoomLevel(const std::string& scheme,
+                            const std::string& host) const = 0;
+
+  // Returns all non-temporary zoom levels. Can be called on any thread.
+  virtual ZoomLevelVector GetAllZoomLevels() const = 0;
+
   // Here |host| is the host portion of URL, or (in the absence of a host)
   // the complete spec of the URL.
   // Sets the zoom level for the |host| to |level|.  If the level matches the
@@ -87,6 +109,25 @@ class HostZoomMap {
                                             const std::string& host,
                                             double level) = 0;
 
+  // Returns whether the view manages its zoom level independently of other
+  // views displaying content from the same host.
+  virtual bool UsesTemporaryZoomLevel(int render_process_id,
+                                      int render_view_id) const = 0;
+
+  // Sets the temporary zoom level that's only valid for the lifetime of this
+  // WebContents.
+  //
+  // This should only be called on the UI thread.
+  virtual void SetTemporaryZoomLevel(int render_process_id,
+                                     int render_view_id,
+                                     double level) = 0;
+
+  // Clears the temporary zoom level stored for this WebContents.
+  //
+  // This should only be called on the UI thread.
+  virtual void ClearTemporaryZoomLevel(int render_process_id,
+                                       int render_view_id) = 0;
+
   // Get/Set the default zoom level for pages that don't override it.
   virtual double GetDefaultZoomLevel() const = 0;
   virtual void SetDefaultZoomLevel(double level) = 0;;
diff --git a/chromium/content/public/browser/location_provider.h b/chromium/content/public/browser/location_provider.h
new file mode 100644
index 00000000000..8752a902e1e
--- /dev/null
+++ b/chromium/content/public/browser/location_provider.h
@@ -0,0 +1,58 @@
+// Copyright (c) 2013 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_PUBLIC_BROWSER_LOCATION_PROVIDER_H_
+#define CONTENT_PUBLIC_BROWSER_LOCATION_PROVIDER_H_
+
+#include "base/callback.h"
+#include "base/compiler_specific.h"
+#include "content/public/common/geoposition.h"
+
+namespace content {
+
+class LocationProvider;
+
+// The interface for providing location information.
+class LocationProvider {
+ public:
+  virtual ~LocationProvider() {}
+
+  typedef base::Callback<void(const LocationProvider*, const Geoposition&)>
+      LocationProviderUpdateCallback;
+
+  // This callback will be used to notify when a new Geoposition becomes
+  // available.
+  virtual void SetUpdateCallback(
+      const LocationProviderUpdateCallback& callback) = 0;
+
+  // StartProvider maybe called multiple times, e.g. to alter the
+  // |high_accuracy| setting. Returns false if a fatal error was encountered
+  // which prevented the provider from starting.
+  virtual bool StartProvider(bool high_accuracy) = 0;
+
+  // Stops the provider from sending more requests.
+  // Important: a LocationProvider may be instantiated and StartProvider() may
+  // be called before the user has granted permission via OnPermissionGranted().
+  // This is to allow underlying providers to warm up, load their internal
+  // libraries, etc. No |LocationProviderUpdateCallback| can be run and no
+  // network requests can be done until OnPermissionGranted() has been called.
+  virtual void StopProvider() = 0;
+
+  // Gets the current best position estimate.
+  virtual void GetPosition(Geoposition* position) = 0;
+
+  // Provides a hint to the provider that new location data is needed as soon
+  // as possible.
+  virtual void RequestRefresh() = 0;
+
+  // Called everytime permission is granted to a page for using geolocation.
+  // This may either be through explicit user action (e.g. responding to the
+  // infobar prompt) or inferred from a persisted site permission.
+  // Note: See |StartProvider()| for more information.
+  virtual void OnPermissionGranted() = 0;
+};
+
+}  // namespace content
+
+#endif  // CONTENT_PUBLIC_BROWSER_LOCATION_PROVIDER_H_
diff --git a/chromium/content/public/browser/media_capture_devices.h b/chromium/content/public/browser/media_capture_devices.h
new file mode 100644
index 00000000000..925fff66c25
--- /dev/null
+++ b/chromium/content/public/browser/media_capture_devices.h
@@ -0,0 +1,32 @@
+// Copyright 2014 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_PUBLIC_BROWSER_MEDIA_CAPTURE_DEVICES_H_
+#define CONTENT_PUBLIC_BROWSER_MEDIA_CAPTURE_DEVICES_H_
+
+#include "content/public/common/media_stream_request.h"
+
+namespace content {
+
+// This is a singleton class, used to get Audio/Video devices, it must be
+// called in UI thread.
+class CONTENT_EXPORT  MediaCaptureDevices {
+ public:
+  // Get signleton instance of MediaCaptureDevices.
+  static MediaCaptureDevices* GetInstance();
+
+  // Return all Audio/Video devices.
+  virtual const MediaStreamDevices& GetAudioCaptureDevices() = 0;
+  virtual const MediaStreamDevices& GetVideoCaptureDevices() = 0;
+
+ private:
+  // This interface should only be implemented inside content.
+  friend class MediaCaptureDevicesImpl;
+  MediaCaptureDevices() {}
+  virtual ~MediaCaptureDevices() {}
+};
+
+}  // namespace content
+
+#endif  // CONTENT_PUBLIC_BROWSER_MEDIA_CAPTURE_DEVICES_H_
diff --git a/chromium/content/public/browser/media_device_id.cc b/chromium/content/public/browser/media_device_id.cc
index 65ac7e2dc44..2e405dd2183 100644
--- a/chromium/content/public/browser/media_device_id.cc
+++ b/chromium/content/public/browser/media_device_id.cc
@@ -6,6 +6,8 @@
 #include "base/logging.h"
 #include "base/strings/string_number_conversions.h"
 #include "base/strings/string_util.h"
+#include "content/browser/browser_main_loop.h"
+#include "content/browser/renderer_host/media/media_stream_manager.h"
 #include "crypto/hmac.h"
 
 namespace content {
@@ -36,4 +38,20 @@ bool DoesMediaDeviceIDMatchHMAC(const ResourceContext::SaltCallback& sc,
   return guid_from_raw_device_id == device_guid;
 }
 
+bool GetMediaDeviceIDForHMAC(MediaStreamType stream_type,
+                             const ResourceContext::SaltCallback& rc,
+                             const GURL& security_origin,
+                             const std::string& source_id,
+                             std::string* device_id) {
+  content::MediaStreamManager* manager =
+      content::BrowserMainLoop::GetInstance()->media_stream_manager();
+
+  return manager->TranslateSourceIdToDeviceId(
+      content::MEDIA_DEVICE_VIDEO_CAPTURE,
+      rc,
+      security_origin,
+      source_id,
+      device_id);
+}
+
 }  // namespace content
diff --git a/chromium/content/public/browser/media_device_id.h b/chromium/content/public/browser/media_device_id.h
index e14809cedd1..3a42060f834 100644
--- a/chromium/content/public/browser/media_device_id.h
+++ b/chromium/content/public/browser/media_device_id.h
@@ -14,6 +14,7 @@
 
 #include "content/common/content_export.h"
 #include "content/public/browser/resource_context.h"
+#include "content/public/common/media_stream_request.h"
 #include "url/gurl.h"
 
 namespace content {
@@ -33,6 +34,13 @@ CONTENT_EXPORT bool DoesMediaDeviceIDMatchHMAC(
     const std::string& device_guid,
     const std::string& raw_unique_id);
 
+CONTENT_EXPORT bool GetMediaDeviceIDForHMAC(
+    MediaStreamType stream_type,
+    const ResourceContext::SaltCallback& rc,
+    const GURL& security_origin,
+    const std::string& source_id,
+    std::string* device_id);
+
 }  // namespace content
 
 #endif  // CONTENT_PUBLIC_BROWSER_MEDIA_DEVICE_ID_H_
diff --git a/chromium/content/public/browser/media_devices_monitor.h b/chromium/content/public/browser/media_devices_monitor.h
deleted file mode 100644
index 044c8ada064..00000000000
--- a/chromium/content/public/browser/media_devices_monitor.h
+++ /dev/null
@@ -1,19 +0,0 @@
-// Copyright (c) 2012 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef CONTENT_PUBLIC_BROWSER_MEDIA_DEVICES_MONITOR_H_
-#define CONTENT_PUBLIC_BROWSER_MEDIA_DEVICES_MONITOR_H_
-
-#include "content/common/content_export.h"
-
-namespace content {
-
-// Called to ensure the MediaStreamManager has started monitoring the capture
-// devices, this will trigger OnAudioCaptureDevicesChanged() and
-// OnVideoCaptureDevicesChanged() callbacks.
-CONTENT_EXPORT void EnsureMonitorCaptureDevices();
-
-}  // namespace content
-
-#endif  // CONTENT_PUBLIC_BROWSER_MEDIA_DEVICES_MONITOR_H_
diff --git a/chromium/content/public/browser/media_observer.h b/chromium/content/public/browser/media_observer.h
index 1c264aa5a01..dca5b85564f 100644
--- a/chromium/content/public/browser/media_observer.h
+++ b/chromium/content/public/browser/media_observer.h
@@ -5,6 +5,7 @@
 #ifndef CONTENT_PUBLIC_BROWSER_MEDIA_OBSERVER_H_
 #define CONTENT_PUBLIC_BROWSER_MEDIA_OBSERVER_H_
 
+#include "base/callback_forward.h"
 #include "content/public/browser/media_request_state.h"
 #include "content/public/common/media_stream_request.h"
 
@@ -15,37 +16,44 @@ namespace content {
 class MediaObserver {
  public:
   // Called when a audio capture device is plugged in or unplugged.
-  virtual void OnAudioCaptureDevicesChanged(
-      const MediaStreamDevices& devices) = 0;
+  virtual void OnAudioCaptureDevicesChanged() = 0;
 
   // Called when a video capture device is plugged in or unplugged.
-  virtual void OnVideoCaptureDevicesChanged(
-      const MediaStreamDevices& devices) = 0;
+  virtual void OnVideoCaptureDevicesChanged() = 0;
 
   // Called when a media request changes state.
   virtual void OnMediaRequestStateChanged(
       int render_process_id,
       int render_view_id,
       int page_request_id,
+      const GURL& security_origin,
       const MediaStreamDevice& device,
       MediaRequestState state) = 0;
 
-  // Called when an audio stream transitions into a playing or paused state, and
-  // also at regular intervals to report the current power level of the audio
-  // signal in dBFS (decibels relative to full-scale) units.  |clipped| is true
-  // if any part of the audio signal has been clipped since the last call.  See
-  // media/audio/audio_power_monitor.h for more info.
-  virtual void OnAudioStreamPlayingChanged(
+  // Called when an audio stream is being created.
+  virtual void OnCreatingAudioStream(int render_process_id,
+                                     int render_frame_id) = 0;
+
+  // Called when an audio stream transitions into a playing state.
+  // |power_read_callback| is a thread-safe callback, provided for polling the
+  // current audio signal power level, and any copies/references to it must be
+  // destroyed when OnAudioStreamStopped() is called.
+  //
+  // The callback returns the current power level (in dBFS units) and the clip
+  // status (true if any part of the audio signal has clipped since the last
+  // callback run).  See media/audio/audio_power_monitor.h for more info.
+  typedef base::Callback<std::pair<float, bool>()> ReadPowerAndClipCallback;
+  virtual void OnAudioStreamPlaying(
       int render_process_id,
-      int render_view_id,
+      int render_frame_id,
       int stream_id,
-      bool is_playing,
-      float power_dbfs,
-      bool clipped) = 0;
+      const ReadPowerAndClipCallback& power_read_callback) = 0;
 
-  // Called when the audio stream is being created.
-  virtual void OnCreatingAudioStream(int render_process_id,
-                                     int render_view_id) = 0;
+  // Called when an audio stream has stopped.
+  virtual void OnAudioStreamStopped(
+      int render_process_id,
+      int render_frame_id,
+      int stream_id) = 0;
 
  protected:
   virtual ~MediaObserver() {}
diff --git a/chromium/content/public/browser/native_web_keyboard_event.h b/chromium/content/public/browser/native_web_keyboard_event.h
index 1585fbd6762..3e4db80d49d 100644
--- a/chromium/content/public/browser/native_web_keyboard_event.h
+++ b/chromium/content/public/browser/native_web_keyboard_event.h
@@ -28,7 +28,7 @@ struct CONTENT_EXPORT NativeWebKeyboardEvent :
                          wchar_t character,
                          int state,
                          double time_stamp_seconds);
-#elif defined(OS_MACOSX) || defined(TOOLKIT_GTK)
+#elif defined(OS_MACOSX)
   // TODO(suzhe): Limit these constructors to Linux native Gtk port.
   // For Linux Views port, after using RenderWidgetHostViewViews to replace
   // RenderWidgetHostViewGtk, we can use constructors for TOOLKIT_VIEWS defined
@@ -67,7 +67,7 @@ struct CONTENT_EXPORT NativeWebKeyboardEvent :
   // Currently, it's only used by Linux and Mac ports.
   bool skip_in_browser;
 
-#if defined(TOOLKIT_GTK)
+#if defined(USE_AURA)
   // True if the key event matches an edit command. In order to ensure the edit
   // command always work in web page, the browser should not pre-handle this key
   // event as a reserved accelerator. See http://crbug.com/54573
diff --git a/chromium/content/public/browser/navigation_controller.h b/chromium/content/public/browser/navigation_controller.h
index 8c0596e7e2b..08ea0b9985d 100644
--- a/chromium/content/public/browser/navigation_controller.h
+++ b/chromium/content/public/browser/navigation_controller.h
@@ -13,6 +13,7 @@
 #include "base/strings/string16.h"
 #include "content/common/content_export.h"
 #include "content/public/browser/global_request_id.h"
+#include "content/public/browser/session_storage_namespace.h"
 #include "content/public/common/page_transition_types.h"
 #include "content/public/common/referrer.h"
 #include "url/gurl.h"
@@ -27,14 +28,8 @@ namespace content {
 
 class BrowserContext;
 class NavigationEntry;
-class SessionStorageNamespace;
 class WebContents;
 
-// Used to store the mapping of a StoragePartition id to
-// SessionStorageNamespace.
-typedef std::map<std::string, scoped_refptr<SessionStorageNamespace> >
-    SessionStorageNamespaceMap;
-
 // A NavigationController maintains the back-forward list for a WebContents and
 // manages all navigation within that list.
 //
@@ -220,22 +215,22 @@ class NavigationController {
   // Active entry --------------------------------------------------------------
 
   // THIS IS DEPRECATED. DO NOT USE. Use GetVisibleEntry instead.
+  // See http://crbug.com/273710.
   //
   // Returns the active entry, which is the transient entry if any, the pending
   // entry if a navigation is in progress or the last committed entry otherwise.
   // NOTE: This can be NULL!!
-  //
-  // If you are trying to get the current state of the NavigationController,
-  // this is the method you will typically want to call.  If you want to display
-  // the active entry to the user (e.g., in the location bar), use
-  // GetVisibleEntry instead.
   virtual NavigationEntry* GetActiveEntry() const = 0;
 
-  // Returns the same entry as GetActiveEntry, except that it ignores pending
-  // history navigation entries.  This should be used when displaying info to
-  // the user, so that the location bar and other indicators do not update for
-  // a back/forward navigation until the pending entry commits.  This approach
-  // guards against URL spoofs on slow history navigations.
+  // Returns the entry that should be displayed to the user in the address bar.
+  // This is the transient entry if any, the pending entry if a navigation is
+  // in progress *and* is safe to display to the user (see below), or the last
+  // committed entry otherwise.
+  // NOTE: This can be NULL if no entry has committed!
+  //
+  // A pending entry is safe to display if it started in the browser process or
+  // if it's a renderer-initiated navigation in a new tab which hasn't been
+  // accessed by another tab.  (If it has been accessed, it risks a URL spoof.)
   virtual NavigationEntry* GetVisibleEntry() const = 0;
 
   // Returns the index from which we would go back/forward or reload.  This is
@@ -356,7 +351,7 @@ class NavigationController {
   // which cannot be used on iOS.
 #if !defined(OS_IOS)
   // Returns all the SessionStorageNamespace objects that this
-  // NavigationController knows about.
+  // NavigationController knows about, the map key is a StoragePartition id.
   virtual const SessionStorageNamespaceMap&
       GetSessionStorageNamespaceMap() const = 0;
 
diff --git a/chromium/content/public/browser/navigation_details.h b/chromium/content/public/browser/navigation_details.h
index 5a01aec7754..5103f640b49 100644
--- a/chromium/content/public/browser/navigation_details.h
+++ b/chromium/content/public/browser/navigation_details.h
@@ -51,8 +51,8 @@ struct CONTENT_EXPORT LoadCommittedDetails {
 
   // When the committed load is a web page from the renderer, this string
   // specifies the security state if the page is secure.
-  // See ViewHostMsg_FrameNavigate_Params.security_info, where it comes from.
-  // Use SSLManager::DeserializeSecurityInfo to decode it.
+  // See FrameHostMsg_DidCommitProvisionalLoad_Params.security_info, where it
+  // comes from. Use SSLManager::DeserializeSecurityInfo to decode it.
   std::string serialized_security_info;
 
   // Returns whether the main frame navigated to a different page (e.g., not
diff --git a/chromium/content/public/browser/navigation_entry.h b/chromium/content/public/browser/navigation_entry.h
index e23773f1a2c..6d69b0de4bc 100644
--- a/chromium/content/public/browser/navigation_entry.h
+++ b/chromium/content/public/browser/navigation_entry.h
@@ -209,6 +209,14 @@ class NavigationEntry {
   //     status code wasn't available.
   virtual void SetHttpStatusCode(int http_status_code) = 0;
   virtual int GetHttpStatusCode() const = 0;
+
+  // The redirect chain traversed during this navigation, from the initial
+  // redirecting URL to the final non-redirecting current URL.
+  virtual void SetRedirectChain(const std::vector<GURL>& redirects) = 0;
+  virtual const std::vector<GURL>& GetRedirectChain() const = 0;
+
+  // True if this entry is restored and hasn't been loaded.
+  virtual bool IsRestored() const = 0;
 };
 
 }  // namespace content
diff --git a/chromium/content/public/browser/notification_types.h b/chromium/content/public/browser/notification_types.h
index 3366f169cb4..08ffd3306de 100644
--- a/chromium/content/public/browser/notification_types.h
+++ b/chromium/content/public/browser/notification_types.h
@@ -72,7 +72,7 @@ enum NotificationType {
   // Other load-related (not from NavigationController) ----------------------
 
   // Corresponds to ViewHostMsg_DocumentOnLoadCompletedInMainFrame. The source
-  // is the WebContents and the details the page_id.
+  // is the WebContents.
   // DEPRECATED: Use WebContentsObserver::DocumentOnLoadCompletedInMainFrame()
   NOTIFICATION_LOAD_COMPLETED_MAIN_FRAME,
 
@@ -179,11 +179,6 @@ enum NotificationType {
   // painted. The source is the RenderWidgetHost, the details are not used.
   NOTIFICATION_RENDER_WIDGET_HOST_DID_UPDATE_BACKING_STORE,
 
-  // This notifies the observer that a PaintAtSizeACK was received. The source
-  // is the RenderWidgetHost, the details are an instance of
-  // std::pair<int, gfx::Size>.
-  NOTIFICATION_RENDER_WIDGET_HOST_DID_RECEIVE_PAINT_AT_SIZE_ACK,
-
   // This notifies the observer that a HandleInputEventACK was received. The
   // source is the RenderWidgetHost, the details are the type of event
   // received.
diff --git a/chromium/content/public/browser/page_navigator.cc b/chromium/content/public/browser/page_navigator.cc
index 164bc4e0bc1..dc9b3c53aaa 100644
--- a/chromium/content/public/browser/page_navigator.cc
+++ b/chromium/content/public/browser/page_navigator.cc
@@ -15,7 +15,6 @@ OpenURLParams::OpenURLParams(
     : url(url),
       referrer(referrer),
       uses_post(false),
-      source_frame_id(-1),
       frame_tree_node_id(-1),
       disposition(disposition),
       transition(transition),
@@ -27,7 +26,6 @@ OpenURLParams::OpenURLParams(
 OpenURLParams::OpenURLParams(
     const GURL& url,
     const Referrer& referrer,
-    int64 source_frame_id,
     int64 frame_tree_node_id,
     WindowOpenDisposition disposition,
     PageTransition transition,
@@ -35,7 +33,6 @@ OpenURLParams::OpenURLParams(
     : url(url),
       referrer(referrer),
       uses_post(false),
-      source_frame_id(source_frame_id),
       frame_tree_node_id(frame_tree_node_id),
       disposition(disposition),
       transition(transition),
@@ -46,7 +43,6 @@ OpenURLParams::OpenURLParams(
 
 OpenURLParams::OpenURLParams()
     : uses_post(false),
-      source_frame_id(-1),
       frame_tree_node_id(-1),
       disposition(UNKNOWN),
       transition(PageTransitionFromInt(0)),
diff --git a/chromium/content/public/browser/page_navigator.h b/chromium/content/public/browser/page_navigator.h
index 7cd9afbadbf..849d4ca68b1 100644
--- a/chromium/content/public/browser/page_navigator.h
+++ b/chromium/content/public/browser/page_navigator.h
@@ -32,7 +32,6 @@ struct CONTENT_EXPORT OpenURLParams {
                 bool is_renderer_initiated);
   OpenURLParams(const GURL& url,
                 const Referrer& referrer,
-                int64 source_frame_id,
                 int64 frame_tree_node_id,
                 WindowOpenDisposition disposition,
                 PageTransition transition,
@@ -60,10 +59,6 @@ struct CONTENT_EXPORT OpenURLParams {
   // is terminated by \r\n.  May be empty if no extra headers are needed.
   std::string extra_headers;
 
-  // The renderer-specific source frame id or -1 to indicate the main frame.
-  // TODO(creis): This appears to be dead code and should be removed.
-  int64 source_frame_id;
-
   // The browser-global FrameTreeNode ID or -1 to indicate the main frame.
   int64 frame_tree_node_id;
 
diff --git a/chromium/content/public/browser/plugin_service.h b/chromium/content/public/browser/plugin_service.h
index 4cf5f988ac0..696800f3f28 100644
--- a/chromium/content/public/browser/plugin_service.h
+++ b/chromium/content/public/browser/plugin_service.h
@@ -161,7 +161,8 @@ class PluginService {
 #endif
 
   // Returns true iff PPAPI "dev channel" methods are supported.
-  virtual bool PpapiDevChannelSupported() = 0;
+  virtual bool PpapiDevChannelSupported(BrowserContext* browser_context,
+                                        const GURL& document_url) = 0;
 };
 
 }  // namespace content
diff --git a/chromium/content/public/browser/push_messaging_service.h b/chromium/content/public/browser/push_messaging_service.h
new file mode 100644
index 00000000000..37150db783b
--- /dev/null
+++ b/chromium/content/public/browser/push_messaging_service.h
@@ -0,0 +1,33 @@
+// Copyright 2014 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_PUBLIC_BROWSER_PUSH_MESSAGING_SERVICE_H_
+#define CONTENT_PUBLIC_BROWSER_PUSH_MESSAGING_SERVICE_H_
+
+#include <string>
+
+#include "base/callback.h"
+#include "content/common/content_export.h"
+#include "url/gurl.h"
+
+namespace content {
+
+// A push service-agnostic interface that the Push API uses for talking to
+// push messaging services like GCM.
+class CONTENT_EXPORT PushMessagingService {
+ public:
+  typedef base::Callback<void(const GURL& /* endpoint */,
+                              const std::string& /* registration_id */,
+                              bool /* success */)>
+      RegisterCallback;
+
+  virtual ~PushMessagingService() {}
+  virtual void Register(const std::string& app_id,
+                        const std::string& sender_id,
+                        const RegisterCallback& callback) = 0;
+};
+
+}  // namespace content
+
+#endif  // CONTENT_PUBLIC_BROWSER_PUSH_MESSAGING_SERVICE_H_
diff --git a/chromium/content/public/browser/quota_permission_context.h b/chromium/content/public/browser/quota_permission_context.h
index 27844de5ff7..5950f233ff5 100644
--- a/chromium/content/public/browser/quota_permission_context.h
+++ b/chromium/content/public/browser/quota_permission_context.h
@@ -7,6 +7,7 @@
 
 #include "base/callback.h"
 #include "base/memory/ref_counted.h"
+#include "content/public/common/storage_quota_params.h"
 #include "webkit/common/quota/quota_types.h"
 
 class GURL;
@@ -26,11 +27,8 @@ class QuotaPermissionContext
   typedef base::Callback<void(QuotaPermissionResponse)> PermissionCallback;
 
   virtual void RequestQuotaPermission(
-      const GURL& origin_url,
-      quota::StorageType type,
-      int64 new_quota,
+      const StorageQuotaParams& params,
       int render_process_id,
-      int render_view_id,
       const PermissionCallback& callback) = 0;
 
  protected:
diff --git a/chromium/content/public/browser/render_frame_host.h b/chromium/content/public/browser/render_frame_host.h
index 1455f856f24..ac6ba5aa8d7 100644
--- a/chromium/content/public/browser/render_frame_host.h
+++ b/chromium/content/public/browser/render_frame_host.h
@@ -5,21 +5,75 @@
 #ifndef CONTENT_PUBLIC_BROWSER_RENDER_FRAME_HOST_H_
 #define CONTENT_PUBLIC_BROWSER_RENDER_FRAME_HOST_H_
 
+#include <string>
+
+#include "base/callback_forward.h"
 #include "content/common/content_export.h"
 #include "ipc/ipc_listener.h"
 #include "ipc/ipc_sender.h"
+#include "ui/gfx/native_widget_types.h"
+#include "url/gurl.h"
+
+namespace base {
+class Value;
+}
 
 namespace content {
+class RenderProcessHost;
+class RenderViewHost;
+class SiteInstance;
 
 // The interface provides a communication conduit with a frame in the renderer.
 class CONTENT_EXPORT RenderFrameHost : public IPC::Listener,
                                        public IPC::Sender {
  public:
+  // Returns the RenderFrameHost given its ID and the ID of its render process.
+  // Returns NULL if the IDs do not correspond to a live RenderFrameHost.
+  static RenderFrameHost* FromID(int render_process_id, int render_frame_id);
+
   virtual ~RenderFrameHost() {}
 
   // Returns the route id for this frame.
   virtual int GetRoutingID() = 0;
 
+  // Returns the SiteInstance grouping all RenderFrameHosts that have script
+  // access to this RenderFrameHost, and must therefore live in the same
+  // process.
+  virtual SiteInstance* GetSiteInstance() = 0;
+
+  // Returns the process for this frame.
+  virtual RenderProcessHost* GetProcess() = 0;
+
+  // Returns the current RenderFrameHost of the parent frame, or NULL if there
+  // is no parent. The result may be in a different process than the current
+  // RenderFrameHost.
+  virtual RenderFrameHost* GetParent() = 0;
+
+  // Returns the assigned name of the frame, the name of the iframe tag
+  // declaring it. For example, <iframe name="framename">[...]</iframe>. It is
+  // quite possible for a frame to have no name, in which case GetFrameName will
+  // return an empty string.
+  virtual const std::string& GetFrameName() = 0;
+
+  // Returns true if the frame is out of process.
+  virtual bool IsCrossProcessSubframe() = 0;
+
+  // Returns the last committed URL of the frame.
+  virtual GURL GetLastCommittedURL() = 0;
+
+  // Returns the associated widget's native view.
+  virtual gfx::NativeView GetNativeView() = 0;
+
+  // Runs some JavaScript in this frame's context. If a callback is provided, it
+  // will be used to return the result, when the result is available.
+  typedef base::Callback<void(const base::Value*)> JavaScriptResultCallback;
+  virtual void ExecuteJavaScript(const base::string16& javascript) = 0;
+  virtual void ExecuteJavaScript(const base::string16& javascript,
+                                 const JavaScriptResultCallback& callback) = 0;
+
+  // Temporary until we get rid of RenderViewHost.
+  virtual RenderViewHost* GetRenderViewHost() = 0;
+
  private:
   // This interface should only be implemented inside content.
   friend class RenderFrameHostImpl;
diff --git a/chromium/content/public/browser/render_process_host.h b/chromium/content/public/browser/render_process_host.h
index 76558254871..ee650367fcc 100644
--- a/chromium/content/public/browser/render_process_host.h
+++ b/chromium/content/public/browser/render_process_host.h
@@ -14,7 +14,6 @@
 #include "ipc/ipc_channel_proxy.h"
 #include "ipc/ipc_sender.h"
 #include "ui/gfx/native_widget_types.h"
-#include "ui/surface/transport_dib.h"
 
 class GURL;
 struct ViewMsg_SwapOut_Params;
@@ -29,9 +28,7 @@ class BrowserMessageFilter;
 class RenderProcessHostObserver;
 class RenderWidgetHost;
 class StoragePartition;
-
-typedef base::Thread* (*RendererMainThreadFactoryFunction)(
-    const std::string& id);
+struct GlobalRequestID;
 
 // Interface that represents the browser side of the browser <-> renderer
 // communication channel. There will generally be one RenderProcessHost per
@@ -98,9 +95,11 @@ class CONTENT_EXPORT RenderProcessHost : public IPC::Sender,
   virtual void WidgetHidden() = 0;
   virtual int VisibleWidgetCount() const = 0;
 
-  // Indicates whether the current RenderProcessHost associated with a guest
-  // renderer process.
-  virtual bool IsGuest() const = 0;
+  // Indicates whether the current RenderProcessHost is associated with an
+  // isolated guest renderer process. Not all guest renderers are created equal.
+  // A guest, as indicated by BrowserPluginGuest::IsGuest, may coexist with
+  // other non-guest renderers in the same process if IsIsolatedGuest is false.
+  virtual bool IsIsolatedGuest() const = 0;
 
   // Returns the storage partition associated with this process.
   //
@@ -130,19 +129,6 @@ class CONTENT_EXPORT RenderProcessHost : public IPC::Sender,
   // the first IPC arrives.
   virtual base::ProcessHandle GetHandle() const = 0;
 
-  // Transport DIB functions ---------------------------------------------------
-
-  // Return the TransportDIB for the given id. On Linux, this can involve
-  // mapping shared memory. On Mac, the shared memory is created in the browser
-  // process and the cached metadata is returned. On Windows, this involves
-  // duplicating the handle from the remote process.  The RenderProcessHost
-  // still owns the returned DIB.
-  virtual TransportDIB* GetTransportDIB(TransportDIB::Id dib_id) = 0;
-
-  // Return the TransportDIB for the given id. In contrast to GetTransportDIB,
-  // the caller owns the resulting TransportDIB.
-  virtual TransportDIB* MapTransportDIB(TransportDIB::Id dib_id) = 0;
-
   // Returns the user browser context associated with this renderer process.
   virtual content::BrowserContext* GetBrowserContext() const = 0;
 
@@ -150,12 +136,14 @@ class CONTENT_EXPORT RenderProcessHost : public IPC::Sender,
   // |partition|.
   virtual bool InSameStoragePartition(StoragePartition* partition) const = 0;
 
-  // Returns the unique ID for this child process. This can be used later in
-  // a call to FromID() to get back to this object (this is used to avoid
+  // Returns the unique ID for this child process host. This can be used later
+  // in a call to FromID() to get back to this object (this is used to avoid
   // sending non-threadsafe pointers to other threads).
   //
-  // This ID will be unique for all child processes, including workers, plugins,
-  // etc.
+  // This ID will be unique across all child process hosts, including workers,
+  // plugins, etc.
+  //
+  // This will never return ChildProcessHost::kInvalidUniqueID.
   virtual int GetID() const = 0;
 
   // Returns true iff channel_ has been set to non-NULL. Use this for checking
@@ -201,15 +189,49 @@ class CONTENT_EXPORT RenderProcessHost : public IPC::Sender,
   // 10 milliseconds.
   virtual base::TimeDelta GetChildProcessIdleTime() const = 0;
 
-  // Signals that a compositing surface has been updated after a lost context
-  // event, so that we can process requests from the renderer to create contexts
-  // with that surface.
-  virtual void SurfaceUpdated(int32 surface_id) = 0;
-
   // Called to resume the requests for a view created through window.open that
   // were initially blocked.
   virtual void ResumeRequestsForView(int route_id) = 0;
 
+  // Checks that the given renderer can request |url|, if not it sets it to
+  // about:blank.
+  // |empty_allowed| must be set to false for navigations for security reasons.
+  virtual void FilterURL(bool empty_allowed, GURL* url) = 0;
+
+#if defined(ENABLE_WEBRTC)
+  virtual void EnableAecDump(const base::FilePath& file) = 0;
+  virtual void DisableAecDump() = 0;
+
+  // When set, |callback| receives log messages regarding, for example, media
+  // devices (webcams, mics, etc) that were initially requested in the render
+  // process associated with this RenderProcessHost.
+  virtual void SetWebRtcLogMessageCallback(
+      base::Callback<void(const std::string&)> callback) = 0;
+
+  typedef base::Callback<void(scoped_ptr<uint8[]> packet_header,
+                              size_t header_length,
+                              size_t packet_length,
+                              bool incoming)> WebRtcRtpPacketCallback;
+
+  typedef base::Callback<void(bool incoming, bool outgoing)>
+      WebRtcStopRtpDumpCallback;
+
+  // Starts passing RTP packets to |packet_callback| and returns the callback
+  // used to stop dumping.
+  virtual WebRtcStopRtpDumpCallback StartRtpDump(
+      bool incoming,
+      bool outgoing,
+      const WebRtcRtpPacketCallback& packet_callback) = 0;
+#endif
+
+  // Tells the ResourceDispatcherHost to resume a deferred navigation without
+  // transferring it to a new renderer process.
+  virtual void ResumeDeferredNavigation(const GlobalRequestID& request_id) = 0;
+
+  // Notifies the renderer that the timezone configuration of the system might
+  // have changed.
+  virtual void NotifyTimezoneChange() = 0;
+
   // Static management functions -----------------------------------------------
 
   // Flag to run the renderer in process.  This is primarily
@@ -263,9 +285,6 @@ class CONTENT_EXPORT RenderProcessHost : public IPC::Sender,
   // Returns the current max number of renderer processes used by the content
   // module.
   static size_t GetMaxRendererProcessCount();
-
-  static void RegisterRendererMainThreadFactory(
-      RendererMainThreadFactoryFunction create);
 };
 
 }  // namespace content.
diff --git a/chromium/content/public/browser/render_process_host_observer.h b/chromium/content/public/browser/render_process_host_observer.h
index 221673734fb..867bc7cc3a0 100644
--- a/chromium/content/public/browser/render_process_host_observer.h
+++ b/chromium/content/public/browser/render_process_host_observer.h
@@ -5,6 +5,8 @@
 #ifndef CONTENT_PUBLIC_BROWSER_RENDER_PROCESS_HOST_OBSERVER_H_
 #define CONTENT_PUBLIC_BROWSER_RENDER_PROCESS_HOST_OBSERVER_H_
 
+#include "base/process/kill.h"
+#include "base/process/process_handle.h"
 #include "content/common/content_export.h"
 
 namespace content {
@@ -15,7 +17,18 @@ class RenderProcessHost;
 // in RenderProcessHost lifecycle events.
 class CONTENT_EXPORT RenderProcessHostObserver {
  public:
-  // Called when the observed RenderProcessHost itself is destroyed.
+  // This method is invoked when a render process exited (either normally or
+  // with a crash). To determine if the process closed normally or crashed,
+  // examine the |status| parameter.
+  //
+  // Note that this is equivalent to WebContentsObserver::RenderProcessGone().
+  virtual void RenderProcessExited(RenderProcessHost* host,
+                                   base::ProcessHandle handle,
+                                   base::TerminationStatus status,
+                                   int exit_code) {}
+
+  // This method is invoked when the observed RenderProcessHost itself is
+  // destroyed. This is guaranteed to be the last call made to the observer.
   virtual void RenderProcessHostDestroyed(RenderProcessHost* host) {}
 
  protected:
diff --git a/chromium/content/public/browser/render_view_host.h b/chromium/content/public/browser/render_view_host.h
index f2efd36c8ba..559c0ef4c69 100644
--- a/chromium/content/public/browser/render_view_host.h
+++ b/chromium/content/public/browser/render_view_host.h
@@ -12,7 +12,7 @@
 #include "content/public/browser/render_widget_host.h"
 #include "content/public/common/file_chooser_params.h"
 #include "content/public/common/page_zoom.h"
-#include "content/public/common/stop_find_action.h"
+#include "mojo/public/cpp/system/core.h"
 #include "third_party/WebKit/public/web/WebDragOperation.h"
 
 class GURL;
@@ -36,7 +36,6 @@ struct SelectedFileInfo;
 }
 
 namespace blink {
-struct WebFindOptions;
 struct WebMediaPlayerAction;
 struct WebPluginAction;
 }
@@ -44,11 +43,10 @@ struct WebPluginAction;
 namespace content {
 
 class ChildProcessSecurityPolicy;
-class RenderProcessHost;
+class RenderFrameHost;
 class RenderViewHostDelegate;
 class SessionStorageNamespace;
 class SiteInstance;
-struct CustomContextMenuContext;
 struct DropData;
 
 // A RenderViewHost is responsible for creating and talking to a RenderView
@@ -72,21 +70,20 @@ class CONTENT_EXPORT RenderViewHost : virtual public RenderWidgetHost {
   // because RenderWidgetHost is a virtual base class.
   static RenderViewHost* From(RenderWidgetHost* rwh);
 
-  // Checks that the given renderer can request |url|, if not it sets it to
-  // about:blank.
-  // |empty_allowed| must be set to false for navigations for security reasons.
-  static void FilterURL(const RenderProcessHost* process,
-                        bool empty_allowed,
-                        GURL* url);
-
   virtual ~RenderViewHost() {}
 
+  // Returns the main frame for this render view.
+  virtual RenderFrameHost* GetMainFrame() = 0;
+
   // Tell the render view to enable a set of javascript bindings. The argument
   // should be a combination of values from BindingsPolicy.
   virtual void AllowBindings(int binding_flags) = 0;
 
-  // Tells the renderer to clear the focused node (if any).
-  virtual void ClearFocusedNode() = 0;
+  // Tells the renderer to clear the focused element (if any).
+  virtual void ClearFocusedElement() = 0;
+
+  // Returns true if the current focused element is editable.
+  virtual bool IsFocusedElementEditable() = 0;
 
   // Causes the renderer to close the current page, including running its
   // onunload event handler.  A ClosePage_ACK message will be sent to the
@@ -97,15 +94,9 @@ class CONTENT_EXPORT RenderViewHost : virtual public RenderWidgetHost {
   // image at that location).
   virtual void CopyImageAt(int x, int y) = 0;
 
-  // Notifies the renderer about the result of a desktop notification.
-  virtual void DesktopNotificationPermissionRequestDone(
-      int callback_context) = 0;
-  virtual void DesktopNotificationPostDisplay(int callback_context) = 0;
-  virtual void DesktopNotificationPostError(int notification_id,
-                                    const base::string16& message) = 0;
-  virtual void DesktopNotificationPostClose(int notification_id,
-                                            bool by_user) = 0;
-  virtual void DesktopNotificationPostClick(int notification_id) = 0;
+  // Saves the image at location x, y to the disk (if there indeed is an
+  // image at that location).
+  virtual void SaveImageAt(int x, int y) = 0;
 
   // Notifies the listener that a directory enumeration is complete.
   virtual void DirectoryEnumerationFinished(
@@ -122,11 +113,6 @@ class CONTENT_EXPORT RenderViewHost : virtual public RenderWidgetHost {
       int client_x, int client_y, int screen_x, int screen_y,
       blink::WebDragOperation operation) = 0;
 
-  // Notifies the renderer that a drag and drop operation is in progress, with
-  // droppable items positioned over the renderer's view.
-  virtual void DragSourceMovedTo(
-      int client_x, int client_y, int screen_x, int screen_y) = 0;
-
   // Notifies the renderer that we're done with the drag and drop operation.
   // This allows the renderer to reset some state.
   virtual void DragSourceSystemDragEnded() = 0;
@@ -159,28 +145,12 @@ class CONTENT_EXPORT RenderViewHost : virtual public RenderWidgetHost {
   // Instructs the RenderView to send back updates to the preferred size.
   virtual void EnablePreferredSizeMode() = 0;
 
-  // Executes custom context menu action that was provided from WebKit.
-  virtual void ExecuteCustomContextMenuCommand(
-      int action, const CustomContextMenuContext& context) = 0;
-
   // Tells the renderer to perform the given action on the media player
   // located at the given point.
   virtual void ExecuteMediaPlayerActionAtLocation(
       const gfx::Point& location,
       const blink::WebMediaPlayerAction& action) = 0;
 
-  // Runs some javascript within the context of a frame in the page.
-  virtual void ExecuteJavascriptInWebFrame(const base::string16& frame_xpath,
-                                           const base::string16& jscript) = 0;
-
-  // Runs some javascript within the context of a frame in the page. The result
-  // is sent back via the provided callback.
-  typedef base::Callback<void(const base::Value*)> JavascriptResultCallback;
-  virtual void ExecuteJavascriptInWebFrameCallbackResult(
-      const base::string16& frame_xpath,
-      const base::string16& jscript,
-      const JavascriptResultCallback& callback) = 0;
-
   // Tells the renderer to perform the given action on the plugin located at
   // the given point.
   virtual void ExecutePluginActionAtLocation(
@@ -189,23 +159,6 @@ class CONTENT_EXPORT RenderViewHost : virtual public RenderWidgetHost {
   // Asks the renderer to exit fullscreen
   virtual void ExitFullscreen() = 0;
 
-  // Finds text on a page.
-  virtual void Find(int request_id, const base::string16& search_text,
-                    const blink::WebFindOptions& options) = 0;
-
-  // Notifies the renderer that the user has closed the FindInPage window
-  // (and what action to take regarding the selection).
-  virtual void StopFinding(StopFindAction action) = 0;
-
-  // Causes the renderer to invoke the onbeforeunload event handler.  The
-  // result will be returned via ViewMsg_ShouldClose. See also ClosePage and
-  // SwapOut, which fire the PageUnload event.
-  //
-  // Set bool for_cross_site_transition when this close is just for the current
-  // RenderView in the case of a cross-site transition. False means we're
-  // closing the entire tab.
-  virtual void FirePageBeforeUnload(bool for_cross_site_transition) = 0;
-
   // Notifies the Listener that one or more files have been chosen by the user
   // from a file chooser dialog for the form. |permissions| is the file
   // selection mode in which the chooser dialog was created.
@@ -221,33 +174,14 @@ class CONTENT_EXPORT RenderViewHost : virtual public RenderWidgetHost {
 
   virtual SiteInstance* GetSiteInstance() const = 0;
 
-  // Requests the renderer to evaluate an xpath to a frame and insert css
-  // into that frame's document.
-  virtual void InsertCSS(const base::string16& frame_xpath,
-                         const std::string& css) = 0;
-
   // Returns true if the RenderView is active and has not crashed. Virtual
   // because it is overridden by TestRenderViewHost.
   virtual bool IsRenderViewLive() const = 0;
 
-  // Returns true if the RenderView is responsible for displaying a subframe
-  // in a different process from its parent page.
-  virtual bool IsSubframe() const = 0;
-
-  // Let the renderer know that the menu has been closed.
-  virtual void NotifyContextMenuClosed(
-      const CustomContextMenuContext& context) = 0;
-
   // Notification that a move or resize renderer's containing window has
   // started.
   virtual void NotifyMoveOrResizeStarted() = 0;
 
-  // Reloads the current focused frame.
-  virtual void ReloadFrame() = 0;
-
-  // Sets the alternate error page URL (link doctor) for the renderer process.
-  virtual void SetAltErrorPageURL(const GURL& url) = 0;
-
   // Sets a property with the given name and value on the Web UI binding object.
   // Must call AllowWebUIBindings() on this renderer first.
   virtual void SetWebUIProperty(const std::string& name,
@@ -260,17 +194,12 @@ class CONTENT_EXPORT RenderViewHost : virtual public RenderWidgetHost {
   // RenderViewHostDelegate.
   virtual void SyncRendererPrefs() = 0;
 
-  virtual void ToggleSpeechInput() = 0;
-
   // Returns the current WebKit preferences.
   virtual WebPreferences GetWebkitPreferences() = 0;
 
   // Passes a list of Webkit preferences to the renderer.
   virtual void UpdateWebkitPreferences(const WebPreferences& prefs) = 0;
 
-  // Informs the renderer process of a change in timezone.
-  virtual void NotifyTimezoneChange() = 0;
-
   // Retrieves the list of AudioOutputController objects associated
   // with this object and passes it to the callback you specify, on
   // the same thread on which you called the method.
@@ -281,6 +210,12 @@ class CONTENT_EXPORT RenderViewHost : virtual public RenderWidgetHost {
   virtual void GetAudioOutputControllers(
       const GetAudioOutputControllersCallback& callback) const = 0;
 
+  // Sets the mojo handle for WebUI pages.
+  virtual void SetWebUIHandle(mojo::ScopedMessagePipeHandle handle) = 0;
+
+  // Notify the render view host to select the word around the caret.
+  virtual void SelectWordAroundCaret() = 0;
+
 #if defined(OS_ANDROID)
   // Selects and zooms to the find result nearest to the point (x,y)
   // defined in find-in-page coordinates.
@@ -288,9 +223,6 @@ class CONTENT_EXPORT RenderViewHost : virtual public RenderWidgetHost {
 
   // Asks the renderer to send the rects of the current find matches.
   virtual void RequestFindMatchRects(int current_version) = 0;
-
-  // Disables fullscreen media playback for encrypted video.
-  virtual void DisableFullscreenEncryptedMediaPlayback() = 0;
 #endif
 
  private:
diff --git a/chromium/content/public/browser/render_widget_host.h b/chromium/content/public/browser/render_widget_host.h
index 944ecbbcc75..30308736a76 100644
--- a/chromium/content/public/browser/render_widget_host.h
+++ b/chromium/content/public/browser/render_widget_host.h
@@ -12,12 +12,11 @@
 #include "ipc/ipc_sender.h"
 #include "third_party/WebKit/public/web/WebInputEvent.h"
 #include "third_party/WebKit/public/web/WebTextDirection.h"
+#include "third_party/skia/include/core/SkBitmap.h"
 #include "ui/gfx/size.h"
 #include "ui/surface/transport_dib.h"
 
-#if defined(TOOLKIT_GTK)
-#include "ui/base/x/x11_util.h"
-#elif defined(OS_MACOSX)
+#if defined(OS_MACOSX)
 #include "skia/ext/platform_device.h"
 #endif
 
@@ -107,12 +106,6 @@ class RenderWidgetHostView;
 // the RenderWidgetHost's IPC message map.
 class CONTENT_EXPORT RenderWidgetHost : public IPC::Sender {
  public:
-  // Free all backing stores used for rendering to drop memory usage.
-  static void RemoveAllBackingStores();
-
-  // Returns the size of all the backing stores used for rendering
-  static size_t BackingStoreMemorySize();
-
   // Returns the RenderWidgetHost given its ID and the ID of its render process.
   // Returns NULL if the IDs do not correspond to a live RenderWidgetHost.
   static RenderWidgetHost* FromID(int32 process_id, int32 routing_id);
@@ -123,18 +116,6 @@ class CONTENT_EXPORT RenderWidgetHost : public IPC::Sender {
 
   virtual ~RenderWidgetHost() {}
 
-  // Edit operations.
-  virtual void Undo() = 0;
-  virtual void Redo() = 0;
-  virtual void Cut() = 0;
-  virtual void Copy() = 0;
-  virtual void CopyToFindPboard() = 0;
-  virtual void Paste() = 0;
-  virtual void PasteAndMatchStyle() = 0;
-  virtual void Delete() = 0;
-  virtual void SelectAll() = 0;
-  virtual void Unselect() = 0;
-
   // Update the text direction of the focused input element and notify it to a
   // renderer process.
   // These functions have two usage scenarios: changing the text direction
@@ -199,20 +180,51 @@ class CONTENT_EXPORT RenderWidgetHost : public IPC::Sender {
   virtual void CopyFromBackingStore(
       const gfx::Rect& src_rect,
       const gfx::Size& accelerated_dst_size,
-      const base::Callback<void(bool, const SkBitmap&)>& callback) = 0;
-#if defined(TOOLKIT_GTK)
-  // Paint the backing store into the target's |dest_rect|.
-  virtual bool CopyFromBackingStoreToGtkWindow(const gfx::Rect& dest_rect,
-                                               GdkWindow* target) = 0;
-#elif defined(OS_MACOSX)
-  virtual gfx::Size GetBackingStoreSize() = 0;
-  virtual bool CopyFromBackingStoreToCGContext(const CGRect& dest_rect,
-                                               CGContextRef target) = 0;
+      const base::Callback<void(bool, const SkBitmap&)>& callback,
+      const SkBitmap::Config& bitmap_config) = 0;
+  // Ensures that the view does not drop the backing store even when hidden.
+  virtual bool CanCopyFromBackingStore() = 0;
+#if defined(OS_ANDROID)
+  virtual void LockBackingStore() = 0;
+  virtual void UnlockBackingStore() = 0;
 #endif
 
   // Send a command to the renderer to turn on full accessibility.
   virtual void EnableFullAccessibilityMode() = 0;
 
+  // Check whether this RenderWidget has full accessibility mode.
+  virtual bool IsFullAccessibilityModeForTesting() = 0;
+
+  // Send a command to the renderer to turn on tree only accessibility.
+  virtual void EnableTreeOnlyAccessibilityMode() = 0;
+
+  // Check whether this RenderWidget has tree-only accessibility mode.
+  virtual bool IsTreeOnlyAccessibilityModeForTesting() = 0;
+
+  // Relay a request from assistive technology to perform the default action
+  // on a given node.
+  virtual void AccessibilityDoDefaultAction(int object_id) = 0;
+
+  // Relay a request from assistive technology to set focus to a given node.
+  virtual void AccessibilitySetFocus(int object_id) = 0;
+
+  // Relay a request from assistive technology to make a given object
+  // visible by scrolling as many scrollable containers as necessary.
+  // In addition, if it's not possible to make the entire object visible,
+  // scroll so that the |subfocus| rect is visible at least. The subfocus
+  // rect is in local coordinates of the object itself.
+  virtual void AccessibilityScrollToMakeVisible(
+      int acc_obj_id, gfx::Rect subfocus) = 0;
+
+  // Relay a request from assistive technology to move a given object
+  // to a specific location, in the WebContents area coordinate space, i.e.
+  // (0, 0) is the top-left corner of the WebContents.
+  virtual void AccessibilityScrollToPoint(int acc_obj_id, gfx::Point point) = 0;
+
+  // Relay a request from assistive technology to set text selection.
+  virtual void AccessibilitySetTextSelection(
+      int acc_obj_id, int start_offset, int end_offset) = 0;
+
   // Forwards the given message to the renderer. These are called by
   // the view when it has received a message.
   virtual void ForwardMouseEvent(
@@ -240,28 +252,6 @@ class CONTENT_EXPORT RenderWidgetHost : public IPC::Sender {
   // Returns true if this is a RenderViewHost, false if not.
   virtual bool IsRenderView() const = 0;
 
-  // This tells the renderer to paint into a bitmap and return it,
-  // regardless of whether the tab is hidden or not.  It resizes the
-  // web widget to match the |page_size| and then returns the bitmap
-  // scaled so it matches the |desired_size|, so that the scaling
-  // happens on the rendering thread.  When the bitmap is ready, the
-  // renderer sends a PaintAtSizeACK to this host, and a
-  // RENDER_WIDGET_HOST_DID_RECEIVE_PAINT_AT_SIZE_ACK notification is issued.
-  // Note that this bypasses most of the update logic that is normally invoked,
-  // and doesn't put the results into the backing store.
-  virtual void PaintAtSize(TransportDIB::Handle dib_handle,
-                           int tag,
-                           const gfx::Size& page_size,
-                           const gfx::Size& desired_size) = 0;
-
-  // Makes an IPC call to tell webkit to replace the currently selected word
-  // or a word around the cursor.
-  virtual void Replace(const base::string16& word) = 0;
-
-  // Makes an IPC call to tell webkit to replace the misspelling in the current
-  // selection.
-  virtual void ReplaceMisspelling(const base::string16& word) = 0;
-
   // Called to notify the RenderWidget that the resize rect has changed without
   // the size of the RenderWidget itself changing.
   virtual void ResizeRectChanged(const gfx::Rect& new_rect) = 0;
@@ -300,15 +290,7 @@ class CONTENT_EXPORT RenderWidgetHost : public IPC::Sender {
   // Get the screen info corresponding to this render widget.
   virtual void GetWebScreenInfo(blink::WebScreenInfo* result) = 0;
 
-  // Grabs snapshot from renderer side and returns the bitmap to a callback.
-  // If |src_rect| is empty, the whole contents is copied. This is an expensive
-  // operation due to the IPC, but it can be used as a fallback method when
-  // CopyFromBackingStore fails due to the backing store not being available or,
-  // in composited mode, when the accelerated surface is not available to the
-  // browser side.
-  virtual void GetSnapshotFromRenderer(
-      const gfx::Rect& src_subrect,
-      const base::Callback<void(bool, const SkBitmap&)>& callback) = 0;
+  virtual SkBitmap::Config PreferredReadbackFormat() = 0;
 
  protected:
   friend class RenderWidgetHostImpl;
diff --git a/chromium/content/public/browser/render_widget_host_view.h b/chromium/content/public/browser/render_widget_host_view.h
index d815cdfd2b1..fff83a76f75 100644
--- a/chromium/content/public/browser/render_widget_host_view.h
+++ b/chromium/content/public/browser/render_widget_host_view.h
@@ -6,6 +6,7 @@
 #define CONTENT_PUBLIC_BROWSER_RENDER_WIDGET_HOST_VIEW_H_
 
 #include "base/basictypes.h"
+#include "base/memory/scoped_ptr.h"
 #include "base/strings/string16.h"
 #include "content/common/content_export.h"
 #include "third_party/skia/include/core/SkBitmap.h"
@@ -13,10 +14,6 @@
 #include "third_party/WebKit/public/web/WebInputEvent.h"
 #include "ui/gfx/native_widget_types.h"
 
-#if defined(TOOLKIT_GTK)
-#include <gdk/gdk.h>
-#endif
-
 class GURL;
 
 namespace gfx {
@@ -24,10 +21,14 @@ class Rect;
 class Size;
 }
 
+namespace ui {
+class TextInputClient;
+}
+
 namespace content {
 
-class BrowserAccessibilityManager;
 class RenderWidgetHost;
+class RenderWidgetHostViewFrameSubscriber;
 
 // RenderWidgetHostView is an interface implemented by an object that acts as
 // the "View" portion of a RenderWidgetHost. The RenderWidgetHost and its
@@ -39,26 +40,12 @@ class RenderWidgetHost;
 //
 // RenderWidgetHostView Class Hierarchy:
 //   RenderWidgetHostView - Public interface.
-//   RenderWidgetHostViewPort - Private interface for content/ and ports.
 //   RenderWidgetHostViewBase - Common implementation between platforms.
-//   RenderWidgetHostViewWin, ... - Platform specific implementations.
+//   RenderWidgetHostViewAura, ... - Platform specific implementations.
 class CONTENT_EXPORT RenderWidgetHostView {
  public:
   virtual ~RenderWidgetHostView() {}
 
-  // Platform-specific creator. Use this to construct new RenderWidgetHostViews
-  // rather than using RenderWidgetHostViewWin & friends.
-  //
-  // This function must NOT size it, because the RenderView in the renderer
-  // wouldn't have been created yet. The widget would set its "waiting for
-  // resize ack" flag, and the ack would never come becasue no RenderView
-  // received it.
-  //
-  // The RenderWidgetHost must already be created (because we can't know if it's
-  // going to be a regular RenderWidgetHost or a RenderViewHost (a subclass).
-  static RenderWidgetHostView* CreateViewForWidget(
-      RenderWidgetHost* widget);
-
   // Initialize this object for use as a drawing area.  |parent_view| may be
   // left as NULL on platforms where a parent view is not required to initialize
   // a child window.
@@ -80,6 +67,13 @@ class CONTENT_EXPORT RenderWidgetHostView {
   virtual gfx::NativeViewId GetNativeViewId() const = 0;
   virtual gfx::NativeViewAccessible GetNativeViewAccessible() = 0;
 
+  // Returns a ui::TextInputClient to support text input or NULL if this RWHV
+  // doesn't support text input.
+  // Note: Not all the platforms use ui::InputMethod and ui::TextInputClient for
+  // text input.  Some platforms (Mac and Android for example) use their own
+  // text input system.
+  virtual ui::TextInputClient* GetTextInputClient() = 0;
+
   // Set focus to the associated View component.
   virtual void Focus() = 0;
   // Returns true if the View currently has the focus.
@@ -108,9 +102,9 @@ class CONTENT_EXPORT RenderWidgetHostView {
   virtual base::string16 GetSelectedText() const = 0;
 
   // Subclasses should override this method to do what is appropriate to set
-  // the custom background for their platform.
-  virtual void SetBackground(const SkBitmap& background) = 0;
-  virtual const SkBitmap& GetBackground() = 0;
+  // the background to be transparent or opaque.
+  virtual void SetBackgroundOpaque(bool opaque) = 0;
+  virtual bool GetBackgroundOpaque() = 0;
 
   // Return value indicates whether the mouse is locked successfully or not.
   virtual bool LockMouse() = 0;
@@ -118,6 +112,25 @@ class CONTENT_EXPORT RenderWidgetHostView {
   // Returns true if the mouse pointer is currently locked.
   virtual bool IsMouseLocked() = 0;
 
+  // Retrives the size of the viewport for the visible region. May be smaller
+  // than the view size if a portion of the view is obstructed (e.g. by a
+  // virtual keyboard).
+  virtual gfx::Size GetVisibleViewportSize() const = 0;
+
+  // Set insets for the visible region of the root window. Used to compute the
+  // visible viewport.
+  virtual void SetInsets(const gfx::Insets& insets) = 0;
+
+  // Begin subscribing for presentation events and captured frames.
+  // |subscriber| is now owned by this object, it will be called only on the
+  // UI thread.
+  virtual void BeginFrameSubscription(
+      scoped_ptr<RenderWidgetHostViewFrameSubscriber> subscriber) = 0;
+
+  // End subscribing for frame presentation events. FrameSubscriber will be
+  // deleted after this call.
+  virtual void EndFrameSubscription() = 0;
+
 #if defined(OS_MACOSX)
   // Set the view's active state (i.e., tint state of controls).
   virtual void SetActive(bool active) = 0;
@@ -151,18 +164,6 @@ class CONTENT_EXPORT RenderWidgetHostView {
   // Stops speaking, if it is currently in progress.
   virtual void StopSpeaking() = 0;
 #endif  // defined(OS_MACOSX)
-
-#if defined(TOOLKIT_GTK)
-  // Gets the event for the last mouse down.
-  virtual GdkEventButton* GetLastMouseDown() = 0;
-  // Builds a submenu containing all the gtk input method commands.
-  virtual gfx::NativeView BuildInputMethodsGtkMenu() = 0;
-#endif  // defined(TOOLKIT_GTK)
-
-#if defined(OS_WIN) && !defined(USE_AURA)
-  // The region specified will be transparent to mouse clicks.
-  virtual void SetClickthroughRegion(SkRegion* region) = 0;
-#endif
 };
 
 }  // namespace content
diff --git a/chromium/content/public/browser/render_widget_host_view_frame_subscriber.h b/chromium/content/public/browser/render_widget_host_view_frame_subscriber.h
new file mode 100644
index 00000000000..0b658595caf
--- /dev/null
+++ b/chromium/content/public/browser/render_widget_host_view_frame_subscriber.h
@@ -0,0 +1,70 @@
+// Copyright (c) 2012 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_PORT_BROWSER_RENDER_WIDGET_HOST_VIEW_FRAME_SUBSCRIBER_H_
+#define CONTENT_PORT_BROWSER_RENDER_WIDGET_HOST_VIEW_FRAME_SUBSCRIBER_H_
+
+#include "base/callback.h"
+#include "base/time/time.h"
+
+namespace gfx {
+class Rect;
+class Size;
+}  // namespace gfx
+
+namespace media {
+class VideoFrame;
+}  // namespace media
+
+namespace content {
+
+// Defines an interface for listening to events of frame presentation and to
+// instruct the platform layer (i.e. RenderWidgetHostView) to copy a frame.
+//
+// Further processing is possible (e.g. scale and color space conversion)
+// through this interface. See ShouldCaptureFrame() for details.
+//
+// It is platform dependent which thread this object lives on, but it is
+// guaranteed to be used on a single thread.
+class RenderWidgetHostViewFrameSubscriber {
+ public:
+  virtual ~RenderWidgetHostViewFrameSubscriber() {}
+
+  // Called when a captured frame is available or the frame is no longer
+  // needed by the platform layer.
+  //
+  // If |frame_captured| is true then frame provided contains valid content and
+  // |timestamp| is the time when the frame was painted.
+  //
+  // If |frame_captured| is false then the content in frame provided is
+  // invalid. There was an error during the process of frame capture or the
+  // platform layer is shutting down. |timestamp| is also invalid in this case.
+  typedef base::Callback<void(base::TimeTicks /* timestamp */,
+                              bool /* frame_captured */)> DeliverFrameCallback;
+
+  // Called when a new frame is going to be presented at time
+  // |present_time|. Implementation can decide whether the current frame should
+  // be captured or not.
+  //
+  // Return true if the current frame should be captured. If so, |storage|
+  // should will be set to hold an appropriately sized and allocated buffer
+  // into which to copy the frame. The platform presenter will perform scaling
+  // and color space conversion to fit into the output frame.
+  //
+  // Destination format is determined by |storage|, currently only
+  // media::VideoFrame::YV12 is supported. Platform layer will perform color
+  // space conversion if needed.
+  //
+  // When the frame is available |callback| will be called. It is up to the
+  // platform layer to decide when to deliver a captured frame.
+  //
+  // Return false if the current frame should not be captured.
+  virtual bool ShouldCaptureFrame(base::TimeTicks present_time,
+                                  scoped_refptr<media::VideoFrame>* storage,
+                                  DeliverFrameCallback* callback) = 0;
+};
+
+}  // namespace content
+
+#endif  // CONTENT_PORT_BROWSER_RENDER_WIDGET_HOST_VIEW_FRAME_SUBSCRIBER_H_
diff --git a/chromium/content/public/browser/render_widget_host_view_mac_delegate.h b/chromium/content/public/browser/render_widget_host_view_mac_delegate.h
index 6bcf744631d..c00d8bd3109 100644
--- a/chromium/content/public/browser/render_widget_host_view_mac_delegate.h
+++ b/chromium/content/public/browser/render_widget_host_view_mac_delegate.h
@@ -7,6 +7,10 @@
 
 #import <Cocoa/Cocoa.h>
 
+namespace blink {
+class WebMouseWheelEvent;
+}
+
 // This protocol is used as a delegate for the NSView class used in the
 // hierarchy. There are two ways to extend the view:
 // - Implement the methods listed in the protocol below.
@@ -27,15 +31,6 @@
 // normal processing should take place.
 - (BOOL)handleEvent:(NSEvent*)event;
 
-// Notification that a wheel event was unhandled.
-- (void)gotUnhandledWheelEvent;
-
-// Notification of scroll offset pinning.
-- (void)scrollOffsetPinnedToLeft:(BOOL)left toRight:(BOOL)right;
-
-// Notification of whether the view has a horizontal scrollbar.
-- (void)setHasHorizontalScrollbar:(BOOL)has_horizontal_scrollbar;
-
 // Provides validation of user interface items. If the return value is NO, then
 // the delegate is unaware of that item and |valid| is undefined.  Otherwise,
 // |valid| contains the validity of the specified item.
@@ -55,6 +50,16 @@
 - (void)touchesCancelledWithEvent:(NSEvent*)event;
 - (void)touchesEndedWithEvent:(NSEvent*)event;
 
+// These methods control whether a given view is allowed to rubberband in the
+// given direction. This is inversely related to whether the view is allowed to
+// 2-finger history swipe in the given direction.
+- (BOOL)canRubberbandLeft:(NSView*)view;
+- (BOOL)canRubberbandRight:(NSView*)view;
+
+// The browser process received an ACK from the renderer after it processed
+// |event|.
+- (void)rendererHandledWheelEvent:(const blink::WebMouseWheelEvent&)event
+                         consumed:(BOOL)consumed;
 @end
 
 #endif  // CONTENT_PUBLIC_BROWSER_RENDER_WIDGET_HOST_VIEW_MAC_DELEGATE_H_
diff --git a/chromium/content/public/browser/resource_dispatcher_host.h b/chromium/content/public/browser/resource_dispatcher_host.h
index 0d4a624f2e8..7db278c8aac 100644
--- a/chromium/content/public/browser/resource_dispatcher_host.h
+++ b/chromium/content/public/browser/resource_dispatcher_host.h
@@ -6,7 +6,8 @@
 #define CONTENT_PUBLIC_BROWSER_RESOURCE_DISPATCHER_HOST_H_
 
 #include "base/callback_forward.h"
-#include "net/base/net_errors.h"
+#include "base/memory/scoped_ptr.h"
+#include "content/public/browser/download_interrupt_reasons.h"
 
 namespace net {
 class URLRequest;
@@ -22,8 +23,8 @@ struct Referrer;
 
 class CONTENT_EXPORT ResourceDispatcherHost {
  public:
-  typedef base::Callback<void(DownloadItem*, net::Error)>
-    DownloadStartedCallback;
+  typedef base::Callback<void(DownloadItem*, DownloadInterruptReason)>
+      DownloadStartedCallback;
 
   // Returns the singleton instance of the ResourceDispatcherHost.
   static ResourceDispatcherHost* Get();
@@ -45,8 +46,8 @@ class CONTENT_EXPORT ResourceDispatcherHost {
   // will be used.  (Note that this will result in re-use of an existing
   // download item if the download id was already assigned.)  If the download
   // is started, |started_callback| will be called on the UI thread with the
-  // DownloadItem; otherwise an error code will be returned.
-  virtual net::Error BeginDownload(
+  // DownloadItem; otherwise an interrupt reason will be returned.
+  virtual DownloadInterruptReason BeginDownload(
       scoped_ptr<net::URLRequest> request,
       const Referrer& referrer,
       bool is_content_initiated,
diff --git a/chromium/content/public/browser/resource_dispatcher_host_delegate.cc b/chromium/content/public/browser/resource_dispatcher_host_delegate.cc
index 4457de11bef..607b1af81d2 100644
--- a/chromium/content/public/browser/resource_dispatcher_host_delegate.cc
+++ b/chromium/content/public/browser/resource_dispatcher_host_delegate.cc
@@ -28,15 +28,6 @@ void ResourceDispatcherHostDelegate::RequestBeginning(
     ScopedVector<ResourceThrottle>* throttles) {
 }
 
-void ResourceDispatcherHostDelegate::WillTransferRequestToNewProcess(
-      int old_child_id,
-      int old_route_id,
-      int old_request_id,
-      int new_child_id,
-      int new_route_id,
-      int new_request_id) {
-}
-
 void ResourceDispatcherHostDelegate::DownloadStarting(
     net::URLRequest* request,
     ResourceContext* resource_context,
@@ -48,18 +39,6 @@ void ResourceDispatcherHostDelegate::DownloadStarting(
     ScopedVector<ResourceThrottle>* throttles) {
 }
 
-bool ResourceDispatcherHostDelegate::AcceptSSLClientCertificateRequest(
-    net::URLRequest* request,
-    net::SSLCertRequestInfo* cert_request_info) {
-  return false;
-}
-
-bool ResourceDispatcherHostDelegate::AcceptAuthRequest(
-    net::URLRequest* request,
-    net::AuthChallengeInfo* auth_info) {
-  return false;
-}
-
 ResourceDispatcherHostLoginDelegate*
     ResourceDispatcherHostDelegate::CreateLoginDelegate(
         net::AuthChallengeInfo* auth_info,
@@ -80,21 +59,16 @@ bool ResourceDispatcherHostDelegate::ShouldForceDownloadResource(
 }
 
 bool ResourceDispatcherHostDelegate::ShouldInterceptResourceAsStream(
-    content::ResourceContext* resource_context,
-    const GURL& url,
+    net::URLRequest* request,
     const std::string& mime_type,
     GURL* origin,
-    std::string* target_id) {
+    std::string* payload) {
   return false;
 }
 
 void ResourceDispatcherHostDelegate::OnStreamCreated(
-    content::ResourceContext* resource_context,
-    int render_process_id,
-    int render_view_id,
-    const std::string& target_id,
-    scoped_ptr<StreamHandle> stream,
-    int64 expected_content_size) {
+    net::URLRequest* request,
+    scoped_ptr<content::StreamHandle> stream) {
 }
 
 void ResourceDispatcherHostDelegate::OnResponseStarted(
@@ -111,6 +85,10 @@ void ResourceDispatcherHostDelegate::OnRequestRedirected(
     ResourceResponse* response) {
 }
 
+void ResourceDispatcherHostDelegate::RequestComplete(
+    net::URLRequest* url_request) {
+}
+
 ResourceDispatcherHostDelegate::ResourceDispatcherHostDelegate() {
 }
 
diff --git a/chromium/content/public/browser/resource_dispatcher_host_delegate.h b/chromium/content/public/browser/resource_dispatcher_host_delegate.h
index 3bc9b85a927..cb8b683cfa4 100644
--- a/chromium/content/public/browser/resource_dispatcher_host_delegate.h
+++ b/chromium/content/public/browser/resource_dispatcher_host_delegate.h
@@ -33,7 +33,6 @@ class Sender;
 
 namespace net {
 class AuthChallengeInfo;
-class SSLCertRequestInfo;
 class URLRequest;
 }
 
@@ -65,15 +64,6 @@ class CONTENT_EXPORT ResourceDispatcherHostDelegate {
       int route_id,
       ScopedVector<ResourceThrottle>* throttles);
 
-  // Called if a navigation request is transferred from one process to another.
-  virtual void WillTransferRequestToNewProcess(
-      int old_child_id,
-      int old_route_id,
-      int old_request_id,
-      int new_child_id,
-      int new_route_id,
-      int new_request_id);
-
   // Allows an embedder to add additional resource handlers for a download.
   // |must_download| is set if the request must be handled as a download.
   virtual void DownloadStarting(
@@ -86,19 +76,6 @@ class CONTENT_EXPORT ResourceDispatcherHostDelegate {
       bool must_download,
       ScopedVector<ResourceThrottle>* throttles);
 
-  // Called when an SSL Client Certificate is requested. If false is returned,
-  // the request is canceled. Otherwise, the certificate is chosen.
-  virtual bool AcceptSSLClientCertificateRequest(
-      net::URLRequest* request,
-      net::SSLCertRequestInfo* cert_request_info);
-
-  // Called when authentication is required and credentials are needed. If
-  // false is returned, CancelAuth() is called on the URLRequest and the error
-  // page is shown. If true is returned, the user will be prompted for
-  // authentication credentials.
-  virtual bool AcceptAuthRequest(net::URLRequest* request,
-                                 net::AuthChallengeInfo* auth_info);
-
   // Creates a ResourceDispatcherHostLoginDelegate that asks the user for a
   // username and password.
   virtual ResourceDispatcherHostLoginDelegate* CreateLoginDelegate(
@@ -116,32 +93,28 @@ class CONTENT_EXPORT ResourceDispatcherHostDelegate {
   virtual bool ShouldForceDownloadResource(
       const GURL& url, const std::string& mime_type);
 
-  // Returns true and sets |origin| and |target_id| if a Stream should be
-  // created for the resource.
+  // Returns true and sets |origin| if a Stream should be created for the
+  // resource.
   // If true is returned, a new Stream will be created and OnStreamCreated()
   // will be called with
-  // - the |target_id| returned by this function
   // - a StreamHandle instance for the Stream. The handle contains the URL for
   //   reading the Stream etc.
   // The Stream's origin will be set to |origin|.
+  //
+  // If the stream will be rendered in a BrowserPlugin, |payload| will contain
+  // the data that should be given to the old ResourceHandler to forward to the
+  // renderer process.
   virtual bool ShouldInterceptResourceAsStream(
-      content::ResourceContext* resource_context,
-      const GURL& url,
+      net::URLRequest* request,
       const std::string& mime_type,
       GURL* origin,
-      std::string* target_id);
+      std::string* payload);
 
-  // Informs the delegate that a Stream was created. |target_id| will be filled
-  // with the parameter returned by ShouldInterceptResourceAsStream(). The
-  // Stream can be read from the blob URL of the Stream, but can only be read
-  // once.
+  // Informs the delegate that a Stream was created. The Stream can be read from
+  // the blob URL of the Stream, but can only be read once.
   virtual void OnStreamCreated(
-      content::ResourceContext* resource_context,
-      int render_process_id,
-      int render_view_id,
-      const std::string& target_id,
-      scoped_ptr<StreamHandle> stream,
-      int64 expected_content_size);
+      net::URLRequest* request,
+      scoped_ptr<content::StreamHandle> stream);
 
   // Informs the delegate that a response has started.
   virtual void OnResponseStarted(
@@ -157,6 +130,9 @@ class CONTENT_EXPORT ResourceDispatcherHostDelegate {
       ResourceContext* resource_context,
       ResourceResponse* response);
 
+  // Notification that a request has completed.
+  virtual void RequestComplete(net::URLRequest* url_request);
+
  protected:
   ResourceDispatcherHostDelegate();
   virtual ~ResourceDispatcherHostDelegate();
diff --git a/chromium/content/public/browser/resource_request_details.cc b/chromium/content/public/browser/resource_request_details.cc
index 7b92c845689..a5b91b90d05 100644
--- a/chromium/content/public/browser/resource_request_details.cc
+++ b/chromium/content/public/browser/resource_request_details.cc
@@ -6,6 +6,7 @@
 
 #include "content/browser/worker_host/worker_service_impl.h"
 #include "content/public/browser/resource_request_info.h"
+#include "net/http/http_response_headers.h"
 #include "net/url_request/url_request.h"
 
 namespace content {
@@ -24,7 +25,10 @@ ResourceRequestDetails::ResourceRequestDetails(const net::URLRequest* request,
       socket_address(request->GetSocketAddress()) {
   const ResourceRequestInfo* info = ResourceRequestInfo::ForRequest(request);
   resource_type = info->GetResourceType();
-  frame_id = info->GetFrameID();
+  render_frame_id = info->GetRenderFrameID();
+  http_response_code =
+      request->response_info().headers.get() ?
+          request->response_info().headers.get()->response_code() : -1;
 
   // If request is from the worker process on behalf of a renderer, use
   // the renderer process id, since it consumes the notification response
@@ -33,10 +37,10 @@ ResourceRequestDetails::ResourceRequestDetails(const net::URLRequest* request,
   // of ssl state change (http://crbug.com/25357). For now, just notify
   // the first one (works for dedicated workers and shared workers with
   // a single process).
+  int worker_render_frame_id;
   if (!WorkerServiceImpl::GetInstance()->GetRendererForWorker(
-          info->GetChildID(), &origin_child_id, &origin_route_id)) {
+          info->GetChildID(), &origin_child_id, &worker_render_frame_id)) {
     origin_child_id = info->GetChildID();
-    origin_route_id = info->GetRouteID();
   }
 }
 
diff --git a/chromium/content/public/browser/resource_request_details.h b/chromium/content/public/browser/resource_request_details.h
index 1c20557fd59..0127fefef22 100644
--- a/chromium/content/public/browser/resource_request_details.h
+++ b/chromium/content/public/browser/resource_request_details.h
@@ -34,13 +34,15 @@ struct ResourceRequestDetails {
   bool has_upload;
   int load_flags;
   int origin_child_id;
-  int origin_route_id;
   net::URLRequestStatus status;
   int ssl_cert_id;
   net::CertStatus ssl_cert_status;
   ResourceType::Type resource_type;
   net::HostPortPair socket_address;
-  int64 frame_id;
+  int render_frame_id;
+  // HTTP response code. See HttpResponseHeaders::response_code().
+  // -1 if there are no response headers yet.
+  int http_response_code;
 };
 
 // Details about a redirection of a resource request.
diff --git a/chromium/content/public/browser/resource_request_info.h b/chromium/content/public/browser/resource_request_info.h
index 1c191ab607d..f0badee0f7c 100644
--- a/chromium/content/public/browser/resource_request_info.h
+++ b/chromium/content/public/browser/resource_request_info.h
@@ -9,6 +9,7 @@
 #include "content/common/content_export.h"
 #include "content/public/common/page_transition_types.h"
 #include "third_party/WebKit/public/platform/WebReferrerPolicy.h"
+#include "third_party/WebKit/public/web/WebPageVisibilityState.h"
 #include "webkit/common/resource_type.h"
 
 namespace net {
@@ -35,16 +36,17 @@ class ResourceRequestInfo {
       ResourceContext* context,
       int render_process_id,
       int render_view_id,
+      int render_frame_id,
       bool is_async);
 
-  // Returns the associated RenderView for a given process. Returns false, if
-  // there is no associated RenderView. This method does not rely on the
+  // Returns the associated RenderFrame for a given process. Returns false, if
+  // there is no associated RenderFrame. This method does not rely on the
   // request being allocated by the ResourceDispatcherHost, but works for all
-  // URLRequests that are associated with a RenderView.
-  CONTENT_EXPORT static bool GetRenderViewForRequest(
+  // URLRequests that are associated with a RenderFrame.
+  CONTENT_EXPORT static bool GetRenderFrameForRequest(
       const net::URLRequest* request,
       int* render_process_id,
-      int* render_view_id);
+      int* render_frame_id);
 
   // Returns the associated ResourceContext.
   virtual ResourceContext* GetContext() const = 0;
@@ -69,25 +71,29 @@ class ResourceRequestInfo {
   // just use GetRouteID above.
   virtual int GetRenderFrameID() const = 0;
 
-  // True if GetFrameID() represents a main frame in the RenderView.
+  // True if GetRenderFrameID() represents a main frame in the RenderView.
   virtual bool IsMainFrame() const = 0;
 
-  // Frame ID that sent this resource request. -1 if unknown / invalid.
-  virtual int64 GetFrameID() const = 0;
-
-  // True if GetParentFrameID() represents a main frame in the RenderView.
+  // True if GetParentRenderFrameID() represents a main frame in the RenderView.
   virtual bool ParentIsMainFrame() const = 0;
 
-  // Frame ID of parent frame of frame that sent this resource request.
+  // Routing ID of parent frame of frame that sent this resource request.
   // -1 if unknown / invalid.
-  virtual int64 GetParentFrameID() const = 0;
+  virtual int GetParentRenderFrameID() const = 0;
 
   // Returns the associated resource type.
   virtual ResourceType::Type GetResourceType() const = 0;
 
+  // Returns the process type that initiated this request.
+  virtual int GetProcessType() const = 0;
+
   // Returns the associated referrer policy.
   virtual blink::WebReferrerPolicy GetReferrerPolicy() const = 0;
 
+  // Returns the associated visibility state at the time the request was started
+  // in the renderer.
+  virtual blink::WebPageVisibilityState GetVisibilityState() const = 0;
+
   // Returns the associated page transition type.
   virtual PageTransition GetPageTransition() const = 0;
 
@@ -99,9 +105,9 @@ class ResourceRequestInfo {
   // the requested URL may be being loaded by an external program.
   virtual bool WasIgnoredByHandler() const = 0;
 
-  // Returns false if there is NOT an associated render view.
-  virtual bool GetAssociatedRenderView(int* render_process_id,
-                                       int* render_view_id) const = 0;
+  // Returns false if there is NOT an associated render frame.
+  virtual bool GetAssociatedRenderFrame(int* render_process_id,
+                                        int* render_frame_id) const = 0;
 
   // Returns true if this is associated with an asynchronous request.
   virtual bool IsAsync() const = 0;
diff --git a/chromium/content/public/browser/resource_throttle.h b/chromium/content/public/browser/resource_throttle.h
index 7bcab8813c1..469782d9dfd 100644
--- a/chromium/content/public/browser/resource_throttle.h
+++ b/chromium/content/public/browser/resource_throttle.h
@@ -25,6 +25,7 @@ class ResourceThrottle {
   virtual void WillStartRequest(bool* defer) {}
   virtual void WillRedirectRequest(const GURL& new_url, bool* defer) {}
   virtual void WillProcessResponse(bool* defer) {}
+  virtual void OnBeforeNetworkStart(bool* defer) {}
 
   // Returns the name of the throttle, as a UTF-8 C-string, for logging
   // purposes.  NULL is not allowed.  Caller does *not* take ownership of the
diff --git a/chromium/content/public/browser/service_worker_context.h b/chromium/content/public/browser/service_worker_context.h
new file mode 100644
index 00000000000..2d0805e9b99
--- /dev/null
+++ b/chromium/content/public/browser/service_worker_context.h
@@ -0,0 +1,64 @@
+// Copyright 2014 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_PUBLIC_BROWSER_SERVICE_WORKER_CONTEXT_H_
+#define CONTENT_PUBLIC_BROWSER_SERVICE_WORKER_CONTEXT_H_
+
+#include "base/basictypes.h"
+#include "base/callback_forward.h"
+#include "url/gurl.h"
+
+namespace content {
+
+// Represents the per-StoragePartition ServiceWorker data.  Must be used from
+// the UI thread.
+class ServiceWorkerContext {
+ public:
+  // https://rawgithub.com/slightlyoff/ServiceWorker/master/spec/service_worker/index.html#url-scope:
+  // roughly, must be of the form "<origin>/<path>/*".
+  typedef GURL Scope;
+
+  typedef base::Callback<void(bool success)> ResultCallback;
+
+  // Equivalent to calling navigator.serviceWorker.register(script_url, {scope:
+  // pattern}) from a renderer, except that |pattern| is an absolute URL instead
+  // of relative to some current origin.  |callback| is passed true when the JS
+  // promise is fulfilled or false when the JS promise is rejected.
+  //
+  // The registration can fail if:
+  //  * |script_url| is on a different origin from |pattern|
+  //  * Fetching |script_url| fails.
+  //  * |script_url| fails to parse or its top-level execution fails.
+  //    TODO: The error message for this needs to be available to developers.
+  //  * Something unexpected goes wrong, like a renderer crash or a full disk.
+  virtual void RegisterServiceWorker(const Scope& pattern,
+                                     const GURL& script_url,
+                                     const ResultCallback& callback) = 0;
+
+  // Equivalent to calling navigator.serviceWorker.unregister(pattern) from a
+  // renderer, except that |pattern| is an absolute URL instead of relative to
+  // some current origin.  |callback| is passed true when the JS promise is
+  // fulfilled or false when the JS promise is rejected.
+  //
+  // Unregistration can fail if:
+  //  * No Service Worker was registered for |pattern|.
+  //  * Something unexpected goes wrong, like a renderer crash.
+  virtual void UnregisterServiceWorker(const Scope& pattern,
+                                       const ResultCallback& callback) = 0;
+
+  // TODO(jyasskin): Provide a way to SendMessage to a Scope.
+
+  // Synchronously releases all of the RenderProcessHosts that have Service
+  // Workers running inside them, and prevents any new Service Worker instances
+  // from starting up.
+  virtual void Terminate() = 0;
+
+ protected:
+  ServiceWorkerContext() {}
+  virtual ~ServiceWorkerContext() {}
+};
+
+}  // namespace content
+
+#endif  // CONTENT_PUBLIC_BROWSER_SERVICE_WORKER_CONTEXT_H_
diff --git a/chromium/content/public/browser/session_storage_namespace.h b/chromium/content/public/browser/session_storage_namespace.h
index ec49419ffb3..374b7b050fb 100644
--- a/chromium/content/public/browser/session_storage_namespace.h
+++ b/chromium/content/public/browser/session_storage_namespace.h
@@ -5,6 +5,7 @@
 #ifndef CONTENT_PUBLIC_BROWSER_SESSION_STORAGE_NAMESPACE_H_
 #define CONTENT_PUBLIC_BROWSER_SESSION_STORAGE_NAMESPACE_H_
 
+#include <map>
 #include <string>
 
 #include "base/basictypes.h"
@@ -79,6 +80,10 @@ class SessionStorageNamespace
   virtual ~SessionStorageNamespace() {}
 };
 
+// Used to store mappings of StoragePartition id to SessionStorageNamespace.
+typedef std::map<std::string, scoped_refptr<SessionStorageNamespace> >
+    SessionStorageNamespaceMap;
+
 }  // namespace content
 
 #endif  // CONTENT_PUBLIC_BROWSER_SESSION_STORAGE_NAMESPACE_H_
diff --git a/chromium/content/public/browser/site_instance.h b/chromium/content/public/browser/site_instance.h
index 2cede0abf41..9c9e6633864 100644
--- a/chromium/content/public/browser/site_instance.h
+++ b/chromium/content/public/browser/site_instance.h
@@ -12,7 +12,6 @@
 
 namespace content {
 class BrowserContext;
-class BrowsingInstance;
 class RenderProcessHost;
 
 ///////////////////////////////////////////////////////////////////////////////
@@ -107,6 +106,10 @@ class CONTENT_EXPORT SiteInstance : public base::RefCounted<SiteInstance> {
   // origins (e.g., postMessage) should be supported.
   virtual bool IsRelatedSiteInstance(const SiteInstance* instance) = 0;
 
+  // Returns the total active WebContents count for this SiteInstance and all
+  // related SiteInstances in the same BrowsingInstance.
+  virtual size_t GetRelatedActiveContentsCount() = 0;
+
   // Factory method to create a new SiteInstance.  This will create a new
   // new BrowsingInstance, so it should only be used when creating a new tab
   // from scratch (or similar circumstances).  Callers should ensure that
diff --git a/chromium/content/public/browser/speech_recognition_session_config.h b/chromium/content/public/browser/speech_recognition_session_config.h
index 813fbd1056a..1cde6430b0d 100644
--- a/chromium/content/public/browser/speech_recognition_session_config.h
+++ b/chromium/content/public/browser/speech_recognition_session_config.h
@@ -22,7 +22,9 @@ struct CONTENT_EXPORT SpeechRecognitionSessionConfig {
   SpeechRecognitionSessionConfig();
   ~SpeechRecognitionSessionConfig();
 
+  // TODO(hans): The legacy API is dead; remove this flag (crbug.com/223198).
   bool is_legacy_api;
+
   std::string language;
   SpeechRecognitionGrammarArray grammars;
   std::string origin_url;
diff --git a/chromium/content/public/browser/speech_recognition_session_context.cc b/chromium/content/public/browser/speech_recognition_session_context.cc
index f362ef34f18..9b6575b4f0e 100644
--- a/chromium/content/public/browser/speech_recognition_session_context.cc
+++ b/chromium/content/public/browser/speech_recognition_session_context.cc
@@ -14,8 +14,7 @@ SpeechRecognitionSessionContext::SpeechRecognitionSessionContext()
       guest_render_view_id(MSG_ROUTING_NONE),
       embedder_render_process_id(0),
       embedder_render_view_id(MSG_ROUTING_NONE),
-      request_id(0),
-      requested_by_page_element(true) {
+      request_id(0) {
 }
 
 SpeechRecognitionSessionContext::~SpeechRecognitionSessionContext() {
diff --git a/chromium/content/public/browser/speech_recognition_session_context.h b/chromium/content/public/browser/speech_recognition_session_context.h
index 5606b78f352..d092a5daf04 100644
--- a/chromium/content/public/browser/speech_recognition_session_context.h
+++ b/chromium/content/public/browser/speech_recognition_session_context.h
@@ -46,14 +46,6 @@ struct CONTENT_EXPORT SpeechRecognitionSessionContext {
 
   int request_id;
 
-  // Determines whether recognition was requested by a page element (in which
-  // case its coordinates are passed in |element_rect|).
-  bool requested_by_page_element;
-
-  // The coordinates of the page element for placing the bubble (valid only when
-  // |requested_by_page_element| = true).
-  gfx::Rect element_rect;
-
   // A texual description of the context (website, extension name) that is
   // requesting recognition, for prompting security notifications to the user.
   std::string context_name;
diff --git a/chromium/content/public/browser/storage_partition.h b/chromium/content/public/browser/storage_partition.h
index 579ccbcbb44..3a4139d633b 100644
--- a/chromium/content/public/browser/storage_partition.h
+++ b/chromium/content/public/browser/storage_partition.h
@@ -38,6 +38,7 @@ namespace content {
 class BrowserContext;
 class IndexedDBContext;
 class DOMStorageContext;
+class ServiceWorkerContext;
 
 // Defines what persistent state a child process can access.
 //
@@ -56,6 +57,7 @@ class StoragePartition {
   virtual webkit_database::DatabaseTracker* GetDatabaseTracker() = 0;
   virtual DOMStorageContext* GetDOMStorageContext() = 0;
   virtual IndexedDBContext* GetIndexedDBContext() = 0;
+  virtual ServiceWorkerContext* GetServiceWorkerContext() = 0;
 
   enum RemoveDataMask {
     REMOVE_DATA_MASK_APPCACHE = 1 << 0,
@@ -113,7 +115,7 @@ class StoragePartition {
   // scheduled.
   virtual void ClearData(uint32 remove_mask,
                          uint32 quota_storage_remove_mask,
-                         const GURL* storage_origin,
+                         const GURL& storage_origin,
                          const OriginMatcherFunction& origin_matcher,
                          const base::Time begin,
                          const base::Time end,
diff --git a/chromium/content/public/browser/stream_handle.h b/chromium/content/public/browser/stream_handle.h
index 5965a40350e..94591d7d41d 100644
--- a/chromium/content/public/browser/stream_handle.h
+++ b/chromium/content/public/browser/stream_handle.h
@@ -6,9 +6,14 @@
 #define CONTENT_PUBLIC_BROWSER_STREAM_HANDLE_H_
 
 #include "base/callback.h"
+#include "base/memory/ref_counted.h"
 #include "content/common/content_export.h"
 #include "url/gurl.h"
 
+namespace net {
+class HttpResponseHeaders;
+}
+
 namespace content {
 
 class CONTENT_EXPORT StreamHandle {
@@ -23,6 +28,12 @@ class CONTENT_EXPORT StreamHandle {
 
   // Get the MIME type associated with this Stream.
   virtual const std::string& GetMimeType() = 0;
+
+  // Get the HTTP response headers associated with this Stream.
+  virtual scoped_refptr<net::HttpResponseHeaders> GetResponseHeaders() = 0;
+
+  // Add a callback which will be called when the Stream is closed.
+  virtual void AddCloseListener(const base::Closure& callback) = 0;
 };
 
 }  // namespace content
diff --git a/chromium/content/public/browser/url_data_source.cc b/chromium/content/public/browser/url_data_source.cc
index d9506f50cf3..148e62ab229 100644
--- a/chromium/content/public/browser/url_data_source.cc
+++ b/chromium/content/public/browser/url_data_source.cc
@@ -46,8 +46,8 @@ bool URLDataSource::ShouldDenyXFrameOptions() const {
 }
 
 bool URLDataSource::ShouldServiceRequest(const net::URLRequest* request) const {
-  if (request->url().SchemeIs(chrome::kChromeDevToolsScheme) ||
-      request->url().SchemeIs(chrome::kChromeUIScheme))
+  if (request->url().SchemeIs(kChromeDevToolsScheme) ||
+      request->url().SchemeIs(kChromeUIScheme))
     return true;
   return false;
 }
diff --git a/chromium/content/public/browser/url_data_source.h b/chromium/content/public/browser/url_data_source.h
index d93e51e4d87..33c185b63b8 100644
--- a/chromium/content/public/browser/url_data_source.h
+++ b/chromium/content/public/browser/url_data_source.h
@@ -36,7 +36,11 @@ class CONTENT_EXPORT URLDataSource {
 
   // The name of this source.
   // E.g., for favicons, this could be "favicon", which results in paths for
-  // specific resources like "favicon/34" getting sent to this source.
+  // specific resources like "favicon/34" getting sent to this source. For
+  // sources where a scheme is used instead of the hostname as the unique
+  // identifier, the suffix "://" must be added to the return value, eg. for a
+  // URLDataSource which would display resources with URLs on the form
+  // your-scheme://anything , GetSource() must return "your-scheme://".
   virtual std::string GetSource() const = 0;
 
   // Used by StartDataRequest so that the child class can return the data when
@@ -49,7 +53,7 @@ class CONTENT_EXPORT URLDataSource {
   // called either in this callback or asynchronously with the response.
   virtual void StartDataRequest(const std::string& path,
                                 int render_process_id,
-                                int render_view_id,
+                                int render_frame_id,
                                 const GotDataCallback& callback) = 0;
 
   // Return the mimetype that should be sent with this response, or empty
diff --git a/chromium/content/public/browser/user_metrics.h b/chromium/content/public/browser/user_metrics.h
index e9480acaea3..118d8a93ae3 100644
--- a/chromium/content/public/browser/user_metrics.h
+++ b/chromium/content/public/browser/user_metrics.h
@@ -8,50 +8,17 @@
 #include <string>
 
 #include "base/callback.h"
+#include "base/metrics/user_metrics_action.h"
 #include "content/common/content_export.h"
-#include "content/public/common/user_metrics_action.h"
 
 namespace content {
 
-// This module provides some helper functions for logging actions tracked by
-// the user metrics system.
-
-// Record that the user performed an action.
-// "Action" here means a user-generated event:
-//   good: "Reload", "CloseTab", and "IMEInvoked"
-//   not good: "SSLDialogShown", "PageLoaded", "DiskFull"
-// We use this to gather anonymized information about how users are
-// interacting with the browser.
-// WARNING: In calls to this function, UserMetricsAction and a
-// string literal parameter must be on the same line, e.g.
-//   content::RecordAction(
-//       content::UserMetricsAction("my extremely long action name"));
-// This ensures that our processing scripts can associate this action's hash
-// with its metric name. Therefore, it will be possible to retrieve the metric
-// name from the hash later on.
-//
-// Once a new recorded action is added, run
-// tools/metrics/actions/extract_actions.py --hash
-// to generate a new mapping of [action hashes -> metric names] and send it
-// out for review to be updated.
-//
-// For more complicated situations (like when there are many different
-// possible actions), see RecordComputedAction.
-CONTENT_EXPORT void RecordAction(const UserMetricsAction& action);
-
-// This function has identical input and behavior to RecordAction, but is
-// not automatically found by the action-processing scripts.  It can be used
-// when it's a pain to enumerate all possible actions, but if you use this
-// you need to also update the rules for extracting known actions in
-// tools/metrics/actions/extract_actions.py.
-CONTENT_EXPORT void RecordComputedAction(const std::string& action);
-
-// Called with the action string.
-typedef base::Callback<void(const std::string&)> ActionCallback;
+// Wrappers around functions defined in base/metrics/user_metrics.h, refer to
+// that header for full documentation. These wrappers can be called from any
+// thread (they will post back to the UI thread to do the recording).
 
-// Add/remove action callbacks (see above).
-CONTENT_EXPORT void AddActionCallback(const ActionCallback& callback);
-CONTENT_EXPORT void RemoveActionCallback(const ActionCallback& callback);
+CONTENT_EXPORT void RecordAction(const base::UserMetricsAction& action);
+CONTENT_EXPORT void RecordComputedAction(const std::string& action);
 
 }  // namespace content
 
diff --git a/chromium/content/public/browser/utility_process_host.h b/chromium/content/public/browser/utility_process_host.h
index 1f027a8610b..756d50f1d1e 100644
--- a/chromium/content/public/browser/utility_process_host.h
+++ b/chromium/content/public/browser/utility_process_host.h
@@ -20,9 +20,6 @@ namespace content {
 class UtilityProcessHostClient;
 struct ChildProcessData;
 
-typedef base::Thread* (*UtilityMainThreadFactoryFunction)(
-    const std::string& id);
-
 // This class acts as the browser-side host to a utility child process.  A
 // utility process is a short-lived process that is created to run a specific
 // task.  This class lives solely on the IO thread.
@@ -61,15 +58,17 @@ class UtilityProcessHost : public IPC::Sender,
   // Make the process run without a sandbox.
   virtual void DisableSandbox() = 0;
 
+#if defined(OS_WIN)
+  // Make the process run elevated.
+  virtual void ElevatePrivileges() = 0;
+#endif
+
   // Returns information about the utility child process.
   virtual const ChildProcessData& GetData() = 0;
 
 #if defined(OS_POSIX)
   virtual void SetEnv(const base::EnvironmentMap& env) = 0;
 #endif
-
-  CONTENT_EXPORT static void RegisterUtilityMainThreadFactory(
-      UtilityMainThreadFactoryFunction create);
 };
 
 };  // namespace content
diff --git a/chromium/content/public/browser/utility_process_host_client.h b/chromium/content/public/browser/utility_process_host_client.h
index 73d707bb18a..bd7e89d6203 100644
--- a/chromium/content/public/browser/utility_process_host_client.h
+++ b/chromium/content/public/browser/utility_process_host_client.h
@@ -23,6 +23,9 @@ class UtilityProcessHostClient
   // Called when the process has crashed.
   virtual void OnProcessCrashed(int exit_code) {}
 
+  // Called when the process fails to launch, i.e. it has no exit code.
+  virtual void OnProcessLaunchFailed() {}
+
   // Allow the client to filter IPC messages.
   virtual bool OnMessageReceived(const IPC::Message& message) = 0;
 
diff --git a/chromium/content/public/browser/vibration_provider.h b/chromium/content/public/browser/vibration_provider.h
new file mode 100644
index 00000000000..71eba76a2da
--- /dev/null
+++ b/chromium/content/public/browser/vibration_provider.h
@@ -0,0 +1,23 @@
+// Copyright 2013 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_PUBLIC_BROWSER_VIBRATION_PROVIDER_H_
+#define CONTENT_PUBLIC_BROWSER_VIBRATION_PROVIDER_H_
+
+namespace content {
+
+class VibrationProvider {
+ public:
+  // Device should start vibrating for N milliseconds.
+  virtual void Vibrate(int64 milliseconds) = 0;
+
+  // Cancels vibration of the device.
+  virtual void CancelVibration() = 0;
+
+  virtual ~VibrationProvider() {}
+};
+
+}  // namespace content
+
+#endif // CONTENT_PUBLIC_BROWSER_VIBRATION_PROVIDER_H_
diff --git a/chromium/content/public/browser/web_contents.cc b/chromium/content/public/browser/web_contents.cc
index d8547679ba1..549e881c748 100644
--- a/chromium/content/public/browser/web_contents.cc
+++ b/chromium/content/public/browser/web_contents.cc
@@ -12,9 +12,11 @@ WebContents::CreateParams::CreateParams(BrowserContext* context)
     : browser_context(context),
       site_instance(NULL),
       opener(NULL),
+      opener_suppressed(false),
       routing_id(MSG_ROUTING_NONE),
       main_frame_routing_id(MSG_ROUTING_NONE),
       initially_hidden(false),
+      guest_instance_id(0),
       context(NULL) {}
 
 WebContents::CreateParams::CreateParams(
@@ -22,9 +24,14 @@ WebContents::CreateParams::CreateParams(
     : browser_context(context),
       site_instance(site),
       opener(NULL),
+      opener_suppressed(false),
       routing_id(MSG_ROUTING_NONE),
       main_frame_routing_id(MSG_ROUTING_NONE),
       initially_hidden(false),
+      guest_instance_id(0),
       context(NULL) {}
 
+WebContents::CreateParams::~CreateParams() {
+}
+
 }  // namespace content
diff --git a/chromium/content/public/browser/web_contents.h b/chromium/content/public/browser/web_contents.h
index 0f59c773096..0e388764929 100644
--- a/chromium/content/public/browser/web_contents.h
+++ b/chromium/content/public/browser/web_contents.h
@@ -18,23 +18,24 @@
 #include "content/public/browser/page_navigator.h"
 #include "content/public/browser/save_page_type.h"
 #include "content/public/browser/web_ui.h"
+#include "content/public/common/stop_find_action.h"
 #include "ipc/ipc_sender.h"
 #include "third_party/skia/include/core/SkColor.h"
 #include "ui/base/window_open_disposition.h"
 #include "ui/gfx/native_widget_types.h"
-#include "ui/gfx/size.h"
+#include "ui/gfx/rect.h"
 
 #if defined(OS_ANDROID)
 #include "base/android/scoped_java_ref.h"
 #endif
 
 namespace base {
+class DictionaryValue;
 class TimeTicks;
 }
 
-namespace gfx {
-class Rect;
-class Size;
+namespace blink {
+struct WebFindOptions;
 }
 
 namespace net {
@@ -52,7 +53,8 @@ class RenderViewHost;
 class RenderWidgetHostView;
 class SiteInstance;
 class WebContentsDelegate;
-class WebContentsView;
+struct CustomContextMenuContext;
+struct DropData;
 struct RendererPreferences;
 
 // WebContents is the core class in content/. A WebContents renders web content
@@ -62,7 +64,7 @@ struct RendererPreferences;
 //   scoped_ptr<content::WebContents> web_contents(
 //       content::WebContents::Create(
 //           content::WebContents::CreateParams(browser_context)));
-//   gfx::NativeView view = web_contents->GetView()->GetNativeView();
+//   gfx::NativeView view = web_contents->GetNativeView();
 //   // |view| is an HWND, NSView*, GtkWidget*, etc.; insert it into the view
 //   // hierarchy wherever it needs to go.
 //
@@ -81,6 +83,7 @@ class WebContents : public PageNavigator,
  public:
   struct CONTENT_EXPORT CreateParams {
     explicit CreateParams(BrowserContext* context);
+    ~CreateParams();
     CreateParams(BrowserContext* context, SiteInstance* site);
 
     BrowserContext* browser_context;
@@ -90,7 +93,13 @@ class WebContents : public PageNavigator,
     // privileged process.
     SiteInstance* site_instance;
 
+    // The opener WebContents is the WebContents that initiated this request,
+    // if any.
     WebContents* opener;
+
+    // If the opener is suppressed, then the new WebContents doesn't hold a
+    // reference to its opener.
+    bool opener_suppressed;
     int routing_id;
     int main_frame_routing_id;
 
@@ -100,6 +109,14 @@ class WebContents : public PageNavigator,
     // True if the contents should be initially hidden.
     bool initially_hidden;
 
+    // If this instance ID is non-zero then it indicates that this WebContents
+    // should behave as a guest.
+    int guest_instance_id;
+
+    // TODO(fsamuel): This is temporary. Remove this once all guests are created
+    // from the content embedder.
+    scoped_ptr<base::DictionaryValue> guest_extra_params;
+
     // Used to specify the location context which display the new view should
     // belong. This can be NULL if not needed.
     gfx::NativeView context;
@@ -127,6 +144,8 @@ class WebContents : public PageNavigator,
   CONTENT_EXPORT static WebContents* FromRenderViewHost(
       const RenderViewHost* rvh);
 
+  CONTENT_EXPORT static WebContents* FromRenderFrameHost(RenderFrameHost* rfh);
+
   virtual ~WebContents() {}
 
   // Intrinsic tab state -------------------------------------------------------
@@ -156,7 +175,7 @@ class WebContents : public PageNavigator,
   virtual const GURL& GetVisibleURL() const = 0;
 
   // Gets the last committed URL. It represents the current page that is
-  // displayed in  this WebContents. It represents the current security
+  // displayed in this WebContents. It represents the current security
   // context.
   virtual const GURL& GetLastCommittedURL() const = 0;
 
@@ -167,30 +186,20 @@ class WebContents : public PageNavigator,
   // Returns the main frame for the currently active view.
   virtual RenderFrameHost* GetMainFrame() = 0;
 
+  // Returns the focused frame for the currently active view.
+  virtual RenderFrameHost* GetFocusedFrame() = 0;
+
+  // Calls |on_frame| for each frame in the currently active view.
+  virtual void ForEachFrame(
+      const base::Callback<void(RenderFrameHost*)>& on_frame) = 0;
+
+  // Sends the given IPC to all frames in the currently active view. This is a
+  // convenience method instead of calling ForEach.
+  virtual void SendToAllFrames(IPC::Message* message) = 0;
+
   // Gets the current RenderViewHost for this tab.
   virtual RenderViewHost* GetRenderViewHost() const = 0;
 
-  typedef base::Callback<void(RenderViewHost* /* render_view_host */,
-                              int /* x */,
-                              int /* y */)> GetRenderViewHostCallback;
-  // Gets the RenderViewHost at coordinates (|x|, |y|) for this WebContents via
-  // |callback|.
-  // This can be different than the current RenderViewHost if there is a
-  // BrowserPlugin at the specified position.
-  virtual void GetRenderViewHostAtPosition(
-      int x,
-      int y,
-      const GetRenderViewHostCallback& callback) = 0;
-
-  // Returns the WebContents embedding this WebContents, if any.
-  // If this is a top-level WebContents then it returns NULL.
-  virtual WebContents* GetEmbedderWebContents() const = 0;
-
-  // Gets the instance ID of the current WebContents if it is embedded
-  // within a BrowserPlugin. The instance ID of a WebContents uniquely
-  // identifies it within its embedder WebContents.
-  virtual int GetEmbeddedInstanceID() const = 0;
-
   // Gets the current RenderViewHost's routing id. Returns
   // MSG_ROUTING_NONE when there is no RenderViewHost.
   virtual int GetRoutingID() const = 0;
@@ -203,9 +212,6 @@ class WebContents : public PageNavigator,
   // NULL.
   virtual RenderWidgetHostView* GetFullscreenRenderWidgetHostView() const = 0;
 
-  // The WebContentsView will never change and is guaranteed non-NULL.
-  virtual WebContentsView* GetView() const = 0;
-
   // Create a WebUI page for the given url. In most cases, this doesn't need to
   // be called by embedders since content will create its own WebUI objects as
   // necessary. However if the embedder wants to create its own WebUI object and
@@ -220,7 +226,7 @@ class WebContents : public PageNavigator,
   virtual void SetUserAgentOverride(const std::string& override) = 0;
   virtual const std::string& GetUserAgentOverride() const = 0;
 
-#if defined(OS_WIN) && defined(USE_AURA)
+#if defined(OS_WIN)
   virtual void SetParentNativeViewAccessible(
       gfx::NativeViewAccessible accessible_parent) = 0;
 #endif
@@ -249,25 +255,30 @@ class WebContents : public PageNavigator,
   // returns the current SiteInstance.
   virtual SiteInstance* GetPendingSiteInstance() const = 0;
 
-  // Return whether this WebContents is loading a resource.
+  // Returns whether this WebContents is loading a resource.
   virtual bool IsLoading() const = 0;
 
+  // Returns whether this WebContents is loading and and the load is to a
+  // different top-level document (rather than being a navigation within the
+  // same document). This being true implies that IsLoading() is also true.
+  virtual bool IsLoadingToDifferentDocument() const = 0;
+
   // Returns whether this WebContents is waiting for a first-response for the
   // main resource of the page.
   virtual bool IsWaitingForResponse() const = 0;
 
-  // Return the current load state and the URL associated with it.
+  // Returns the current load state and the URL associated with it.
   virtual const net::LoadStateWithParam& GetLoadState() const = 0;
   virtual const base::string16& GetLoadStateHost() const = 0;
 
-  // Return the upload progress.
+  // Returns the upload progress.
   virtual uint64 GetUploadSize() const = 0;
   virtual uint64 GetUploadPosition() const = 0;
 
   // Returns a set of the site URLs currently committed in this tab.
   virtual std::set<GURL> GetSitesInTab() const = 0;
 
-  // Return the character encoding of the page.
+  // Returns the character encoding of the page.
   virtual const std::string& GetEncoding() const = 0;
 
   // True if this is a secure page which displayed insecure content.
@@ -277,8 +288,11 @@ class WebContents : public PageNavigator,
 
   // Indicates whether the WebContents is being captured (e.g., for screenshots
   // or mirroring).  Increment calls must be balanced with an equivalent number
-  // of decrement calls.
-  virtual void IncrementCapturerCount() = 0;
+  // of decrement calls.  |capture_size| specifies the capturer's video
+  // resolution, but can be empty to mean "unspecified."  The first screen
+  // capturer that provides a non-empty |capture_size| will override the value
+  // returned by GetPreferredSize() until all captures have ended.
+  virtual void IncrementCapturerCount(const gfx::Size& capture_size) = 0;
   virtual void DecrementCapturerCount() = 0;
   virtual int GetCapturerCount() const = 0;
 
@@ -296,8 +310,9 @@ class WebContents : public PageNavigator,
   // change. See InvalidateType enum.
   virtual void NotifyNavigationStateChanged(unsigned changed_flags) = 0;
 
-  // Get the last time that the WebContents was made visible with WasShown()
-  virtual base::TimeTicks GetLastSelectedTime() const = 0;
+  // Get the last time that the WebContents was made active (either when it was
+  // created or shown with WasShown()).
+  virtual base::TimeTicks GetLastActiveTime() const = 0;
 
   // Invoked when the WebContents becomes shown/hidden.
   virtual void WasShown() = 0;
@@ -309,6 +324,17 @@ class WebContents : public PageNavigator,
   // returns false.
   virtual bool NeedToFireBeforeUnload() = 0;
 
+  // Runs the beforeunload handler for the main frame. See also ClosePage and
+  // SwapOut in RenderViewHost, which run the unload handler.
+  //
+  // |for_cross_site_transition| indicates whether this call is for the current
+  // frame during a cross-process navigation. False means we're closing the
+  // entire tab.
+  //
+  // TODO(creis): We should run the beforeunload handler for every frame that
+  // has one.
+  virtual void DispatchBeforeUnload(bool for_cross_site_transition) = 0;
+
   // Commands ------------------------------------------------------------------
 
   // Stop any pending navigation.
@@ -318,7 +344,74 @@ class WebContents : public PageNavigator,
   // heap-allocated pointer is owned by the caller.
   virtual WebContents* Clone() = 0;
 
+  // Reloads the focused frame.
+  virtual void ReloadFocusedFrame(bool ignore_cache) = 0;
+
+  // Editing commands ----------------------------------------------------------
+
+  virtual void Undo() = 0;
+  virtual void Redo() = 0;
+  virtual void Cut() = 0;
+  virtual void Copy() = 0;
+  virtual void CopyToFindPboard() = 0;
+  virtual void Paste() = 0;
+  virtual void PasteAndMatchStyle() = 0;
+  virtual void Delete() = 0;
+  virtual void SelectAll() = 0;
+  virtual void Unselect() = 0;
+
+  // Replaces the currently selected word or a word around the cursor.
+  virtual void Replace(const base::string16& word) = 0;
+
+  // Replaces the misspelling in the current selection.
+  virtual void ReplaceMisspelling(const base::string16& word) = 0;
+
+  // Let the renderer know that the menu has been closed.
+  virtual void NotifyContextMenuClosed(
+      const CustomContextMenuContext& context) = 0;
+
+  // Executes custom context menu action that was provided from Blink.
+  virtual void ExecuteCustomContextMenuCommand(
+      int action, const CustomContextMenuContext& context) = 0;
+
   // Views and focus -----------------------------------------------------------
+
+  // Returns the native widget that contains the contents of the tab.
+  virtual gfx::NativeView GetNativeView() = 0;
+
+  // Returns the native widget with the main content of the tab (i.e. the main
+  // render view host, though there may be many popups in the tab as children of
+  // the container).
+  virtual gfx::NativeView GetContentNativeView() = 0;
+
+  // Returns the outermost native view. This will be used as the parent for
+  // dialog boxes.
+  virtual gfx::NativeWindow GetTopLevelNativeWindow() = 0;
+
+  // Computes the rectangle for the native widget that contains the contents of
+  // the tab in the screen coordinate system.
+  virtual gfx::Rect GetContainerBounds() = 0;
+
+  // Get the bounds of the View, relative to the parent.
+  virtual gfx::Rect GetViewBounds() = 0;
+
+  // Returns the current drop data, if any.
+  virtual DropData* GetDropData() = 0;
+
+  // Sets focus to the native widget for this tab.
+  virtual void Focus() = 0;
+
+  // Sets focus to the appropriate element when the WebContents is shown the
+  // first time.
+  virtual void SetInitialFocus() = 0;
+
+  // Stores the currently focused view.
+  virtual void StoreFocus() = 0;
+
+  // Restores focus to the last focus view. If StoreFocus has not yet been
+  // invoked, SetInitialFocus is invoked.
+  virtual void RestoreFocus() = 0;
+
   // Focuses the first (last if |reverse| is true) element in the page.
   // Invoked when this tab is getting the focus through tab traversal (|reverse|
   // is true when using Shift-Tab).
@@ -359,9 +452,6 @@ class WebContents : public PageNavigator,
       const base::Callback<void(
           int64 /* size of the file */)>& callback) = 0;
 
-  // Returns true if the active NavigationEntry's page_id equals page_id.
-  virtual bool IsActiveEntry(int32 page_id) = 0;
-
   // Returns the contents MIME type after a navigation.
   virtual const std::string& GetContentsMimeType() const = 0;
 
@@ -402,9 +492,6 @@ class WebContents : public PageNavigator,
   virtual void SetClosedByUserGesture(bool value) = 0;
   virtual bool GetClosedByUserGesture() const = 0;
 
-  // Gets the zoom level for this tab.
-  virtual double GetZoomLevel() const = 0;
-
   // Gets the zoom percent for this tab.
   virtual int GetZoomPercent(bool* enable_increment,
                              bool* enable_decrement) const = 0;
@@ -466,14 +553,46 @@ class WebContents : public PageNavigator,
                             uint32_t max_bitmap_size,
                             const ImageDownloadCallback& callback) = 0;
 
-  // Sets the zoom level for the current page and all BrowserPluginGuests
-  // within the page.
-  virtual void SetZoomLevel(double level) = 0;
+  // Returns true if the WebContents is responsible for displaying a subframe
+  // in a different process from its parent page.
+  // TODO: this doesn't really belong here. With site isolation, this should be
+  // removed since we can then embed iframes in different processes.
+  virtual bool IsSubframe() const = 0;
+
+  // Finds text on a page.
+  virtual void Find(int request_id,
+                    const base::string16& search_text,
+                    const blink::WebFindOptions& options) = 0;
+
+  // Notifies the renderer that the user has closed the FindInPage window
+  // (and what action to take regarding the selection).
+  virtual void StopFinding(StopFindAction action) = 0;
+
+  // Requests the renderer to insert CSS into the main frame's document.
+  virtual void InsertCSS(const std::string& css) = 0;
 
 #if defined(OS_ANDROID)
   CONTENT_EXPORT static WebContents* FromJavaWebContents(
       jobject jweb_contents_android);
   virtual base::android::ScopedJavaLocalRef<jobject> GetJavaWebContents() = 0;
+#elif defined(OS_MACOSX)
+  // The web contents view assumes that its view will never be overlapped by
+  // another view (either partially or fully). This allows it to perform
+  // optimizations. If the view is in a view hierarchy where it might be
+  // overlapped by another view, notify the view by calling this with |true|.
+  virtual void SetAllowOverlappingViews(bool overlapping) = 0;
+
+  // Returns true if overlapping views are allowed, false otherwise.
+  virtual bool GetAllowOverlappingViews() = 0;
+
+  // To draw two overlapping web contents view, the underlaying one should
+  // know about the overlaying one. Caller must ensure that |overlay| exists
+  // until |RemoveOverlayView| is called.
+  virtual void SetOverlayView(WebContents* overlay,
+                              const gfx::Point& offset) = 0;
+
+  // Removes the previously set overlay view.
+  virtual void RemoveOverlayView() = 0;
 #endif  // OS_ANDROID
 
  private:
diff --git a/chromium/content/public/browser/web_contents_delegate.cc b/chromium/content/public/browser/web_contents_delegate.cc
index 63ad65baeab..0028339ab63 100644
--- a/chromium/content/public/browser/web_contents_delegate.cc
+++ b/chromium/content/public/browser/web_contents_delegate.cc
@@ -27,8 +27,6 @@ bool WebContentsDelegate::IsPopupOrPanel(const WebContents* source) const {
   return false;
 }
 
-bool WebContentsDelegate::CanLoadDataURLsInWebUI() const { return false; }
-
 bool WebContentsDelegate::CanOverscrollContent() const { return false; }
 
 gfx::Rect WebContentsDelegate::GetRootWindowResizerRect() const {
@@ -39,6 +37,10 @@ bool WebContentsDelegate::ShouldSuppressDialogs() {
   return false;
 }
 
+bool WebContentsDelegate::ShouldPreserveAbortedURLs(WebContents* source) {
+  return false;
+}
+
 bool WebContentsDelegate::AddMessageToConsole(WebContents* source,
                                               int32 level,
                                               const base::string16& message,
@@ -71,7 +73,7 @@ int WebContentsDelegate::GetExtraRenderViewHeight() const {
 
 void WebContentsDelegate::CanDownload(
     RenderViewHost* render_view_host,
-    int request_id,
+    const GURL& url,
     const std::string& request_method,
     const base::Callback<void(bool)>& callback) {
   callback.Run(true);
@@ -110,6 +112,12 @@ bool WebContentsDelegate::PreHandleKeyboardEvent(
   return false;
 }
 
+bool WebContentsDelegate::PreHandleGestureEvent(
+    WebContents* source,
+    const blink::WebGestureEvent& event) {
+  return false;
+}
+
 bool WebContentsDelegate::CanDragEnter(
     WebContents* source,
     const DropData& data,
@@ -156,7 +164,9 @@ void WebContentsDelegate::RequestMediaAccessPermission(
     WebContents* web_contents,
     const MediaStreamRequest& request,
     const MediaResponseCallback& callback) {
-  callback.Run(MediaStreamDevices(), scoped_ptr<MediaStreamUI>());
+  callback.Run(MediaStreamDevices(),
+               MEDIA_DEVICE_INVALID_STATE,
+               scoped_ptr<MediaStreamUI>());
 }
 
 bool WebContentsDelegate::RequestPpapiBrokerPermission(
@@ -186,8 +196,12 @@ void WebContentsDelegate::Detach(WebContents* web_contents) {
 }
 
 gfx::Size WebContentsDelegate::GetSizeForNewRenderView(
-    const WebContents* web_contents) const {
+   WebContents* web_contents) const {
   return gfx::Size();
 }
 
+bool WebContentsDelegate::IsNeverVisible(WebContents* web_contents) {
+  return false;
+}
+
 }  // namespace content
diff --git a/chromium/content/public/browser/web_contents_delegate.h b/chromium/content/public/browser/web_contents_delegate.h
index e1319c0a433..52e4747ca59 100644
--- a/chromium/content/public/browser/web_contents_delegate.h
+++ b/chromium/content/public/browser/web_contents_delegate.h
@@ -55,6 +55,7 @@ class Size;
 }
 
 namespace blink {
+class WebGestureEvent;
 class WebLayer;
 struct WebWindowFeatures;
 }
@@ -88,9 +89,9 @@ class CONTENT_EXPORT WebContentsDelegate {
   virtual void NavigationStateChanged(const WebContents* source,
                                       unsigned changed_flags) {}
 
-  // Adds the navigation request headers to |headers|. Use
-  // net::HttpUtil::AppendHeaderIfMissing to build the set of headers.
-  virtual void AddNavigationHeaders(const GURL& url, std::string* headers) {}
+  // Called to inform the delegate that the WebContent's visible SSL state (as
+  // defined by SSLStatus) changed.
+  virtual void VisibleSSLStateChanged(const WebContents* source) {}
 
   // Creates a new tab with the already-created WebContents 'new_contents'.
   // The window for the added contents should be reparented correctly when this
@@ -115,7 +116,10 @@ class CONTENT_EXPORT WebContentsDelegate {
   // Notifies the delegate that this contents is starting or is done loading
   // some resource. The delegate should use this notification to represent
   // loading feedback. See WebContents::IsLoading()
-  virtual void LoadingStateChanged(WebContents* source) {}
+  // |to_different_document| will be true unless the load is a fragment
+  // navigation, or triggered by history.pushState/replaceState.
+  virtual void LoadingStateChanged(WebContents* source,
+                                   bool to_different_document) {}
 
   // Notifies the delegate that the page has made some progress loading.
   // |progress| is a value between 0.0 (nothing loaded) to 1.0 (page fully
@@ -162,10 +166,6 @@ class CONTENT_EXPORT WebContentsDelegate {
   // delegate.
   virtual void OverscrollUpdate(int delta_y) {}
 
-  // Check whether this contents is permitted to load data URLs in WebUI mode.
-  // This is normally disallowed for security.
-  virtual bool CanLoadDataURLsInWebUI() const;
-
   // Return the rect where to display the resize corner, if any, otherwise
   // an empty rect.
   virtual gfx::Rect GetRootWindowResizerRect() const;
@@ -177,6 +177,11 @@ class CONTENT_EXPORT WebContentsDelegate {
   // Default is false.
   virtual bool ShouldSuppressDialogs();
 
+  // Returns whether pending NavigationEntries for aborted browser-initiated
+  // navigations should be preserved (and thus returned from GetVisibleURL).
+  // Defaults to false.
+  virtual bool ShouldPreserveAbortedURLs(WebContents* source);
+
   // Add a message to the console. Returning true indicates that the delegate
   // handled the message. If false is returned the default logging mechanism
   // will be used for the message.
@@ -210,11 +215,6 @@ class CONTENT_EXPORT WebContentsDelegate {
   // to live. Default is true.
   virtual bool ShouldFocusPageAfterCrash();
 
-  // Called when a popup select is about to be displayed. The delegate can use
-  // this to disable inactive rendering for the frame in the window the select
-  // is opened within if necessary.
-  virtual void RenderWidgetShowing() {}
-
   // This is called when WebKit tells us that it is done tabbing through
   // controls on the page. Provides a way for WebContentsDelegates to handle
   // this. Returns true if the delegate successfully handled it.
@@ -230,7 +230,7 @@ class CONTENT_EXPORT WebContentsDelegate {
   // Asks the delegate if the given tab can download.
   // Invoking the |callback| synchronously is OK.
   virtual void CanDownload(RenderViewHost* render_view_host,
-                           int request_id,
+                           const GURL& url,
                            const std::string& request_method,
                            const base::Callback<void(bool)>& callback);
 
@@ -271,6 +271,15 @@ class CONTENT_EXPORT WebContentsDelegate {
   // pressed, or a touch-gesture begins).
   virtual void HandlePointerActivate() {}
 
+  // Allows delegates to handle gesture events before sending to the renderer.
+  // Returns true if the |event| was handled and thus shouldn't be processed
+  // by the renderer's event handler. Note that the touch events that create
+  // the gesture are always passed to the renderer since the gesture is created
+  // and dispatched after the touches return without being "preventDefault()"ed.
+  virtual bool PreHandleGestureEvent(
+      WebContents* source,
+      const blink::WebGestureEvent& event);
+
   virtual void HandleGestureBegin() {}
   virtual void HandleGestureEnd() {}
 
@@ -294,6 +303,8 @@ class CONTENT_EXPORT WebContentsDelegate {
   // Allows delegate to control whether a WebContents will be created. Returns
   // true to allow the creation. Default is to allow it. In cases where the
   // delegate handles the creation/navigation itself, it will use |target_url|.
+  // The embedder has to synchronously adopt |route_id| or else the view will
+  // be destroyed.
   virtual bool ShouldCreateWebContents(
       WebContents* web_contents,
       int route_id,
@@ -306,7 +317,7 @@ class CONTENT_EXPORT WebContentsDelegate {
   // Notifies the delegate about the creation of a new WebContents. This
   // typically happens when popups are created.
   virtual void WebContentsCreated(WebContents* source_contents,
-                                  int64 source_frame_id,
+                                  int opener_render_frame_id,
                                   const base::string16& frame_name,
                                   const GURL& target_url,
                                   WebContents* new_contents) {}
@@ -364,16 +375,12 @@ class CONTENT_EXPORT WebContentsDelegate {
   virtual bool IsFullscreenForTabOrPending(
       const WebContents* web_contents) const;
 
-  // Called when a Javascript out of memory notification is received.
-  virtual void JSOutOfMemory(WebContents* web_contents) {}
-
   // Register a new handler for URL requests with the given scheme.
   // |user_gesture| is true if the registration is made in the context of a user
   // gesture.
   virtual void RegisterProtocolHandler(WebContents* web_contents,
                                        const std::string& protocol,
                                        const GURL& url,
-                                       const base::string16& title,
                                        bool user_gesture) {}
 
   // Result of string search in the page. This includes the number of matches
@@ -393,13 +400,6 @@ class CONTENT_EXPORT WebContentsDelegate {
                                    int version,
                                    const std::vector<gfx::RectF>& rects,
                                    const gfx::RectF& active_rect) {}
-
-  // Request permission to access protected media identifier. The callback will
-  // tell whether it's allowed.
-  virtual void RequestProtectedMediaIdentifierPermission(
-      const WebContents* web_contents,
-      const GURL& frame_url,
-      const base::Callback<void(bool)>& callback) {}
 #endif
 
   // Invoked when the preferred size of the contents has been changed.
@@ -450,15 +450,14 @@ class CONTENT_EXPORT WebContentsDelegate {
   // This is optional for implementations of WebContentsDelegate; if the
   // delegate doesn't provide a size, the current WebContentsView's size will be
   // used.
-  virtual gfx::Size GetSizeForNewRenderView(
-      const WebContents* web_contents) const;
+  virtual gfx::Size GetSizeForNewRenderView(WebContents* web_contents) const;
 
   // Notification that validation of a form displayed by the |web_contents|
   // has failed. There can only be one message per |web_contents| at a time.
   virtual void ShowValidationMessage(WebContents* web_contents,
                                      const gfx::Rect& anchor_in_root_view,
-                                     const string16& main_text,
-                                     const string16& sub_text) {}
+                                     const base::string16& main_text,
+                                     const base::string16& sub_text) {}
 
   // Notification that the delegate should hide any showing form validation
   // message.
@@ -469,6 +468,9 @@ class CONTENT_EXPORT WebContentsDelegate {
   virtual void MoveValidationMessage(WebContents* web_contents,
                                      const gfx::Rect& anchor_in_root_view) {}
 
+  // Returns true if the WebContents is never visible.
+  virtual bool IsNeverVisible(WebContents* web_contents);
+
  protected:
   virtual ~WebContentsDelegate();
 
diff --git a/chromium/content/public/browser/web_contents_observer.cc b/chromium/content/public/browser/web_contents_observer.cc
index fc0fcf253ac..3178b188bd5 100644
--- a/chromium/content/public/browser/web_contents_observer.cc
+++ b/chromium/content/public/browser/web_contents_observer.cc
@@ -41,6 +41,12 @@ void WebContentsObserver::Observe(WebContents* web_contents) {
   }
 }
 
+bool WebContentsObserver::OnMessageReceived(
+    const IPC::Message& message,
+    RenderFrameHost* render_frame_host) {
+  return false;
+}
+
 bool WebContentsObserver::OnMessageReceived(const IPC::Message& message) {
   return false;
 }
@@ -61,12 +67,9 @@ int WebContentsObserver::routing_id() const {
   return web_contents_->GetRoutingID();
 }
 
-void WebContentsObserver::WebContentsImplDestroyed() {
-  // Do cleanup so that 'this' can safely be deleted from WebContentsDestroyed.
+void WebContentsObserver::ResetWebContents() {
   web_contents_->RemoveObserver(this);
-  WebContentsImpl* contents = web_contents_;
   web_contents_ = NULL;
-  WebContentsDestroyed(contents);
 }
 
 }  // namespace content
diff --git a/chromium/content/public/browser/web_contents_observer.h b/chromium/content/public/browser/web_contents_observer.h
index ce6c2da8ccc..72c6ff60680 100644
--- a/chromium/content/public/browser/web_contents_observer.h
+++ b/chromium/content/public/browser/web_contents_observer.h
@@ -9,9 +9,11 @@
 #include "base/process/process_handle.h"
 #include "content/common/content_export.h"
 #include "content/public/browser/navigation_controller.h"
+#include "content/public/common/frame_navigate_params.h"
 #include "content/public/common/page_transition_types.h"
 #include "ipc/ipc_listener.h"
 #include "ipc/ipc_sender.h"
+#include "third_party/skia/include/core/SkColor.h"
 #include "ui/base/window_open_disposition.h"
 
 namespace content {
@@ -21,6 +23,7 @@ class RenderFrameHost;
 class RenderViewHost;
 class WebContents;
 class WebContentsImpl;
+struct AXEventNotificationDetails;
 struct FaviconURL;
 struct FrameNavigateParams;
 struct LoadCommittedDetails;
@@ -52,11 +55,13 @@ class CONTENT_EXPORT WebContentsObserver : public IPC::Listener,
   // deleted.
   virtual void RenderFrameDeleted(RenderFrameHost* render_frame_host) {}
 
-  // Only one of the two methods below will be called when a RVH is created for
-  // a WebContents, depending on whether it's for an interstitial or not.
+  // This is called when a RVH is created for a WebContents, but not if it's an
+  // interstitial.
   virtual void RenderViewCreated(RenderViewHost* render_view_host) {}
-  virtual void RenderViewForInterstitialPageCreated(
-      RenderViewHost* render_view_host) {}
+
+  // Called for every RenderFrameHost that's created for an interstitial.
+  virtual void RenderFrameForInterstitialPageCreated(
+      RenderFrameHost* render_frame_host) {}
 
   // This method is invoked when the RenderView of the current RenderViewHost
   // is ready, e.g. because we recreated it after a crash.
@@ -70,9 +75,11 @@ class CONTENT_EXPORT WebContentsObserver : public IPC::Listener,
 
   // This method is invoked when the process for the current RenderView crashes.
   // The WebContents continues to use the RenderViewHost, e.g. when the user
-  // reloads the current page.
-  // When the RenderViewHost is deleted, the RenderViewDeleted method will be
-  // invoked.
+  // reloads the current page. When the RenderViewHost itself is deleted, the
+  // RenderViewDeleted method will be invoked.
+  //
+  // Note that this is equivalent to
+  // RenderProcessHostObserver::RenderProcessExited().
   virtual void RenderProcessGone(base::TerminationStatus status) {}
 
   // This method is invoked when a WebContents swaps its render view host with
@@ -123,7 +130,7 @@ class CONTENT_EXPORT WebContentsObserver : public IPC::Listener,
   // WebContentsObserver::DidGetRedirectForResourceRequest instead.
   virtual void ProvisionalChangeToMainFrameUrl(
       const GURL& url,
-      RenderViewHost* render_view_host) {}
+      RenderFrameHost* render_frame_host) {}
 
   // This method is invoked when the provisional load was successfully
   // committed. The |render_view_host| is now the current RenderViewHost of the
@@ -167,7 +174,7 @@ class CONTENT_EXPORT WebContentsObserver : public IPC::Listener,
 
   // This method is invoked once the onload handler of the main frame has
   // completed.
-  virtual void DocumentOnLoadCompletedInMainFrame(int32 page_id) {}
+  virtual void DocumentOnLoadCompletedInMainFrame() {}
 
   // This method is invoked when the document in the given frame finished
   // loading. At this point, scripts marked as defer were executed, and
@@ -207,6 +214,7 @@ class CONTENT_EXPORT WebContentsObserver : public IPC::Listener,
   // This method is invoked when a redirect was received while requesting a
   // resource.
   virtual void DidGetRedirectForResourceRequest(
+      RenderViewHost* render_view_host,
       const ResourceRedirectDetails& details) {}
 
   // This method is invoked when a new non-pending navigation entry is created.
@@ -232,7 +240,7 @@ class CONTENT_EXPORT WebContentsObserver : public IPC::Listener,
 
   // This method is invoked when the renderer has completed its first paint
   // after a non-empty layout.
-  virtual void DidFirstVisuallyNonEmptyPaint(int32 page_id) {}
+  virtual void DidFirstVisuallyNonEmptyPaint() {}
 
   // These two methods correspond to the points in time when the spinner of the
   // tab starts and stops spinning.
@@ -286,24 +294,23 @@ class CONTENT_EXPORT WebContentsObserver : public IPC::Listener,
                                         WebContents* new_web_contents) {}
 
   // Invoked when the WebContents is being destroyed. Gives subclasses a chance
-  // to cleanup. At the time this is invoked |web_contents()| returns NULL.
-  // It is safe to delete 'this' from here.
-  virtual void WebContentsDestroyed(WebContents* web_contents) {}
+  // to cleanup. After the whole loop over all WebContentsObservers has been
+  // finished, web_contents() returns NULL.
+  virtual void WebContentsDestroyed() {}
 
   // Called when the user agent override for a WebContents has been changed.
   virtual void UserAgentOverrideSet(const std::string& user_agent) {}
 
   // Invoked when new FaviconURL candidates are received from the renderer.
-  virtual void DidUpdateFaviconURL(int32 page_id,
-                                   const std::vector<FaviconURL>& candidates) {}
+  virtual void DidUpdateFaviconURL(const std::vector<FaviconURL>& candidates) {}
 
   // Invoked when a pepper plugin creates and shows or destroys a fullscreen
   // render widget.
   virtual void DidShowFullscreenWidget(int routing_id) {}
   virtual void DidDestroyFullscreenWidget(int routing_id) {}
 
-  // Invoked when visible SSL state (as defined by SSLStatus) changes.
-  virtual void DidChangeVisibleSSLState() {}
+  // Invoked when the renderer has toggled the tab into/out of fullscreen mode.
+  virtual void DidToggleFullscreenModeForTab(bool entered_fullscreen) {}
 
   // Invoked when an interstitial page is attached or detached.
   virtual void DidAttachInterstitialPage() {}
@@ -318,6 +325,17 @@ class CONTENT_EXPORT WebContentsObserver : public IPC::Listener,
   // Invoked when a user cancels a before unload dialog.
   virtual void BeforeUnloadDialogCancelled() {}
 
+  // Invoked when an accessibility event is received from the renderer.
+  virtual void AccessibilityEventReceived(
+      const std::vector<AXEventNotificationDetails>& details) {}
+
+  // Invoked when theme color is changed to |theme_color|.
+  virtual void DidChangeThemeColor(SkColor theme_color) {}
+
+  // Invoked if an IPC message is coming from a specific RenderFrameHost.
+  virtual bool OnMessageReceived(const IPC::Message& message,
+                                 RenderFrameHost* render_frame_host);
+
   // IPC::Listener implementation.
   virtual bool OnMessageReceived(const IPC::Message& message) OVERRIDE;
 
@@ -345,9 +363,7 @@ class CONTENT_EXPORT WebContentsObserver : public IPC::Listener,
  private:
   friend class WebContentsImpl;
 
-  // Invoked from WebContentsImpl. Invokes WebContentsDestroyed and NULL out
-  // |web_contents_|.
-  void WebContentsImplDestroyed();
+  void ResetWebContents();
 
   WebContentsImpl* web_contents_;
 
diff --git a/chromium/content/public/browser/web_contents_view.h b/chromium/content/public/browser/web_contents_view.h
deleted file mode 100644
index 8405945e68e..00000000000
--- a/chromium/content/public/browser/web_contents_view.h
+++ /dev/null
@@ -1,107 +0,0 @@
-// Copyright (c) 2012 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef CONTENT_PUBLIC_BROWSER_WEB_CONTENTS_VIEW_H_
-#define CONTENT_PUBLIC_BROWSER_WEB_CONTENTS_VIEW_H_
-
-#include <string>
-
-#include "base/basictypes.h"
-#include "base/process/kill.h"
-#include "content/common/content_export.h"
-#include "ui/gfx/native_widget_types.h"
-#include "ui/gfx/rect.h"
-#include "ui/gfx/size.h"
-
-namespace content {
-struct DropData;
-
-// The WebContentsView is an interface that is implemented by the platform-
-// dependent web contents views. The WebContents uses this interface to talk to
-// them.
-class CONTENT_EXPORT WebContentsView {
- public:
-  virtual ~WebContentsView() {}
-
-  // Returns the native widget that contains the contents of the tab.
-  virtual gfx::NativeView GetNativeView() const = 0;
-
-  // Returns the native widget with the main content of the tab (i.e. the main
-  // render view host, though there may be many popups in the tab as children of
-  // the container).
-  virtual gfx::NativeView GetContentNativeView() const = 0;
-
-  // Returns the outermost native view. This will be used as the parent for
-  // dialog boxes.
-  virtual gfx::NativeWindow GetTopLevelNativeWindow() const = 0;
-
-  // Computes the rectangle for the native widget that contains the contents of
-  // the tab in the screen coordinate system.
-  virtual void GetContainerBounds(gfx::Rect* out) const = 0;
-
-  // Helper function for GetContainerBounds. Most callers just want to know the
-  // size, and this makes it more clear.
-  gfx::Size GetContainerSize() const {
-    gfx::Rect rc;
-    GetContainerBounds(&rc);
-    return gfx::Size(rc.width(), rc.height());
-  }
-
-  // Used to notify the view that a tab has crashed.
-  virtual void OnTabCrashed(base::TerminationStatus status, int error_code) = 0;
-
-  // TODO(brettw) this is a hack. It's used in two places at the time of this
-  // writing: (1) when render view hosts switch, we need to size the replaced
-  // one to be correct, since it wouldn't have known about sizes that happened
-  // while it was hidden; (2) in constrained windows.
-  //
-  // (1) will be fixed once interstitials are cleaned up. (2) seems like it
-  // should be cleaned up or done some other way, since this works for normal
-  // WebContents without the special code.
-  virtual void SizeContents(const gfx::Size& size) = 0;
-
-  // Sets focus to the native widget for this tab.
-  virtual void Focus() = 0;
-
-  // Sets focus to the appropriate element when the WebContents is shown the
-  // first time.
-  virtual void SetInitialFocus() = 0;
-
-  // Stores the currently focused view.
-  virtual void StoreFocus() = 0;
-
-  // Restores focus to the last focus view. If StoreFocus has not yet been
-  // invoked, SetInitialFocus is invoked.
-  virtual void RestoreFocus() = 0;
-
-  // Returns the current drop data, if any.
-  virtual DropData* GetDropData() const = 0;
-
-  // Get the bounds of the View, relative to the parent.
-  virtual gfx::Rect GetViewBounds() const = 0;
-
-#if defined(OS_MACOSX)
-  // The web contents view assumes that its view will never be overlapped by
-  // another view (either partially or fully). This allows it to perform
-  // optimizations. If the view is in a view hierarchy where it might be
-  // overlapped by another view, notify the view by calling this with |true|.
-  virtual void SetAllowOverlappingViews(bool overlapping) = 0;
-
-  // Returns true if overlapping views are allowed, false otherwise.
-  virtual bool GetAllowOverlappingViews() const = 0;
-
-  // To draw two overlapping web contents view, the underlaying one should
-  // know about the overlaying one. Caller must ensure that |overlay| exists
-  // until |RemoveOverlayView| is called.
-  virtual void SetOverlayView(WebContentsView* overlay,
-                              const gfx::Point& offset) = 0;
-
-  // Removes the previously set overlay view.
-  virtual void RemoveOverlayView() = 0;
-#endif
-};
-
-}  // namespace content
-
-#endif  // CONTENT_PUBLIC_BROWSER_WEB_CONTENTS_VIEW_H_
diff --git a/chromium/content/public/browser/web_contents_view_delegate.h b/chromium/content/public/browser/web_contents_view_delegate.h
index 0e61017b6b9..b0e3f6255b9 100644
--- a/chromium/content/public/browser/web_contents_view_delegate.h
+++ b/chromium/content/public/browser/web_contents_view_delegate.h
@@ -5,9 +5,7 @@
 #ifndef CONTENT_PUBLIC_BROWSER_WEB_CONTENTS_VIEW_WIN_DELEGATE_H_
 #define CONTENT_PUBLIC_BROWSER_WEB_CONTENTS_VIEW_WIN_DELEGATE_H_
 
-#if defined(TOOLKIT_GTK)
-#include <gtk/gtk.h>
-#elif defined(OS_MACOSX)
+#if defined(OS_MACOSX)
 #import <Cocoa/Cocoa.h>
 #endif
 
@@ -27,7 +25,7 @@ class FocusStoreGtk;
 }
 
 namespace content {
-
+class RenderFrameHost;
 class RenderWidgetHost;
 class WebDragDestDelegate;
 struct ContextMenuParams;
@@ -42,9 +40,10 @@ class CONTENT_EXPORT WebContentsViewDelegate {
   virtual WebDragDestDelegate* GetDragDestDelegate() = 0;
 
   // Shows a context menu.
-  virtual void ShowContextMenu(const content::ContextMenuParams& params) = 0;
+  virtual void ShowContextMenu(RenderFrameHost* render_frame_host,
+                               const ContextMenuParams& params) = 0;
 
-#if defined(OS_WIN) || defined(USE_AURA)
+#if defined(USE_AURA)
   // These methods allow the embedder to intercept WebContentsViewWin's
   // implementation of these WebContentsView methods. See the WebContentsView
   // interface documentation for more information about these methods.
@@ -53,25 +52,6 @@ class CONTENT_EXPORT WebContentsViewDelegate {
   virtual bool Focus() = 0;
   virtual void TakeFocus(bool reverse) = 0;
   virtual void SizeChanged(const gfx::Size& size) = 0;
-#elif defined(TOOLKIT_GTK)
-  // Initializes the WebContentsViewDelegate.
-  virtual void Initialize(GtkWidget* expanded_container,
-                          ui::FocusStoreGtk* focus_store) = 0;
-
-  // Returns the top widget that contains |view| passed in from WrapView. This
-  // is exposed through WebContentsViewGtk::GetNativeView() when a wrapper is
-  // supplied to a WebContentsViewGtk.
-  virtual gfx::NativeView GetNativeView() const = 0;
-
-  // Handles a focus event from the renderer process.
-  virtual void Focus() = 0;
-
-  // Gives the delegate a first chance at focus events from our render widget
-  // host, before the main view invokes its default behaviour. Returns TRUE if
-  // |return_value| has been set and that value should be returned to GTK+.
-  virtual gboolean OnNativeViewFocusEvent(GtkWidget* widget,
-                                          GtkDirectionType type,
-                                          gboolean* return_value) = 0;
 #elif defined(OS_MACOSX)
   // Returns a newly-created delegate for the RenderWidgetHostViewMac, to handle
   // events on the responder chain.
diff --git a/chromium/content/public/browser/web_drag_dest_delegate.h b/chromium/content/public/browser/web_drag_dest_delegate.h
index a556b88af0b..0f13c947800 100644
--- a/chromium/content/public/browser/web_drag_dest_delegate.h
+++ b/chromium/content/public/browser/web_drag_dest_delegate.h
@@ -5,16 +5,8 @@
 #ifndef CONTENT_PUBLIC_BROWSER_WEB_DRAG_DEST_DELEGATE_H_
 #define CONTENT_PUBLIC_BROWSER_WEB_DRAG_DEST_DELEGATE_H_
 
-#if defined(TOOLKIT_GTK)
-#include <gtk/gtk.h>
-#endif  // TOOLKIT_GTK
-
 #include "base/strings/string16.h"
 
-#if defined(OS_WIN)
-#include "ui/base/dragdrop/drop_target_win.h"
-#endif
-
 class GURL;
 
 namespace ui {
@@ -34,38 +26,17 @@ class WebDragDestDelegate {
   virtual void DragInitialize(WebContents* contents) = 0;
 
   // Notifications of drag progression.
-#if defined(OS_WIN) && !defined(USE_AURA)
-  virtual void OnDragOver(IDataObject* data_object) = 0;
-  virtual void OnDragEnter(IDataObject* data_object) = 0;
-  virtual void OnDrop(IDataObject* data_object) = 0;
-  virtual void OnDragLeave(IDataObject* data_object) = 0;
-#else
   virtual void OnDragOver() = 0;
   virtual void OnDragEnter() = 0;
   virtual void OnDrop() = 0;
   // This should also clear any state kept about this drag.
   virtual void OnDragLeave() = 0;
-#endif
-
-#if defined(TOOLKIT_GTK)
-  // Returns the bookmark atom type. GTK and Views return different values here.
-  virtual GdkAtom GetBookmarkTargetAtom() const = 0;
 
-  // Called when WebDragDestkGtk detects that there's bookmark data in a
-  // drag. Not every drag will trigger these.
-  virtual void OnReceiveDataFromGtk(GtkSelectionData* data) = 0;
-  virtual void OnReceiveProcessedData(const GURL& url,
-                                      const base::string16& title) = 0;
-#elif defined(USE_AURA)
+#if defined(USE_AURA)
   // Called at the start of every drag to supply the data associated with the
   // drag.
   virtual void OnReceiveDragData(const ui::OSExchangeData& data) = 0;
-#elif defined(OS_WIN)
-  // Allows the delegate to set data on the drag. If it doesn't want to set
-  // data, it should return false.
-  virtual bool AddDragData(const DropData& drop_data,
-                           ui::OSExchangeData* data) = 0;
-#endif  // TOOLKIT_GTK
+#endif  // USE_AURA
 
   virtual ~WebDragDestDelegate() {}
 };
diff --git a/chromium/content/public/browser/web_ui.h b/chromium/content/public/browser/web_ui.h
index 5427673ad43..52ce114dcf3 100644
--- a/chromium/content/public/browser/web_ui.h
+++ b/chromium/content/public/browser/web_ui.h
@@ -12,7 +12,6 @@
 #include "base/strings/string16.h"
 #include "content/common/content_export.h"
 #include "content/public/common/page_transition_types.h"
-#include "ui/base/layout.h"
 
 class GURL;
 
@@ -55,7 +54,7 @@ class CONTENT_EXPORT WebUI {
   // Returns the device scale factor of the monitor that the renderer is on.
   // Whenever possible, WebUI should push resources with this scale factor to
   // Javascript.
-  virtual ui::ScaleFactor GetDeviceScaleFactor() const = 0;
+  virtual float GetDeviceScaleFactor() const = 0;
 
   // Gets a custom tab title provided by the Web UI. If there is no title
   // override, the string will be empty which should trigger the default title
@@ -73,8 +72,10 @@ class CONTENT_EXPORT WebUI {
   virtual int GetBindings() const = 0;
   virtual void SetBindings(int bindings) = 0;
 
-  // Sets the path for the iframe if this WebUI is embedded in a page.
-  virtual void SetFrameXPath(const std::string& xpath) = 0;
+  // Overrides which frame gets JavaScript messages; this is useful if this
+  // WebUI is embedded in a page. If no override is set, the main frame will
+  // receive the JavaScript messages.
+  virtual void OverrideJavaScriptFrame(const std::string& frame_name) = 0;
 
   // Takes ownership of |handler|, which will be destroyed when the WebUI is.
   virtual void AddMessageHandler(WebUIMessageHandler* handler) = 0;
diff --git a/chromium/content/public/browser/web_ui_data_source.h b/chromium/content/public/browser/web_ui_data_source.h
index b5cc6d577ba..2acb117b2c0 100644
--- a/chromium/content/public/browser/web_ui_data_source.h
+++ b/chromium/content/public/browser/web_ui_data_source.h
@@ -25,6 +25,12 @@ class WebUIDataSource {
 
   CONTENT_EXPORT static WebUIDataSource* Create(const std::string& source_name);
 
+  // Adds the necessary resources for mojo bindings returning the
+  // WebUIDataSource that handles the resources. Callers do not own the return
+  // value.
+  CONTENT_EXPORT static WebUIDataSource* AddMojoDataSource(
+      BrowserContext* browser_context);
+
   // Adds a WebUI data source to |browser_context|.
   CONTENT_EXPORT static void Add(BrowserContext* browser_context,
                                  WebUIDataSource* source);
@@ -55,7 +61,7 @@ class WebUIDataSource {
   virtual void SetUseJsonJSFormatV2() = 0;
 
   // Adds a mapping between a path name and a resource to return.
-  virtual void AddResourcePath(const std::string &path, int resource_id) = 0;
+  virtual void AddResourcePath(const std::string& path, int resource_id) = 0;
 
   // Sets the resource to returned when no other paths match.
   virtual void SetDefaultResource(int resource_id) = 0;
diff --git a/chromium/content/public/browser/worker_service.h b/chromium/content/public/browser/worker_service.h
index 7ce2bf4ec1f..83a8bd83e0c 100644
--- a/chromium/content/public/browser/worker_service.h
+++ b/chromium/content/public/browser/worker_service.h
@@ -26,6 +26,9 @@ class WorkerService {
   // Returns the WorkerService singleton.
   CONTENT_EXPORT static WorkerService* GetInstance();
 
+  // Determines whether embedded SharedWorker is enabled.
+  CONTENT_EXPORT static bool EmbeddedSharedWorkerEnabled();
+
   // Terminates the given worker. Returns true if the process was found.
   virtual bool TerminateWorker(int process_id, int route_id) = 0;
 
diff --git a/chromium/content/public/browser/zygote_host_linux.h b/chromium/content/public/browser/zygote_host_linux.h
index 77cc00b2fb1..ebe5ee7387f 100644
--- a/chromium/content/public/browser/zygote_host_linux.h
+++ b/chromium/content/public/browser/zygote_host_linux.h
@@ -26,9 +26,6 @@ class ZygoteHost {
   // Returns the pid of the Zygote process.
   virtual pid_t GetPid() const = 0;
 
-  // Returns the pid of the Sandbox Helper process.
-  virtual pid_t GetSandboxHelperPid() const = 0;
-
   // Returns an int which is a bitmask of kSandboxLinux* values. Only valid
   // after the first render has been forked.
   virtual int GetSandboxStatus() const = 0;
diff --git a/chromium/content/public/child/BUILD.gn b/chromium/content/public/child/BUILD.gn
new file mode 100644
index 00000000000..9dc2c30ad45
--- /dev/null
+++ b/chromium/content/public/child/BUILD.gn
@@ -0,0 +1,18 @@
+# Copyright 2014 The Chromium Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+import("//content/child/child.gni")
+
+source_set("child") {
+  sources = rebase_path(content_child_gypi_values.public_child_sources,
+                        ".", "//content")
+
+  configs += [
+    "//content:content_implementation",
+  ]
+
+  deps = [
+    "//content/child",
+  ]
+}
diff --git a/chromium/content/public/child/request_peer.h b/chromium/content/public/child/request_peer.h
new file mode 100644
index 00000000000..93143c5b4a8
--- /dev/null
+++ b/chromium/content/public/child/request_peer.h
@@ -0,0 +1,86 @@
+// Copyright 2014 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_PUBLIC_CHILD_REQUEST_PEER_H_
+#define CONTENT_PUBLIC_CHILD_REQUEST_PEER_H_
+
+#include <string>
+
+#include "base/basictypes.h"
+#include "content/common/content_export.h"
+
+class GURL;
+
+namespace base {
+class TimeTicks;
+}
+
+namespace content {
+
+struct ResourceResponseInfo;
+
+// This is implemented by our custom resource loader within content. The Peer
+// and it's bridge should have identical lifetimes as they represent each end of
+// a communication channel.
+//
+// These callbacks mirror net::URLRequest::Delegate and the order and
+// conditions in which they will be called are identical. See url_request.h
+// for more information.
+class CONTENT_EXPORT RequestPeer {
+ public:
+  // Called as upload progress is made.
+  // note: only for requests with LOAD_ENABLE_UPLOAD_PROGRESS set
+  virtual void OnUploadProgress(uint64 position, uint64 size) = 0;
+
+  // Called when a redirect occurs.  The implementation may return false to
+  // suppress the redirect.  The given ResponseInfo provides complete
+  // information about the redirect, and new_url is the URL that will be loaded
+  // if this method returns true. new_first_party_for_cookies is the new
+  // first-party URL for cookies should that have changed.
+  virtual bool OnReceivedRedirect(const GURL& new_url,
+                                  const GURL& new_first_party_for_cookies,
+                                  const ResourceResponseInfo& info) = 0;
+
+  // Called when response headers are available (after all redirects have
+  // been followed).
+  virtual void OnReceivedResponse(const ResourceResponseInfo& info) = 0;
+
+  // Called when a chunk of response data is downloaded.  This method may be
+  // called multiple times or not at all if an error occurs.  This method is
+  // only called if RequestInfo::download_to_file was set to true, and in
+  // that case, OnReceivedData will not be called.
+  // The encoded_data_length is the length of the encoded data transferred
+  // over the network, which could be different from data length (e.g. for
+  // gzipped content).
+  virtual void OnDownloadedData(int len, int encoded_data_length) = 0;
+
+  // Called when a chunk of response data is available. This method may
+  // be called multiple times or not at all if an error occurs.
+  // The encoded_data_length is the length of the encoded data transferred
+  // over the network, which could be different from data length (e.g. for
+  // gzipped content).
+  virtual void OnReceivedData(const char* data,
+                              int data_length,
+                              int encoded_data_length) = 0;
+
+  // Called when metadata generated by the renderer is retrieved from the
+  // cache. This method may be called zero or one times.
+  virtual void OnReceivedCachedMetadata(const char* data, int len) {}
+
+  // Called when the response is complete.  This method signals completion of
+  // the resource load.
+  virtual void OnCompletedRequest(int error_code,
+                                  bool was_ignored_by_handler,
+                                  bool stale_copy_in_cache,
+                                  const std::string& security_info,
+                                  const base::TimeTicks& completion_time,
+                                  int64 total_transfer_size) = 0;
+
+ protected:
+  virtual ~RequestPeer() {}
+};
+
+}  // namespace content
+
+#endif  // CONTENT_PUBLIC_CHILD_REQUEST_PEER_H_
diff --git a/chromium/content/public/child/resource_dispatcher_delegate.h b/chromium/content/public/child/resource_dispatcher_delegate.h
index 8c67e075900..1c6168824fc 100644
--- a/chromium/content/public/child/resource_dispatcher_delegate.h
+++ b/chromium/content/public/child/resource_dispatcher_delegate.h
@@ -1,32 +1,38 @@
-// Copyright (c) 2012 The Chromium Authors. All rights reserved.

-// Use of this source code is governed by a BSD-style license that can be

-// found in the LICENSE file.

-

-#ifndef CONTENT_PUBLIC_CHILD_RESOURCE_DISPATCHER_DELEGATE_H_

-#define CONTENT_PUBLIC_CHILD_RESOURCE_DISPATCHER_DELEGATE_H_

-

-#include "content/common/content_export.h"

-#include "webkit/child/resource_loader_bridge.h"

-

-namespace content {

-

-// Interface that allows observing request events and optionally replacing the

-// peer.

-class CONTENT_EXPORT ResourceDispatcherDelegate {

- public:

-  virtual ~ResourceDispatcherDelegate() {}

-

-  virtual webkit_glue::ResourceLoaderBridge::Peer* OnRequestComplete(

-      webkit_glue::ResourceLoaderBridge::Peer* current_peer,

-      ResourceType::Type resource_type,

-      int error_code) = 0;

-

-  virtual webkit_glue::ResourceLoaderBridge::Peer* OnReceivedResponse(

-      webkit_glue::ResourceLoaderBridge::Peer* current_peer,

-      const std::string& mime_type,

-      const GURL& url) = 0;

-};

-

-}  // namespace content

-

-#endif  // CONTENT_PUBLIC_CHILD_RESOURCE_DISPATCHER_DELEGATE_H_

+// Copyright (c) 2012 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_PUBLIC_CHILD_RESOURCE_DISPATCHER_DELEGATE_H_
+#define CONTENT_PUBLIC_CHILD_RESOURCE_DISPATCHER_DELEGATE_H_
+
+#include <string>
+
+#include "content/common/content_export.h"
+#include "webkit/common/resource_type.h"
+
+class GURL;
+
+namespace content {
+
+class RequestPeer;
+
+// Interface that allows observing request events and optionally replacing the
+// peer.
+class CONTENT_EXPORT ResourceDispatcherDelegate {
+ public:
+  virtual ~ResourceDispatcherDelegate() {}
+
+  virtual RequestPeer* OnRequestComplete(
+      RequestPeer* current_peer,
+      ResourceType::Type resource_type,
+      int error_code) = 0;
+
+  virtual RequestPeer* OnReceivedResponse(
+      RequestPeer* current_peer,
+      const std::string& mime_type,
+      const GURL& url) = 0;
+};
+
+}  // namespace content
+
+#endif  // CONTENT_PUBLIC_CHILD_RESOURCE_DISPATCHER_DELEGATE_H_
diff --git a/chromium/content/public/common/BUILD.gn b/chromium/content/public/common/BUILD.gn
new file mode 100644
index 00000000000..32fd84e09d5
--- /dev/null
+++ b/chromium/content/public/common/BUILD.gn
@@ -0,0 +1,20 @@
+# Copyright 2014 The Chromium Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+import("//content/common/common.gni")
+
+source_set("common") {
+  sources = rebase_path(content_common_gypi_values.public_common_sources,
+                        ".", "//content")
+
+  configs += [
+    "//content:content_implementation",
+  ]
+
+  deps = [
+    "//content/common",
+    "//skia",
+    "//third_party/WebKit/public:blink_headers",
+  ]
+}
diff --git a/chromium/content/public/common/OWNERS b/chromium/content/public/common/OWNERS
index 15191781efa..cbcb62d430c 100644
--- a/chromium/content/public/common/OWNERS
+++ b/chromium/content/public/common/OWNERS
@@ -1,2 +1,14 @@
+per-file common_param_traits.cc=set noparent
 per-file common_param_traits.cc=cevans@chromium.org
 per-file common_param_traits.cc=tsepez@chromium.org
+
+per-file *param_traits*.h=set noparent
+per-file *param_traits*.h=cevans@chromium.org
+per-file *param_traits*.h=dcheng@chromium.org
+per-file *param_traits*.h=inferno@chromium.org
+per-file *param_traits*.h=jln@chromium.org
+per-file *param_traits*.h=jschuh@chromium.org
+per-file *param_traits*.h=kenrb@chromium.org
+per-file *param_traits*.h=nasko@chromium.org
+per-file *param_traits*.h=palmer@chromium.org
+per-file *param_traits*.h=tsepez@chromium.org
diff --git a/chromium/content/public/common/bindings_policy.h b/chromium/content/public/common/bindings_policy.h
index 8c8a74356a2..9a4745c4295 100644
--- a/chromium/content/public/common/bindings_policy.h
+++ b/chromium/content/public/common/bindings_policy.h
@@ -18,12 +18,10 @@ enum BindingsPolicy {
   // allowed unless the app has been started up with the --dom-automation
   // switch.)
   BINDINGS_POLICY_DOM_AUTOMATION = 1 << 1,
-  // Bindings that allow access to the external host (through automation).
-  BINDINGS_POLICY_EXTERNAL_HOST = 1 << 2,
   // Bindings that allows the JS content to retrieve a variety of internal
   // metrics. (By default this isn't allowed unless the app has been started up
   // with the --enable-stats-collection-bindings switch.)
-  BINDINGS_POLICY_STATS_COLLECTION = 1 << 3,
+  BINDINGS_POLICY_STATS_COLLECTION = 1 << 2,
 
 };
 
diff --git a/chromium/content/public/common/browser_plugin_permission_type.h b/chromium/content/public/common/browser_plugin_permission_type.h
deleted file mode 100644
index 257b3913d01..00000000000
--- a/chromium/content/public/common/browser_plugin_permission_type.h
+++ /dev/null
@@ -1,36 +0,0 @@
-// Copyright 2013 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef CONTENT_COMMON_BROWSER_PLUGIN_PERMISSION_TYPE_H_
-#define CONTENT_COMMON_BROWSER_PLUGIN_PERMISSION_TYPE_H_
-
-enum BrowserPluginPermissionType {
-  // Unknown type of permission request.
-  BROWSER_PLUGIN_PERMISSION_TYPE_UNKNOWN,
-
-  BROWSER_PLUGIN_PERMISSION_TYPE_DOWNLOAD,
-
-  BROWSER_PLUGIN_PERMISSION_TYPE_GEOLOCATION,
-
-  // Media access (audio/video) permission request type.
-  BROWSER_PLUGIN_PERMISSION_TYPE_MEDIA,
-
-  BROWSER_PLUGIN_PERMISSION_TYPE_POINTER_LOCK,
-
-  // New window requests.
-  // Note: Even though new windows don't use the permission API, the new window
-  // API is sufficiently similar that it's convenient to consider it a
-  // permission type for code reuse.
-  BROWSER_PLUGIN_PERMISSION_TYPE_NEW_WINDOW,
-
-  // JavaScript Dialogs: prompt, alert, confirm
-  // Note: Even through dialogs do not use the permission API, the dialog API
-  // is sufficiently similiar that it's convenient to consider it a permission
-  // type for code reuse.
-  BROWSER_PLUGIN_PERMISSION_TYPE_JAVASCRIPT_DIALOG,
-
-  BROWSER_PLUGIN_PERMISSION_TYPE_CONTENT_END,
-};
-
-#endif  // CONTENT_COMMON_BROWSER_PLUGIN_PERMISSION_TYPE_H_
diff --git a/chromium/content/public/common/child_process_host.h b/chromium/content/public/common/child_process_host.h
index bccbd67b89d..c8abedebd8b 100644
--- a/chromium/content/public/common/child_process_host.h
+++ b/chromium/content/public/common/child_process_host.h
@@ -13,6 +13,10 @@ namespace base {
 class FilePath;
 }
 
+namespace IPC {
+class MessageFilter;
+}
+
 namespace content {
 
 class ChildProcessHostDelegate;
@@ -24,9 +28,12 @@ class CONTENT_EXPORT ChildProcessHost : public IPC::Sender {
  public:
   virtual ~ChildProcessHost() {}
 
+  // This is a value never returned as the unique id of any child processes of
+  // any kind, including the values returned by RenderProcessHost::GetID().
+  static int kInvalidUniqueID;
+
   // Used to create a child process host. The delegate must outlive this object.
-  static ChildProcessHost* Create(
-      ChildProcessHostDelegate* delegate);
+  static ChildProcessHost* Create(ChildProcessHostDelegate* delegate);
 
   // These flags may be passed to GetChildPath in order to alter its behavior,
   // causing it to return a child path more suited to a specific task.
@@ -87,7 +94,7 @@ class CONTENT_EXPORT ChildProcessHost : public IPC::Sender {
   virtual bool IsChannelOpening() = 0;
 
   // Adds an IPC message filter.  A reference will be kept to the filter.
-  virtual void AddFilter(IPC::ChannelProxy::MessageFilter* filter) = 0;
+  virtual void AddFilter(IPC::MessageFilter* filter) = 0;
 
 #if defined(OS_POSIX)
   // See IPC::Channel::TakeClientFileDescriptor.
diff --git a/chromium/content/public/common/child_process_host_delegate.h b/chromium/content/public/common/child_process_host_delegate.h
index 89cb70afcec..06d30937cb6 100644
--- a/chromium/content/public/common/child_process_host_delegate.h
+++ b/chromium/content/public/common/child_process_host_delegate.h
@@ -7,6 +7,7 @@
 
 #include <string>
 
+#include "base/process/process.h"
 #include "content/common/content_export.h"
 #include "ipc/ipc_listener.h"
 
@@ -26,6 +27,10 @@ class ChildProcessHostDelegate : public IPC::Listener {
   // Called when the child process unexpected closes the IPC channel. Delegates
   // would normally delete the object in this case.
   virtual void OnChildDisconnected() {}
+
+  // Returns the handle of the child process. This can be called only after
+  // OnProcessLaunched is called or it will be invalid and may crash.
+  virtual base::ProcessHandle GetHandle() const = 0;
 };
 
 };  // namespace content
diff --git a/chromium/content/public/common/child_process_sandbox_support_linux.h b/chromium/content/public/common/child_process_sandbox_support_linux.h
index f653e35787c..58dc3ea8bf5 100644
--- a/chromium/content/public/common/child_process_sandbox_support_linux.h
+++ b/chromium/content/public/common/child_process_sandbox_support_linux.h
@@ -2,13 +2,14 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef CONTENT_PULIC_COMMON_CHILD_PROCESS_SANDBOX_SUPPORT_LINUX_H_
-#define CONTENT_PULIC_COMMON_CHILD_PROCESS_SANDBOX_SUPPORT_LINUX_H_
+#ifndef CONTENT_PUBLIC_COMMON_CHILD_PROCESS_SANDBOX_SUPPORT_LINUX_H_
+#define CONTENT_PUBLIC_COMMON_CHILD_PROCESS_SANDBOX_SUPPORT_LINUX_H_
 
 #include <stdint.h>
 #include <string>
 
 #include "content/common/content_export.h"
+#include "ppapi/c/trusted/ppb_browser_font_trusted.h"
 
 namespace content {
 
@@ -26,8 +27,15 @@ CONTENT_EXPORT int MakeSharedMemorySegmentViaIPC(size_t length,
 // properties or -1 on failure.
 //   charset: specifies the language(s) that the font must cover. See
 // render_sandbox_host_linux.cc for more information.
-CONTENT_EXPORT int MatchFontWithFallback(const std::string& face, bool bold,
-                                         bool italic, int charset);
+// fallback_family: If not set to PP_BROWSERFONT_TRUSTED_FAMILY_DEFAULT, font
+// selection should fall back to generic Windows font names like Arial and
+// Times New Roman.
+CONTENT_EXPORT int MatchFontWithFallback(
+    const std::string& face,
+    bool bold,
+    bool italic,
+    int charset,
+    PP_BrowserFont_Trusted_Family fallback_family);
 
 // GetFontTable loads a specified font table from an open SFNT file.
 //   fd: a file descriptor to the SFNT file. The position doesn't matter.
@@ -42,6 +50,10 @@ CONTENT_EXPORT int MatchFontWithFallback(const std::string& face, bool bold,
 CONTENT_EXPORT bool GetFontTable(int fd, uint32_t table_tag, off_t offset,
                                  uint8_t* output, size_t* output_length);
 
+// Sends a zygote child "ping" message to browser process via socket |fd|.
+// Returns true on success.
+CONTENT_EXPORT bool SendZygoteChildPing(int fd);
+
 };  // namespace content
 
-#endif  // CONTENT_PULIC_COMMON_CHILD_PROCESS_SANDBOX_SUPPORT_LINUX_H_
+#endif  // CONTENT_PUBLIC_COMMON_CHILD_PROCESS_SANDBOX_SUPPORT_LINUX_H_
diff --git a/chromium/content/public/common/common_param_traits.cc b/chromium/content/public/common/common_param_traits.cc
index 4e5d92b8522..956801a178a 100644
--- a/chromium/content/public/common/common_param_traits.cc
+++ b/chromium/content/public/common/common_param_traits.cc
@@ -4,11 +4,14 @@
 
 #include "content/public/common/common_param_traits.h"
 
+#include <string>
+
 #include "content/public/common/content_constants.h"
 #include "content/public/common/page_state.h"
 #include "content/public/common/referrer.h"
 #include "content/public/common/url_utils.h"
 #include "net/base/host_port_pair.h"
+#include "net/base/ip_endpoint.h"
 #include "third_party/skia/include/core/SkBitmap.h"
 #include "ui/gfx/rect.h"
 #include "ui/gfx/rect_f.h"
@@ -86,6 +89,27 @@ void ParamTraits<GURL>::Log(const GURL& p, std::string* l) {
   l->append(p.spec());
 }
 
+void ParamTraits<url::Origin>::Write(Message* m,
+                                          const url::Origin& p) {
+  m->WriteString(p.string());
+}
+
+bool ParamTraits<url::Origin>::Read(const Message* m,
+                                    PickleIterator* iter,
+                                    url::Origin* p) {
+  std::string s;
+  if (!m->ReadString(iter, &s)) {
+    *p = url::Origin();
+    return false;
+  }
+  *p = url::Origin(s);
+  return true;
+}
+
+void ParamTraits<url::Origin>::Log(const url::Origin& p, std::string* l) {
+  l->append(p.string());
+}
+
 void ParamTraits<net::HostPortPair>::Write(Message* m, const param_type& p) {
   WriteParam(m, p.host());
   WriteParam(m, p.port());
@@ -108,6 +132,30 @@ void ParamTraits<net::HostPortPair>::Log(const param_type& p, std::string* l) {
   l->append(p.ToString());
 }
 
+void ParamTraits<net::IPEndPoint>::Write(Message* m, const param_type& p) {
+  WriteParam(m, p.address());
+  WriteParam(m, p.port());
+}
+
+bool ParamTraits<net::IPEndPoint>::Read(const Message* m, PickleIterator* iter,
+                                        param_type* p) {
+  net::IPAddressNumber address;
+  int port;
+  if (!ReadParam(m, iter, &address) || !ReadParam(m, iter, &port))
+    return false;
+  if (address.size() &&
+      address.size() != net::kIPv4AddressSize &&
+      address.size() != net::kIPv6AddressSize) {
+    return false;
+  }
+  *p = net::IPEndPoint(address, port);
+  return true;
+}
+
+void ParamTraits<net::IPEndPoint>::Log(const param_type& p, std::string* l) {
+  LogParam("IPEndPoint:" + p.ToString(), l);
+}
+
 void ParamTraits<content::PageState>::Write(
     Message* m, const param_type& p) {
   WriteParam(m, p.ToEncodedData());
@@ -129,26 +177,6 @@ void ParamTraits<content::PageState>::Log(
   l->append(")");
 }
 
-void ParamTraits<content::Referrer>::Write(
-    Message* m, const param_type& p) {
-  WriteParam(m, p.url);
-  WriteParam(m, p.policy);
-}
-
-bool ParamTraits<content::Referrer>::Read(
-    const Message* m, PickleIterator* iter, param_type* r) {
-  return ReadParam(m, iter, &r->url) && ReadParam(m, iter, &r->policy);
-}
-
-void ParamTraits<content::Referrer>::Log(
-    const param_type& p, std::string* l) {
-  l->append("(");
-  LogParam(p.url, l);
-  l->append(",");
-  LogParam(p.policy, l);
-  l->append(")");
-}
-
 void ParamTraits<gfx::Point>::Write(Message* m, const gfx::Point& p) {
   m->WriteInt(p.x());
   m->WriteInt(p.y());
diff --git a/chromium/content/public/common/common_param_traits.h b/chromium/content/public/common/common_param_traits.h
index b3f66f57367..f527f162800 100644
--- a/chromium/content/public/common/common_param_traits.h
+++ b/chromium/content/public/common/common_param_traits.h
@@ -14,6 +14,8 @@
 #ifndef CONTENT_PUBLIC_COMMON_COMMON_PARAM_TRAITS_H_
 #define CONTENT_PUBLIC_COMMON_COMMON_PARAM_TRAITS_H_
 
+#include <string>
+
 #include "base/memory/ref_counted.h"
 #include "content/common/content_export.h"
 #include "content/public/common/common_param_traits_macros.h"
@@ -21,12 +23,12 @@
 #include "ui/gfx/native_widget_types.h"
 #include "ui/surface/transport_dib.h"
 #include "url/gurl.h"
+#include "url/origin.h"
 
 class SkBitmap;
 
 namespace content {
 class PageState;
-struct Referrer;
 }
 
 namespace gfx {
@@ -39,6 +41,7 @@ class Vector2d;
 
 namespace net {
 class HostPortPair;
+class IPEndPoint;
 }
 
 namespace IPC {
@@ -51,6 +54,14 @@ struct CONTENT_EXPORT ParamTraits<GURL> {
   static void Log(const param_type& p, std::string* l);
 };
 
+template <>
+struct CONTENT_EXPORT ParamTraits<url::Origin> {
+  typedef url::Origin param_type;
+  static void Write(Message* m, const param_type& p);
+  static bool Read(const Message* m, PickleIterator* iter, param_type* p);
+  static void Log(const param_type& p, std::string* l);
+};
+
 template<>
 struct CONTENT_EXPORT ParamTraits<net::HostPortPair> {
   typedef net::HostPortPair param_type;
@@ -60,16 +71,16 @@ struct CONTENT_EXPORT ParamTraits<net::HostPortPair> {
 };
 
 template <>
-struct CONTENT_EXPORT ParamTraits<content::PageState> {
-  typedef content::PageState param_type;
+struct CONTENT_EXPORT ParamTraits<net::IPEndPoint> {
+  typedef net::IPEndPoint param_type;
   static void Write(Message* m, const param_type& p);
   static bool Read(const Message* m, PickleIterator* iter, param_type* p);
   static void Log(const param_type& p, std::string* l);
 };
 
 template <>
-struct CONTENT_EXPORT ParamTraits<content::Referrer> {
-  typedef content::Referrer param_type;
+struct CONTENT_EXPORT ParamTraits<content::PageState> {
+  typedef content::PageState param_type;
   static void Write(Message* m, const param_type& p);
   static bool Read(const Message* m, PickleIterator* iter, param_type* p);
   static void Log(const param_type& p, std::string* l);
@@ -193,24 +204,6 @@ struct ParamTraits<TransportDIB::Id> {
 };
 #endif
 
-#if defined(TOOLKIT_GTK)
-template<>
-struct ParamTraits<TransportDIB::Id> {
-  typedef TransportDIB::Id param_type;
-  static void Write(Message* m, const param_type& p) {
-    WriteParam(m, p.shmkey);
-  }
-  static bool Read(const Message* m, PickleIterator* iter, param_type* r) {
-    return ReadParam(m, iter, &r->shmkey);
-  }
-  static void Log(const param_type& p, std::string* l) {
-    l->append("TransportDIB(");
-    LogParam(p.shmkey, l);
-    l->append(")");
-  }
-};
-#endif
-
 template <>
 struct CONTENT_EXPORT ParamTraits<SkBitmap> {
   typedef SkBitmap param_type;
diff --git a/chromium/content/public/common/common_param_traits_macros.h b/chromium/content/public/common/common_param_traits_macros.h
index 4c871a6f29c..61d8b851434 100644
--- a/chromium/content/public/common/common_param_traits_macros.h
+++ b/chromium/content/public/common/common_param_traits_macros.h
@@ -10,10 +10,12 @@
 
 #include "content/public/common/console_message_level.h"
 #include "content/public/common/page_transition_types.h"
+#include "content/public/common/referrer.h"
 #include "content/public/common/security_style.h"
 #include "content/public/common/ssl_status.h"
 #include "content/public/common/webplugininfo.h"
 #include "ipc/ipc_message_macros.h"
+#include "net/base/network_change_notifier.h"
 #include "net/base/request_priority.h"
 #include "third_party/WebKit/public/platform/WebPoint.h"
 #include "third_party/WebKit/public/platform/WebRect.h"
@@ -26,12 +28,19 @@
 #undef IPC_MESSAGE_EXPORT
 #define IPC_MESSAGE_EXPORT CONTENT_EXPORT
 
-IPC_ENUM_TRAITS(content::ConsoleMessageLevel)
-IPC_ENUM_TRAITS(content::PageTransition)
-IPC_ENUM_TRAITS(content::SecurityStyle)
-IPC_ENUM_TRAITS(blink::WebReferrerPolicy)
-IPC_ENUM_TRAITS(WindowOpenDisposition)
-IPC_ENUM_TRAITS(webkit_glue::EditingBehavior)
+IPC_ENUM_TRAITS(content::PageTransition)  // Bitmask.
+IPC_ENUM_TRAITS_MAX_VALUE(net::NetworkChangeNotifier::ConnectionType,
+                          net::NetworkChangeNotifier::CONNECTION_LAST)
+IPC_ENUM_TRAITS_MAX_VALUE(content::ConsoleMessageLevel,
+                          content::CONSOLE_MESSAGE_LEVEL_LAST)
+IPC_ENUM_TRAITS_MAX_VALUE(content::SecurityStyle,
+                          content::SECURITY_STYLE_LAST)
+IPC_ENUM_TRAITS_MAX_VALUE(blink::WebReferrerPolicy,
+                          blink::WebReferrerPolicyLast)
+IPC_ENUM_TRAITS_MAX_VALUE(webkit_glue::EditingBehavior,
+                          webkit_glue::EDITING_BEHAVIOR_LAST)
+IPC_ENUM_TRAITS_MAX_VALUE(WindowOpenDisposition,
+                          WINDOW_OPEN_DISPOSITION_LAST)
 IPC_ENUM_TRAITS_MAX_VALUE(net::RequestPriority, net::MAXIMUM_PRIORITY)
 
 IPC_STRUCT_TRAITS_BEGIN(blink::WebPoint)
@@ -46,6 +55,11 @@ IPC_STRUCT_TRAITS_BEGIN(blink::WebRect)
   IPC_STRUCT_TRAITS_MEMBER(height)
 IPC_STRUCT_TRAITS_END()
 
+IPC_STRUCT_TRAITS_BEGIN(content::Referrer)
+  IPC_STRUCT_TRAITS_MEMBER(url)
+  IPC_STRUCT_TRAITS_MEMBER(policy)
+IPC_STRUCT_TRAITS_END()
+
 IPC_STRUCT_TRAITS_BEGIN(content::SSLStatus)
   IPC_STRUCT_TRAITS_MEMBER(security_style)
   IPC_STRUCT_TRAITS_MEMBER(cert_id)
@@ -110,12 +124,14 @@ IPC_STRUCT_TRAITS_BEGIN(WebPreferences)
   IPC_STRUCT_TRAITS_MEMBER(tabs_to_links)
   IPC_STRUCT_TRAITS_MEMBER(hyperlink_auditing_enabled)
   IPC_STRUCT_TRAITS_MEMBER(is_online)
+  IPC_STRUCT_TRAITS_MEMBER(connection_type)
   IPC_STRUCT_TRAITS_MEMBER(allow_universal_access_from_file_urls)
   IPC_STRUCT_TRAITS_MEMBER(allow_file_access_from_file_urls)
   IPC_STRUCT_TRAITS_MEMBER(webaudio_enabled)
   IPC_STRUCT_TRAITS_MEMBER(experimental_webgl_enabled)
-  IPC_STRUCT_TRAITS_MEMBER(experimental_websocket_enabled)
+  IPC_STRUCT_TRAITS_MEMBER(pepper_3d_enabled)
   IPC_STRUCT_TRAITS_MEMBER(pinch_virtual_viewport_enabled)
+  IPC_STRUCT_TRAITS_MEMBER(pinch_overlay_scrollbar_thickness)
   IPC_STRUCT_TRAITS_MEMBER(use_solid_color_scrollbars)
   IPC_STRUCT_TRAITS_MEMBER(flash_3d_enabled)
   IPC_STRUCT_TRAITS_MEMBER(flash_stage3d_enabled)
@@ -123,44 +139,30 @@ IPC_STRUCT_TRAITS_BEGIN(WebPreferences)
   IPC_STRUCT_TRAITS_MEMBER(gl_multisampling_enabled)
   IPC_STRUCT_TRAITS_MEMBER(privileged_webgl_extensions_enabled)
   IPC_STRUCT_TRAITS_MEMBER(webgl_errors_to_console_enabled)
-  IPC_STRUCT_TRAITS_MEMBER(accelerated_compositing_for_overflow_scroll_enabled)
-  IPC_STRUCT_TRAITS_MEMBER(
-      accelerated_compositing_for_scrollable_frames_enabled)
-  IPC_STRUCT_TRAITS_MEMBER(composited_scrolling_for_frames_enabled)
   IPC_STRUCT_TRAITS_MEMBER(mock_scrollbars_enabled)
   IPC_STRUCT_TRAITS_MEMBER(layer_squashing_enabled)
-  IPC_STRUCT_TRAITS_MEMBER(threaded_html_parser)
-  IPC_STRUCT_TRAITS_MEMBER(show_paint_rects)
   IPC_STRUCT_TRAITS_MEMBER(asynchronous_spell_checking_enabled)
   IPC_STRUCT_TRAITS_MEMBER(unified_textchecker_enabled)
-  IPC_STRUCT_TRAITS_MEMBER(accelerated_compositing_enabled)
-  IPC_STRUCT_TRAITS_MEMBER(force_compositing_mode)
   IPC_STRUCT_TRAITS_MEMBER(accelerated_2d_canvas_enabled)
   IPC_STRUCT_TRAITS_MEMBER(minimum_accelerated_2d_canvas_size)
   IPC_STRUCT_TRAITS_MEMBER(antialiased_2d_canvas_disabled)
   IPC_STRUCT_TRAITS_MEMBER(accelerated_2d_canvas_msaa_sample_count)
   IPC_STRUCT_TRAITS_MEMBER(accelerated_filters_enabled)
+  IPC_STRUCT_TRAITS_MEMBER(deferred_filters_enabled)
+  IPC_STRUCT_TRAITS_MEMBER(container_culling_enabled)
   IPC_STRUCT_TRAITS_MEMBER(gesture_tap_highlight_enabled)
-  IPC_STRUCT_TRAITS_MEMBER(accelerated_compositing_for_plugins_enabled)
-  IPC_STRUCT_TRAITS_MEMBER(accelerated_compositing_for_3d_transforms_enabled)
-  IPC_STRUCT_TRAITS_MEMBER(accelerated_compositing_for_animation_enabled)
   IPC_STRUCT_TRAITS_MEMBER(accelerated_compositing_for_video_enabled)
-  IPC_STRUCT_TRAITS_MEMBER(memory_info_enabled)
-  IPC_STRUCT_TRAITS_MEMBER(fullscreen_enabled)
   IPC_STRUCT_TRAITS_MEMBER(allow_displaying_insecure_content)
   IPC_STRUCT_TRAITS_MEMBER(allow_running_insecure_content)
   IPC_STRUCT_TRAITS_MEMBER(enable_scroll_animator)
-  IPC_STRUCT_TRAITS_MEMBER(visual_word_movement_enabled)
   IPC_STRUCT_TRAITS_MEMBER(password_echo_enabled)
   IPC_STRUCT_TRAITS_MEMBER(should_clear_document_background)
-  IPC_STRUCT_TRAITS_MEMBER(lazy_layout_enabled)
   IPC_STRUCT_TRAITS_MEMBER(region_based_columns_enabled)
   IPC_STRUCT_TRAITS_MEMBER(touch_enabled)
   IPC_STRUCT_TRAITS_MEMBER(device_supports_touch)
   IPC_STRUCT_TRAITS_MEMBER(device_supports_mouse)
   IPC_STRUCT_TRAITS_MEMBER(touch_adjustment_enabled)
   IPC_STRUCT_TRAITS_MEMBER(pointer_events_max_touch_points)
-  IPC_STRUCT_TRAITS_MEMBER(fixed_position_creates_stacking_context)
   IPC_STRUCT_TRAITS_MEMBER(sync_xhr_in_documents_enabled)
   IPC_STRUCT_TRAITS_MEMBER(deferred_image_decoding_enabled)
   IPC_STRUCT_TRAITS_MEMBER(should_respect_image_orientation)
@@ -174,7 +176,9 @@ IPC_STRUCT_TRAITS_BEGIN(WebPreferences)
   IPC_STRUCT_TRAITS_MEMBER(smart_insert_delete_enabled)
   IPC_STRUCT_TRAITS_MEMBER(compositor_touch_hit_testing)
   IPC_STRUCT_TRAITS_MEMBER(cookie_enabled)
+  IPC_STRUCT_TRAITS_MEMBER(navigate_on_drag_drop)
   IPC_STRUCT_TRAITS_MEMBER(spatial_navigation_enabled)
+  IPC_STRUCT_TRAITS_MEMBER(pepper_accelerated_video_decode_enabled)
 #if defined(OS_ANDROID)
   IPC_STRUCT_TRAITS_MEMBER(text_autosizing_enabled)
   IPC_STRUCT_TRAITS_MEMBER(font_scale_factor)
@@ -182,7 +186,6 @@ IPC_STRUCT_TRAITS_BEGIN(WebPreferences)
   IPC_STRUCT_TRAITS_MEMBER(force_enable_zoom)
   IPC_STRUCT_TRAITS_MEMBER(double_tap_to_zoom_enabled)
   IPC_STRUCT_TRAITS_MEMBER(user_gesture_required_for_media_playback)
-  IPC_STRUCT_TRAITS_MEMBER(user_gesture_required_for_media_fullscreen)
   IPC_STRUCT_TRAITS_MEMBER(default_video_poster_url)
   IPC_STRUCT_TRAITS_MEMBER(support_deprecated_target_density_dpi)
   IPC_STRUCT_TRAITS_MEMBER(use_legacy_background_size_shorthand_behavior)
diff --git a/chromium/content/public/common/console_message_level.h b/chromium/content/public/common/console_message_level.h
index 5dcb8d83627..af51c32c04a 100644
--- a/chromium/content/public/common/console_message_level.h
+++ b/chromium/content/public/common/console_message_level.h
@@ -11,7 +11,8 @@ enum ConsoleMessageLevel {
   CONSOLE_MESSAGE_LEVEL_DEBUG,
   CONSOLE_MESSAGE_LEVEL_LOG,
   CONSOLE_MESSAGE_LEVEL_WARNING,
-  CONSOLE_MESSAGE_LEVEL_ERROR
+  CONSOLE_MESSAGE_LEVEL_ERROR,
+  CONSOLE_MESSAGE_LEVEL_LAST = CONSOLE_MESSAGE_LEVEL_ERROR
 };
 
 }  // namespace content
diff --git a/chromium/content/public/common/content_client.cc b/chromium/content/public/common/content_client.cc
index 54db51778a4..3a9769cbfd1 100644
--- a/chromium/content/public/common/content_client.cc
+++ b/chromium/content/public/common/content_client.cc
@@ -6,8 +6,8 @@
 
 #include "base/logging.h"
 #include "base/strings/string_piece.h"
+#include "content/public/common/user_agent.h"
 #include "ui/gfx/image/image.h"
-#include "webkit/common/user_agent/user_agent.h"
 
 namespace content {
 
@@ -37,12 +37,10 @@ class InternalTestInitializer {
 void SetContentClient(ContentClient* client) {
   g_client = client;
 
-  // Set the default user agent as provided by the client. We need to make
-  // sure this is done before webkit_glue::GetUserAgent() is called (so that
-  // the UA doesn't change).
-  if (client) {
-    webkit_glue::SetUserAgent(client->GetUserAgent(), false);
-  }
+  // TODO(jam): find out which static on Windows is causing this to have to be
+  // called on startup.
+  if (client)
+    client->GetUserAgent();
 }
 
 ContentClient* GetContentClient() {
@@ -61,11 +59,6 @@ ContentUtilityClient* SetUtilityClientForTesting(ContentUtilityClient* u) {
   return InternalTestInitializer::SetUtility(u);
 }
 
-const std::string& GetUserAgent(const GURL& url) {
-  DCHECK(g_client);
-  return webkit_glue::GetUserAgent(url);
-}
-
 ContentClient::ContentClient()
     : browser_(NULL), plugin_(NULL), renderer_(NULL), utility_(NULL) {
 }
@@ -77,10 +70,6 @@ bool ContentClient::CanSendWhileSwappedOut(const IPC::Message* message) {
   return false;
 }
 
-bool ContentClient::CanHandleWhileSwappedOut(const IPC::Message& message) {
-  return false;
-}
-
 std::string ContentClient::GetProduct() const {
   return std::string();
 }
diff --git a/chromium/content/public/common/content_client.h b/chromium/content/public/common/content_client.h
index 1695656e891..ec52600a349 100644
--- a/chromium/content/public/common/content_client.h
+++ b/chromium/content/public/common/content_client.h
@@ -15,7 +15,6 @@
 #include "content/common/content_export.h"
 #include "ui/base/layout.h"
 
-class CommandLine;
 class GURL;
 
 namespace base {
@@ -65,16 +64,6 @@ CONTENT_EXPORT ContentRendererClient* SetRendererClientForTesting(
 CONTENT_EXPORT ContentUtilityClient* SetUtilityClientForTesting(
     ContentUtilityClient* u);
 
-// Returns the user agent string being used by the browser. SetContentClient()
-// must be called prior to calling this, and this routine must be used
-// instead of webkit_glue::GetUserAgent() in order to ensure that we use
-// the same user agent string everywhere.
-// TODO(dpranke): This is caused by webkit_glue being a library that can
-// get linked into multiple linkable objects, causing us to have multiple
-// static values of the user agent. This will be fixed when we clean up
-// webkit_glue.
-CONTENT_EXPORT const std::string& GetUserAgent(const GURL& url);
-
 // Interface that the embedder implements.
 class CONTENT_EXPORT ContentClient {
  public:
@@ -105,10 +94,6 @@ class CONTENT_EXPORT ContentClient {
   // Returns whether the given message should be sent in a swapped out renderer.
   virtual bool CanSendWhileSwappedOut(const IPC::Message* message);
 
-  // Returns whether the given message should be processed in the browser on
-  // behalf of a swapped out renderer.
-  virtual bool CanHandleWhileSwappedOut(const IPC::Message& message);
-
   // Returns a string describing the embedder product name and version,
   // of the form "productname/version", with no other slashes.
   // Used as part of the user agent string.
diff --git a/chromium/content/public/common/content_descriptors.h b/chromium/content/public/common/content_descriptors.h
index ce7ab0e8d8a..5a6b234e5d9 100644
--- a/chromium/content/public/common/content_descriptors.h
+++ b/chromium/content/public/common/content_descriptors.h
@@ -15,6 +15,7 @@ enum {
 
 #if defined(OS_ANDROID)
   kAndroidPropertyDescriptor,
+  kAndroidICUDataDescriptor,
 #endif
 
   // The first key that embedders can use to register descriptors (see
diff --git a/chromium/content/public/common/content_switches.cc b/chromium/content/public/common/content_switches.cc
index 1fc5ef5f2d1..f10bed115cd 100644
--- a/chromium/content/public/common/content_switches.cc
+++ b/chromium/content/public/common/content_switches.cc
@@ -4,6 +4,8 @@
 
 #include "content/public/common/content_switches.h"
 
+#include "base/command_line.h"
+
 namespace switches {
 
 // The number of MSAA samples for canvas2D. Requires MSAA support by GPU to
@@ -14,6 +16,15 @@ const char kAcceleratedCanvas2dMSAASampleCount[] = "canvas-msaa-sample-count";
 // override for developers who need the old behavior for testing.
 const char kAllowFileAccessFromFiles[]      = "allow-file-access-from-files";
 
+// Allows frames with an https origin to use WebSockets with an insecure URL
+// (ws://).
+const char kAllowInsecureWebSocketFromHttpsOrigin[] =
+    "allow-insecure-websocket-from-https-origin";
+
+// Allows loopback interface to be added in network list for peer connection.
+const char kAllowLoopbackInPeerConnection[] =
+    "allow-loopback-in-peer-connection";
+
 // Enables the sandboxed processes to run without a job object assigned to them.
 // This flag is required to allow Chrome to run in RemoteApps or Citrix. This
 // flag can reduce the security of the sandboxed processes and allow them to do
@@ -25,9 +36,6 @@ const char kAllowNoSandboxJob[]             = "allow-no-sandbox-job";
 // Allows debugging of sandboxed processes (see zygote_main_linux.cc).
 const char kAllowSandboxDebugging[]         = "allow-sandbox-debugging";
 
-// Allow compositing on chrome:// pages.
-const char kAllowWebUICompositing[]         = "allow-webui-compositing";
-
 // The same as kAuditHandles except all handles are enumerated.
 const char kAuditAllHandles[]               = "enable-handle-auditing-all";
 
@@ -35,12 +43,9 @@ const char kAuditAllHandles[]               = "enable-handle-auditing-all";
 // is terminated.
 const char kAuditHandles[]                  = "enable-handle-auditing";
 
-// Blacklist the GPU for accelerated compositing.
-const char kBlacklistAcceleratedCompositing[] =
-    "blacklist-accelerated-compositing";
-
-// Blacklist the GPU for WebGL.
-const char kBlacklistWebGL[]                = "blacklist-webgl";
+// Choose which logging channels in blink platform to activate.  See
+// Logging.cpp in blink's Source/platform for a list of available channels.
+const char kBlinkPlatformLogChannels[]      = "blink-platform-log-channels";
 
 // Block cross-site documents (i.e., HTML/XML/JSON) from being loaded in
 // subresources when a document is not supposed to read them.  This will later
@@ -76,17 +81,11 @@ const char kDisable3DAPIs[]                 = "disable-3d-apis";
 // Disable gpu-accelerated 2d canvas.
 const char kDisableAccelerated2dCanvas[]    = "disable-accelerated-2d-canvas";
 
-// Disables accelerated compositing.
-const char kDisableAcceleratedCompositing[] = "disable-accelerated-compositing";
-
 // Disables accelerated compositing for backgrounds of root layers with
 // background-attachment: fixed.
 const char kDisableAcceleratedFixedRootBackground[] =
     "disable-accelerated-fixed-root-background";
 
-// Disables the hardware acceleration of 3D CSS and animation.
-const char kDisableAcceleratedLayers[]      = "disable-accelerated-layers";
-
 // Disables accelerated compositing for overflow scroll.
 const char kDisableAcceleratedOverflowScroll[] =
     "disable-accelerated-overflow-scroll";
@@ -95,42 +94,17 @@ const char kDisableAcceleratedOverflowScroll[] =
 const char kDisableLayerSquashing[] =
     "disable-layer-squashing";
 
-// Disable accelerated compositing for scrollable frames.
-const char kDisableAcceleratedScrollableFrames[] =
-     "disable-accelerated-scrollable-frames";
-
-// Disables the hardware acceleration of plugins.
-const char kDisableAcceleratedPlugins[]     = "disable-accelerated-plugins";
-
-// Disables GPU accelerated video display.
-const char kDisableAcceleratedVideo[]       = "disable-accelerated-video";
-
 // Disables hardware acceleration of video decode, where available.
 const char kDisableAcceleratedVideoDecode[] =
     "disable-accelerated-video-decode";
 
-// Disables the alternate window station for the renderer.
-const char kDisableAltWinstation[]          = "disable-winsta";
-
 // Disable the ApplicationCache.
 const char kDisableApplicationCache[]       = "disable-application-cache";
-//
-// TODO(scherkus): remove --disable-audio when we have a proper fallback
-// mechanism.
-const char kDisableAudio[]                  = "disable-audio";
 
 // Disable limits on the number of backing stores. Can prevent blinking for
 // users with many windows/tabs and lots of memory.
 const char kDisableBackingStoreLimit[]      = "disable-backing-store-limit";
 
-// Disable browser plugin compositing experiment.
-const char kDisableBrowserPluginCompositing[] =
-    "disable-browser-plugin-compositing";
-
-// Disable accelerated scrolling by the compositor for frames.
-const char kDisableCompositedScrollingForFrames[] =
-     "disable-composited-scrolling-for-frames";
-
 // See comment for kEnableCompositingForFixedPosition.
 const char kDisableCompositingForFixedPosition[] =
      "disable-fixed-position-compositing";
@@ -142,9 +116,6 @@ const char kDisableCompositingForTransition[] =
 // Disables HTML5 DB support.
 const char kDisableDatabases[]              = "disable-databases";
 
-// Disables the deadline scheduler.
-const char kDisableDeadlineScheduling[]     = "disable-deadline-scheduling";
-
 // Disables delegated renderer.
 const char kDisableDelegatedRenderer[]      = "disable-delegated-renderer";
 
@@ -155,12 +126,6 @@ const char kDisableDesktopNotifications[]   = "disable-desktop-notifications";
 const char kDisableNavigatorContentUtils[]  =
       "disable-navigator-content-utils";
 
-// Disable device motion events.
-const char kDisableDeviceMotion[]           = "disable-device-motion";
-
-// Disable device orientation events.
-const char kDisableDeviceOrientation[]      = "disable-device-orientation";
-
 // Handles URL requests by NPAPI plugins through the renderer.
 const char kDisableDirectNPAPIRequests[]    = "disable-direct-npapi-requests";
 
@@ -169,42 +134,26 @@ const char kDisableDirectNPAPIRequests[]    = "disable-direct-npapi-requests";
 extern const char kDisableDomainBlockingFor3DAPIs[] =
     "disable-domain-blocking-for-3d-apis";
 
+// Disable running the SharedWorker inside the renderer process.
+const char kDisableEmbeddedSharedWorker[]    = "disable-embedded-shared-worker";
+
 // Disable experimental WebGL support.
 const char kDisableExperimentalWebGL[]      = "disable-webgl";
 
+// Disable the fast text autosizing implementation.
+const char kDisableFastTextAutosizing[]     = "disable-fast-text-autosizing";
+
 // Disable FileSystem API.
 const char kDisableFileSystem[]             = "disable-file-system";
 
-// Disables sending filters (SkImageFilter objects) between processes over IPC
-const char kDisableFiltersOverIPC[]         = "disable-filters-over-ipc";
-
-const char kDisableFixedPositionCreatesStackingContext[]
-    = "disable-fixed-position-creates-stacking-context";
-
 // Disable 3D inside of flapper.
 const char kDisableFlash3d[]                = "disable-flash-3d";
 
 // Disable Stage3D inside of flapper.
 const char kDisableFlashStage3d[]           = "disable-flash-stage3d";
 
-// This flag disables force compositing mode and prevents it from being enabled
-// via field trials.
-const char kDisableForceCompositingMode[]   = "disable-force-compositing-mode";
-
-// Disable the JavaScript Full Screen API.
-const char kDisableFullScreen[]             = "disable-fullscreen";
-
-// Suppresses support for the Geolocation javascript API.
-const char kDisableGeolocation[]            = "disable-geolocation";
-
-// Disable deferral of scroll-ending gesture events when a scroll is active.
-const char kDisableGestureDebounce[]        = "disable-gesture-debounce";
-
 const char kDisableGestureTapHighlight[]    = "disable-gesture-tap-highlight";
 
-// Disable GL multisampling.
-const char kDisableGLMultisampling[]        = "disable-gl-multisampling";
-
 // Disables GPU hardware acceleration.  If software renderer is not in place,
 // then the GPU process won't launch.
 const char kDisableGpu[]                    = "disable-gpu";
@@ -217,9 +166,14 @@ const char kDisableGpuCompositing[]         = "disable-gpu-compositing";
 extern const char kDisableGpuProcessCrashLimit[] =
     "disable-gpu-process-crash-limit";
 
-// Do not launch the GPU process shortly after browser process launch. Instead
-// launch it when it is first needed.
-const char kDisableGpuProcessPrelaunch[]    = "disable-gpu-process-prelaunch";
+// Disable GPU rasterization, i.e. rasterize on the CPU only.
+// Overrides the kEnableGpuRasterization and kForceGpuRasterization flags.
+const char kDisableGpuRasterization[]       = "disable-gpu-rasterization";
+
+// When using CPU rasterizing disable low resolution tiling. This uses
+// less power, particularly during animations, but more white may be seen
+// during fast scrolling especially on slower devices.
+const char kDisableLowResTiling[] = "disable-low-res-tiling";
 
 // Disable the GPU process sandbox.
 const char kDisableGpuSandbox[]             = "disable-gpu-sandbox";
@@ -236,9 +190,9 @@ const char kDisableHangMonitor[]            = "disable-hang-monitor";
 // Disable the RenderThread's HistogramCustomizer.
 const char kDisableHistogramCustomizer[]    = "disable-histogram-customizer";
 
-// Disable the use of an ImageTransportSurface. This means the GPU process
-// will present the rendered page rather than the browser process.
-const char kDisableImageTransportSurface[]  = "disable-image-transport-surface";
+// Paint content on the main thread instead of the compositor thread.
+// Overrides the kEnableImplSidePainting flag.
+const char kDisableImplSidePainting[]       = "disable-impl-side-painting";
 
 // Prevent Java from running.
 const char kDisableJava[]                   = "disable-java";
@@ -255,6 +209,12 @@ const char kDisableKillAfterBadIPC[]        = "disable-kill-after-bad-ipc";
 const char kDisablePrefixedEncryptedMedia[] =
     "disable-prefixed-encrypted-media";
 
+// Disables LCD text.
+const char kDisableLCDText[]                = "disable-lcd-text";
+
+// Disables distance field text.
+const char kDisableDistanceFieldText[]      = "disable-distance-field-text";
+
 // Disable LocalStorage.
 const char kDisableLocalStorage[]           = "disable-local-storage";
 
@@ -262,10 +222,8 @@ const char kDisableLocalStorage[]           = "disable-local-storage";
 // builds.
 const char kDisableLogging[]                = "disable-logging";
 
-// Allows P2P sockets to talk UDP to other servers without using STUN first.
-// For development only, use with caution.
-// TODO(hubbe): Remove this flag.
-const char kDisableP2PSocketSTUNFilter[]    = "disable-p2psocket-stun-filter";
+// Disables Media Source API (i.e., the MediaSource object).
+const char kDisableMediaSource[]            = "disable-media-source";
 
 // Disable Pepper3D.
 const char kDisablePepper3d[]               = "disable-pepper-3d";
@@ -288,6 +246,9 @@ const char kDisableRemoteFonts[]            = "disable-remote-fonts";
 // Turns off the accessibility in the renderer.
 const char kDisableRendererAccessibility[]  = "disable-renderer-accessibility";
 
+// Disables the new layout/paint system which paints after layout is complete.
+const char kDisableRepaintAfterLayout[]     = "disable-repaint-after-layout";
+
 // Disable the seccomp filter sandbox (seccomp-bpf) (Linux only).
 const char kDisableSeccompFilterSandbox[]   = "disable-seccomp-filter-sandbox";
 
@@ -309,32 +270,12 @@ const char kDisableSmoothScrolling[]        = "disable-smooth-scrolling";
 // Disables the use of a 3D software rasterizer.
 const char kDisableSoftwareRasterizer[]     = "disable-software-rasterizer";
 
-// Disables speech input.
-const char kDisableSpeechInput[]            = "disable-speech-input";
-
 // Disable False Start in SSL and TLS connections.
 const char kDisableSSLFalseStart[]          = "disable-ssl-false-start";
 
 // Disable multithreaded GPU compositing of web content.
 const char kDisableThreadedCompositing[]     = "disable-threaded-compositing";
 
-// Disables the threaded HTML parser in Blink
-const char kDisableThreadedHTMLParser[]     = "disable-threaded-html-parser";
-
-// Disable accelerated overflow scrolling in corner cases (that would not be
-// handled by enable-accelerated-overflow-scroll).
-const char kDisableUniversalAcceleratedOverflowScroll[] =
-    "disable-universal-accelerated-overflow-scroll";
-
-// Disables unprefixed Media Source API (i.e., the MediaSource object).
-const char kDisableUnprefixedMediaSource[]  = "disable-unprefixed-media-source";
-
-// Disable CSS Transitions / Animations on the Web Animations model.
-const char kDisableWebAnimationsCSS[]        = "disable-web-animations-css";
-
-// Disables prefixed Media Source API (i.e., the WebKitMediaSource object).
-const char kDisableWebKitMediaSource[]      = "disable-webkit-media-source";
-
 // Don't enforce the same-origin policy. (Used by people testing their sites.)
 const char kDisableWebSecurity[]            = "disable-web-security";
 
@@ -344,17 +285,27 @@ const char kDisableXSLT[]                   = "disable-xslt";
 // Disables Blink's XSSAuditor. The XSSAuditor mitigates reflective XSS.
 const char kDisableXSSAuditor[]             = "disable-xss-auditor";
 
+// Disable rasterizer that writes directly to GPU memory associated with tiles.
+// Overrides the kEnableZeroCopy flag.
+const char kDisableZeroCopy[]               = "disable-zero-copy";
+
 // Specifies if the |DOMAutomationController| needs to be bound in the
 // renderer. This binding happens on per-frame basis and hence can potentially
 // be a performance bottleneck. One should only enable it when automating dom
 // based tests.
 const char kDomAutomationController[]       = "dom-automation";
 
-// Enable gpu-accelerated SVG/W3C filters.
-const char kEnableAcceleratedFilters[]      = "enable-accelerated-filters";
+// Enable bleeding-edge code to make Chrome draw content faster. The changes
+// behind this path are very likely to break lots of content.
+// ** DO NOT use this flag unless you know what you are doing. **
+const char kEnableBleedingEdgeRenderingFastPaths[] =
+    "enable-bleeding-edge-rendering-fast-paths";
+
+// Disable deferred image filters.
+const char kDisableDeferredFilters[]         = "disable-deferred-filters";
 
 // Enables accelerated compositing for backgrounds of root layers with
-// background-attachment: fixed. Requires kForceCompositingMode.
+// background-attachment: fixed.
 const char kEnableAcceleratedFixedRootBackground[] =
     "enable-accelerated-fixed-root-background";
 
@@ -363,35 +314,24 @@ const char kEnableAcceleratedFixedRootBackground[] =
 const char kEnableAcceleratedOverflowScroll[] =
     "enable-accelerated-overflow-scroll";
 
+// Enables LCD text.
+const char kEnableLCDText[]                 = "enable-lcd-text";
+
+// Enables using signed distance fields when rendering text.
+// Only valid if GPU rasterization is enabled as well.
+const char kEnableDistanceFieldText[]       = "enable-distance-field-text";
+
 // Enables experimental feature that maps multiple RenderLayers to
 // one composited layer to avoid pathological layer counts.
 const char kEnableLayerSquashing[] =
     "enable-layer-squashing";
 
-// Enables accelerated compositing for scrollable frames for accelerated
-// scrolling for them. Requires kForceCompositingMode.
-const char kEnableAcceleratedScrollableFrames[] =
-     "enable-accelerated-scrollable-frames";
-
-// Turns on extremely verbose logging of accessibility events.
-const char kEnableAccessibilityLogging[]    = "enable-accessibility-logging";
+// Enable experimental container node culling.
+const char kEnableContainerCulling[]        = "enable-container-culling";
 
-// Use a BeginImplFrame signal from browser to renderer to schedule rendering.
+// Use a BeginFrame signal from browser to renderer to schedule rendering.
 const char kEnableBeginFrameScheduling[]    = "enable-begin-frame-scheduling";
 
-// Enables browser plugin for all types of pages.
-const char kEnableBrowserPluginForAllViewTypes[] =
-    "enable-browser-plugin-for-all-view-types";
-
-// Enables Drag and Drop into and out of Browser Plugin.
-// kEnableBrowserPluginGuestViews must also be set at this time.
-const char kEnableBrowserPluginDragDrop[]   = "enable-browser-plugin-drag-drop";
-
-// Enables accelerated scrolling by the compositor for frames. Requires
-// kForceCompositingMode and kEnableAcceleratedScrollableFrames.
-const char kEnableCompositedScrollingForFrames[] =
-     "enable-composited-scrolling-for-frames";
-
 // Enable the creation of compositing layers for fixed position
 // elements. Three options are needed to support four possible scenarios:
 //  1. Default (disabled)
@@ -418,9 +358,6 @@ const char kEnableCompositingForTransition[] =
 // Defer image decoding in WebKit until painting.
 const char kEnableDeferredImageDecoding[]   = "enable-deferred-image-decoding";
 
-// Enables the deadline scheduler.
-const char kEnableDeadlineScheduling[]      = "enable-deadline-scheduling";
-
 // Enables delegated renderer.
 const char kEnableDelegatedRenderer[]       = "enable-delegated-renderer";
 
@@ -438,45 +375,38 @@ const char kEnableExperimentalCanvasFeatures[] =
 const char kEnableExperimentalWebPlatformFeatures[] =
     "enable-experimental-web-platform-features";
 
-// Enable an experimental WebSocket implementation.
-const char kEnableExperimentalWebSocket[]   = "enable-experimental-websocket";
+// By default, cookies are not allowed on file://. They are needed for testing,
+// for example page cycler and layout tests. See bug 1157243.
+const char kEnableFileCookies[]             = "enable-file-cookies";
 
 // Enable the fast text autosizing implementation.
 const char kEnableFastTextAutosizing[]      = "enable-fast-text-autosizing";
 
-const char kEnableFixedPositionCreatesStackingContext[]
-    = "enable-fixed-position-creates-stacking-context";
-
 // Enable Gesture Tap Highlight
 const char kEnableGestureTapHighlight[]     = "enable-gesture-tap-highlight";
 
-// Enables the GPU benchmarking extension
-const char kEnableGpuBenchmarking[]         = "enable-gpu-benchmarking";
-
 // Enables TRACE for GL calls in the renderer.
 const char kEnableGpuClientTracing[]        = "enable-gpu-client-tracing";
 
+// Allow heuristics to determine when a layer tile should be drawn with the
+// Skia GPU backend. Only valid with GPU accelerated compositing +
+// impl-side painting.
+const char kEnableGpuRasterization[]        = "enable-gpu-rasterization";
+
+// When using CPU rasterizing generate low resolution tiling. Low res
+// tiles may be displayed during fast scrolls especially on slower devices.
+const char kEnableLowResTiling[] = "enable-low-res-tiling";
+
 // See comment for kEnableCompositingForFixedPosition.
 const char kEnableHighDpiCompositingForFixedPosition[] =
      "enable-high-dpi-fixed-position-compositing";
 
-#if defined(OS_WIN)
-// Enables the DirectWrite font rendering system on windows.
-const char kEnableDirectWrite[]             = "enable-direct-write";
-
-// Use high resolution timers for TimeTicks.
-const char kEnableHighResolutionTime[]      = "enable-high-resolution-time";
-#endif
-
-// Enable HTML Imports
-extern const char kEnableHTMLImports[]      = "enable-html-imports";
+// Paint content on the compositor thread instead of the main thread.
+const char kEnableImplSidePainting[]        = "enable-impl-side-painting";
 
 // Enables support for inband text tracks in media content.
 const char kEnableInbandTextTracks[]        = "enable-inband-text-tracks";
 
-// Enable inputmode attribute of HTML input or text element.
-extern const char kEnableInputModeAttribute[] = "enable-input-mode-attribute";
-
 // Force logging to be enabled.  Logging is disabled by default in release
 // builds.
 const char kEnableLogging[]                 = "enable-logging";
@@ -484,19 +414,15 @@ const char kEnableLogging[]                 = "enable-logging";
 // Enables the memory benchmarking extension
 const char kEnableMemoryBenchmarking[]      = "enable-memory-benchmarking";
 
-// On Windows, converts the page to the currently-installed monitor profile.
-// This does NOT enable color management for images. The source is still
-// assumed to be sRGB.
-const char kEnableMonitorProfile[]          = "enable-monitor-profile";
-
-// Enables use of cache if offline, even if it's stale
-const char kEnableOfflineCacheAccess[]      = "enable-offline-cache-access";
+// Enable rasterizer that writes directly to GPU memory.
+const char kEnableOneCopy[]                 = "enable-one-copy";
 
 // Enables use of hardware overlay for fullscreen video playback. Android only.
 const char kEnableOverlayFullscreenVideo[]  = "enable-overlay-fullscreen-video";
 
-// Enables overlay scrollbars on Aura or Linux. Does nothing on Mac.
-const char kEnableOverlayScrollbars[]       = "enable-overlay-scrollbars";
+// Disables blink subtitle and media control on top of overlay fullscreen video.
+const char kDisableOverlayFullscreenVideoSubtitle[] =
+    "disable-overlay-fullscreen-video-subtitle";
 
 // Forward overscroll event data from the renderer to the browser.
 const char kEnableOverscrollNotifications[] = "enable-overscroll-notifications";
@@ -504,18 +430,15 @@ const char kEnableOverscrollNotifications[] = "enable-overscroll-notifications";
 // Enables compositor-accelerated touch-screen pinch gestures.
 const char kEnablePinch[]                   = "enable-pinch";
 
+// Make the values returned to window.performance.memory more granular and more
+// up to date in shared worker. Without this flag, the memory information is
+// still available, but it is bucketized and updated less frequently. This flag
+// also applys to workers.
+const char kEnablePreciseMemoryInfo[] = "enable-precise-memory-info";
+
 // Enable caching of pre-parsed JS script data.  See http://crbug.com/32407.
 const char kEnablePreparsedJsCaching[]      = "enable-preparsed-js-caching";
 
-// Enable privileged WebGL extensions; without this switch such extensions are
-// available only to Chrome extensions.
-const char kEnablePrivilegedWebGLExtensions[] =
-    "enable-privileged-webgl-extensions";
-
-// Aggressively free GPU command buffers belonging to hidden tabs.
-const char kEnablePruneGpuCommandBuffers[] =
-    "enable-prune-gpu-command-buffers";
-
 // Enables the CSS multicol implementation that uses the regions implementation.
 const char kEnableRegionBasedColumns[] =
     "enable-region-based-columns";
@@ -524,28 +447,31 @@ const char kEnableRegionBasedColumns[] =
 const char kEnableRepaintAfterLayout[] =
     "enable-repaint-after-layout";
 
+// Enables targeted style recalculation optimizations.
+const char kEnableTargetedStyleRecalc[] =
+    "enable-targeted-style-recalc";
+
 // Cause the OS X sandbox write to syslog every time an access to a resource
 // is denied by the sandbox.
 const char kEnableSandboxLogging[]          = "enable-sandbox-logging";
 
+// Enables seccomp-bpf support for Android. Requires experimental kernel
+// support. <http://crbug.com/166704>
+const char kEnableSeccompFilterSandbox[] =
+    "enable-seccomp-filter-sandbox";
+
 // Enables the Skia benchmarking extension
 const char kEnableSkiaBenchmarking[]        = "enable-skia-benchmarking";
 
 // On platforms that support it, enables smooth scroll animation.
 const char kEnableSmoothScrolling[]         = "enable-smooth-scrolling";
 
-// Allow the compositor to use its software implementation if GL fails.
-const char kEnableSoftwareCompositing[]     = "enable-software-compositing";
-
 // Enable spatial navigation
 const char kEnableSpatialNavigation[]       = "enable-spatial-navigation";
 
 // Enables the synthesis part of the Web Speech API.
 const char kEnableSpeechSynthesis[]         = "enable-speech-synthesis";
 
-// Enables TLS cached info extension.
-const char kEnableSSLCachedInfo[]           = "enable-ssl-cached-info";
-
 // Enables StatsTable, logging statistics to a global named shared memory table.
 const char kEnableStatsTable[]              = "enable-stats-table";
 
@@ -565,21 +491,16 @@ const char kEnableStrictSiteIsolation[]     = "enable-strict-site-isolation";
 // https://github.com/slightlyoff/ServiceWorker for more information.
 const char kEnableServiceWorker[]           = "enable-service-worker";
 
+// Enable support for sync events in ServiceWorkers.
+const char kEnableServiceWorkerSync[]       = "enable-service-worker-sync";
+
 // Enable use of experimental TCP sockets API for sending data in the
 // SYN packet.
 const char kEnableTcpFastOpen[]             = "enable-tcp-fastopen";
 
-// Enable Text Service Framework(TSF) for text inputting instead of IMM32. This
-// flag is ignored on Metro environment.
-const char kEnableTextServicesFramework[]   = "enable-text-services-framework";
-
 // Enable multithreaded GPU compositing of web content.
 const char kEnableThreadedCompositing[]     = "enable-threaded-compositing";
 
-// Enable accelerated overflow scrolling in all cases.
-const char kEnableUniversalAcceleratedOverflowScroll[] =
-    "enable-universal-accelerated-overflow-scroll";
-
 // Enable screen capturing support for MediaStream API.
 const char kEnableUserMediaScreenCapturing[] =
     "enable-usermedia-screen-capturing";
@@ -598,31 +519,27 @@ const char kEnableViewportMeta[]            = "enable-viewport-meta";
 const char kMainFrameResizesAreOrientationChanges[] =
     "main-frame-resizes-are-orientation-changes";
 
-// Enables moving cursor by word in visual order.
-const char kEnableVisualWordMovement[]      = "enable-visual-word-movement";
-
 // Enable the Vtune profiler support.
 const char kEnableVtune[]                   = "enable-vtune-support";
 
-// Enable CSS Transitions / Animations on the Web Animations model.
-const char kEnableWebAnimationsCSS[]        = "enable-web-animations-css";
-
 // Enable SVG Animations on the Web Animations model.
 const char kEnableWebAnimationsSVG[]        = "enable-web-animations-svg";
 
 // Enables WebGL extensions not yet approved by the community.
 const char kEnableWebGLDraftExtensions[] = "enable-webgl-draft-extensions";
 
+// Enables WebGL rendering into a scanout buffer for overlay support.
+const char kEnableWebGLImageChromium[] = "enable-webgl-image-chromium";
+
 // Enables Web MIDI API.
 const char kEnableWebMIDI[]                 = "enable-web-midi";
 
+// Enable rasterizer that writes directly to GPU memory associated with tiles.
+const char kEnableZeroCopy[]                = "enable-zero-copy";
+
 // Load NPAPI plugins from the specified directory.
 const char kExtraPluginDir[]                = "extra-plugin-dir";
 
-// If accelerated compositing is supported, always enter compositing mode for
-// the base layer even when compositing is not strictly required.
-const char kForceCompositingMode[]          = "force-compositing-mode";
-
 // Some field trials may be randomized in the browser, and the randomly selected
 // outcome needs to be propagated to the renderer. For instance, this is used
 // to modify histograms recorded in the renderer, or to get the renderer to
@@ -633,6 +550,11 @@ const char kForceCompositingMode[]          = "force-compositing-mode";
 // field_trial.h for details.
 const char kForceFieldTrials[]              = "force-fieldtrials";
 
+// Always use the Skia GPU backend for drawing layer tiles. Only valid with GPU
+// accelerated compositing + impl-side painting. Overrides the
+// kEnableGpuRasterization flag.
+const char kForceGpuRasterization[]        = "force-gpu-rasterization";
+
 // Force renderer accessibility to be on instead of enabling it on demand when
 // a screen reader is detected. The disable-renderer-accessibility switch
 // overrides this if present.
@@ -657,6 +579,13 @@ const char kGpuProcess[]                    = "gpu-process";
 // Allow shmat system call in GPU sandbox.
 const char kGpuSandboxAllowSysVShm[]        = "gpu-sandbox-allow-sysv-shm";
 
+// Makes GPU sandbox failures fatal.
+const char kGpuSandboxFailuresFatal[]       = "gpu-sandbox-failures-fatal";
+
+// Allow GPU sandbox to start later
+const char kGpuSandboxStartAfterInitialization[] =
+    "gpu-sandbox-start-after-initialization";
+
 // Causes the GPU process to display a dialog on launch.
 const char kGpuStartupDialog[]              = "gpu-startup-dialog";
 
@@ -675,8 +604,9 @@ const char kIgnoreGpuBlacklist[]            = "ignore-gpu-blacklist";
 // Run the GPU process as a thread in the browser process.
 const char kInProcessGPU[]                  = "in-process-gpu";
 
-// Runs plugins inside the renderer process
-const char kInProcessPlugins[]              = "in-process-plugins";
+// Overrides the timeout, in seconds, that a child process waits for a
+// connection from the browser before killing itself.
+const char kIPCConnectionTimeout[]          = "ipc-connection-timeout";
 
 // Specifies the flags passed to JS engine
 const char kJavaScriptFlags[]               = "js-flags";
@@ -691,8 +621,7 @@ const char kLogGpuControlListDecisions[]    = "log-gpu-control-list-decisions";
 // INFO = 0, WARNING = 1, LOG_ERROR = 2, LOG_FATAL = 3.
 const char kLoggingLevel[]                  = "log-level";
 
-// Enables displaying net log events on the command line, or writing the events
-// to a separate file if a file name is given.
+// Enables saving net log events to a file and sets the file name to use.
 const char kLogNetLog[]                     = "log-net-log";
 
 // Make plugin processes log their sent and received messages to VLOG(1).
@@ -716,6 +645,9 @@ const char kNoReferrers[]                   = "no-referrers";
 // Disables the sandbox for all process types that are normally sandboxed.
 const char kNoSandbox[]                     = "no-sandbox";
 
+// Number of worker threads used to rasterize content.
+const char kNumRasterThreads[]              = "num-raster-threads";
+
 // Enables or disables history navigation in response to horizontal overscroll.
 // Set the value to '1' to enable the feature, and set to '0' to disable.
 // Defaults to enabled.
@@ -771,9 +703,6 @@ const char kProcessPerTab[]                 = "process-per-tab";
 // renderer or plugin host.  If it's empty, it's the browser.
 const char kProcessType[]                   = "type";
 
-// Reduces the GPU process sandbox to be less strict.
-const char kReduceGpuSandbox[]              = "reduce-gpu-sandbox";
-
 // Enables more web features over insecure connections. Designed to be used
 // for testing purposes only.
 const char kReduceSecurityForTesting[]      = "reduce-security-for-testing";
@@ -814,11 +743,6 @@ const char kScrollEndEffect[] = "scroll-end-effect";
 // and study painting behavior.
 const char kShowPaintRects[]                = "show-paint-rects";
 
-// Map mouse input events into touch gesture events.  Useful for debugging touch
-// gestures without needing a touchscreen.
-const char kSimulateTouchScreenWithMouse[]  =
-    "simulate-touch-screen-with-mouse";
-
 // Runs the renderer and plugins in the same process as the browser
 const char kSingleProcess[]                 = "single-process";
 
@@ -840,8 +764,9 @@ const char kSitePerProcess[]                = "site-per-process";
 // TODO(gab): Get rid of this switch entirely.
 const char kSkipGpuDataLoading[]            = "skip-gpu-data-loading";
 
-// Specifies the request key for the continuous speech recognition webservice.
-const char kSpeechRecognitionWebserviceKey[] = "speech-service-key";
+// Specifies if the browser should start in fullscreen mode, like if the user
+// had pressed F11 right after startup.
+const char kStartFullscreen[] = "start-fullscreen";
 
 // Specifies if the |StatsCollectionController| needs to be bound in the
 // renderer. This binding happens on per-frame basis and hence can potentially
@@ -862,12 +787,13 @@ const char kTabCaptureUpscaleQuality[]      = "tab-capture-upscale-quality";
 const char kTestingFixedHttpPort[]          = "testing-fixed-http-port";
 const char kTestingFixedHttpsPort[]         = "testing-fixed-https-port";
 
-// Runs the security test for the renderer sandbox.
-const char kTestSandbox[]                   = "test-sandbox";
+// Type of the current test harness ("browser" or "ui").
+const char kTestType[]                      = "test-type";
 
-// Enable timeout-based touch event cancellation if a touch ack is delayed.
-// If unspecified, touch timeout behavior will be disabled.
-const char kTouchAckTimeoutDelayMs[]        = "touch-ack-timeout-delay-ms";
+const char kTouchScrollingMode[]            = "touch-scrolling-mode";
+const char kTouchScrollingModeAsyncTouchmove[] = "async-touchmove";
+const char kTouchScrollingModeSyncTouchmove[] = "sync-touchmove";
+const char kTouchScrollingModeTouchcancel[] = "touchcancel";
 
 // Causes TRACE_EVENT flags to be recorded beginning with shutdown. Optionally,
 // can specify the specific trace categories to include (e.g.
@@ -911,21 +837,18 @@ const char kTraceStartupFile[]              = "trace-startup-file";
 extern const char kUIPrioritizeInGpuProcess[] =
     "ui-prioritize-in-gpu-process";
 
-// Use fake device for MediaStream to replace actual camera and microphone.
-const char kUseFakeDeviceForMediaStream[] = "use-fake-device-for-media-stream";
+// Overrides the preferred discardable memory implementation.
+const char kUseDiscardableMemory[] = "use-discardable-memory";
 
 // Bypass the media stream infobar by selecting the default device for media
 // streams (e.g. WebRTC). Works with --use-fake-device-for-media-stream.
 const char kUseFakeUIForMediaStream[]     = "use-fake-ui-for-media-stream";
 
-// Use hardware gpu, if available, for tests.
-const char kUseGpuInTests[]                 = "use-gpu-in-tests";
-
 // Set when Chromium should use a mobile user agent.
 const char kUseMobileUserAgent[] = "use-mobile-user-agent";
 
-// A string used to override the default user agent with a custom one.
-const char kUserAgent[]                     = "user-agent";
+// Use the new surfaces system to handle compositor delegation.
+const char kUseSurfaces[] = "use-surfaces";
 
 // On POSIX only: the contents of this flag are prepended to the utility
 // process command line. Useful values might be "valgrind" or "xterm -e gdb
@@ -942,18 +865,16 @@ const char kUtilityProcessAllowedDir[]      = "utility-allowed-dir";
 // Allows MDns to access network in sandboxed process.
 const char kUtilityProcessEnableMDns[]      = "utility-enable-mdns";
 
+const char kUtilityProcessRunningElevated[] = "utility-run-elevated";
+
+// In debug builds, asserts that the stream of input events is valid.
+const char kValidateInputEventStream[] = "validate-input-event-stream";
+
 // Will add kWaitForDebugger to every child processes. If a value is passed, it
 // will be used as a filter to determine if the child process should have the
 // kWaitForDebugger flag passed on or not.
 const char kWaitForDebuggerChildren[]       = "wait-for-debugger-children";
 
-// Choose which logging channels in WebCore to activate.  See
-// Logging.cpp in WebKit's WebCore for a list of available channels.
-const char kWebCoreLogChannels[]            = "webcore-log-channels";
-
-// Overrides the amount of shared memory the webgl command buffer allocates
-const char kWebGLCommandBufferSizeKb[]      = "webgl-command-buffer-size-kb";
-
 // Causes the process to run as a worker subprocess.
 const char kWorkerProcess[]                 = "worker";
 
@@ -964,16 +885,13 @@ const char kZygoteCmdPrefix[]               = "zygote-cmd-prefix";
 const char kZygoteProcess[]                 = "zygote";
 
 #if defined(ENABLE_WEBRTC)
-// Enables audio processing in a MediaStreamTrack. When this flag is on, AEC,
-// NS and AGC will be done per MediaStreamTrack instead of in PeerConnection.
-const char kEnableAudioTrackProcessing[]    = "enable-audio-track-processing";
+// Disables audio processing in a MediaStreamTrack. When this flag is on, AEC,
+// NS and AGC will be done in PeerConnection instead of MediaStreamTrack.
+const char kDisableAudioTrackProcessing[]    = "disable-audio-track-processing";
 
 // Disables WebRTC device enumeration.
 const char kDisableDeviceEnumeration[]      = "disable-device-enumeration";
 
-// Disables WebRTC DataChannels SCTP wire protocol support.
-const char kDisableSCTPDataChannels[]       = "disable-sctp-data-channels";
-
 // Disables HW decode acceleration for WebRTC.
 const char kDisableWebRtcHWDecoding[]       = "disable-webrtc-hw-decoding";
 
@@ -984,27 +902,17 @@ const char kDisableWebRtcEncryption[]      = "disable-webrtc-encryption";
 // Disables HW encode acceleration for WebRTC.
 const char kDisableWebRtcHWEncoding[]       = "disable-webrtc-hw-encoding";
 
-// Enables WebRTC AEC recordings.
-const char kEnableWebRtcAecRecordings[]     = "enable-webrtc-aec-recordings";
-
-// Enables WebRTC to open TCP server sockets.
-const char kEnableWebRtcTcpServerSocket[]   = "enable-webrtc-tcp-server-socket";
-
 // Enables VP8 HW encode acceleration for WebRTC.
 const char kEnableWebRtcHWVp8Encoding[]     = "enable-webrtc-hw-vp8-encoding";
 #endif
 
 #if defined(OS_ANDROID)
-// Disable user gesture requirement for the media element to enter fullscreen.
-const char kDisableGestureRequirementForMediaFullscreen[] =
-    "disable-gesture-requirement-for-media-fullscreen";
-
 // Disable user gesture requirement for media playback.
 const char kDisableGestureRequirementForMediaPlayback[] =
     "disable-gesture-requirement-for-media-playback";
 
-// Disable history logging for media elements.
-const char kDisableMediaHistoryLogging[]    = "disable-media-history";
+// Disable the click delay by sending click events during double tap.
+const char kDisableClickDelay[]             = "disable-click-delay";
 
 // Disable overscroll edge effects like those found in Android views.
 const char kDisableOverscrollEdgeEffect[]   = "disable-overscroll-edge-effect";
@@ -1015,9 +923,9 @@ const char kDisableWebRTC[]                 = "disable-webrtc";
 // Enable the recognition part of the Web Speech API.
 const char kEnableSpeechRecognition[]       = "enable-speech-recognition";
 
-// Don't display any scrollbars. This is useful for Android WebView where
-// the system manages the scrollbars instead.
-const char kHideScrollbars[]                = "hide-scrollbars";
+// Always use the video overlay for the embedded video.
+// This switch is intended only for tests.
+const char kForceUseOverlayEmbeddedVideo[] = "force-use-overlay-embedded-video";
 
 // The telephony region (ISO country code) to use in phone number detection.
 const char kNetworkCountryIso[] = "network-country-iso";
@@ -1026,12 +934,8 @@ const char kNetworkCountryIso[] = "network-country-iso";
 const char kRemoteDebuggingSocketName[]     = "remote-debugging-socket-name";
 #endif
 
-#if defined(OS_ANDROID) && defined(ARCH_CPU_X86)
-const char kEnableWebAudio[]                = "enable-webaudio";
-#else
 // Disable web audio API.
 const char kDisableWebAudio[]               = "disable-webaudio";
-#endif
 
 #if defined(OS_CHROMEOS)
 // Disables panel fitting (used for mirror mode).
@@ -1039,20 +943,32 @@ const char kDisablePanelFitting[]           = "disable-panel-fitting";
 #endif
 
 #if defined(OS_MACOSX) && !defined(OS_IOS)
-const char kDisableCarbonInterposing[]      = "disable-carbon-interposing";
+const char kEnableCarbonInterposing[]       = "enable-carbon-interposing";
 
 // Disables support for Core Animation plugins. This is triggered when
 // accelerated compositing is disabled. See http://crbug.com/122430 .
 const char kDisableCoreAnimationPlugins[] =
     "disable-core-animation-plugins";
-
-// Use core animation to draw the RenderWidgetHostView on Mac.
-const char kUseCoreAnimation[]              = "use-core-animation";
 #endif
 
-#if defined(OS_POSIX)
-// Causes the child processes to cleanly exit via calling exit().
-const char kChildCleanExit[]                = "child-clean-exit";
+#if defined(OS_WIN)
+// Device scale factor passed to certain processes like renderers, etc.
+const char kDeviceScaleFactor[]     = "device-scale-factor";
+
+// Disables the DirectWrite font rendering system on windows.
+const char kDisableDirectWrite[]             = "disable-direct-write";
+
+// Disable the Legacy Window which corresponds to the size of the WebContents.
+const char kDisableLegacyIntermediateWindow[] = "disable-legacy-window";
+
+// Use high resolution timers for TimeTicks.
+const char kEnableHighResolutionTime[]      = "enable-high-resolution-time";
+
+// Enable the Win32K process mitigation policy for renderer processes which
+// prevents them from invoking user32 and gdi32 system calls which enter
+// the kernel. This is only supported on Windows 8 and beyond.
+const char kEnableWin32kRendererLockDown[]
+    = "enable_win32k_renderer_lockdown";
 #endif
 
 // Don't dump stuff here, follow the same order as the header.
diff --git a/chromium/content/public/common/content_switches.h b/chromium/content/public/common/content_switches.h
index 11842883b8e..6b7042a2126 100644
--- a/chromium/content/public/common/content_switches.h
+++ b/chromium/content/public/common/content_switches.h
@@ -16,13 +16,13 @@ namespace switches {
 // alongside the definition of their values in the .cc file.
 CONTENT_EXPORT extern const char kAcceleratedCanvas2dMSAASampleCount[];
 CONTENT_EXPORT extern const char kAllowFileAccessFromFiles[];
+CONTENT_EXPORT extern const char kAllowInsecureWebSocketFromHttpsOrigin[];
+CONTENT_EXPORT extern const char kAllowLoopbackInPeerConnection[];
 CONTENT_EXPORT extern const char kAllowNoSandboxJob[];
 extern const char kAllowSandboxDebugging[];
-CONTENT_EXPORT extern const char kAllowWebUICompositing[];
 extern const char kAuditAllHandles[];
 extern const char kAuditHandles[];
-CONTENT_EXPORT extern const char kBlacklistAcceleratedCompositing[];
-CONTENT_EXPORT extern const char kBlacklistWebGL[];
+CONTENT_EXPORT extern const char kBlinkPlatformLogChannels[];
 CONTENT_EXPORT extern const char kBlockCrossSiteDocuments[];
 CONTENT_EXPORT extern const char kBrowserAssertTest[];
 CONTENT_EXPORT extern const char kBrowserCrashTest[];
@@ -33,66 +33,53 @@ CONTENT_EXPORT extern const char kDefaultTileHeight[];
 CONTENT_EXPORT extern const char kDisable2dCanvasAntialiasing[];
 CONTENT_EXPORT extern const char kDisable3DAPIs[];
 CONTENT_EXPORT extern const char kDisableAccelerated2dCanvas[];
-CONTENT_EXPORT extern const char kDisableAcceleratedCompositing[];
 CONTENT_EXPORT extern const char kDisableAcceleratedFixedRootBackground[];
-CONTENT_EXPORT extern const char kDisableAcceleratedLayers[];
 CONTENT_EXPORT extern const char kDisableAcceleratedOverflowScroll[];
 CONTENT_EXPORT extern const char kDisableLayerSquashing[];
-CONTENT_EXPORT extern const char kDisableAcceleratedPlugins[];
-CONTENT_EXPORT extern const char kDisableAcceleratedScrollableFrames[];
-CONTENT_EXPORT extern const char kDisableAcceleratedVideo[];
 CONTENT_EXPORT extern const char kDisableAcceleratedVideoDecode[];
-CONTENT_EXPORT extern const char kDisableAltWinstation[];
 CONTENT_EXPORT extern const char kDisableApplicationCache[];
-CONTENT_EXPORT extern const char kDisableAudio[];
 extern const char kDisableBackingStoreLimit[];
-CONTENT_EXPORT extern const char kDisableBrowserPluginCompositing[];
-CONTENT_EXPORT extern const char kDisableCompositedScrollingForFrames[];
 CONTENT_EXPORT extern const char kDisableCompositingForFixedPosition[];
 CONTENT_EXPORT extern const char kDisableCompositingForTransition[];
 CONTENT_EXPORT extern const char kDisableDatabases[];
-CONTENT_EXPORT extern const char kDisableDeadlineScheduling[];
 CONTENT_EXPORT extern const char kDisableDelegatedRenderer[];
 extern const char kDisableDesktopNotifications[];
-CONTENT_EXPORT extern const char kDisableDeviceMotion[];
-CONTENT_EXPORT extern const char kDisableDeviceOrientation[];
 extern const char kDisableDirectNPAPIRequests[];
+CONTENT_EXPORT extern const char kDisableDistanceFieldText[];
 extern const char kDisableDomainBlockingFor3DAPIs[];
+CONTENT_EXPORT extern const char kDisableEmbeddedSharedWorker[];
 CONTENT_EXPORT extern const char kDisableExperimentalWebGL[];
+CONTENT_EXPORT extern const char kDisableFastTextAutosizing[];
 CONTENT_EXPORT extern const char kDisableFileSystem[];
-CONTENT_EXPORT extern const char kDisableFiltersOverIPC[];
-CONTENT_EXPORT extern const char kDisableFixedPositionCreatesStackingContext[];
 CONTENT_EXPORT extern const char kDisableFlash3d[];
 CONTENT_EXPORT extern const char kDisableFlashStage3d[];
-CONTENT_EXPORT extern const char kDisableForceCompositingMode[];
-CONTENT_EXPORT extern const char kDisableFullScreen[];
-extern const char kDisableGeolocation[];
-extern const char kDisableGestureDebounce[];
 CONTENT_EXPORT extern const char kDisableGestureTapHighlight[];
-CONTENT_EXPORT extern const char kDisableGLMultisampling[];
 CONTENT_EXPORT extern const char kDisableGpu[];
 CONTENT_EXPORT extern const char kDisableGpuCompositing[];
 extern const char kDisableGpuProcessCrashLimit[];
-CONTENT_EXPORT extern const char kDisableGpuProcessPrelaunch[];
+CONTENT_EXPORT extern const char kDisableGpuRasterization[];
 CONTENT_EXPORT extern const char kDisableGpuSandbox[];
 CONTENT_EXPORT extern const char kDisableGpuWatchdog[];
+CONTENT_EXPORT extern const char kDisableLowResTiling[];
 CONTENT_EXPORT extern const char kDisableHangMonitor[];
 extern const char kDisableHistogramCustomizer[];
-extern const char kDisableImageTransportSurface[];
+CONTENT_EXPORT extern const char kDisableImplSidePainting[];
 CONTENT_EXPORT extern const char kDisableJava[];
 CONTENT_EXPORT extern const char kDisableJavaScript[];
+CONTENT_EXPORT extern const char kDisableLCDText[];
 CONTENT_EXPORT extern const char kDisablePrefixedEncryptedMedia[];
 extern const char kDisableKillAfterBadIPC[];
 CONTENT_EXPORT extern const char kDisableLocalStorage[];
 CONTENT_EXPORT extern const char kDisableLogging[];
+CONTENT_EXPORT extern const char kDisableMediaSource[];
 extern const char kDisableNavigatorContentUtils[];
-extern const char kDisableP2PSocketSTUNFilter[];
 extern const char kDisablePepper3d[];
 CONTENT_EXPORT extern const char kDisablePinch[];
 CONTENT_EXPORT extern const char kDisablePlugins[];
 CONTENT_EXPORT extern const char kDisablePluginsDiscovery[];
 extern const char kDisableRemoteFonts[];
 extern const char kDisableRendererAccessibility[];
+CONTENT_EXPORT extern const char kDisableRepaintAfterLayout[];
 CONTENT_EXPORT extern const char kDisableSeccompFilterSandbox[];
 extern const char kDisableSessionStorage[];
 CONTENT_EXPORT extern const char kDisableSetuidSandbox[];
@@ -100,92 +87,76 @@ CONTENT_EXPORT extern const char kDisableSharedWorkers[];
 extern const char kDisableSiteSpecificQuirks[];
 CONTENT_EXPORT extern const char kDisableSmoothScrolling[];
 CONTENT_EXPORT extern const char kDisableSoftwareRasterizer[];
-CONTENT_EXPORT extern const char kDisableSpeechInput[];
 CONTENT_EXPORT extern const char kDisableSSLFalseStart[];
 CONTENT_EXPORT extern const char kDisableThreadedCompositing[];
-CONTENT_EXPORT extern const char kDisableThreadedHTMLParser[];
-CONTENT_EXPORT extern const char kDisableUniversalAcceleratedOverflowScroll[];
-CONTENT_EXPORT extern const char kDisableUnprefixedMediaSource[];
-extern const char kDisableWebAnimationsCSS[];
-CONTENT_EXPORT extern const char kDisableWebKitMediaSource[];
 CONTENT_EXPORT extern const char kDisableWebSecurity[];
 extern const char kDisableXSLT[];
 extern const char kDisableXSSAuditor[];
+CONTENT_EXPORT extern const char kDisableZeroCopy[];
 CONTENT_EXPORT extern const char kDomAutomationController[];
-CONTENT_EXPORT extern const char kEnableAcceleratedFilters[];
+CONTENT_EXPORT extern const char kEnableBleedingEdgeRenderingFastPaths[];
+CONTENT_EXPORT extern const char kDisableDeferredFilters[];
 CONTENT_EXPORT extern const char kEnableAcceleratedFixedRootBackground[];
 CONTENT_EXPORT extern const char kEnableAcceleratedOverflowScroll[];
 CONTENT_EXPORT extern const char kEnableLayerSquashing[];
-CONTENT_EXPORT extern const char kEnableAcceleratedScrollableFrames[];
-extern const char kEnableAccessibilityLogging[];
+CONTENT_EXPORT extern const char kEnableContainerCulling[];
 CONTENT_EXPORT extern const char kEnableBeginFrameScheduling[];
-CONTENT_EXPORT extern const char kEnableBrowserPluginForAllViewTypes[];
-CONTENT_EXPORT extern const char kEnableBrowserPluginDragDrop[];
-CONTENT_EXPORT extern const char kEnableCompositedScrollingForFrames[];
 CONTENT_EXPORT extern const char kEnableCompositingForFixedPosition[];
 CONTENT_EXPORT extern const char kEnableCompositingForTransition[];
 CONTENT_EXPORT extern const char kEnableDeferredImageDecoding[];
-CONTENT_EXPORT extern const char kEnableDeadlineScheduling[];
 CONTENT_EXPORT extern const char kEnableDelegatedRenderer[];
+CONTENT_EXPORT extern const char kEnableDistanceFieldText[];
 CONTENT_EXPORT extern const char kEnableDownloadResumption[];
 CONTENT_EXPORT extern const char kEnableEncryptedMedia[];
 CONTENT_EXPORT extern const char kEnableExperimentalCanvasFeatures[];
 CONTENT_EXPORT extern const char kEnableExperimentalWebPlatformFeatures[];
-CONTENT_EXPORT extern const char kEnableExperimentalWebSocket[];
-extern const char kEnableFastTextAutosizing[];
-CONTENT_EXPORT extern const char kEnableFixedPositionCreatesStackingContext[];
+CONTENT_EXPORT extern const char kEnableFastTextAutosizing[];
+CONTENT_EXPORT extern const char kEnableFileCookies[];
 CONTENT_EXPORT extern const char kEnableGestureTapHighlight[];
-extern const char kEnableGpuBenchmarking[];
 extern const char kEnableGpuClientTracing[];
+CONTENT_EXPORT extern const char kEnableGpuRasterization[];
+CONTENT_EXPORT extern const char kEnableLowResTiling[];
 CONTENT_EXPORT extern const char kEnableHighDpiCompositingForFixedPosition[];
-#if defined(OS_WIN)
-CONTENT_EXPORT extern const char kEnableDirectWrite[];
-CONTENT_EXPORT extern const char kEnableHighResolutionTime[];
-#endif
-CONTENT_EXPORT extern const char kEnableHTMLImports[];
+CONTENT_EXPORT extern const char kEnableImplSidePainting[];
 CONTENT_EXPORT extern const char kEnableInbandTextTracks[];
-extern const char kEnableInputModeAttribute[];
+CONTENT_EXPORT extern const char kEnableLCDText[];
 CONTENT_EXPORT extern const char kEnableLogging[];
 extern const char kEnableMemoryBenchmarking[];
-extern const char kEnableMonitorProfile[];
-CONTENT_EXPORT extern const char kEnableOfflineCacheAccess[];
+CONTENT_EXPORT extern const char kEnableOneCopy[];
 CONTENT_EXPORT extern const char kEnableOverlayFullscreenVideo[];
-CONTENT_EXPORT extern const char kEnableOverlayScrollbars[];
+CONTENT_EXPORT extern const char kDisableOverlayFullscreenVideoSubtitle[];
 CONTENT_EXPORT extern const char kEnableOverscrollNotifications[];
 CONTENT_EXPORT extern const char kEnablePinch[];
+CONTENT_EXPORT extern const char kEnablePreciseMemoryInfo[];
 extern const char kEnablePreparsedJsCaching[];
-CONTENT_EXPORT extern const char kEnablePrivilegedWebGLExtensions[];
-extern const char kEnablePruneGpuCommandBuffers[];
 CONTENT_EXPORT extern const char kEnableRegionBasedColumns[];
 CONTENT_EXPORT extern const char kEnableRepaintAfterLayout[];
 CONTENT_EXPORT extern const char kEnableSandboxLogging[];
+extern const char kEnableSeccompFilterSandbox[];
 extern const char kEnableSkiaBenchmarking[];
 CONTENT_EXPORT extern const char kEnableSmoothScrolling[];
-CONTENT_EXPORT extern const char kEnableSoftwareCompositing[];
 CONTENT_EXPORT extern const char kEnableSpatialNavigation[];
 CONTENT_EXPORT extern const char kEnableSpeechSynthesis[];
-extern const char kEnableSSLCachedInfo[];
 CONTENT_EXPORT extern const char kEnableStatsTable[];
 extern const char kEnableStrictSiteIsolation[];
 CONTENT_EXPORT extern const char kEnableServiceWorker[];
+CONTENT_EXPORT extern const char kEnableServiceWorkerSync[];
+CONTENT_EXPORT extern const char kEnableTargetedStyleRecalc[];
 CONTENT_EXPORT extern const char kEnableTcpFastOpen[];
-CONTENT_EXPORT extern const char kEnableTextServicesFramework[];
 CONTENT_EXPORT extern const char kEnableThreadedCompositing[];
-CONTENT_EXPORT extern const char kEnableUniversalAcceleratedOverflowScroll[];
 CONTENT_EXPORT extern const char kEnableUserMediaScreenCapturing[];
 CONTENT_EXPORT extern const char kEnableViewport[];
 CONTENT_EXPORT extern const char kEnableViewportMeta[];
 CONTENT_EXPORT extern const char kMainFrameResizesAreOrientationChanges[];
-extern const char kEnableVisualWordMovement[];
 CONTENT_EXPORT extern const char kEnableVtune[];
-// FIXME: Remove this once Web Animations CSS is enabled by default in Blink.
-extern const char kEnableWebAnimationsCSS[];
 extern const char kEnableWebAnimationsSVG[];
 CONTENT_EXPORT extern const char kEnableWebGLDraftExtensions[];
+CONTENT_EXPORT extern const char kEnableWebGLImageChromium[];
 CONTENT_EXPORT extern const char kEnableWebMIDI[];
+CONTENT_EXPORT extern const char kEnableZeroCopy[];
 CONTENT_EXPORT extern const char kExtraPluginDir[];
-CONTENT_EXPORT extern const char kForceCompositingMode[];
 CONTENT_EXPORT extern const char kForceFieldTrials[];
+CONTENT_EXPORT extern const char kForceGpuRasterization[];
 CONTENT_EXPORT extern const char kForceRendererAccessibility[];
 extern const char kGpuDeviceID[];
 extern const char kGpuDriverVendor[];
@@ -193,13 +164,15 @@ extern const char kGpuDriverVersion[];
 extern const char kGpuLauncher[];
 CONTENT_EXPORT extern const char kGpuProcess[];
 CONTENT_EXPORT extern const char kGpuSandboxAllowSysVShm[];
+CONTENT_EXPORT extern const char kGpuSandboxFailuresFatal[];
+CONTENT_EXPORT extern const char kGpuSandboxStartAfterInitialization[];
 CONTENT_EXPORT extern const char kGpuStartupDialog[];
 extern const char kGpuVendorID[];
 CONTENT_EXPORT extern const char kHostResolverRules[];
 CONTENT_EXPORT extern const char kIgnoreCertificateErrors[];
 CONTENT_EXPORT extern const char kIgnoreGpuBlacklist[];
 extern const char kInProcessGPU[];
-extern const char kInProcessPlugins[];
+CONTENT_EXPORT extern const char kIPCConnectionTimeout[];
 CONTENT_EXPORT extern const char kJavaScriptFlags[];
 extern const char kLoadPlugin[];
 CONTENT_EXPORT extern const char kLogGpuControlListDecisions[];
@@ -212,6 +185,7 @@ extern const char kMemoryMetrics[];
 CONTENT_EXPORT extern const char kMuteAudio[];
 CONTENT_EXPORT extern const char kNoReferrers[];
 CONTENT_EXPORT extern const char kNoSandbox[];
+CONTENT_EXPORT extern const char kNumRasterThreads[];
 CONTENT_EXPORT extern const char kOverscrollHistoryNavigation[];
 extern const char kPluginLauncher[];
 CONTENT_EXPORT extern const char kPluginPath[];
@@ -226,7 +200,6 @@ extern const char kPpapiStartupDialog[];
 CONTENT_EXPORT extern const char kProcessPerSite[];
 CONTENT_EXPORT extern const char kProcessPerTab[];
 CONTENT_EXPORT extern const char kProcessType[];
-extern const char kReduceGpuSandbox[];
 CONTENT_EXPORT extern const char kReduceSecurityForTesting[];
 CONTENT_EXPORT extern const char kRegisterPepperPlugins[];
 CONTENT_EXPORT extern const char kRemoteDebuggingPort[];
@@ -238,82 +211,83 @@ CONTENT_EXPORT extern const char kRendererStartupDialog[];
 extern const char kSandboxIPCProcess[];
 CONTENT_EXPORT extern const char kScrollEndEffect[];
 extern const char kShowPaintRects[];
-CONTENT_EXPORT extern const char kSimulateTouchScreenWithMouse[];
 CONTENT_EXPORT extern const char kSingleProcess[];
 CONTENT_EXPORT extern const char kSitePerProcess[];
 CONTENT_EXPORT extern const char kSkipGpuDataLoading[];
-extern const char kSpeechRecognitionWebserviceKey[];
+CONTENT_EXPORT extern const char kStartFullscreen[];
 CONTENT_EXPORT extern const char kStatsCollectionController[];
 CONTENT_EXPORT extern const char kTabCaptureDownscaleQuality[];
 CONTENT_EXPORT extern const char kTabCaptureUpscaleQuality[];
 CONTENT_EXPORT extern const char kTestingFixedHttpPort[];
 CONTENT_EXPORT extern const char kTestingFixedHttpsPort[];
-CONTENT_EXPORT extern const char kTestSandbox[];
-CONTENT_EXPORT extern const char kTouchAckTimeoutDelayMs[];
+CONTENT_EXPORT extern const char kTestType[];
+CONTENT_EXPORT extern const char kTouchScrollingMode[];
+CONTENT_EXPORT extern const char kTouchScrollingModeAsyncTouchmove[];
+CONTENT_EXPORT extern const char kTouchScrollingModeSyncTouchmove[];
+CONTENT_EXPORT extern const char kTouchScrollingModeTouchcancel[];
 CONTENT_EXPORT extern const char kTraceShutdown[];
 extern const char kTraceShutdownFile[];
 extern const char kTraceStartup[];
 extern const char kTraceStartupDuration[];
 extern const char kTraceStartupFile[];
 CONTENT_EXPORT extern const char kUIPrioritizeInGpuProcess[];
-CONTENT_EXPORT extern const char kUseFakeDeviceForMediaStream[];
+CONTENT_EXPORT extern const char kUseDiscardableMemory[];
 CONTENT_EXPORT extern const char kUseFakeUIForMediaStream[];
-CONTENT_EXPORT extern const char kUseGpuInTests[];
 CONTENT_EXPORT extern const char kUseMobileUserAgent[];
-CONTENT_EXPORT extern const char kUserAgent[];
+extern const char kUseSurfaces[];
 extern const char kUtilityCmdPrefix[];
 CONTENT_EXPORT extern const char kUtilityProcess[];
 extern const char kUtilityProcessAllowedDir[];
 CONTENT_EXPORT extern const char kUtilityProcessEnableMDns[];
+CONTENT_EXPORT extern const char kUtilityProcessRunningElevated[];
+CONTENT_EXPORT extern const char kValidateInputEventStream[];
 CONTENT_EXPORT extern const char kWaitForDebuggerChildren[];
-extern const char kWebCoreLogChannels[];
-CONTENT_EXPORT extern const char kWebGLCommandBufferSizeKb[];
 CONTENT_EXPORT extern const char kWorkerProcess[];
 CONTENT_EXPORT extern const char kZygoteCmdPrefix[];
 CONTENT_EXPORT extern const char kZygoteProcess[];
 
 #if defined(ENABLE_WEBRTC)
-CONTENT_EXPORT extern const char kEnableAudioTrackProcessing[];
+CONTENT_EXPORT extern const char kDisableAudioTrackProcessing[];
 CONTENT_EXPORT extern const char kDisableDeviceEnumeration[];
-CONTENT_EXPORT extern const char kDisableSCTPDataChannels[];
 CONTENT_EXPORT extern const char kDisableWebRtcHWDecoding[];
 CONTENT_EXPORT extern const char kDisableWebRtcEncryption[];
 CONTENT_EXPORT extern const char kDisableWebRtcHWEncoding[];
-extern const char kEnableWebRtcAecRecordings[];
-extern const char kEnableWebRtcTcpServerSocket[];
 CONTENT_EXPORT extern const char kEnableWebRtcHWVp8Encoding[];
 #endif
 
 #if defined(OS_ANDROID)
-CONTENT_EXPORT extern const char kDisableGestureRequirementForMediaFullscreen[];
 CONTENT_EXPORT extern const char kDisableGestureRequirementForMediaPlayback[];
-extern const char kDisableMediaHistoryLogging[];
+CONTENT_EXPORT extern const char kDisableClickDelay[];
 CONTENT_EXPORT extern const char kDisableOverscrollEdgeEffect[];
 CONTENT_EXPORT extern const char kDisableWebRTC[];
 CONTENT_EXPORT extern const char kEnableSpeechRecognition[];
+CONTENT_EXPORT extern const char kForceUseOverlayEmbeddedVideo[];
 CONTENT_EXPORT extern const char kHideScrollbars[];
 extern const char kNetworkCountryIso[];
 CONTENT_EXPORT extern const char kRemoteDebuggingSocketName[];
 #endif
 
-#if defined(OS_ANDROID) && defined(ARCH_CPU_X86)
-CONTENT_EXPORT extern const char kEnableWebAudio[];
-#else
 CONTENT_EXPORT extern const char kDisableWebAudio[];
-#endif
 
 #if defined(OS_CHROMEOS)
 CONTENT_EXPORT extern const char kDisablePanelFitting[];
 #endif
 
 #if defined(OS_MACOSX) && !defined(OS_IOS)
-extern const char kDisableCarbonInterposing[];
+extern const char kEnableCarbonInterposing[];
 extern const char kDisableCoreAnimationPlugins[];
-CONTENT_EXPORT extern const char kUseCoreAnimation[];
 #endif
 
-#if defined(OS_POSIX)
-extern const char kChildCleanExit[];
+#if defined(OS_WIN)
+// This switch contains the device scale factor passed to certain processes
+// like renderers, etc.
+CONTENT_EXPORT extern const char kDeviceScaleFactor[];
+CONTENT_EXPORT extern const char kDisableDirectWrite[];
+CONTENT_EXPORT extern const char kDisableLegacyIntermediateWindow[];
+CONTENT_EXPORT extern const char kEnableHighResolutionTime[];
+// This switch will be removed when we enable the win32K lockdown process
+// mitigation.
+CONTENT_EXPORT extern const char kEnableWin32kRendererLockDown[];
 #endif
 
 // DON'T ADD RANDOM STUFF HERE. Put it in the main section above in
diff --git a/chromium/content/public/common/context_menu_params.cc b/chromium/content/public/common/context_menu_params.cc
index 9d5438aa99f..54b48c20815 100644
--- a/chromium/content/public/common/context_menu_params.cc
+++ b/chromium/content/public/common/context_menu_params.cc
@@ -19,10 +19,8 @@ ContextMenuParams::ContextMenuParams()
       x(0),
       y(0),
       has_image_contents(true),
-      frame_id(0),
       media_flags(0),
       misspelling_hash(0),
-      speech_input_enabled(false),
       spellcheck_enabled(false),
       is_editable(false),
       writing_direction_default(
@@ -32,7 +30,8 @@ ContextMenuParams::ContextMenuParams()
       writing_direction_right_to_left(
           blink::WebContextMenuData::CheckableMenuItemEnabled),
       edit_flags(0),
-      referrer_policy(blink::WebReferrerPolicyDefault) {
+      referrer_policy(blink::WebReferrerPolicyDefault),
+      source_type(ui::MENU_SOURCE_NONE) {
 }
 
 ContextMenuParams::~ContextMenuParams() {
diff --git a/chromium/content/public/common/context_menu_params.h b/chromium/content/public/common/context_menu_params.h
index aca84e25351..ccef48ec2ca 100644
--- a/chromium/content/public/common/context_menu_params.h
+++ b/chromium/content/public/common/context_menu_params.h
@@ -88,9 +88,6 @@ struct CONTENT_EXPORT ContextMenuParams {
   // This is the URL of the subframe that the context menu was invoked on.
   GURL frame_url;
 
-  // This is the ID of the subframe that the context menu was invoked on.
-  int64 frame_id;
-
   // This is the page state of the frame on which the context menu was invoked.
   PageState frame_page_state;
 
@@ -115,9 +112,6 @@ struct CONTENT_EXPORT ContextMenuParams {
   // and the misspelled_word is not empty.
   std::vector<base::string16> dictionary_suggestions;
 
-  // If editable, flag for whether node is speech-input enabled.
-  bool speech_input_enabled;
-
   // If editable, flag for whether spell check is enabled or not.
   bool spellcheck_enabled;
 
diff --git a/chromium/content/public/common/drop_data.cc b/chromium/content/public/common/drop_data.cc
index 3536efb21cf..5f9466b39bf 100644
--- a/chromium/content/public/common/drop_data.cc
+++ b/chromium/content/public/common/drop_data.cc
@@ -6,18 +6,9 @@
 
 namespace content {
 
-DropData::FileInfo::FileInfo() {
-}
-
-DropData::FileInfo::FileInfo(const base::string16& path,
-                             const base::string16& display_name)
-    : path(path),
-      display_name(display_name) {
-}
-
 DropData::DropData()
-    : referrer_policy(blink::WebReferrerPolicyDefault) {
-}
+    : did_originate_from_renderer(false),
+      referrer_policy(blink::WebReferrerPolicyDefault) {}
 
 DropData::~DropData() {
 }
diff --git a/chromium/content/public/common/drop_data.h b/chromium/content/public/common/drop_data.h
index 74ad79ddd71..3bc08df3a8d 100644
--- a/chromium/content/public/common/drop_data.h
+++ b/chromium/content/public/common/drop_data.h
@@ -16,25 +16,26 @@
 #include "base/strings/nullable_string16.h"
 #include "content/common/content_export.h"
 #include "third_party/WebKit/public/platform/WebReferrerPolicy.h"
+#include "ui/base/dragdrop/file_info.h"
 #include "url/gurl.h"
 
 namespace content {
 
 struct CONTENT_EXPORT DropData {
-  // The struct is used to represent a file in the drop data.
-  struct CONTENT_EXPORT FileInfo {
-    FileInfo();
-    FileInfo(const base::string16& path, const base::string16& display_name);
-
-    // The path of the file.
-    base::string16 path;
-    // The display name of the file. This field is optional.
-    base::string16 display_name;
+  struct FileSystemFileInfo {
+    FileSystemFileInfo() : size(0) {}
+    ~FileSystemFileInfo() {}
+
+    GURL url;
+    int64 size;
   };
 
   DropData();
   ~DropData();
 
+  // Whether this drag originated from a renderer.
+  bool did_originate_from_renderer;
+
   // User is dragging a link into the webview.
   GURL url;
   base::string16 url_title;  // The title associated with |url|.
@@ -46,12 +47,17 @@ struct CONTENT_EXPORT DropData {
   // a download.
   blink::WebReferrerPolicy referrer_policy;
 
-  // User is dropping one or more files on the webview.
-  std::vector<FileInfo> filenames;
+  // User is dropping one or more files on the webview. This field is only
+  // populated if the drag is not renderer tainted, as this allows File access
+  // from web content.
+  std::vector<ui::FileInfo> filenames;
 
   // Isolated filesystem ID for the files being dragged on the webview.
   base::string16 filesystem_id;
 
+  // User is dragging files specified with filesystem: URLs.
+  std::vector<FileSystemFileInfo> file_system_files;
+
   // User is dragging plain text into the webview.
   base::NullableString16 text;
 
diff --git a/chromium/content/public/common/eme_codec.h b/chromium/content/public/common/eme_codec.h
new file mode 100644
index 00000000000..54ed0e60044
--- /dev/null
+++ b/chromium/content/public/common/eme_codec.h
@@ -0,0 +1,37 @@
+// Copyright 2014 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_PUBLIC_COMMON_EME_CODEC_H_
+#define CONTENT_PUBLIC_COMMON_EME_CODEC_H_
+
+namespace content {
+
+// Defines bitmask values that specify codecs used in Encrypted Media Extension
+// (EME). Each value represents a codec within a specific container.
+// The mask values are stored in a SupportedCodecs.
+enum EmeCodec {
+  EME_CODEC_NONE = 0,
+  EME_CODEC_WEBM_VORBIS = 1 << 0,
+  EME_CODEC_WEBM_AUDIO_ALL = EME_CODEC_WEBM_VORBIS,
+  EME_CODEC_WEBM_VP8 = 1 << 1,
+  EME_CODEC_WEBM_VP9 = 1 << 2,
+  EME_CODEC_WEBM_VIDEO_ALL = (EME_CODEC_WEBM_VP8 | EME_CODEC_WEBM_VP9),
+  EME_CODEC_WEBM_ALL = (EME_CODEC_WEBM_AUDIO_ALL | EME_CODEC_WEBM_VIDEO_ALL),
+#if defined(USE_PROPRIETARY_CODECS)
+  EME_CODEC_MP4_AAC = 1 << 3,
+  EME_CODEC_MP4_AUDIO_ALL = EME_CODEC_MP4_AAC,
+  EME_CODEC_MP4_AVC1 = 1 << 4,
+  EME_CODEC_MP4_VIDEO_ALL = EME_CODEC_MP4_AVC1,
+  EME_CODEC_MP4_ALL = (EME_CODEC_MP4_AUDIO_ALL | EME_CODEC_MP4_VIDEO_ALL),
+  EME_CODEC_ALL = (EME_CODEC_WEBM_ALL | EME_CODEC_MP4_ALL),
+#else
+  EME_CODEC_ALL = EME_CODEC_WEBM_ALL,
+#endif  // defined(USE_PROPRIETARY_CODECS)
+};
+
+typedef uint32 SupportedCodecs;
+
+}  // namespace content
+
+#endif  // CONTENT_PUBLIC_COMMON_EME_CODEC_H_
diff --git a/chromium/content/public/common/favicon_url.cc b/chromium/content/public/common/favicon_url.cc
index 44f12bc6ed9..68ba481b531 100644
--- a/chromium/content/public/common/favicon_url.cc
+++ b/chromium/content/public/common/favicon_url.cc
@@ -10,10 +10,10 @@ FaviconURL::FaviconURL()
   : icon_type(INVALID_ICON) {
 }
 
-FaviconURL::FaviconURL(const GURL& url, IconType type)
-    : icon_url(url),
-      icon_type(type) {
-}
+FaviconURL::FaviconURL(const GURL& url,
+                       IconType type,
+                       const std::vector<gfx::Size>& sizes)
+    : icon_url(url), icon_type(type), icon_sizes(sizes) {}
 
 FaviconURL::~FaviconURL() {
 }
diff --git a/chromium/content/public/common/favicon_url.h b/chromium/content/public/common/favicon_url.h
index 189d4422941..141925b099b 100644
--- a/chromium/content/public/common/favicon_url.h
+++ b/chromium/content/public/common/favicon_url.h
@@ -5,14 +5,18 @@
 #ifndef CONTENT_PUBLIC_COMMON_FAVICON_URL_
 #define CONTENT_PUBLIC_COMMON_FAVICON_URL_
 
+#include <vector>
+
 #include "content/common/content_export.h"
+#include "ui/gfx/geometry/size.h"
 #include "url/gurl.h"
 
 namespace content {
 
 // The favicon url from the render.
 struct CONTENT_EXPORT FaviconURL {
-  // The icon type in a page. The definition must be same as chrome::IconType.
+  // The icon type in a page. The definition must be same as
+  // favicon_base::IconType.
   enum IconType {
     INVALID_ICON = 0x0,
     FAVICON = 1 << 0,
@@ -21,7 +25,9 @@ struct CONTENT_EXPORT FaviconURL {
   };
 
   FaviconURL();
-  FaviconURL(const GURL& url, IconType type);
+  FaviconURL(const GURL& url,
+             IconType type,
+             const std::vector<gfx::Size>& sizes);
   ~FaviconURL();
 
   // The url of the icon.
@@ -29,6 +35,9 @@ struct CONTENT_EXPORT FaviconURL {
 
   // The type of the icon
   IconType icon_type;
+
+  // Icon's bitmaps' size
+  std::vector<gfx::Size> icon_sizes;
 };
 
 } // namespace content
diff --git a/chromium/content/public/common/geoposition.h b/chromium/content/public/common/geoposition.h
index 8cbee512d6c..04946963972 100644
--- a/chromium/content/public/common/geoposition.h
+++ b/chromium/content/public/common/geoposition.h
@@ -25,6 +25,7 @@ struct CONTENT_EXPORT Geoposition {
     ERROR_CODE_PERMISSION_DENIED = 1,
     ERROR_CODE_POSITION_UNAVAILABLE = 2,
     ERROR_CODE_TIMEOUT = 3,
+    ERROR_CODE_LAST = ERROR_CODE_TIMEOUT
   };
 
   // All fields are initialized to sentinel values marking them as invalid. The
diff --git a/chromium/content/public/common/main_function_params.h b/chromium/content/public/common/main_function_params.h
index c1700c7f643..8a2b826acd8 100644
--- a/chromium/content/public/common/main_function_params.h
+++ b/chromium/content/public/common/main_function_params.h
@@ -9,8 +9,8 @@
 #ifndef CONTENT_PUBLIC_COMMON_MAIN_FUNCTION_PARAMS_H_
 #define CONTENT_PUBLIC_COMMON_MAIN_FUNCTION_PARAMS_H_
 
-#include "base/command_line.h"
 #include "base/callback_forward.h"
+#include "base/command_line.h"
 
 #if defined(OS_WIN)
 namespace sandbox {
@@ -27,20 +27,24 @@ class ScopedNSAutoreleasePool;
 namespace content {
 
 struct MainFunctionParams {
-  explicit MainFunctionParams(const CommandLine& cl)
+  explicit MainFunctionParams(const base::CommandLine& cl)
       : command_line(cl),
 #if defined(OS_WIN)
         sandbox_info(NULL),
 #elif defined(OS_MACOSX)
         autorelease_pool(NULL),
 #endif
-        ui_task(NULL) {}
-  const CommandLine& command_line;
+        ui_task(NULL) {
+  }
+
+  const base::CommandLine& command_line;
+
 #if defined(OS_WIN)
   sandbox::SandboxInterfaceInfo* sandbox_info;
 #elif defined(OS_MACOSX)
   base::mac::ScopedNSAutoreleasePool* autorelease_pool;
 #endif
+
   // Used by InProcessBrowserTest. If non-null BrowserMain schedules this
   // task to run on the MessageLoop and BrowserInit is not invoked.
   base::Closure* ui_task;
diff --git a/chromium/content/public/common/media_stream_request.cc b/chromium/content/public/common/media_stream_request.cc
index b15a0b04879..cb3b8ed86aa 100644
--- a/chromium/content/public/common/media_stream_request.cc
+++ b/chromium/content/public/common/media_stream_request.cc
@@ -8,14 +8,14 @@
 
 namespace content {
 
-bool IsAudioMediaType(MediaStreamType type) {
-  return (type == content::MEDIA_DEVICE_AUDIO_CAPTURE ||
+bool IsAudioInputMediaType(MediaStreamType type) {
+  return (type == MEDIA_DEVICE_AUDIO_CAPTURE ||
           type == content::MEDIA_TAB_AUDIO_CAPTURE ||
           type == content::MEDIA_LOOPBACK_AUDIO_CAPTURE);
 }
 
 bool IsVideoMediaType(MediaStreamType type) {
-  return (type == content::MEDIA_DEVICE_VIDEO_CAPTURE ||
+  return (type == MEDIA_DEVICE_VIDEO_CAPTURE ||
           type == content::MEDIA_TAB_VIDEO_CAPTURE ||
           type == content::MEDIA_DESKTOP_VIDEO_CAPTURE);
 }
@@ -67,11 +67,28 @@ bool MediaStreamDevice::IsEqual(const MediaStreamDevice& second) const {
       input.channel_layout == input_second.channel_layout;
 }
 
+MediaStreamDevices::MediaStreamDevices() {}
+
+MediaStreamDevices::MediaStreamDevices(size_t count,
+                                       const MediaStreamDevice& value)
+    : std::vector<MediaStreamDevice>(count, value) {
+}
+
+const MediaStreamDevice* MediaStreamDevices::FindById(
+    const std::string& device_id) const {
+  for (const_iterator iter = begin(); iter != end(); ++iter) {
+    if (iter->id == device_id)
+      return &(*iter);
+  }
+  return NULL;
+}
+
 MediaStreamRequest::MediaStreamRequest(
     int render_process_id,
     int render_view_id,
     int page_request_id,
     const GURL& security_origin,
+    bool user_gesture,
     MediaStreamRequestType request_type,
     const std::string& requested_audio_device_id,
     const std::string& requested_video_device_id,
@@ -81,6 +98,7 @@ MediaStreamRequest::MediaStreamRequest(
       render_view_id(render_view_id),
       page_request_id(page_request_id),
       security_origin(security_origin),
+      user_gesture(user_gesture),
       request_type(request_type),
       requested_audio_device_id(requested_audio_device_id),
       requested_video_device_id(requested_video_device_id),
diff --git a/chromium/content/public/common/media_stream_request.h b/chromium/content/public/common/media_stream_request.h
index c4c838fb6e3..5a91fd10ccc 100644
--- a/chromium/content/public/common/media_stream_request.h
+++ b/chromium/content/public/common/media_stream_request.h
@@ -13,6 +13,7 @@
 #include "base/callback_forward.h"
 #include "base/memory/scoped_ptr.h"
 #include "content/common/content_export.h"
+#include "ui/gfx/native_widget_types.h"
 #include "url/gurl.h"
 
 namespace content {
@@ -37,6 +38,11 @@ enum MediaStreamType {
   // TODO(sergeyu): Replace with MEDIA_DESKTOP_AUDIO_CAPTURE.
   MEDIA_LOOPBACK_AUDIO_CAPTURE,
 
+  // This is used for enumerating audio output devices.
+  // TODO(grunell): Output isn't really a part of media streams. Device
+  // enumeration should be decoupled from media streams and related code.
+  MEDIA_DEVICE_AUDIO_OUTPUT,
+
   NUM_MEDIA_TYPES
 };
 
@@ -45,7 +51,7 @@ enum MediaStreamRequestType {
   MEDIA_DEVICE_ACCESS = 0,
   MEDIA_GENERATE_STREAM,
   MEDIA_ENUMERATE_DEVICES,
-  MEDIA_OPEN_DEVICE
+  MEDIA_OPEN_DEVICE  // Only used in requests made by Pepper.
 };
 
 // Facing mode for video capture.
@@ -59,9 +65,24 @@ enum VideoFacingMode {
   NUM_MEDIA_VIDEO_FACING_MODE
 };
 
+enum MediaStreamRequestResult {
+  MEDIA_DEVICE_OK = 0,
+  MEDIA_DEVICE_PERMISSION_DENIED,
+  MEDIA_DEVICE_PERMISSION_DISMISSED,
+  MEDIA_DEVICE_INVALID_STATE,
+  MEDIA_DEVICE_NO_HARDWARE,
+  MEDIA_DEVICE_INVALID_SECURITY_ORIGIN,
+  MEDIA_DEVICE_TAB_CAPTURE_FAILURE,
+  MEDIA_DEVICE_SCREEN_CAPTURE_FAILURE,
+  MEDIA_DEVICE_CAPTURE_FAILURE,
+  MEDIA_DEVICE_TRACK_START_FAILURE,
+
+  NUM_MEDIA_REQUEST_RESULTS
+};
+
 // Convenience predicates to determine whether the given type represents some
 // audio or some video device.
-CONTENT_EXPORT bool IsAudioMediaType(MediaStreamType type);
+CONTENT_EXPORT bool IsAudioInputMediaType(MediaStreamType type);
 CONTENT_EXPORT bool IsVideoMediaType(MediaStreamType type);
 
 // TODO(xians): Change the structs to classes.
@@ -136,7 +157,7 @@ struct CONTENT_EXPORT MediaStreamDevice {
   };
 
   // These below two member variables are valid only when the type of device is
-  // audio (i.e. IsAudioMediaType returns true).
+  // audio (i.e. IsAudioInputMediaType returns true).
 
   // Contains the device properties of the capture device.
   AudioDeviceParameters input;
@@ -148,7 +169,16 @@ struct CONTENT_EXPORT MediaStreamDevice {
   AudioDeviceParameters matched_output;
 };
 
-typedef std::vector<MediaStreamDevice> MediaStreamDevices;
+class CONTENT_EXPORT MediaStreamDevices
+    : public std::vector<MediaStreamDevice> {
+ public:
+  MediaStreamDevices();
+  MediaStreamDevices(size_t count, const MediaStreamDevice& value);
+
+  // Looks for a MediaStreamDevice based on its ID.
+  // Returns NULL if not found.
+  const MediaStreamDevice* FindById(const std::string& device_id) const;
+};
 
 typedef std::map<MediaStreamType, MediaStreamDevices> MediaStreamDeviceMap;
 
@@ -165,6 +195,7 @@ struct CONTENT_EXPORT MediaStreamRequest {
       int render_view_id,
       int page_request_id,
       const GURL& security_origin,
+      bool user_gesture,
       MediaStreamRequestType request_type,
       const std::string& requested_audio_device_id,
       const std::string& requested_video_device_id,
@@ -193,6 +224,9 @@ struct CONTENT_EXPORT MediaStreamRequest {
   // The WebKit security origin for the current request (e.g. "html5rocks.com").
   GURL security_origin;
 
+  // Set to true if the call was made in the context of a user gesture.
+  bool user_gesture;
+
   // Stores the type of request that was made to the media controller. Right now
   // this is only used to distinguish between WebRTC and Pepper requests, as the
   // latter should not be subject to user approval but only to policy check.
@@ -218,13 +252,15 @@ class MediaStreamUI {
   virtual ~MediaStreamUI() {}
 
   // Called when MediaStream capturing is started. Chrome layer can call |stop|
-  // to stop the stream.
-  virtual void OnStarted(const base::Closure& stop) = 0;
+  // to stop the stream. Returns the platform-dependent window ID for the UI, or
+  // 0 if not applicable.
+  virtual gfx::NativeViewId OnStarted(const base::Closure& stop) = 0;
 };
 
 // Callback used return results of media access requests.
 typedef base::Callback<void(
     const MediaStreamDevices& devices,
+    content::MediaStreamRequestResult result,
     scoped_ptr<MediaStreamUI> ui)> MediaResponseCallback;
 
 }  // namespace content
diff --git a/chromium/content/public/common/p2p_socket_type.h b/chromium/content/public/common/p2p_socket_type.h
deleted file mode 100644
index a272f8c075c..00000000000
--- a/chromium/content/public/common/p2p_socket_type.h
+++ /dev/null
@@ -1,28 +0,0 @@
-// Copyright 2013 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// This file defines some basic types used by the P2P-related IPC
-// messages.
-
-#ifndef CONTENT_PUBLIC_COMMON_P2P_SOCKET_TYPE_H_
-#define CONTENT_PUBLIC_COMMON_P2P_SOCKET_TYPE_H_
-
-namespace content {
-
-// Type of P2P Socket.
-enum P2PSocketType {
-  P2P_SOCKET_UDP,
-  P2P_SOCKET_TCP_SERVER,
-  P2P_SOCKET_STUN_TCP_SERVER,
-  P2P_SOCKET_TCP_CLIENT,
-  P2P_SOCKET_STUN_TCP_CLIENT,
-  P2P_SOCKET_SSLTCP_CLIENT,
-  P2P_SOCKET_STUN_SSLTCP_CLIENT,
-  P2P_SOCKET_TLS_CLIENT,
-  P2P_SOCKET_STUN_TLS_CLIENT,
-};
-
-}  // namespace content
-
-#endif  // CONTENT_PUBLIC_COMMON_P2P_SOCKET_TYPE_H_
diff --git a/chromium/content/public/common/page_state.cc b/chromium/content/public/common/page_state.cc
index 1e429b80df6..9d100d31b62 100644
--- a/chromium/content/public/common/page_state.cc
+++ b/chromium/content/public/common/page_state.cc
@@ -12,7 +12,7 @@ namespace content {
 namespace {
 
 base::NullableString16 ToNullableString16(const std::string& utf8) {
-  return base::NullableString16(UTF8ToUTF16(utf8), false);
+  return base::NullableString16(base::UTF8ToUTF16(utf8), false);
 }
 
 base::FilePath ToFilePath(const base::NullableString16& s) {
@@ -42,6 +42,17 @@ void RecursivelyRemovePasswordData(ExplodedFrameState* state) {
 
 void RecursivelyRemoveScrollOffset(ExplodedFrameState* state) {
   state->scroll_offset = gfx::Point();
+  state->pinch_viewport_scroll_offset = gfx::PointF();
+}
+
+void RecursivelyRemoveReferrer(ExplodedFrameState* state) {
+  state->referrer = base::NullableString16();
+  state->referrer_policy = blink::WebReferrerPolicyDefault;
+  for (std::vector<ExplodedFrameState>::iterator it = state->children.begin();
+       it != state->children.end();
+       ++it) {
+    RecursivelyRemoveReferrer(&*it);
+  }
 }
 
 }  // namespace
@@ -55,8 +66,7 @@ PageState PageState::CreateFromEncodedData(const std::string& data) {
 PageState PageState::CreateFromURL(const GURL& url) {
   ExplodedPageState state;
 
-  state.top.url_string = state.top.original_url_string =
-      ToNullableString16(url.possibly_invalid_spec());
+  state.top.url_string = ToNullableString16(url.possibly_invalid_spec());
 
   return ToPageState(state);
 }
@@ -69,8 +79,7 @@ PageState PageState::CreateForTesting(
     const base::FilePath* optional_body_file_path) {
   ExplodedPageState state;
 
-  state.top.url_string = state.top.original_url_string =
-      ToNullableString16(url.possibly_invalid_spec());
+  state.top.url_string = ToNullableString16(url.possibly_invalid_spec());
 
   if (optional_body_data || optional_body_file_path) {
     state.top.http_body.is_null = false;
@@ -140,6 +149,19 @@ PageState PageState::RemoveScrollOffset() const {
   return ToPageState(state);
 }
 
+PageState PageState::RemoveReferrer() const {
+  if (data_.empty())
+    return *this;
+
+  ExplodedPageState state;
+  if (!DecodePageState(data_, &state))
+    return PageState();  // Oops!
+
+  RecursivelyRemoveReferrer(&state.top);
+
+  return ToPageState(state);
+}
+
 PageState::PageState(const std::string& data)
     : data_(data) {
   // TODO(darin): Enable this DCHECK once tests have been fixed up to not pass
diff --git a/chromium/content/public/common/page_state.h b/chromium/content/public/common/page_state.h
index b4484b7a33e..c38f961bb24 100644
--- a/chromium/content/public/common/page_state.h
+++ b/chromium/content/public/common/page_state.h
@@ -23,9 +23,7 @@ namespace content {
 // example the URLs of the documents and the values of any form fields.  This
 // information is used when navigating back & forward through session history.
 //
-// The browser process only sees the encoded form of the data, which is
-// designed as an archival format.  The renderer process can decode the data
-// using methods found in public/renderer/history_item_serialization.h.
+// The format of the encoded data is not exposed by the content API.
 class CONTENT_EXPORT PageState {
  public:
   static PageState CreateFromEncodedData(const std::string& data);
@@ -46,6 +44,7 @@ class CONTENT_EXPORT PageState {
   std::vector<base::FilePath> GetReferencedFiles() const;
   PageState RemovePasswordData() const;
   PageState RemoveScrollOffset() const;
+  PageState RemoveReferrer() const;
 
  private:
   PageState(const std::string& data);
diff --git a/chromium/content/public/common/page_transition_types.cc b/chromium/content/public/common/page_transition_types.cc
index 52a0561765d..bf95ea045c0 100644
--- a/chromium/content/public/common/page_transition_types.cc
+++ b/chromium/content/public/common/page_transition_types.cc
@@ -47,6 +47,11 @@ bool PageTransitionIsRedirect(PageTransition type) {
   return (type & PAGE_TRANSITION_IS_REDIRECT_MASK) != 0;
 }
 
+bool PageTransitionIsNewNavigation(PageTransition type) {
+  return (type & PAGE_TRANSITION_FORWARD_BACK) == 0 &&
+      !PageTransitionCoreTypeIs(type, content::PAGE_TRANSITION_RELOAD);
+}
+
 int32 PageTransitionGetQualifier(PageTransition type) {
   return type & PAGE_TRANSITION_QUALIFIER_MASK;
 }
diff --git a/chromium/content/public/common/page_transition_types.h b/chromium/content/public/common/page_transition_types.h
index acb894b4760..1b1f8013502 100644
--- a/chromium/content/public/common/page_transition_types.h
+++ b/chromium/content/public/common/page_transition_types.h
@@ -38,6 +38,10 @@ CONTENT_EXPORT bool PageTransitionIsMainFrame(PageTransition type);
 // Returns whether a transition involves a redirection
 CONTENT_EXPORT bool PageTransitionIsRedirect(PageTransition type);
 
+// Returns whether a transition is a new navigation (rather than a return
+// to a previously committed navigation).
+CONTENT_EXPORT bool PageTransitionIsNewNavigation(PageTransition type);
+
 // Return the qualifier
 CONTENT_EXPORT int32 PageTransitionGetQualifier(PageTransition type);
 
diff --git a/chromium/content/public/common/pepper_plugin_info.cc b/chromium/content/public/common/pepper_plugin_info.cc
index 21ef4e8f44b..d627a4becb0 100644
--- a/chromium/content/public/common/pepper_plugin_info.cc
+++ b/chromium/content/public/common/pepper_plugin_info.cc
@@ -34,10 +34,10 @@ WebPluginInfo PepperPluginInfo::ToWebPluginInfo() const {
       WebPluginInfo::PLUGIN_TYPE_PEPPER_IN_PROCESS;
 
   info.name = name.empty() ?
-      path.BaseName().LossyDisplayName() : UTF8ToUTF16(name);
+      path.BaseName().LossyDisplayName() : base::UTF8ToUTF16(name);
   info.path = path;
-  info.version = ASCIIToUTF16(version);
-  info.desc = ASCIIToUTF16(description);
+  info.version = base::ASCIIToUTF16(version);
+  info.desc = base::ASCIIToUTF16(description);
   info.mime_types = mime_types;
   info.pepper_permissions = permissions;
 
diff --git a/chromium/content/public/common/renderer_preferences.cc b/chromium/content/public/common/renderer_preferences.cc
index 8213c95dd94..1e4c6d55ec8 100644
--- a/chromium/content/public/common/renderer_preferences.cc
+++ b/chromium/content/public/common/renderer_preferences.cc
@@ -37,7 +37,6 @@ RendererPreferences::RendererPreferences()
       inactive_selection_fg_color(SkColorSetRGB(50, 50, 50)),
       browser_handles_non_local_top_level_requests(false),
       browser_handles_all_top_level_requests(false),
-      browser_handles_all_top_level_link_clicks(false),
       caret_blink_interval(0.5),
       use_custom_colors(true),
       enable_referrers(true),
@@ -48,7 +47,8 @@ RendererPreferences::RendererPreferences()
       touchscreen_fling_profile(3),
       tap_multiple_targets_strategy(TAP_MULTIPLE_TARGETS_STRATEGY_POPUP),
       disable_client_blocked_error_page(false),
-      plugin_fullscreen_allowed(true) {
+      plugin_fullscreen_allowed(true),
+      use_video_overlay_for_embedded_encrypted_video(false) {
   touchpad_fling_profile[0] = kDefaultAlpha;
   touchpad_fling_profile[1] = kDefaultBeta;
   touchpad_fling_profile[2] = kDefaultGamma;
diff --git a/chromium/content/public/common/renderer_preferences.h b/chromium/content/public/common/renderer_preferences.h
index 61d334995e7..43e43c9e589 100644
--- a/chromium/content/public/common/renderer_preferences.h
+++ b/chromium/content/public/common/renderer_preferences.h
@@ -97,9 +97,6 @@ struct CONTENT_EXPORT RendererPreferences {
   // Browser wants a look at all top-level navigation requests.
   bool browser_handles_all_top_level_requests;
 
-  // Browser wants a look at all top-level link clicks.
-  bool browser_handles_all_top_level_link_clicks;
-
   // Cursor blink rate in seconds.
   // Currently only changed from default on Linux.  Uses |gtk-cursor-blink|
   // from GtkSettings.
@@ -147,6 +144,10 @@ struct CONTENT_EXPORT RendererPreferences {
 
   // Determines whether plugins are allowed to enter fullscreen mode.
   bool plugin_fullscreen_allowed;
+
+  // Whether video-overlay (hole-punching) should be used for the embedded
+  // encrypted video.  Currently only used by Android.
+  bool use_video_overlay_for_embedded_encrypted_video;
 };
 
 }  // namespace content
diff --git a/chromium/content/public/common/resource_devtools_info.cc b/chromium/content/public/common/resource_devtools_info.cc
new file mode 100644
index 00000000000..657ac3af23f
--- /dev/null
+++ b/chromium/content/public/common/resource_devtools_info.cc
@@ -0,0 +1,16 @@
+// Copyright 2014 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "content/public/common/resource_devtools_info.h"
+
+namespace content {
+
+ResourceDevToolsInfo::ResourceDevToolsInfo()
+    : http_status_code(0) {
+}
+
+ResourceDevToolsInfo::~ResourceDevToolsInfo() {
+}
+
+}  // namespace content
diff --git a/chromium/content/public/common/resource_devtools_info.h b/chromium/content/public/common/resource_devtools_info.h
new file mode 100644
index 00000000000..d9485badfec
--- /dev/null
+++ b/chromium/content/public/common/resource_devtools_info.h
@@ -0,0 +1,37 @@
+// Copyright 2014 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_COMMON_RESOURCE_DEVTOOLS_INFO_H_
+#define CONTENT_COMMON_RESOURCE_DEVTOOLS_INFO_H_
+
+#include <string>
+#include <vector>
+
+#include "base/basictypes.h"
+#include "base/memory/ref_counted.h"
+#include "content/common/content_export.h"
+
+namespace content {
+
+struct ResourceDevToolsInfo : base::RefCounted<ResourceDevToolsInfo> {
+  typedef std::vector<std::pair<std::string, std::string> >
+      HeadersVector;
+
+  CONTENT_EXPORT ResourceDevToolsInfo();
+
+  int32 http_status_code;
+  std::string http_status_text;
+  HeadersVector request_headers;
+  HeadersVector response_headers;
+  std::string request_headers_text;
+  std::string response_headers_text;
+
+ private:
+  friend class base::RefCounted<ResourceDevToolsInfo>;
+  CONTENT_EXPORT ~ResourceDevToolsInfo();
+};
+
+}  // namespace content
+
+#endif  // CONTENT_COMMON_RESOURCE_DEVTOOLS_INFO_H_
diff --git a/chromium/content/public/common/resource_response.h b/chromium/content/public/common/resource_response.h
index 829a1eae19b..a9a6addaaca 100644
--- a/chromium/content/public/common/resource_response.h
+++ b/chromium/content/public/common/resource_response.h
@@ -12,14 +12,14 @@
 #include "base/compiler_specific.h"
 #include "base/memory/ref_counted.h"
 #include "content/common/content_export.h"
+#include "content/public/common/resource_response_info.h"
 #include "net/url_request/url_request_status.h"
 #include "url/gurl.h"
-#include "webkit/common/resource_response_info.h"
 
 namespace content {
 
 // Parameters for a resource response header.
-struct ResourceResponseHead : webkit_glue::ResourceResponseInfo {
+struct ResourceResponseHead : ResourceResponseInfo {
   // The response error_code.
   int error_code;
   // TimeTicks::Now() when the browser received the request from the renderer.
diff --git a/chromium/content/public/common/resource_response_info.cc b/chromium/content/public/common/resource_response_info.cc
new file mode 100644
index 00000000000..70dbc508d34
--- /dev/null
+++ b/chromium/content/public/common/resource_response_info.cc
@@ -0,0 +1,26 @@
+// Copyright 2014 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "content/public/common/resource_response_info.h"
+
+#include "net/http/http_response_headers.h"
+#include "webkit/common/appcache/appcache_interfaces.h"
+
+namespace content {
+
+ResourceResponseInfo::ResourceResponseInfo()
+    : content_length(-1),
+      encoded_data_length(-1),
+      appcache_id(appcache::kAppCacheNoCacheId),
+      was_fetched_via_spdy(false),
+      was_npn_negotiated(false),
+      was_alternate_protocol_available(false),
+      connection_info(net::HttpResponseInfo::CONNECTION_INFO_UNKNOWN),
+      was_fetched_via_proxy(false) {
+}
+
+ResourceResponseInfo::~ResourceResponseInfo() {
+}
+
+}  // namespace content
diff --git a/chromium/content/public/common/resource_response_info.h b/chromium/content/public/common/resource_response_info.h
new file mode 100644
index 00000000000..31fa4b905b9
--- /dev/null
+++ b/chromium/content/public/common/resource_response_info.h
@@ -0,0 +1,104 @@
+// Copyright 2014 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_PUBLIC_COMMON_RESOURCE_RESPONSE_INFO_H_
+#define CONTENT_PUBLIC_COMMON_RESOURCE_RESPONSE_INFO_H_
+
+#include <string>
+
+#include "base/basictypes.h"
+#include "base/files/file_path.h"
+#include "base/memory/ref_counted.h"
+#include "base/time/time.h"
+#include "content/common/content_export.h"
+#include "content/public/common/resource_devtools_info.h"
+#include "net/base/host_port_pair.h"
+#include "net/base/load_timing_info.h"
+#include "net/http/http_response_info.h"
+#include "url/gurl.h"
+
+namespace content {
+
+struct ResourceResponseInfo {
+  CONTENT_EXPORT ResourceResponseInfo();
+  CONTENT_EXPORT ~ResourceResponseInfo();
+
+  // The time at which the request was made that resulted in this response.
+  // For cached responses, this time could be "far" in the past.
+  base::Time request_time;
+
+  // The time at which the response headers were received.  For cached
+  // responses, this time could be "far" in the past.
+  base::Time response_time;
+
+  // The response headers or NULL if the URL type does not support headers.
+  scoped_refptr<net::HttpResponseHeaders> headers;
+
+  // The mime type of the response.  This may be a derived value.
+  std::string mime_type;
+
+  // The character encoding of the response or none if not applicable to the
+  // response's mime type.  This may be a derived value.
+  std::string charset;
+
+  // An opaque string carrying security information pertaining to this
+  // response.  This may include information about the SSL connection used.
+  std::string security_info;
+
+  // Content length if available. -1 if not available
+  int64 content_length;
+
+  // Length of the encoded data transferred over the network. In case there is
+  // no data, contains -1.
+  int64 encoded_data_length;
+
+  // The appcache this response was loaded from, or kAppCacheNoCacheId.
+  int64 appcache_id;
+
+  // The manifest url of the appcache this response was loaded from.
+  // Note: this value is only populated for main resource requests.
+  GURL appcache_manifest_url;
+
+  // Detailed timing information used by the WebTiming, HAR and Developer
+  // Tools.  Includes socket ID and socket reuse information.
+  net::LoadTimingInfo load_timing;
+
+  // Actual request and response headers, as obtained from the network stack.
+  // Only present if request had LOAD_REPORT_RAW_HEADERS in load_flags, and
+  // requesting renderer had CanReadRowCookies permission.
+  scoped_refptr<ResourceDevToolsInfo> devtools_info;
+
+  // The path to a file that will contain the response body.  It may only
+  // contain a portion of the response body at the time that the ResponseInfo
+  // becomes available.
+  base::FilePath download_file_path;
+
+  // True if the response was delivered using SPDY.
+  bool was_fetched_via_spdy;
+
+  // True if the response was delivered after NPN is negotiated.
+  bool was_npn_negotiated;
+
+  // True if response could use alternate protocol. However, browser will
+  // ignore the alternate protocol when spdy is not enabled on browser side.
+  bool was_alternate_protocol_available;
+
+  // Information about the type of connection used to fetch this response.
+  net::HttpResponseInfo::ConnectionInfo connection_info;
+
+  // True if the response was fetched via an explicit proxy (as opposed to a
+  // transparent proxy). The proxy could be any type of proxy, HTTP or SOCKS.
+  // Note: we cannot tell if a transparent proxy may have been involved.
+  bool was_fetched_via_proxy;
+
+  // NPN protocol negotiated with the server.
+  std::string npn_negotiated_protocol;
+
+  // Remote address of the socket which fetched this resource.
+  net::HostPortPair socket_address;
+};
+
+}  // namespace content
+
+#endif  // CONTENT_PUBLIC_COMMON_RESOURCE_RESPONSE_INFO_H_
diff --git a/chromium/content/public/common/result_codes_list.h b/chromium/content/public/common/result_codes_list.h
index 5a79f754dba..589fb458eba 100644
--- a/chromium/content/public/common/result_codes_list.h
+++ b/chromium/content/public/common/result_codes_list.h
@@ -28,17 +28,3 @@ RESULT_CODE(HUNG, 2)
 
 // A bad message caused the process termination.
 RESULT_CODE(KILLED_BAD_MESSAGE, 3)
-
-#if defined(OS_ANDROID)
-// Failed to register JNI methods.
-RESULT_CODE(FAILED_TO_REGISTER_JNI, 4)
-
-// Failed to find and load the native library.
-RESULT_CODE(NATIVE_LIBRARY_LOAD_FAILED, 5)
-
-// Wrong version of library loaded
-RESULT_CODE(NATIVE_LIBRARY_WRONG_VERSION, 6)
-
-// Native library startup failed
-RESULT_CODE(NATIVE_STARTUP_FAILED, 7)
-#endif
diff --git a/chromium/content/public/common/sandbox_init.h b/chromium/content/public/common/sandbox_init.h
index f709d23ea2a..313662da0b0 100644
--- a/chromium/content/public/common/sandbox_init.h
+++ b/chromium/content/public/common/sandbox_init.h
@@ -10,9 +10,8 @@
 #include "build/build_config.h"
 #include "content/common/content_export.h"
 
-class CommandLine;
-
 namespace base {
+class CommandLine;
 class FilePath;
 }
 
@@ -59,7 +58,7 @@ CONTENT_EXPORT bool BrokerAddTargetPeer(HANDLE peer_process);
 // then it just has to outlive this method call.
 CONTENT_EXPORT base::ProcessHandle StartSandboxedProcess(
     SandboxedProcessLauncherDelegate* delegate,
-    CommandLine* cmd_line);
+    base::CommandLine* cmd_line);
 
 #elif defined(OS_MACOSX)
 
diff --git a/chromium/content/public/common/sandbox_linux.h b/chromium/content/public/common/sandbox_linux.h
index 4d2db390759..a9be3b5470e 100644
--- a/chromium/content/public/common/sandbox_linux.h
+++ b/chromium/content/public/common/sandbox_linux.h
@@ -23,6 +23,9 @@ enum LinuxSandboxStatus {
   // seccomp-bpf sandbox active.
   kSandboxLinuxSeccompBPF = 1 << 3,
 
+  // The Yama LSM module is present and enforcing.
+  kSandboxLinuxYama = 1 << 4,
+
   // A flag that denotes an invalid sandbox status.
   kSandboxLinuxInvalid = 1 << 31,
 };
diff --git a/chromium/content/public/common/sandbox_type_mac.h b/chromium/content/public/common/sandbox_type_mac.h
index b034ba51dc2..4c7faaa756c 100644
--- a/chromium/content/public/common/sandbox_type_mac.h
+++ b/chromium/content/public/common/sandbox_type_mac.h
@@ -11,6 +11,9 @@ namespace content {
 // additional sandbox types with IDs starting with SANDBOX_TYPE_AFTER_LAST_TYPE.
 
 enum SandboxType {
+  // Not a valid sandbox type.
+  SANDBOX_TYPE_INVALID = -1,
+
   SANDBOX_TYPE_FIRST_TYPE = 0,  // Placeholder to ease iteration.
 
   SANDBOX_TYPE_RENDERER = SANDBOX_TYPE_FIRST_TYPE,
diff --git a/chromium/content/public/common/sandboxed_process_launcher_delegate.cc b/chromium/content/public/common/sandboxed_process_launcher_delegate.cc
new file mode 100644
index 00000000000..b961c3ef9ed
--- /dev/null
+++ b/chromium/content/public/common/sandboxed_process_launcher_delegate.cc
@@ -0,0 +1,34 @@
+// Copyright 2014 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "content/public/common/sandboxed_process_launcher_delegate.h"
+
+namespace content {
+
+#if defined(OS_WIN)
+bool SandboxedProcessLauncherDelegate::ShouldLaunchElevated() {
+  return false;
+}
+
+bool SandboxedProcessLauncherDelegate::ShouldSandbox() {
+  return true;
+}
+
+#elif(OS_POSIX)
+bool SandboxedProcessLauncherDelegate::ShouldUseZygote() {
+  return false;
+}
+
+base::EnvironmentMap SandboxedProcessLauncherDelegate::GetEnvironment() {
+  return base::EnvironmentMap();
+}
+
+#if defined(OS_MACOSX)
+SandboxType SandboxedProcessLauncherDelegate::GetSandboxType() {
+  return SANDBOX_TYPE_INVALID;
+}
+#endif
+
+#endif
+}  // namespace content
diff --git a/chromium/content/public/common/sandboxed_process_launcher_delegate.h b/chromium/content/public/common/sandboxed_process_launcher_delegate.h
index 6357211ee29..3f634a159f3 100644
--- a/chromium/content/public/common/sandboxed_process_launcher_delegate.h
+++ b/chromium/content/public/common/sandboxed_process_launcher_delegate.h
@@ -5,8 +5,15 @@
 #ifndef CONTENT_PUBLIC_COMMON_SANDBOXED_PROCESS_LAUNCHER_DELEGATE_H_
 #define CONTENT_PUBLIC_COMMON_SANDBOXED_PROCESS_LAUNCHER_DELEGATE_H_
 
+#include "base/environment.h"
 #include "base/process/process.h"
 
+#include "content/common/content_export.h"
+
+#if defined(OS_MACOSX)
+#include "content/public/common/sandbox_type_mac.h"
+#endif
+
 namespace base {
 class FilePath;
 }
@@ -21,14 +28,19 @@ namespace content {
 // BrowserChildProcessHost/ChildProcessLauncher to control the sandbox policy,
 // i.e. to loosen it if needed.
 // The methods below will be called on the PROCESS_LAUNCHER thread.
-class SandboxedProcessLauncherDelegate {
+class CONTENT_EXPORT SandboxedProcessLauncherDelegate {
  public:
   virtual ~SandboxedProcessLauncherDelegate() {}
 
-  // By default, the process is launched sandboxed. Override this method and set
-  // |in_sandbox| to false if this process should be launched without a sandbox
+#if defined(OS_WIN)
+  // Override to return true if the process should be launched as an elevated
+  // process (which implies no sandbox).
+  virtual bool ShouldLaunchElevated();
+
+  // By default, the process is launched sandboxed. Override this method to
+  // return false if the process should be launched without a sandbox
   // (i.e. through base::LaunchProcess directly).
-  virtual void ShouldSandbox(bool* in_sandbox) {}
+  virtual bool ShouldSandbox();
 
   // Called before the default sandbox is applied. If the default policy is too
   // restrictive, the caller should set |disable_default_policy| to true and
@@ -43,6 +55,24 @@ class SandboxedProcessLauncherDelegate {
 
   // Called right after the process is launched, but before its thread is run.
   virtual void PostSpawnTarget(base::ProcessHandle process) {}
+
+#elif defined(OS_POSIX)
+  // Override this to return true to use the setuid sandbox.
+  virtual bool ShouldUseZygote();
+
+  // Override this if the process needs a non-empty environment map.
+  virtual base::EnvironmentMap GetEnvironment();
+
+  // Return the file descriptor for the IPC channel.
+  virtual int GetIpcFd() = 0;
+
+#if defined(OS_MACOSX)
+  // Gets the Mac SandboxType to enforce on the process. Return
+  // SANDBOX_TYPE_INVALID for no sandbox policy.
+  virtual SandboxType GetSandboxType();
+#endif
+
+#endif
 };
 
 }  // namespace content
diff --git a/chromium/content/public/common/screen_orientation_values.h b/chromium/content/public/common/screen_orientation_values.h
new file mode 100644
index 00000000000..fe421a2b793
--- /dev/null
+++ b/chromium/content/public/common/screen_orientation_values.h
@@ -0,0 +1,18 @@
+// Copyright 2014 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_PUBLIC_COMMON_SCREEN_ORIENTATION_VALUES_H_
+#define CONTENT_PUBLIC_COMMON_SCREEN_ORIENTATION_VALUES_H_
+
+namespace content {
+
+enum ScreenOrientationValues {
+#define DEFINE_SCREEN_ORIENTATION_VALUE(name, value) name = value,
+#include "content/public/common/screen_orientation_values_list.h"
+#undef DEFINE_SCREEN_ORIENTATION_VALUE
+};
+
+} // namespace content
+
+#endif  // CONTENT_PUBLIC_COMMON_SCREEN_ORIENTATION_VALUES_H_
diff --git a/chromium/content/public/common/screen_orientation_values_list.h b/chromium/content/public/common/screen_orientation_values_list.h
new file mode 100644
index 00000000000..9cc6f92b171
--- /dev/null
+++ b/chromium/content/public/common/screen_orientation_values_list.h
@@ -0,0 +1,23 @@
+// Copyright 2014 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_PUBLIC_COMMON_SCREEN_ORIENTATION_VALUES_LIST_H_
+#define CONTENT_PUBLIC_COMMON_SCREEN_ORIENTATION_VALUES_LIST_H_
+
+#ifndef DEFINE_SCREEN_ORIENTATION_VALUE
+#error "DEFINE_SCREEN_ORIENTATION_VALUE should be defined before including this"
+#endif
+
+// These values are defined with macros so that a Java class can be generated
+// for them.
+DEFINE_SCREEN_ORIENTATION_VALUE(DEFAULT, 0)
+DEFINE_SCREEN_ORIENTATION_VALUE(PORTRAIT_PRIMARY, 1)
+DEFINE_SCREEN_ORIENTATION_VALUE(PORTRAIT_SECONDARY, 2)
+DEFINE_SCREEN_ORIENTATION_VALUE(LANDSCAPE_PRIMARY, 3)
+DEFINE_SCREEN_ORIENTATION_VALUE(LANDSCAPE_SECONDARY, 4)
+DEFINE_SCREEN_ORIENTATION_VALUE(ANY, 5)
+DEFINE_SCREEN_ORIENTATION_VALUE(LANDSCAPE, 6)
+DEFINE_SCREEN_ORIENTATION_VALUE(PORTRAIT, 7)
+
+#endif  // CONTENT_PUBLIC_COMMON_SCREEN_ORIENTATION_VALUES_LIST_H_
diff --git a/chromium/content/public/common/security_style.h b/chromium/content/public/common/security_style.h
index 84c10a55b53..94cd0ed99d9 100644
--- a/chromium/content/public/common/security_style.h
+++ b/chromium/content/public/common/security_style.h
@@ -31,6 +31,7 @@ enum SecurityStyle {
   // SECURITY_STYLE_AUTHENTICATED indicates that we successfully retrieved this
   // object over an authenticated protocol, such as HTTPS.
   SECURITY_STYLE_AUTHENTICATED,
+  SECURITY_STYLE_LAST = SECURITY_STYLE_AUTHENTICATED
 };
 
 }  // namespace content
diff --git a/chromium/content/public/common/show_desktop_notification_params.cc b/chromium/content/public/common/show_desktop_notification_params.cc
index 4914cb0574f..f001f79eeab 100644
--- a/chromium/content/public/common/show_desktop_notification_params.cc
+++ b/chromium/content/public/common/show_desktop_notification_params.cc
@@ -7,8 +7,7 @@
 namespace content {
 
 ShowDesktopNotificationHostMsgParams::ShowDesktopNotificationHostMsgParams()
-    : direction(blink::WebTextDirectionDefault),
-      notification_id(0) {
+    : direction(blink::WebTextDirectionDefault) {
 }
 
 ShowDesktopNotificationHostMsgParams::~ShowDesktopNotificationHostMsgParams() {
diff --git a/chromium/content/public/common/show_desktop_notification_params.h b/chromium/content/public/common/show_desktop_notification_params.h
index 5ff4511a472..327f91cb8b6 100644
--- a/chromium/content/public/common/show_desktop_notification_params.h
+++ b/chromium/content/public/common/show_desktop_notification_params.h
@@ -30,9 +30,6 @@ struct CONTENT_EXPORT ShowDesktopNotificationHostMsgParams {
   // ReplaceID if this notification should replace an existing one; may be
   // empty if no replacement is called for.
   base::string16 replace_id;
-
-  // Notification ID for sending events back for this notification.
-  int notification_id;
 };
 
 }  // namespace content
diff --git a/chromium/content/public/common/socket_permission_request.h b/chromium/content/public/common/socket_permission_request.h
index 13b9ed19e1c..b7b4389b9b4 100644
--- a/chromium/content/public/common/socket_permission_request.h
+++ b/chromium/content/public/common/socket_permission_request.h
@@ -21,7 +21,8 @@ struct SocketPermissionRequest {
     UDP_MULTICAST_MEMBERSHIP,
     RESOLVE_HOST,
     RESOLVE_PROXY,
-    NETWORK_STATE
+    NETWORK_STATE,
+    OPERATION_TYPE_LAST = NETWORK_STATE
   };
 
   SocketPermissionRequest(OperationType type,
diff --git a/chromium/content/public/common/speech_recognition_error.h b/chromium/content/public/common/speech_recognition_error.h
index 6a40a1e32c0..a12bc401cab 100644
--- a/chromium/content/public/common/speech_recognition_error.h
+++ b/chromium/content/public/common/speech_recognition_error.h
@@ -16,7 +16,8 @@ enum SpeechRecognitionErrorCode {
 // Error details for the SPEECH_RECOGNITION_ERROR_AUDIO error.
 enum SpeechAudioErrorDetails {
   SPEECH_AUDIO_ERROR_DETAILS_NONE = 0,
-  SPEECH_AUDIO_ERROR_DETAILS_NO_MIC
+  SPEECH_AUDIO_ERROR_DETAILS_NO_MIC,
+  SPEECH_AUDIO_ERROR_DETAILS_LAST = SPEECH_AUDIO_ERROR_DETAILS_NO_MIC
 };
 
 struct CONTENT_EXPORT SpeechRecognitionError {
diff --git a/chromium/content/public/common/speech_recognition_error_list.h b/chromium/content/public/common/speech_recognition_error_list.h
index 8bce8d699d4..8a9614ec190 100644
--- a/chromium/content/public/common/speech_recognition_error_list.h
+++ b/chromium/content/public/common/speech_recognition_error_list.h
@@ -32,3 +32,7 @@ DEFINE_SPEECH_RECOGNITION_ERROR(NO_MATCH, 6)
 
 // There was an error in the speech recognition grammar.
 DEFINE_SPEECH_RECOGNITION_ERROR(BAD_GRAMMAR, 7)
+
+// Reports the highest value. Update when adding a new error code.
+DEFINE_SPEECH_RECOGNITION_ERROR(LAST, 7)
+
diff --git a/chromium/content/public/common/storage_quota_params.h b/chromium/content/public/common/storage_quota_params.h
new file mode 100644
index 00000000000..6fd5cf82fd0
--- /dev/null
+++ b/chromium/content/public/common/storage_quota_params.h
@@ -0,0 +1,37 @@
+// Copyright 2014 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_PUBLIC_COMMON_STORAGE_QUOTA_PARAMS_H_
+#define CONTENT_PUBLIC_COMMON_STORAGE_QUOTA_PARAMS_H_
+
+#include "content/common/content_export.h"
+#include "ipc/ipc_message.h"
+#include "url/gurl.h"
+#include "webkit/common/quota/quota_types.h"
+
+namespace content {
+
+// Parameters from the renderer to the browser process on a
+// RequestStorageQuota call.
+struct CONTENT_EXPORT StorageQuotaParams {
+  StorageQuotaParams()
+      : render_view_id(MSG_ROUTING_NONE),
+        request_id(-1),
+        storage_type(quota::kStorageTypeTemporary),
+        requested_size(0),
+        user_gesture(false) {}
+
+  int render_view_id;
+  int request_id;
+  GURL origin_url;
+  quota::StorageType storage_type;
+  uint64 requested_size;
+
+  // Request was made in the context of a user gesture.
+  bool user_gesture;
+};
+
+}  // namespace content
+
+#endif  // CONTENT_PUBLIC_COMMON_STORAGE_QUOTA_PARAMS_H_
diff --git a/chromium/content/public/common/url_constants.cc b/chromium/content/public/common/url_constants.cc
index 261dbc9c47f..ac65dedaaf6 100644
--- a/chromium/content/public/common/url_constants.cc
+++ b/chromium/content/public/common/url_constants.cc
@@ -4,33 +4,17 @@
 
 #include "content/public/common/url_constants.h"
 
-namespace chrome {
-
-const char kAboutScheme[] = "about";
-const char kBlobScheme[] = "blob";
+namespace content {
 
 // Before adding new chrome schemes please check with security@chromium.org.
 // There are security implications associated with introducing new schemes.
 const char kChromeDevToolsScheme[] = "chrome-devtools";
 const char kChromeUIScheme[] = "chrome";
-const char kDataScheme[] = "data";
-const char kFileScheme[] = "file";
-const char kFileSystemScheme[] = "filesystem";
-}  // namespace chrome
-
-namespace content {
-
-const char kFtpScheme[] = "ftp";
 const char kGuestScheme[] = "chrome-guest";
-const char kHttpScheme[] = "http";
-const char kHttpsScheme[] = "https";
-const char kJavaScriptScheme[] = "javascript";
-const char kMailToScheme[] = "mailto";
 const char kMetadataScheme[] = "metadata";
 const char kSwappedOutScheme[] = "swappedout";
 const char kViewSourceScheme[] = "view-source";
 
-const char kAboutBlankURL[] = "about:blank";
 const char kAboutSrcDocURL[] = "about:srcdoc";
 
 const char kChromeUIAppCacheInternalsHost[] = "appcache-internals";
@@ -43,11 +27,13 @@ const char kChromeUIHistogramHost[] = "histograms";
 const char kChromeUIMediaInternalsHost[] = "media-internals";
 const char kChromeUINetworkViewCacheHost[] = "view-http-cache";
 const char kChromeUIResourcesHost[] = "resources";
+const char kChromeUIServiceWorkerInternalsHost[] = "serviceworker-internals";
 const char kChromeUITcmallocHost[] = "tcmalloc";
 const char kChromeUITracingHost[] = "tracing";
 const char kChromeUIWebRTCInternalsHost[] = "webrtc-internals";
 
 const char kChromeUICrashURL[] = "chrome://crash";
+const char kChromeUIDumpURL[] = "chrome://crashdump";
 const char kChromeUIGpuCleanURL[] = "chrome://gpuclean";
 const char kChromeUIGpuCrashURL[] = "chrome://gpucrash";
 const char kChromeUIGpuHangURL[] = "chrome://gpuhang";
@@ -55,8 +41,8 @@ const char kChromeUIHangURL[] = "chrome://hang";
 const char kChromeUIKillURL[] = "chrome://kill";
 const char kChromeUIPpapiFlashCrashURL[] = "chrome://ppapiflashcrash";
 const char kChromeUIPpapiFlashHangURL[] = "chrome://ppapiflashhang";
-
-const char kStandardSchemeSeparator[] = "://";
+const char kChromeUIServiceWorkerInternalsURL[] =
+    "chrome://serviceworker-internals";
 
 // This error URL is loaded in normal web renderer processes, so it should not
 // have a chrome:// scheme that might let it be confused with a WebUI page.
diff --git a/chromium/content/public/common/url_constants.h b/chromium/content/public/common/url_constants.h
index b2194f9d13f..7f125f725a9 100644
--- a/chromium/content/public/common/url_constants.h
+++ b/chromium/content/public/common/url_constants.h
@@ -6,38 +6,23 @@
 #define CONTENT_PUBLIC_COMMON_URL_CONSTANTS_H_
 
 #include "content/common/content_export.h"
+#include "url/url_constants.h"
 
 // Contains constants for known URLs and portions thereof.
 
-// TODO(jam): rename this to content.
-namespace chrome {
+namespace content {
 
 // Canonical schemes you can use as input to GURL.SchemeIs().
 // TODO(jam): some of these don't below in the content layer, but are accessed
 // from there.
-CONTENT_EXPORT extern const char kAboutScheme[];
-CONTENT_EXPORT extern const char kBlobScheme[];
 CONTENT_EXPORT extern const char kChromeDevToolsScheme[];
 CONTENT_EXPORT extern const char kChromeUIScheme[];  // Used for WebUIs.
-CONTENT_EXPORT extern const char kDataScheme[];
-CONTENT_EXPORT extern const char kFileScheme[];
-CONTENT_EXPORT extern const char kFileSystemScheme[];
-}  // namespace chrome
-
-namespace content {
-
-CONTENT_EXPORT extern const char kFtpScheme[];
 CONTENT_EXPORT extern const char kGuestScheme[];
-CONTENT_EXPORT extern const char kHttpScheme[];
-CONTENT_EXPORT extern const char kHttpsScheme[];
-CONTENT_EXPORT extern const char kJavaScriptScheme[];
-CONTENT_EXPORT extern const char kMailToScheme[];
 CONTENT_EXPORT extern const char kMetadataScheme[];
 CONTENT_EXPORT extern const char kSwappedOutScheme[];
 CONTENT_EXPORT extern const char kViewSourceScheme[];
 
 // Hosts for about URLs.
-CONTENT_EXPORT extern const char kAboutBlankURL[];
 CONTENT_EXPORT extern const char kAboutSrcDocURL[];
 
 CONTENT_EXPORT extern const char kChromeUIAccessibilityHost[];
@@ -50,12 +35,14 @@ CONTENT_EXPORT extern const char kChromeUIIndexedDBInternalsHost[];
 CONTENT_EXPORT extern const char kChromeUIMediaInternalsHost[];
 CONTENT_EXPORT extern const char kChromeUINetworkViewCacheHost[];
 CONTENT_EXPORT extern const char kChromeUIResourcesHost[];
+CONTENT_EXPORT extern const char kChromeUIServiceWorkerInternalsHost[];
 CONTENT_EXPORT extern const char kChromeUITcmallocHost[];
 CONTENT_EXPORT extern const char kChromeUITracingHost[];
 CONTENT_EXPORT extern const char kChromeUIWebRTCInternalsHost[];
 
 // Full about URLs (including schemes).
 CONTENT_EXPORT extern const char kChromeUICrashURL[];
+CONTENT_EXPORT extern const char kChromeUIDumpURL[];
 CONTENT_EXPORT extern const char kChromeUIGpuCleanURL[];
 CONTENT_EXPORT extern const char kChromeUIGpuCrashURL[];
 CONTENT_EXPORT extern const char kChromeUIGpuHangURL[];
@@ -63,9 +50,7 @@ CONTENT_EXPORT extern const char kChromeUIHangURL[];
 CONTENT_EXPORT extern const char kChromeUIKillURL[];
 CONTENT_EXPORT extern const char kChromeUIPpapiFlashCrashURL[];
 CONTENT_EXPORT extern const char kChromeUIPpapiFlashHangURL[];
-
-// Used to separate a standard scheme and the hostname: "://".
-CONTENT_EXPORT extern const char kStandardSchemeSeparator[];
+CONTENT_EXPORT extern const char kChromeUIServiceWorkerInternalsURL[];
 
 // Special URL used to start a navigation to an error page.
 CONTENT_EXPORT extern const char kUnreachableWebDataURL[];
diff --git a/chromium/content/public/common/url_fetcher.h b/chromium/content/public/common/url_fetcher.h
index 2a8b47d33f5..901e7655177 100644
--- a/chromium/content/public/common/url_fetcher.h
+++ b/chromium/content/public/common/url_fetcher.h
@@ -16,12 +16,12 @@ class URLFetcher;
 namespace content {
 
 // Mark URLRequests started by the URLFetcher to stem from the given render
-// view.
-CONTENT_EXPORT void AssociateURLFetcherWithRenderView(
+// frame.
+CONTENT_EXPORT void AssociateURLFetcherWithRenderFrame(
     net::URLFetcher* url_fetcher,
     const GURL& first_party_for_cookies,
     int render_process_id,
-    int render_view_id);
+    int render_frame_id);
 
 }  // namespace content
 
diff --git a/chromium/content/public/common/url_utils.cc b/chromium/content/public/common/url_utils.cc
index 1aa1a97051e..d2fb13bd0f7 100644
--- a/chromium/content/public/common/url_utils.cc
+++ b/chromium/content/public/common/url_utils.cc
@@ -24,9 +24,9 @@ const char* const* GetSavableSchemes() {
 bool HasWebUIScheme(const GURL& url) {
   return
 #if !defined(OS_IOS)
-         url.SchemeIs(chrome::kChromeDevToolsScheme) ||
+         url.SchemeIs(kChromeDevToolsScheme) ||
 #endif
-         url.SchemeIs(chrome::kChromeUIScheme);
+         url.SchemeIs(kChromeUIScheme);
 }
 
 bool IsSavableURL(const GURL& url) {
diff --git a/chromium/content/public/common/user_agent.h b/chromium/content/public/common/user_agent.h
new file mode 100644
index 00000000000..0613678a3ba
--- /dev/null
+++ b/chromium/content/public/common/user_agent.h
@@ -0,0 +1,39 @@
+// Copyright 2014 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_PUBLIC_COMMON_USER_AGENT_H_
+#define CONTENT_PUBLIC_COMMON_USER_AGENT_H_
+
+#include <string>
+
+#include "content/common/content_export.h"
+
+namespace content {
+
+// Returns the WebKit version, in the form "major.minor (branch@revision)".
+CONTENT_EXPORT std::string GetWebKitVersion();
+
+// The following 2 functions return the major and minor webkit versions.
+CONTENT_EXPORT int GetWebKitMajorVersion();
+CONTENT_EXPORT int GetWebKitMinorVersion();
+
+CONTENT_EXPORT std::string GetWebKitRevision();
+
+// Builds a User-agent compatible string that describes the OS and CPU type.
+CONTENT_EXPORT std::string BuildOSCpuInfo();
+
+// Helper function to generate a full user agent string from a short
+// product name.
+CONTENT_EXPORT std::string BuildUserAgentFromProduct(
+    const std::string& product);
+
+// Builds a full user agent string given a string describing the OS and a
+// product name.
+CONTENT_EXPORT std::string BuildUserAgentFromOSAndProduct(
+    const std::string& os_info,
+    const std::string& product);
+
+}  // namespace content
+
+#endif  // CONTENT_PUBLIC_COMMON_USER_AGENT_H_
diff --git a/chromium/content/public/common/user_metrics_action.h b/chromium/content/public/common/user_metrics_action.h
deleted file mode 100644
index 3b604ef3b8f..00000000000
--- a/chromium/content/public/common/user_metrics_action.h
+++ /dev/null
@@ -1,29 +0,0 @@
-// Copyright 2013 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef CONTENT_PUBLIC_COMMON_USER_METRICS_ACTION_H_
-#define CONTENT_PUBLIC_COMMON_USER_METRICS_ACTION_H_
-
-namespace content {
-
-// UserMetricsAction exists purely to standardize on the parameters passed to
-// UserMetrics. That way, our toolset can scan the source code reliable for
-// constructors and extract the associated string constants.
-// WARNING: When using UserMetricsAction, UserMetricsAction and a string literal
-// parameter must be on the same line, e.g.
-//   RecordAction(
-//       UserMetricsAction("my extremely long action name"));
-// or
-//   RenderThread::Get()->RecordAction(
-//       UserMetricsAction("my extremely long action name"));
-// because otherwise our processing scripts won't pick up on new actions.
-// Please see tools/metrics/actions/extract_actions.py for details.
-struct UserMetricsAction {
-  const char* str_;
-  explicit UserMetricsAction(const char* str) : str_(str) {}
-};
-
-}  // namespace content
-
-#endif  // CONTENT_PUBLIC_COMMON_USER_METRICS_ACTION_H_
diff --git a/chromium/content/public/common/webplugininfo.cc b/chromium/content/public/common/webplugininfo.cc
index 9f0c42f9ced..b6fedb9bd0f 100644
--- a/chromium/content/public/common/webplugininfo.cc
+++ b/chromium/content/public/common/webplugininfo.cc
@@ -21,7 +21,7 @@ WebPluginMimeType::WebPluginMimeType(const std::string& m,
                                      const std::string& d)
     : mime_type(m),
       file_extensions(),
-      description(ASCIIToUTF16(d)) {
+      description(base::ASCIIToUTF16(d)) {
   file_extensions.push_back(f);
 }
 
@@ -73,7 +73,7 @@ void WebPluginInfo::CreateVersionFromString(
     base::Version* parsed_version) {
   // Remove spaces and ')' from the version string,
   // Replace any instances of 'r', ',' or '(' with a dot.
-  std::string version = UTF16ToASCII(version_string);
+  std::string version = base::UTF16ToASCII(version_string);
   base::RemoveChars(version, ") ", &version);
   std::replace(version.begin(), version.end(), 'd', '.');
   std::replace(version.begin(), version.end(), 'r', '.');
diff --git a/chromium/content/public/common/webplugininfo.h b/chromium/content/public/common/webplugininfo.h
index 75b4033efd4..2912cefb331 100644
--- a/chromium/content/public/common/webplugininfo.h
+++ b/chromium/content/public/common/webplugininfo.h
@@ -47,7 +47,8 @@ struct CONTENT_EXPORT WebPluginInfo {
     PLUGIN_TYPE_NPAPI,
     PLUGIN_TYPE_PEPPER_IN_PROCESS,
     PLUGIN_TYPE_PEPPER_OUT_OF_PROCESS,
-    PLUGIN_TYPE_PEPPER_UNSANDBOXED
+    PLUGIN_TYPE_PEPPER_UNSANDBOXED,
+    PLUGIN_TYPE_BROWSER_PLUGIN
   };
 
   WebPluginInfo();
diff --git a/chromium/content/public/common/zygote_fork_delegate_linux.h b/chromium/content/public/common/zygote_fork_delegate_linux.h
index 87b4859c7cf..2f2f0b2a55c 100644
--- a/chromium/content/public/common/zygote_fork_delegate_linux.h
+++ b/chromium/content/public/common/zygote_fork_delegate_linux.h
@@ -29,10 +29,14 @@ class ZygoteForkDelegate {
 
   // Initialization happens in the zygote after it has been
   // started by ZygoteMain.
-  virtual void Init(int sandboxdesc) = 0;
+  // If |enable_layer1_sandbox| is true, the delegate must enable a
+  // layer-1 sandbox such as the setuid sandbox.
+  virtual void Init(int sandboxdesc, bool enable_layer1_sandbox) = 0;
 
-  // After Init, supply a UMA_HISTOGRAM_ENUMERATION the delegate
-  // would like to supply on the first fork.
+  // After Init, supply a UMA_HISTOGRAM_ENUMERATION the delegate would like
+  // reported to the browser process.  (Note: Because these reports are
+  // piggy-backed onto fork responses that don't otherwise contain UMA reports,
+  // this method may not be called until much later.)
   virtual void InitialUMA(std::string* uma_name,
                           int* uma_sample,
                           int* uma_boundary_value) = 0;
@@ -47,11 +51,11 @@ class ZygoteForkDelegate {
   enum {
     // Used to pass in the descriptor for talking to the Browser
     kBrowserFDIndex,
-    // The next two are used in the protocol for discovering the
-    // child processes real PID from within the SUID sandbox. See
-    // http://code.google.com/p/chromium/wiki/LinuxZygote
-    kDummyFDIndex,
-    kParentFDIndex,
+    // The PID oracle is used in the protocol for discovering the
+    // child process's real PID from within the SUID sandbox.
+    // The child process is required to write to the socket after
+    // successfully forking.
+    kPIDOracleFDIndex,
     kNumPassedFDs  // Number of FDs in the vector passed to Fork().
   };
 
@@ -59,12 +63,11 @@ class ZygoteForkDelegate {
   // suid sandbox, Fork() returns the Linux process ID.
   // This method is not aware of any potential pid namespaces, so it'll
   // return a raw pid just like fork() would.
-  virtual pid_t Fork(const std::vector<int>& fds) = 0;
-
-  // After a successful fork, signal the child to indicate that
-  // the child's PID has been received. Also communicate the
-  // channel switch as a part of acknowledgement message.
-  virtual bool AckChild(int fd, const std::string& channel_switch) = 0;
+  // Delegate is responsible for communicating the channel ID to the
+  // newly created child process.
+  virtual pid_t Fork(const std::string& process_type,
+                     const std::vector<int>& fds,
+                     const std::string& channel_id) = 0;
 
   // The fork delegate must also assume the role of waiting for its children
   // since the caller will not be their parents and cannot do it. |pid| here
diff --git a/chromium/content/public/plugin/BUILD.gn b/chromium/content/public/plugin/BUILD.gn
new file mode 100644
index 00000000000..059aea60ebd
--- /dev/null
+++ b/chromium/content/public/plugin/BUILD.gn
@@ -0,0 +1,9 @@
+# Copyright 2014 The Chromium Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+source_set("plugin") {
+  sources = [
+    "content_plugin_client.h",
+  ]
+}
diff --git a/chromium/content/public/renderer/BUILD.gn b/chromium/content/public/renderer/BUILD.gn
new file mode 100644
index 00000000000..414020506ab
--- /dev/null
+++ b/chromium/content/public/renderer/BUILD.gn
@@ -0,0 +1,30 @@
+# Copyright 2014 The Chromium Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+import("//build/config/features.gni")
+import("//content/renderer/renderer.gni")
+
+source_set("renderer") {
+  sources = rebase_path(content_renderer_gypi_values.public_renderer_sources,
+                        ".", "//content")
+
+  configs += [
+    "//content:content_implementation",
+    "//content:libjingle_stub_config",
+  ]
+
+  deps = [
+    "//content/renderer",
+    "//skia",
+    "//third_party/WebKit/public:blink_headers",
+    "//third_party/widevine/cdm:version_h",
+    "//v8",
+  ]
+
+  if (enable_webrtc) {
+    sources += rebase_path(
+        content_renderer_gypi_values.public_renderer_webrtc_sources,
+        ".", "//content")
+  }
+}
diff --git a/chromium/content/public/renderer/DEPS b/chromium/content/public/renderer/DEPS
index 3035db9dada..11f2420efb5 100644
--- a/chromium/content/public/renderer/DEPS
+++ b/chromium/content/public/renderer/DEPS
@@ -1,4 +1,6 @@
 include_rules = [
+  "+media/filters",
+  "+media/video",
   "+v8/include/v8.h",
 ]
 
diff --git a/chromium/content/public/renderer/android/OWNERS b/chromium/content/public/renderer/android/OWNERS
deleted file mode 100644
index f1159d64574..00000000000
--- a/chromium/content/public/renderer/android/OWNERS
+++ /dev/null
@@ -1,3 +0,0 @@
-boliu@chromium.org
-jamesr@chromium.org
-mkosiba@chromium.org
diff --git a/chromium/content/public/renderer/content_renderer_client.cc b/chromium/content/public/renderer/content_renderer_client.cc
index e33e34f8fec..800bb55b151 100644
--- a/chromium/content/public/renderer/content_renderer_client.cc
+++ b/chromium/content/public/renderer/content_renderer_client.cc
@@ -20,7 +20,7 @@ std::string ContentRendererClient::GetDefaultEncoding() {
 
 bool ContentRendererClient::OverrideCreatePlugin(
     RenderFrame* render_frame,
-    blink::WebFrame* frame,
+    blink::WebLocalFrame* frame,
     const blink::WebPluginParams& params,
     blink::WebPlugin** plugin) {
   return false;
@@ -37,7 +37,8 @@ bool ContentRendererClient::HasErrorPage(int http_status_code,
   return false;
 }
 
-bool ContentRendererClient::ShouldSuppressErrorPage(const GURL& url) {
+bool ContentRendererClient::ShouldSuppressErrorPage(RenderFrame* render_frame,
+                                                    const GURL& url) {
   return false;
 }
 
@@ -93,7 +94,7 @@ bool ContentRendererClient::AllowPopup() {
 
 #ifdef OS_ANDROID
 bool ContentRendererClient::HandleNavigation(
-    RenderView* view,
+    RenderFrame* render_frame,
     DocumentState* document_state,
     int opener_id,
     blink::WebFrame* frame,
@@ -153,11 +154,6 @@ bool ContentRendererClient::IsExternalPepperPlugin(
   return false;
 }
 
-bool ContentRendererClient::AllowBrowserPlugin(
-    blink::WebPluginContainer* container) {
-  return false;
-}
-
 bool ContentRendererClient::AllowPepperMediaStreamAPI(const GURL& url) {
   return false;
 }
@@ -177,7 +173,7 @@ bool ContentRendererClient::ShouldEnableSiteIsolationPolicy() const {
 
 blink::WebWorkerPermissionClientProxy*
 ContentRendererClient::CreateWorkerPermissionClientProxy(
-    RenderView* render_view, blink::WebFrame* frame) {
+    RenderFrame* render_frame, blink::WebFrame* frame) {
   return NULL;
 }
 
diff --git a/chromium/content/public/renderer/content_renderer_client.h b/chromium/content/public/renderer/content_renderer_client.h
index 1e834fe89c2..ca600396daa 100644
--- a/chromium/content/public/renderer/content_renderer_client.h
+++ b/chromium/content/public/renderer/content_renderer_client.h
@@ -30,6 +30,7 @@ namespace blink {
 class WebAudioDevice;
 class WebClipboard;
 class WebFrame;
+class WebLocalFrame;
 class WebMIDIAccessor;
 class WebMIDIAccessorClient;
 class WebMediaStreamCenter;
@@ -64,7 +65,9 @@ class CONTENT_EXPORT ContentRendererClient {
   // Notifies us that the RenderThread has been created.
   virtual void RenderThreadStarted() {}
 
-  // Notifies that a new RenderFrame has been created.
+  // Notifies that a new RenderFrame has been created. Note that at this point,
+  // render_frame->GetWebFrame()->parent() is always NULL. This will change once
+  // the frame tree moves from Blink to content.
   virtual void RenderFrameCreated(RenderFrame* render_frame) {}
 
   // Notifies that a new RenderView has been created.
@@ -88,7 +91,7 @@ class CONTENT_EXPORT ContentRendererClient {
   // returns false, the content layer will create the plugin.
   virtual bool OverrideCreatePlugin(
       RenderFrame* render_frame,
-      blink::WebFrame* frame,
+      blink::WebLocalFrame* frame,
       const blink::WebPluginParams& params,
       blink::WebPlugin** plugin);
 
@@ -106,8 +109,9 @@ class CONTENT_EXPORT ContentRendererClient {
                             std::string* error_domain);
 
   // Returns true if the embedder prefers not to show an error page for a failed
-  // navigation to |url|.
-  virtual bool ShouldSuppressErrorPage(const GURL& url);
+  // navigation to |url| in |render_frame|.
+  virtual bool ShouldSuppressErrorPage(RenderFrame* render_frame,
+                                       const GURL& url);
 
   // Returns the information to display when a navigation error occurs.
   // If |error_html| is not null then it may be set to a HTML page containing
@@ -118,10 +122,10 @@ class CONTENT_EXPORT ContentRendererClient {
   // (lack of information on the error code) so the caller should take care to
   // initialize the string values with safe defaults before the call.
   virtual void GetNavigationErrorStrings(
+      content::RenderView* render_view,
       blink::WebFrame* frame,
       const blink::WebURLRequest& failed_request,
       const blink::WebURLError& error,
-      const std::string& accept_languages,
       std::string* error_html,
       base::string16* error_description) {}
 
@@ -179,7 +183,7 @@ class CONTENT_EXPORT ContentRendererClient {
   //
   // Returns true if the navigation was handled by the embedder and should be
   // ignored by WebKit. This method is used by CEF and android_webview.
-  virtual bool HandleNavigation(RenderView* view,
+  virtual bool HandleNavigation(RenderFrame* render_frame,
                                 DocumentState* document_state,
                                 int opener_id,
                                 blink::WebFrame* frame,
@@ -213,9 +217,6 @@ class CONTENT_EXPORT ContentRendererClient {
                                       v8::Handle<v8::Context> context,
                                       int extension_group,
                                       int world_id) {}
-  virtual void WillReleaseScriptContext(blink::WebFrame* frame,
-                                        v8::Handle<v8::Context>,
-                                        int world_id) {}
 
   // See blink::Platform.
   virtual unsigned long long VisitedLinkHash(const char* canonical_url,
@@ -234,9 +235,6 @@ class CONTENT_EXPORT ContentRendererClient {
   // startup steps).
   virtual bool IsExternalPepperPlugin(const std::string& module_name);
 
-  // Returns whether BrowserPlugin should be allowed within the |container|.
-  virtual bool AllowBrowserPlugin(blink::WebPluginContainer* container);
-
   // Returns true if the page at |url| can use Pepper MediaStream APIs.
   virtual bool AllowPepperMediaStreamAPI(const GURL& url);
 
@@ -258,7 +256,7 @@ class CONTENT_EXPORT ContentRendererClient {
 
   // Creates a permission client proxy for in-renderer worker.
   virtual blink::WebWorkerPermissionClientProxy*
-      CreateWorkerPermissionClientProxy(RenderView* render_view,
+      CreateWorkerPermissionClientProxy(RenderFrame* render_frame,
                                         blink::WebFrame* frame);
 };
 
diff --git a/chromium/content/public/renderer/history_item_serialization.cc b/chromium/content/public/renderer/history_item_serialization.cc
deleted file mode 100644
index 96309c954d2..00000000000
--- a/chromium/content/public/renderer/history_item_serialization.cc
+++ /dev/null
@@ -1,196 +0,0 @@
-// Copyright (c) 2013 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "content/public/renderer/history_item_serialization.h"
-
-#include "content/common/page_state_serialization.h"
-#include "content/public/common/page_state.h"
-#include "third_party/WebKit/public/platform/WebHTTPBody.h"
-#include "third_party/WebKit/public/platform/WebPoint.h"
-#include "third_party/WebKit/public/platform/WebString.h"
-#include "third_party/WebKit/public/platform/WebVector.h"
-#include "third_party/WebKit/public/web/WebHistoryItem.h"
-#include "third_party/WebKit/public/web/WebSerializedScriptValue.h"
-
-using blink::WebHTTPBody;
-using blink::WebHistoryItem;
-using blink::WebSerializedScriptValue;
-using blink::WebString;
-using blink::WebVector;
-
-namespace content {
-namespace {
-
-void ToNullableString16Vector(const WebVector<WebString>& input,
-                              std::vector<base::NullableString16>* output) {
-  output->reserve(input.size());
-  for (size_t i = 0; i < input.size(); ++i)
-    output->push_back(input[i]);
-}
-
-void ToExplodedHttpBodyElement(const WebHTTPBody::Element& input,
-                               ExplodedHttpBodyElement* output) {
-  switch (input.type) {
-    case WebHTTPBody::Element::TypeData:
-      output->data.assign(input.data.data(), input.data.size());
-      break;
-    case WebHTTPBody::Element::TypeFile:
-      output->file_path = input.filePath;
-      output->file_start = input.fileStart;
-      output->file_length = input.fileLength;
-      output->file_modification_time = input.modificationTime;
-      break;
-    case WebHTTPBody::Element::TypeFileSystemURL:
-      output->filesystem_url = input.fileSystemURL;
-      output->file_start = input.fileStart;
-      output->file_length = input.fileLength;
-      output->file_modification_time = input.modificationTime;
-      break;
-    case WebHTTPBody::Element::TypeBlob:
-      output->blob_uuid = input.blobUUID.utf8();
-      break;
-  }
-}
-
-void AppendHTTPBodyElement(const ExplodedHttpBodyElement& element,
-                           WebHTTPBody* http_body) {
-  switch (element.type) {
-    case WebHTTPBody::Element::TypeData:
-      http_body->appendData(element.data);
-      break;
-    case WebHTTPBody::Element::TypeFile:
-      http_body->appendFileRange(
-          element.file_path,
-          element.file_start,
-          element.file_length,
-          element.file_modification_time);
-      break;
-    case WebHTTPBody::Element::TypeFileSystemURL:
-      http_body->appendFileSystemURLRange(
-          element.filesystem_url,
-          element.file_start,
-          element.file_length,
-          element.file_modification_time);
-      break;
-    case WebHTTPBody::Element::TypeBlob:
-      http_body->appendBlob(WebString::fromUTF8(element.blob_uuid));
-      break;
-  }
-}
-
-bool RecursivelyGenerateFrameState(const WebHistoryItem& item,
-                                   ExplodedFrameState* state) {
-  state->url_string = item.urlString();
-  state->original_url_string = item.originalURLString();
-  state->referrer = item.referrer();
-  state->target = item.target();
-  if (!item.stateObject().isNull())
-    state->state_object = item.stateObject().toString();
-  state->scroll_offset = item.scrollOffset();
-  state->item_sequence_number = item.itemSequenceNumber();
-  state->document_sequence_number =
-      item.documentSequenceNumber();
-  state->target_frame_id = item.targetFrameID();
-  state->page_scale_factor = item.pageScaleFactor();
-  ToNullableString16Vector(item.documentState(), &state->document_state);
-
-  state->http_body.http_content_type = item.httpContentType();
-  const WebHTTPBody& http_body = item.httpBody();
-  if (!(state->http_body.is_null = http_body.isNull())) {
-    state->http_body.identifier = http_body.identifier();
-    state->http_body.elements.resize(http_body.elementCount());
-    for (size_t i = 0; i < http_body.elementCount(); ++i) {
-      WebHTTPBody::Element element;
-      http_body.elementAt(i, element);
-      ToExplodedHttpBodyElement(element, &state->http_body.elements[i]);
-    }
-    state->http_body.contains_passwords = http_body.containsPasswordData();
-  }
-
-  const WebVector<WebHistoryItem>& children = item.children();
-  state->children.resize(children.size());
-  for (size_t i = 0; i < children.size(); ++i) {
-    if (!RecursivelyGenerateFrameState(children[i], &state->children[i]))
-      return false;
-  }
-
-  return true;
-}
-
-bool RecursivelyGenerateHistoryItem(const ExplodedFrameState& state,
-                                    WebHistoryItem* item) {
-  item->setURLString(state.url_string);
-  item->setOriginalURLString(state.original_url_string);
-  item->setReferrer(state.referrer);
-  item->setTarget(state.target);
-  if (!state.state_object.is_null()) {
-    item->setStateObject(
-        WebSerializedScriptValue::fromString(state.state_object));
-  }
-  item->setDocumentState(state.document_state);
-  item->setScrollOffset(state.scroll_offset);
-  item->setPageScaleFactor(state.page_scale_factor);
-
-  // These values are generated at WebHistoryItem construction time, and we
-  // only want to override those new values with old values if the old values
-  // are defined.  A value of 0 means undefined in this context.
-  if (state.item_sequence_number)
-    item->setItemSequenceNumber(state.item_sequence_number);
-  if (state.document_sequence_number)
-    item->setDocumentSequenceNumber(state.document_sequence_number);
-
-  item->setTargetFrameID(state.target_frame_id);
-
-  item->setHTTPContentType(state.http_body.http_content_type);
-  if (!state.http_body.is_null) {
-    WebHTTPBody http_body;
-    http_body.initialize();
-    http_body.setIdentifier(state.http_body.identifier);
-    for (size_t i = 0; i < state.http_body.elements.size(); ++i)
-      AppendHTTPBodyElement(state.http_body.elements[i], &http_body);
-    item->setHTTPBody(http_body);
-  }
-
-  for (size_t i = 0; i < state.children.size(); ++i) {
-    WebHistoryItem child_item;
-    child_item.initialize();
-    if (!RecursivelyGenerateHistoryItem(state.children[i], &child_item))
-      return false;
-    item->appendToChildren(child_item);
-  }
-
-  return true;
-}
-
-}  // namespace
-
-PageState HistoryItemToPageState(const WebHistoryItem& item) {
-  ExplodedPageState state;
-  ToNullableString16Vector(item.getReferencedFilePaths(),
-                           &state.referenced_files);
-
-  if (!RecursivelyGenerateFrameState(item, &state.top))
-    return PageState();
-
-  std::string encoded_data;
-  if (!EncodePageState(state, &encoded_data))
-    return PageState();
-
-  return PageState::CreateFromEncodedData(encoded_data);
-}
-
-WebHistoryItem PageStateToHistoryItem(const PageState& page_state) {
-  ExplodedPageState state;
-  if (!DecodePageState(page_state.ToEncodedData(), &state))
-    return WebHistoryItem();
-
-  WebHistoryItem item;
-  item.initialize();
-  if (!RecursivelyGenerateHistoryItem(state.top, &item))
-    return WebHistoryItem();
-
-  return item;
-}
-
-}  // namespace content
diff --git a/chromium/content/public/renderer/history_item_serialization.h b/chromium/content/public/renderer/history_item_serialization.h
deleted file mode 100644
index dda1cf406fa..00000000000
--- a/chromium/content/public/renderer/history_item_serialization.h
+++ /dev/null
@@ -1,26 +0,0 @@
-// Copyright (c) 2013 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef CONTENT_RENDERER_HISTORY_ITEM_SERIALIZATION_H_
-#define CONTENT_RENDERER_HISTORY_ITEM_SERIALIZATION_H_
-
-#include <string>
-
-#include "content/common/content_export.h"
-
-namespace blink {
-class WebHistoryItem;
-}
-
-namespace content {
-class PageState;
-
-CONTENT_EXPORT PageState HistoryItemToPageState(
-    const blink::WebHistoryItem& item);
-CONTENT_EXPORT blink::WebHistoryItem PageStateToHistoryItem(
-    const PageState& state);
-
-}  // namespace content
-
-#endif  // CONTENT_RENDERER_HISTORY_ITEM_SERIALIZATION_H_
diff --git a/chromium/content/public/renderer/key_system_info.h b/chromium/content/public/renderer/key_system_info.h
index 09dedc607f1..8eb2e573c48 100644
--- a/chromium/content/public/renderer/key_system_info.h
+++ b/chromium/content/public/renderer/key_system_info.h
@@ -5,12 +5,13 @@
 #ifndef CONTENT_PUBLIC_RENDERER_KEY_SYSTEM_INFO_H_
 #define CONTENT_PUBLIC_RENDERER_KEY_SYSTEM_INFO_H_
 
+#include <map>
 #include <string>
-#include <utility>
-#include <vector>
 
 #include "base/basictypes.h"
+#include "base/containers/hash_tables.h"
 #include "content/common/content_export.h"
+#include "content/public/common/eme_codec.h"
 
 // Definitions:
 // * Key system
@@ -32,19 +33,13 @@ namespace content {
 // Contains information about an EME key system as well as how to instantiate
 // the corresponding CDM.
 struct CONTENT_EXPORT KeySystemInfo {
-  // Represents container-codec combinations. The second string may contain zero
-  // or more codecs separated by commas.
-  typedef std::pair<std::string, std::string> ContainerCodecsPair;
-
   explicit KeySystemInfo(const std::string& key_system);
   ~KeySystemInfo();
 
   std::string key_system;
 
-  // Specifies container and codec combinations supported by |key_system|.
-  // Multiple codecs may be listed for each container.
-  // In all cases, the container without a codec is also always supported.
-  std::vector<ContainerCodecsPair> supported_types;
+  // Specifies codecs supported by |key_system|.
+  SupportedCodecs supported_codecs;
 
   // A hierarchical parent for |key_system|. This value can be used to check
   // supported types but cannot be used to instantiate a MediaKeys object.
@@ -55,8 +50,6 @@ struct CONTENT_EXPORT KeySystemInfo {
   bool use_aes_decryptor;
 #if defined(ENABLE_PEPPER_CDMS)
   std::string pepper_type;
-#elif defined(OS_ANDROID)
-  std::vector<uint8> uuid;
 #endif
 };
 
diff --git a/chromium/content/public/renderer/media_stream_audio_sink.cc b/chromium/content/public/renderer/media_stream_audio_sink.cc
index f96c92b336f..9d105d9c36f 100644
--- a/chromium/content/public/renderer/media_stream_audio_sink.cc
+++ b/chromium/content/public/renderer/media_stream_audio_sink.cc
@@ -5,7 +5,7 @@
 #include "content/public/renderer/media_stream_audio_sink.h"
 
 #include "base/logging.h"
-#include "content/renderer/media/media_stream_track_extra_data.h"
+#include "content/renderer/media/media_stream_track.h"
 #include "content/renderer/media/webrtc_local_audio_track.h"
 #include "third_party/WebKit/public/platform/WebMediaStreamSource.h"
 #include "third_party/WebKit/public/platform/WebMediaStreamTrack.h"
@@ -16,24 +16,22 @@ void MediaStreamAudioSink::AddToAudioTrack(
     MediaStreamAudioSink* sink,
     const blink::WebMediaStreamTrack& track) {
   DCHECK(track.source().type() == blink::WebMediaStreamSource::TypeAudio);
-  MediaStreamTrackExtraData* extra_data =
-      static_cast<MediaStreamTrackExtraData*>(track.extraData());
+  MediaStreamTrack* native_track = MediaStreamTrack::GetTrack(track);
   // TODO(xians): Support remote audio track.
-  DCHECK(extra_data->is_local_track());
+  DCHECK(native_track->is_local_track());
   WebRtcLocalAudioTrack* audio_track =
-      static_cast<WebRtcLocalAudioTrack*>(extra_data->track().get());
+      static_cast<WebRtcLocalAudioTrack*>(native_track);
   audio_track->AddSink(sink);
 }
 
 void MediaStreamAudioSink::RemoveFromAudioTrack(
     MediaStreamAudioSink* sink,
     const blink::WebMediaStreamTrack& track) {
-  MediaStreamTrackExtraData* extra_data =
-      static_cast<MediaStreamTrackExtraData*>(track.extraData());
+  MediaStreamTrack* native_track = MediaStreamTrack::GetTrack(track);
   // TODO(xians): Support remote audio track.
-  DCHECK(extra_data->is_local_track());
+  DCHECK(native_track->is_local_track());
   WebRtcLocalAudioTrack* audio_track =
-      static_cast<WebRtcLocalAudioTrack*>(extra_data->track().get());
+      static_cast<WebRtcLocalAudioTrack*>(native_track);
   audio_track->RemoveSink(sink);
 }
 
diff --git a/chromium/content/public/renderer/media_stream_video_sink.cc b/chromium/content/public/renderer/media_stream_video_sink.cc
index c6580362203..6ca37c584a1 100644
--- a/chromium/content/public/renderer/media_stream_video_sink.cc
+++ b/chromium/content/public/renderer/media_stream_video_sink.cc
@@ -12,11 +12,12 @@ namespace content {
 
 void MediaStreamVideoSink::AddToVideoTrack(
     MediaStreamVideoSink* sink,
+    const VideoCaptureDeliverFrameCB& callback,
     const blink::WebMediaStreamTrack& track) {
   DCHECK_EQ(blink::WebMediaStreamSource::TypeVideo, track.source().type());
   MediaStreamVideoTrack* video_track =
       static_cast<MediaStreamVideoTrack*>(track.extraData());
-  video_track->AddSink(sink);
+  video_track->AddSink(sink, callback);
 }
 
 void MediaStreamVideoSink::RemoveFromVideoTrack(
diff --git a/chromium/content/public/renderer/media_stream_video_sink.h b/chromium/content/public/renderer/media_stream_video_sink.h
index 48a37199b55..7aa2a5e8850 100644
--- a/chromium/content/public/renderer/media_stream_video_sink.h
+++ b/chromium/content/public/renderer/media_stream_video_sink.h
@@ -5,12 +5,15 @@
 #ifndef CONTENT_PUBLIC_RENDERER_MEDIA_STREAM_VIDEO_SINK_H_
 #define CONTENT_PUBLIC_RENDERER_MEDIA_STREAM_VIDEO_SINK_H_
 
+#include "base/callback.h"
 #include "base/compiler_specific.h"
 #include "base/memory/ref_counted.h"
+#include "base/time/time.h"
 #include "content/common/content_export.h"
 #include "content/public/renderer/media_stream_sink.h"
 
 namespace media {
+class VideoCaptureFormat;
 class VideoFrame;
 }
 
@@ -20,6 +23,23 @@ class WebMediaStreamTrack;
 
 namespace content {
 
+// This callback is used to deliver video frames.
+// |estimated_capture_time| - An optional field to provide the capture time of
+// the delivered video frame. This field usually means the local time when the
+// video frame was generated. It is possible for this value to be null if this
+// timing information cannot be determined. There is no gurantee that this
+// value is accurate. For example video frames from a remote source can only
+// provide this timing information as an estimate.
+// |video_frame->timestamp()| gives the presentation timestamp of the video
+// frame relative to the first frame generated by the corresponding source.
+// Because a source can start generating frames before a subscriber is added,
+// the first video frame delivered may not have timestamp equal to 0.
+typedef base::Callback<
+  void(const scoped_refptr<media::VideoFrame>& video_frame,
+       const media::VideoCaptureFormat& format,
+       const base::TimeTicks& estimated_capture_time)>
+    VideoCaptureDeliverFrameCB;
+
 // MediaStreamVideoSink is an interface used for receiving video frames from a
 // Video Stream Track or a Video Source.
 // http://dev.w3.org/2011/webrtc/editor/getusermedia.html
@@ -29,14 +49,19 @@ class CONTENT_EXPORT MediaStreamVideoSink : public MediaStreamSink {
   // An implementation of MediaStreamVideoSink should call AddToVideoTrack when
   // it is ready to receive data from a video track. Before the implementation
   // is destroyed, RemoveFromVideoTrack must be called.
+  //
   // Calls to these methods must be done on the main render thread.
+  // Note that |callback| for frame delivery happens on the IO thread.
+  //
+  // Calling RemoveFromVideoTrack also not stop frame delivery through the
+  // callback immediately because it may happen on another thread.
+  // The added callback will be reset on the render thread.
   static void AddToVideoTrack(MediaStreamVideoSink* sink,
+                              const VideoCaptureDeliverFrameCB& callback,
                               const blink::WebMediaStreamTrack& track);
   static void RemoveFromVideoTrack(MediaStreamVideoSink* sink,
                                    const blink::WebMediaStreamTrack& track);
 
-  virtual void OnVideoFrame(const scoped_refptr<media::VideoFrame>& frame) = 0;
-
  protected:
   virtual ~MediaStreamVideoSink() {}
 };
diff --git a/chromium/content/public/renderer/p2p_socket_client.h b/chromium/content/public/renderer/p2p_socket_client.h
deleted file mode 100644
index 6df92851243..00000000000
--- a/chromium/content/public/renderer/p2p_socket_client.h
+++ /dev/null
@@ -1,62 +0,0 @@
-// Copyright 2013 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef CONTENT_PUBLIC_RENDERER_P2P_SOCKET_CLIENT_H_
-#define CONTENT_PUBLIC_RENDERER_P2P_SOCKET_CLIENT_H_
-
-#include <vector>
-
-#include "base/memory/ref_counted.h"
-#include "content/common/content_export.h"
-#include "content/public/common/p2p_socket_type.h"
-#include "net/base/ip_endpoint.h"
-
-namespace content {
-
-class P2PSocketClientDelegate;
-
-// P2P socket that routes all calls over IPC.
-// Note that while ref-counting is thread-safe, all methods must be
-// called on the same thread.
-class CONTENT_EXPORT P2PSocketClient :
-      public base::RefCountedThreadSafe<P2PSocketClient> {
- public:
-  // Create a new P2PSocketClient() of the specified |type| and connected to
-  // the specified |address|. |address| matters only when |type| is set to
-  // P2P_SOCKET_TCP_CLIENT. The methods on the returned socket may only be
-  // called on the same thread that created it.
-  static scoped_refptr<P2PSocketClient> Create(
-      P2PSocketType type,
-      const net::IPEndPoint& local_address,
-      const net::IPEndPoint& remote_address,
-      P2PSocketClientDelegate* delegate);
-
-  P2PSocketClient() {}
-
-  // Send the |data| to the |address|.
-  virtual void Send(const net::IPEndPoint& address,
-                    const std::vector<char>& data) = 0;
-
-  // Send the |data| to the |address| using Differentiated Services Code Point
-  // |dscp|.
-  virtual void SendWithDscp(const net::IPEndPoint& address,
-                            const std::vector<char>& data,
-                            net::DiffServCodePoint dscp) = 0;
-
-  // Must be called before the socket is destroyed.
-  virtual void Close() = 0;
-
-  virtual int GetSocketID() const = 0;
-  virtual void SetDelegate(P2PSocketClientDelegate* delegate) = 0;
-
- protected:
-  virtual ~P2PSocketClient() {}
-
- private:
-  // Calls destructor.
-  friend class base::RefCountedThreadSafe<P2PSocketClient>;
-};
-}  // namespace content
-
-#endif  // CONTENT_PUBLIC_RENDERER_P2P_SOCKET_CLIENT_H_
diff --git a/chromium/content/public/renderer/p2p_socket_client_delegate.h b/chromium/content/public/renderer/p2p_socket_client_delegate.h
deleted file mode 100644
index 6b2a7312756..00000000000
--- a/chromium/content/public/renderer/p2p_socket_client_delegate.h
+++ /dev/null
@@ -1,46 +0,0 @@
-// Copyright 2013 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef CONTENT_PUBLIC_RENDERER_P2P_SOCKET_CLIENT_DELEGATE_H_
-#define CONTENT_PUBLIC_RENDERER_P2P_SOCKET_CLIENT_DELEGATE_H_
-
-#include <vector>
-
-#include "base/memory/ref_counted.h"
-#include "content/public/common/p2p_socket_type.h"
-#include "net/base/ip_endpoint.h"
-
-namespace content {
-
-class P2PSocketClient;
-
-class P2PSocketClientDelegate {
- public:
-  virtual ~P2PSocketClientDelegate() { }
-
-  // Called after the socket has been opened with the local endpoint address
-  // as argument. Please note that in the precence of multiple interfaces,
-  // you should not rely on the local endpoint address if possible.
-  virtual void OnOpen(const net::IPEndPoint& address) = 0;
-
-  // For a socket that is listening on incoming TCP connectsion, this
-  // function is called when a new client connects.
-  virtual void OnIncomingTcpConnection(const net::IPEndPoint& address,
-                                       P2PSocketClient* client) = 0;
-
-  // Called once for each Send() call after the send is complete.
-  virtual void OnSendComplete() = 0;
-
-  // Called if an non-retryable error occurs.
-  virtual void OnError() = 0;
-
-  // Called when data is received on the socket.
-  virtual void OnDataReceived(const net::IPEndPoint& address,
-                              const std::vector<char>& data,
-                              const base::TimeTicks& timestamp) = 0;
-};
-
-}  // namespace content
-
-#endif  // CONTENT_PUBLIC_RENDERER_P2P_SOCKET_CLIENT_DELEGATE_H_
diff --git a/chromium/content/public/renderer/pepper_plugin_instance.h b/chromium/content/public/renderer/pepper_plugin_instance.h
index 4811217b18d..d397fbc2ad0 100644
--- a/chromium/content/public/renderer/pepper_plugin_instance.h
+++ b/chromium/content/public/renderer/pepper_plugin_instance.h
@@ -7,10 +7,12 @@
 
 #include "base/basictypes.h"
 #include "base/process/process_handle.h"
+#include "base/strings/string16.h"
 #include "content/common/content_export.h"
 #include "ppapi/c/pp_resource.h"
 #include "ppapi/c/pp_var.h"
 #include "ppapi/c/private/ppb_instance_private.h"
+#include "ui/base/ime/text_input_type.h"
 
 class GURL;
 
@@ -103,6 +105,18 @@ class PepperPluginInstance {
 
   // Sets a read-only property on the <embed> tag for this plugin instance.
   virtual void SetEmbedProperty(PP_Var key, PP_Var value) = 0;
+
+  // Sets the selected text for this plugin.
+  virtual void SetSelectedText(const base::string16& selected_text) = 0;
+
+  // Sets the link currently under the cursor.
+  virtual void SetLinkUnderCursor(const std::string& url) = 0;
+
+  // Sets the text input type for this plugin.
+  virtual void SetTextInputType(ui::TextInputType type) = 0;
+
+  // Posts a message to the JavaScript object for this instance.
+  virtual void PostMessageToJavaScript(PP_Var message) = 0;
 };
 
 }  // namespace content
diff --git a/chromium/content/public/renderer/render_font_warmup_win.cc b/chromium/content/public/renderer/render_font_warmup_win.cc
new file mode 100644
index 00000000000..a7f67b8fbd6
--- /dev/null
+++ b/chromium/content/public/renderer/render_font_warmup_win.cc
@@ -0,0 +1,164 @@
+// Copyright 2014 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "content/public/renderer/render_font_warmup_win.h"
+
+#include <dwrite.h>
+
+#include "base/logging.h"
+#include "base/win/iat_patch_function.h"
+#include "base/win/windows_version.h"
+#include "third_party/WebKit/public/web/win/WebFontRendering.h"
+#include "third_party/skia/include/core/SkPaint.h"
+#include "third_party/skia/include/ports/SkFontMgr.h"
+#include "third_party/skia/include/ports/SkTypeface_win.h"
+
+namespace content {
+
+namespace {
+
+SkFontMgr* g_warmup_fontmgr = NULL;
+
+base::win::IATPatchFunction g_iat_patch_open_sc_manager;
+base::win::IATPatchFunction g_iat_patch_close_service_handle;
+base::win::IATPatchFunction g_iat_patch_open_service;
+base::win::IATPatchFunction g_iat_patch_start_service;
+base::win::IATPatchFunction g_iat_patch_nt_connect_port;
+
+// These are from ntddk.h
+#if !defined(STATUS_ACCESS_DENIED)
+#define STATUS_ACCESS_DENIED   ((NTSTATUS)0xC0000022L)
+#endif
+
+typedef LONG NTSTATUS;
+
+SC_HANDLE WINAPI OpenSCManagerWPatch(const wchar_t* machine_name,
+                                     const wchar_t* database_name,
+                                     DWORD access_mask) {
+  ::SetLastError(0);
+  return reinterpret_cast<SC_HANDLE>(0xdeadbeef);
+}
+
+SC_HANDLE WINAPI OpenServiceWPatch(SC_HANDLE sc_manager,
+                                   const wchar_t* service_name,
+                                   DWORD access_mask) {
+  ::SetLastError(0);
+  return reinterpret_cast<SC_HANDLE>(0xdeadbabe);
+}
+
+BOOL WINAPI CloseServiceHandlePatch(SC_HANDLE service_handle) {
+  if (service_handle != reinterpret_cast<SC_HANDLE>(0xdeadbabe) &&
+      service_handle != reinterpret_cast<SC_HANDLE>(0xdeadbeef))
+    CHECK(false);
+  ::SetLastError(0);
+  return TRUE;
+}
+
+BOOL WINAPI StartServiceWPatch(SC_HANDLE service,
+                               DWORD args,
+                               const wchar_t** arg_vectors) {
+  if (service != reinterpret_cast<SC_HANDLE>(0xdeadbabe))
+    CHECK(false);
+  ::SetLastError(ERROR_ACCESS_DENIED);
+  return FALSE;
+}
+
+NTSTATUS WINAPI NtALpcConnectPortPatch(HANDLE* port_handle,
+                                       void* port_name,
+                                       void* object_attribs,
+                                       void* port_attribs,
+                                       DWORD flags,
+                                       void* server_sid,
+                                       void* message,
+                                       DWORD* buffer_length,
+                                       void* out_message_attributes,
+                                       void* in_message_attributes,
+                                       void* time_out) {
+  return STATUS_ACCESS_DENIED;
+}
+
+// Directwrite connects to the font cache service to retrieve information about
+// fonts installed on the system etc. This works well outside the sandbox and
+// within the sandbox as long as the lpc connection maintained by the current
+// process with the font cache service remains valid. It appears that there
+// are cases when this connection is dropped after which directwrite is unable
+// to connect to the font cache service which causes problems with characters
+// disappearing.
+// Directwrite has fallback code to enumerate fonts if it is unable to connect
+// to the font cache service. We need to intercept the following APIs to
+// ensure that it does not connect to the font cache service.
+// NtALpcConnectPort
+// OpenSCManagerW
+// OpenServiceW
+// StartServiceW
+// CloseServiceHandle.
+// These are all IAT patched.
+void PatchServiceManagerCalls() {
+  static bool is_patched = false;
+  if (is_patched)
+    return;
+  const char* service_provider_dll =
+      (base::win::GetVersion() >= base::win::VERSION_WIN8 ?
+          "api-ms-win-service-management-l1-1-0.dll" : "advapi32.dll");
+
+  is_patched = true;
+
+  DWORD patched = g_iat_patch_open_sc_manager.Patch(L"dwrite.dll",
+      service_provider_dll, "OpenSCManagerW", OpenSCManagerWPatch);
+  DCHECK(patched == 0);
+
+  patched = g_iat_patch_close_service_handle.Patch(L"dwrite.dll",
+      service_provider_dll, "CloseServiceHandle", CloseServiceHandlePatch);
+  DCHECK(patched == 0);
+
+  patched = g_iat_patch_open_service.Patch(L"dwrite.dll",
+      service_provider_dll, "OpenServiceW", OpenServiceWPatch);
+  DCHECK(patched == 0);
+
+  patched = g_iat_patch_start_service.Patch(L"dwrite.dll",
+      service_provider_dll, "StartServiceW", StartServiceWPatch);
+  DCHECK(patched == 0);
+
+  patched = g_iat_patch_nt_connect_port.Patch(L"dwrite.dll",
+      "ntdll.dll", "NtAlpcConnectPort", NtALpcConnectPortPatch);
+  DCHECK(patched == 0);
+}
+
+
+// Windows-only DirectWrite support. These warm up the DirectWrite paths
+// before sandbox lock down to allow Skia access to the Font Manager service.
+void CreateDirectWriteFactory(IDWriteFactory** factory) {
+  typedef decltype(DWriteCreateFactory)* DWriteCreateFactoryProc;
+  PatchServiceManagerCalls();
+
+  DWriteCreateFactoryProc dwrite_create_factory_proc =
+      reinterpret_cast<DWriteCreateFactoryProc>(
+          GetProcAddress(LoadLibraryW(L"dwrite.dll"), "DWriteCreateFactory"));
+  CHECK(dwrite_create_factory_proc);
+  CHECK(SUCCEEDED(
+      dwrite_create_factory_proc(DWRITE_FACTORY_TYPE_ISOLATED,
+                                 __uuidof(IDWriteFactory),
+                                 reinterpret_cast<IUnknown**>(factory))));
+}
+
+}  // namespace
+
+void DoPreSandboxWarmupForTypeface(SkTypeface* typeface) {
+  SkPaint paint_warmup;
+  paint_warmup.setTypeface(typeface);
+  wchar_t glyph = L'S';
+  paint_warmup.measureText(&glyph, 2);
+}
+
+SkFontMgr* GetPreSandboxWarmupFontMgr() {
+  if (!g_warmup_fontmgr) {
+    IDWriteFactory* factory;
+    CreateDirectWriteFactory(&factory);
+    blink::WebFontRendering::setDirectWriteFactory(factory);
+    g_warmup_fontmgr = SkFontMgr_New_DirectWrite(factory);
+  }
+  return g_warmup_fontmgr;
+}
+
+}  // namespace content
diff --git a/chromium/content/public/renderer/render_font_warmup_win.h b/chromium/content/public/renderer/render_font_warmup_win.h
new file mode 100644
index 00000000000..9624d88b6c6
--- /dev/null
+++ b/chromium/content/public/renderer/render_font_warmup_win.h
@@ -0,0 +1,25 @@
+// Copyright 2014 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_PUBLIC_RENDERER_RENDER_FONT_WARMUP_WIN_H_
+#define CONTENT_PUBLIC_RENDERER_RENDER_FONT_WARMUP_WIN_H_
+
+#include "content/common/content_export.h"
+
+class SkFontMgr;
+class SkTypeface;
+
+namespace content {
+
+// Make necessary calls to cache the data for a given font, used before
+// sandbox lockdown.
+CONTENT_EXPORT void DoPreSandboxWarmupForTypeface(SkTypeface* typeface);
+
+// Get the shared font manager used during pre-sandbox warmup for DirectWrite
+// fonts.
+CONTENT_EXPORT SkFontMgr* GetPreSandboxWarmupFontMgr();
+
+}  // namespace content
+
+#endif  // CONTENT_PUBLIC_RENDERER_RENDER_FONT_WARMUP_WIN_H_
diff --git a/chromium/content/public/renderer/render_frame.h b/chromium/content/public/renderer/render_frame.h
index eef36c686ff..c48acd80123 100644
--- a/chromium/content/public/renderer/render_frame.h
+++ b/chromium/content/public/renderer/render_frame.h
@@ -5,6 +5,7 @@
 #ifndef CONTENT_PUBLIC_RENDERER_RENDER_FRAME_H_
 #define CONTENT_PUBLIC_RENDERER_RENDER_FRAME_H_
 
+#include "base/strings/string16.h"
 #include "content/common/content_export.h"
 #include "ipc/ipc_listener.h"
 #include "ipc/ipc_sender.h"
@@ -14,6 +15,8 @@ struct WebPreferences;
 
 namespace blink {
 class WebFrame;
+class WebLocalFrame;
+class WebNode;
 class WebPlugin;
 class WebURLRequest;
 struct WebPluginParams;
@@ -31,12 +34,18 @@ struct WebPluginInfo;
 class CONTENT_EXPORT RenderFrame : public IPC::Listener,
                                    public IPC::Sender {
  public:
+  // Returns the RenderFrame given a WebFrame.
+  static RenderFrame* FromWebFrame(blink::WebFrame* web_frame);
+
   // Returns the RenderView associated with this frame.
   virtual RenderView* GetRenderView() = 0;
 
   // Get the routing ID of the frame.
   virtual int GetRoutingID() = 0;
 
+  // Returns the associated WebFrame.
+  virtual blink::WebFrame* GetWebFrame() = 0;
+
    // Gets WebKit related preferences associated with this frame.
   virtual WebPreferences& GetWebkitPreferences() = 0;
 
@@ -58,6 +67,9 @@ class CONTENT_EXPORT RenderFrame : public IPC::Listener,
   // menu is closed.
   virtual void CancelContextMenu(int request_id) = 0;
 
+  // Gets the node that the context menu was pressed over.
+  virtual blink::WebNode GetContextMenuNode() const = 0;
+
   // Create a new NPAPI/Pepper plugin depending on |info|. Returns NULL if no
   // plugin was found.
   virtual blink::WebPlugin* CreatePlugin(
@@ -66,10 +78,15 @@ class CONTENT_EXPORT RenderFrame : public IPC::Listener,
       const blink::WebPluginParams& params) = 0;
 
   // The client should handle the navigation externally.
-  virtual void LoadURLExternally(
-      blink::WebFrame* frame,
-      const blink::WebURLRequest& request,
-      blink::WebNavigationPolicy policy) = 0;
+  virtual void LoadURLExternally(blink::WebLocalFrame* frame,
+                                 const blink::WebURLRequest& request,
+                                 blink::WebNavigationPolicy policy) = 0;
+
+  // Execute a string of JavaScript in this frame's context.
+  virtual void ExecuteJavaScript(const base::string16& javascript) = 0;
+
+  // Return true if this frame is hidden.
+  virtual bool IsHidden() = 0;
 
  protected:
   virtual ~RenderFrame() {}
diff --git a/chromium/content/public/renderer/render_frame_observer.cc b/chromium/content/public/renderer/render_frame_observer.cc
index 5891e111f5c..19d77d01f0e 100644
--- a/chromium/content/public/renderer/render_frame_observer.cc
+++ b/chromium/content/public/renderer/render_frame_observer.cc
@@ -17,6 +17,7 @@ RenderFrameObserver::RenderFrameObserver(RenderFrame* render_frame)
   if (render_frame) {
     RenderFrameImpl* impl = static_cast<RenderFrameImpl*>(render_frame);
     routing_id_ = impl->GetRoutingID();
+    DCHECK_NE(routing_id_, MSG_ROUTING_NONE);
     impl->AddObserver(this);
   }
 }
diff --git a/chromium/content/public/renderer/render_frame_observer.h b/chromium/content/public/renderer/render_frame_observer.h
index 6d4aa6401bf..ac836bb809b 100644
--- a/chromium/content/public/renderer/render_frame_observer.h
+++ b/chromium/content/public/renderer/render_frame_observer.h
@@ -7,9 +7,16 @@
 
 #include "base/basictypes.h"
 #include "base/compiler_specific.h"
+#include "base/strings/string16.h"
 #include "content/common/content_export.h"
 #include "ipc/ipc_listener.h"
 #include "ipc/ipc_sender.h"
+#include "v8/include/v8.h"
+
+namespace blink {
+class WebFrame;
+struct WebURLError;
+}
 
 namespace content {
 
@@ -29,6 +36,39 @@ class CONTENT_EXPORT RenderFrameObserver : public IPC::Listener,
   // Called when a Pepper plugin is created.
   virtual void DidCreatePepperPlugin(RendererPpapiHost* host) {}
 
+  // Called when a load is explicitly stopped by the user or browser.
+  virtual void OnStop() {}
+
+  // Called when the RenderFrame visiblity is changed.
+  virtual void WasHidden() {}
+  virtual void WasShown() {}
+
+  // These match the Blink API notifications
+  virtual void DidCommitProvisionalLoad(bool is_new_navigation) {}
+  virtual void DidStartProvisionalLoad() {}
+  virtual void DidFailProvisionalLoad(const blink::WebURLError& error) {}
+  virtual void DidFinishLoad() {}
+  virtual void DidFinishDocumentLoad() {}
+  virtual void WillReleaseScriptContext(v8::Handle<v8::Context> context,
+                                        int world_id) {}
+  virtual void DidClearWindowObject() {}
+  virtual void DidChangeName(const base::string16& name) {}
+
+  // Called when we receive a console message from Blink for which we requested
+  // extra details (like the stack trace). |message| is the error message,
+  // |source| is the Blink-reported source of the error (either external or
+  // internal), and |stack_trace| is the stack trace of the error in a
+  // human-readable format (each frame is formatted as
+  // "\n    at function_name (source:line_number:column_number)").
+  virtual void DetailedConsoleMessageAdded(const base::string16& message,
+                                           const base::string16& source,
+                                           const base::string16& stack_trace,
+                                           int32 line_number,
+                                           int32 severity_level) {}
+
+  // Called when a compositor frame has committed.
+  virtual void DidCommitCompositorFrame() {}
+
   // IPC::Listener implementation.
   virtual bool OnMessageReceived(const IPC::Message& message) OVERRIDE;
 
diff --git a/chromium/content/public/renderer/render_process_observer.h b/chromium/content/public/renderer/render_process_observer.h
index 1067567dc34..de23dae1468 100644
--- a/chromium/content/public/renderer/render_process_observer.h
+++ b/chromium/content/public/renderer/render_process_observer.h
@@ -35,6 +35,9 @@ class CONTENT_EXPORT RenderProcessObserver {
 
   virtual void IdleNotification() {}
 
+  // Called when the network state changes.
+  virtual void NetworkStateChanged(bool online) {}
+
  private:
   DISALLOW_COPY_AND_ASSIGN(RenderProcessObserver);
 };
diff --git a/chromium/content/public/renderer/render_thread.h b/chromium/content/public/renderer/render_thread.h
index 4693da3aa72..a545150f9bb 100644
--- a/chromium/content/public/renderer/render_thread.h
+++ b/chromium/content/public/renderer/render_thread.h
@@ -8,8 +8,8 @@
 #include "base/basictypes.h"
 #include "base/callback.h"
 #include "base/memory/shared_memory.h"
+#include "base/metrics/user_metrics_action.h"
 #include "content/common/content_export.h"
-#include "content/public/common/user_metrics_action.h"
 #include "ipc/ipc_channel_proxy.h"
 #include "ipc/ipc_sender.h"
 
@@ -22,9 +22,11 @@ class GURL;
 namespace base {
 class MessageLoop;
 class MessageLoopProxy;
+class WaitableEvent;
 }
 
 namespace IPC {
+class MessageFilter;
 class SyncChannel;
 class SyncMessageFilter;
 }
@@ -60,8 +62,8 @@ class CONTENT_EXPORT RenderThread : public IPC::Sender {
   virtual int GenerateRoutingID() = 0;
 
   // These map to IPC::ChannelProxy methods.
-  virtual void AddFilter(IPC::ChannelProxy::MessageFilter* filter) = 0;
-  virtual void RemoveFilter(IPC::ChannelProxy::MessageFilter* filter) = 0;
+  virtual void AddFilter(IPC::MessageFilter* filter) = 0;
+  virtual void RemoveFilter(IPC::MessageFilter* filter) = 0;
 
   // Add/remove observers for the process.
   virtual void AddObserver(RenderProcessObserver* observer) = 0;
@@ -71,25 +73,23 @@ class CONTENT_EXPORT RenderThread : public IPC::Sender {
   virtual void SetResourceDispatcherDelegate(
       ResourceDispatcherDelegate* delegate) = 0;
 
-  // Called by a RenderWidget when it is hidden or restored.
-  virtual void WidgetHidden() = 0;
-  virtual void WidgetRestored() = 0;
-
   // We initialize WebKit as late as possible. Call this to force
   // initialization.
   virtual void EnsureWebKitInitialized() = 0;
 
-  // Sends over a UserMetricsAction to be recorded by user metrics as an action.
-  // Once a new user metric is added, run
-  //   tools/metrics/actions/extract_actions.py --hash
-  // to generate a new mapping of [action hashes -> metric names] and send it
-  // out for review to be updated.
-  // WARNING: When using UserMetricsAction, UserMetricsAction and a string
-  // literal parameter must be on the same line, e.g.
+  // Sends over a base::UserMetricsAction to be recorded by user metrics as
+  // an action. Once a new user metric is added, run
+  //   tools/metrics/actions/extract_actions.py
+  // to add the metric to actions.xml, then update the <owner>s and
+  // <description> sections. Make sure to include the actions.xml file when you
+  // upload your code for review!
+  //
+  // WARNING: When using base::UserMetricsAction, base::UserMetricsAction
+  // and a string literal parameter must be on the same line, e.g.
   //   RenderThread::Get()->RecordAction(
-  //       UserMetricsAction("my extremely long action name"));
+  //       base::UserMetricsAction("my extremely long action name"));
   // because otherwise our processing scripts won't pick up on new actions.
-  virtual void RecordAction(const UserMetricsAction& action) = 0;
+  virtual void RecordAction(const base::UserMetricsAction& action) = 0;
 
   // Sends over a string to be recorded by user metrics as a computed action.
   // When you use this you need to also update the rules for extracting known
@@ -115,9 +115,6 @@ class CONTENT_EXPORT RenderThread : public IPC::Sender {
   virtual void SetIdleNotificationDelayInMs(
       int64 idle_notification_delay_in_ms) = 0;
 
-  // Suspend/resume the webkit timer for this renderer.
-  virtual void ToggleWebKitSharedTimer(bool suspend) = 0;
-
   virtual void UpdateHistograms(int sequence_number) = 0;
 
   // Post task to all worker threads. Returns number of workers.
@@ -128,6 +125,9 @@ class CONTENT_EXPORT RenderThread : public IPC::Sender {
   // proxy servers.
   virtual bool ResolveProxy(const GURL& url, std::string* proxy_list) = 0;
 
+  // Gets the shutdown event for the process.
+  virtual base::WaitableEvent* GetShutdownEvent() = 0;
+
 #if defined(OS_WIN)
   // Request that the given font be loaded by the browser so it's cached by the
   // OS. Please see ChildProcessHost::PreCacheFont for details.
diff --git a/chromium/content/public/renderer/render_view.h b/chromium/content/public/renderer/render_view.h
index c7ab4af9755..c4fce50b7bd 100644
--- a/chromium/content/public/renderer/render_view.h
+++ b/chromium/content/public/renderer/render_view.h
@@ -18,7 +18,9 @@
 struct WebPreferences;
 
 namespace blink {
+class WebElement;
 class WebFrame;
+class WebLocalFrame;
 class WebNode;
 class WebString;
 class WebURLRequest;
@@ -75,22 +77,14 @@ class CONTENT_EXPORT RenderView : public IPC::Sender {
   // Returns the associated WebView. May return NULL when the view is closing.
   virtual blink::WebView* GetWebView() = 0;
 
-  // Gets the focused node. If no such node exists then the node will be isNull.
-  virtual blink::WebNode GetFocusedNode() const = 0;
-
-  // Gets the node that the context menu was pressed over.
-  virtual blink::WebNode GetContextMenuNode() const = 0;
+  // Gets the focused element. If no such element exists then
+  // the element will be Null.
+  virtual blink::WebElement GetFocusedElement() const = 0;
 
   // Returns true if the parameter node is a textfield, text area, a content
   // editable div, or has an ARIA role of textbox.
   virtual bool IsEditableNode(const blink::WebNode& node) const = 0;
 
-  // Evaluates a string of JavaScript in a particular frame.
-  virtual void EvaluateScript(const base::string16& frame_xpath,
-                              const base::string16& jscript,
-                              int id,
-                              bool notify_result) = 0;
-
   // Returns true if we should display scrollbars for the given view size and
   // false if the scrollbars should be hidden.
   virtual bool ShouldDisplayScrollbars(int width, int height) const = 0;
@@ -104,17 +98,9 @@ class CONTENT_EXPORT RenderView : public IPC::Sender {
   // false, but set to true by some tests.
   virtual bool GetContentStateImmediately() const = 0;
 
-  // Filtered time per frame based on UpdateRect messages.
-  virtual float GetFilteredTimePerFrame() const = 0;
-
   // Returns the current visibility of the WebView.
   virtual blink::WebPageVisibilityState GetVisibilityState() const = 0;
 
-  // Displays a modal alert dialog containing the given message.  Returns
-  // once the user dismisses the dialog.
-  virtual void RunModalAlertDialog(blink::WebFrame* frame,
-                                   const blink::WebString& message) = 0;
-
   // Used by plugins that load data in this RenderView to update the loading
   // notifications.
   virtual void DidStartLoading() = 0;
diff --git a/chromium/content/public/renderer/render_view_observer.cc b/chromium/content/public/renderer/render_view_observer.cc
index dd439cf1b2f..8289da949e1 100644
--- a/chromium/content/public/renderer/render_view_observer.cc
+++ b/chromium/content/public/renderer/render_view_observer.cc
@@ -13,10 +13,11 @@ namespace content {
 RenderViewObserver::RenderViewObserver(RenderView* render_view)
     : render_view_(render_view),
       routing_id_(MSG_ROUTING_NONE) {
-  // |render_view| can be NULL on unit testing.
+  // |render_view| can be NULL on unit testing or if Observe() is used.
   if (render_view) {
     RenderViewImpl* impl = static_cast<RenderViewImpl*>(render_view);
     routing_id_ = impl->routing_id();
+    // TODO(jam): bring this back DCHECK_NE(routing_id_, MSG_ROUTING_NONE);
     impl->AddObserver(this);
   }
 }
@@ -52,4 +53,19 @@ void RenderViewObserver::RenderViewGone() {
   render_view_ = NULL;
 }
 
+void RenderViewObserver::Observe(RenderView* render_view) {
+  RenderViewImpl* impl = static_cast<RenderViewImpl*>(render_view_);
+  if (impl) {
+    impl->RemoveObserver(this);
+    routing_id_ = 0;
+  }
+
+  render_view_ = render_view;
+  impl = static_cast<RenderViewImpl*>(render_view_);
+  if (impl) {
+    routing_id_ = impl->routing_id();
+    impl->AddObserver(this);
+  }
+}
+
 }  // namespace content
diff --git a/chromium/content/public/renderer/render_view_observer.h b/chromium/content/public/renderer/render_view_observer.h
index 9578867cbff..2849bdd45d6 100644
--- a/chromium/content/public/renderer/render_view_observer.h
+++ b/chromium/content/public/renderer/render_view_observer.h
@@ -11,7 +11,6 @@
 #include "ipc/ipc_listener.h"
 #include "ipc/ipc_sender.h"
 #include "third_party/WebKit/public/platform/WebVector.h"
-#include "third_party/WebKit/public/web/WebIconURL.h"
 
 class GURL;
 
@@ -26,12 +25,12 @@ class WebDataSource;
 class WebFrame;
 class WebFormElement;
 class WebGestureEvent;
-class WebMediaPlayerClient;
+class WebLocalFrame;
 class WebMouseEvent;
 class WebNode;
+class WebString;
 class WebTouchEvent;
 class WebURL;
-struct WebContextMenuData;
 struct WebURLError;
 }
 
@@ -53,41 +52,36 @@ class CONTENT_EXPORT RenderViewObserver : public IPC::Listener,
   // These match the WebKit API notifications
   virtual void DidStartLoading() {}
   virtual void DidStopLoading() {}
-  virtual void DidFinishDocumentLoad(blink::WebFrame* frame) {}
-  virtual void DidFailLoad(blink::WebFrame* frame,
+  virtual void DidFinishDocumentLoad(blink::WebLocalFrame* frame) {}
+  virtual void DidFailLoad(blink::WebLocalFrame* frame,
                            const blink::WebURLError& error) {}
-  virtual void DidFinishLoad(blink::WebFrame* frame) {}
-  virtual void DidStartProvisionalLoad(blink::WebFrame* frame) {}
-  virtual void DidFailProvisionalLoad(blink::WebFrame* frame,
+  virtual void DidFinishLoad(blink::WebLocalFrame* frame) {}
+  virtual void DidStartProvisionalLoad(blink::WebLocalFrame* frame) {}
+  virtual void DidFailProvisionalLoad(blink::WebLocalFrame* frame,
                                       const blink::WebURLError& error) {}
-  virtual void DidCommitProvisionalLoad(blink::WebFrame* frame,
+  virtual void DidCommitProvisionalLoad(blink::WebLocalFrame* frame,
                                         bool is_new_navigation) {}
-  virtual void DidClearWindowObject(blink::WebFrame* frame) {}
-  virtual void DidCreateDocumentElement(blink::WebFrame* frame) {}
-  virtual void FrameCreated(blink::WebFrame* parent,
+  virtual void DidClearWindowObject(blink::WebLocalFrame* frame) {}
+  virtual void DidCreateDocumentElement(blink::WebLocalFrame* frame) {}
+  virtual void FrameCreated(blink::WebLocalFrame* parent,
                             blink::WebFrame* frame) {}
   virtual void FrameDetached(blink::WebFrame* frame) {}
   virtual void FrameWillClose(blink::WebFrame* frame) {}
   virtual void DidMatchCSS(
-      blink::WebFrame* frame,
+      blink::WebLocalFrame* frame,
       const blink::WebVector<blink::WebString>& newly_matching_selectors,
       const blink::WebVector<blink::WebString>& stopped_matching_selectors) {}
-  virtual void WillSendSubmitEvent(blink::WebFrame* frame,
+  virtual void WillSendSubmitEvent(blink::WebLocalFrame* frame,
                                    const blink::WebFormElement& form) {}
-  virtual void WillSubmitForm(blink::WebFrame* frame,
+  virtual void WillSubmitForm(blink::WebLocalFrame* frame,
                               const blink::WebFormElement& form) {}
-  virtual void DidCreateDataSource(blink::WebFrame* frame,
+  virtual void DidCreateDataSource(blink::WebLocalFrame* frame,
                                    blink::WebDataSource* ds) {}
-  virtual void PrintPage(blink::WebFrame* frame, bool user_initiated) {}
+  virtual void PrintPage(blink::WebLocalFrame* frame, bool user_initiated) {}
   virtual void FocusedNodeChanged(const blink::WebNode& node) {}
-  virtual void WillCreateMediaPlayer(blink::WebFrame* frame,
-                                     blink::WebMediaPlayerClient* client) {}
   virtual void ZoomLevelChanged() {};
-  virtual void DidChangeScrollOffset(blink::WebFrame* frame) {}
+  virtual void DidChangeScrollOffset(blink::WebLocalFrame* frame) {}
   virtual void DraggableRegionsChanged(blink::WebFrame* frame) {}
-  virtual void DidRequestShowContextMenu(
-      blink::WebFrame* frame,
-      const blink::WebContextMenuData& data) {}
   virtual void DidCommitCompositorFrame() {}
   virtual void DidUpdateLayout() {}
 
@@ -95,22 +89,12 @@ class CONTENT_EXPORT RenderViewObserver : public IPC::Listener,
   virtual void DidHandleMouseEvent(const blink::WebMouseEvent& event) {}
   virtual void DidHandleTouchEvent(const blink::WebTouchEvent& event) {}
 
-  // Called when we receive a console message from WebKit for which we requested
-  // extra details (like the stack trace). |message| is the error message,
-  // |source| is the WebKit-reported source of the error (either external or
-  // internal), and |stack_trace| is the stack trace of the error in a
-  // human-readable format (each frame is formatted as
-  // "\n    at function_name (source:line_number:column_number)").
-  virtual void DetailedConsoleMessageAdded(const base::string16& message,
-                                           const base::string16& source,
-                                           const base::string16& stack_trace,
-                                           int32 line_number,
-                                           int32 severity_level) {}
-
   // These match incoming IPCs.
   virtual void Navigate(const GURL& url) {}
   virtual void ClosePage() {}
-  virtual void OrientationChangeEvent(int orientation) {}
+  virtual void OrientationChangeEvent() {}
+
+  virtual void OnStop() {}
 
   // IPC::Listener implementation.
   virtual bool OnMessageReceived(const IPC::Message& message) OVERRIDE;
@@ -125,6 +109,12 @@ class CONTENT_EXPORT RenderViewObserver : public IPC::Listener,
   explicit RenderViewObserver(RenderView* render_view);
   virtual ~RenderViewObserver();
 
+  // Sets |render_view_| to track.
+  // Removes itself of previous (if any) |render_view_| observer list and adds
+  // to the new |render_view|. Since it assumes that observer outlives
+  // render_view, OnDestruct should be overridden.
+  void Observe(RenderView* render_view);
+
  private:
   friend class RenderViewImpl;
 
diff --git a/chromium/content/public/renderer/renderer_gamepad_provider.h b/chromium/content/public/renderer/renderer_gamepad_provider.h
new file mode 100644
index 00000000000..ba6ec9fae98
--- /dev/null
+++ b/chromium/content/public/renderer/renderer_gamepad_provider.h
@@ -0,0 +1,30 @@
+// Copyright 2014 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_GAMEPAD_RENDERER_PROVIDER_H_
+#define CONTENT_GAMEPAD_RENDERER_PROVIDER_H_
+
+namespace blink {
+class WebGamepadListener;
+class WebGamepads;
+}
+
+namespace content {
+
+// Provides gamepad data and events for blink.
+class RendererGamepadProvider {
+ public:
+  // Provides latest snapshot of gamepads.
+  virtual void SampleGamepads(blink::WebGamepads& gamepads) = 0;
+
+  // Registers listener for be notified of events.
+  virtual void SetGamepadListener(blink::WebGamepadListener* listener) = 0;
+
+ protected:
+  virtual ~RendererGamepadProvider() {}
+};
+
+} // namespace content
+
+#endif
diff --git a/chromium/content/public/renderer/renderer_ppapi_host.h b/chromium/content/public/renderer/renderer_ppapi_host.h
index 4e253e2e2cf..6c843dc30f9 100644
--- a/chromium/content/public/renderer/renderer_ppapi_host.h
+++ b/chromium/content/public/renderer/renderer_ppapi_host.h
@@ -123,6 +123,23 @@ class RendererPpapiHost {
   // Returns true if the plugin is running in process.
   virtual bool IsRunningInProcess() const = 0;
 
+  virtual std::string GetPluginName() const = 0;
+
+  // Used by the embedder to inform this RendererPpapiHost that the associated
+  // plugin module is a host for "external plugins."
+  //
+  // An embedder may, at the time a plugin module is created, configure it to
+  // be a host for external plugins. Instances of such plugins go through two
+  // two stages of initialization; the first stage initializes a host plugin
+  // instance, which then loads and initializes a child plugin which takes
+  // over control. These are treated as one Pepper Instance, because despite the
+  // two-stage initialization process, the host and child appear to blink as
+  // one plugin instance.
+  //
+  // The host plugin appears as an in-process plugin, while we interact with the
+  // child plugin via the Pepper proxy.
+  virtual void SetToExternalPluginHost() = 0;
+
   // There are times when the renderer needs to create a ResourceHost in the
   // browser. This function does so asynchronously. |nested_msgs| is a list of
   // resource host creation messages and |instance| is the PP_Instance which
diff --git a/chromium/content/public/renderer/resource_fetcher.h b/chromium/content/public/renderer/resource_fetcher.h
index 5f57cb6b09a..05967f189cc 100644
--- a/chromium/content/public/renderer/resource_fetcher.h
+++ b/chromium/content/public/renderer/resource_fetcher.h
@@ -36,17 +36,26 @@ class CONTENT_EXPORT ResourceFetcher {
   typedef base::Callback<void(const blink::WebURLResponse& response,
                               const std::string& data)> Callback;
 
-  // Creates a ResourceFetcher and starts fetching the specified resource.
-  // Caller takes ownership of the returned object.  Deleting the
-  // ResourceFetcher will cancel the request, and the callback will never be
-  // run.
-  static ResourceFetcher* Create(const GURL& url,
-                                 blink::WebFrame* frame,
-                                 blink::WebURLRequest::TargetType target_type,
-                                 const Callback& callback);
+  // Creates a ResourceFetcher for the specified resource.  Caller takes
+  // ownership of the returned object.  Deleting the ResourceFetcher will cancel
+  // the request, and the callback will never be run.
+  static ResourceFetcher* Create(const GURL& url);
+
+  // Set the corresponding parameters of the request.  Must be called before
+  // Start.  By default, requests are GETs with no body.
+  virtual void SetMethod(const std::string& method) = 0;
+  virtual void SetBody(const std::string& body) = 0;
+  virtual void SetHeader(const std::string& header,
+                         const std::string& value) = 0;
+
+  // Starts the request using the specified frame.  Calls |callback| when
+  // done.
+  virtual void Start(blink::WebFrame* frame,
+                     blink::WebURLRequest::TargetType target_type,
+                     const Callback& callback) = 0;
 
   // Sets how long to wait for the server to reply.  By default, there is no
-  // timeout.
+  // timeout.  Must be called after a request is started.
   virtual void SetTimeout(const base::TimeDelta& timeout) = 0;
 };
 
diff --git a/chromium/content/public/renderer/v8_value_converter.h b/chromium/content/public/renderer/v8_value_converter.h
index 2b1011310a1..f3fd126931a 100644
--- a/chromium/content/public/renderer/v8_value_converter.h
+++ b/chromium/content/public/renderer/v8_value_converter.h
@@ -5,6 +5,7 @@
 #ifndef CONTENT_PUBLIC_RENDERER_V8_VALUE_CONVERTER_H_
 #define CONTENT_PUBLIC_RENDERER_V8_VALUE_CONVERTER_H_
 
+#include "base/callback.h"
 #include "content/common/content_export.h"
 #include "v8/include/v8.h"
 
@@ -27,17 +28,45 @@ class CONTENT_EXPORT V8ValueConverter {
   // Extends the default behaviour of V8ValueConverter.
   class CONTENT_EXPORT Strategy {
    public:
+    typedef base::Callback<base::Value*(
+        v8::Handle<v8::Value>, v8::Isolate* isolate)> FromV8ValueCallback;
+
     virtual ~Strategy() {}
+
     // If false is returned, V8ValueConverter proceeds with the default
     // behavior.
+    // Use |callback| to convert any child values, as this will retain
+    // the ValueConverter's internal checks for depth and cycles.
     virtual bool FromV8Object(v8::Handle<v8::Object> value,
                               base::Value** out,
-                              v8::Isolate* isolate) const = 0;
+                              v8::Isolate* isolate,
+                              const FromV8ValueCallback& callback) const;
+
     // If false is returned, V8ValueConverter proceeds with the default
     // behavior.
+    // Use |callback| to convert any child values, as this will retain
+    // the ValueConverter's internal checks for depth and cycles.
     virtual bool FromV8Array(v8::Handle<v8::Array> value,
                              base::Value** out,
-                             v8::Isolate* isolate) const = 0;
+                             v8::Isolate* isolate,
+                             const FromV8ValueCallback& callback) const;
+
+    // If false is returned, V8ValueConverter proceeds with the default
+    // behavior. v8::Object is passed as ArrayBuffer and ArrayBufferView
+    // classes are siblings.
+    virtual bool FromV8ArrayBuffer(v8::Handle<v8::Object> value,
+                                   base::Value** out,
+                                   v8::Isolate* isolate) const;
+
+    // If false is returned, V8ValueConverter proceeds with the default
+    // behavior. This allows to intercept "non-finite" values and do something
+    // with them.
+    virtual bool FromV8Number(v8::Handle<v8::Number> value,
+                              base::Value** out) const;
+
+    // If false is returned, V8ValueConverter proceeds with the default
+    // behavior.
+    virtual bool FromV8Undefined(base::Value** out) const;
   };
 
   static V8ValueConverter* create();
diff --git a/chromium/content/public/renderer/video_encode_accelerator.cc b/chromium/content/public/renderer/video_encode_accelerator.cc
new file mode 100644
index 00000000000..f256f48b522
--- /dev/null
+++ b/chromium/content/public/renderer/video_encode_accelerator.cc
@@ -0,0 +1,41 @@
+// Copyright 2014 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "content/public/renderer/video_encode_accelerator.h"
+
+#include "base/task_runner_util.h"
+#include "content/common/gpu/client/gpu_video_encode_accelerator_host.h"
+#include "content/renderer/render_thread_impl.h"
+#include "media/filters/gpu_video_accelerator_factories.h"
+
+namespace content {
+
+void CreateVideoEncodeAccelerator(
+    const OnCreateVideoEncodeAcceleratorCallback& callback) {
+  DCHECK(!callback.is_null());
+
+  scoped_refptr<media::GpuVideoAcceleratorFactories> gpu_factories =
+        RenderThreadImpl::current()->GetGpuFactories();
+  if (!gpu_factories.get()) {
+    callback.Run(NULL, scoped_ptr<media::VideoEncodeAccelerator>());
+    return;
+  }
+
+  scoped_refptr<base::SingleThreadTaskRunner> encode_task_runner =
+      gpu_factories->GetTaskRunner();
+  base::PostTaskAndReplyWithResult(
+      encode_task_runner,
+      FROM_HERE,
+      base::Bind(
+          &media::GpuVideoAcceleratorFactories::CreateVideoEncodeAccelerator,
+          gpu_factories),
+      base::Bind(callback, encode_task_runner));
+}
+
+std::vector<media::VideoEncodeAccelerator::SupportedProfile>
+GetSupportedVideoEncodeAcceleratorProfiles() {
+  return GpuVideoEncodeAcceleratorHost::GetSupportedProfiles();
+}
+
+}  // namespace content
diff --git a/chromium/content/public/renderer/video_encode_accelerator.h b/chromium/content/public/renderer/video_encode_accelerator.h
new file mode 100644
index 00000000000..426b05279d0
--- /dev/null
+++ b/chromium/content/public/renderer/video_encode_accelerator.h
@@ -0,0 +1,35 @@
+// Copyright 2014 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_PUBLIC_RENDERER_VIDEO_ENCODE_ACCELERATOR_H_
+#define CONTENT_PUBLIC_RENDERER_VIDEO_ENCODE_ACCELERATOR_H_
+
+#include "base/callback.h"
+#include "base/memory/scoped_ptr.h"
+#include "base/single_thread_task_runner.h"
+#include "content/common/content_export.h"
+#include "media/video/video_encode_accelerator.h"
+
+namespace content {
+
+// Called when CreateVideoEncodeAccelerator request is complete.
+// The |vea| object must be accessed on the thread associated with the
+// |encode_task_runner|.
+typedef base::Callback<
+    void (scoped_refptr<base::SingleThreadTaskRunner> encoder_task_runner,
+          scoped_ptr<media::VideoEncodeAccelerator> vea)>
+    OnCreateVideoEncodeAcceleratorCallback;
+
+// Generates an instance of media::VideoEncodeAccelerator.
+CONTENT_EXPORT void
+CreateVideoEncodeAccelerator(
+    const OnCreateVideoEncodeAcceleratorCallback& callback);
+
+// Returns list of encoding profiles supported by VideoEncodeAccelerator.
+CONTENT_EXPORT std::vector<media::VideoEncodeAccelerator::SupportedProfile>
+GetSupportedVideoEncodeAcceleratorProfiles();
+
+}  // namespace content
+
+#endif  // CONTENT_PUBLIC_RENDERER_VIDEO_ENCODE_ACCELERATOR_H_
diff --git a/chromium/content/public/utility/BUILD.gn b/chromium/content/public/utility/BUILD.gn
new file mode 100644
index 00000000000..f61994b2624
--- /dev/null
+++ b/chromium/content/public/utility/BUILD.gn
@@ -0,0 +1,21 @@
+# Copyright 2014 The Chromium Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+source_set("utility") {
+  sources = [
+    "content_utility_client.cc",
+    "content_utility_client.h",
+    "utility_thread.cc",
+    "utility_thread.h",
+  ]
+
+  configs += [ "//content:content_implementation" ]
+
+  deps = [
+    "//base",
+    "//content:export",
+    "//ipc",
+  ]
+}
+