Merge remote-tracking branch 'origin/5.10' into dev

Change-Id: Ibc1c881a67bf088ba6fb044e2553c74c7e9e24ca

30 files changed, 364 insertions, 192 deletions

diff --git a/src/core/browser_accessibility_qt.cpp b/src/core/browser_accessibility_qt.cpp
index cafc4f5ad..e31951307 100644
--- a/src/core/browser_accessibility_qt.cpp
+++ b/src/core/browser_accessibility_qt.cpp
@@ -160,7 +160,7 @@ QString BrowserAccessibilityQt::text(QAccessible::Text t) const
     case QAccessible::Value:
         return toQt(GetStringAttribute(ui::AX_ATTR_VALUE));
     case QAccessible::Accelerator:
-        return toQt(GetStringAttribute(ui::AX_ATTR_SHORTCUT));
+        return toQt(GetStringAttribute(ui::AX_ATTR_KEY_SHORTCUTS));
     default:
         break;
     }
@@ -458,18 +458,16 @@ QAccessible::State BrowserAccessibilityQt::state() const
     int32_t s = GetState();
     if (s & (1 << ui::AX_STATE_BUSY))
         state.busy = true;
-    if (s & (1 << ui::AX_CHECKED_STATE_TRUE))
-        state.checked = true;
     if (s & (1 << ui::AX_STATE_COLLAPSED))
         state.collapsed = true;
-    if (s & (1 << ui::AX_STATE_DISABLED))
-        state.disabled = true;
+    if (s & (1 << ui::AX_STATE_DEFAULT))
+        state.defaultButton = true;
+    if (s & (1 << ui::AX_STATE_EDITABLE))
+        state.editable = true;
     if (s & (1 << ui::AX_STATE_EXPANDED))
         state.expanded = true;
     if (s & (1 << ui::AX_STATE_FOCUSABLE))
         state.focusable = true;
-    if (manager()->GetFocus() == this)
-        state.focused = true;
     if (s & (1 << ui::AX_STATE_HASPOPUP))
         state.hasPopup = true;
     if (s & (1 << ui::AX_STATE_HOVERED))
@@ -482,14 +480,12 @@ QAccessible::State BrowserAccessibilityQt::state() const
         state.multiSelectable = true;
     if (s & (1 << ui::AX_STATE_OFFSCREEN))
         state.offscreen = true;
-    if (s & (1 << ui::AX_STATE_PRESSED))
-        state.pressed = true;
     if (s & (1 << ui::AX_STATE_PROTECTED))
     {} // FIXME
-    if (s & (1 << ui::AX_STATE_READ_ONLY))
-        state.readOnly = true;
     if (s & (1 << ui::AX_STATE_REQUIRED))
     {} // FIXME
+    if (s & (1 << ui::AX_STATE_RICHLY_EDITABLE))
+    {} // FIXME
     if (s & (1 << ui::AX_STATE_SELECTABLE))
         state.selectable = true;
     if (s & (1 << ui::AX_STATE_SELECTED))
@@ -498,8 +494,40 @@ QAccessible::State BrowserAccessibilityQt::state() const
     {} // FIXME
     if (s & (1 << ui::AX_STATE_VISITED))
     {} // FIXME
-    if (HasState(ui::AX_STATE_EDITABLE))
-        state.editable = true;
+
+    if (manager()->GetFocus() == this)
+        state.focused = true;
+    if (HasIntAttribute(ui::AX_ATTR_CHECKED_STATE)) {
+        ui::AXCheckedState checkedState = (ui::AXCheckedState)GetIntAttribute(ui::AX_ATTR_CHECKED_STATE);
+        switch (checkedState) {
+        case ui::AX_CHECKED_STATE_TRUE:
+            if (GetRole() == ui::AX_ROLE_TOGGLE_BUTTON)
+                state.pressed = true;
+            else
+                state.checked = true;
+            break;
+        case ui::AX_CHECKED_STATE_MIXED:
+            state.checkStateMixed = true;
+            break;
+        case ui::AX_CHECKED_STATE_FALSE:
+        case ui::AX_CHECKED_STATE_NONE:
+            break;
+        }
+    }
+    if (HasIntAttribute(ui::AX_ATTR_RESTRICTION)) {
+        ui::AXRestriction restriction = (ui::AXRestriction)GetIntAttribute(ui::AX_ATTR_RESTRICTION);
+        switch (restriction) {
+        case ui::AX_RESTRICTION_READ_ONLY:
+            state.readOnly = true;
+            break;
+        case ui::AX_RESTRICTION_DISABLED:
+            state.disabled = true;
+            break;
+        case ui::AX_RESTRICTION_NONE:
+            break;
+        }
+    }
+
     return state;
 }
 
diff --git a/src/core/browser_context_qt.cpp b/src/core/browser_context_qt.cpp
index 16b7e5514..415318fe8 100644
--- a/src/core/browser_context_qt.cpp
+++ b/src/core/browser_context_qt.cpp
@@ -182,6 +182,11 @@ content::BackgroundSyncController* BrowserContextQt::GetBackgroundSyncController
     return nullptr;
 }
 
+content::BrowsingDataRemoverDelegate *BrowserContextQt::GetBrowsingDataRemoverDelegate()
+{
+    return nullptr;
+}
+
 content::PermissionManager *BrowserContextQt::GetPermissionManager()
 {
     if (!permissionManager)
diff --git a/src/core/browser_context_qt.h b/src/core/browser_context_qt.h
index 681657d96..ceb4838e3 100644
--- a/src/core/browser_context_qt.h
+++ b/src/core/browser_context_qt.h
@@ -91,6 +91,7 @@ public:
     std::unique_ptr<content::ZoomLevelDelegate> CreateZoomLevelDelegate(const base::FilePath& partition_path) override;
     content::PermissionManager *GetPermissionManager() override;
     content::BackgroundSyncController* GetBackgroundSyncController() override;
+    content::BrowsingDataRemoverDelegate *GetBrowsingDataRemoverDelegate() override;
 
     // Profile implementation:
     PrefService* GetPrefs() override;
diff --git a/src/core/chromium_overrides.cpp b/src/core/chromium_overrides.cpp
index 9aeeb1327..d1cc951d2 100644
--- a/src/core/chromium_overrides.cpp
+++ b/src/core/chromium_overrides.cpp
@@ -49,6 +49,8 @@
 #include "content/common/font_list.h"
 #include "ui/base/dragdrop/os_exchange_data.h"
 #include "ui/base/dragdrop/os_exchange_data_provider_factory.h"
+#include "ui/events/devices/device_data_manager.h"
+#include "ui/events/platform/platform_event_source.h"
 #include "ppapi/features/features.h"
 
 #include <QGuiApplication>
@@ -97,7 +99,21 @@ XDisplay* GetQtXDisplay()
 {
     return static_cast<XDisplay*>(GLContextHelper::getXDisplay());
 }
-#endif
+
+namespace ui {
+class DummyPlatformEventSource : public PlatformEventSource
+{
+public:
+    DummyPlatformEventSource() {
+        DeviceDataManager::CreateInstance();
+    }
+};
+
+std::unique_ptr<PlatformEventSource> PlatformEventSource::CreateDefault() {
+  return base::MakeUnique<DummyPlatformEventSource>();
+}
+} // namespace ui
+#endif // defined(USE_X11)
 
 namespace content {
 class WebContentsImpl;
@@ -160,6 +176,19 @@ void GetFontsInFamily_SlowBlocking(const std::string &, std::vector<ppapi::proxy
 
 } // namespace content
 
+namespace aura {
+class Window;
+}
+
+namespace wm {
+class ActivationClient;
+
+ActivationClient *GetActivationClient(aura::Window *)
+{
+    return nullptr;
+}
+
+} // namespace wm
 #endif // defined(USE_AURA) || defined(USE_OZONE)
 
 std::unique_ptr<ui::OSExchangeData::Provider>
diff --git a/src/core/config/common.pri b/src/core/config/common.pri
index 2aa3c614d..e7010a13a 100644
--- a/src/core/config/common.pri
+++ b/src/core/config/common.pri
@@ -11,7 +11,8 @@ gn_args += \
     use_allocator=\"none\" \
     v8_use_external_startup_data=false \
     treat_warnings_as_errors=false \
-    enable_swiftshader=false
+    enable_swiftshader=false \
+    use_custom_libcxx=false
 
 qtConfig(printing-and-pdf) {
     gn_args += enable_basic_printing=true enable_print_preview=true
diff --git a/src/core/content_browser_client_qt.cpp b/src/core/content_browser_client_qt.cpp
index 1b2f155c9..328dcd38d 100644
--- a/src/core/content_browser_client_qt.cpp
+++ b/src/core/content_browser_client_qt.cpp
@@ -44,7 +44,7 @@
 #include "base/threading/thread_restrictions.h"
 #include "components/spellcheck/spellcheck_build_features.h"
 #if BUILDFLAG(ENABLE_SPELLCHECK)
-#include "chrome/browser/spellchecker/spellcheck_message_filter.h"
+#include "chrome/browser/spellchecker/spell_check_host_impl.h"
 #if BUILDFLAG(USE_BROWSER_SPELLCHECKER)
 #include "components/spellcheck/browser/spellcheck_message_filter_platform.h"
 #endif
@@ -68,6 +68,7 @@
 #include "device/geolocation/geolocation_provider.h"
 #include "mojo/public/cpp/bindings/binding.h"
 #include "mojo/public/cpp/bindings/binding_set.h"
+#include "net/ssl/client_cert_identity.h"
 #include "services/service_manager/public/cpp/bind_source_info.h"
 #include "services/service_manager/public/cpp/binder_registry.h"
 #include "third_party/WebKit/public/platform/modules/sensitive_input_visibility/sensitive_input_visibility_service.mojom.h"
@@ -407,10 +408,6 @@ void ContentBrowserClientQt::RenderProcessWillLaunch(content::RenderProcessHost*
 #if BUILDFLAG(ENABLE_PEPPER_CDMS)
     host->AddFilter(new BrowserMessageFilterQt(id));
 #endif
-#if BUILDFLAG(ENABLE_SPELLCHECK)
-    // SpellCheckMessageFilter is required for both Hunspell and Native configurations.
-    host->AddFilter(new SpellCheckMessageFilter(id));
-#endif
 #if defined(Q_OS_MACOS) && BUILDFLAG(ENABLE_SPELLCHECK) && BUILDFLAG(USE_BROWSER_SPELLCHECKER)
   host->AddFilter(new SpellCheckMessageFilterPlatform(id));
 #endif
@@ -451,15 +448,11 @@ content::QuotaPermissionContext *ContentBrowserClientQt::CreateQuotaPermissionCo
     return new QuotaPermissionContextQt;
 }
 
-void ContentBrowserClientQt::GetQuotaSettings(content::BrowserContext *context,
-                    content::StoragePartition *partition,
-                    const storage::OptionalQuotaSettingsCallback &callback)
+void ContentBrowserClientQt::GetQuotaSettings(content::BrowserContext* context,
+                                              content::StoragePartition* partition,
+                                              storage::OptionalQuotaSettingsCallback callback)
 {
-    content::BrowserThread::PostTaskAndReplyWithResult(
-        content::BrowserThread::FILE, FROM_HERE,
-        base::Bind(&storage::CalculateNominalDynamicSettings,
-                    partition->GetPath(), context->IsOffTheRecord()),
-        callback);
+    storage::GetNominalDynamicSettings(partition->GetPath(), context->IsOffTheRecord(), std::move(callback));
 }
 
 void ContentBrowserClientQt::AllowCertificateError(content::WebContents *webContents,
@@ -480,10 +473,10 @@ void ContentBrowserClientQt::AllowCertificateError(content::WebContents *webCont
 
 void ContentBrowserClientQt::SelectClientCertificate(content::WebContents * /*webContents*/,
                                                      net::SSLCertRequestInfo * /*certRequestInfo*/,
-                                                     net::CertificateList /*client_certs*/,
+                                                     net::ClientCertIdentityList /*client_certs*/,
                                                      std::unique_ptr<content::ClientCertificateDelegate> delegate)
 {
-    delegate->ContinueWithCertificate(nullptr);
+    delegate->ContinueWithCertificate(nullptr, nullptr);
 }
 
 std::string ContentBrowserClientQt::GetApplicationLocale()
@@ -560,17 +553,16 @@ public:
             return nullptr;
         return FromWebContents(web_contents);
     }
-    static void BindSensitiveInputVisibilityService(content::RenderFrameHost* render_frame_host,
-                                                    const service_manager::BindSourceInfo& source_info,
-                                                    blink::mojom::SensitiveInputVisibilityServiceRequest request)
+    static void BindSensitiveInputVisibilityService(blink::mojom::SensitiveInputVisibilityServiceRequest request,
+                                                    content::RenderFrameHost* render_frame_host)
     {
         CreateForRenderFrameHost(render_frame_host);
         ServiceDriver *driver = FromRenderFrameHost(render_frame_host);
 
         if (driver)
-            driver->BindSensitiveInputVisibilityServiceInternal(std::move(request));
+            driver->BindSensitiveInputVisibilityServiceRequest(std::move(request));
     }
-    void BindSensitiveInputVisibilityServiceInternal(blink::mojom::SensitiveInputVisibilityServiceRequest request)
+    void BindSensitiveInputVisibilityServiceRequest(blink::mojom::SensitiveInputVisibilityServiceRequest request)
     {
         m_sensitiveInputVisibilityBindings.AddBinding(this, std::move(request));
     }
@@ -588,10 +580,35 @@ private:
 
 };
 
-void ContentBrowserClientQt::ExposeInterfacesToFrame(service_manager::BinderRegistry* registry,
-                                                     content::RenderFrameHost* render_frame_host)
+void ContentBrowserClientQt::InitFrameInterfaces()
+{
+    m_frameInterfaces = base::MakeUnique<service_manager::BinderRegistry>();
+    m_frameInterfacesParameterized = base::MakeUnique<service_manager::BinderRegistryWithArgs<content::RenderFrameHost*>>();
+    m_frameInterfacesParameterized->AddInterface(base::Bind(&ServiceDriver::BindSensitiveInputVisibilityService));
+}
+
+void ContentBrowserClientQt::BindInterfaceRequestFromFrame(content::RenderFrameHost* render_frame_host,
+                                                           const std::string& interface_name,
+                                                           mojo::ScopedMessagePipeHandle interface_pipe)
+{
+    if (!m_frameInterfaces.get() && !m_frameInterfacesParameterized.get())
+        InitFrameInterfaces();
+
+    if (!m_frameInterfacesParameterized->TryBindInterface(interface_name, &interface_pipe, render_frame_host))
+        m_frameInterfaces->TryBindInterface(interface_name, &interface_pipe);
+}
+
+void ContentBrowserClientQt::ExposeInterfacesToRenderer(service_manager::BinderRegistry *registry,
+                                                        content::AssociatedInterfaceRegistry */*associated_registry*/,
+                                                        content::RenderProcessHost *render_process_host)
 {
-    registry->AddInterface(base::Bind(&ServiceDriver::BindSensitiveInputVisibilityService, render_frame_host));
+#if BUILDFLAG(ENABLE_SPELLCHECK)
+    registry->AddInterface(base::Bind(&SpellCheckHostImpl::Create, render_process_host->GetID()),
+                           content::BrowserThread::GetTaskRunnerForThread(content::BrowserThread::UI));
+#else
+    Q_UNUSED(registry);
+    Q_UNUSED(render_process_host);
+#endif
 }
 
 bool ContentBrowserClientQt::CanCreateWindow(
diff --git a/src/core/content_browser_client_qt.h b/src/core/content_browser_client_qt.h
index be7511755..d810fc08a 100644
--- a/src/core/content_browser_client_qt.h
+++ b/src/core/content_browser_client_qt.h
@@ -73,10 +73,6 @@ namespace gl {
 class GLShareGroup;
 }
 
-namespace service_manager {
-class BinderRegistry;
-}
-
 namespace QtWebEngineCore {
 class BrowserContextQt;
 class BrowserMainPartsQt;
@@ -97,7 +93,7 @@ public:
     content::QuotaPermissionContext *CreateQuotaPermissionContext() override;
     void GetQuotaSettings(content::BrowserContext *context,
                         content::StoragePartition *partition,
-                        const storage::OptionalQuotaSettingsCallback &callback) override;
+                        storage::OptionalQuotaSettingsCallback callback) override;
     void OverrideWebkitPrefs(content::RenderViewHost *, content::WebPreferences *) override;
     void AllowCertificateError(content::WebContents* web_contents,
                                        int cert_error,
@@ -110,7 +106,7 @@ public:
                                        const base::Callback<void(content::CertificateRequestResultType)>& callback) override;
     void SelectClientCertificate(content::WebContents* web_contents,
                                          net::SSLCertRequestInfo* cert_request_info,
-                                         net::CertificateList client_certs,
+                                         net::ClientCertIdentityList client_certs,
                                          std::unique_ptr<content::ClientCertificateDelegate> delegate) override;
     content::DevToolsManagerDelegate *GetDevToolsManagerDelegate() override;
 
@@ -119,7 +115,12 @@ public:
     void AppendExtraCommandLineSwitches(base::CommandLine* command_line, int child_process_id) override;
     void GetAdditionalViewSourceSchemes(std::vector<std::string>* additional_schemes) override;
 
-    void ExposeInterfacesToFrame(service_manager::BinderRegistry* registry, content::RenderFrameHost* render_frame_host) override;
+    void BindInterfaceRequestFromFrame(content::RenderFrameHost* render_frame_host,
+                                       const std::string& interface_name,
+                                       mojo::ScopedMessagePipeHandle interface_pipe) override;
+    void ExposeInterfacesToRenderer(service_manager::BinderRegistry *registry,
+                                    content::AssociatedInterfaceRegistry *associated_registry,
+                                    content::RenderProcessHost *render_process_host) override;
 
     bool CanCreateWindow(
         content::RenderFrameHost* opener,
@@ -145,9 +146,12 @@ public:
 #endif
 
 private:
+    void InitFrameInterfaces();
     BrowserMainPartsQt* m_browserMainParts;
     std::unique_ptr<ResourceDispatcherHostDelegateQt> m_resourceDispatcherHostDelegate;
     scoped_refptr<ShareGroupQtQuick> m_shareGroupQtQuick;
+    std::unique_ptr<service_manager::BinderRegistry> m_frameInterfaces;
+    std::unique_ptr<service_manager::BinderRegistryWithArgs<content::RenderFrameHost*>> m_frameInterfacesParameterized;
 };
 
 } // namespace QtWebEngineCore
diff --git a/src/core/cookie_monster_delegate_qt.cpp b/src/core/cookie_monster_delegate_qt.cpp
index d2a3377a4..0fa8dead0 100644
--- a/src/core/cookie_monster_delegate_qt.cpp
+++ b/src/core/cookie_monster_delegate_qt.cpp
@@ -61,7 +61,7 @@ static void onSetCookieCallback(QWebEngineCookieStorePrivate *client, qint64 cal
                                      base::Bind(&QWebEngineCookieStorePrivate::onSetCallbackResult, base::Unretained(client), callbackId, success));
 }
 
-static void onDeleteCookiesCallback(QWebEngineCookieStorePrivate *client, qint64 callbackId, int numCookies) {
+static void onDeleteCookiesCallback(QWebEngineCookieStorePrivate *client, qint64 callbackId, uint numCookies) {
     content::BrowserThread::PostTask(content::BrowserThread::UI, FROM_HERE,
                                      base::Bind(&QWebEngineCookieStorePrivate::onDeleteCallbackResult, base::Unretained(client), callbackId, numCookies));
 }
@@ -96,13 +96,13 @@ void CookieMonsterDelegateQt::getAllCookies(quint64 callbackId)
     net::CookieMonster::GetCookieListCallback callback = base::Bind(&onGetAllCookiesCallback, m_client->d_func(), callbackId);
 
     content::BrowserThread::PostTask(content::BrowserThread::IO, FROM_HERE,
-                                     base::Bind(&CookieMonsterDelegateQt::GetAllCookiesOnIOThread, this, callback));
+                                     base::BindOnce(&CookieMonsterDelegateQt::GetAllCookiesOnIOThread, this, std::move(callback)));
 }
 
-void CookieMonsterDelegateQt::GetAllCookiesOnIOThread(const net::CookieMonster::GetCookieListCallback& callback)
+void CookieMonsterDelegateQt::GetAllCookiesOnIOThread(net::CookieMonster::GetCookieListCallback callback)
 {
     if (m_cookieMonster)
-        m_cookieMonster->GetAllCookiesAsync(callback);
+        m_cookieMonster->GetAllCookiesAsync(std::move(callback));
 }
 
 void CookieMonsterDelegateQt::setCookie(quint64 callbackId, const QNetworkCookie &cookie, const QUrl &origin)
@@ -117,19 +117,19 @@ void CookieMonsterDelegateQt::setCookie(quint64 callbackId, const QNetworkCookie
     GURL gurl = origin.isEmpty() ? sourceUrlForCookie(cookie) : toGurl(origin);
 
     content::BrowserThread::PostTask(content::BrowserThread::IO, FROM_HERE,
-                                     base::Bind(&CookieMonsterDelegateQt::SetCookieOnIOThread, this,
-                                                gurl, cookie.toRawForm().toStdString(), callback));
+                                     base::BindOnce(&CookieMonsterDelegateQt::SetCookieOnIOThread, this,
+                                                    gurl, cookie.toRawForm().toStdString(), std::move(callback)));
 }
 
 void CookieMonsterDelegateQt::SetCookieOnIOThread(
         const GURL& url, const std::string& cookie_line,
-        const net::CookieMonster::SetCookiesCallback& callback)
+        net::CookieMonster::SetCookiesCallback callback)
 {
     net::CookieOptions options;
     options.set_include_httponly();
 
     if (m_cookieMonster)
-        m_cookieMonster->SetCookieWithOptionsAsync(url, cookie_line, options, callback);
+        m_cookieMonster->SetCookieWithOptionsAsync(url, cookie_line, options, std::move(callback));
 }
 
 void CookieMonsterDelegateQt::deleteCookie(const QNetworkCookie &cookie, const QUrl &origin)
@@ -140,8 +140,8 @@ void CookieMonsterDelegateQt::deleteCookie(const QNetworkCookie &cookie, const Q
     GURL gurl = origin.isEmpty() ? sourceUrlForCookie(cookie) : toGurl(origin);
 
     content::BrowserThread::PostTask(content::BrowserThread::IO, FROM_HERE,
-                                     base::Bind(&CookieMonsterDelegateQt::DeleteCookieOnIOThread, this,
-                                                gurl, cookie.name().toStdString()));
+                                     base::BindOnce(&CookieMonsterDelegateQt::DeleteCookieOnIOThread, this,
+                                                    gurl, cookie.name().toStdString()));
 }
 
 void CookieMonsterDelegateQt::DeleteCookieOnIOThread(const GURL& url, const std::string& cookie_name)
@@ -157,13 +157,13 @@ void CookieMonsterDelegateQt::deleteSessionCookies(quint64 callbackId)
 
     net::CookieMonster::DeleteCallback callback = base::Bind(&onDeleteCookiesCallback, m_client->d_func(), callbackId);
     content::BrowserThread::PostTask(content::BrowserThread::IO, FROM_HERE,
-                                     base::Bind(&CookieMonsterDelegateQt::DeleteSessionCookiesOnIOThread, this, callback));
+                                     base::BindOnce(&CookieMonsterDelegateQt::DeleteSessionCookiesOnIOThread, this, std::move(callback)));
 }
 
-void CookieMonsterDelegateQt::DeleteSessionCookiesOnIOThread(const net::CookieMonster::DeleteCallback& callback)
+void CookieMonsterDelegateQt::DeleteSessionCookiesOnIOThread(net::CookieMonster::DeleteCallback callback)
 {
     if (m_cookieMonster)
-        m_cookieMonster->DeleteSessionCookiesAsync(callback);
+        m_cookieMonster->DeleteSessionCookiesAsync(std::move(callback));
 }
 
 void CookieMonsterDelegateQt::deleteAllCookies(quint64 callbackId)
@@ -173,13 +173,13 @@ void CookieMonsterDelegateQt::deleteAllCookies(quint64 callbackId)
 
     net::CookieMonster::DeleteCallback callback = base::Bind(&onDeleteCookiesCallback, m_client->d_func(), callbackId);
     content::BrowserThread::PostTask(content::BrowserThread::IO, FROM_HERE,
-                                     base::Bind(&CookieMonsterDelegateQt::DeleteAllOnIOThread, this, callback));
+                                     base::BindOnce(&CookieMonsterDelegateQt::DeleteAllOnIOThread, this, std::move(callback)));
 }
 
-void CookieMonsterDelegateQt::DeleteAllOnIOThread(const net::CookieMonster::DeleteCallback& callback)
+void CookieMonsterDelegateQt::DeleteAllOnIOThread(net::CookieMonster::DeleteCallback callback)
 {
     if (m_cookieMonster)
-        m_cookieMonster->DeleteAllAsync(callback);
+        m_cookieMonster->DeleteAllAsync(std::move(callback));
 }
 
 void CookieMonsterDelegateQt::setCookieMonster(net::CookieMonster* monster)
diff --git a/src/core/cookie_monster_delegate_qt.h b/src/core/cookie_monster_delegate_qt.h
index 009abdd68..4625eb264 100644
--- a/src/core/cookie_monster_delegate_qt.h
+++ b/src/core/cookie_monster_delegate_qt.h
@@ -86,11 +86,11 @@ public:
     void OnCookieChanged(const net::CanonicalCookie& cookie, bool removed, net::CookieStore::ChangeCause cause) override;
 
 private:
-    void GetAllCookiesOnIOThread(const net::CookieMonster::GetCookieListCallback& callback);
-    void SetCookieOnIOThread(const GURL& url, const std::string& cookie_line, const net::CookieMonster::SetCookiesCallback& callback);
+    void GetAllCookiesOnIOThread(net::CookieMonster::GetCookieListCallback callback);
+    void SetCookieOnIOThread(const GURL& url, const std::string& cookie_line, net::CookieMonster::SetCookiesCallback callback);
     void DeleteCookieOnIOThread(const GURL& url, const std::string& cookie_name);
-    void DeleteSessionCookiesOnIOThread(const net::CookieMonster::DeleteCallback& callback);
-    void DeleteAllOnIOThread(const net::CookieMonster::DeleteCallback& callback);
+    void DeleteSessionCookiesOnIOThread(net::CookieMonster::DeleteCallback callback);
+    void DeleteAllOnIOThread(net::CookieMonster::DeleteCallback callback);
 };
 
 }
diff --git a/src/core/delegated_frame_node.cpp b/src/core/delegated_frame_node.cpp
index 12d429770..d0d840ecb 100644
--- a/src/core/delegated_frame_node.cpp
+++ b/src/core/delegated_frame_node.cpp
@@ -71,7 +71,7 @@
 #include "cc/quads/yuv_video_draw_quad.h"
 #include "cc/resources/returned_resource.h"
 #include "cc/resources/transferable_resource.h"
-#include "components/viz/display_compositor/host_shared_bitmap_manager.h"
+#include "components/viz/service/display_embedder/server_shared_bitmap_manager.h"
 #include "gpu/command_buffer/service/mailbox_manager.h"
 #include "ui/gl/gl_context.h"
 #include "ui/gl/gl_fence.h"
@@ -659,7 +659,7 @@ QSharedPointer<QSGTexture> ResourceHolder::initTexture(bool quadNeedsBlending, R
     if (!texture) {
         if (m_resource.is_software) {
             Q_ASSERT(apiDelegate);
-            std::unique_ptr<cc::SharedBitmap> sharedBitmap = viz::HostSharedBitmapManager::current()->GetSharedBitmapFromId(m_resource.size, m_resource.mailbox_holder.mailbox);
+            std::unique_ptr<viz::SharedBitmap> sharedBitmap = viz::ServerSharedBitmapManager::current()->GetSharedBitmapFromId(m_resource.size, m_resource.mailbox_holder.mailbox);
             // QSG interprets QImage::hasAlphaChannel meaning that a node should enable blending
             // to draw it but Chromium keeps this information in the quads.
             // The input format is currently always Format_ARGB32_Premultiplied, so assume that all
@@ -837,7 +837,7 @@ static bool areRenderPassStructuresEqual(cc::CompositorFrame *frameData,
 }
 
 void DelegatedFrameNode::commit(ChromiumCompositorData *chromiumCompositorData,
-                                cc::ReturnedResourceArray *resourcesToRelease,
+                                std::vector<cc::ReturnedResource> *resourcesToRelease,
                                 RenderWidgetHostViewQtDelegate *apiDelegate)
 {
     m_chromiumCompositorData = chromiumCompositorData;
diff --git a/src/core/delegated_frame_node.h b/src/core/delegated_frame_node.h
index cb8b1a5c3..b83f4682a 100644
--- a/src/core/delegated_frame_node.h
+++ b/src/core/delegated_frame_node.h
@@ -91,7 +91,7 @@ public:
     DelegatedFrameNode();
     ~DelegatedFrameNode();
     void preprocess();
-    void commit(ChromiumCompositorData *chromiumCompositorData, cc::ReturnedResourceArray *resourcesToRelease, RenderWidgetHostViewQtDelegate *apiDelegate);
+    void commit(ChromiumCompositorData *chromiumCompositorData, std::vector<cc::ReturnedResource> *resourcesToRelease, RenderWidgetHostViewQtDelegate *apiDelegate);
 
 private:
     void flushPolygons(
diff --git a/src/core/network_delegate_qt.cpp b/src/core/network_delegate_qt.cpp
index 6507ac1cc..90d4e6ce2 100644
--- a/src/core/network_delegate_qt.cpp
+++ b/src/core/network_delegate_qt.cpp
@@ -296,7 +296,7 @@ bool NetworkDelegateQt::OnCanGetCookies(const net::URLRequest&, const net::Cooki
     return true;
 }
 
-bool NetworkDelegateQt::OnCanAccessFile(const net::URLRequest& request, const base::FilePath& path) const
+bool NetworkDelegateQt::OnCanAccessFile(const net::URLRequest&, const base::FilePath&, const base::FilePath&) const
 {
     return true;
 }
diff --git a/src/core/network_delegate_qt.h b/src/core/network_delegate_qt.h
index 75d141ceb..b0a8e1ef9 100644
--- a/src/core/network_delegate_qt.h
+++ b/src/core/network_delegate_qt.h
@@ -89,7 +89,7 @@ public:
     void OnPACScriptError(int, const base::string16&) override;
     net::NetworkDelegate::AuthRequiredResponse OnAuthRequired(net::URLRequest*, const net::AuthChallengeInfo&, const AuthCallback&, net::AuthCredentials*) override;
     bool OnCanGetCookies(const net::URLRequest&, const net::CookieList&) override;
-    bool OnCanAccessFile(const net::URLRequest& request, const base::FilePath& path) const override;
+    bool OnCanAccessFile(const net::URLRequest&, const base::FilePath&, const base::FilePath&) const override;
     bool OnCanEnablePrivacyMode(const GURL&, const GURL&) const override;
     bool OnAreExperimentalCookieFeaturesEnabled() const override;
     bool OnCancelURLRequestWithPolicyViolatingReferrerHeader(const net::URLRequest&, const GURL&, const GURL&) const override;
diff --git a/src/core/permission_manager_qt.cpp b/src/core/permission_manager_qt.cpp
index 4c941406c..5328166d1 100644
--- a/src/core/permission_manager_qt.cpp
+++ b/src/core/permission_manager_qt.cpp
@@ -88,18 +88,52 @@ void PermissionManagerQt::permissionRequestReply(const QUrl &origin, BrowserCont
     QPair<QUrl, BrowserContextAdapter::PermissionType> key(origin, type);
     m_permissions[key] = reply;
     blink::mojom::PermissionStatus status = reply ? blink::mojom::PermissionStatus::GRANTED : blink::mojom::PermissionStatus::DENIED;
-    auto it = m_requests.begin();
-    while (it != m_requests.end()) {
-        if (it->origin == origin && it->type == type) {
-            it->callback.Run(status);
-            it = m_requests.erase(it);
-        } else
-            ++it;
+    {
+        auto it = m_requests.begin();
+        while (it != m_requests.end()) {
+            if (it->origin == origin && it->type == type) {
+                it->callback.Run(status);
+                it = m_requests.erase(it);
+            } else
+                ++it;
+        }
     }
     Q_FOREACH (const RequestOrSubscription &subscriber, m_subscribers) {
         if (subscriber.origin == origin && subscriber.type == type)
             subscriber.callback.Run(status);
     }
+
+    auto it = m_multiRequests.begin();
+    while (it != m_multiRequests.end()) {
+        if (it->origin == origin) {
+            bool answerable = true;
+            std::vector<blink::mojom::PermissionStatus> result;
+            result.reserve(it->types.size());
+            for (content::PermissionType permission : it->types) {
+                const BrowserContextAdapter::PermissionType permissionType = toQt(permission);
+                if (permissionType == BrowserContextAdapter::UnsupportedPermission) {
+                    result.push_back(blink::mojom::PermissionStatus::DENIED);
+                    continue;
+                }
+
+                QPair<QUrl, BrowserContextAdapter::PermissionType> key(origin, permissionType);
+                if (!m_permissions.contains(key)) {
+                    answerable = false;
+                    break;
+                }
+                if (m_permissions[key])
+                    result.push_back(blink::mojom::PermissionStatus::GRANTED);
+                else
+                    result.push_back(blink::mojom::PermissionStatus::DENIED);
+            }
+            if (answerable) {
+                it->callback.Run(result);
+                it = m_multiRequests.erase(it);
+                continue;
+            }
+        }
+        ++it;
+    }
 }
 
 bool PermissionManagerQt::checkPermission(const QUrl &origin, BrowserContextAdapter::PermissionType type)
@@ -144,32 +178,46 @@ int PermissionManagerQt::RequestPermissions(const std::vector<content::Permissio
                                             bool /*user_gesture*/,
                                             const base::Callback<void(const std::vector<blink::mojom::PermissionStatus>&)>& callback)
 {
-    NOTIMPLEMENTED() << "RequestPermissions has not been implemented in QtWebEngine";
-    Q_UNUSED(frameHost);
-
-    std::vector<blink::mojom::PermissionStatus> result(permissions.size());
+    bool answerable = true;
+    std::vector<blink::mojom::PermissionStatus> result;
+    result.reserve(permissions.size());
     for (content::PermissionType permission : permissions) {
         const BrowserContextAdapter::PermissionType permissionType = toQt(permission);
         if (permissionType == BrowserContextAdapter::UnsupportedPermission)
             result.push_back(blink::mojom::PermissionStatus::DENIED);
         else {
-            QPair<QUrl, BrowserContextAdapter::PermissionType> key(toQt(requesting_origin), permissionType);
-            // TODO: Request permission from UI
-            if (m_permissions.contains(key) && m_permissions[key])
-                result.push_back(blink::mojom::PermissionStatus::GRANTED);
-            else
-                result.push_back(blink::mojom::PermissionStatus::DENIED);
+            answerable = false;
+            break;
         }
     }
+    if (answerable) {
+        callback.Run(result);
+        return kNoPendingOperation;
+    }
 
-    callback.Run(result);
-    return kNoPendingOperation;
+    int request_id = ++m_requestIdCount;
+    content::WebContents *webContents = frameHost->GetRenderViewHost()->GetDelegate()->GetAsWebContents();
+    WebContentsDelegateQt* contentsDelegate = static_cast<WebContentsDelegateQt*>(webContents->GetDelegate());
+    Q_ASSERT(contentsDelegate);
+    MultiRequest request = {
+        permissions,
+        toQt(requesting_origin),
+        callback
+    };
+    m_multiRequests.insert(request_id, request);
+    for (content::PermissionType permission : permissions) {
+        const BrowserContextAdapter::PermissionType permissionType = toQt(permission);
+        if (permissionType == BrowserContextAdapter::GeolocationPermission)
+            contentsDelegate->requestGeolocationPermission(request.origin);
+    }
+    return request_id;
 }
 
 void PermissionManagerQt::CancelPermissionRequest(int request_id)
 {
     // Should we add API to cancel permissions in the UI level?
     m_requests.remove(request_id);
+    m_multiRequests.remove(request_id);
 }
 
 blink::mojom::PermissionStatus PermissionManagerQt::GetPermissionStatus(
diff --git a/src/core/permission_manager_qt.h b/src/core/permission_manager_qt.h
index e98174762..f51ea3c59 100644
--- a/src/core/permission_manager_qt.h
+++ b/src/core/permission_manager_qt.h
@@ -102,8 +102,14 @@ private:
         QUrl origin;
         base::Callback<void(blink::mojom::PermissionStatus)> callback;
     };
+    struct MultiRequest {
+        std::vector<content::PermissionType> types;
+        QUrl origin;
+        base::Callback<void(const std::vector<blink::mojom::PermissionStatus>&)> callback;
+    };
     QHash<int, RequestOrSubscription> m_requests;
     QHash<int, RequestOrSubscription> m_subscribers;
+    QHash<int, MultiRequest> m_multiRequests;
     int m_requestIdCount;
     int m_subscriberIdCount;
 
diff --git a/src/core/qtwebengine.gni b/src/core/qtwebengine.gni
index c9f766a36..a86e93f5b 100644
--- a/src/core/qtwebengine.gni
+++ b/src/core/qtwebengine.gni
@@ -17,6 +17,7 @@ deps = [
   "//components/keyed_service/content",
   "//components/visitedlink/browser",
   "//components/visitedlink/renderer",
+  "//components/signin/core/common:signin_features",
   "//components/web_cache/browser",
   "//components/web_cache/renderer",
   "//components/spellcheck:build_features",
diff --git a/src/core/qtwebengine_sources.gni b/src/core/qtwebengine_sources.gni
index 6e75a3247..a21193ecd 100644
--- a/src/core/qtwebengine_sources.gni
+++ b/src/core/qtwebengine_sources.gni
@@ -7,14 +7,14 @@ import("//printing/features/features.gni")
 
 source_set("qtwebengine_spellcheck_sources") {
   sources = [
+    "//chrome/browser/spellchecker/spell_check_host_impl.cc",
+    "//chrome/browser/spellchecker/spell_check_host_impl.h",
     "//chrome/browser/spellchecker/spellcheck_custom_dictionary.cc",
     "//chrome/browser/spellchecker/spellcheck_custom_dictionary.h",
     "//chrome/browser/spellchecker/spellcheck_factory.cc",
     "//chrome/browser/spellchecker/spellcheck_factory.h",
     "//chrome/browser/spellchecker/spellcheck_hunspell_dictionary.cc",
     "//chrome/browser/spellchecker/spellcheck_hunspell_dictionary.h",
-    "//chrome/browser/spellchecker/spellcheck_message_filter.cc",
-    "//chrome/browser/spellchecker/spellcheck_message_filter.h",
     "//chrome/browser/spellchecker/spellcheck_service.cc",
     "//chrome/browser/spellchecker/spellcheck_service.h",
   ]
@@ -27,7 +27,6 @@ source_set("qtwebengine_spellcheck_sources") {
   ]
   if (is_mac && use_browser_spellchecker) {
     sources += [
-        "//chrome/browser/spellchecker/spellcheck_message_filter_platform.h",
         "//chrome/browser/spellchecker/spellcheck_message_filter_platform_mac.cc",
     ]
   }
diff --git a/src/core/render_widget_host_view_qt.cpp b/src/core/render_widget_host_view_qt.cpp
index 78273060f..9be5bd498 100644
--- a/src/core/render_widget_host_view_qt.cpp
+++ b/src/core/render_widget_host_view_qt.cpp
@@ -53,7 +53,10 @@
 
 #include "base/command_line.h"
 #include "cc/output/direct_renderer.h"
+#include "components/viz/service/frame_sinks/frame_sink_manager_impl.h"
 #include "content/browser/accessibility/browser_accessibility_state_impl.h"
+#include "content/browser/browser_main_loop.h"
+#include "content/browser/frame_host/render_frame_host_impl.h"
 #include "content/browser/frame_host/frame_tree.h"
 #include "content/browser/renderer_host/render_view_host_impl.h"
 #include "content/common/cursors/webcursor.h"
@@ -272,7 +275,6 @@ RenderWidgetHostViewQt::RenderWidgetHostViewQt(content::RenderWidgetHost* widget
     , m_initPending(false)
     , m_beginFrameSource(nullptr)
     , m_needsBeginFrames(false)
-    , m_needsFlushInput(false)
     , m_addedFrameObserver(false)
     , m_backgroundColor(SK_ColorWHITE)
     , m_imState(0)
@@ -664,7 +666,7 @@ bool RenderWidgetHostViewQt::HasAcceleratedSurface(const gfx::Size&)
     return false;
 }
 
-void RenderWidgetHostViewQt::DidCreateNewRendererCompositorFrameSink(cc::mojom::MojoCompositorFrameSinkClient *frameSink)
+void RenderWidgetHostViewQt::DidCreateNewRendererCompositorFrameSink(cc::mojom::CompositorFrameSinkClient *frameSink)
 {
     // Accumulated resources belong to the old RendererCompositorFrameSink and
     // should not be returned.
@@ -672,7 +674,7 @@ void RenderWidgetHostViewQt::DidCreateNewRendererCompositorFrameSink(cc::mojom::
     m_rendererCompositorFrameSink = frameSink;
 }
 
-void RenderWidgetHostViewQt::SubmitCompositorFrame(const cc::LocalSurfaceId &local_surface_id, cc::CompositorFrame frame)
+void RenderWidgetHostViewQt::SubmitCompositorFrame(const viz::LocalSurfaceId &local_surface_id, cc::CompositorFrame frame)
 {
     bool scrollOffsetChanged = (m_lastScrollOffset != frame.metadata.root_scroll_offset);
     bool contentsSizeChanged = (m_lastContentsSize != frame.metadata.root_layer_size);
@@ -795,10 +797,10 @@ void RenderWidgetHostViewQt::OnTextSelectionChanged(content::TextInputManager *t
         return;
 
 #if defined(USE_X11)
-    if (!GetSelectedText().empty() && selection->user_initiated()) {
+    if (!selection->selected_text().empty() && selection->user_initiated()) {
         // Set the CLIPBOARD_TYPE_SELECTION to the ui::Clipboard.
         ui::ScopedClipboardWriter clipboard_writer(ui::CLIPBOARD_TYPE_SELECTION);
-        clipboard_writer.WriteText(GetSelectedText());
+        clipboard_writer.WriteText(selection->selected_text());
     }
 #endif // defined(USE_X11)
 
@@ -866,10 +868,10 @@ void RenderWidgetHostViewQt::selectionChanged()
     m_anchorPositionWithinSelection = newAnchorPositionWithinSelection;
     m_cursorPositionWithinSelection = newCursorPositionWithinSelection;
 
-    if (!GetSelectedText().empty())
+    if (!selection->selected_text().empty())
         m_cursorPosition = newCursorPositionWithinSelection;
 
-    m_emptyPreviousSelection = GetSelectedText().empty();
+    m_emptyPreviousSelection = selection->selected_text().empty();
     m_adapterClient->selectionChanged();
 }
 
@@ -1027,14 +1029,13 @@ QVariant RenderWidgetHostViewQt::inputMethodQuery(Qt::InputMethodQuery query)
 void RenderWidgetHostViewQt::ProcessAckedTouchEvent(const content::TouchEventWithLatencyInfo &touch, content::InputEventAckState ack_result) {
     Q_UNUSED(touch);
     const bool eventConsumed = ack_result == content::INPUT_EVENT_ACK_STATE_CONSUMED;
-    m_gestureProvider.OnTouchEventAck(touch.event.unique_touch_event_id, eventConsumed);
+    m_gestureProvider.OnTouchEventAck(touch.event.unique_touch_event_id, eventConsumed, /*fixme: ?? */false);
 }
 
 void RenderWidgetHostViewQt::sendDelegatedFrameAck()
 {
-    const cc::BeginFrameAck ack;
-    m_beginFrameSource->DidFinishFrame(this, ack);
-    cc::ReturnedResourceArray resources;
+    m_beginFrameSource->DidFinishFrame(this);
+    std::vector<cc::ReturnedResource> resources;
     m_resourcesToRelease.swap(resources);
     if (m_rendererCompositorFrameSink)
         m_rendererCompositorFrameSink->DidReceiveCompositorFrameAck(resources);
@@ -1149,7 +1150,7 @@ void RenderWidgetHostViewQt::handleKeyEvent(QKeyEvent *ev)
             if (ev->type() == QEvent::KeyRelease) {
                 m_receivedEmptyImeText = false;
                 m_host->ImeSetComposition(toString16(ev->text()),
-                                          std::vector<blink::WebCompositionUnderline>(),
+                                          std::vector<ui::CompositionUnderline>(),
                                           gfx::Range::InvalidRange(),
                                           gfx::Range::InvalidRange().start(),
                                           gfx::Range::InvalidRange().end());
@@ -1190,7 +1191,7 @@ void RenderWidgetHostViewQt::handleInputMethodEvent(QInputMethodEvent *ev)
     gfx::Range selectionRange = gfx::Range::InvalidRange();
 
     const QList<QInputMethodEvent::Attribute> &attributes = ev->attributes();
-    std::vector<blink::WebCompositionUnderline> underlines;
+    std::vector<ui::CompositionUnderline> underlines;
     bool hasSelection = false;
 
     for (const auto &attribute : attributes) {
@@ -1215,7 +1216,7 @@ void RenderWidgetHostViewQt::handleInputMethodEvent(QInputMethodEvent *ev)
             if (format.underlineStyle() != QTextCharFormat::NoUnderline)
                 underlineColor = format.underlineColor();
 
-            underlines.push_back(blink::WebCompositionUnderline(start, end, toSk(underlineColor), /*thick*/ false, SK_ColorTRANSPARENT));
+            underlines.push_back(ui::CompositionUnderline(start, end, toSk(underlineColor), /*thick*/ false, SK_ColorTRANSPARENT));
             break;
         }
         case QInputMethodEvent::Cursor:
@@ -1254,9 +1255,9 @@ void RenderWidgetHostViewQt::handleInputMethodEvent(QInputMethodEvent *ev)
     }
 
     if (hasSelection) {
-        content::RenderFrameHost *frameHost = getFocusedFrameHost();
+        content::RenderFrameHostImpl *frameHost = static_cast<content::RenderFrameHostImpl *>(getFocusedFrameHost());
         if (frameHost)
-            frameHost->Send(new InputMsg_SetEditableSelectionOffsets(frameHost->GetRoutingID(), selectionRange.start(), selectionRange.end()));
+            frameHost->GetFrameInputHandler()->SetEditableSelectionOffsets(selectionRange.start(), selectionRange.end());
     }
 
     int replacementLength = ev->replacementLength();
@@ -1512,35 +1513,28 @@ void RenderWidgetHostViewQt::SetNeedsBeginFrames(bool needs_begin_frames)
     updateNeedsBeginFramesInternal();
 }
 
-void RenderWidgetHostViewQt::OnSetNeedsFlushInput()
-{
-    m_needsFlushInput = true;
-    updateNeedsBeginFramesInternal();
-}
-
 void RenderWidgetHostViewQt::updateNeedsBeginFramesInternal()
 {
     if (!m_beginFrameSource)
         return;
 
-    // Based on upstream Chromium commit 7f7c8cc8b97dd0d5c9159d9e60c62efbc35e6b53.
-    bool needsFrame = m_needsBeginFrames || m_needsFlushInput;
-    if (m_addedFrameObserver == needsFrame)
+    if (m_addedFrameObserver == m_needsBeginFrames)
         return;
 
-    m_addedFrameObserver = needsFrame;
-    if (needsFrame)
+    if (m_needsBeginFrames)
         m_beginFrameSource->AddObserver(this);
     else
         m_beginFrameSource->RemoveObserver(this);
+    m_addedFrameObserver = m_needsBeginFrames;
 }
 
 bool RenderWidgetHostViewQt::OnBeginFrameDerivedImpl(const cc::BeginFrameArgs& args)
 {
-    m_needsFlushInput = false;
     m_beginFrameSource->OnUpdateVSyncParameters(args.frame_time, args.interval);
-    updateNeedsBeginFramesInternal();
-    m_host->Send(new ViewMsg_BeginFrame(m_host->GetRoutingID(), args));
+    if (m_rendererCompositorFrameSink)
+        m_rendererCompositorFrameSink->OnBeginFrame(args);
+    else // FIXME: is this else part ever needed?
+        m_host->Send(new ViewMsg_BeginFrame(m_host->GetRoutingID(), args));
     return true;
 }
 
diff --git a/src/core/render_widget_host_view_qt.h b/src/core/render_widget_host_view_qt.h
index 76aa9711a..7d32cc645 100644
--- a/src/core/render_widget_host_view_qt.h
+++ b/src/core/render_widget_host_view_qt.h
@@ -151,15 +151,14 @@ public:
     void Destroy() override;
     void SetTooltipText(const base::string16 &tooltip_text) override;
     bool HasAcceleratedSurface(const gfx::Size&) override;
-    void DidCreateNewRendererCompositorFrameSink(cc::mojom::MojoCompositorFrameSinkClient*) override;
-    void SubmitCompositorFrame(const cc::LocalSurfaceId&, cc::CompositorFrame) override;
+    void DidCreateNewRendererCompositorFrameSink(cc::mojom::CompositorFrameSinkClient* renderer_compositor_frame_sink) override;
+    void SubmitCompositorFrame(const viz::LocalSurfaceId&, cc::CompositorFrame) override;
 
     void GetScreenInfo(content::ScreenInfo* results);
     gfx::Rect GetBoundsInRootWindow() override;
     void ProcessAckedTouchEvent(const content::TouchEventWithLatencyInfo &touch, content::InputEventAckState ack_result) override;
     void ClearCompositorFrame() override;
     void SetNeedsBeginFrames(bool needs_begin_frames) override;
-    void OnSetNeedsFlushInput() override;
 
     // Overridden from ui::GestureProviderClient.
     void OnGestureEvent(const ui::GestureEventData& gesture) override;
@@ -240,14 +239,14 @@ private:
     std::unique_ptr<RenderWidgetHostViewQtDelegate> m_delegate;
 
     QExplicitlySharedDataPointer<ChromiumCompositorData> m_chromiumCompositorData;
-    cc::ReturnedResourceArray m_resourcesToRelease;
+    std::vector<cc::ReturnedResource> m_resourcesToRelease;
     bool m_needsDelegatedFrameAck;
     LoadVisuallyCommittedState m_loadVisuallyCommittedState;
 
     QMetaObject::Connection m_adapterClientDestroyedConnection;
     WebContentsAdapterClient *m_adapterClient;
     MultipleMouseClickHelper m_clickHelper;
-    cc::mojom::MojoCompositorFrameSinkClient *m_rendererCompositorFrameSink;
+    cc::mojom::CompositorFrameSinkClient *m_rendererCompositorFrameSink;
 
     bool m_imeInProgress;
     bool m_receivedEmptyImeText;
@@ -257,13 +256,12 @@ private:
 
     std::unique_ptr<cc::SyntheticBeginFrameSource> m_beginFrameSource;
     bool m_needsBeginFrames;
-    bool m_needsFlushInput;
     bool m_addedFrameObserver;
 
     gfx::Vector2dF m_lastScrollOffset;
     gfx::SizeF m_lastContentsSize;
     SkColor m_backgroundColor;
-    cc::LocalSurfaceId m_localSurfaceId;
+    viz::LocalSurfaceId m_localSurfaceId;
 
     uint m_imState;
     int m_anchorPositionWithinSelection;
diff --git a/src/core/renderer/web_channel_ipc_transport.cpp b/src/core/renderer/web_channel_ipc_transport.cpp
index f2e438233..8374a8e6b 100644
--- a/src/core/renderer/web_channel_ipc_transport.cpp
+++ b/src/core/renderer/web_channel_ipc_transport.cpp
@@ -105,7 +105,7 @@ void WebChannelTransport::Install(blink::WebFrame *frame, uint worldId)
     v8::HandleScope handleScope(isolate);
     v8::Handle<v8::Context> context;
     if (worldId == 0)
-        context = frame->MainWorldScriptContext();
+        context = frame->ToWebLocalFrame()->MainWorldScriptContext();
     else
         context = frame->ToWebLocalFrame()->IsolatedWorldScriptContext(worldId);
     v8::Context::Scope contextScope(context);
@@ -126,7 +126,7 @@ void WebChannelTransport::Uninstall(blink::WebFrame *frame, uint worldId)
     v8::HandleScope handleScope(isolate);
     v8::Handle<v8::Context> context;
     if (worldId == 0)
-        context = frame->MainWorldScriptContext();
+        context = frame->ToWebLocalFrame()->MainWorldScriptContext();
     else
         context = frame->ToWebLocalFrame()->IsolatedWorldScriptContext(worldId);
     v8::Context::Scope contextScope(context);
@@ -209,7 +209,7 @@ void WebChannelIPCTransport::dispatchWebChannelMessage(const std::vector<char> &
     blink::WebFrame *frame = webView->MainFrame();
     v8::Handle<v8::Context> context;
     if (worldId == 0)
-        context = frame->MainWorldScriptContext();
+        context = frame->ToWebLocalFrame()->MainWorldScriptContext();
     else
         context = frame->ToWebLocalFrame()->IsolatedWorldScriptContext(worldId);
     v8::Context::Scope contextScope(context);
@@ -239,7 +239,7 @@ void WebChannelIPCTransport::dispatchWebChannelMessage(const std::vector<char> &
     const int argc = 1;
     v8::Handle<v8::Value> argv[argc];
     argv[0] = messageObject;
-    frame->CallFunctionEvenIfScriptDisabled(callback, webChannelObjectValue->ToObject(), argc, argv);
+    frame->ToWebLocalFrame()->CallFunctionEvenIfScriptDisabled(callback, webChannelObjectValue->ToObject(), argc, argv);
 }
 
 bool WebChannelIPCTransport::OnMessageReceived(const IPC::Message &message)
diff --git a/src/core/surface_factory_qt.cpp b/src/core/surface_factory_qt.cpp
index 6e5e13866..d0741506a 100644
--- a/src/core/surface_factory_qt.cpp
+++ b/src/core/surface_factory_qt.cpp
@@ -77,8 +77,7 @@ protected:
     intptr_t GetNativeDisplay() override;
 
     // Sets up GL bindings for the native surface.
-    bool LoadGLES2Bindings() override;
-
+    bool LoadGLES2Bindings(gl::GLImplementation implementation) override;
 };
 
 base::NativeLibrary LoadLibrary(const base::FilePath& filename) {
@@ -91,7 +90,7 @@ base::NativeLibrary LoadLibrary(const base::FilePath& filename) {
     return library;
 }
 
-bool GLOzoneQt::LoadGLES2Bindings()
+bool GLOzoneQt::LoadGLES2Bindings(gl::GLImplementation /*implementation*/)
 {
     base::NativeLibrary eglgles2Library = dlopen(NULL, RTLD_LAZY);
     if (!eglgles2Library) {
diff --git a/src/core/type_conversion.cpp b/src/core/type_conversion.cpp
index a7b5ee831..685ee273e 100644
--- a/src/core/type_conversion.cpp
+++ b/src/core/type_conversion.cpp
@@ -39,6 +39,7 @@
 
 #include "type_conversion.h"
 
+#include <content/public/common/favicon_url.h>
 #include <ui/events/event_constants.h>
 #include <ui/gfx/image/image_skia.h>
 #include <QtCore/qcoreapplication.h>
@@ -104,17 +105,6 @@ QImage toQImage(const SkBitmap &bitmap)
             break;
         }
         break;
-    case kIndex_8_SkColorType: {
-        image = toQImage(bitmap, QImage::Format_Indexed8);
-        SkColorTable *skTable = bitmap.getColorTable();
-        if (skTable) {
-            QVector<QRgb> qTable(skTable->count());
-            for (int i = 0; i < skTable->count(); ++i)
-                qTable[i] = (*skTable)[i];
-            image.setColorTable(qTable);
-        }
-        break;
-    }
     case kGray_8_SkColorType:
         image = toQImage(bitmap, QImage::Format_Grayscale8);
         break;
@@ -171,31 +161,30 @@ int flagsFromModifiers(Qt::KeyboardModifiers modifiers)
     return modifierFlags;
 }
 
+FaviconInfo::FaviconType toQt(content::FaviconURL::IconType type)
+{
+    switch (type) {
+    case content::FaviconURL::IconType::kFavicon:
+        return FaviconInfo::Favicon;
+    case content::FaviconURL::IconType::kTouchIcon:
+        return FaviconInfo::TouchIcon;
+    case content::FaviconURL::IconType::kTouchPrecomposedIcon:
+        return FaviconInfo::TouchPrecomposedIcon;
+    case content::FaviconURL::IconType::kInvalid:
+        return FaviconInfo::InvalidIcon;
+    }
+    Q_UNREACHABLE();
+    return FaviconInfo::InvalidIcon;
+}
+
 FaviconInfo toFaviconInfo(const content::FaviconURL &favicon_url)
 {
     FaviconInfo info;
-
     info.url = toQt(favicon_url.icon_url);
-
-    switch (favicon_url.icon_type) {
-    case content::FaviconURL::FAVICON:
-        info.type = FaviconInfo::Favicon;
-        break;
-    case content::FaviconURL::TOUCH_ICON:
-        info.type = FaviconInfo::TouchIcon;
-        break;
-    case content::FaviconURL::TOUCH_PRECOMPOSED_ICON:
-        info.type = FaviconInfo::TouchPrecomposedIcon;
-        break;
-    default:
-        info.type = FaviconInfo::InvalidIcon;
-        break;
-    }
-
+    info.type = toQt(favicon_url.icon_type);
     // TODO: Add support for rel sizes attribute (favicon_url.icon_sizes):
     // http://www.w3schools.com/tags/att_link_sizes.asp
     info.size = QSize(0, 0);
-
     return info;
 }
 
diff --git a/src/core/type_conversion.h b/src/core/type_conversion.h
index ed02a9db9..d9ba735bd 100644
--- a/src/core/type_conversion.h
+++ b/src/core/type_conversion.h
@@ -54,7 +54,6 @@
 #include "base/files/file_path.h"
 #include "base/time/time.h"
 #include "content/public/common/file_chooser_file_info.h"
-#include "content/public/common/favicon_url.h"
 #include "favicon_manager.h"
 #include "net/cookies/canonical_cookie.h"
 #include "third_party/skia/include/core/SkBitmap.h"
@@ -65,6 +64,10 @@
 #include "ui/gfx/geometry/rect_f.h"
 #include "url/gurl.h"
 
+namespace content {
+struct FaviconURL;
+}
+
 namespace gfx {
 class ImageSkiaRep;
 }
diff --git a/src/core/url_request_context_getter_qt.cpp b/src/core/url_request_context_getter_qt.cpp
index cb8c3c093..4f30881c8 100644
--- a/src/core/url_request_context_getter_qt.cpp
+++ b/src/core/url_request_context_getter_qt.cpp
@@ -175,9 +175,7 @@ void URLRequestContextGetterQt::updateStorageSettings()
         m_proxyConfigService =
                 new ProxyConfigServiceQt(
                     net::ProxyService::CreateSystemProxyConfigService(
-                        content::BrowserThread::GetTaskRunnerForThread(BrowserThread::IO),
-                        content::BrowserThread::GetTaskRunnerForThread(BrowserThread::FILE)
-                ));
+                        content::BrowserThread::GetTaskRunnerForThread(BrowserThread::IO)));
         if (m_contextInitialized)
             content::BrowserThread::PostTask(content::BrowserThread::IO, FROM_HERE,
                                              base::Bind(&URLRequestContextGetterQt::generateAllStorage, this));
@@ -410,7 +408,7 @@ void URLRequestContextGetterQt::updateRequestInterceptor()
     // We in this case do not need to regenerate any Chromium classes.
 }
 
-static bool doNetworkSessionParamsMatch(const net::HttpNetworkSession::Params &first, const net::HttpNetworkSession::Params &second)
+static bool doNetworkSessionContextMatch(const net::HttpNetworkSession::Context &first, const net::HttpNetworkSession::Context &second)
 {
     if (first.transport_security_state != second.transport_security_state)
         return false;
@@ -426,8 +424,6 @@ static bool doNetworkSessionParamsMatch(const net::HttpNetworkSession::Params &f
         return false;
     if (first.http_server_properties != second.http_server_properties)
         return false;
-    if (first.ignore_certificate_errors != second.ignore_certificate_errors)
-        return false;
     if (first.host_resolver != second.host_resolver)
         return false;
     if (first.cert_transparency_verifier != second.cert_transparency_verifier)
@@ -438,23 +434,41 @@ static bool doNetworkSessionParamsMatch(const net::HttpNetworkSession::Params &f
     return true;
 }
 
+static bool doNetworkSessionParamsMatch(const net::HttpNetworkSession::Params &first, const net::HttpNetworkSession::Params &second)
+{
+    if (first.ignore_certificate_errors != second.ignore_certificate_errors)
+        return false;
+
+    return true;
+}
+
+net::HttpNetworkSession::Context URLRequestContextGetterQt::generateNetworkSessionContext()
+{
+    Q_ASSERT(m_urlRequestContext);
+
+    net::HttpNetworkSession::Context network_session_context;
+
+    network_session_context.transport_security_state     = m_urlRequestContext->transport_security_state();
+    network_session_context.cert_verifier                = m_urlRequestContext->cert_verifier();
+    network_session_context.channel_id_service           = m_urlRequestContext->channel_id_service();
+    network_session_context.proxy_service                = m_urlRequestContext->proxy_service();
+    network_session_context.ssl_config_service           = m_urlRequestContext->ssl_config_service();
+    network_session_context.http_auth_handler_factory    = m_urlRequestContext->http_auth_handler_factory();
+    network_session_context.http_server_properties       = m_urlRequestContext->http_server_properties();
+    network_session_context.host_resolver                = m_urlRequestContext->host_resolver();
+    network_session_context.cert_transparency_verifier   = m_urlRequestContext->cert_transparency_verifier();
+    network_session_context.ct_policy_enforcer           = m_urlRequestContext->ct_policy_enforcer();
+
+    return network_session_context;
+}
+
 net::HttpNetworkSession::Params URLRequestContextGetterQt::generateNetworkSessionParams()
 {
     Q_ASSERT(m_urlRequestContext);
 
     net::HttpNetworkSession::Params network_session_params;
 
-    network_session_params.transport_security_state     = m_urlRequestContext->transport_security_state();
-    network_session_params.cert_verifier                = m_urlRequestContext->cert_verifier();
-    network_session_params.channel_id_service           = m_urlRequestContext->channel_id_service();
-    network_session_params.proxy_service                = m_urlRequestContext->proxy_service();
-    network_session_params.ssl_config_service           = m_urlRequestContext->ssl_config_service();
-    network_session_params.http_auth_handler_factory    = m_urlRequestContext->http_auth_handler_factory();
-    network_session_params.http_server_properties       = m_urlRequestContext->http_server_properties();
     network_session_params.ignore_certificate_errors    = m_ignoreCertificateErrors;
-    network_session_params.host_resolver                = m_urlRequestContext->host_resolver();
-    network_session_params.cert_transparency_verifier   = m_urlRequestContext->cert_transparency_verifier();
-    network_session_params.ct_policy_enforcer           = m_urlRequestContext->ct_policy_enforcer();
 
     return network_session_params;
 }
@@ -499,11 +513,14 @@ void URLRequestContextGetterQt::generateHttpCache()
     }
 
     net::HttpCache *cache = 0;
+    net::HttpNetworkSession::Context network_session_context = generateNetworkSessionContext();
     net::HttpNetworkSession::Params network_session_params = generateNetworkSessionParams();
 
-    if (!m_httpNetworkSession || !doNetworkSessionParamsMatch(network_session_params, m_httpNetworkSession->params())) {
+    if (!m_httpNetworkSession
+            || !doNetworkSessionParamsMatch(network_session_params, m_httpNetworkSession->params())
+            || !doNetworkSessionContextMatch(network_session_context, m_httpNetworkSession->context())) {
         cancelAllUrlRequests();
-        m_httpNetworkSession.reset(new net::HttpNetworkSession(network_session_params));
+        m_httpNetworkSession.reset(new net::HttpNetworkSession(network_session_params, network_session_context));
     }
 
     cache = new net::HttpCache(m_httpNetworkSession.get(), std::unique_ptr<net::HttpCache::DefaultBackend>(main_backend), false);
diff --git a/src/core/url_request_context_getter_qt.h b/src/core/url_request_context_getter_qt.h
index 9757cc73e..511d9eb04 100644
--- a/src/core/url_request_context_getter_qt.h
+++ b/src/core/url_request_context_getter_qt.h
@@ -99,6 +99,7 @@ private:
     void clearCurrentCacheBackend();
     void cancelAllUrlRequests();
     net::HttpNetworkSession::Params generateNetworkSessionParams();
+    net::HttpNetworkSession::Context generateNetworkSessionContext();
 
     void setFullConfiguration(QSharedPointer<BrowserContextAdapter> browserContext);
 
diff --git a/src/core/web_contents_adapter.cpp b/src/core/web_contents_adapter.cpp
index a5e33257e..effd6e340 100644
--- a/src/core/web_contents_adapter.cpp
+++ b/src/core/web_contents_adapter.cpp
@@ -954,9 +954,26 @@ void WebContentsAdapter::download(const QUrl &url, const QString &suggestedFileN
     dlmd->setDownloadType(BrowserContextAdapterClient::UserRequested);
     dlm->SetDelegate(dlmd);
 
+    net::NetworkTrafficAnnotationTag traffic_annotation =
+        net::DefineNetworkTrafficAnnotation(
+            "WebContentsAdapter::download", R"(
+            semantics {
+              sender: "User"
+              description:
+                "User requested download"
+              trigger: "User."
+              data: "Anything."
+              destination: OTHER
+            }
+            policy {
+              cookies_allowed: YES
+              cookies_store: "user"
+              setting:
+                "It's possible not to use this feature."
+            })");
     GURL gurl = toGurl(url);
     std::unique_ptr<content::DownloadUrlParameters> params(
-        content::DownloadUrlParameters::CreateForWebContentsMainFrame(webContents(), gurl));
+        content::DownloadUrlParameters::CreateForWebContentsMainFrame(webContents(), gurl, traffic_annotation));
 
     params->set_suggested_name(toString16(suggestedFileName));
 
@@ -1514,6 +1531,8 @@ ASSERT_ENUMS_MATCH(ReferrerPolicy::Never, blink::kWebReferrerPolicyNever)
 ASSERT_ENUMS_MATCH(ReferrerPolicy::Origin, blink::kWebReferrerPolicyOrigin)
 ASSERT_ENUMS_MATCH(ReferrerPolicy::OriginWhenCrossOrigin, blink::kWebReferrerPolicyOriginWhenCrossOrigin)
 ASSERT_ENUMS_MATCH(ReferrerPolicy::NoReferrerWhenDowngradeOriginWhenCrossOrigin, blink::kWebReferrerPolicyNoReferrerWhenDowngradeOriginWhenCrossOrigin)
+ASSERT_ENUMS_MATCH(ReferrerPolicy::SameOrigin, blink::kWebReferrerPolicySameOrigin)
+ASSERT_ENUMS_MATCH(ReferrerPolicy::StrictOrigin, blink::kWebReferrerPolicyStrictOrigin)
 ASSERT_ENUMS_MATCH(ReferrerPolicy::Last, blink::kWebReferrerPolicyLast)
 
 } // namespace QtWebEngineCore
diff --git a/src/core/web_contents_adapter_client.h b/src/core/web_contents_adapter_client.h
index efcc6cb3e..6416ab6af 100644
--- a/src/core/web_contents_adapter_client.h
+++ b/src/core/web_contents_adapter_client.h
@@ -81,7 +81,9 @@ enum class ReferrerPolicy {
     Origin,
     OriginWhenCrossOrigin,
     NoReferrerWhenDowngradeOriginWhenCrossOrigin,
-    Last = NoReferrerWhenDowngradeOriginWhenCrossOrigin,
+    SameOrigin,
+    StrictOrigin,
+    Last = StrictOrigin,
 };
 
 class WebEngineContextMenuSharedData : public QSharedData {
diff --git a/src/core/web_contents_delegate_qt.cpp b/src/core/web_contents_delegate_qt.cpp
index c2d7f4136..111a6943a 100644
--- a/src/core/web_contents_delegate_qt.cpp
+++ b/src/core/web_contents_delegate_qt.cpp
@@ -119,6 +119,7 @@ content::WebContents *WebContentsDelegateQt::OpenURLFromTab(content::WebContents
     load_url_params.extra_headers = params.extra_headers;
     load_url_params.should_replace_current_entry = params.should_replace_current_entry;
     load_url_params.is_renderer_initiated = params.is_renderer_initiated;
+    load_url_params.started_from_context_menu = params.started_from_context_menu;
     load_url_params.override_user_agent = content::NavigationController::UA_OVERRIDE_TRUE;
     if (params.uses_post) {
         load_url_params.load_type = content::NavigationController::LOAD_TYPE_HTTP_POST;
@@ -244,9 +245,12 @@ void WebContentsDelegateQt::DidFinishNavigation(content::NavigationHandle *navig
         return;
 
     if (navigation_handle->HasCommitted() && !navigation_handle->IsErrorPage()) {
+        BrowserContextAdapter *browserContextAdapter = m_viewClient->browserContextAdapter().data();
         // VisistedLinksMaster asserts !IsOffTheRecord().
-        if (navigation_handle->ShouldUpdateHistory() && m_viewClient->browserContextAdapter()->trackVisitedLinks())
-            m_viewClient->browserContextAdapter()->visitedLinksManager()->addUrl(navigation_handle->GetURL());
+        if (navigation_handle->ShouldUpdateHistory() && browserContextAdapter->trackVisitedLinks()) {
+            for (const GURL &url : navigation_handle->GetRedirectChain())
+                browserContextAdapter->visitedLinksManager()->addUrl(url);
+        }
 
         // Make sure that we don't set the findNext WebFindOptions on a new frame.
         m_lastSearchedString = QString();
@@ -338,9 +342,12 @@ void WebContentsDelegateQt::DidUpdateFaviconURL(const std::vector<content::Favic
     m_faviconManager->update(faviconCandidates);
 }
 
-void WebContentsDelegateQt::WebContentsCreated(content::WebContents* /*source_contents*/, int /*opener_render_process_id*/, int /*opener_render_frame_id*/, const std::string& /*frame_name*/, const GURL& target_url, content::WebContents* new_contents, const base::Optional<content::WebContents::CreateParams>& create_params)
+void WebContentsDelegateQt::WebContentsCreated(content::WebContents */*source_contents*/,
+                                               int /*opener_render_process_id*/, int /*opener_render_frame_id*/,
+                                               const std::string &/*frame_name*/,
+                                               const GURL &target_url, content::WebContents */*new_contents*/)
 {
-    this->m_initialTargetUrl = toQt(target_url);
+    m_initialTargetUrl = toQt(target_url);
 }
 
 content::ColorChooser *WebContentsDelegateQt::OpenColorChooser(content::WebContents *source, SkColor color, const std::vector<content::ColorSuggestion> &suggestion)
diff --git a/src/core/web_contents_delegate_qt.h b/src/core/web_contents_delegate_qt.h
index dab693780..87b7271f6 100644
--- a/src/core/web_contents_delegate_qt.h
+++ b/src/core/web_contents_delegate_qt.h
@@ -105,7 +105,8 @@ public:
     void LoadProgressChanged(content::WebContents* source, double progress) override;
     void HandleKeyboardEvent(content::WebContents *source, const content::NativeWebKeyboardEvent &event) override;
     content::ColorChooser *OpenColorChooser(content::WebContents *source, SkColor color, const std::vector<content::ColorSuggestion> &suggestion) override;
-    void WebContentsCreated(content::WebContents* source_contents, int opener_render_process_id, int opener_render_frame_id, const std::string& frame_name, const GURL& target_url, content::WebContents* new_contents, const base::Optional<content::WebContents::CreateParams>& create_params) override;
+    void WebContentsCreated(content::WebContents *source_contents, int opener_render_process_id, int opener_render_frame_id,
+                            const std::string &frame_name, const GURL &target_url, content::WebContents *new_contents) override;
     content::JavaScriptDialogManager *GetJavaScriptDialogManager(content::WebContents *source) override;
     void EnterFullscreenModeForTab(content::WebContents* web_contents, const GURL& origin) override;
     void ExitFullscreenModeForTab(content::WebContents*) override;
diff --git a/src/core/web_engine_context.cpp b/src/core/web_engine_context.cpp
index f7557ebf4..d1f041c56 100644
--- a/src/core/web_engine_context.cpp
+++ b/src/core/web_engine_context.cpp
@@ -334,6 +334,9 @@ WebEngineContext::WebEngineContext()
     // Enabled on OS X and Linux but currently not working. It worked in 5.7 on OS X.
     parsedCommandLine->AppendSwitch(switches::kDisableGpuMemoryBufferVideoFrames);
 
+    // The Mojo local-storage is currently pretty broken and saves in $$PWD/Local\ Storage
+    parsedCommandLine->AppendSwitch(switches::kDisableMojoLocalStorage);
+
 #if defined(Q_OS_MACOS)
     // Accelerated decoding currently does not work on macOS due to issues with OpenGL Rectangle
     // texture support. See QTBUG-60002.