M115 stage 5

src/chrome/browser/chrome_content_browser_client.cc

@@ -24,6 +24,7 @@
 #include "base/memory/raw_ptr.h"
 #include "base/memory/scoped_refptr.h"
 #include "base/metrics/field_trial_params.h"
+#include "base/metrics/histogram_functions.h"
 #include "base/metrics/histogram_macros.h"
 #include "base/no_destructor.h"
 #include "base/path_service.h"
@@ -192,6 +193,7 @@
 #include "chrome/common/webui_url_constants.h"
 #include "chrome/grit/generated_resources.h"
 #include "chrome/installer/util/google_update_settings.h"
+#include "chromeos/components/kiosk/kiosk_utils.h"
 #include "components/autofill/core/common/autofill_switches.h"
 #include "components/blocked_content/popup_blocker.h"
 #include "components/browsing_topics/browsing_topics_service.h"
@@ -207,6 +209,7 @@
 #include "components/dom_distiller/core/dom_distiller_switches.h"
 #include "components/dom_distiller/core/url_constants.h"
 #include "components/embedder_support/content_settings_utils.h"
+#include "components/embedder_support/origin_trials/origin_trials_settings_storage.h"
 #include "components/embedder_support/switches.h"
 #include "components/enterprise/content/clipboard_restriction_service.h"
 #include "components/enterprise/content/pref_names.h"
@@ -482,6 +485,7 @@
 #include "chrome/browser/direct_sockets/chrome_direct_sockets_delegate.h"
 #include "chrome/browser/headless/chrome_browser_main_extra_parts_headless.h"
 #include "chrome/browser/media/unified_autoplay_config.h"
+#include "chrome/browser/metrics/chrome_responsiveness_calculator_delegate.h"
 #include "chrome/browser/new_tab_page/new_tab_page_util.h"
 #include "chrome/browser/page_info/about_this_site_side_panel_throttle.h"
 #include "chrome/browser/search/instant_service.h"
@@ -528,7 +532,7 @@
 
 #if BUILDFLAG(IS_LINUX) || BUILDFLAG(IS_MAC) || BUILDFLAG(IS_WIN)
 #include "chrome/browser/enterprise/chrome_browser_main_extra_parts_enterprise.h"
-#include "chrome/browser/enterprise/profile_token_management/profile_token_navigation_throttle.h"
+#include "chrome/browser/enterprise/profile_management/profile_management_navigation_throttle.h"
 #include "chrome/browser/ui/webui/app_settings/web_app_settings_navigation_throttle.h"
 #endif
 
@@ -677,6 +681,7 @@
 #include "chrome/browser/ui/views/chrome_browser_main_extra_parts_views_lacros.h"
 #include "chrome/common/chrome_descriptors.h"
 #include "chromeos/constants/chromeos_features.h"
+#include "chromeos/crosapi/mojom/kerberos_in_browser.mojom.h"
 #include "chromeos/lacros/lacros_service.h"
 #include "chromeos/startup/browser_init_params.h"
 #include "chromeos/startup/browser_postlogin_params.h"
@@ -1444,31 +1449,6 @@ bool ShouldUseSpareRenderProcessHostForTopChromePage(Profile* profile) {
          !IsTopChromeRendererPresent(profile);
 }
 
-bool DoesGaiaOriginRequireDedicatedProcess() {
-#if !BUILDFLAG(IS_ANDROID)
-  return true;
-#else
-  // Sign-in process isolation is not strictly needed on Android, see
-  // https://crbug.com/739418. On Android, it's more optional but it does
-  // improve security generally and specifically it allows the exposure of
-  // certain optional privileged APIs.
-
-  // Kill switch that falls back to the legacy behavior.
-  if (!base::FeatureList::IsEnabled(kAllowGaiaOriginIsolationOnAndroid)) {
-    return false;
-  }
-
-  if (site_isolation::SiteIsolationPolicy::
-          ShouldDisableSiteIsolationDueToMemoryThreshold(
-              content::SiteIsolationMode::kPartialSiteIsolation)) {
-    // Insufficient memory to isolate Gaia's origin.
-    return false;
-  }
-
-  return true;
-#endif  // !BUILDFLAG(IS_ANDROID)
-}
-
 #if BUILDFLAG(FULL_SAFE_BROWSING)
 
 void HandleExpandedPaths(
@@ -1607,12 +1587,6 @@ void ChromeContentBrowserClient::RegisterLocalStatePrefs(
       prefs::kThrottleNonVisibleCrossOriginIframesAllowed, true);
   registry->RegisterBooleanPref(prefs::kNewBaseUrlInheritanceBehaviorAllowed,
                                 true);
-  registry->RegisterBooleanPref(
-      policy::policy_prefs::kUseMojoVideoDecoderForPepperAllowed, true);
-  registry->RegisterBooleanPref(
-      policy::policy_prefs::kPPAPISharedImagesSwapChainAllowed, true);
-  registry->RegisterBooleanPref(
-      policy::policy_prefs::kForceEnablePepperVideoDecoderDevAPI, false);
 #if BUILDFLAG(IS_LINUX) || BUILDFLAG(IS_ANDROID)
   registry->RegisterBooleanPref(prefs::kOutOfProcessSystemDnsResolutionEnabled,
                                 true);
@@ -1685,6 +1659,7 @@ void ChromeContentBrowserClient::RegisterProfilePrefs(
       policy::policy_prefs::kOffsetParentNewSpecBehaviorEnabled, true);
   registry->RegisterBooleanPref(
       policy::policy_prefs::kSendMouseEventsDisabledFormControlsEnabled, true);
+  registry->RegisterBooleanPref(prefs::kDataUrlInSvgUseEnabled, false);
 
 #if BUILDFLAG(IS_CHROMEOS)
   registry->RegisterListPref(prefs::kMandatoryExtensionsForIncognitoNavigation);
@@ -1893,9 +1868,15 @@ ChromeContentBrowserClient::GetStoragePartitionConfigForSite(
 std::unique_ptr<content::WebContentsViewDelegate>
 ChromeContentBrowserClient::GetWebContentsViewDelegate(
     content::WebContents* web_contents) {
-  if (auto* registry =
+  Profile* profile =
-          performance_manager::PerformanceManagerRegistry::GetInstance()) {
+      Profile::FromBrowserContext(web_contents->GetBrowserContext());
-    registry->MaybeCreatePageNodeForWebContents(web_contents);
+  // Do not track web contents performance for profiles that have Keyed Services
+  // disabled.
+  if (!AreKeyedServicesDisabledForProfileByDefault(profile)) {
+    if (auto* registry =
+            performance_manager::PerformanceManagerRegistry::GetInstance()) {
+      registry->MaybeCreatePageNodeForWebContents(web_contents);
+    }
   }
   return CreateWebContentsViewDelegate(web_contents);
 }
@@ -2250,7 +2231,7 @@ bool ChromeContentBrowserClient::CanCommitURL(
 }
 
 void ChromeContentBrowserClient::OverrideNavigationParams(
-    SiteInstance* site_instance,
+    absl::optional<GURL> source_process_site_url,
     ui::PageTransition* transition,
     bool* is_renderer_initiated,
     content::Referrer* referrer,
@@ -2258,10 +2239,10 @@ void ChromeContentBrowserClient::OverrideNavigationParams(
   DCHECK(transition);
   DCHECK(is_renderer_initiated);
   DCHECK(referrer);
-  // While using SiteInstance::GetSiteURL() is unreliable and the wrong thing to
+  // IsNTPURL only looks at the origin of the parameter, so it is safe to use
-  // use for making security decisions 99.44% of the time, for detecting the NTP
+  // the effective site URL for the source process.
-  // it is reliable and the correct way. See http://crbug.com/624410.
+  if (source_process_site_url &&
-  if (site_instance && search::IsNTPURL(site_instance->GetSiteURL()) &&
+      search::IsNTPURL(source_process_site_url.value()) &&
       ui::PageTransitionCoreTypeIs(*transition, ui::PAGE_TRANSITION_LINK)) {
     // Clicks on tiles of the new tab page should be treated as if a user
     // clicked on a bookmark.  This is consistent with native implementations
@@ -2425,15 +2406,6 @@ void ChromeContentBrowserClient::SiteInstanceGotProcess(
     extra_parts_[i]->SiteInstanceGotProcess(site_instance);
 }
 
-void ChromeContentBrowserClient::SiteInstanceDeleting(
-    SiteInstance* site_instance) {
-  if (!site_instance->HasProcess())
-    return;
-
-  for (size_t i = 0; i < extra_parts_.size(); ++i)
-    extra_parts_[i]->SiteInstanceDeleting(site_instance);
-}
-
 bool ChromeContentBrowserClient::ShouldSwapBrowsingInstancesForNavigation(
     SiteInstance* site_instance,
     const GURL& current_effective_url,
@@ -2518,7 +2490,9 @@ bool ChromeContentBrowserClient::ShouldUrlUseApplicationIsolationLevel(
     return false;
   }
 
-  if (url.SchemeIs(chrome::kIsolatedAppScheme)) {
+  // Convert |url| to an origin to resolve blob: URLs.
+  auto origin = url::Origin::Create(url);
+  if (origin.scheme() == chrome::kIsolatedAppScheme) {
     return true;
   }
 #endif
@@ -2546,11 +2520,10 @@ bool ChromeContentBrowserClient::IsIsolatedContextAllowedForUrl(
 #endif
 }
 
-bool ChromeContentBrowserClient::IsGetDisplayMediaSetSelectAllScreensAllowed(
+bool ChromeContentBrowserClient::IsGetAllScreensMediaAllowed(
     content::BrowserContext* context,
     const url::Origin& origin) {
-  return capture_policy::IsGetDisplayMediaSetSelectAllScreensAllowed(
+  return capture_policy::IsGetAllScreensMediaAllowed(context, origin.GetURL());
-      context, origin.GetURL());
 }
 
 bool ChromeContentBrowserClient::IsFileAccessAllowed(
@@ -2755,6 +2728,10 @@ void ChromeContentBrowserClient::AppendExtraCommandLineSwitches(
         command_line->AppendSwitch(blink::switches::kWebSQLAccess);
       }
 
+      if (prefs->GetBoolean(prefs::kDataUrlInSvgUseEnabled)) {
+        command_line->AppendSwitch(blink::switches::kDataUrlInSvgUseEnabled);
+      }
+
 #if !BUILDFLAG(IS_ANDROID)
       InstantService* instant_service =
           InstantServiceFactory::GetForProfile(profile);
@@ -2938,7 +2915,6 @@ void ChromeContentBrowserClient::AppendExtraCommandLineSwitches(
       switches::kJavaScriptHarmony,
       switches::kEnableExperimentalWebAssemblyFeatures,
       embedder_support::kOriginTrialDisabledFeatures,
-      embedder_support::kOriginTrialDisabledTokens,
       embedder_support::kOriginTrialPublicKey,
       switches::kReaderModeHeuristics,
       translate::switches::kTranslateSecurityOrigin,
@@ -3032,26 +3008,6 @@ void ChromeContentBrowserClient::AppendExtraCommandLineSwitches(
                                     switches::kChangeStackGuardOnForkEnabled);
   }
 #endif  // BUILDFLAG(IS_LINUX) || BUILDFLAG(IS_CHROMEOS)
-  if (process_type != switches::kZygoteProcess) {
-    DCHECK(g_browser_process);
-    PrefService* local_state = g_browser_process->local_state();
-    DCHECK(local_state);
-    if (!local_state->GetBoolean(
-            policy::policy_prefs::kUseMojoVideoDecoderForPepperAllowed)) {
-      command_line->AppendSwitch(
-          ::switches::kDisableUseMojoVideoDecoderForPepper);
-    }
-    if (!local_state->GetBoolean(
-            policy::policy_prefs::kPPAPISharedImagesSwapChainAllowed)) {
-      command_line->AppendSwitch(
-          ::switches::kDisablePPAPISharedImagesSwapChain);
-    }
-    if (local_state->GetBoolean(
-            policy::policy_prefs::kForceEnablePepperVideoDecoderDevAPI)) {
-      command_line->AppendSwitch(
-          ::switches::kForceEnablePepperVideoDecoderDevAPI);
-    }
-  }
 }
 
 std::string
@@ -4174,75 +4130,13 @@ void ChromeContentBrowserClient::OverrideWebkitPrefs(
     web_prefs->immersive_mode_enabled = vr::VrTabHelper::IsInVr(web_contents);
   }
 
-  web_prefs->lazy_load_enabled =
+  if (base::CommandLine::ForCurrentProcess()->HasSwitch(
-      !web_contents || !web_contents->GetDelegate() ||
+          switches::kDisableLazyLoading)) {
-      web_contents->GetDelegate()->ShouldAllowLazyLoad();
+    web_prefs->lazy_load_enabled = false;
-
+  } else {
-  if (base::FeatureList::IsEnabled(features::kLazyFrameLoading)) {
+    web_prefs->lazy_load_enabled =
-    const char* param_name =
+        !web_contents || !web_contents->GetDelegate() ||
-        web_prefs->data_saver_enabled
+        web_contents->GetDelegate()->ShouldAllowLazyLoad();
-            ? "lazy_frame_loading_distance_thresholds_px_by_ect"
-            : "lazy_frame_loading_distance_thresholds_px_by_ect_with_data_"
-              "saver_enabled";
-
-    base::StringPairs pairs;
-    base::SplitStringIntoKeyValuePairs(
-        base::GetFieldTrialParamValueByFeature(features::kLazyFrameLoading,
-                                               param_name),
-        ':', ',', &pairs);
-
-    for (const auto& pair : pairs) {
-      absl::optional<net::EffectiveConnectionType> effective_connection_type =
-          net::GetEffectiveConnectionTypeForName(pair.first);
-      int value = 0;
-      if (effective_connection_type && base::StringToInt(pair.second, &value)) {
-        web_prefs->lazy_frame_loading_distance_thresholds_px[static_cast<
-            EffectiveConnectionType>(effective_connection_type.value())] =
-            value;
-      }
-    }
-  }
-
-  if (base::FeatureList::IsEnabled(features::kLazyImageLoading)) {
-    const char* param_name =
-        web_prefs->data_saver_enabled
-            ? "lazy_image_loading_distance_thresholds_px_by_ect"
-            : "lazy_image_loading_distance_thresholds_px_by_ect_with_data_"
-              "saver_enabled";
-
-    base::StringPairs pairs;
-    base::SplitStringIntoKeyValuePairs(
-        base::GetFieldTrialParamValueByFeature(features::kLazyImageLoading,
-                                               param_name),
-        ':', ',', &pairs);
-
-    for (const auto& pair : pairs) {
-      absl::optional<net::EffectiveConnectionType> effective_connection_type =
-          net::GetEffectiveConnectionTypeForName(pair.first);
-      int value = 0;
-      if (effective_connection_type && base::StringToInt(pair.second, &value)) {
-        web_prefs->lazy_image_loading_distance_thresholds_px[static_cast<
-            EffectiveConnectionType>(effective_connection_type.value())] =
-            value;
-      }
-    }
-
-    pairs.clear();
-    base::SplitStringIntoKeyValuePairs(
-        base::GetFieldTrialParamValueByFeature(features::kLazyImageLoading,
-                                               "lazy_image_first_k_fully_load"),
-        ':', ',', &pairs);
-
-    for (const auto& pair : pairs) {
-      absl::optional<net::EffectiveConnectionType> effective_connection_type =
-          net::GetEffectiveConnectionTypeForName(pair.first);
-      int value = 0;
-      if (effective_connection_type && base::StringToInt(pair.second, &value)) {
-        web_prefs->lazy_image_first_k_fully_load[static_cast<
-            EffectiveConnectionType>(effective_connection_type.value())] =
-            value;
-      }
-    }
   }
 
   if (base::FeatureList::IsEnabled(
@@ -4721,7 +4615,6 @@ std::wstring ChromeContentBrowserClient::GetAppContainerSidForSandboxType(
     case sandbox::mojom::Sandbox::kIconReader:
     case sandbox::mojom::Sandbox::kMediaFoundationCdm:
     case sandbox::mojom::Sandbox::kWindowsSystemProxyResolver:
-    case sandbox::mojom::Sandbox::kFileUtil:
       // Should never reach here.
       CHECK(0);
       return std::wstring();
@@ -4811,7 +4704,6 @@ bool ChromeContentBrowserClient::PreSpawnChild(
     case sandbox::mojom::Sandbox::kIconReader:
     case sandbox::mojom::Sandbox::kMediaFoundationCdm:
     case sandbox::mojom::Sandbox::kWindowsSystemProxyResolver:
-    case sandbox::mojom::Sandbox::kFileUtil:
       break;
   }
 
@@ -4852,11 +4744,15 @@ bool ChromeContentBrowserClient::PreSpawnChild(
 
 bool ChromeContentBrowserClient::IsRendererCodeIntegrityEnabled() {
   PrefService* local_state = g_browser_process->local_state();
-  if (local_state &&
+
-      local_state->HasPrefPath(prefs::kRendererCodeIntegrityEnabled) &&
+  // Code integrity defaults to enabled, unless specifically overridden by a
-      !local_state->GetBoolean(prefs::kRendererCodeIntegrityEnabled))
+  // policy controlled pref being set to false.
-    return false;
+  const bool is_code_integrity_enabled =
-  return true;
+      !local_state->HasPrefPath(prefs::kRendererCodeIntegrityEnabled) ||
+      local_state->GetBoolean(prefs::kRendererCodeIntegrityEnabled);
+  base::UmaHistogramBoolean("Windows.RendererCodeIntegrityEnabled",
+                            is_code_integrity_enabled);
+  return is_code_integrity_enabled;
 }
 
 // Note: Only use sparingly to add Chrome specific sandbox functionality here.
@@ -5101,7 +4997,7 @@ ChromeContentBrowserClient::CreateThrottlesForNavigation(
   MaybeAddThrottle(
       WebAppSettingsNavigationThrottle::MaybeCreateThrottleFor(handle),
       &throttles);
-  MaybeAddThrottle(profile_token_management::ProfileTokenNavigationThrottle::
+  MaybeAddThrottle(profile_management::ProfileManagementNavigationThrottle::
                        MaybeCreateThrottleFor(handle),
                    &throttles);
 #endif  // BUILDFLAG(IS_LINUX) || BUILDFLAG(IS_MAC) || BUILDFLAG(IS_WIN)
@@ -6114,7 +6010,8 @@ ChromeContentBrowserClient::WillCreateURLLoaderRequestInterceptors(
 
   if (base::FeatureList::IsEnabled(features::kHttpsFirstModeV2)) {
     auto https_upgrades_interceptor =
-        HttpsUpgradesInterceptor::MaybeCreateInterceptor(frame_tree_node_id);
+        HttpsUpgradesInterceptor::MaybeCreateInterceptor(frame_tree_node_id,
+                                                         navigation_ui_data);
     if (https_upgrades_interceptor) {
       interceptors.push_back(std::move(https_upgrades_interceptor));
     }
@@ -6480,7 +6377,7 @@ ChromeContentBrowserClient::CreateLoginDelegate(
     scoped_refptr<net::HttpResponseHeaders> response_headers,
     bool first_auth_attempt,
     LoginAuthRequiredCallback auth_required_callback) {
-#if BUILDFLAG(IS_CHROMEOS_ASH)
+#if BUILDFLAG(IS_CHROMEOS)
   // Negotiate challenge is handled via GSSAPI library, which can not receive
   // external credentials. However, on ChromeOS we can suggest the user to
   // create a TGT using their credentials. Note that the credentials are NOT
@@ -6489,10 +6386,19 @@ ChromeContentBrowserClient::CreateLoginDelegate(
   if (base::FeatureList::IsEnabled(net::features::kKerberosInBrowserRedirect) &&
       auth_info.scheme ==
           net::HttpAuth::SchemeToString(net::HttpAuth::AUTH_SCHEME_NEGOTIATE)) {
+#if BUILDFLAG(IS_CHROMEOS_ASH)
     ash::KerberosInBrowserDialog::Show();
+#else
+    // Requests to show Kerberos ui via crosapi mojo call.
+    chromeos::LacrosService::Get()
+        ->GetRemote<crosapi::mojom::KerberosInBrowser>()
+        ->ShowKerberosInBrowserDialog();
+#endif  // BUILDFLAG(IS_CHROMEOS_ASH)
     return nullptr;
   }
+#endif  // BUILDFLAG(IS_CHROMEOS)
 
+#if BUILDFLAG(IS_CHROMEOS_ASH)
   auto* system_proxy_manager = ash::SystemProxyManager::Get();
   // For Managed Guest Session and Kiosk devices, the credentials configured
   // via the policy SystemProxySettings may be used for proxy authentication.
@@ -6647,8 +6553,8 @@ bool ChromeContentBrowserClient::HandleWebUI(
 
   if (!ChromeWebUIControllerFactory::GetInstance()->UseWebUIForURL(
           browser_context, *url) &&
-      !content::WebUIConfigMap::GetInstance().GetConfig(
+      !content::WebUIConfigMap::GetInstance().GetConfig(browser_context,
-          browser_context, url::Origin::Create(*url))) {
+                                                        *url)) {
     return false;
   }
 
@@ -6882,7 +6788,7 @@ void ChromeContentBrowserClient::LogWebFeatureForCurrentPage(
 }
 
 std::string ChromeContentBrowserClient::GetProduct() {
-  return version_info::GetProductNameAndVersionForUserAgent();
+  return std::string(version_info::GetProductNameAndVersionForUserAgent());
 }
 
 std::string ChromeContentBrowserClient::GetUserAgent() {
@@ -6952,10 +6858,23 @@ bool ChromeContentBrowserClient::IsBuiltinComponent(
 
 bool ChromeContentBrowserClient::ShouldBlockRendererDebugURL(
     const GURL& url,
-    content::BrowserContext* context) {
+    content::BrowserContext* context,
+    content::RenderFrameHost* render_frame_host) {
+#if !BUILDFLAG(IS_ANDROID)
+  // If devtools access is blocked for the page, debug URLs should also be
+  // blocked for the page.
+  Profile* profile = Profile::FromBrowserContext(context);
+  content::WebContents* web_contents =
+      content::WebContents::FromRenderFrameHost(render_frame_host);
+  if (!DevToolsWindow::AllowDevToolsFor(profile, web_contents)) {
+    return true;
+  }
+#endif
+
+  // If the debug URL being visited is listed in the URLBlocklist policy it
+  // should be blocked.
   PolicyBlocklistService* service =
       PolicyBlocklistFactory::GetForBrowserContext(context);
-
   using URLBlocklistState = policy::URLBlocklist::URLBlocklistState;
   URLBlocklistState blocklist_state = service->GetURLBlocklistState(url);
   return blocklist_state == URLBlocklistState::URL_IN_BLOCKLIST;
@@ -7076,6 +6995,19 @@ bool ChromeContentBrowserClient::HandleTopicsWebApi(
   return allowed;
 }
 
+int ChromeContentBrowserClient::NumVersionsInTopicsEpochs(
+    content::RenderFrameHost* main_frame) const {
+  browsing_topics::BrowsingTopicsService* browsing_topics_service =
+      browsing_topics::BrowsingTopicsServiceFactory::GetForProfile(
+          Profile::FromBrowserContext(
+              content::WebContents::FromRenderFrameHost(main_frame)
+                  ->GetBrowserContext()));
+
+  CHECK(browsing_topics_service);
+  return browsing_topics_service->NumVersionsInEpochs(
+      main_frame->GetLastCommittedOrigin());
+}
+
 bool ChromeContentBrowserClient::IsBluetoothScanningBlocked(
     content::BrowserContext* browser_context,
     const url::Origin& requesting_origin,
@@ -7169,8 +7101,10 @@ bool ChromeContentBrowserClient::IsClipboardPasteAllowed(
 
   // or (4) origination from a process that at least might be running a
   // content script from an extension with the clipboardRead permission.
-  extensions::ExtensionIdSet extension_ids =
+  // Note that we currently don't allow clipboard operations based just on user
-      extensions::ContentScriptTracker::GetExtensionsThatRanScriptsInProcess(
+  // script injections.
+  extensions::ExtensionIdSet extension_ids = extensions::ContentScriptTracker::
+      GetExtensionsThatRanContentScriptsInProcess(
           *render_frame_host->GetProcess());
   for (const auto& extension_id : extension_ids) {
     const Extension* extension =
@@ -7192,14 +7126,6 @@ void ChromeContentBrowserClient::IsClipboardPasteContentAllowed(
     ClipboardPasteData clipboard_paste_data,
     IsClipboardPasteContentAllowedCallback callback) {
 #if BUILDFLAG(FULL_SAFE_BROWSING)
-  // Safe browsing does not support images, so accept without checking.
-  // TODO(crbug.com/1013584): check policy on what to do about unsupported
-  // types when it is implemented.
-  if (data_type == ui::ClipboardFormatType::BitmapType()) {
-    std::move(callback).Run(std::move(clipboard_paste_data));
-    return;
-  }
-
   Profile* profile =
       Profile::FromBrowserContext(web_contents->GetBrowserContext());
   bool is_files = data_type == ui::ClipboardFormatType::FilenamesType();
@@ -7228,8 +7154,11 @@ void ChromeContentBrowserClient::IsClipboardPasteContentAllowed(
                                         std::move(dialog_data), connector,
                                         std::move(paths), std::move(callback)));
   } else {
-    // TODO(b/261589323): Pass additional info when we send data to local agent.
     dialog_data.text.push_back(clipboard_paste_data.text);
+    // Send image only to local agent for analysis.
+    if (dialog_data.settings.cloud_or_local_settings.is_local_analysis()) {
+      dialog_data.image = std::move(clipboard_paste_data.image);
+    }
     HandleStringData(web_contents, std::move(dialog_data), connector,
                      std::move(callback));
   }
@@ -7327,6 +7256,11 @@ ukm::UkmService* ChromeContentBrowserClient::GetUkmService() {
   return g_browser_process->GetMetricsServicesManager()->GetUkmService();
 }
 
+blink::mojom::OriginTrialsSettingsPtr
+ChromeContentBrowserClient::GetOriginTrialsSettings() {
+  return g_browser_process->GetOriginTrialsSettingsStorage()->GetSettings();
+}
+
 void ChromeContentBrowserClient::OnKeepaliveRequestStarted(
     content::BrowserContext* context) {
 #if !BUILDFLAG(IS_ANDROID)
@@ -7622,7 +7556,7 @@ bool ChromeContentBrowserClient::OpenExternally(
     return false;
   }
 
-  if (profiles::IsKioskSession()) {
+  if (chromeos::IsKioskSession()) {
     // Kiosk sessions already hide the navigation bar and block window creation.
     // Moreover, they don't support SWAs which we might end up trying to run
     // below.
@@ -7697,26 +7631,14 @@ bool ChromeContentBrowserClient::OpenExternally(
   // crash dump for various cases so that we can better understand the
   // situation. For now, continue as usual afterwards (i.e. don't handle the
   // request here).
-  if (is_lacros_only) {
+  if (is_lacros_only &&
-    size_t id = 0;
-    if (url.SchemeIs(content::kChromeDevToolsScheme)) {
-      id = 1;
-    } else if (url.SchemeIs(content::kChromeUIUntrustedScheme) &&
-               (!url.has_host() || url.host() != "terminal")) {
-      id = 2;
-    } else if (url.SchemeIs(content::kChromeUIScheme)) {
-      id = 3;
-    } else if (url.SchemeIs(extensions::kExtensionScheme)) {
-      id = 4;
-    } else {
       // We know that Terminal still needs to open Ash windows, no need to dump.
-      DCHECK(url.SchemeIs(content::kChromeUIUntrustedScheme));
+      !(url.SchemeIs(content::kChromeUIUntrustedScheme) && url.has_host() &&
-      DCHECK(url.host() == "terminal");
+        url.host() == "terminal")) {
-    }
+    SCOPED_CRASH_KEY_STRING32("CCBC", "OpenExternally",
-    if (id > 0) {
+                              url.possibly_invalid_spec());
-      base::debug::DumpWithoutCrashingWithUniqueId(id);
+    base::debug::DumpWithoutCrashing();
-      LOG(WARNING) << "Allowing Ash window creation for url " << url;
+    LOG(WARNING) << "Allowing Ash window creation for url " << url;
-    }
   }
 #endif  // BUILDFLAG(IS_CHROMEOS_ASH)
 
@@ -7831,3 +7753,38 @@ bool ChromeContentBrowserClient::ShouldUseFirstPartyStorageKey(
   return false;
 #endif  // BUILDFLAG(ENABLE_EXTENSIONS)
 }
+
+std::unique_ptr<content::ResponsivenessCalculatorDelegate>
+ChromeContentBrowserClient::CreateResponsivenessCalculatorDelegate() {
+#if !BUILDFLAG(IS_ANDROID)
+  return ChromeResponsivenessCalculatorDelegate::Create();
+#else
+  return nullptr;
+#endif
+}
+
+// static
+bool ChromeContentBrowserClient::DoesGaiaOriginRequireDedicatedProcess() {
+#if !BUILDFLAG(IS_ANDROID)
+  return true;
+#else
+  // Sign-in process isolation is not strictly needed on Android, see
+  // https://crbug.com/739418. On Android, it's more optional but it does
+  // improve security generally and specifically it allows the exposure of
+  // certain optional privileged APIs.
+
+  // Kill switch that falls back to the legacy behavior.
+  if (!base::FeatureList::IsEnabled(kAllowGaiaOriginIsolationOnAndroid)) {
+    return false;
+  }
+
+  if (site_isolation::SiteIsolationPolicy::
+          ShouldDisableSiteIsolationDueToMemoryThreshold(
+              content::SiteIsolationMode::kPartialSiteIsolation)) {
+    // Insufficient memory to isolate Gaia's origin.
+    return false;
+  }
+
+  return true;
+#endif  // !BUILDFLAG(IS_ANDROID)
+}

src/chrome/browser/ui/browser_commands.cc

@@ -8,6 +8,7 @@
 #include <utility>
 #include <vector>
 
+#include "base/check.h"
 #include "base/command_line.h"
 #include "base/feature_list.h"
 #include "base/memory/scoped_refptr.h"
@@ -51,6 +52,7 @@
 #include "chrome/browser/ui/accelerator_utils.h"
 #include "chrome/browser/ui/autofill/payments/iban_bubble_controller_impl.h"
 #include "chrome/browser/ui/autofill/payments/manage_migration_ui_controller.h"
+#include "chrome/browser/ui/autofill/payments/mandatory_reauth_bubble_controller_impl.h"
 #include "chrome/browser/ui/autofill/payments/offer_notification_bubble_controller_impl.h"
 #include "chrome/browser/ui/autofill/payments/save_card_bubble_controller_impl.h"
 #include "chrome/browser/ui/autofill/payments/virtual_card_enroll_bubble_controller_impl.h"
@@ -90,10 +92,7 @@
 #include "chrome/browser/ui/tabs/tab_group.h"
 #include "chrome/browser/ui/tabs/tab_group_model.h"
 #include "chrome/browser/ui/tabs/tab_strip_user_gesture_details.h"
-#include "chrome/browser/ui/translate/translate_bubble_ui_action_logger.h"
 #include "chrome/browser/ui/ui_features.h"
-#include "chrome/browser/ui/user_education/reopen_tab_in_product_help.h"
-#include "chrome/browser/ui/user_education/reopen_tab_in_product_help_factory.h"
 #include "chrome/browser/ui/web_applications/app_browser_controller.h"
 #include "chrome/browser/upgrade_detector/upgrade_detector.h"
 #include "chrome/browser/web_applications/web_app_constants.h"
@@ -206,23 +205,6 @@ const char kChPlatformOverrideForTabletSite[] = "Android";
 const char kBackForwardNavigationIsTriggered[] =
     "back_forward_navigation_is_triggered";
 
-translate::TranslateBubbleUiEvent TranslateBubbleResultToUiEvent(
-    ShowTranslateBubbleResult result) {
-  switch (result) {
-    default:
-      NOTREACHED();
-      [[fallthrough]];
-    case ShowTranslateBubbleResult::SUCCESS:
-      return translate::TranslateBubbleUiEvent::BUBBLE_SHOWN;
-    case ShowTranslateBubbleResult::BROWSER_WINDOW_MINIMIZED:
-      return translate::TranslateBubbleUiEvent::
-          BUBBLE_NOT_SHOWN_WINDOW_MINIMIZED;
-    case ShowTranslateBubbleResult::EDITABLE_FIELD_IS_ACTIVE:
-      return translate::TranslateBubbleUiEvent::
-          BUBBLE_NOT_SHOWN_EDITABLE_FIELD_IS_ACTIVE;
-  }
-}
-
 // Creates a new tabbed browser window, with the same size, type and profile as
 // |original_browser|'s window, inserts |contents| into it, and shows it.
 void CreateAndShowNewWindowWithContents(
@@ -430,10 +412,10 @@ bool IsShowingWebContentsModalDialog(Browser* browser) {
 bool PrintPreviewShowing(const Browser* browser) {
 #if BUILDFLAG(ENABLE_PRINT_PREVIEW)
   WebContents* contents = browser->tab_strip_model()->GetActiveWebContents();
-  printing::PrintPreviewDialogController* controller =
+  auto* controller = printing::PrintPreviewDialogController::GetInstance();
-      printing::PrintPreviewDialogController::GetInstance();
+  CHECK(controller);
-  return controller && (controller->GetPrintPreviewForContents(contents) ||
+  return controller->GetPrintPreviewForContents(contents) ||
-                        controller->is_creating_print_preview_dialog());
+         controller->is_creating_print_preview_dialog();
 #else
   return false;
 #endif
@@ -788,6 +770,8 @@ base::WeakPtr<content::NavigationHandle> OpenCurrentURL(Browser* browser) {
   params.input_start = location_bar->GetMatchSelectionTimestamp();
   params.is_using_https_as_default_scheme =
       location_bar->IsInputTypedUrlWithoutScheme();
+  params.url_typed_with_http_scheme =
+      location_bar->IsInputTypedUrlWithHttpScheme();
   auto result = Navigate(&params);
 
 #if BUILDFLAG(ENABLE_EXTENSIONS)
@@ -870,11 +854,6 @@ void NewTab(Browser* browser) {
   UMA_HISTOGRAM_ENUMERATION("Tab.NewTab", NewTabTypes::NEW_TAB_COMMAND,
                             NewTabTypes::NEW_TAB_ENUM_COUNT);
 
-  // Notify IPH that new tab was opened.
-  auto* reopen_tab_iph =
-      ReopenTabInProductHelpFactory::GetForProfile(browser->profile());
-  reopen_tab_iph->NewTabOpened();
-
   if (browser->SupportsWindowFeature(Browser::FEATURE_TABSTRIP)) {
     AddTabAt(browser, GURL(), -1, true);
   } else {
@@ -1378,6 +1357,15 @@ void SaveIBAN(Browser* browser) {
   controller->ReshowBubble();
 }
 
+void ShowMandatoryReauthOptInPrompt(Browser* browser) {
+  WebContents* web_contents =
+      browser->tab_strip_model()->GetActiveWebContents();
+  autofill::MandatoryReauthBubbleControllerImpl* controller =
+      autofill::MandatoryReauthBubbleControllerImpl::FromWebContents(
+          web_contents);
+  controller->ReshowBubble();
+}
+
 void MigrateLocalCards(Browser* browser) {
   WebContents* web_contents =
       browser->tab_strip_model()->GetActiveWebContents();
@@ -1439,12 +1427,9 @@ void Translate(Browser* browser) {
     else if (chrome_translate_client->GetLanguageState().IsPageTranslated())
       step = translate::TRANSLATE_STEP_AFTER_TRANSLATE;
   }
-  ShowTranslateBubbleResult result = browser->window()->ShowTranslateBubble(
+  browser->window()->ShowTranslateBubble(
       web_contents, step, source_language, target_language,
       translate::TranslateErrors::NONE, true);
-  if (result != ShowTranslateBubbleResult::SUCCESS)
-    translate::ReportTranslateBubbleUiAction(
-        TranslateBubbleResultToUiEvent(result));
 }
 
 void ManagePasswordsForPage(Browser* browser) {
@@ -1522,9 +1507,12 @@ void Print(Browser* browser) {
 #if BUILDFLAG(ENABLE_PRINTING)
   auto* web_contents = browser->tab_strip_model()->GetActiveWebContents();
   printing::StartPrint(
-      web_contents, mojo::NullAssociatedRemote() /* print_renderer */,
+      web_contents,
+#if BUILDFLAG(IS_CHROMEOS_ASH)
+      /*print_renderer=*/mojo::NullAssociatedRemote(),
+#endif
       browser->profile()->GetPrefs()->GetBoolean(prefs::kPrintPreviewDisabled),
-      false /* has_selection? */);
+      /*has_selection=*/false);
 #endif
 }
 
@@ -1709,8 +1697,8 @@ void OpenTaskManager(Browser* browser) {
 #if BUILDFLAG(IS_CHROMEOS_LACROS)
   // Open linux version of task manager UI if ash TaskManager
   // interface is in an old version.
-  if (chromeos::LacrosService::Get()->GetInterfaceVersion(
+  if (chromeos::LacrosService::Get()
-          crosapi::mojom::TaskManager::Uuid_) < 1) {
+          ->GetInterfaceVersion<crosapi::mojom::TaskManager>() < 1) {
     base::RecordAction(UserMetricsAction("TaskManager"));
     chrome::ShowTaskManager(browser);
     return;

src/chrome/installer/setup/install_worker.cc

@@ -690,6 +690,7 @@ std::wstring GetUpdatedBrandCode(const std::wstring& brand_code) {
   } kEnterpriseBrandRemapping[] = {
       {L"GGLS", L"GCEU"},
       {L"GGRV", L"GCEV"},
+      {L"GTPM", L"GCER"},
   };
 
   for (auto mapping : kEnterpriseBrandRemapping) {

src/components/BUILD.gn

@@ -264,13 +264,9 @@ test("components_unittests") {
   }
 
   if (build_allocation_stack_trace_recorder) {
-    deps += [ "//components/allocation_recorder/crash_client:unit_tests" ]
-  }
-
-  if (!is_ios) {
     deps += [
-      "//components/file_access:unit_tests",
+      "//components/allocation_recorder/crash_client:unit_tests",
-      "//components/webauthn/json:unit_tests",
+      "//components/allocation_recorder/crash_handler:unit_tests",
     ]
   }
 
@@ -321,8 +317,83 @@ test("components_unittests") {
     ]
   }
 
+  if (use_blink) {
+    deps += [
+      "//components/autofill/content/browser:unit_tests",
+      "//components/autofill/content/renderer:unit_tests",
+      "//components/autofill/core/common/mojom:unit_tests",
+      "//components/browsing_data/content:unit_tests",
+      "//components/captive_portal/content:unit_tests",
+      "//components/cast_receiver:unit_tests",
+      "//components/cast_streaming:unit_tests",
+      "//components/content_capture/browser:unit_tests",
+      "//components/content_relationship_verification:unit_tests",
+      "//components/contextual_search/core/browser:unit_tests",
+      "//components/continuous_search/browser:unit_tests",
+      "//components/continuous_search/common:unit_tests",
+      "//components/custom_handlers:unit_tests",
+      "//components/devtools/simple_devtools_protocol_client:unit_tests",
+      "//components/discardable_memory/client:unit_tests",
+      "//components/discardable_memory/common:unit_tests",
+      "//components/discardable_memory/service:unit_tests",
+      "//components/dom_distiller/content/browser:unit_tests",
+      "//components/domain_reliability:unit_tests",
+      "//components/drive:unit_tests",
+      "//components/embedder_support:unit_tests",
+      "//components/endpoint_fetcher:unit_tests",
+      "//components/enterprise/content:unit_tests",
+      "//components/favicon/content:unit_tests",
+      "//components/feed:unit_tests",
+      "//components/file_access:unit_tests",
+      "//components/gcm_driver/instance_id:unit_tests",
+      "//components/heavy_ad_intervention:unit_tests",
+      "//components/history/content/browser:unit_tests",
+      "//components/history_clusters/core:unit_tests",
+      "//components/history_clusters/ui:unit_tests",
+      "//components/invalidation/impl:unit_tests",
+      "//components/javascript_dialogs:unit_tests",
+      "//components/js_injection/common:unit_tests",
+      "//components/keyed_service/content:unit_tests",
+      "//components/link_header_util:unit_tests",
+      "//components/mirroring:mirroring_tests",
+      "//components/navigation_interception:unit_tests",
+      "//components/no_state_prefetch/browser:unit_tests",
+      "//components/optimization_guide/content/browser:unit_tests",
+      "//components/optimization_guide/content/renderer:unit_tests",
+      "//components/origin_trials:unit_tests",
+      "//components/page_image_annotation/content/renderer:unit_tests",
+      "//components/page_image_annotation/core:unit_tests",
+      "//components/page_info/core:unit_tests",
+      "//components/paint_preview/browser:unit_tests",
+      "//components/paint_preview/common:unit_tests",
+      "//components/paint_preview/player:unit_tests",
+      "//components/paint_preview/renderer:unit_tests",
+      "//components/payments/content:unit_tests",
+      "//components/payments/content/utility:unit_tests",
+      "//components/policy/content:unit_tests",
+      "//components/query_tiles:unit_tests",
+      "//components/reporting/resources:unit_tests",
+      "//components/services/heap_profiling:unit_tests",
+      "//components/tracing:unit_tests",
+      "//components/translate/content/browser:unit_tests",
+      "//components/translate/content/renderer:unit_tests",
+      "//components/ukm/content:unit_tests",
+      "//components/url_rewrite:unit_tests",
+      "//components/user_education/common:unit_tests",
+      "//components/visitedlink/test:unit_tests",
+      "//components/web_cache/browser:unit_tests",
+      "//components/webapps/services/web_app_origin_association:unit_tests",
+      "//components/webauthn/json:unit_tests",
+      "//components/webrtc:unit_tests",
+      "//components/webrtc_logging:unit_tests",
+      "//components/webrtc_logging/browser:unit_tests",
+      "//components/webrtc_logging/common:unit_tests",
+    ]
+  }
+
   if (is_ios) {
     deps += [
+      ":components_tests_pak_bundle_data",
       "//components/autofill/ios/browser:unit_tests",
       "//components/autofill/ios/form_util:unit_tests",
       "//components/crash/core/app:unit_tests",
@@ -342,83 +413,30 @@ test("components_unittests") {
     ]
   } else {  #!is_ios
     deps += [
-      "//components/autofill/content/browser:unit_tests",
-      "//components/autofill/content/renderer:unit_tests",
-      "//components/autofill/core/common/mojom:unit_tests",
       "//components/background_sync:unit_tests",
       "//components/blocked_content:unit_tests",
-      "//components/browsing_data/content:unit_tests",
       "//components/browsing_topics:unit_tests",
       "//components/browsing_topics/common:unit_tests",
-      "//components/captive_portal/content:unit_tests",
-      "//components/cast_receiver:unit_tests",
-      "//components/cast_streaming:unit_tests",
       "//components/certificate_transparency:unit_tests",
-      "//components/content_capture/browser:unit_tests",
-      "//components/content_relationship_verification:unit_tests",
       "//components/content_settings/browser:unit_tests",
-      "//components/contextual_search/core/browser:unit_tests",
-      "//components/continuous_search/browser:unit_tests",
-      "//components/continuous_search/common:unit_tests",
-      "//components/custom_handlers:unit_tests",
-      "//components/devtools/simple_devtools_protocol_client:unit_tests",
-      "//components/discardable_memory/client:unit_tests",
-      "//components/discardable_memory/common:unit_tests",
-      "//components/discardable_memory/service:unit_tests",
-      "//components/dom_distiller/content/browser:unit_tests",
-      "//components/domain_reliability:unit_tests",
-      "//components/drive:unit_tests",
-      "//components/embedder_support:unit_tests",
-      "//components/endpoint_fetcher:unit_tests",
-      "//components/enterprise/content:unit_tests",
-      "//components/favicon/content:unit_tests",
-      "//components/feed:unit_tests",
-      "//components/gcm_driver/instance_id:unit_tests",
-      "//components/heavy_ad_intervention:unit_tests",
-      "//components/history/content/browser:unit_tests",
-      "//components/history_clusters/core:unit_tests",
-      "//components/history_clusters/ui:unit_tests",
-      "//components/invalidation/impl:unit_tests",
-      "//components/javascript_dialogs:unit_tests",
-      "//components/js_injection/common:unit_tests",
-      "//components/keyed_service/content:unit_tests",
       "//components/language/content/browser:unit_tests",
-      "//components/link_header_util:unit_tests",
       "//components/media_router/browser:unit_tests",
       "//components/media_router/common:unit_tests",
       "//components/media_router/common/providers/cast/channel:unit_tests",
-      "//components/mirroring:mirroring_tests",
-      "//components/navigation_interception:unit_tests",
-      "//components/no_state_prefetch/browser:unit_tests",
       "//components/offline_pages:unit_tests",
-      "//components/optimization_guide/content/browser:unit_tests",
-      "//components/optimization_guide/content/renderer:unit_tests",
-      "//components/origin_trials:unit_tests",
-      "//components/page_image_annotation/content/renderer:unit_tests",
-      "//components/page_image_annotation/core:unit_tests",
-      "//components/page_info/core:unit_tests",
       "//components/page_load_metrics/browser:unit_tests",
       "//components/page_load_metrics/browser/observers/ad_metrics:unit_tests",
       "//components/page_load_metrics/renderer:unit_tests",
-      "//components/paint_preview/browser:unit_tests",
-      "//components/paint_preview/common:unit_tests",
-      "//components/paint_preview/player:unit_tests",
-      "//components/paint_preview/renderer:unit_tests",
       "//components/password_manager/content/browser:unit_tests",
       "//components/password_manager/services/csv_password:unit_tests",
-      "//components/payments/content:unit_tests",
-      "//components/payments/content/utility:unit_tests",
       "//components/performance_manager:unit_tests",
       "//components/permissions:unit_tests",
       "//components/permissions/prediction_service:unit_tests",
-      "//components/policy/content:unit_tests",
       "//components/privacy_sandbox:unit_tests",
-      "//components/query_tiles:unit_tests",
       "//components/session_proto_db:unit_tests",
 
       # TODO(chromium: 1169835) components / reporting / storage / resources: unit_tests
       # can't be run on iOS until they are updated.
-      "//components/reporting/resources:unit_tests",
       "//components/safe_browsing/content/browser/password_protection:password_protection_unittest",
       "//components/safe_browsing/content/browser/triggers:unit_tests",
       "//components/safe_browsing/content/browser/web_ui:unit_tests",
@@ -440,24 +458,11 @@ test("components_unittests") {
       "//components/subresource_filter/content/browser:unit_tests",
       "//components/subresource_filter/content/common:unit_tests",
       "//components/subresource_filter/content/renderer:unit_tests",
-      "//components/tracing:unit_tests",
-      "//components/translate/content/browser:unit_tests",
-      "//components/translate/content/renderer:unit_tests",
-      "//components/ukm/content:unit_tests",
-      "//components/url_rewrite:unit_tests",
-      "//components/user_education/common:unit_tests",
       "//components/value_store:unit_tests",
-      "//components/visitedlink/test:unit_tests",
-      "//components/web_cache/browser:unit_tests",
       "//components/web_package:unit_tests",
       "//components/web_package/test_support:unit_tests",
       "//components/webapps/browser:unit_tests",
-      "//components/webapps/services/web_app_origin_association:unit_tests",
       "//components/webcrypto:unit_tests",
-      "//components/webrtc:unit_tests",
-      "//components/webrtc_logging:unit_tests",
-      "//components/webrtc_logging/browser:unit_tests",
-      "//components/webrtc_logging/common:unit_tests",
     ]
 
     if (!is_win) {  #!iOS and!Windows
@@ -478,14 +483,6 @@ test("components_unittests") {
     ]
   }  # iOS / !iOS
 
-  if (use_blink) {
-    deps += [ "//components/services/heap_profiling:unit_tests" ]
-  }
-
-  if (is_ios) {
-    deps += [ ":components_tests_pak_bundle_data" ]
-  }
-
   if (is_mac || is_linux || is_chromeos) {
     data_deps += [ "//content/shell:pak" ]
   }
@@ -531,6 +528,7 @@ test("components_unittests") {
       "//components/variations/android:variations_java",
       "//components/webapps/browser/android:java",
       "//components/webapps/browser/android:unit_tests",
+      "//components/webauthn/android:unit_tests",
       "//content/public/android:content_java",
       "//content/public/browser",
       "//gin:v8_snapshot_assets",
@@ -667,7 +665,10 @@ test("components_unittests") {
       "//components/safe_browsing/core/common:unit_tests",
     ]
   } else if (safe_browsing_mode == 2) {
-    deps += [ "//components/safe_browsing/android:unit_tests_mobile" ]
+    deps += [
+      "//components/safe_browsing/android:native_java_unittests_java",
+      "//components/safe_browsing/android:unit_tests_mobile",
+    ]
   }
 
   if (safe_browsing_mode == 1) {
@@ -822,13 +823,16 @@ if (use_blink) {
       "dom_distiller/content/browser/test/dom_distiller_js_browsertest.cc",
       "dom_distiller/content/browser/test/test_util.cc",
       "dom_distiller/content/browser/test/test_util.h",
-      "metrics/content/subprocess_metrics_provider_browsertest.cc",
       "optimization_guide/content/renderer/page_text_agent_browsertest.cc",
       "paint_preview/renderer/paint_preview_recorder_browsertest.cc",
       "ukm/content/source_url_recorder_browsertest.cc",
       "url_rewrite/browser/url_request_rewrite_rules_manager_browsertest.cc",
     ]
 
+    if (is_android && target_cpu == "arm64") {
+      sources += [ "memory_system/memory_system_tests.cc" ]
+    }
+
     data = [
       "$root_out_dir/components_tests_resources.pak",
       "$root_out_dir/content_shell.pak",
@@ -1023,7 +1027,6 @@ if (use_blink) {
   test("components_perftests") {
     sources = [
       "discardable_memory/common/discardable_shared_memory_heap_perftest.cc",
-      "leveldb_proto/internal/proto_database_perftest.cc",
       "omnibox/browser/history_quick_provider_performance_unittest.cc",
       "subresource_filter/core/common/perftests/indexed_ruleset_perftest.cc",
       "test/run_all_perftests.cc",
@@ -1035,8 +1038,6 @@ if (use_blink) {
       "//components/bookmarks/test",
       "//components/discardable_memory/common",
       "//components/history/core/test",
-      "//components/leveldb_proto",
-      "//components/leveldb_proto/testing/proto",
       "//components/omnibox/browser",
       "//components/omnibox/browser:test_support",
       "//components/subresource_filter/core/common",

src/components/bookmarks/browser/bookmark_utils.cc

@@ -15,6 +15,7 @@
 #include "base/functional/bind.h"
 #include "base/i18n/case_conversion.h"
 #include "base/i18n/string_search.h"
+#include "base/metrics/user_metrics.h"
 #include "base/metrics/user_metrics_action.h"
 #include "base/ranges/algorithm.h"
 #include "base/strings/string_util.h"
@@ -184,6 +185,24 @@ void GetBookmarksMatchingPropertiesImpl(
   }
 }
 
+template <class Comparator>
+void GetMostRecentEntries(
+    BookmarkModel* model,
+    size_t limit,
+    std::multiset<const BookmarkNode*, Comparator>* nodes_set) {
+  ui::TreeNodeIterator<const BookmarkNode> iterator(model->root_node());
+  while (iterator.has_next()) {
+    const BookmarkNode* node = iterator.Next();
+    if (node->is_url()) {
+      nodes_set->insert(node);
+      if (nodes_set->size() > limit) {
+        nodes_set->erase(std::next(nodes_set->begin(), limit),
+                         nodes_set->end());
+      }
+    }
+  }
+}
+
 #if BUILDFLAG(IS_ANDROID)
 // Returns whether or not a bookmark model contains any bookmarks aside of the
 // permanent nodes.
@@ -372,25 +391,43 @@ std::vector<const BookmarkNode*> GetMostRecentlyModifiedUserFolders(
 void GetMostRecentlyAddedEntries(BookmarkModel* model,
                                  size_t count,
                                  std::vector<const BookmarkNode*>* nodes) {
-  ui::TreeNodeIterator<const BookmarkNode> iterator(model->root_node());
+  // std::set is used here since insert element into std::vector is slower than
-  while (iterator.has_next()) {
+  // std::set, so we use std::set to find the most recent bookmarks, and then
-    const BookmarkNode* node = iterator.Next();
+  // return to users as std::vector.
-    if (node->is_url()) {
+  std::multiset<const BookmarkNode*, decltype(&MoreRecentlyAdded)> nodes_set(
-      auto insert_position = std::upper_bound(nodes->begin(), nodes->end(),
+      &MoreRecentlyAdded);
-                                              node, &MoreRecentlyAdded);
+  GetMostRecentEntries(model, count, &nodes_set);
-      if (nodes->size() < count || insert_position != nodes->end()) {
+
-        nodes->insert(insert_position, node);
+  nodes->reserve(nodes_set.size());
-        while (nodes->size() > count)
+  std::move(nodes_set.begin(), nodes_set.end(), std::back_inserter(*nodes));
-          nodes->pop_back();
-      }
-    }
-  }
 }
 
 bool MoreRecentlyAdded(const BookmarkNode* n1, const BookmarkNode* n2) {
   return n1->date_added() > n2->date_added();
 }
 
+void GetMostRecentlyUsedEntries(BookmarkModel* model,
+                                size_t count,
+                                std::vector<const BookmarkNode*>* nodes) {
+  // std::set is used here since insert element into std::vector is slower than
+  // std::set, so we use std::set to find the most recent bookmarks, and then
+  // return to users as std::vector.
+  auto lastUsedComp = [](const BookmarkNode* n1, const BookmarkNode* n2) {
+    if (n1->date_last_used() == n2->date_last_used()) {
+      // Both bookmarks have same used date, we compare added date instead,
+      // normally this happens when both bookmarks are never used.
+      return n1->date_added() > n2->date_added();
+    }
+    return n1->date_last_used() > n2->date_last_used();
+  };
+  std::multiset<const BookmarkNode*, decltype(lastUsedComp)> nodes_set(
+      lastUsedComp);
+  GetMostRecentEntries(model, count, &nodes_set);
+
+  nodes->reserve(nodes_set.size());
+  std::move(nodes_set.begin(), nodes_set.end(), std::back_inserter(*nodes));
+}
+
 void GetBookmarksMatchingProperties(BookmarkModel* model,
                                     const QueryFields& query,
                                     size_t max_count,
@@ -505,7 +542,8 @@ const BookmarkNode* AddIfNotBookmarked(BookmarkModel* model,
   // Nothing to do, a user bookmark with that url already exists.
   if (IsBookmarkedByUser(model, url))
     return nullptr;
-  model->client()->RecordAction(base::UserMetricsAction("BookmarkAdded"));
+
+  base::RecordAction(base::UserMetricsAction("BookmarkAdded"));
 
   const auto* parent_to_use = parent ? parent : GetParentForNewNodes(model);
   return model->AddNewURL(parent_to_use, parent_to_use->children().size(),

src/components/omnibox/browser/omnibox_view.cc

@@ -24,6 +24,7 @@
 #include "components/omnibox/browser/autocomplete_match.h"
 #include "components/omnibox/browser/autocomplete_match_type.h"
 #include "components/omnibox/browser/location_bar_model.h"
+#include "components/omnibox/browser/omnibox_controller.h"
 #include "components/omnibox/browser/omnibox_edit_model.h"
 #include "components/omnibox/browser/omnibox_edit_model_delegate.h"
 #include "components/omnibox/browser/omnibox_field_trial.h"
@@ -169,7 +170,7 @@ std::u16string OmniboxView::SanitizeTextForPaste(const std::u16string& text) {
 OmniboxView::~OmniboxView() = default;
 
 bool OmniboxView::IsEditingOrEmpty() const {
-  return (model_.get() && model_->user_input_in_progress()) ||
+  return (model() && model()->user_input_in_progress()) ||
          (GetOmniboxTextLength() == 0);
 }
 
@@ -191,8 +192,7 @@ ui::ImageModel OmniboxView::GetIcon(int dip_size,
   return ui::ImageModel();
 #else
 
-  // For tests, model_ will be null.
+  if (!model()) {
-  if (!model_) {
     AutocompleteMatch fake_match;
     fake_match.type = AutocompleteMatchType::URL_WHAT_YOU_TYPED;
     const gfx::VectorIcon& vector_icon = fake_match.GetVectorIcon(false);
@@ -200,7 +200,7 @@ ui::ImageModel OmniboxView::GetIcon(int dip_size,
                                           dip_size);
   }
 
-  if (model_->ShouldShowCurrentPageIcon()) {
+  if (model()->ShouldShowCurrentPageIcon()) {
     LocationBarModel* location_bar_model =
         edit_model_delegate_->GetLocationBarModel();
     return ui::ImageModel::FromVectorIcon(location_bar_model->GetVectorIcon(),
@@ -208,7 +208,7 @@ ui::ImageModel OmniboxView::GetIcon(int dip_size,
   }
 
   gfx::Image favicon;
-  AutocompleteMatch match = model_->CurrentMatch(nullptr);
+  AutocompleteMatch match = model()->CurrentMatch(nullptr);
   if (AutocompleteMatch::IsSearchType(match.type)) {
     // For search queries, display default search engine's favicon. If the
     // default search engine is google return the icon instead of favicon for
@@ -216,19 +216,19 @@ ui::ImageModel OmniboxView::GetIcon(int dip_size,
     // (DISABLED BY Alex313031).
   } else if (match.type != AutocompleteMatchType::HISTORY_CLUSTER) {
     // For site suggestions, display site's favicon.
-    favicon = model_->client()->GetFaviconForPageUrl(
+    favicon = model()->client()->GetFaviconForPageUrl(
         match.destination_url, std::move(on_icon_fetched));
   }
 
   if (!favicon.IsEmpty())
-    return ui::ImageModel::FromImage(model_->client()->GetSizedIcon(favicon));
+    return ui::ImageModel::FromImage(model()->client()->GetSizedIcon(favicon));
   // If the client returns an empty favicon, fall through to provide the
   // generic vector icon. |on_icon_fetched| may or may not be called later.
   // If it's never called, the vector icon we provide below should remain.
 
   // For bookmarked suggestions, display bookmark icon.
   bookmarks::BookmarkModel* bookmark_model =
-      model_->client()->GetBookmarkModel();
+      model()->client()->GetBookmarkModel();
   const bool is_bookmarked =
       bookmark_model && bookmark_model->IsBookmarked(match.destination_url);
 
@@ -245,8 +245,9 @@ void OmniboxView::SetUserText(const std::u16string& text) {
 }
 
 void OmniboxView::SetUserText(const std::u16string& text, bool update_popup) {
-  if (model_)
+  if (model()) {
-    model_->SetUserText(text);
+    model()->SetUserText(text);
+  }
   SetWindowTextAndCaretPos(text, text.length(), update_popup, true);
 }
 
@@ -257,8 +258,9 @@ void OmniboxView::RevertAll() {
 
   if (base::FeatureList::IsEnabled(omnibox::kRevertModelBeforeClosingPopup)) {
     // This will clear the model's `user_input_in_progress_`.
-    if (model_)
+    if (model()) {
-      model_->Revert();
+      model()->Revert();
+    }
 
     // This will stop the `AutocompleteController`. This should happen after
     // `user_input_in_progress_` is cleared above; otherwise, closing the popup
@@ -269,16 +271,18 @@ void OmniboxView::RevertAll() {
   } else {
     // Same as above, but in reverse order.
     CloseOmniboxPopup();
-    if (model_)
+    if (model()) {
-      model_->Revert();
+      model()->Revert();
+    }
   }
 
   TextChanged();
 }
 
 void OmniboxView::CloseOmniboxPopup() {
-  if (model_)
+  if (model()) {
-    model_->StopAutocomplete();
+    model()->StopAutocomplete();
+  }
 }
 
 bool OmniboxView::IsImeShowingPopup() const {
@@ -350,17 +354,30 @@ OmniboxView::StateChanges OmniboxView::GetStateChanges(const State& before,
 OmniboxView::OmniboxView(OmniboxEditModelDelegate* edit_model_delegate,
                          std::unique_ptr<OmniboxClient> client)
     : edit_model_delegate_(edit_model_delegate) {
-  // |client| can be null in tests.
+  // `client` can be nullptr in tests.
+  // TODO(crbug.com/1404748): Verify if this can actually happen and prevent it
+  //  such that checking `model()` before use is no longer necessary.
   if (client) {
-    model_ = std::make_unique<OmniboxEditModel>(this, edit_model_delegate,
+    controller_ = std::make_unique<OmniboxController>(
-                                                std::move(client));
+        /*view=*/this, edit_model_delegate, std::move(client));
   }
 }
 
+OmniboxEditModel* OmniboxView::model() {
+  return const_cast<OmniboxEditModel*>(
+      const_cast<const OmniboxView*>(this)->model());
+}
+
+const OmniboxEditModel* OmniboxView::model() const {
+  // `controller_` can be nullptr in tests.
+  return controller_ ? controller_->edit_model() : nullptr;
+}
+
 void OmniboxView::TextChanged() {
   EmphasizeURLComponents();
-  if (model_)
+  if (model()) {
-    model_->OnChanged();
+    model()->OnChanged();
+  }
 }
 
 void OmniboxView::UpdateTextStyle(

src/third_party/blink/renderer/platform/runtime_enabled_features.json5

@@ -177,14 +177,26 @@
       default: "enabled_or_overridden",
     },
 
+    // browser_process_read_access indicates the runtime feature state should be
+    // readable in the browserprocess via RuntimeFeatureStateReadContext.
+    // TODO(crbug.com/1377000): this feature does not support origin trial
+    // tokens provided in HTTP headers. Any tokens provided via HTTP header will
+    // be dropped.
     browser_process_read_access: {
       default: false,
       value_type: "bool",
     },
+
+    // browser_process_read_write_access indicates the runtime feature state
+    // should be writable in the browserprocess via RuntimeFeatureStateContext.
+    // TODO(crbug.com/1377000): this feature does not support origin trial
+    // tokens provided in HTTP headers. Any tokens provided via HTTP header will
+    // be dropped.
     browser_process_read_write_access: {
       default: false,
       value_type: "bool",
     },
+
     override_from_pref: {
       valid_keys: [
         // Chrome Prefs name (string) from which we will conditionally override
@@ -246,6 +258,10 @@
       status: "experimental",
       base_feature: "none",
     },
+    {
+      name: "AccessibilityEagerAXTreeUpdate",
+      status: "stable",
+    },
     {
       name: "AccessibilityExposeDisplayNone",
       status: "test",
@@ -276,6 +292,10 @@
       base_feature: "none",
       public: true,
     },
+    {
+      name: "AccordionPattern",
+      status: "experimental",
+    },
     {
       name: "AddIdentityInCanMakePaymentEvent",
       origin_trial_allows_third_party: true,
@@ -344,6 +364,7 @@
       origin_trial_feature_name: "AttributionReportingCrossAppWeb",
       origin_trial_allows_third_party: true,
       base_feature: "none",
+      browser_process_read_access: true,
     },
     {
       // This only exists so we can use RuntimeEnabled in the IDL file
@@ -453,7 +474,7 @@
     },
     {
       name: "BeforeunloadEventCancelByPreventDefault",
-      status: "stable",
+      status: "experimental",
     },
     {
       name: "BidiCaretAffinity",
@@ -622,6 +643,7 @@
     },
     {
       name: "CompositeBackgroundAttachmentFixed",
+      status: "experimental",
     },
     {
       name: "CompositeBGColorAnimation",
@@ -654,13 +676,11 @@
       copied_from_base_feature_if: "overridden",
       origin_trial_feature_name: "CompressionDictionaryTransport",
       public: true,
-      status: "experimental",
     },
     {
       name: "CompressionDictionaryTransportBackend",
       base_feature_status: "disabled",
       public: true,
-      status: "experimental",
     },
     {
       name: "ComputedAccessibilityInfo",
@@ -668,8 +688,13 @@
       base_feature: "none",
     },
     {
+      // blink::features::kComputePressure is a kill switch for the API. If the
+      // feature is disabled, origin trial tokens are ignored.
       name: "ComputePressure",
+      origin_trial_feature_name: "ComputePressure_v2",
       status: "experimental",
+      base_feature_status: "enabled",
+      copied_from_base_feature_if: "overridden",
     },
     {
       name: "ConfirmationOfAction",
@@ -715,6 +740,10 @@
       name: "CorsRFC1918",
       base_feature: "none",
     },
+    {
+      name: "CriticalCHRestartNavigationTiming",
+      status: "experimental",
+    },
     {
       name: "CrossFramePerformanceTimeline",
       status: "experimental",
@@ -740,7 +769,6 @@
       // to those properties.
       name: "CSSAnimationDelayStartEnd",
       depends_on: ["ScrollTimeline"],
-      status: "test",
     },
     {
       // Whether <image> values are allowed as counter style <symbol>
@@ -778,12 +806,6 @@
       status: "test",
       base_feature: "none",
     },
-    {
-      // Support for CSS Color Module Level 4
-      // https://www.w3.org/TR/css-color-4/
-      name: "CSSColor4",
-      status:  "stable",
-    },
     {
       name: "CSSColorContrast",
       status: "experimental",
@@ -807,7 +829,7 @@
     {
       // crbug.com/995106
       name: "CSSDisplayMultipleValues",
-      status: "experimental",
+      status: "stable",
     },
     // Exists so that we can run a reverse-Finch experiment to assess its performance.
     {
@@ -877,11 +899,6 @@
       status: "stable",
       base_feature: "CSSHyphenateLimitChars",
     },
-    {
-      name: "CSSIcUnit",
-      status: "stable",
-      base_feature: "none",
-    },
     {
       // If enabled,
       // image-set values without the `-webkit-` prefix
@@ -894,30 +911,16 @@
       status: "stable",
       base_feature: "none",
     },
-    {
-      // http://crbug.com/1276900
-      name: "CSSInitialLetter",
-      status: "stable",
-    },
     {
       name: "CSSInitialPseudo",
       status: "experimental",
       base_feature: "none",
     },
-    {
-      name: "CSSLastBaseline",
-      status: "stable",
-      base_feature: "none",
-    },
     {
       name: "CSSLayoutAPI",
       status: "experimental",
       base_feature: "none",
     },
-    {
-      name: "CSSLhUnit",
-      status: "stable",
-    },
     {
       name: "CSSLinearTimingFunction",
       status: "stable"
@@ -978,13 +981,23 @@
       name: "CSSNestingIdent",
     },
     {
-      name: "CSSNewRootFontUnits",
+      name: "CSSObjectViewBox",
       status: "stable",
       base_feature: "none",
     },
     {
-      name: "CSSObjectViewBox",
+      name: "CSSOffsetPathBasicShapesCircleAndEllipse",
-      status: "stable",
+      status: "experimental",
+      base_feature: "none",
+    },
+    {
+      name: "CSSOffsetPathBasicShapesRectanglesAndPolygon",
+      status: "experimental",
+      base_feature: "none",
+    },
+    {
+      name: "CSSOffsetPathCoordBox",
+      status: "experimental",
       base_feature: "none",
     },
     {
@@ -997,6 +1010,11 @@
       status: "experimental",
       base_feature: "none",
     },
+    {
+      name: "CSSOffsetPathUrl",
+      status: "experimental",
+      base_feature: "none",
+    },
     {
       name: "CSSOffsetPositionAnchor",
       status: "experimental",
@@ -1057,12 +1075,10 @@
       status: "experimental",
       base_feature: "none",
     },
-    // Scrollbar styling.
-    // https://drafts.csswg.org/css-scrollbars/
     {
-      name: "CSSScrollbars",
+      // https://drafts.csswg.org/css-scroll-snap-2
+      name: "CSSScrollSnap2",
       status: "test",
-      base_feature: "none",
     },
     {
       name: "CSSSelectorFragmentAnchor",
@@ -1098,6 +1114,10 @@
       name: "CSSSteppedValueFunctions",
       status: "experimental",
     },
+    {
+      name: "CSSStickyContainerQueries",
+      status: "experimental",
+    },
     {
       // https://drafts.csswg.org/css-contain-3/#style-container
       // This flag is for querying custom properties only.
@@ -1108,6 +1128,15 @@
     {
       // Support style() queries that evaluate in a boolean context.
       name: "CSSStyleQueriesBoolean",
+      status: "stable",
+    },
+    {
+      // Merge multiple rulesets into one, for faster matching.
+      name: "CSSSuperRulesets",
+      status: "experimental",
+    },
+    {
+      name: "CSSSystemAccentColor",
       status: "experimental",
     },
     {
@@ -1121,6 +1150,12 @@
       name: "CSSTextWrap",
       status: "stable",
     },
+    // `text-wrap: pretty`. crbug.com/1432798
+    {
+      name: "CSSTextWrapPretty",
+      status: "test",
+      depends_on: ["CSSTextWrap", "CSSWhiteSpaceShorthand"],
+    },
     // Support for CSS Toggles, https://tabatkins.github.io/css-toggle/
     {
       name: "CSSToggles",
@@ -1170,15 +1205,13 @@
     // Support for registered custom properties with <image> syntax.
     {
       name: "CSSVariables2ImageValues",
-      status: "test",
+      status: "experimental",
-      base_feature: "none",
     },
     // Support for registered custom properties with <transform-list> and
     // <transform-function> syntax.
     {
       name: "CSSVariables2TransformValues",
-      status: "test",
+      status: "experimental",
-      base_feature: "none",
     },
     {
       name: "CSSVideoDynamicRangeMediaQueries",
@@ -1232,7 +1265,6 @@
     },
     {
       name: "DelayOutOfViewportLazyImages",
-      depends_on: ["LazyImageLoading"],
       public: true,
       status: "experimental",
     },
@@ -1327,6 +1359,10 @@
       status: "experimental",
       base_feature: "none",
     },
+    {
+      name: "DisableSelectAllForEmptyText",
+      status: "stable",
+    },
     // This feature should only be enabled if
     // DisableThirdPartyStoragePartitioning is enabled, but as
     // DisableThirdPartyStoragePartitioning will be linked to a deprecation
@@ -1347,6 +1383,7 @@
       origin_trial_feature_name: "DisableThirdPartyStoragePartitioning",
       origin_trial_type: "deprecation",
       origin_trial_allows_insecure: true,
+      origin_trial_allows_third_party: true,
       status: "experimental",
       base_feature: "none",
       browser_process_read_write_access: true,
@@ -1545,16 +1582,14 @@
       name: "FedCmAutoReauthn",
       depends_on: ["FedCm"],
       public: true,
-      status: "test",
+      status: "stable",
       base_feature: "none",
-      origin_trial_feature_name: "FedCmAutoReauthn",
-      origin_trial_allows_third_party: true,
     },
     {
       // This only exists so we can use RuntimeEnabled in the IDL file
       // when either implied_by flag is enabled.
       name: "FedCmIdentityProviderInterface",
-      implied_by: ["FedCmIdpSigninStatus", "FedCmUserInfo", "FedCmIdPRegistration"],
+      implied_by: ["FedCmIdpSigninStatus", "FedCmUserInfo", "FedCmIdPRegistration", "FedCmAuthz"],
       base_feature: "none",
     },
     {
@@ -1638,6 +1673,12 @@
       base_feature_status: "enabled",
       copied_from_base_feature_if: "enabled_or_overridden",
     },
+    {
+      name: "FencedFramesDefaultMode",
+      base_feature_status: "disabled",
+      copied_from_base_feature_if: "enabled_or_overridden",
+      public: true,
+    },
     {
       name: "FetchUploadStreaming",
       status: "stable",
@@ -1706,6 +1747,13 @@
       origin_trial_feature_name: "PrivacySandboxAdsAPIs",
       origin_trial_allows_third_party: true,
     },
+    {
+      name: "FledgeBiddingAndAuctionServer",
+      base_feature: "none",
+      origin_trial_feature_name: "FledgeBiddingAndAuctionServer",
+      origin_trial_allows_third_party: true,
+      public: true,
+    },
     {
       name: "FluentScrollbars",
       base_feature: "none",
@@ -1794,6 +1842,11 @@
       name: "FormRelAttribute",
       status: "stable",
     },
+    {
+      // Bug fix for crbug.com/1429585
+      name: "FormStateRestoreCallbackCallWithState",
+      status: "stable",
+    },
     {
       name: "FractionalScrollOffsets",
       implied_by: ["PercentBasedScrolling"],
@@ -1850,26 +1903,6 @@
       depends_on: ["GetDisplayMedia"],
       status: "experimental",
     },
-    {
-      // Enables the getDisplayMediaSet API for multi surface capture.
-      name: "GetDisplayMediaSet",
-      depends_on: ["GetDisplayMedia"],
-      public: true,
-      status: "test",
-      base_feature: "none",
-    },
-    {
-      name: "GetDisplayMediaSetAutoSelectAllScreens",
-      depends_on: ["GetDisplayMediaSet"],
-      public: true,
-      status: {
-        "ChromeOS_Ash": "test",
-        "ChromeOS_Lacros": "test",
-        "Linux": "test",
-        "default": "",
-      },
-      base_feature: "none",
-    },
     {
       name: "GroupEffect",
       status: "test",
@@ -1987,7 +2020,7 @@
     {
       // If enabled, setting innerHTML will use a special fast-path parser.
       name: "InnerHTMLParserFastpath",
-      status: "experimental",
+      status: "stable",
     },
     {
       // If enabled, and the inner html parser is unable to successfully
@@ -2008,6 +2041,15 @@
       status: "stable",
       base_feature: "none",
     },
+    {
+      name: "InteroperablePrivateAttribution",
+      status: "experimental",
+    },
+    {
+      name: "JavaScriptCompileHintsMagicRuntime",
+      status: "experimental",
+      origin_trial_feature_name: "JavaScriptCompileHintsMagic",
+    },
     {
       name: "KeyboardAccessibleTooltip",
       status: "experimental",
@@ -2030,19 +2072,27 @@
       name: "LayoutDisableBrokenIntrinsicSize",
       status: "stable",
     },
+    {
+      name: "LayoutDisableWebkitBoxSafeAlignment",
+      status: "stable",
+    },
+    {
+      name: "LayoutFlexNewColumnAlgorithm",
+      status: "test",
+    },
+    {
+      name: "LayoutFlexNewRowAlgorithm",
+      status: "test",
+    },
+    {
+      name: "LayoutFlexSafeAlignment",
+      status: "stable",
+    },
     {
       // crbug.com/1425520. Enabled since M113.
       name: "LayoutMediaChildPaintContainment",
       status: "stable",
     },
-    {
-      name: "LayoutMediaNGContainer",
-      status: "stable",
-    },
-    {
-      name: "LayoutMediaNoInlineChildren",
-      status: "stable",  // Since M112.
-    },
     {
       name: "LayoutNewFormCentering",
       status: "stable",
@@ -2059,10 +2109,14 @@
       name: "LayoutNewSVGTextEntry",
       status: "stable",
     },
+    {
+      name: "LayoutNewTextAreaScrollbar",
+      status: "stable",
+    },
     {
       // crbug.com/1353190
       name: "LayoutNGNoCopyBack",
-      depends_on: ["LayoutMediaNGContainer", "RemoveConvertToLayerCoords"],
+      depends_on: ["RemoveConvertToLayerCoords"],
       status: "test",
     },
     {
@@ -2081,17 +2135,6 @@
       status: "stable",
       base_feature: "none",
     },
-    {
-      name: "LazyImageLoading",
-      public: true,
-      status: "stable",
-      base_feature: "none",
-    },
-    {
-      name: "LazyImageVisibleLoadTimeMetrics",
-      base_feature: "none",
-      public: true,
-    },
     {
       name: "LazyInitializeMediaControls",
       base_feature: "none",
@@ -2126,7 +2169,7 @@
       // Enable AnimationFrameTimingMonitor, which measures long animation
       // frames. Can be used for UKM or for the perofrmance API.
       name: "LongAnimationFrameMonitoring",
-      implied_by: ["LongAnimationFrameTiming", "LongAnimationFrameUKM"],
+      implied_by: ["LongAnimationFrameTiming", "LongAnimationFrameUKM", "LongTaskFromLongAnimationFrame"],
       status: "experimental"
     },
     {
@@ -2140,6 +2183,10 @@
       name: "LongAnimationFrameUKM",
       status: "stable"
     },
+    {
+      // Use LongAnimationFrameMonitor to emit longtask entries
+      name: "LongTaskFromLongAnimationFrame"
+    },
     {
       name: "MachineLearningCommon",
       implied_by: ["MachineLearningModelLoader", "MachineLearningNeuralNetwork"],
@@ -2284,7 +2331,6 @@
       base_feature_status: "enabled",
     },
     {
-
       name: "MobileLayoutTheme",
       base_feature: "none",
     },
@@ -2300,6 +2346,12 @@
       status: "test",
       base_feature: "none",
     },
+    // crbug.com/1446498: This feature is being used for the deprecation of
+    // Mutation Events.
+    {
+      name: "MutationEvents",
+      status: "stable",
+    },
     {
       name: "NavigateEventCancelableTraversals",
       status: "stable",
@@ -2319,6 +2371,9 @@
       status: {"Android": "", "default": "stable"},
       base_feature: "none",
     },
+    {
+      name: "NetInfoConstantType",
+    },
     {
       name: "NetInfoDownlinkMax",
       public: true,
@@ -2332,14 +2387,21 @@
       base_feature: "none",
     },
     {
-      name: "NewFlexboxSizing",
+      name: "NodeAsNSResolver",
-      base_feature: "none",
+      status: "stable",
     },
     {
       name: "NoIdleEncodingForWebTests",
       status: "test",
       base_feature: "none",
     },
+    // Makes enter/leave Mouse and Pointer Events non-composed as per
+    // corresponding specifications.
+    {
+      name: "NonComposedEnterLeaveEvents",
+      public: true,
+      status: "experimental",
+    },
     {
       // Kill switch for crbug.com/1427047 fix.
       // TODO(xiaochengh): Remove in M117.
@@ -2636,6 +2698,10 @@
       base_feature: "none",
       public: true,
     },
+    {
+      name: "PerformanceNavigateSystemEntropy",
+      status: "experimental",
+    },
     {
       name: "PeriodicBackgroundSync",
       public: true,
@@ -2676,6 +2742,13 @@
       name: "PointerEventDeviceId",
       status: "test",
     },
+    // PopoverDialogDontThrow makes popover and dialog elements stop throwing
+    // exceptions when calling their show and hide methods when they are
+    // already in their requested state. See https://github.com/whatwg/html/pull/9142
+    {
+      name: "PopoverDialogDontThrow",
+      status: "stable",
+    },
     {
       name: "Portals",
       // Portals must be enabled by blink::features::kPortals as we require the
@@ -2718,6 +2791,12 @@
       status: "stable",
       base_feature: "none",
     },
+    {
+      // Attempt to set up paint properties for ancestors when pre-painting a
+      // missed descendant, so that paint effects like transforms aren't lost.
+      name: "PrePaintAncestorsOfMissedOOF",
+      status: "stable",
+    },
     {
       // https://crbug.com/1126305
       name: "Prerender2",
@@ -2808,7 +2887,7 @@
       // User-Agent string.
       name: "ReduceUserAgentAndroidVersionDeviceModel",
       depends_on: ["ReduceUserAgentMinorVersion"],
-      status: {"Android": "experimental"},
+      status: {"Android": "stable"},
     },
     // If enabled, the minor version of the User-Agent string will be reduced.
     // This User-Agent Reduction feature has been enabled starting from M101,
@@ -2852,12 +2931,25 @@
       status: "experimental",
       base_feature: "none",
     },
+    {
+      name: "RemoveLegacySizeComputation",
+      status: "stable",
+    },
     {
       name: "RemoveMobileViewportDoubleTap",
       public: true,
       status: "stable",
       base_feature: "none",
     },
+    {
+      // Non-standard appearance values should be removed. This feature removes
+      // inner-spin-button, media-slider, media-sliderthumb, media-volume-slider
+      // media-volume-sliderthumb, searchfield-cancel-button,
+      // sliderthumb-horizontal, sliderthumb-vertical.
+      // https://drafts.csswg.org/css-ui-4/#appearance-switching
+      name: "RemoveNonStandardAppearanceValue",
+      status: "experimental",
+    },
     {
       // Non-standard appearance values should be removed. This feature removes
       // slider-vertical.
@@ -2887,7 +2979,7 @@
     },
     {
       name: "ResourceTimingInterimResponseTimes",
-      status: "test",
+      status: "stable",
       base_feature: "none",
     },
     {
@@ -3003,7 +3095,7 @@
     },
     {
       name: "ScrollbarWidth",
-      status: "test",
+      status: "experimental",
       base_feature: "none",
     },
     {
@@ -3016,9 +3108,32 @@
     },
     {
       name: "ScrollTimeline",
-      status: "experimental",
+      status: "stable",
-      implied_by: ["AnimationWorklet"],
+      implied_by: ["AnimationWorklet", "ScrollTimelineCurrentTime"]
-      base_feature: "none",
+    },
+    {
+      // Support for scroll/view-timeline-attachment.
+      //
+      // This feature was intially specified in scroll-animations-1,
+      // but was since removed by a resolution in Issue 7759.
+      //
+      // The properties will remain available behind this flag until
+      // all WPTs are adjusted to the new API (see feature TimelineScope).
+      //
+      // https://github.com/w3c/csswg-drafts/issues/7759
+      // https://crbug.com/1446702
+      name: "ScrollTimelineAttachment",
+      status: "test"
+    },
+    {
+      // Separate flag for crbug.com/1426506 (getCurrentTime API change) which
+      // is expected to land after the initial launch of ScrollTimeline.
+      name: "ScrollTimelineCurrentTime",
+      status: "experimental"
+    },
+    {
+      name: "ScrollTimelineOnCompositor",
+      status: "test"
     },
     // Implements documentElement.scrollTop/Left and bodyElement.scrollTop/Left
     // as per the spec, matching other Web engines.
@@ -3085,6 +3200,10 @@
       status: {"Android": "", "default": "stable"},
       base_feature: "none",
     },
+    {
+      name: "SerializeViewTransitionStateInSPA",
+      base_feature: "none",
+    },
     {
       name: "ServiceWorkerBypassFetchHandler",
       base_feature: "none",
@@ -3216,6 +3335,7 @@
       origin_trial_feature_name: "SpeculationRulesPrefetchFuture",
       origin_trial_allows_third_party: true,
       status: "experimental",
+      implied_by: ["SpeculationRulesNoVarySearchHint"],
     },
     {
       name: "SpeculationRulesFetchFromHeader",
@@ -3227,6 +3347,7 @@
     {
       name: "SpeculationRulesNoVarySearchHint",
       base_feature: "none",
+      origin_trial_feature_name: "NoVarySearchPrefetch",
     },
     {
       name: "SpeculationRulesPointerDownHeuristics",
@@ -3384,6 +3505,14 @@
       base_feature: "none",
       browser_process_read_write_access: true,
     },
+    {
+      // Support for the timeline-scope property.
+      //
+      // https://github.com/w3c/csswg-drafts/issues/7759
+      name: "TimelineScope",
+      status: "experimental",
+      depends_on: ["ScrollTimeline"]
+    },
     {
       name: "TimerThrottlingForBackgroundTabs",
       public: true,
@@ -3439,6 +3568,11 @@
       status: "stable",
       base_feature: "none",
     },
+    // Set to reflect the kTouchTextEditingRedesign feature.
+    {
+      name: "TouchTextEditingRedesign",
+      base_feature: "none",
+    },
     // This is conditionally set if the platform supports translation.
     {
       name: "TranslateService",
@@ -3583,7 +3717,7 @@
     },
     {
       name: "VisibilityStateEntry",
-      status: "experimental",
+      status: "stable",
       base_feature: "none",
     },
     {
@@ -3650,6 +3784,11 @@
       status: "experimental",
       base_feature: "none",
     },
+    {
+      name: "WebAppTabStripCustomizations",
+      status: "experimental",
+      base_feature: "none",
+    },
     {
       name: "WebAppTranslations",
       status: "experimental",
@@ -3768,6 +3907,12 @@
       status: "experimental",
       base_feature: "none",
     },
+    {
+      name: "WebEnvironmentIntegrity",
+      status: "experimental",
+      base_feature: "none",
+      origin_trial_feature_name: "WebEnvironmentIntegrity",
+    },
     {
       name: "WebFontResizeLCP",
       status: "experimental",