diff --git a/configure.pri b/configure.pri
index 1765e32e38ce433474a6a74d929c0fc73bfdf46a..e0e4826852b98018dcecb50c80f8a3065d42471c 100644
--- a/configure.pri
+++ b/configure.pri
@@ -109,7 +109,7 @@ defineTest(qtConfTest_detectNinja) {
     !isEmpty(ninja) {
         qtLog("Found ninja from path: $$ninja")
         qtRunLoggedCommand("$$ninja --version", version)|return(false)
-        contains(version, "1.*"): return(true)
+        contains(version, "1.[7-9].*"): return(true)
         qtLog("Ninja version too old")
     }
     qtLog("Building own ninja")
diff --git a/src/3rdparty b/src/3rdparty
index 3d02dd98fb1928c0c92d3ca4d67c2baeca4aece1..f352e70b325bd176f53f47f43f9c37df54e4397a 160000
--- a/src/3rdparty
+++ b/src/3rdparty
@@ -1 +1 @@
-Subproject commit 3d02dd98fb1928c0c92d3ca4d67c2baeca4aece1
+Subproject commit f352e70b325bd176f53f47f43f9c37df54e4397a
diff --git a/src/core/browser_accessibility_qt.cpp b/src/core/browser_accessibility_qt.cpp
index cafc4f5adcb2538a66c3632e4d43e3298d58c54f..e31951307250c3cafc5b1f989bbefad7d4ffb450 100644
--- a/src/core/browser_accessibility_qt.cpp
+++ b/src/core/browser_accessibility_qt.cpp
@@ -160,7 +160,7 @@ QString BrowserAccessibilityQt::text(QAccessible::Text t) const
     case QAccessible::Value:
         return toQt(GetStringAttribute(ui::AX_ATTR_VALUE));
     case QAccessible::Accelerator:
-        return toQt(GetStringAttribute(ui::AX_ATTR_SHORTCUT));
+        return toQt(GetStringAttribute(ui::AX_ATTR_KEY_SHORTCUTS));
     default:
         break;
     }
@@ -458,18 +458,16 @@ QAccessible::State BrowserAccessibilityQt::state() const
     int32_t s = GetState();
     if (s & (1 << ui::AX_STATE_BUSY))
         state.busy = true;
-    if (s & (1 << ui::AX_CHECKED_STATE_TRUE))
-        state.checked = true;
     if (s & (1 << ui::AX_STATE_COLLAPSED))
         state.collapsed = true;
-    if (s & (1 << ui::AX_STATE_DISABLED))
-        state.disabled = true;
+    if (s & (1 << ui::AX_STATE_DEFAULT))
+        state.defaultButton = true;
+    if (s & (1 << ui::AX_STATE_EDITABLE))
+        state.editable = true;
     if (s & (1 << ui::AX_STATE_EXPANDED))
         state.expanded = true;
     if (s & (1 << ui::AX_STATE_FOCUSABLE))
         state.focusable = true;
-    if (manager()->GetFocus() == this)
-        state.focused = true;
     if (s & (1 << ui::AX_STATE_HASPOPUP))
         state.hasPopup = true;
     if (s & (1 << ui::AX_STATE_HOVERED))
@@ -482,14 +480,12 @@ QAccessible::State BrowserAccessibilityQt::state() const
         state.multiSelectable = true;
     if (s & (1 << ui::AX_STATE_OFFSCREEN))
         state.offscreen = true;
-    if (s & (1 << ui::AX_STATE_PRESSED))
-        state.pressed = true;
     if (s & (1 << ui::AX_STATE_PROTECTED))
     {} // FIXME
-    if (s & (1 << ui::AX_STATE_READ_ONLY))
-        state.readOnly = true;
     if (s & (1 << ui::AX_STATE_REQUIRED))
     {} // FIXME
+    if (s & (1 << ui::AX_STATE_RICHLY_EDITABLE))
+    {} // FIXME
     if (s & (1 << ui::AX_STATE_SELECTABLE))
         state.selectable = true;
     if (s & (1 << ui::AX_STATE_SELECTED))
@@ -498,8 +494,40 @@ QAccessible::State BrowserAccessibilityQt::state() const
     {} // FIXME
     if (s & (1 << ui::AX_STATE_VISITED))
     {} // FIXME
-    if (HasState(ui::AX_STATE_EDITABLE))
-        state.editable = true;
+
+    if (manager()->GetFocus() == this)
+        state.focused = true;
+    if (HasIntAttribute(ui::AX_ATTR_CHECKED_STATE)) {
+        ui::AXCheckedState checkedState = (ui::AXCheckedState)GetIntAttribute(ui::AX_ATTR_CHECKED_STATE);
+        switch (checkedState) {
+        case ui::AX_CHECKED_STATE_TRUE:
+            if (GetRole() == ui::AX_ROLE_TOGGLE_BUTTON)
+                state.pressed = true;
+            else
+                state.checked = true;
+            break;
+        case ui::AX_CHECKED_STATE_MIXED:
+            state.checkStateMixed = true;
+            break;
+        case ui::AX_CHECKED_STATE_FALSE:
+        case ui::AX_CHECKED_STATE_NONE:
+            break;
+        }
+    }
+    if (HasIntAttribute(ui::AX_ATTR_RESTRICTION)) {
+        ui::AXRestriction restriction = (ui::AXRestriction)GetIntAttribute(ui::AX_ATTR_RESTRICTION);
+        switch (restriction) {
+        case ui::AX_RESTRICTION_READ_ONLY:
+            state.readOnly = true;
+            break;
+        case ui::AX_RESTRICTION_DISABLED:
+            state.disabled = true;
+            break;
+        case ui::AX_RESTRICTION_NONE:
+            break;
+        }
+    }
+
     return state;
 }
 
diff --git a/src/core/browser_context_qt.cpp b/src/core/browser_context_qt.cpp
index 16b7e551430ace49b7b36f85673db5c4f42f6ca5..415318fe839956f1e19c7d97bb5890bb4f74be1b 100644
--- a/src/core/browser_context_qt.cpp
+++ b/src/core/browser_context_qt.cpp
@@ -182,6 +182,11 @@ content::BackgroundSyncController* BrowserContextQt::GetBackgroundSyncController
     return nullptr;
 }
 
+content::BrowsingDataRemoverDelegate *BrowserContextQt::GetBrowsingDataRemoverDelegate()
+{
+    return nullptr;
+}
+
 content::PermissionManager *BrowserContextQt::GetPermissionManager()
 {
     if (!permissionManager)
diff --git a/src/core/browser_context_qt.h b/src/core/browser_context_qt.h
index 681657d96ce42c7c1d59eb372c9ec3f47bc681fd..ceb4838e3c5889dec3eb849f13b9013fc4838ea3 100644
--- a/src/core/browser_context_qt.h
+++ b/src/core/browser_context_qt.h
@@ -91,6 +91,7 @@ public:
     std::unique_ptr<content::ZoomLevelDelegate> CreateZoomLevelDelegate(const base::FilePath& partition_path) override;
     content::PermissionManager *GetPermissionManager() override;
     content::BackgroundSyncController* GetBackgroundSyncController() override;
+    content::BrowsingDataRemoverDelegate *GetBrowsingDataRemoverDelegate() override;
 
     // Profile implementation:
     PrefService* GetPrefs() override;
diff --git a/src/core/chromium_overrides.cpp b/src/core/chromium_overrides.cpp
index 8e19fa08f8170c289602d9b00819ce0479e94e3f..d1cc951d2f8f5284ca151789966ff5683a98e38b 100644
--- a/src/core/chromium_overrides.cpp
+++ b/src/core/chromium_overrides.cpp
@@ -176,6 +176,19 @@ void GetFontsInFamily_SlowBlocking(const std::string &, std::vector<ppapi::proxy
 
 } // namespace content
 
+namespace aura {
+class Window;
+}
+
+namespace wm {
+class ActivationClient;
+
+ActivationClient *GetActivationClient(aura::Window *)
+{
+    return nullptr;
+}
+
+} // namespace wm
 #endif // defined(USE_AURA) || defined(USE_OZONE)
 
 std::unique_ptr<ui::OSExchangeData::Provider>
diff --git a/src/core/config/common.pri b/src/core/config/common.pri
index 2aa3c614dd5ca28d92c98210143931d105b127fc..e7010a13a988008a00ed3e54a6f65de753aeb85e 100644
--- a/src/core/config/common.pri
+++ b/src/core/config/common.pri
@@ -11,7 +11,8 @@ gn_args += \
     use_allocator=\"none\" \
     v8_use_external_startup_data=false \
     treat_warnings_as_errors=false \
-    enable_swiftshader=false
+    enable_swiftshader=false \
+    use_custom_libcxx=false
 
 qtConfig(printing-and-pdf) {
     gn_args += enable_basic_printing=true enable_print_preview=true
diff --git a/src/core/content_browser_client_qt.cpp b/src/core/content_browser_client_qt.cpp
index 97d3ad6bb890e954a167a637dee4663a79742ea2..3ec119e0ab5d79ed7a5560cbd4880e97c5a4bb0a 100644
--- a/src/core/content_browser_client_qt.cpp
+++ b/src/core/content_browser_client_qt.cpp
@@ -44,7 +44,7 @@
 #include "base/threading/thread_restrictions.h"
 #include "components/spellcheck/spellcheck_build_features.h"
 #if BUILDFLAG(ENABLE_SPELLCHECK)
-#include "chrome/browser/spellchecker/spellcheck_message_filter.h"
+#include "chrome/browser/spellchecker/spell_check_host_impl.h"
 #if BUILDFLAG(USE_BROWSER_SPELLCHECKER)
 #include "components/spellcheck/browser/spellcheck_message_filter_platform.h"
 #endif
@@ -69,6 +69,7 @@
 #include "device/geolocation/geolocation_provider.h"
 #include "mojo/public/cpp/bindings/binding.h"
 #include "mojo/public/cpp/bindings/binding_set.h"
+#include "net/ssl/client_cert_identity.h"
 #include "services/service_manager/public/cpp/bind_source_info.h"
 #include "services/service_manager/public/cpp/binder_registry.h"
 #include "third_party/WebKit/public/platform/modules/sensitive_input_visibility/sensitive_input_visibility_service.mojom.h"
@@ -417,10 +418,6 @@ void ContentBrowserClientQt::RenderProcessWillLaunch(content::RenderProcessHost*
 #if BUILDFLAG(ENABLE_PEPPER_CDMS)
     host->AddFilter(new BrowserMessageFilterQt(id));
 #endif
-#if BUILDFLAG(ENABLE_SPELLCHECK)
-    // SpellCheckMessageFilter is required for both Hunspell and Native configurations.
-    host->AddFilter(new SpellCheckMessageFilter(id));
-#endif
 #if defined(Q_OS_MACOS) && BUILDFLAG(ENABLE_SPELLCHECK) && BUILDFLAG(USE_BROWSER_SPELLCHECKER)
   host->AddFilter(new SpellCheckMessageFilterPlatform(id));
 #endif
@@ -461,15 +458,11 @@ content::QuotaPermissionContext *ContentBrowserClientQt::CreateQuotaPermissionCo
     return new QuotaPermissionContextQt;
 }
 
-void ContentBrowserClientQt::GetQuotaSettings(content::BrowserContext *context,
-                    content::StoragePartition *partition,
-                    const storage::OptionalQuotaSettingsCallback &callback)
+void ContentBrowserClientQt::GetQuotaSettings(content::BrowserContext* context,
+                                              content::StoragePartition* partition,
+                                              storage::OptionalQuotaSettingsCallback callback)
 {
-    content::BrowserThread::PostTaskAndReplyWithResult(
-        content::BrowserThread::FILE, FROM_HERE,
-        base::Bind(&storage::CalculateNominalDynamicSettings,
-                    partition->GetPath(), context->IsOffTheRecord()),
-        callback);
+    storage::GetNominalDynamicSettings(partition->GetPath(), context->IsOffTheRecord(), std::move(callback));
 }
 
 void ContentBrowserClientQt::AllowCertificateError(content::WebContents *webContents,
@@ -490,10 +483,10 @@ void ContentBrowserClientQt::AllowCertificateError(content::WebContents *webCont
 
 void ContentBrowserClientQt::SelectClientCertificate(content::WebContents * /*webContents*/,
                                                      net::SSLCertRequestInfo * /*certRequestInfo*/,
-                                                     net::CertificateList /*client_certs*/,
+                                                     net::ClientCertIdentityList /*client_certs*/,
                                                      std::unique_ptr<content::ClientCertificateDelegate> delegate)
 {
-    delegate->ContinueWithCertificate(nullptr);
+    delegate->ContinueWithCertificate(nullptr, nullptr);
 }
 
 std::string ContentBrowserClientQt::GetApplicationLocale()
@@ -570,17 +563,16 @@ public:
             return nullptr;
         return FromWebContents(web_contents);
     }
-    static void BindSensitiveInputVisibilityService(content::RenderFrameHost* render_frame_host,
-                                                    const service_manager::BindSourceInfo& source_info,
-                                                    blink::mojom::SensitiveInputVisibilityServiceRequest request)
+    static void BindSensitiveInputVisibilityService(blink::mojom::SensitiveInputVisibilityServiceRequest request,
+                                                    content::RenderFrameHost* render_frame_host)
     {
         CreateForRenderFrameHost(render_frame_host);
         ServiceDriver *driver = FromRenderFrameHost(render_frame_host);
 
         if (driver)
-            driver->BindSensitiveInputVisibilityServiceInternal(std::move(request));
+            driver->BindSensitiveInputVisibilityServiceRequest(std::move(request));
     }
-    void BindSensitiveInputVisibilityServiceInternal(blink::mojom::SensitiveInputVisibilityServiceRequest request)
+    void BindSensitiveInputVisibilityServiceRequest(blink::mojom::SensitiveInputVisibilityServiceRequest request)
     {
         m_sensitiveInputVisibilityBindings.AddBinding(this, std::move(request));
     }
@@ -598,10 +590,35 @@ private:
 
 };
 
-void ContentBrowserClientQt::ExposeInterfacesToFrame(service_manager::BinderRegistry* registry,
-                                                     content::RenderFrameHost* render_frame_host)
+void ContentBrowserClientQt::InitFrameInterfaces()
+{
+    m_frameInterfaces = base::MakeUnique<service_manager::BinderRegistry>();
+    m_frameInterfacesParameterized = base::MakeUnique<service_manager::BinderRegistryWithArgs<content::RenderFrameHost*>>();
+    m_frameInterfacesParameterized->AddInterface(base::Bind(&ServiceDriver::BindSensitiveInputVisibilityService));
+}
+
+void ContentBrowserClientQt::BindInterfaceRequestFromFrame(content::RenderFrameHost* render_frame_host,
+                                                           const std::string& interface_name,
+                                                           mojo::ScopedMessagePipeHandle interface_pipe)
+{
+    if (!m_frameInterfaces.get() && !m_frameInterfacesParameterized.get())
+        InitFrameInterfaces();
+
+    if (!m_frameInterfacesParameterized->TryBindInterface(interface_name, &interface_pipe, render_frame_host))
+        m_frameInterfaces->TryBindInterface(interface_name, &interface_pipe);
+}
+
+void ContentBrowserClientQt::ExposeInterfacesToRenderer(service_manager::BinderRegistry *registry,
+                                                        content::AssociatedInterfaceRegistry */*associated_registry*/,
+                                                        content::RenderProcessHost *render_process_host)
 {
-    registry->AddInterface(base::Bind(&ServiceDriver::BindSensitiveInputVisibilityService, render_frame_host));
+#if BUILDFLAG(ENABLE_SPELLCHECK)
+    registry->AddInterface(base::Bind(&SpellCheckHostImpl::Create, render_process_host->GetID()),
+                           content::BrowserThread::GetTaskRunnerForThread(content::BrowserThread::UI));
+#else
+    Q_UNUSED(registry);
+    Q_UNUSED(render_process_host);
+#endif
 }
 
 bool ContentBrowserClientQt::CanCreateWindow(
diff --git a/src/core/content_browser_client_qt.h b/src/core/content_browser_client_qt.h
index eab8e42abeffd710c00d2fc70695225886826826..5d5a96e0c0e89bdbaaa45ff4fc63b835244dd99c 100644
--- a/src/core/content_browser_client_qt.h
+++ b/src/core/content_browser_client_qt.h
@@ -73,10 +73,6 @@ namespace gl {
 class GLShareGroup;
 }
 
-namespace service_manager {
-class BinderRegistry;
-}
-
 namespace QtWebEngineCore {
 class BrowserContextQt;
 class BrowserMainPartsQt;
@@ -97,7 +93,7 @@ public:
     content::QuotaPermissionContext *CreateQuotaPermissionContext() override;
     void GetQuotaSettings(content::BrowserContext *context,
                         content::StoragePartition *partition,
-                        const storage::OptionalQuotaSettingsCallback &callback) override;
+                        storage::OptionalQuotaSettingsCallback callback) override;
     void OverrideWebkitPrefs(content::RenderViewHost *, content::WebPreferences *) override;
     void AllowCertificateError(content::WebContents* web_contents,
                                        int cert_error,
@@ -110,7 +106,7 @@ public:
                                        const base::Callback<void(content::CertificateRequestResultType)>& callback) override;
     void SelectClientCertificate(content::WebContents* web_contents,
                                          net::SSLCertRequestInfo* cert_request_info,
-                                         net::CertificateList client_certs,
+                                         net::ClientCertIdentityList client_certs,
                                          std::unique_ptr<content::ClientCertificateDelegate> delegate) override;
     content::DevToolsManagerDelegate *GetDevToolsManagerDelegate() override;
 
@@ -119,7 +115,12 @@ public:
     void AppendExtraCommandLineSwitches(base::CommandLine* command_line, int child_process_id) override;
     void GetAdditionalWebUISchemes(std::vector<std::string>* additional_schemes) override;
 
-    void ExposeInterfacesToFrame(service_manager::BinderRegistry* registry, content::RenderFrameHost* render_frame_host) override;
+    void BindInterfaceRequestFromFrame(content::RenderFrameHost* render_frame_host,
+                                       const std::string& interface_name,
+                                       mojo::ScopedMessagePipeHandle interface_pipe) override;
+    void ExposeInterfacesToRenderer(service_manager::BinderRegistry *registry,
+                                    content::AssociatedInterfaceRegistry *associated_registry,
+                                    content::RenderProcessHost *render_process_host) override;
 
     bool CanCreateWindow(
         content::RenderFrameHost* opener,
@@ -145,9 +146,12 @@ public:
 #endif
 
 private:
+    void InitFrameInterfaces();
     BrowserMainPartsQt* m_browserMainParts;
     std::unique_ptr<ResourceDispatcherHostDelegateQt> m_resourceDispatcherHostDelegate;
     scoped_refptr<ShareGroupQtQuick> m_shareGroupQtQuick;
+    std::unique_ptr<service_manager::BinderRegistry> m_frameInterfaces;
+    std::unique_ptr<service_manager::BinderRegistryWithArgs<content::RenderFrameHost*>> m_frameInterfacesParameterized;
 };
 
 } // namespace QtWebEngineCore
diff --git a/src/core/cookie_monster_delegate_qt.cpp b/src/core/cookie_monster_delegate_qt.cpp
index d2a3377a422c2ccd6c99ec6aca8579adf9023d50..0fa8dead00acb9a546abbaed1e407e22c75165db 100644
--- a/src/core/cookie_monster_delegate_qt.cpp
+++ b/src/core/cookie_monster_delegate_qt.cpp
@@ -61,7 +61,7 @@ static void onSetCookieCallback(QWebEngineCookieStorePrivate *client, qint64 cal
                                      base::Bind(&QWebEngineCookieStorePrivate::onSetCallbackResult, base::Unretained(client), callbackId, success));
 }
 
-static void onDeleteCookiesCallback(QWebEngineCookieStorePrivate *client, qint64 callbackId, int numCookies) {
+static void onDeleteCookiesCallback(QWebEngineCookieStorePrivate *client, qint64 callbackId, uint numCookies) {
     content::BrowserThread::PostTask(content::BrowserThread::UI, FROM_HERE,
                                      base::Bind(&QWebEngineCookieStorePrivate::onDeleteCallbackResult, base::Unretained(client), callbackId, numCookies));
 }
@@ -96,13 +96,13 @@ void CookieMonsterDelegateQt::getAllCookies(quint64 callbackId)
     net::CookieMonster::GetCookieListCallback callback = base::Bind(&onGetAllCookiesCallback, m_client->d_func(), callbackId);
 
     content::BrowserThread::PostTask(content::BrowserThread::IO, FROM_HERE,
-                                     base::Bind(&CookieMonsterDelegateQt::GetAllCookiesOnIOThread, this, callback));
+                                     base::BindOnce(&CookieMonsterDelegateQt::GetAllCookiesOnIOThread, this, std::move(callback)));
 }
 
-void CookieMonsterDelegateQt::GetAllCookiesOnIOThread(const net::CookieMonster::GetCookieListCallback& callback)
+void CookieMonsterDelegateQt::GetAllCookiesOnIOThread(net::CookieMonster::GetCookieListCallback callback)
 {
     if (m_cookieMonster)
-        m_cookieMonster->GetAllCookiesAsync(callback);
+        m_cookieMonster->GetAllCookiesAsync(std::move(callback));
 }
 
 void CookieMonsterDelegateQt::setCookie(quint64 callbackId, const QNetworkCookie &cookie, const QUrl &origin)
@@ -117,19 +117,19 @@ void CookieMonsterDelegateQt::setCookie(quint64 callbackId, const QNetworkCookie
     GURL gurl = origin.isEmpty() ? sourceUrlForCookie(cookie) : toGurl(origin);
 
     content::BrowserThread::PostTask(content::BrowserThread::IO, FROM_HERE,
-                                     base::Bind(&CookieMonsterDelegateQt::SetCookieOnIOThread, this,
-                                                gurl, cookie.toRawForm().toStdString(), callback));
+                                     base::BindOnce(&CookieMonsterDelegateQt::SetCookieOnIOThread, this,
+                                                    gurl, cookie.toRawForm().toStdString(), std::move(callback)));
 }
 
 void CookieMonsterDelegateQt::SetCookieOnIOThread(
         const GURL& url, const std::string& cookie_line,
-        const net::CookieMonster::SetCookiesCallback& callback)
+        net::CookieMonster::SetCookiesCallback callback)
 {
     net::CookieOptions options;
     options.set_include_httponly();
 
     if (m_cookieMonster)
-        m_cookieMonster->SetCookieWithOptionsAsync(url, cookie_line, options, callback);
+        m_cookieMonster->SetCookieWithOptionsAsync(url, cookie_line, options, std::move(callback));
 }
 
 void CookieMonsterDelegateQt::deleteCookie(const QNetworkCookie &cookie, const QUrl &origin)
@@ -140,8 +140,8 @@ void CookieMonsterDelegateQt::deleteCookie(const QNetworkCookie &cookie, const Q
     GURL gurl = origin.isEmpty() ? sourceUrlForCookie(cookie) : toGurl(origin);
 
     content::BrowserThread::PostTask(content::BrowserThread::IO, FROM_HERE,
-                                     base::Bind(&CookieMonsterDelegateQt::DeleteCookieOnIOThread, this,
-                                                gurl, cookie.name().toStdString()));
+                                     base::BindOnce(&CookieMonsterDelegateQt::DeleteCookieOnIOThread, this,
+                                                    gurl, cookie.name().toStdString()));
 }
 
 void CookieMonsterDelegateQt::DeleteCookieOnIOThread(const GURL& url, const std::string& cookie_name)
@@ -157,13 +157,13 @@ void CookieMonsterDelegateQt::deleteSessionCookies(quint64 callbackId)
 
     net::CookieMonster::DeleteCallback callback = base::Bind(&onDeleteCookiesCallback, m_client->d_func(), callbackId);
     content::BrowserThread::PostTask(content::BrowserThread::IO, FROM_HERE,
-                                     base::Bind(&CookieMonsterDelegateQt::DeleteSessionCookiesOnIOThread, this, callback));
+                                     base::BindOnce(&CookieMonsterDelegateQt::DeleteSessionCookiesOnIOThread, this, std::move(callback)));
 }
 
-void CookieMonsterDelegateQt::DeleteSessionCookiesOnIOThread(const net::CookieMonster::DeleteCallback& callback)
+void CookieMonsterDelegateQt::DeleteSessionCookiesOnIOThread(net::CookieMonster::DeleteCallback callback)
 {
     if (m_cookieMonster)
-        m_cookieMonster->DeleteSessionCookiesAsync(callback);
+        m_cookieMonster->DeleteSessionCookiesAsync(std::move(callback));
 }
 
 void CookieMonsterDelegateQt::deleteAllCookies(quint64 callbackId)
@@ -173,13 +173,13 @@ void CookieMonsterDelegateQt::deleteAllCookies(quint64 callbackId)
 
     net::CookieMonster::DeleteCallback callback = base::Bind(&onDeleteCookiesCallback, m_client->d_func(), callbackId);
     content::BrowserThread::PostTask(content::BrowserThread::IO, FROM_HERE,
-                                     base::Bind(&CookieMonsterDelegateQt::DeleteAllOnIOThread, this, callback));
+                                     base::BindOnce(&CookieMonsterDelegateQt::DeleteAllOnIOThread, this, std::move(callback)));
 }
 
-void CookieMonsterDelegateQt::DeleteAllOnIOThread(const net::CookieMonster::DeleteCallback& callback)
+void CookieMonsterDelegateQt::DeleteAllOnIOThread(net::CookieMonster::DeleteCallback callback)
 {
     if (m_cookieMonster)
-        m_cookieMonster->DeleteAllAsync(callback);
+        m_cookieMonster->DeleteAllAsync(std::move(callback));
 }
 
 void CookieMonsterDelegateQt::setCookieMonster(net::CookieMonster* monster)
diff --git a/src/core/cookie_monster_delegate_qt.h b/src/core/cookie_monster_delegate_qt.h
index 009abdd684de2e6d04c2b12c4cdafbf5002ba986..4625eb264a044c1be9c5c5d2a824cf1e4e3ed14f 100644
--- a/src/core/cookie_monster_delegate_qt.h
+++ b/src/core/cookie_monster_delegate_qt.h
@@ -86,11 +86,11 @@ public:
     void OnCookieChanged(const net::CanonicalCookie& cookie, bool removed, net::CookieStore::ChangeCause cause) override;
 
 private:
-    void GetAllCookiesOnIOThread(const net::CookieMonster::GetCookieListCallback& callback);
-    void SetCookieOnIOThread(const GURL& url, const std::string& cookie_line, const net::CookieMonster::SetCookiesCallback& callback);
+    void GetAllCookiesOnIOThread(net::CookieMonster::GetCookieListCallback callback);
+    void SetCookieOnIOThread(const GURL& url, const std::string& cookie_line, net::CookieMonster::SetCookiesCallback callback);
     void DeleteCookieOnIOThread(const GURL& url, const std::string& cookie_name);
-    void DeleteSessionCookiesOnIOThread(const net::CookieMonster::DeleteCallback& callback);
-    void DeleteAllOnIOThread(const net::CookieMonster::DeleteCallback& callback);
+    void DeleteSessionCookiesOnIOThread(net::CookieMonster::DeleteCallback callback);
+    void DeleteAllOnIOThread(net::CookieMonster::DeleteCallback callback);
 };
 
 }
diff --git a/src/core/delegated_frame_node.cpp b/src/core/delegated_frame_node.cpp
index 12d429770b2a7d14fc10f9094986fcaef408e79e..d0d840ecbc1404a51211610662023dc148ecd7e9 100644
--- a/src/core/delegated_frame_node.cpp
+++ b/src/core/delegated_frame_node.cpp
@@ -71,7 +71,7 @@
 #include "cc/quads/yuv_video_draw_quad.h"
 #include "cc/resources/returned_resource.h"
 #include "cc/resources/transferable_resource.h"
-#include "components/viz/display_compositor/host_shared_bitmap_manager.h"
+#include "components/viz/service/display_embedder/server_shared_bitmap_manager.h"
 #include "gpu/command_buffer/service/mailbox_manager.h"
 #include "ui/gl/gl_context.h"
 #include "ui/gl/gl_fence.h"
@@ -659,7 +659,7 @@ QSharedPointer<QSGTexture> ResourceHolder::initTexture(bool quadNeedsBlending, R
     if (!texture) {
         if (m_resource.is_software) {
             Q_ASSERT(apiDelegate);
-            std::unique_ptr<cc::SharedBitmap> sharedBitmap = viz::HostSharedBitmapManager::current()->GetSharedBitmapFromId(m_resource.size, m_resource.mailbox_holder.mailbox);
+            std::unique_ptr<viz::SharedBitmap> sharedBitmap = viz::ServerSharedBitmapManager::current()->GetSharedBitmapFromId(m_resource.size, m_resource.mailbox_holder.mailbox);
             // QSG interprets QImage::hasAlphaChannel meaning that a node should enable blending
             // to draw it but Chromium keeps this information in the quads.
             // The input format is currently always Format_ARGB32_Premultiplied, so assume that all
@@ -837,7 +837,7 @@ static bool areRenderPassStructuresEqual(cc::CompositorFrame *frameData,
 }
 
 void DelegatedFrameNode::commit(ChromiumCompositorData *chromiumCompositorData,
-                                cc::ReturnedResourceArray *resourcesToRelease,
+                                std::vector<cc::ReturnedResource> *resourcesToRelease,
                                 RenderWidgetHostViewQtDelegate *apiDelegate)
 {
     m_chromiumCompositorData = chromiumCompositorData;
diff --git a/src/core/delegated_frame_node.h b/src/core/delegated_frame_node.h
index cb8b1a5c390f2292ebe231b7ad6d36a21042c53e..b83f4682ab4fd90db07ff8c8cb455f0ed6488673 100644
--- a/src/core/delegated_frame_node.h
+++ b/src/core/delegated_frame_node.h
@@ -91,7 +91,7 @@ public:
     DelegatedFrameNode();
     ~DelegatedFrameNode();
     void preprocess();
-    void commit(ChromiumCompositorData *chromiumCompositorData, cc::ReturnedResourceArray *resourcesToRelease, RenderWidgetHostViewQtDelegate *apiDelegate);
+    void commit(ChromiumCompositorData *chromiumCompositorData, std::vector<cc::ReturnedResource> *resourcesToRelease, RenderWidgetHostViewQtDelegate *apiDelegate);
 
 private:
     void flushPolygons(
diff --git a/src/core/network_delegate_qt.cpp b/src/core/network_delegate_qt.cpp
index 6507ac1cc60925243c52408e5609944cac0c3c56..90d4e6ce2ad5302a0350536e30365e9d3e3c4dfd 100644
--- a/src/core/network_delegate_qt.cpp
+++ b/src/core/network_delegate_qt.cpp
@@ -296,7 +296,7 @@ bool NetworkDelegateQt::OnCanGetCookies(const net::URLRequest&, const net::Cooki
     return true;
 }
 
-bool NetworkDelegateQt::OnCanAccessFile(const net::URLRequest& request, const base::FilePath& path) const
+bool NetworkDelegateQt::OnCanAccessFile(const net::URLRequest&, const base::FilePath&, const base::FilePath&) const
 {
     return true;
 }
diff --git a/src/core/network_delegate_qt.h b/src/core/network_delegate_qt.h
index 590b3b20c2c3a8888d29823efda2806b4519fe67..3607d8ab038ca983d939acaffbe7255106e1e297 100644
--- a/src/core/network_delegate_qt.h
+++ b/src/core/network_delegate_qt.h
@@ -89,7 +89,8 @@ public:
     virtual void OnPACScriptError(int, const base::string16&) override;
     virtual net::NetworkDelegate::AuthRequiredResponse OnAuthRequired(net::URLRequest*, const net::AuthChallengeInfo&, const AuthCallback&, net::AuthCredentials*) override;
     virtual bool OnCanGetCookies(const net::URLRequest&, const net::CookieList&) override;
-    virtual bool OnCanAccessFile(const net::URLRequest& request, const base::FilePath& path) const override;
+    virtual bool OnCanAccessFile(const net::URLRequest&, const base::FilePath&, const base::FilePath&) const override;
+
     virtual bool OnCanEnablePrivacyMode(const GURL&, const GURL&) const override;
     virtual bool OnAreExperimentalCookieFeaturesEnabled() const override;
     virtual bool OnCancelURLRequestWithPolicyViolatingReferrerHeader(const net::URLRequest&, const GURL&, const GURL&) const override;
diff --git a/src/core/permission_manager_qt.cpp b/src/core/permission_manager_qt.cpp
index 4c941406c5ae03627c4a146d64c8bca622586ad1..5328166d1bc69701dd4b69e31aa158e4c85bd305 100644
--- a/src/core/permission_manager_qt.cpp
+++ b/src/core/permission_manager_qt.cpp
@@ -88,18 +88,52 @@ void PermissionManagerQt::permissionRequestReply(const QUrl &origin, BrowserCont
     QPair<QUrl, BrowserContextAdapter::PermissionType> key(origin, type);
     m_permissions[key] = reply;
     blink::mojom::PermissionStatus status = reply ? blink::mojom::PermissionStatus::GRANTED : blink::mojom::PermissionStatus::DENIED;
-    auto it = m_requests.begin();
-    while (it != m_requests.end()) {
-        if (it->origin == origin && it->type == type) {
-            it->callback.Run(status);
-            it = m_requests.erase(it);
-        } else
-            ++it;
+    {
+        auto it = m_requests.begin();
+        while (it != m_requests.end()) {
+            if (it->origin == origin && it->type == type) {
+                it->callback.Run(status);
+                it = m_requests.erase(it);
+            } else
+                ++it;
+        }
     }
     Q_FOREACH (const RequestOrSubscription &subscriber, m_subscribers) {
         if (subscriber.origin == origin && subscriber.type == type)
             subscriber.callback.Run(status);
     }
+
+    auto it = m_multiRequests.begin();
+    while (it != m_multiRequests.end()) {
+        if (it->origin == origin) {
+            bool answerable = true;
+            std::vector<blink::mojom::PermissionStatus> result;
+            result.reserve(it->types.size());
+            for (content::PermissionType permission : it->types) {
+                const BrowserContextAdapter::PermissionType permissionType = toQt(permission);
+                if (permissionType == BrowserContextAdapter::UnsupportedPermission) {
+                    result.push_back(blink::mojom::PermissionStatus::DENIED);
+                    continue;
+                }
+
+                QPair<QUrl, BrowserContextAdapter::PermissionType> key(origin, permissionType);
+                if (!m_permissions.contains(key)) {
+                    answerable = false;
+                    break;
+                }
+                if (m_permissions[key])
+                    result.push_back(blink::mojom::PermissionStatus::GRANTED);
+                else
+                    result.push_back(blink::mojom::PermissionStatus::DENIED);
+            }
+            if (answerable) {
+                it->callback.Run(result);
+                it = m_multiRequests.erase(it);
+                continue;
+            }
+        }
+        ++it;
+    }
 }
 
 bool PermissionManagerQt::checkPermission(const QUrl &origin, BrowserContextAdapter::PermissionType type)
@@ -144,32 +178,46 @@ int PermissionManagerQt::RequestPermissions(const std::vector<content::Permissio
                                             bool /*user_gesture*/,
                                             const base::Callback<void(const std::vector<blink::mojom::PermissionStatus>&)>& callback)
 {
-    NOTIMPLEMENTED() << "RequestPermissions has not been implemented in QtWebEngine";
-    Q_UNUSED(frameHost);
-
-    std::vector<blink::mojom::PermissionStatus> result(permissions.size());
+    bool answerable = true;
+    std::vector<blink::mojom::PermissionStatus> result;
+    result.reserve(permissions.size());
     for (content::PermissionType permission : permissions) {
         const BrowserContextAdapter::PermissionType permissionType = toQt(permission);
         if (permissionType == BrowserContextAdapter::UnsupportedPermission)
             result.push_back(blink::mojom::PermissionStatus::DENIED);
         else {
-            QPair<QUrl, BrowserContextAdapter::PermissionType> key(toQt(requesting_origin), permissionType);
-            // TODO: Request permission from UI
-            if (m_permissions.contains(key) && m_permissions[key])
-                result.push_back(blink::mojom::PermissionStatus::GRANTED);
-            else
-                result.push_back(blink::mojom::PermissionStatus::DENIED);
+            answerable = false;
+            break;
         }
     }
+    if (answerable) {
+        callback.Run(result);
+        return kNoPendingOperation;
+    }
 
-    callback.Run(result);
-    return kNoPendingOperation;
+    int request_id = ++m_requestIdCount;
+    content::WebContents *webContents = frameHost->GetRenderViewHost()->GetDelegate()->GetAsWebContents();
+    WebContentsDelegateQt* contentsDelegate = static_cast<WebContentsDelegateQt*>(webContents->GetDelegate());
+    Q_ASSERT(contentsDelegate);
+    MultiRequest request = {
+        permissions,
+        toQt(requesting_origin),
+        callback
+    };
+    m_multiRequests.insert(request_id, request);
+    for (content::PermissionType permission : permissions) {
+        const BrowserContextAdapter::PermissionType permissionType = toQt(permission);
+        if (permissionType == BrowserContextAdapter::GeolocationPermission)
+            contentsDelegate->requestGeolocationPermission(request.origin);
+    }
+    return request_id;
 }
 
 void PermissionManagerQt::CancelPermissionRequest(int request_id)
 {
     // Should we add API to cancel permissions in the UI level?
     m_requests.remove(request_id);
+    m_multiRequests.remove(request_id);
 }
 
 blink::mojom::PermissionStatus PermissionManagerQt::GetPermissionStatus(
diff --git a/src/core/permission_manager_qt.h b/src/core/permission_manager_qt.h
index e981747629299d78401c67e36f58616119675e40..f51ea3c596a111b64dd8dab13fbbb28629300928 100644
--- a/src/core/permission_manager_qt.h
+++ b/src/core/permission_manager_qt.h
@@ -102,8 +102,14 @@ private:
         QUrl origin;
         base::Callback<void(blink::mojom::PermissionStatus)> callback;
     };
+    struct MultiRequest {
+        std::vector<content::PermissionType> types;
+        QUrl origin;
+        base::Callback<void(const std::vector<blink::mojom::PermissionStatus>&)> callback;
+    };
     QHash<int, RequestOrSubscription> m_requests;
     QHash<int, RequestOrSubscription> m_subscribers;
+    QHash<int, MultiRequest> m_multiRequests;
     int m_requestIdCount;
     int m_subscriberIdCount;
 
diff --git a/src/core/qtwebengine_sources.gni b/src/core/qtwebengine_sources.gni
index d7fe4d70dc8ad9a64734fe73fd238d115c18c4f7..9a2d4aee536ba4720cd9c4f596968fd98222107a 100644
--- a/src/core/qtwebengine_sources.gni
+++ b/src/core/qtwebengine_sources.gni
@@ -7,14 +7,14 @@ import("//printing/features/features.gni")
 
 source_set("qtwebengine_spellcheck_sources") {
   sources = [
+    "//chrome/browser/spellchecker/spell_check_host_impl.cc",
+    "//chrome/browser/spellchecker/spell_check_host_impl.h",
     "//chrome/browser/spellchecker/spellcheck_custom_dictionary.cc",
     "//chrome/browser/spellchecker/spellcheck_custom_dictionary.h",
     "//chrome/browser/spellchecker/spellcheck_factory.cc",
     "//chrome/browser/spellchecker/spellcheck_factory.h",
     "//chrome/browser/spellchecker/spellcheck_hunspell_dictionary.cc",
     "//chrome/browser/spellchecker/spellcheck_hunspell_dictionary.h",
-    "//chrome/browser/spellchecker/spellcheck_message_filter.cc",
-    "//chrome/browser/spellchecker/spellcheck_message_filter.h",
     "//chrome/browser/spellchecker/spellcheck_service.cc",
     "//chrome/browser/spellchecker/spellcheck_service.h",
   ]
@@ -27,7 +27,6 @@ source_set("qtwebengine_spellcheck_sources") {
   ]
   if (is_mac && use_browser_spellchecker) {
     sources += [
-        "//chrome/browser/spellchecker/spellcheck_message_filter_platform.h",
         "//chrome/browser/spellchecker/spellcheck_message_filter_platform_mac.cc",
     ]
   }
diff --git a/src/core/render_widget_host_view_qt.cpp b/src/core/render_widget_host_view_qt.cpp
index 466d2826b2ba59049f7f5fd530f5214a0a21afe4..d1fc7d17114e229ad1653f2bb99233b469c1ef18 100644
--- a/src/core/render_widget_host_view_qt.cpp
+++ b/src/core/render_widget_host_view_qt.cpp
@@ -53,7 +53,10 @@
 
 #include "base/command_line.h"
 #include "cc/output/direct_renderer.h"
+#include "components/viz/service/frame_sinks/frame_sink_manager_impl.h"
 #include "content/browser/accessibility/browser_accessibility_state_impl.h"
+#include "content/browser/browser_main_loop.h"
+#include "content/browser/frame_host/render_frame_host_impl.h"
 #include "content/browser/frame_host/frame_tree.h"
 #include "content/browser/renderer_host/render_view_host_impl.h"
 #include "content/common/cursors/webcursor.h"
@@ -272,7 +275,6 @@ RenderWidgetHostViewQt::RenderWidgetHostViewQt(content::RenderWidgetHost* widget
     , m_initPending(false)
     , m_beginFrameSource(nullptr)
     , m_needsBeginFrames(false)
-    , m_needsFlushInput(false)
     , m_addedFrameObserver(false)
     , m_backgroundColor(SK_ColorWHITE)
     , m_imState(0)
@@ -664,7 +666,7 @@ bool RenderWidgetHostViewQt::HasAcceleratedSurface(const gfx::Size&)
     return false;
 }
 
-void RenderWidgetHostViewQt::DidCreateNewRendererCompositorFrameSink(cc::mojom::MojoCompositorFrameSinkClient *frameSink)
+void RenderWidgetHostViewQt::DidCreateNewRendererCompositorFrameSink(cc::mojom::CompositorFrameSinkClient *frameSink)
 {
     // Accumulated resources belong to the old RendererCompositorFrameSink and
     // should not be returned.
@@ -672,7 +674,7 @@ void RenderWidgetHostViewQt::DidCreateNewRendererCompositorFrameSink(cc::mojom::
     m_rendererCompositorFrameSink = frameSink;
 }
 
-void RenderWidgetHostViewQt::SubmitCompositorFrame(const cc::LocalSurfaceId &local_surface_id, cc::CompositorFrame frame)
+void RenderWidgetHostViewQt::SubmitCompositorFrame(const viz::LocalSurfaceId &local_surface_id, cc::CompositorFrame frame)
 {
     bool scrollOffsetChanged = (m_lastScrollOffset != frame.metadata.root_scroll_offset);
     bool contentsSizeChanged = (m_lastContentsSize != frame.metadata.root_layer_size);
@@ -795,10 +797,10 @@ void RenderWidgetHostViewQt::OnTextSelectionChanged(content::TextInputManager *t
         return;
 
 #if defined(USE_X11)
-    if (!GetSelectedText().empty() && selection->user_initiated()) {
+    if (!selection->selected_text().empty() && selection->user_initiated()) {
         // Set the CLIPBOARD_TYPE_SELECTION to the ui::Clipboard.
         ui::ScopedClipboardWriter clipboard_writer(ui::CLIPBOARD_TYPE_SELECTION);
-        clipboard_writer.WriteText(GetSelectedText());
+        clipboard_writer.WriteText(selection->selected_text());
     }
 #endif // defined(USE_X11)
 
@@ -866,10 +868,10 @@ void RenderWidgetHostViewQt::selectionChanged()
     m_anchorPositionWithinSelection = newAnchorPositionWithinSelection;
     m_cursorPositionWithinSelection = newCursorPositionWithinSelection;
 
-    if (!GetSelectedText().empty())
+    if (!selection->selected_text().empty())
         m_cursorPosition = newCursorPositionWithinSelection;
 
-    m_emptyPreviousSelection = GetSelectedText().empty();
+    m_emptyPreviousSelection = selection->selected_text().empty();
     m_adapterClient->selectionChanged();
 }
 
@@ -1026,14 +1028,13 @@ QVariant RenderWidgetHostViewQt::inputMethodQuery(Qt::InputMethodQuery query)
 void RenderWidgetHostViewQt::ProcessAckedTouchEvent(const content::TouchEventWithLatencyInfo &touch, content::InputEventAckState ack_result) {
     Q_UNUSED(touch);
     const bool eventConsumed = ack_result == content::INPUT_EVENT_ACK_STATE_CONSUMED;
-    m_gestureProvider.OnTouchEventAck(touch.event.unique_touch_event_id, eventConsumed);
+    m_gestureProvider.OnTouchEventAck(touch.event.unique_touch_event_id, eventConsumed, /*fixme: ?? */false);
 }
 
 void RenderWidgetHostViewQt::sendDelegatedFrameAck()
 {
-    const cc::BeginFrameAck ack;
-    m_beginFrameSource->DidFinishFrame(this, ack);
-    cc::ReturnedResourceArray resources;
+    m_beginFrameSource->DidFinishFrame(this);
+    std::vector<cc::ReturnedResource> resources;
     m_resourcesToRelease.swap(resources);
     if (m_rendererCompositorFrameSink)
         m_rendererCompositorFrameSink->DidReceiveCompositorFrameAck(resources);
@@ -1148,7 +1149,7 @@ void RenderWidgetHostViewQt::handleKeyEvent(QKeyEvent *ev)
             if (ev->type() == QEvent::KeyRelease) {
                 m_receivedEmptyImeText = false;
                 m_host->ImeSetComposition(toString16(ev->text()),
-                                          std::vector<blink::WebCompositionUnderline>(),
+                                          std::vector<ui::CompositionUnderline>(),
                                           gfx::Range::InvalidRange(),
                                           gfx::Range::InvalidRange().start(),
                                           gfx::Range::InvalidRange().end());
@@ -1189,7 +1190,7 @@ void RenderWidgetHostViewQt::handleInputMethodEvent(QInputMethodEvent *ev)
     gfx::Range selectionRange = gfx::Range::InvalidRange();
 
     const QList<QInputMethodEvent::Attribute> &attributes = ev->attributes();
-    std::vector<blink::WebCompositionUnderline> underlines;
+    std::vector<ui::CompositionUnderline> underlines;
     bool hasSelection = false;
 
     for (const auto &attribute : attributes) {
@@ -1214,7 +1215,7 @@ void RenderWidgetHostViewQt::handleInputMethodEvent(QInputMethodEvent *ev)
             if (format.underlineStyle() != QTextCharFormat::NoUnderline)
                 underlineColor = format.underlineColor();
 
-            underlines.push_back(blink::WebCompositionUnderline(start, end, toSk(underlineColor), /*thick*/ false, SK_ColorTRANSPARENT));
+            underlines.push_back(ui::CompositionUnderline(start, end, toSk(underlineColor), /*thick*/ false, SK_ColorTRANSPARENT));
             break;
         }
         case QInputMethodEvent::Cursor:
@@ -1253,9 +1254,9 @@ void RenderWidgetHostViewQt::handleInputMethodEvent(QInputMethodEvent *ev)
     }
 
     if (hasSelection) {
-        content::RenderFrameHost *frameHost = getFocusedFrameHost();
+        content::RenderFrameHostImpl *frameHost = static_cast<content::RenderFrameHostImpl *>(getFocusedFrameHost());
         if (frameHost)
-            frameHost->Send(new InputMsg_SetEditableSelectionOffsets(frameHost->GetRoutingID(), selectionRange.start(), selectionRange.end()));
+            frameHost->GetFrameInputHandler()->SetEditableSelectionOffsets(selectionRange.start(), selectionRange.end());
     }
 
     int replacementLength = ev->replacementLength();
@@ -1511,35 +1512,28 @@ void RenderWidgetHostViewQt::SetNeedsBeginFrames(bool needs_begin_frames)
     updateNeedsBeginFramesInternal();
 }
 
-void RenderWidgetHostViewQt::OnSetNeedsFlushInput()
-{
-    m_needsFlushInput = true;
-    updateNeedsBeginFramesInternal();
-}
-
 void RenderWidgetHostViewQt::updateNeedsBeginFramesInternal()
 {
     if (!m_beginFrameSource)
         return;
 
-    // Based on upstream Chromium commit 7f7c8cc8b97dd0d5c9159d9e60c62efbc35e6b53.
-    bool needsFrame = m_needsBeginFrames || m_needsFlushInput;
-    if (m_addedFrameObserver == needsFrame)
+    if (m_addedFrameObserver == m_needsBeginFrames)
         return;
 
-    m_addedFrameObserver = needsFrame;
-    if (needsFrame)
+    if (m_needsBeginFrames)
         m_beginFrameSource->AddObserver(this);
     else
         m_beginFrameSource->RemoveObserver(this);
+    m_addedFrameObserver = m_needsBeginFrames;
 }
 
 bool RenderWidgetHostViewQt::OnBeginFrameDerivedImpl(const cc::BeginFrameArgs& args)
 {
-    m_needsFlushInput = false;
     m_beginFrameSource->OnUpdateVSyncParameters(args.frame_time, args.interval);
-    updateNeedsBeginFramesInternal();
-    m_host->Send(new ViewMsg_BeginFrame(m_host->GetRoutingID(), args));
+    if (m_rendererCompositorFrameSink)
+        m_rendererCompositorFrameSink->OnBeginFrame(args);
+    else // FIXME: is this else part ever needed?
+        m_host->Send(new ViewMsg_BeginFrame(m_host->GetRoutingID(), args));
     return true;
 }
 
diff --git a/src/core/render_widget_host_view_qt.h b/src/core/render_widget_host_view_qt.h
index 0db5df8621a45d11dff4ba72b67ee7b63f187213..59e21b853932d372c97a90d4170e9ea4ee6de3a6 100644
--- a/src/core/render_widget_host_view_qt.h
+++ b/src/core/render_widget_host_view_qt.h
@@ -150,15 +150,14 @@ public:
     void Destroy() override;
     void SetTooltipText(const base::string16 &tooltip_text) override;
     bool HasAcceleratedSurface(const gfx::Size&) override;
-    void DidCreateNewRendererCompositorFrameSink(cc::mojom::MojoCompositorFrameSinkClient*) override;
-    void SubmitCompositorFrame(const cc::LocalSurfaceId&, cc::CompositorFrame) override;
+    void DidCreateNewRendererCompositorFrameSink(cc::mojom::CompositorFrameSinkClient* renderer_compositor_frame_sink) override;
+    void SubmitCompositorFrame(const viz::LocalSurfaceId&, cc::CompositorFrame) override;
 
     void GetScreenInfo(content::ScreenInfo* results);
     gfx::Rect GetBoundsInRootWindow() override;
     void ProcessAckedTouchEvent(const content::TouchEventWithLatencyInfo &touch, content::InputEventAckState ack_result) override;
     void ClearCompositorFrame() override;
     void SetNeedsBeginFrames(bool needs_begin_frames) override;
-    void OnSetNeedsFlushInput() override;
 
     // Overridden from ui::GestureProviderClient.
     void OnGestureEvent(const ui::GestureEventData& gesture) override;
@@ -239,14 +238,14 @@ private:
     std::unique_ptr<RenderWidgetHostViewQtDelegate> m_delegate;
 
     QExplicitlySharedDataPointer<ChromiumCompositorData> m_chromiumCompositorData;
-    cc::ReturnedResourceArray m_resourcesToRelease;
+    std::vector<cc::ReturnedResource> m_resourcesToRelease;
     bool m_needsDelegatedFrameAck;
     LoadVisuallyCommittedState m_loadVisuallyCommittedState;
 
     QMetaObject::Connection m_adapterClientDestroyedConnection;
     WebContentsAdapterClient *m_adapterClient;
     MultipleMouseClickHelper m_clickHelper;
-    cc::mojom::MojoCompositorFrameSinkClient *m_rendererCompositorFrameSink;
+    cc::mojom::CompositorFrameSinkClient *m_rendererCompositorFrameSink;
 
     bool m_imeInProgress;
     bool m_receivedEmptyImeText;
@@ -256,13 +255,12 @@ private:
 
     std::unique_ptr<cc::SyntheticBeginFrameSource> m_beginFrameSource;
     bool m_needsBeginFrames;
-    bool m_needsFlushInput;
     bool m_addedFrameObserver;
 
     gfx::Vector2dF m_lastScrollOffset;
     gfx::SizeF m_lastContentsSize;
     SkColor m_backgroundColor;
-    cc::LocalSurfaceId m_localSurfaceId;
+    viz::LocalSurfaceId m_localSurfaceId;
 
     uint m_imState;
     int m_anchorPositionWithinSelection;
diff --git a/src/core/renderer/web_channel_ipc_transport.cpp b/src/core/renderer/web_channel_ipc_transport.cpp
index edd223223419ebfb6896646cac1d0abdc608af2e..554bda2a832ad30c7c74eb0957b71850e73a97ae 100644
--- a/src/core/renderer/web_channel_ipc_transport.cpp
+++ b/src/core/renderer/web_channel_ipc_transport.cpp
@@ -105,7 +105,7 @@ void WebChannelTransport::Install(blink::WebFrame *frame, uint worldId)
     v8::HandleScope handleScope(isolate);
     v8::Handle<v8::Context> context;
     if (worldId == 0)
-        context = frame->MainWorldScriptContext();
+        context = frame->ToWebLocalFrame()->MainWorldScriptContext();
     else
         context = frame->ToWebLocalFrame()->IsolatedWorldScriptContext(worldId);
     v8::Context::Scope contextScope(context);
@@ -126,7 +126,7 @@ void WebChannelTransport::Uninstall(blink::WebFrame *frame, uint worldId)
     v8::HandleScope handleScope(isolate);
     v8::Handle<v8::Context> context;
     if (worldId == 0)
-        context = frame->MainWorldScriptContext();
+        context = frame->ToWebLocalFrame()->MainWorldScriptContext();
     else
         context = frame->ToWebLocalFrame()->IsolatedWorldScriptContext(worldId);
     v8::Context::Scope contextScope(context);
@@ -209,7 +209,7 @@ void WebChannelIPCTransport::dispatchWebChannelMessage(const std::vector<char> &
     blink::WebFrame *frame = webView->MainFrame();
     v8::Handle<v8::Context> context;
     if (worldId == 0)
-        context = frame->MainWorldScriptContext();
+        context = frame->ToWebLocalFrame()->MainWorldScriptContext();
     else
         context = frame->ToWebLocalFrame()->IsolatedWorldScriptContext(worldId);
     v8::Context::Scope contextScope(context);
@@ -239,7 +239,7 @@ void WebChannelIPCTransport::dispatchWebChannelMessage(const std::vector<char> &
     const int argc = 1;
     v8::Handle<v8::Value> argv[argc];
     argv[0] = messageObject;
-    frame->CallFunctionEvenIfScriptDisabled(callback, webChannelObjectValue->ToObject(), argc, argv);
+    frame->ToWebLocalFrame()->CallFunctionEvenIfScriptDisabled(callback, webChannelObjectValue->ToObject(), argc, argv);
 }
 
 bool WebChannelIPCTransport::OnMessageReceived(const IPC::Message &message)
diff --git a/src/core/surface_factory_qt.cpp b/src/core/surface_factory_qt.cpp
index 6e5e13866debf8f39a8ebf7ef422e07debe5c8a4..d0741506ae09d32d525cdd60fb7d0b007812d664 100644
--- a/src/core/surface_factory_qt.cpp
+++ b/src/core/surface_factory_qt.cpp
@@ -77,8 +77,7 @@ protected:
     intptr_t GetNativeDisplay() override;
 
     // Sets up GL bindings for the native surface.
-    bool LoadGLES2Bindings() override;
-
+    bool LoadGLES2Bindings(gl::GLImplementation implementation) override;
 };
 
 base::NativeLibrary LoadLibrary(const base::FilePath& filename) {
@@ -91,7 +90,7 @@ base::NativeLibrary LoadLibrary(const base::FilePath& filename) {
     return library;
 }
 
-bool GLOzoneQt::LoadGLES2Bindings()
+bool GLOzoneQt::LoadGLES2Bindings(gl::GLImplementation /*implementation*/)
 {
     base::NativeLibrary eglgles2Library = dlopen(NULL, RTLD_LAZY);
     if (!eglgles2Library) {
diff --git a/src/core/type_conversion.cpp b/src/core/type_conversion.cpp
index a7b5ee8319fb4dd8cc5fb2169931e6ff7cc5574b..685ee273e48911a4b9c0c4bd1aecf75b1e3629a0 100644
--- a/src/core/type_conversion.cpp
+++ b/src/core/type_conversion.cpp
@@ -39,6 +39,7 @@
 
 #include "type_conversion.h"
 
+#include <content/public/common/favicon_url.h>
 #include <ui/events/event_constants.h>
 #include <ui/gfx/image/image_skia.h>
 #include <QtCore/qcoreapplication.h>
@@ -104,17 +105,6 @@ QImage toQImage(const SkBitmap &bitmap)
             break;
         }
         break;
-    case kIndex_8_SkColorType: {
-        image = toQImage(bitmap, QImage::Format_Indexed8);
-        SkColorTable *skTable = bitmap.getColorTable();
-        if (skTable) {
-            QVector<QRgb> qTable(skTable->count());
-            for (int i = 0; i < skTable->count(); ++i)
-                qTable[i] = (*skTable)[i];
-            image.setColorTable(qTable);
-        }
-        break;
-    }
     case kGray_8_SkColorType:
         image = toQImage(bitmap, QImage::Format_Grayscale8);
         break;
@@ -171,31 +161,30 @@ int flagsFromModifiers(Qt::KeyboardModifiers modifiers)
     return modifierFlags;
 }
 
+FaviconInfo::FaviconType toQt(content::FaviconURL::IconType type)
+{
+    switch (type) {
+    case content::FaviconURL::IconType::kFavicon:
+        return FaviconInfo::Favicon;
+    case content::FaviconURL::IconType::kTouchIcon:
+        return FaviconInfo::TouchIcon;
+    case content::FaviconURL::IconType::kTouchPrecomposedIcon:
+        return FaviconInfo::TouchPrecomposedIcon;
+    case content::FaviconURL::IconType::kInvalid:
+        return FaviconInfo::InvalidIcon;
+    }
+    Q_UNREACHABLE();
+    return FaviconInfo::InvalidIcon;
+}
+
 FaviconInfo toFaviconInfo(const content::FaviconURL &favicon_url)
 {
     FaviconInfo info;
-
     info.url = toQt(favicon_url.icon_url);
-
-    switch (favicon_url.icon_type) {
-    case content::FaviconURL::FAVICON:
-        info.type = FaviconInfo::Favicon;
-        break;
-    case content::FaviconURL::TOUCH_ICON:
-        info.type = FaviconInfo::TouchIcon;
-        break;
-    case content::FaviconURL::TOUCH_PRECOMPOSED_ICON:
-        info.type = FaviconInfo::TouchPrecomposedIcon;
-        break;
-    default:
-        info.type = FaviconInfo::InvalidIcon;
-        break;
-    }
-
+    info.type = toQt(favicon_url.icon_type);
     // TODO: Add support for rel sizes attribute (favicon_url.icon_sizes):
     // http://www.w3schools.com/tags/att_link_sizes.asp
     info.size = QSize(0, 0);
-
     return info;
 }
 
diff --git a/src/core/type_conversion.h b/src/core/type_conversion.h
index ed02a9db9a65a0dd4fe76cbff8d261fdd9da34b0..d9ba735bdf6153a44d0d0803dea7f22b3aa24f9c 100644
--- a/src/core/type_conversion.h
+++ b/src/core/type_conversion.h
@@ -54,7 +54,6 @@
 #include "base/files/file_path.h"
 #include "base/time/time.h"
 #include "content/public/common/file_chooser_file_info.h"
-#include "content/public/common/favicon_url.h"
 #include "favicon_manager.h"
 #include "net/cookies/canonical_cookie.h"
 #include "third_party/skia/include/core/SkBitmap.h"
@@ -65,6 +64,10 @@
 #include "ui/gfx/geometry/rect_f.h"
 #include "url/gurl.h"
 
+namespace content {
+struct FaviconURL;
+}
+
 namespace gfx {
 class ImageSkiaRep;
 }
diff --git a/src/core/url_request_context_getter_qt.cpp b/src/core/url_request_context_getter_qt.cpp
index 8a6717e91cd31bea2b9b60d54d4a5b9189d2558f..4f1850f54ec2ae0909c9860744ab5f5421eb0928 100644
--- a/src/core/url_request_context_getter_qt.cpp
+++ b/src/core/url_request_context_getter_qt.cpp
@@ -175,9 +175,7 @@ void URLRequestContextGetterQt::updateStorageSettings()
         m_proxyConfigService =
                 new ProxyConfigServiceQt(
                     net::ProxyService::CreateSystemProxyConfigService(
-                        content::BrowserThread::GetTaskRunnerForThread(BrowserThread::IO),
-                        content::BrowserThread::GetTaskRunnerForThread(BrowserThread::FILE)
-                ));
+                        content::BrowserThread::GetTaskRunnerForThread(BrowserThread::IO)));
         if (m_contextInitialized)
             content::BrowserThread::PostTask(content::BrowserThread::IO, FROM_HERE,
                                              base::Bind(&URLRequestContextGetterQt::generateAllStorage, this));
@@ -410,7 +408,7 @@ void URLRequestContextGetterQt::updateRequestInterceptor()
     // We in this case do not need to regenerate any Chromium classes.
 }
 
-static bool doNetworkSessionParamsMatch(const net::HttpNetworkSession::Params &first, const net::HttpNetworkSession::Params &second)
+static bool doNetworkSessionContextMatch(const net::HttpNetworkSession::Context &first, const net::HttpNetworkSession::Context &second)
 {
     if (first.transport_security_state != second.transport_security_state)
         return false;
@@ -426,8 +424,6 @@ static bool doNetworkSessionParamsMatch(const net::HttpNetworkSession::Params &f
         return false;
     if (first.http_server_properties != second.http_server_properties)
         return false;
-    if (first.ignore_certificate_errors != second.ignore_certificate_errors)
-        return false;
     if (first.host_resolver != second.host_resolver)
         return false;
     if (first.cert_transparency_verifier != second.cert_transparency_verifier)
@@ -438,23 +434,41 @@ static bool doNetworkSessionParamsMatch(const net::HttpNetworkSession::Params &f
     return true;
 }
 
+static bool doNetworkSessionParamsMatch(const net::HttpNetworkSession::Params &first, const net::HttpNetworkSession::Params &second)
+{
+    if (first.ignore_certificate_errors != second.ignore_certificate_errors)
+        return false;
+
+    return true;
+}
+
+net::HttpNetworkSession::Context URLRequestContextGetterQt::generateNetworkSessionContext()
+{
+    Q_ASSERT(m_urlRequestContext);
+
+    net::HttpNetworkSession::Context network_session_context;
+
+    network_session_context.transport_security_state     = m_urlRequestContext->transport_security_state();
+    network_session_context.cert_verifier                = m_urlRequestContext->cert_verifier();
+    network_session_context.channel_id_service           = m_urlRequestContext->channel_id_service();
+    network_session_context.proxy_service                = m_urlRequestContext->proxy_service();
+    network_session_context.ssl_config_service           = m_urlRequestContext->ssl_config_service();
+    network_session_context.http_auth_handler_factory    = m_urlRequestContext->http_auth_handler_factory();
+    network_session_context.http_server_properties       = m_urlRequestContext->http_server_properties();
+    network_session_context.host_resolver                = m_urlRequestContext->host_resolver();
+    network_session_context.cert_transparency_verifier   = m_urlRequestContext->cert_transparency_verifier();
+    network_session_context.ct_policy_enforcer           = m_urlRequestContext->ct_policy_enforcer();
+
+    return network_session_context;
+}
+
 net::HttpNetworkSession::Params URLRequestContextGetterQt::generateNetworkSessionParams()
 {
     Q_ASSERT(m_urlRequestContext);
 
     net::HttpNetworkSession::Params network_session_params;
 
-    network_session_params.transport_security_state     = m_urlRequestContext->transport_security_state();
-    network_session_params.cert_verifier                = m_urlRequestContext->cert_verifier();
-    network_session_params.channel_id_service           = m_urlRequestContext->channel_id_service();
-    network_session_params.proxy_service                = m_urlRequestContext->proxy_service();
-    network_session_params.ssl_config_service           = m_urlRequestContext->ssl_config_service();
-    network_session_params.http_auth_handler_factory    = m_urlRequestContext->http_auth_handler_factory();
-    network_session_params.http_server_properties       = m_urlRequestContext->http_server_properties();
     network_session_params.ignore_certificate_errors    = m_ignoreCertificateErrors;
-    network_session_params.host_resolver                = m_urlRequestContext->host_resolver();
-    network_session_params.cert_transparency_verifier   = m_urlRequestContext->cert_transparency_verifier();
-    network_session_params.ct_policy_enforcer           = m_urlRequestContext->ct_policy_enforcer();
 
     return network_session_params;
 }
@@ -499,11 +513,14 @@ void URLRequestContextGetterQt::generateHttpCache()
     }
 
     net::HttpCache *cache = 0;
+    net::HttpNetworkSession::Context network_session_context = generateNetworkSessionContext();
     net::HttpNetworkSession::Params network_session_params = generateNetworkSessionParams();
 
-    if (!m_httpNetworkSession || !doNetworkSessionParamsMatch(network_session_params, m_httpNetworkSession->params())) {
+    if (!m_httpNetworkSession
+            || !doNetworkSessionParamsMatch(network_session_params, m_httpNetworkSession->params())
+            || !doNetworkSessionContextMatch(network_session_context, m_httpNetworkSession->context())) {
         cancelAllUrlRequests();
-        m_httpNetworkSession.reset(new net::HttpNetworkSession(network_session_params));
+        m_httpNetworkSession.reset(new net::HttpNetworkSession(network_session_params, network_session_context));
     }
 
     cache = new net::HttpCache(m_httpNetworkSession.get(), std::unique_ptr<net::HttpCache::DefaultBackend>(main_backend), false);
diff --git a/src/core/url_request_context_getter_qt.h b/src/core/url_request_context_getter_qt.h
index 9757cc73ecf731945e5a6b3422c6f5b7a782f2ff..511d9eb046de83406a64bbf991b33f91c89d5478 100644
--- a/src/core/url_request_context_getter_qt.h
+++ b/src/core/url_request_context_getter_qt.h
@@ -99,6 +99,7 @@ private:
     void clearCurrentCacheBackend();
     void cancelAllUrlRequests();
     net::HttpNetworkSession::Params generateNetworkSessionParams();
+    net::HttpNetworkSession::Context generateNetworkSessionContext();
 
     void setFullConfiguration(QSharedPointer<BrowserContextAdapter> browserContext);
 
diff --git a/src/core/web_contents_adapter.cpp b/src/core/web_contents_adapter.cpp
index a5e33257e9af9d329d5dbfb2166ba4694a4b6fec..effd6e340498336c288cfbcee8e212869d30a5e7 100644
--- a/src/core/web_contents_adapter.cpp
+++ b/src/core/web_contents_adapter.cpp
@@ -954,9 +954,26 @@ void WebContentsAdapter::download(const QUrl &url, const QString &suggestedFileN
     dlmd->setDownloadType(BrowserContextAdapterClient::UserRequested);
     dlm->SetDelegate(dlmd);
 
+    net::NetworkTrafficAnnotationTag traffic_annotation =
+        net::DefineNetworkTrafficAnnotation(
+            "WebContentsAdapter::download", R"(
+            semantics {
+              sender: "User"
+              description:
+                "User requested download"
+              trigger: "User."
+              data: "Anything."
+              destination: OTHER
+            }
+            policy {
+              cookies_allowed: YES
+              cookies_store: "user"
+              setting:
+                "It's possible not to use this feature."
+            })");
     GURL gurl = toGurl(url);
     std::unique_ptr<content::DownloadUrlParameters> params(
-        content::DownloadUrlParameters::CreateForWebContentsMainFrame(webContents(), gurl));
+        content::DownloadUrlParameters::CreateForWebContentsMainFrame(webContents(), gurl, traffic_annotation));
 
     params->set_suggested_name(toString16(suggestedFileName));
 
@@ -1514,6 +1531,8 @@ ASSERT_ENUMS_MATCH(ReferrerPolicy::Never, blink::kWebReferrerPolicyNever)
 ASSERT_ENUMS_MATCH(ReferrerPolicy::Origin, blink::kWebReferrerPolicyOrigin)
 ASSERT_ENUMS_MATCH(ReferrerPolicy::OriginWhenCrossOrigin, blink::kWebReferrerPolicyOriginWhenCrossOrigin)
 ASSERT_ENUMS_MATCH(ReferrerPolicy::NoReferrerWhenDowngradeOriginWhenCrossOrigin, blink::kWebReferrerPolicyNoReferrerWhenDowngradeOriginWhenCrossOrigin)
+ASSERT_ENUMS_MATCH(ReferrerPolicy::SameOrigin, blink::kWebReferrerPolicySameOrigin)
+ASSERT_ENUMS_MATCH(ReferrerPolicy::StrictOrigin, blink::kWebReferrerPolicyStrictOrigin)
 ASSERT_ENUMS_MATCH(ReferrerPolicy::Last, blink::kWebReferrerPolicyLast)
 
 } // namespace QtWebEngineCore
diff --git a/src/core/web_contents_adapter_client.h b/src/core/web_contents_adapter_client.h
index 4280dbfe1f8ce96ad67d9ac15bee70d07253be19..bc45a90fbda40fdd908059edf14fe7ccaf4f358f 100644
--- a/src/core/web_contents_adapter_client.h
+++ b/src/core/web_contents_adapter_client.h
@@ -80,7 +80,9 @@ enum class ReferrerPolicy {
     Origin,
     OriginWhenCrossOrigin,
     NoReferrerWhenDowngradeOriginWhenCrossOrigin,
-    Last = NoReferrerWhenDowngradeOriginWhenCrossOrigin,
+    SameOrigin,
+    StrictOrigin,
+    Last = StrictOrigin,
 };
 
 class WebEngineContextMenuSharedData : public QSharedData {
diff --git a/src/core/web_contents_delegate_qt.cpp b/src/core/web_contents_delegate_qt.cpp
index a997c53de349837ef8a01a8cdb5311bca2901a11..f35620c86b42ef022fbbdb97898646f34a8f9c9e 100644
--- a/src/core/web_contents_delegate_qt.cpp
+++ b/src/core/web_contents_delegate_qt.cpp
@@ -118,6 +118,7 @@ content::WebContents *WebContentsDelegateQt::OpenURLFromTab(content::WebContents
     load_url_params.extra_headers = params.extra_headers;
     load_url_params.should_replace_current_entry = params.should_replace_current_entry;
     load_url_params.is_renderer_initiated = params.is_renderer_initiated;
+    load_url_params.started_from_context_menu = params.started_from_context_menu;
     load_url_params.override_user_agent = content::NavigationController::UA_OVERRIDE_TRUE;
     if (params.uses_post) {
         load_url_params.load_type = content::NavigationController::LOAD_TYPE_HTTP_POST;
@@ -340,9 +341,12 @@ void WebContentsDelegateQt::DidUpdateFaviconURL(const std::vector<content::Favic
     m_faviconManager->update(faviconCandidates);
 }
 
-void WebContentsDelegateQt::WebContentsCreated(content::WebContents* /*source_contents*/, int /*opener_render_process_id*/, int /*opener_render_frame_id*/, const std::string& /*frame_name*/, const GURL& target_url, content::WebContents* new_contents, const base::Optional<content::WebContents::CreateParams>& create_params)
+void WebContentsDelegateQt::WebContentsCreated(content::WebContents */*source_contents*/,
+                                               int /*opener_render_process_id*/, int /*opener_render_frame_id*/,
+                                               const std::string &/*frame_name*/,
+                                               const GURL &target_url, content::WebContents */*new_contents*/)
 {
-    this->m_initialTargetUrl = toQt(target_url);
+    m_initialTargetUrl = toQt(target_url);
 }
 
 content::ColorChooser *WebContentsDelegateQt::OpenColorChooser(content::WebContents *source, SkColor color, const std::vector<content::ColorSuggestion> &suggestion)
diff --git a/src/core/web_contents_delegate_qt.h b/src/core/web_contents_delegate_qt.h
index 2e37c498a6e6742a4fc36a17ad9d6eb0fd6451ec..44fb93093ad6d4b51ce3b74839a5b30376d507f0 100644
--- a/src/core/web_contents_delegate_qt.h
+++ b/src/core/web_contents_delegate_qt.h
@@ -105,7 +105,8 @@ public:
     void LoadProgressChanged(content::WebContents* source, double progress) override;
     void HandleKeyboardEvent(content::WebContents *source, const content::NativeWebKeyboardEvent &event) override;
     content::ColorChooser *OpenColorChooser(content::WebContents *source, SkColor color, const std::vector<content::ColorSuggestion> &suggestion) override;
-    void WebContentsCreated(content::WebContents* source_contents, int opener_render_process_id, int opener_render_frame_id, const std::string& frame_name, const GURL& target_url, content::WebContents* new_contents, const base::Optional<content::WebContents::CreateParams>& create_params) override;
+    void WebContentsCreated(content::WebContents *source_contents, int opener_render_process_id, int opener_render_frame_id,
+                            const std::string &frame_name, const GURL &target_url, content::WebContents *new_contents) override;
     content::JavaScriptDialogManager *GetJavaScriptDialogManager(content::WebContents *source) override;
     void EnterFullscreenModeForTab(content::WebContents* web_contents, const GURL& origin) override;
     void ExitFullscreenModeForTab(content::WebContents*) override;
diff --git a/src/core/web_engine_context.cpp b/src/core/web_engine_context.cpp
index 2339537aa9b91b7e88c806e8b5129a935cc063ab..f3818b194a9b3ca4994cbb1032113f2fe1fd94e4 100644
--- a/src/core/web_engine_context.cpp
+++ b/src/core/web_engine_context.cpp
@@ -332,6 +332,9 @@ WebEngineContext::WebEngineContext()
     // Enabled on OS X and Linux but currently not working. It worked in 5.7 on OS X.
     parsedCommandLine->AppendSwitch(switches::kDisableGpuMemoryBufferVideoFrames);
 
+    // The Mojo local-storage is currently pretty broken and saves in $$PWD/Local\ Storage
+    parsedCommandLine->AppendSwitch(switches::kDisableMojoLocalStorage);
+
 #if defined(Q_OS_MACOS)
     // Accelerated decoding currently does not work on macOS due to issues with OpenGL Rectangle
     // texture support. See QTBUG-60002.
diff --git a/src/webengine/api/qquickwebengineview.cpp b/src/webengine/api/qquickwebengineview.cpp
index 78fdd8fa819183b177eec00b047812ffad4269a0..3da21fde59365eefe9f2ca781468da6c0e409fe0 100644
--- a/src/webengine/api/qquickwebengineview.cpp
+++ b/src/webengine/api/qquickwebengineview.cpp
@@ -138,6 +138,7 @@ QQuickWebEngineViewPrivate::QQuickWebEngineViewPrivate()
     , m_fullscreenMode(false)
     , isLoading(false)
     , m_activeFocusOnPress(true)
+    , m_validationShowing(false)
     , devicePixelRatio(QGuiApplication::primaryScreen()->devicePixelRatio())
     , m_webChannel(0)
     , m_webChannelWorld(0)
@@ -1124,7 +1125,8 @@ void QQuickWebEngineViewPrivate::showValidationMessage(const QRect &anchor, cons
     Q_Q(QQuickWebEngineView);
     QQuickWebEngineFormValidationMessageRequest *request;
     request = new QQuickWebEngineFormValidationMessageRequest(QQuickWebEngineFormValidationMessageRequest::Show,
-                                                          anchor,mainText,subText);
+                                                              anchor,mainText,subText);
+    m_validationShowing = true;
     // mark the object for gc by creating temporary jsvalue
     qmlEngine(q)->newQObject(request);
     Q_EMIT q->formValidationMessageRequested(request);
@@ -1135,8 +1137,12 @@ void QQuickWebEngineViewPrivate::showValidationMessage(const QRect &anchor, cons
 void QQuickWebEngineViewPrivate::hideValidationMessage()
 {
     Q_Q(QQuickWebEngineView);
+    // Suppress the initial hide message before any show messages (Since 61-based)
+    if (!m_validationShowing)
+        return;
     QQuickWebEngineFormValidationMessageRequest *request;
     request = new QQuickWebEngineFormValidationMessageRequest(QQuickWebEngineFormValidationMessageRequest::Hide);
+    m_validationShowing = false;
     // mark the object for gc by creating temporary jsvalue
     qmlEngine(q)->newQObject(request);
     Q_EMIT q->formValidationMessageRequested(request);
diff --git a/src/webengine/api/qquickwebengineview_p_p.h b/src/webengine/api/qquickwebengineview_p_p.h
index 19ecf5e1fdb38f35252cd966eccff71313640d59..bd9b2909bab7c654cd1400f2ec30ea2bb2a201c3 100644
--- a/src/webengine/api/qquickwebengineview_p_p.h
+++ b/src/webengine/api/qquickwebengineview_p_p.h
@@ -179,6 +179,7 @@ public:
     bool isLoading;
     bool m_activeFocusOnPress;
     bool m_navigationActionTriggered;
+    bool m_validationShowing;
     qreal devicePixelRatio;
     QMap<quint64, QJSValue> m_callbacks;
     QList<QSharedPointer<CertificateErrorController> > m_certificateErrorControllers;
diff --git a/tests/auto/widgets/qwebenginepage/tst_qwebenginepage.cpp b/tests/auto/widgets/qwebenginepage/tst_qwebenginepage.cpp
index 90d3b49fac8e4f1ae496f0f9a339a1a1eb35d39e..b4b1abc8cc0f290c96640325f6e1715523ebcba0 100644
--- a/tests/auto/widgets/qwebenginepage/tst_qwebenginepage.cpp
+++ b/tests/auto/widgets/qwebenginepage/tst_qwebenginepage.cpp
@@ -480,7 +480,9 @@ void tst_QWebEnginePage::pasteImage()
             "window.myImageDataURL ? window.myImageDataURL.length : 0").toInt() > 0);
     QByteArray data = evaluateJavaScriptSync(page, "window.myImageDataURL").toByteArray();
     data.remove(0, data.indexOf(";base64,") + 8);
-    const QImage image = QImage::fromData(QByteArray::fromBase64(data), "PNG");
+    QImage image = QImage::fromData(QByteArray::fromBase64(data), "PNG");
+    if (image.format() == QImage::Format_RGB32)
+        image.reinterpretAsFormat(QImage::Format_ARGB32);
     QCOMPARE(image, origImage);
 }
 
diff --git a/tools/scripts/take_snapshot.py b/tools/scripts/take_snapshot.py
index 0b13072dcca2ab55c693800bd2cb0bf7667ac7c2..4abc230090112934b050b1a48e519e3e17178c21 100755
--- a/tools/scripts/take_snapshot.py
+++ b/tools/scripts/take_snapshot.py
@@ -64,7 +64,6 @@ def isInChromiumBlacklist(file_path):
     if ( '_jni' in file_path
         or 'jni_' in file_path
         or 'testdata/' in file_path
-        or file_path.startswith('third_party/android_tools')
         or '/tests/' in file_path
         or ('/test/' in file_path and
             not '/webrtc/' in file_path and
@@ -72,6 +71,7 @@ def isInChromiumBlacklist(file_path):
             not file_path.endswith('mock_chrome_application_mac.h') and
             not file_path.endswith('perftimer.h') and
             not 'ozone' in file_path and
+            not 'core/mojo/test/' in file_path and
             not file_path.startswith('extensions/browser/'))
         or file_path.endswith('.java')
         or file_path.startswith('android_webview')
@@ -142,12 +142,14 @@ def isInChromiumBlacklist(file_path):
         or file_path.startswith('media/base/android/java')
         or file_path.startswith('native_client')
         or file_path.startswith('net/android/java')
+        or (file_path.startswith('net/data/') and '_unittest/' in file_path)
         or file_path.startswith('remoting')
         or file_path.startswith('rlz')
         or file_path.startswith('testing/android')
         or file_path.startswith('testing/buildbot')
         or file_path.startswith('third_party/WebKit/LayoutTests')
         or file_path.startswith('third_party/WebKit/ManualTests')
+        or file_path.startswith('third_party/WebKit/Source/core/testing/data/')
         or file_path.startswith('third_party/WebKit/Source/devtools/devtools-node-modules')
         or file_path.startswith('third_party/WebKit/PerformanceTests')
         or file_path.startswith('third_party/accessibility-audit')
@@ -160,15 +162,18 @@ def isInChromiumBlacklist(file_path):
         or file_path.startswith('third_party/bison')
         or (file_path.startswith('third_party/cacheinvalidation') and
             not file_path.endswith('isolate'))
+        or file_path.startswith('third_party/boringssl/crypto_test_data.cc')
         or file_path.startswith('third_party/boringssl/src/fuzz')
         or file_path.startswith('third_party/catapult')
         or file_path.startswith('third_party/chromite')
         or file_path.startswith('third_party/cld_2')
+        or file_path.startswith('third_party/closure_compiler')
         or file_path.startswith('third_party/codesighs')
         or file_path.startswith('third_party/colorama')
         or file_path.startswith('third_party/cygwin')
         or file_path.startswith('third_party/cython')
         or file_path.startswith('third_party/deqp')
+        or file_path.startswith('third_party/depot_tools')
         or file_path.startswith('third_party/elfutils')
         or file_path.startswith('third_party/freetype-android')
         or file_path.startswith('third_party/google_input_tools')
@@ -180,6 +185,8 @@ def isInChromiumBlacklist(file_path):
         or file_path.startswith('third_party/google_toolbox_for_mac')
         or file_path.startswith('third_party/hunspell_dictionaries')
         or (file_path.startswith('third_party/icu') and file_path.endswith('icudtl_dat.S'))
+        or file_path.startswith('third_party/icu/android')
+        or file_path.startswith('third_party/icu/ios')
         or file_path.startswith('third_party/instrumented_libraries')
         or file_path.startswith('third_party/jsr-305/src')
         or file_path.startswith('third_party/junit')
@@ -198,6 +205,7 @@ def isInChromiumBlacklist(file_path):
         or (file_path.startswith('third_party/polymer') and
             not file_path.startswith('third_party/polymer/v1_0/components-chromium/'))
         or file_path.startswith('third_party/openh264/src/res')
+        or file_path.startswith('third_party/pdfium/testing/resources')
         or file_path.startswith('third_party/pdfium/tools')
         or file_path.startswith('third_party/pdfsqueeze')
         or file_path.startswith('third_party/pefile')
@@ -206,6 +214,7 @@ def isInChromiumBlacklist(file_path):
         or file_path.startswith('third_party/pylint')
         or file_path.startswith('third_party/scons-2.0.1')
         or file_path.startswith('third_party/sfntly/src/cpp/data/fonts')
+        or file_path.startswith('third_party/sfntly/src/java')
         or file_path.startswith('third_party/skia/infra')
         or file_path.startswith('third_party/speech-dispatcher')
         or file_path.startswith('third_party/talloc')
diff --git a/tools/scripts/version_resolver.py b/tools/scripts/version_resolver.py
index f2ff114db43251fc1a7337385159369522da0c13..e91aecfe8d95779382121ccde35ed5c729f5dbe4 100644
--- a/tools/scripts/version_resolver.py
+++ b/tools/scripts/version_resolver.py
@@ -38,8 +38,8 @@ import json
 import urllib2
 import git_submodule as GitSubmodule
 
-chromium_version = '60.0.3112.116'
-chromium_branch = '3112'
+chromium_version = '61.0.3163.99'
+chromium_branch = '3163'
 ninja_version = 'v1.8.2'
 
 json_url = 'http://omahaproxy.appspot.com/all.json'