diff --git a/AUTHORS b/AUTHORS
index 9692411..23347b8 100644
--- a/AUTHORS
+++ b/AUTHORS
@@ -100,6 +100,7 @@
 Gnanasekar Somanathan <gnanasekar.s@samsung.com>
 Goutham Jagannatha <wrm364@motorola.com>
 Grzegorz Czajkowski <g.czajkowski@samsung.com>
+Guangzhen Li <guangzhen.li@intel.com>
 Gyuyoung Kim <gyuyoung.kim@samsung.com>
 Habib Virji <habib.virji@samsung.com>
 Haitao Feng <haitao.feng@intel.com>
diff --git a/android_webview/java/src/org/chromium/android_webview/AwContentsClient.java b/android_webview/java/src/org/chromium/android_webview/AwContentsClient.java
index e3876cd..22e7c7d 100644
--- a/android_webview/java/src/org/chromium/android_webview/AwContentsClient.java
+++ b/android_webview/java/src/org/chromium/android_webview/AwContentsClient.java
@@ -58,28 +58,30 @@
 
         @Override
         public void didFinishLoad(long frameId, String validatedUrl, boolean isMainFrame) {
-            if (isMainFrame)
+            if (isMainFrame) {
                 AwContentsClient.this.onPageFinished(validatedUrl);
+            }
         }
 
         @Override
         public void didFailLoad(boolean isProvisionalLoad,
                 boolean isMainFrame, int errorCode, String description, String failingUrl) {
-            if (errorCode == NetError.ERR_ABORTED) {
-                // This error code is generated for the following reasons:
-                // - WebView.stopLoading is called,
-                // - the navigation is intercepted by the embedder via shouldOverrideNavigation.
-                //
-                // The Android WebView does not notify the embedder of these situations using this
-                // error code with the WebViewClient.onReceivedError callback.
-                return;
+            if (isMainFrame) {
+                if (errorCode != NetError.ERR_ABORTED) {
+                    // This error code is generated for the following reasons:
+                    // - WebView.stopLoading is called,
+                    // - the navigation is intercepted by the embedder via shouldOverrideNavigation.
+                    //
+                    // The Android WebView does not notify the embedder of these situations using
+                    // this error code with the WebViewClient.onReceivedError callback.
+                    AwContentsClient.this.onReceivedError(
+                            ErrorCodeConversionHelper.convertErrorCode(errorCode), description,
+                                    failingUrl);
+                }
+                // Need to call onPageFinished after onReceivedError (if there is an error) for
+                // backwards compatibility with the classic webview.
+                AwContentsClient.this.onPageFinished(failingUrl);
             }
-            if (!isMainFrame) {
-                // The Android WebView does not notify the embedder of sub-frame failures.
-                return;
-            }
-            AwContentsClient.this.onReceivedError(
-                    ErrorCodeConversionHelper.convertErrorCode(errorCode), description, failingUrl);
         }
 
         @Override
diff --git a/android_webview/java/src/org/chromium/android_webview/AwContentsClientBridge.java b/android_webview/java/src/org/chromium/android_webview/AwContentsClientBridge.java
index 4e6fbdd..66e4f1e 100644
--- a/android_webview/java/src/org/chromium/android_webview/AwContentsClientBridge.java
+++ b/android_webview/java/src/org/chromium/android_webview/AwContentsClientBridge.java
@@ -55,11 +55,6 @@
             @Override
             public void onReceiveValue(Boolean value) {
                 proceedSslError(value.booleanValue(), id);
-                if (!value) {
-                    // For backward compatibility with the classic
-                    // webview, call onPageFinished after canceling ssl error.
-                    AwContentsClientBridge.this.mClient.onPageFinished(url);
-                }
             }
         };
         mClient.onReceivedSslError(callback, sslError);
diff --git a/android_webview/javatests/src/org/chromium/android_webview/test/AwContentsClientShouldOverrideUrlLoadingTest.java b/android_webview/javatests/src/org/chromium/android_webview/test/AwContentsClientShouldOverrideUrlLoadingTest.java
index 7d467b8..e7f358d 100644
--- a/android_webview/javatests/src/org/chromium/android_webview/test/AwContentsClientShouldOverrideUrlLoadingTest.java
+++ b/android_webview/javatests/src/org/chromium/android_webview/test/AwContentsClientShouldOverrideUrlLoadingTest.java
@@ -32,60 +32,6 @@
     private static final String REDIRECT_TARGET_PATH = "/redirect_target.html";
     private static final String TITLE = "TITLE";
 
-    private static class TestAwContentsClient
-            extends org.chromium.android_webview.test.TestAwContentsClient {
-
-        public static class ShouldOverrideUrlLoadingHelper extends CallbackHelper {
-            private String mShouldOverrideUrlLoadingUrl;
-            private String mPreviousShouldOverrideUrlLoadingUrl;
-            private boolean mShouldOverrideUrlLoadingReturnValue = false;
-            void setShouldOverrideUrlLoadingUrl(String url) {
-                mShouldOverrideUrlLoadingUrl = url;
-            }
-            void setPreviousShouldOverrideUrlLoadingUrl(String url) {
-                mPreviousShouldOverrideUrlLoadingUrl = url;
-            }
-            void setShouldOverrideUrlLoadingReturnValue(boolean value) {
-                mShouldOverrideUrlLoadingReturnValue = value;
-            }
-            public String getShouldOverrideUrlLoadingUrl() {
-                assert getCallCount() > 0;
-                return mShouldOverrideUrlLoadingUrl;
-            }
-            public String getPreviousShouldOverrideUrlLoadingUrl() {
-                assert getCallCount() > 1;
-                return mPreviousShouldOverrideUrlLoadingUrl;
-            }
-            public boolean getShouldOverrideUrlLoadingReturnValue() {
-                return mShouldOverrideUrlLoadingReturnValue;
-            }
-            public void notifyCalled(String url) {
-                mPreviousShouldOverrideUrlLoadingUrl = mShouldOverrideUrlLoadingUrl;
-                mShouldOverrideUrlLoadingUrl = url;
-                notifyCalled();
-            }
-        }
-
-        @Override
-        public boolean shouldOverrideUrlLoading(String url) {
-            super.shouldOverrideUrlLoading(url);
-            boolean returnValue =
-                mShouldOverrideUrlLoadingHelper.getShouldOverrideUrlLoadingReturnValue();
-            mShouldOverrideUrlLoadingHelper.notifyCalled(url);
-            return returnValue;
-        }
-
-        private ShouldOverrideUrlLoadingHelper mShouldOverrideUrlLoadingHelper;
-
-        public TestAwContentsClient() {
-            mShouldOverrideUrlLoadingHelper = new ShouldOverrideUrlLoadingHelper();
-        }
-
-        public ShouldOverrideUrlLoadingHelper getShouldOverrideUrlLoadingHelper() {
-            return mShouldOverrideUrlLoadingHelper;
-        }
-    }
-
     private TestWebServer mWebServer;
 
     @Override
diff --git a/android_webview/javatests/src/org/chromium/android_webview/test/ClientOnPageFinishedTest.java b/android_webview/javatests/src/org/chromium/android_webview/test/ClientOnPageFinishedTest.java
index aaaa6cc..93f07fb 100644
--- a/android_webview/javatests/src/org/chromium/android_webview/test/ClientOnPageFinishedTest.java
+++ b/android_webview/javatests/src/org/chromium/android_webview/test/ClientOnPageFinishedTest.java
@@ -13,8 +13,6 @@
 import org.chromium.content.browser.test.util.TestCallbackHelperContainer;
 import org.chromium.net.test.util.TestWebServer;
 
-import java.util.concurrent.TimeUnit;
-
 /**
  * Tests for the ContentViewClient.onPageFinished() method.
  */
@@ -26,7 +24,11 @@
     @Override
     public void setUp() throws Exception {
         super.setUp();
-        mContentsClient = new TestAwContentsClient();
+        setTestAwContentsClient(new TestAwContentsClient());
+    }
+
+    private void setTestAwContentsClient(TestAwContentsClient contentsClient) throws Exception {
+        mContentsClient = contentsClient;
         final AwTestContainerView testContainerView =
                 createAwTestContainerViewOnMainSync(mContentsClient);
         mAwContents = testContainerView.getAwContents();
@@ -49,27 +51,79 @@
     @MediumTest
     @Feature({"AndroidWebView"})
     public void testOnPageFinishedCalledAfterError() throws Throwable {
+        setTestAwContentsClient(new TestAwContentsClient() {
+            private boolean isOnReceivedErrorCalled = false;
+            private boolean isOnPageFinishedCalled = false;
+
+            @Override
+            public void onReceivedError(int errorCode, String description, String failingUrl) {
+                isOnReceivedErrorCalled = true;
+                // Make sure onReceivedError is called before onPageFinished
+                assertEquals(false, isOnPageFinishedCalled);
+                super.onReceivedError(errorCode, description, failingUrl);
+            }
+
+            @Override
+            public void onPageFinished(String url) {
+                isOnPageFinishedCalled = true;
+                // Make sure onReceivedError is called before onPageFinished
+                assertEquals(true, isOnReceivedErrorCalled);
+                super.onPageFinished(url);
+            }
+        });
+
         TestCallbackHelperContainer.OnReceivedErrorHelper onReceivedErrorHelper =
                 mContentsClient.getOnReceivedErrorHelper();
         TestCallbackHelperContainer.OnPageFinishedHelper onPageFinishedHelper =
                 mContentsClient.getOnPageFinishedHelper();
 
-        assertEquals(0, onReceivedErrorHelper.getCallCount());
-
-        String url = "http://localhost:7/non_existent";
+        String invalidUrl = "http://localhost:7/non_existent";
         int onReceivedErrorCallCount = onReceivedErrorHelper.getCallCount();
         int onPageFinishedCallCount = onPageFinishedHelper.getCallCount();
-        loadUrlAsync(mAwContents, url);
+        loadUrlSync(mAwContents, onPageFinishedHelper, invalidUrl);
 
-        onReceivedErrorHelper.waitForCallback(onReceivedErrorCallCount,
-                                              1 /* numberOfCallsToWaitFor */,
-                                              WAIT_TIMEOUT_MS,
-                                              TimeUnit.MILLISECONDS);
-        onPageFinishedHelper.waitForCallback(onPageFinishedCallCount,
-                                             1 /* numberOfCallsToWaitFor */,
-                                             WAIT_TIMEOUT_MS,
-                                             TimeUnit.MILLISECONDS);
-        assertEquals(1, onReceivedErrorHelper.getCallCount());
+        assertEquals(invalidUrl, onReceivedErrorHelper.getFailingUrl());
+        assertEquals(invalidUrl, onPageFinishedHelper.getUrl());
+    }
+
+    @MediumTest
+    @Feature({"AndroidWebView"})
+    public void testOnPageFinishedCalledAfterRedirectedUrlIsOverridden() throws Throwable {
+        /*
+         * If url1 is redirected url2, and url2 load is overridden, onPageFinished should still be
+         * called for url2.
+         * Steps:
+         * 1. load url1. url1 onPageStarted
+         * 2. server redirects url1 to url2. url2 onPageStarted
+         * 3. shouldOverridedUrlLoading called for url2 and returns true
+         * 4. url2 onPageFinishedCalled
+         */
+
+        TestWebServer webServer = null;
+        try {
+            webServer = new TestWebServer(false);
+            final String redirectTargetPath = "/redirect_target.html";
+            final String redirectTargetUrl = webServer.setResponse(redirectTargetPath,
+                    "<html><body>hello world</body></html>", null);
+            final String redirectUrl = webServer.setRedirect("/302.html", redirectTargetUrl);
+
+            final TestAwContentsClient.ShouldOverrideUrlLoadingHelper urlOverrideHelper =
+                    mContentsClient.getShouldOverrideUrlLoadingHelper();
+            // Override the load of redirectTargetUrl
+            urlOverrideHelper.setShouldOverrideUrlLoadingReturnValue(true);
+
+            TestCallbackHelperContainer.OnPageFinishedHelper onPageFinishedHelper =
+                mContentsClient.getOnPageFinishedHelper();
+
+            final int currentOnPageFinishedCallCount = onPageFinishedHelper.getCallCount();
+            loadUrlAsync(mAwContents, redirectUrl);
+
+            onPageFinishedHelper.waitForCallback(currentOnPageFinishedCallCount);
+            // onPageFinished needs to be called for redirectTargetUrl, but not for redirectUrl
+            assertEquals(redirectTargetUrl, onPageFinishedHelper.getUrl());
+        } finally {
+            if (webServer != null) webServer.shutdown();
+        }
     }
 
     @MediumTest
diff --git a/android_webview/javatests/src/org/chromium/android_webview/test/TestAwContentsClient.java b/android_webview/javatests/src/org/chromium/android_webview/test/TestAwContentsClient.java
index 70c8fc2..97cb7f1 100644
--- a/android_webview/javatests/src/org/chromium/android_webview/test/TestAwContentsClient.java
+++ b/android_webview/javatests/src/org/chromium/android_webview/test/TestAwContentsClient.java
@@ -23,6 +23,7 @@
     private final AddMessageToConsoleHelper mAddMessageToConsoleHelper;
     private final OnScaleChangedHelper mOnScaleChangedHelper;
     private final PictureListenerHelper mPictureListenerHelper;
+    private final ShouldOverrideUrlLoadingHelper mShouldOverrideUrlLoadingHelper;
 
     public TestAwContentsClient() {
         super(ThreadUtils.getUiThreadLooper());
@@ -33,6 +34,7 @@
         mAddMessageToConsoleHelper = new AddMessageToConsoleHelper();
         mOnScaleChangedHelper = new OnScaleChangedHelper();
         mPictureListenerHelper = new PictureListenerHelper();
+        mShouldOverrideUrlLoadingHelper = new ShouldOverrideUrlLoadingHelper();
     }
 
     public OnPageStartedHelper getOnPageStartedHelper() {
@@ -51,6 +53,10 @@
         return mOnEvaluateJavaScriptResultHelper;
     }
 
+    public ShouldOverrideUrlLoadingHelper getShouldOverrideUrlLoadingHelper() {
+        return mShouldOverrideUrlLoadingHelper;
+    }
+
     public AddMessageToConsoleHelper getAddMessageToConsoleHelper() {
         return mAddMessageToConsoleHelper;
     }
@@ -167,4 +173,44 @@
     public void onNewPicture(Picture picture) {
         mPictureListenerHelper.notifyCalled(picture);
     }
+
+    public static class ShouldOverrideUrlLoadingHelper extends CallbackHelper {
+        private String mShouldOverrideUrlLoadingUrl;
+        private String mPreviousShouldOverrideUrlLoadingUrl;
+        private boolean mShouldOverrideUrlLoadingReturnValue = false;
+        void setShouldOverrideUrlLoadingUrl(String url) {
+            mShouldOverrideUrlLoadingUrl = url;
+        }
+        void setPreviousShouldOverrideUrlLoadingUrl(String url) {
+            mPreviousShouldOverrideUrlLoadingUrl = url;
+        }
+        void setShouldOverrideUrlLoadingReturnValue(boolean value) {
+            mShouldOverrideUrlLoadingReturnValue = value;
+        }
+        public String getShouldOverrideUrlLoadingUrl() {
+            assert getCallCount() > 0;
+            return mShouldOverrideUrlLoadingUrl;
+        }
+        public String getPreviousShouldOverrideUrlLoadingUrl() {
+            assert getCallCount() > 1;
+            return mPreviousShouldOverrideUrlLoadingUrl;
+        }
+        public boolean getShouldOverrideUrlLoadingReturnValue() {
+            return mShouldOverrideUrlLoadingReturnValue;
+        }
+        public void notifyCalled(String url) {
+            mPreviousShouldOverrideUrlLoadingUrl = mShouldOverrideUrlLoadingUrl;
+            mShouldOverrideUrlLoadingUrl = url;
+            notifyCalled();
+        }
+    }
+
+    @Override
+    public boolean shouldOverrideUrlLoading(String url) {
+        super.shouldOverrideUrlLoading(url);
+        boolean returnValue =
+            mShouldOverrideUrlLoadingHelper.getShouldOverrideUrlLoadingReturnValue();
+        mShouldOverrideUrlLoadingHelper.notifyCalled(url);
+        return returnValue;
+    }
 }
diff --git a/build/util/LASTCHANGE b/build/util/LASTCHANGE
index c888255..345fd18 100644
--- a/build/util/LASTCHANGE
+++ b/build/util/LASTCHANGE
@@ -1 +1 @@
-LASTCHANGE=251877
+LASTCHANGE=252176
diff --git a/build/util/LASTCHANGE.blink b/build/util/LASTCHANGE.blink
index 88c386e..b2aa772 100644
--- a/build/util/LASTCHANGE.blink
+++ b/build/util/LASTCHANGE.blink
@@ -1 +1 @@
-LASTCHANGE=167220
+LASTCHANGE=167404
diff --git a/cc/resources/resource_provider.cc b/cc/resources/resource_provider.cc
index 3973fb8..1331ca2 100644
--- a/cc/resources/resource_provider.cc
+++ b/cc/resources/resource_provider.cc
@@ -909,7 +909,8 @@
   CleanUpGLIfNeeded();
 
   default_resource_type_ = Bitmap;
-  max_texture_size_ = INT_MAX / 2;
+  // Pick an arbitrary limit here similar to what hardware might.
+  max_texture_size_ = 16 * 1024;
   best_texture_format_ = RGBA_8888;
 }
 
diff --git a/chrome/VERSION b/chrome/VERSION
index 60c4287..c9a982c 100644
--- a/chrome/VERSION
+++ b/chrome/VERSION
@@ -1,4 +1,4 @@
 MAJOR=33
 MINOR=0
 BUILD=1750
-PATCH=115
+PATCH=126
diff --git a/chrome/browser/chrome_page_zoom.cc b/chrome/browser/chrome_page_zoom.cc
index ae596ce..8fb9cf9 100644
--- a/chrome/browser/chrome_page_zoom.cc
+++ b/chrome/browser/chrome_page_zoom.cc
@@ -65,14 +65,13 @@
 }
 
 void Zoom(content::WebContents* web_contents, content::PageZoom zoom) {
-  content::RenderViewHost* host = web_contents->GetRenderViewHost();
   double current_zoom_level = web_contents->GetZoomLevel();
   double default_zoom_level =
       Profile::FromBrowserContext(web_contents->GetBrowserContext())->
           GetPrefs()->GetDouble(prefs::kDefaultZoomLevel);
 
   if (zoom == content::PAGE_ZOOM_RESET) {
-    host->SetZoomLevel(default_zoom_level);
+    web_contents->SetZoomLevel(default_zoom_level);
     content::RecordAction(UserMetricsAction("ZoomNormal"));
     return;
   }
@@ -90,7 +89,7 @@
       if (content::ZoomValuesEqual(zoom_level, current_zoom_level))
         continue;
       if (zoom_level < current_zoom_level) {
-        host->SetZoomLevel(zoom_level);
+        web_contents->SetZoomLevel(zoom_level);
         content::RecordAction(UserMetricsAction("ZoomMinus"));
         return;
       }
@@ -105,7 +104,7 @@
       if (content::ZoomValuesEqual(zoom_level, current_zoom_level))
         continue;
       if (zoom_level > current_zoom_level) {
-        host->SetZoomLevel(zoom_level);
+        web_contents->SetZoomLevel(zoom_level);
         content::RecordAction(UserMetricsAction("ZoomPlus"));
         return;
       }
diff --git a/chrome/browser/chromeos/login/auth_sync_observer.cc b/chrome/browser/chromeos/login/auth_sync_observer.cc
index 4c623c2..c5b80bf 100644
--- a/chrome/browser/chromeos/login/auth_sync_observer.cc
+++ b/chrome/browser/chromeos/login/auth_sync_observer.cc
@@ -10,6 +10,8 @@
 #include "chrome/browser/sync/profile_sync_service.h"
 #include "chrome/browser/sync/profile_sync_service_factory.h"
 #include "chrome/common/pref_names.h"
+#include "content/public/browser/user_metrics.h"
+#include "content/public/common/user_metrics_action.h"
 #include "google_apis/gaia/gaia_auth_util.h"
 
 class Profile;
@@ -43,6 +45,7 @@
          UserManager::Get()->IsLoggedInAsLocallyManagedUser());
   ProfileSyncService* sync_service =
       ProfileSyncServiceFactory::GetForProfile(profile_);
+  User* user = UserManager::Get()->GetUserByProfile(profile_);
   GoogleServiceAuthError::State state =
       sync_service->GetAuthError().state();
   if (state != GoogleServiceAuthError::NONE &&
@@ -54,21 +57,40 @@
     // TODO(nkostylev): Remove after crosbug.com/25978 is implemented.
     LOG(WARNING) << "Invalidate OAuth token because of a sync error: "
                  << sync_service->GetAuthError().ToString();
-    std::string email = profile_->GetProfileName();
-    if (email.empty() && UserManager::Get()->IsLoggedInAsLocallyManagedUser()) {
-      std::string sync_id =
-          profile_->GetPrefs()->GetString(prefs::kManagedUserId);
-      const User* user =
-          UserManager::Get()->GetSupervisedUserManager()->FindBySyncId(sync_id);
-      if (user)
-        email = user->email();
-    }
+    std::string email = user->email();
     DCHECK(!email.empty());
     // TODO(nkostyelv): Change observer after active user has changed.
-    UserManager::Get()->SaveUserOAuthStatus(
-        gaia::CanonicalizeEmail(email),
+    User::OAuthTokenStatus old_status = user->oauth_token_status();
+    UserManager::Get()->SaveUserOAuthStatus(email,
         User::OAUTH2_TOKEN_STATUS_INVALID);
+    if (user->GetType() == User::USER_TYPE_LOCALLY_MANAGED &&
+        old_status != User::OAUTH2_TOKEN_STATUS_INVALID) {
+       // Attempt to restore token from file.
+       UserManager::Get()->GetSupervisedUserManager()->LoadSupervisedUserToken(
+           profile_,
+           base::Bind(&AuthSyncObserver::OnSupervisedTokenLoaded,
+               base::Unretained(this)));
+       content::RecordAction(
+           content::UserMetricsAction(
+               "ManagedUsers_Chromeos_Sync_Invalidated"));
+    }
+  } else if (state == GoogleServiceAuthError::NONE) {
+    if (user->GetType() == User::USER_TYPE_LOCALLY_MANAGED &&
+        user->oauth_token_status() == User::OAUTH2_TOKEN_STATUS_INVALID) {
+      LOG(ERROR) <<
+          "Got an incorrectly invalidated token case, restoring token status.";
+      UserManager::Get()->SaveUserOAuthStatus(
+          user->email(),
+          User::OAUTH2_TOKEN_STATUS_VALID);
+       content::RecordAction(
+           content::UserMetricsAction("ManagedUsers_Chromeos_Sync_Recovered"));
+    }
   }
 }
 
+void AuthSyncObserver::OnSupervisedTokenLoaded(const std::string& token) {
+  UserManager::Get()->GetSupervisedUserManager()->ConfigureSyncWithToken(
+      profile_, token);
+}
+
 }  // namespace chromeos
diff --git a/chrome/browser/chromeos/login/auth_sync_observer.h b/chrome/browser/chromeos/login/auth_sync_observer.h
index acfa063..063736a 100644
--- a/chrome/browser/chromeos/login/auth_sync_observer.h
+++ b/chrome/browser/chromeos/login/auth_sync_observer.h
@@ -35,6 +35,9 @@
   // ProfileSyncServiceObserver implementation.
   virtual void OnStateChanged() OVERRIDE;
 
+  // Called on attempt to restore supervised user token.
+  void OnSupervisedTokenLoaded(const std::string& token);
+
   Profile* profile_;
 
   DISALLOW_COPY_AND_ASSIGN(AuthSyncObserver);
diff --git a/chrome/browser/chromeos/login/fake_supervised_user_manager.cc b/chrome/browser/chromeos/login/fake_supervised_user_manager.cc
index af53e1a..d051917 100644
--- a/chrome/browser/chromeos/login/fake_supervised_user_manager.cc
+++ b/chrome/browser/chromeos/login/fake_supervised_user_manager.cc
@@ -55,4 +55,10 @@
   return std::string();
 }
 
+void FakeSupervisedUserManager::LoadSupervisedUserToken(
+    Profile * profile,
+    const LoadTokenCallback& callback) {
+  callback.Run("token");
+}
+
 }  // namespace chromeos
diff --git a/chrome/browser/chromeos/login/fake_supervised_user_manager.h b/chrome/browser/chromeos/login/fake_supervised_user_manager.h
index d68ead1..e23e525 100644
--- a/chrome/browser/chromeos/login/fake_supervised_user_manager.h
+++ b/chrome/browser/chromeos/login/fake_supervised_user_manager.h
@@ -38,6 +38,12 @@
   virtual void SetCreationTransactionUserId(const std::string& user_id)
       OVERRIDE {}
   virtual void CommitCreationTransaction() OVERRIDE {}
+  virtual void LoadSupervisedUserToken(
+      Profile * profile,
+      const LoadTokenCallback& callback) OVERRIDE;
+  virtual void ConfigureSyncWithToken(
+      Profile* profile,
+      const std::string& token) OVERRIDE {}
 
  private:
   DISALLOW_COPY_AND_ASSIGN(FakeSupervisedUserManager);
diff --git a/chrome/browser/chromeos/login/managed/locally_managed_user_login_flow.cc b/chrome/browser/chromeos/login/managed/locally_managed_user_login_flow.cc
index f4a4f25..e3a21ae 100644
--- a/chrome/browser/chromeos/login/managed/locally_managed_user_login_flow.cc
+++ b/chrome/browser/chromeos/login/managed/locally_managed_user_login_flow.cc
@@ -4,42 +4,22 @@
 
 #include "chrome/browser/chromeos/login/managed/locally_managed_user_login_flow.h"
 
-#include "base/file_util.h"
-#include "base/files/file_path.h"
 #include "base/logging.h"
 #include "base/prefs/pref_registry_simple.h"
 #include "base/prefs/pref_service.h"
-#include "base/threading/sequenced_worker_pool.h"
 #include "base/values.h"
 #include "chrome/browser/chromeos/login/login_display_host_impl.h"
 #include "chrome/browser/chromeos/login/login_utils.h"
 #include "chrome/browser/chromeos/login/managed/locally_managed_user_constants.h"
 #include "chrome/browser/chromeos/login/managed/locally_managed_user_creation_screen.h"
+#include "chrome/browser/chromeos/login/supervised_user_manager.h"
 #include "chrome/browser/chromeos/login/wizard_controller.h"
-#include "chrome/browser/chromeos/profiles/profile_helper.h"
-#include "chrome/browser/managed_mode/managed_user_service.h"
-#include "chrome/browser/managed_mode/managed_user_service_factory.h"
 #include "content/public/browser/browser_thread.h"
 
 using content::BrowserThread;
 
 namespace chromeos {
 
-namespace {
-
-std::string LoadSyncToken(base::FilePath profile_dir) {
-  std::string token;
-  base::FilePath token_file =
-      profile_dir.Append(kManagedUserTokenFilename);
-  LOG(INFO) << "Loading" << token_file.value();
-  if (!base::ReadFileToString(token_file, &token)) {
-    return std::string();
-  }
-  return token;
-}
-
-} // namespace
-
 LocallyManagedUserLoginFlow::LocallyManagedUserLoginFlow(
     const std::string& user_id)
     : ExtendedUserFlow(user_id),
@@ -78,10 +58,11 @@
 
 void LocallyManagedUserLoginFlow::ConfigureSync(const std::string& token) {
   data_loaded_ = true;
+
   // TODO(antrim): add error handling (no token loaded).
   // See also: http://crbug.com/312751
-  if (!token.empty())
-    ManagedUserServiceFactory::GetForProfile(profile_)->InitSync(token);
+  UserManager::Get()->GetSupervisedUserManager()->ConfigureSyncWithToken(
+      profile_, token);
 
   LoginUtils::Get()->DoBrowserLaunch(profile_, host());
   profile_ = NULL;
@@ -91,12 +72,8 @@
 void LocallyManagedUserLoginFlow::LaunchExtraSteps(
     Profile* profile) {
   profile_ = profile;
-  base::FilePath profile_dir = ProfileHelper::GetProfilePathByUserIdHash(
-      UserManager::Get()->GetUserByProfile(profile)->username_hash());
-  PostTaskAndReplyWithResult(
-      content::BrowserThread::GetBlockingPool(),
-      FROM_HERE,
-      base::Bind(&LoadSyncToken, profile_dir),
+  UserManager::Get()->GetSupervisedUserManager()->LoadSupervisedUserToken(
+      profile,
       base::Bind(
            &LocallyManagedUserLoginFlow::OnSyncSetupDataLoaded,
            weak_factory_.GetWeakPtr()));
diff --git a/chrome/browser/chromeos/login/supervised_user_manager.h b/chrome/browser/chromeos/login/supervised_user_manager.h
index 4b116a8..254706a 100644
--- a/chrome/browser/chromeos/login/supervised_user_manager.h
+++ b/chrome/browser/chromeos/login/supervised_user_manager.h
@@ -8,7 +8,9 @@
 #include <string>
 
 #include "base/basictypes.h"
+#include "base/callback.h"
 #include "base/strings/string16.h"
+#include "chrome/browser/profiles/profile.h"
 
 class PrefRegistrySimple;
 
@@ -21,6 +23,9 @@
 // lookup methods that make sense only for supervised users.
 class SupervisedUserManager {
  public:
+  typedef base::Callback<void(const std::string& /* token */)>
+      LoadTokenCallback;
+
   // Registers user manager preferences.
   static void RegisterPrefs(PrefRegistrySimple* registry);
 
@@ -81,6 +86,14 @@
   // Remove locally managed user creation transaction record.
   virtual void CommitCreationTransaction() = 0;
 
+  // Loads a sync oauth token in background, and passes it to callback.
+  virtual void LoadSupervisedUserToken(Profile* profile,
+                                       const LoadTokenCallback& callback) = 0;
+
+  // Configures sync service with oauth token.
+  virtual void ConfigureSyncWithToken(Profile* profile,
+                                      const std::string& token) = 0;
+
  private:
   DISALLOW_COPY_AND_ASSIGN(SupervisedUserManager);
 };
diff --git a/chrome/browser/chromeos/login/supervised_user_manager_impl.cc b/chrome/browser/chromeos/login/supervised_user_manager_impl.cc
index 8b5bf98..cbd9966 100644
--- a/chrome/browser/chromeos/login/supervised_user_manager_impl.cc
+++ b/chrome/browser/chromeos/login/supervised_user_manager_impl.cc
@@ -4,15 +4,22 @@
 
 #include "chrome/browser/chromeos/login/supervised_user_manager_impl.h"
 
+#include "base/file_util.h"
+#include "base/files/file_path.h"
 #include "base/prefs/pref_registry_simple.h"
 #include "base/prefs/pref_service.h"
 #include "base/prefs/scoped_user_pref_update.h"
 #include "base/strings/string_util.h"
 #include "base/strings/stringprintf.h"
 #include "base/strings/utf_string_conversions.h"
+#include "base/threading/sequenced_worker_pool.h"
 #include "base/values.h"
 #include "chrome/browser/browser_process.h"
+#include "chrome/browser/chromeos/login/managed/locally_managed_user_constants.h"
 #include "chrome/browser/chromeos/login/user_manager_impl.h"
+#include "chrome/browser/chromeos/profiles/profile_helper.h"
+#include "chrome/browser/managed_mode/managed_user_service.h"
+#include "chrome/browser/managed_mode/managed_user_service_factory.h"
 #include "chromeos/settings/cros_settings_names.h"
 #include "content/public/browser/browser_thread.h"
 #include "google_apis/gaia/gaia_auth_util.h"
@@ -53,6 +60,16 @@
 const char kLocallyManagedUserCreationTransactionUserId[] =
     "LocallyManagedUserCreationTransactionUserId";
 
+std::string LoadSyncToken(base::FilePath profile_dir) {
+  std::string token;
+  base::FilePath token_file =
+      profile_dir.Append(chromeos::kManagedUserTokenFilename);
+  VLOG(1) << "Loading" << token_file.value();
+  if (!base::ReadFileToString(token_file, &token))
+    return std::string();
+  return token;
+}
+
 } // namespace
 
 namespace chromeos {
@@ -332,5 +349,24 @@
   }
 }
 
+void SupervisedUserManagerImpl::LoadSupervisedUserToken(
+    Profile* profile,
+    const LoadTokenCallback& callback) {
+  // TODO(antrim): use profile->GetPath() once we sure it is safe.
+  base::FilePath profile_dir = ProfileHelper::GetProfilePathByUserIdHash(
+      UserManager::Get()->GetUserByProfile(profile)->username_hash());
+  PostTaskAndReplyWithResult(
+      content::BrowserThread::GetBlockingPool(),
+      FROM_HERE,
+      base::Bind(&LoadSyncToken, profile_dir),
+      callback);
+}
+
+void SupervisedUserManagerImpl::ConfigureSyncWithToken(
+    Profile* profile,
+    const std::string& token) {
+  if (!token.empty())
+    ManagedUserServiceFactory::GetForProfile(profile)->InitSync(token);
+}
 
 }  // namespace chromeos
diff --git a/chrome/browser/chromeos/login/supervised_user_manager_impl.h b/chrome/browser/chromeos/login/supervised_user_manager_impl.h
index e31766e..737c484 100644
--- a/chrome/browser/chromeos/login/supervised_user_manager_impl.h
+++ b/chrome/browser/chromeos/login/supervised_user_manager_impl.h
@@ -42,6 +42,12 @@
   virtual void SetCreationTransactionUserId(const std::string& user_id)
       OVERRIDE;
   virtual void CommitCreationTransaction() OVERRIDE;
+  virtual void LoadSupervisedUserToken(
+      Profile * profile,
+      const LoadTokenCallback& callback) OVERRIDE;
+  virtual void ConfigureSyncWithToken(
+      Profile* profile,
+      const std::string& token) OVERRIDE;
 
  private:
   friend class UserManager;
diff --git a/chrome/browser/component_updater/component_updater_configurator.cc b/chrome/browser/component_updater/component_updater_configurator.cc
index c7be37d..daacf83 100644
--- a/chrome/browser/component_updater/component_updater_configurator.cc
+++ b/chrome/browser/component_updater/component_updater_configurator.cc
@@ -157,7 +157,7 @@
 }
 
 int ChromeConfigurator::NextCheckDelay() {
-  return fast_update_ ? 3 : (2 * kDelayOneHour);
+  return fast_update_ ? 3 : (6 * kDelayOneHour);
 }
 
 int ChromeConfigurator::StepDelayMedium() {
diff --git a/chrome/browser/component_updater/component_updater_service.cc b/chrome/browser/component_updater/component_updater_service.cc
index ffad89c..2ed6614 100644
--- a/chrome/browser/component_updater/component_updater_service.cc
+++ b/chrome/browser/component_updater/component_updater_service.cc
@@ -884,7 +884,7 @@
 
   // If there are updates pending we do a short wait, otherwise we take
   // a longer delay until we check the components again.
-  ScheduleNextRun(num_updates_pending > 0 ? kStepDelayShort : kStepDelayMedium);
+  ScheduleNextRun(num_updates_pending > 0 ? kStepDelayShort : kStepDelayLong);
 }
 
 void CrxUpdateService::OnParseUpdateResponseFailed(
diff --git a/chrome/browser/managed_mode/managed_mode_url_filter.cc b/chrome/browser/managed_mode/managed_mode_url_filter.cc
index d60255f..2d04acd 100644
--- a/chrome/browser/managed_mode/managed_mode_url_filter.cc
+++ b/chrome/browser/managed_mode/managed_mode_url_filter.cc
@@ -35,10 +35,11 @@
 
 namespace {
 
-const char* kStandardSchemes[] = {
+// URL schemes not in this list (e.g., file:// and chrome://) will always be
+// allowed.
+const char* kFilteredSchemes[] = {
   "http",
   "https",
-  "file",
   "ftp",
   "gopher",
   "ws",
@@ -200,9 +201,9 @@
 }
 
 // static
-bool ManagedModeURLFilter::HasStandardScheme(const GURL& url) {
-  for (size_t i = 0; i < arraysize(kStandardSchemes); ++i) {
-      if (url.scheme() == kStandardSchemes[i])
+bool ManagedModeURLFilter::HasFilteredScheme(const GURL& url) {
+  for (size_t i = 0; i < arraysize(kFilteredSchemes); ++i) {
+      if (url.scheme() == kFilteredSchemes[i])
         return true;
     }
   return false;
@@ -256,7 +257,7 @@
   DCHECK(CalledOnValidThread());
 
   // URLs with a non-standard scheme (e.g. chrome://) are always allowed.
-  if (!HasStandardScheme(url))
+  if (!HasFilteredScheme(url))
     return ALLOW;
 
   // Check manual overrides for the exact URL.
diff --git a/chrome/browser/managed_mode/managed_mode_url_filter.h b/chrome/browser/managed_mode/managed_mode_url_filter.h
index 84457ca..c43326a 100644
--- a/chrome/browser/managed_mode/managed_mode_url_filter.h
+++ b/chrome/browser/managed_mode/managed_mode_url_filter.h
@@ -57,7 +57,7 @@
   // Returns true if the URL has a standard scheme. Only URLs with standard
   // schemes are filtered.
   // This method is public for testing.
-  static bool HasStandardScheme(const GURL& url);
+  static bool HasFilteredScheme(const GURL& url);
 
   // Returns true if the |host| matches the pattern. A pattern is a hostname
   // with one or both of the following modifications:
diff --git a/chrome/browser/managed_mode/managed_mode_url_filter_unittest.cc b/chrome/browser/managed_mode/managed_mode_url_filter_unittest.cc
index a8b839f..e1091e4 100644
--- a/chrome/browser/managed_mode/managed_mode_url_filter_unittest.cc
+++ b/chrome/browser/managed_mode/managed_mode_url_filter_unittest.cc
@@ -55,8 +55,12 @@
   EXPECT_TRUE(IsURLWhitelisted("https://x.mail.google.com/"));
   EXPECT_TRUE(IsURLWhitelisted("http://x.y.google.com/a/b"));
   EXPECT_FALSE(IsURLWhitelisted("http://youtube.com/"));
+
   EXPECT_TRUE(IsURLWhitelisted("bogus://youtube.com/"));
   EXPECT_TRUE(IsURLWhitelisted("chrome://youtube.com/"));
+  EXPECT_TRUE(IsURLWhitelisted("chrome://extensions/"));
+  EXPECT_TRUE(IsURLWhitelisted("chrome-extension://foo/main.html"));
+  EXPECT_TRUE(IsURLWhitelisted("file:///home/chronos/user/Downloads/img.jpg"));
 }
 
 TEST_F(ManagedModeURLFilterTest, Inactive) {
@@ -183,21 +187,28 @@
   EXPECT_TRUE(IsURLWhitelisted("http://www.example.com/foo/?bar=baz#ref"));
 }
 
-TEST_F(ManagedModeURLFilterTest, HasStandardScheme) {
+TEST_F(ManagedModeURLFilterTest, HasFilteredScheme) {
   EXPECT_TRUE(
-      ManagedModeURLFilter::HasStandardScheme(GURL("http://example.com")));
+      ManagedModeURLFilter::HasFilteredScheme(GURL("http://example.com")));
   EXPECT_TRUE(
-      ManagedModeURLFilter::HasStandardScheme(GURL("https://example.com")));
+      ManagedModeURLFilter::HasFilteredScheme(GURL("https://example.com")));
   EXPECT_TRUE(
-      ManagedModeURLFilter::HasStandardScheme(GURL("ftp://example.com")));
+      ManagedModeURLFilter::HasFilteredScheme(GURL("ftp://example.com")));
   EXPECT_TRUE(
-      ManagedModeURLFilter::HasStandardScheme(GURL("gopher://example.com")));
+      ManagedModeURLFilter::HasFilteredScheme(GURL("gopher://example.com")));
   EXPECT_TRUE(
-      ManagedModeURLFilter::HasStandardScheme(GURL("ws://example.com")));
+      ManagedModeURLFilter::HasFilteredScheme(GURL("ws://example.com")));
   EXPECT_TRUE(
-      ManagedModeURLFilter::HasStandardScheme(GURL("wss://example.com")));
+      ManagedModeURLFilter::HasFilteredScheme(GURL("wss://example.com")));
+
   EXPECT_FALSE(
-      ManagedModeURLFilter::HasStandardScheme(GURL("wtf://example.com")));
+      ManagedModeURLFilter::HasFilteredScheme(GURL("file://example.com")));
+  EXPECT_FALSE(
+      ManagedModeURLFilter::HasFilteredScheme(GURL("filesystem://80cols.com")));
+  EXPECT_FALSE(
+      ManagedModeURLFilter::HasFilteredScheme(GURL("chrome://example.com")));
+  EXPECT_FALSE(
+      ManagedModeURLFilter::HasFilteredScheme(GURL("wtf://example.com")));
 }
 
 TEST_F(ManagedModeURLFilterTest, HostMatchesPattern) {
diff --git a/chrome/browser/ui/gtk/zoom_bubble_gtk.cc b/chrome/browser/ui/gtk/zoom_bubble_gtk.cc
index 8c70cd2..cf73519 100644
--- a/chrome/browser/ui/gtk/zoom_bubble_gtk.cc
+++ b/chrome/browser/ui/gtk/zoom_bubble_gtk.cc
@@ -218,7 +218,7 @@
   double default_zoom_level = Profile::FromBrowserContext(
       web_contents_->GetBrowserContext())->GetPrefs()->GetDouble(
           prefs::kDefaultZoomLevel);
-  web_contents_->GetRenderViewHost()->SetZoomLevel(default_zoom_level);
+  web_contents_->SetZoomLevel(default_zoom_level);
 }
 
 gboolean ZoomBubbleGtk::OnMouseEnter(GtkWidget* widget,
diff --git a/components/policy/core/common/policy_loader_win.cc b/components/policy/core/common/policy_loader_win.cc
index 26f9364..0befaa2 100644
--- a/components/policy/core/common/policy_loader_win.cc
+++ b/components/policy/core/common/policy_loader_win.cc
@@ -125,6 +125,7 @@
   const PolicyMap::Entry* map_entry =
       policy->Get(policy::key::kExtensionInstallForcelist);
   if (map_entry && map_entry->value) {
+    int invalid_policies = 0;
     const base::ListValue* policy_list_value = NULL;
     if (!map_entry->value->GetAsList(&policy_list_value))
       return;
@@ -139,8 +140,10 @@
       if (pos == std::string::npos)
         continue;
       // Only allow custom update urls in enterprise environments.
-      if (!LowerCaseEqualsASCII(entry.substr(pos), kExpectedWebStoreUrl))
+      if (!LowerCaseEqualsASCII(entry.substr(pos), kExpectedWebStoreUrl)) {
         entry = kBlockedExtensionPrefix + entry;
+        invalid_policies++;
+      }
 
       filtered_values->AppendString(entry);
     }
@@ -148,6 +151,8 @@
                 map_entry->level, map_entry->scope,
                 filtered_values.release(),
                 map_entry->external_data_fetcher);
+    UMA_HISTOGRAM_COUNTS("EnterpriseCheck.InvalidPoliciesDetected",
+                         invalid_policies);
   }
 }
 
diff --git a/content/browser/browser_plugin/browser_plugin_embedder.cc b/content/browser/browser_plugin/browser_plugin_embedder.cc
index 1418f97..18bfc25 100644
--- a/content/browser/browser_plugin/browser_plugin_embedder.cc
+++ b/content/browser/browser_plugin/browser_plugin_embedder.cc
@@ -8,6 +8,7 @@
 #include "content/browser/browser_plugin/browser_plugin_guest.h"
 #include "content/browser/browser_plugin/browser_plugin_guest_manager.h"
 #include "content/browser/browser_plugin/browser_plugin_host_factory.h"
+#include "content/browser/renderer_host/render_view_host_impl.h"
 #include "content/browser/web_contents/web_contents_impl.h"
 #include "content/common/browser_plugin/browser_plugin_constants.h"
 #include "content/common/browser_plugin/browser_plugin_messages.h"
@@ -22,6 +23,7 @@
 #include "content/public/common/result_codes.h"
 #include "content/public/common/url_constants.h"
 #include "net/base/escape.h"
+#include "ui/events/keycodes/keyboard_codes.h"
 
 namespace content {
 
@@ -79,15 +81,58 @@
   ++next_get_render_view_request_id_;
 }
 
+bool BrowserPluginEmbedder::DidSendScreenRectsCallback(
+   BrowserPluginGuest* guest) {
+  static_cast<RenderViewHostImpl*>(
+      guest->GetWebContents()->GetRenderViewHost())->SendScreenRects();
+  // Not handled => Iterate over all guests.
+  return false;
+}
+
 void BrowserPluginEmbedder::DidSendScreenRects() {
-  GetBrowserPluginGuestManager()->DidSendScreenRects(
-      static_cast<WebContentsImpl*>(web_contents()));
+  WebContentsImpl* embedder =
+      static_cast<WebContentsImpl*>(web_contents());
+  GetBrowserPluginGuestManager()->ForEachGuest(embedder, base::Bind(
+      &BrowserPluginEmbedder::DidSendScreenRectsCallback,
+      base::Unretained(this)));
+}
+
+bool BrowserPluginEmbedder::UnlockMouseIfNecessaryCallback(
+    const NativeWebKeyboardEvent& event,
+    BrowserPluginGuest* guest) {
+  return guest->UnlockMouseIfNecessary(event);
 }
 
 bool BrowserPluginEmbedder::HandleKeyboardEvent(
     const NativeWebKeyboardEvent& event) {
-  return GetBrowserPluginGuestManager()->UnlockMouseIfNecessary(
-      static_cast<WebContentsImpl*>(web_contents()), event);
+  if ((event.type != blink::WebInputEvent::RawKeyDown) ||
+      (event.windowsKeyCode != ui::VKEY_ESCAPE) ||
+      (event.modifiers & blink::WebInputEvent::InputModifiers)) {
+    return false;
+  }
+
+  WebContentsImpl* embedder =
+      static_cast<WebContentsImpl*>(web_contents());
+  return GetBrowserPluginGuestManager()->ForEachGuest(embedder, base::Bind(
+      &BrowserPluginEmbedder::UnlockMouseIfNecessaryCallback,
+      base::Unretained(this),
+      event));
+}
+
+bool BrowserPluginEmbedder::SetZoomLevelCallback(
+    double level, BrowserPluginGuest* guest) {
+  guest->GetWebContents()->SetZoomLevel(level);
+  // Not handled => Iterate over all guests.
+  return false;
+}
+
+void BrowserPluginEmbedder::SetZoomLevel(double level) {
+  WebContentsImpl* embedder =
+      static_cast<WebContentsImpl*>(web_contents());
+  GetBrowserPluginGuestManager()->ForEachGuest(embedder, base::Bind(
+      &BrowserPluginEmbedder::SetZoomLevelCallback,
+      base::Unretained(this),
+      level));
 }
 
 void BrowserPluginEmbedder::RenderProcessGone(base::TerminationStatus status) {
diff --git a/content/browser/browser_plugin/browser_plugin_embedder.h b/content/browser/browser_plugin/browser_plugin_embedder.h
index c2c2a50..107fa61 100644
--- a/content/browser/browser_plugin/browser_plugin_embedder.h
+++ b/content/browser/browser_plugin/browser_plugin_embedder.h
@@ -67,6 +67,9 @@
     factory_ = factory;
   }
 
+  // Sets the zoom level for all guests within this embedder.
+  void SetZoomLevel(double level);
+
   // WebContentsObserver implementation.
   virtual void RenderProcessGone(base::TerminationStatus status) OVERRIDE;
   virtual bool OnMessageReceived(const IPC::Message& message) OVERRIDE;
@@ -98,6 +101,13 @@
 
   BrowserPluginGuestManager* GetBrowserPluginGuestManager();
 
+  bool DidSendScreenRectsCallback(BrowserPluginGuest* guest);
+
+  bool SetZoomLevelCallback(double level, BrowserPluginGuest* guest);
+
+  bool UnlockMouseIfNecessaryCallback(const NativeWebKeyboardEvent& event,
+                                      BrowserPluginGuest* guest);
+
   // Message handlers.
 
   void OnAllocateInstanceID(int request_id);
diff --git a/content/browser/browser_plugin/browser_plugin_guest_manager.cc b/content/browser/browser_plugin/browser_plugin_guest_manager.cc
index 82d0565..ed91c1f 100644
--- a/content/browser/browser_plugin/browser_plugin_guest_manager.cc
+++ b/content/browser/browser_plugin/browser_plugin_guest_manager.cc
@@ -16,7 +16,6 @@
 #include "content/public/common/url_constants.h"
 #include "content/public/common/url_utils.h"
 #include "net/base/escape.h"
-#include "ui/events/keycodes/keyboard_codes.h"
 
 namespace content {
 
@@ -227,40 +226,17 @@
                                                sync_point);
 }
 
-void BrowserPluginGuestManager::DidSendScreenRects(
-    WebContentsImpl* embedder_web_contents) {
-  // TODO(lazyboy): Generalize iterating over guest instances and performing
-  // actions on the guests.
+bool BrowserPluginGuestManager::ForEachGuest(
+    WebContentsImpl* embedder_web_contents, const GuestCallback& callback) {
   for (GuestInstanceMap::iterator it =
            guest_web_contents_by_instance_id_.begin();
-               it != guest_web_contents_by_instance_id_.end(); ++it) {
+       it != guest_web_contents_by_instance_id_.end(); ++it) {
     BrowserPluginGuest* guest = it->second->GetBrowserPluginGuest();
-    if (embedder_web_contents == guest->embedder_web_contents()) {
-      static_cast<RenderViewHostImpl*>(
-          guest->GetWebContents()->GetRenderViewHost())->SendScreenRects();
-    }
-  }
-}
+    if (embedder_web_contents != guest->embedder_web_contents())
+      continue;
 
-bool BrowserPluginGuestManager::UnlockMouseIfNecessary(
-    WebContentsImpl* embedder_web_contents,
-    const NativeWebKeyboardEvent& event) {
-  if ((event.type != blink::WebInputEvent::RawKeyDown) ||
-      (event.windowsKeyCode != ui::VKEY_ESCAPE) ||
-      (event.modifiers & blink::WebInputEvent::InputModifiers)) {
-    return false;
-  }
-
-  // TODO(lazyboy): Generalize iterating over guest instances and performing
-  // actions on the guests.
-  for (GuestInstanceMap::iterator it =
-           guest_web_contents_by_instance_id_.begin();
-               it != guest_web_contents_by_instance_id_.end(); ++it) {
-    BrowserPluginGuest* guest = it->second->GetBrowserPluginGuest();
-    if (embedder_web_contents == guest->embedder_web_contents()) {
-      if (guest->UnlockMouseIfNecessary(event))
-        return true;
-    }
+    if (callback.Run(guest))
+      return true;
   }
   return false;
 }
diff --git a/content/browser/browser_plugin/browser_plugin_guest_manager.h b/content/browser/browser_plugin/browser_plugin_guest_manager.h
index 1ce9a9f..5f3b3b9 100644
--- a/content/browser/browser_plugin/browser_plugin_guest_manager.h
+++ b/content/browser/browser_plugin/browser_plugin_guest_manager.h
@@ -36,7 +36,6 @@
 class SiteInstance;
 class WebContents;
 class WebContentsImpl;
-struct NativeWebKeyboardEvent;
 
 // WARNING: All APIs should be guarded with a process ID check like
 // CanEmbedderAccessInstanceIDMaybeKill, to prevent abuse by normal renderer
@@ -86,10 +85,9 @@
   bool CanEmbedderAccessInstanceIDMaybeKill(int embedder_render_process_id,
                                             int instance_id) const;
 
-  void DidSendScreenRects(WebContentsImpl* embedder_web_contents);
-
-  bool UnlockMouseIfNecessary(WebContentsImpl* embedder_web_contents_,
-                              const NativeWebKeyboardEvent& event);
+  typedef base::Callback<bool(BrowserPluginGuest*)> GuestCallback;
+  bool ForEachGuest(WebContentsImpl* embedder_web_contents,
+                    const GuestCallback& callback);
 
   void OnMessageReceived(const IPC::Message& message, int render_process_id);
 
diff --git a/content/browser/renderer_host/render_view_host_impl.cc b/content/browser/renderer_host/render_view_host_impl.cc
index b19331f..5c246db 100644
--- a/content/browser/renderer_host/render_view_host_impl.cc
+++ b/content/browser/renderer_host/render_view_host_impl.cc
@@ -2104,10 +2104,6 @@
   Send(new ViewMsg_ClearFocusedNode(GetRoutingID()));
 }
 
-void RenderViewHostImpl::SetZoomLevel(double level) {
-  Send(new ViewMsg_SetZoomLevel(GetRoutingID(), level));
-}
-
 void RenderViewHostImpl::Zoom(PageZoom zoom) {
   Send(new ViewMsg_Zoom(GetRoutingID(), zoom));
 }
diff --git a/content/browser/renderer_host/render_view_host_impl.h b/content/browser/renderer_host/render_view_host_impl.h
index 13ff167..e92b939 100644
--- a/content/browser/renderer_host/render_view_host_impl.h
+++ b/content/browser/renderer_host/render_view_host_impl.h
@@ -207,7 +207,6 @@
   virtual void SetAltErrorPageURL(const GURL& url) OVERRIDE;
   virtual void SetWebUIProperty(const std::string& name,
                                 const std::string& value) OVERRIDE;
-  virtual void SetZoomLevel(double level) OVERRIDE;
   virtual void Zoom(PageZoom zoom) OVERRIDE;
   virtual void SyncRendererPrefs() OVERRIDE;
   virtual void ToggleSpeechInput() OVERRIDE;
diff --git a/content/browser/web_contents/web_contents_impl.cc b/content/browser/web_contents/web_contents_impl.cc
index ac681ea..c5765d5 100644
--- a/content/browser/web_contents/web_contents_impl.cc
+++ b/content/browser/web_contents/web_contents_impl.cc
@@ -2051,6 +2051,13 @@
   return id;
 }
 
+void WebContentsImpl::SetZoomLevel(double level) {
+  Send(new ViewMsg_SetZoomLevel(GetRoutingID(), level));
+  BrowserPluginEmbedder* embedder = GetBrowserPluginEmbedder();
+  if (embedder)
+    embedder->SetZoomLevel(level);
+}
+
 bool WebContentsImpl::FocusLocationBarByDefault() {
   NavigationEntry* entry = controller_.GetVisibleEntry();
   if (entry && entry->GetURL() == GURL(kAboutBlankURL))
diff --git a/content/browser/web_contents/web_contents_impl.h b/content/browser/web_contents/web_contents_impl.h
index 0db67f2..4920224 100644
--- a/content/browser/web_contents/web_contents_impl.h
+++ b/content/browser/web_contents/web_contents_impl.h
@@ -268,6 +268,7 @@
                             bool is_favicon,
                             uint32_t max_bitmap_size,
                             const ImageDownloadCallback& callback) OVERRIDE;
+  virtual void SetZoomLevel(double level) OVERRIDE;
 #if defined(OS_ANDROID)
   virtual base::android::ScopedJavaLocalRef<jobject> GetJavaWebContents()
       OVERRIDE;
diff --git a/content/public/browser/render_view_host.h b/content/public/browser/render_view_host.h
index 366ad0d..f2efd36 100644
--- a/content/public/browser/render_view_host.h
+++ b/content/public/browser/render_view_host.h
@@ -253,9 +253,6 @@
   virtual void SetWebUIProperty(const std::string& name,
                                 const std::string& value) = 0;
 
-  // Set the zoom level for the current main frame
-  virtual void SetZoomLevel(double level) = 0;
-
   // Changes the zoom level for the current main frame.
   virtual void Zoom(PageZoom zoom) = 0;
 
diff --git a/content/public/browser/web_contents.h b/content/public/browser/web_contents.h
index a195ba3..0f59c77 100644
--- a/content/public/browser/web_contents.h
+++ b/content/public/browser/web_contents.h
@@ -466,6 +466,10 @@
                             uint32_t max_bitmap_size,
                             const ImageDownloadCallback& callback) = 0;
 
+  // Sets the zoom level for the current page and all BrowserPluginGuests
+  // within the page.
+  virtual void SetZoomLevel(double level) = 0;
+
 #if defined(OS_ANDROID)
   CONTENT_EXPORT static WebContents* FromJavaWebContents(
       jobject jweb_contents_android);
diff --git a/sandbox/linux/suid/sandbox.c b/sandbox/linux/suid/sandbox.c
index a161e19..238a647 100644
--- a/sandbox/linux/suid/sandbox.c
+++ b/sandbox/linux/suid/sandbox.c
@@ -58,6 +58,15 @@
   _exit(1);
 }
 
+static void ExitWithErrorSignalHandler(int signal) {
+  const char msg[] = "\nThe setuid sandbox got signaled, exiting.\n";
+  if (-1 == write(2, msg, sizeof(msg) - 1)) {
+    // Do nothing.
+  }
+
+  _exit(1);
+}
+
 // We will chroot() to the helper's /proc/self directory. Anything there will
 // not exist anymore if we make sure to wait() for the helper.
 //
@@ -195,6 +204,15 @@
   int exit_code = -1;
   siginfo_t reaped_child_info;
 
+  // Don't "Core" on SIGABRT. SIGABRT is sent by the Chrome OS session manager
+  // when things are hanging.
+  // Here, the current process is going to waitid() and _exit(), so there is no
+  // point in generating a crash report. The child process is the one
+  // blocking us.
+  if (signal(SIGABRT, ExitWithErrorSignalHandler) == SIG_ERR) {
+    FatalError("Failed to change signal handler");
+  }
+
   int wait_ret =
     HANDLE_EINTR(waitid(P_PID, child_pid, &reaped_child_info, WEXITED));