Merge from Chromium at DEPS revision 33.0.1750.166

This commit was generated by merge_to_master.py.

Change-Id: I13450f191a4974fca5c79afcc0cc1806bb4411a3
diff --git a/build/util/LASTCHANGE b/build/util/LASTCHANGE
index 4d7b4d5..6bb36d2 100644
--- a/build/util/LASTCHANGE
+++ b/build/util/LASTCHANGE
@@ -1 +1 @@
-LASTCHANGE=254388
+LASTCHANGE=256976
diff --git a/build/util/LASTCHANGE.blink b/build/util/LASTCHANGE.blink
index 913d114..2193b4b 100644
--- a/build/util/LASTCHANGE.blink
+++ b/build/util/LASTCHANGE.blink
@@ -1 +1 @@
-LASTCHANGE=168249
+LASTCHANGE=169177
diff --git a/chrome/VERSION b/chrome/VERSION
index fc08322..221aad3 100644
--- a/chrome/VERSION
+++ b/chrome/VERSION
@@ -1,4 +1,4 @@
 MAJOR=33
 MINOR=0
 BUILD=1750
-PATCH=146
+PATCH=166
diff --git a/chrome/browser/autocomplete/search_provider.cc b/chrome/browser/autocomplete/search_provider.cc
index 59a0730..2746c1f 100644
--- a/chrome/browser/autocomplete/search_provider.cc
+++ b/chrome/browser/autocomplete/search_provider.cc
@@ -312,7 +312,8 @@
 
 bool SearchProvider::NavigationResult::IsInlineable(
     const base::string16& input) const {
-  return URLPrefix::BestURLPrefix(formatted_url_, input) != NULL;
+  return
+      URLPrefix::BestURLPrefix(base::UTF8ToUTF16(url_.spec()), input) != NULL;
 }
 
 int SearchProvider::NavigationResult::CalculateRelevance(
@@ -1897,17 +1898,20 @@
     if (inline_autocomplete_offset != base::string16::npos)
       ++inline_autocomplete_offset;
   }
-  if (!input_.prevent_inline_autocomplete() &&
-      (inline_autocomplete_offset != base::string16::npos)) {
+  if (inline_autocomplete_offset != base::string16::npos) {
     DCHECK(inline_autocomplete_offset <= match.fill_into_edit.length());
-    // A navsuggestion can only be the default match when there is no
-    // keyword provider active, lest it appear first and break the user
-    // out of keyword mode.
-    match.allowed_to_be_default_match =
-        (providers_.GetKeywordProviderURL() == NULL);
     match.inline_autocompletion =
         match.fill_into_edit.substr(inline_autocomplete_offset);
   }
+  // An inlineable navsuggestion can only be the default match when there
+  // is no keyword provider active, lest it appear first and break the user
+  // out of keyword mode.  It can also only be default when we're not
+  // preventing inline autocompletion (unless the inline autocompletion
+  // would be empty).
+  match.allowed_to_be_default_match = navigation.IsInlineable(input) &&
+      (providers_.GetKeywordProviderURL() == NULL) &&
+      (!input_.prevent_inline_autocomplete() ||
+       match.inline_autocompletion.empty());
 
   match.contents = net::FormatUrl(navigation.url(), languages,
       format_types, net::UnescapeRule::SPACES, NULL, NULL, &match_start);
diff --git a/chrome/browser/autocomplete/search_provider_unittest.cc b/chrome/browser/autocomplete/search_provider_unittest.cc
index 12d8a84..0eed095 100644
--- a/chrome/browser/autocomplete/search_provider_unittest.cc
+++ b/chrome/browser/autocomplete/search_provider_unittest.cc
@@ -3020,146 +3020,159 @@
     // Some cases do not trim "http://" to match from the start of the scheme.
     const std::string fill_into_edit;
     const std::string inline_autocompletion;
-    const bool allowed_to_be_default_match;
+    const bool allowed_to_be_default_match_in_regular_mode;
+    const bool allowed_to_be_default_match_in_prevent_inline_mode;
   } cases[] = {
     // Do not inline matches that do not contain the input; trim http as needed.
-    { "x",                    "http://www.abc.com",
-                                     "www.abc.com",  std::string(), false },
-    { "https:",               "http://www.abc.com",
-                                     "www.abc.com",  std::string(), false },
-    { "abc.com/",             "http://www.abc.com",
-                                     "www.abc.com",  std::string(), false },
+    { "x",                 "http://www.abc.com",
+                                  "www.abc.com",  std::string(), false, false },
+    { "https:",            "http://www.abc.com",
+                                  "www.abc.com",  std::string(), false, false },
     { "http://www.abc.com/a", "http://www.abc.com",
-                              "http://www.abc.com",  std::string(), false },
+                              "http://www.abc.com",  std::string(), false,
+                                                                    false },
     { "http://www.abc.com",   "https://www.abc.com",
-                              "https://www.abc.com", std::string(), false },
+                              "https://www.abc.com", std::string(), false,
+                                                                    false },
     { "http://abc.com",       "ftp://abc.com",
-                              "ftp://abc.com",       std::string(), false },
+                              "ftp://abc.com",       std::string(), false,
+                                                                    false },
     { "https://www.abc.com",  "http://www.abc.com",
-                                     "www.abc.com",  std::string(), false },
+                                     "www.abc.com",  std::string(), false,
+                                                                    false },
     { "ftp://abc.com",        "http://abc.com",
-                                     "abc.com",      std::string(), false },
+                                     "abc.com",      std::string(), false,
+                                                                    false },
 
     // Do not inline matches with invalid input prefixes; trim http as needed.
-    { "ttp",                  "http://www.abc.com",
-                                     "www.abc.com", std::string(), false },
-    { "://w",                 "http://www.abc.com",
-                                     "www.abc.com", std::string(), false },
-    { "ww.",                  "http://www.abc.com",
-                                     "www.abc.com", std::string(), false },
-    { ".ab",                  "http://www.abc.com",
-                                     "www.abc.com", std::string(), false },
-    { "bc",                   "http://www.abc.com",
-                                     "www.abc.com", std::string(), false },
-    { ".com",                 "http://www.abc.com",
-                                     "www.abc.com", std::string(), false },
+    { "ttp",              "http://www.abc.com",
+                                 "www.abc.com", std::string(), false, false },
+    { "://w",             "http://www.abc.com",
+                                 "www.abc.com", std::string(), false, false },
+    { "ww.",              "http://www.abc.com",
+                                 "www.abc.com", std::string(), false, false },
+    { ".ab",              "http://www.abc.com",
+                                 "www.abc.com", std::string(), false, false },
+    { "bc",               "http://www.abc.com",
+                                 "www.abc.com", std::string(), false, false },
+    { ".com",             "http://www.abc.com",
+                                 "www.abc.com", std::string(), false, false },
 
     // Do not inline matches that omit input domain labels; trim http as needed.
-    { "www.a",                "http://a.com",
-                                     "a.com",       std::string(), false },
-    { "http://www.a",         "http://a.com",
-                              "http://a.com",       std::string(), false },
-    { "www.a",                "ftp://a.com",
-                              "ftp://a.com",        std::string(), false },
-    { "ftp://www.a",          "ftp://a.com",
-                              "ftp://a.com",        std::string(), false },
+    { "www.a",            "http://a.com",
+                                 "a.com",       std::string(), false, false },
+    { "http://www.a",     "http://a.com",
+                          "http://a.com",       std::string(), false, false },
+    { "www.a",            "ftp://a.com",
+                          "ftp://a.com",        std::string(), false, false },
+    { "ftp://www.a",      "ftp://a.com",
+                          "ftp://a.com",        std::string(), false, false },
 
     // Input matching but with nothing to inline will not yield an offset, but
     // will be allowed to be default.
-    { "abc.com",              "http://www.abc.com",
-                                     "www.abc.com", std::string(), true },
-    { "http://www.abc.com",   "http://www.abc.com",
-                              "http://www.abc.com", std::string(), true },
+    { "abc.com",             "http://www.abc.com",
+                                    "www.abc.com", std::string(), true, true },
+    { "abc.com/",            "http://www.abc.com",
+                                    "www.abc.com", std::string(), true, true },
+    { "http://www.abc.com",  "http://www.abc.com",
+                             "http://www.abc.com", std::string(), true, true },
+    { "http://www.abc.com/", "http://www.abc.com",
+                             "http://www.abc.com", std::string(), true, true },
 
     // Inline matches when the input is a leading substring of the scheme.
-    { "h",                    "http://www.abc.com",
-                              "http://www.abc.com", "ttp://www.abc.com", true },
-    { "http",                 "http://www.abc.com",
-                              "http://www.abc.com", "://www.abc.com",    true },
+    { "h",             "http://www.abc.com",
+                       "http://www.abc.com", "ttp://www.abc.com", true, false },
+    { "http",          "http://www.abc.com",
+                       "http://www.abc.com", "://www.abc.com",    true, false },
 
     // Inline matches when the input is a leading substring of the full URL.
-    { "http:",                "http://www.abc.com",
-                              "http://www.abc.com", "//www.abc.com", true },
-    { "http://w",             "http://www.abc.com",
-                              "http://www.abc.com", "ww.abc.com",    true },
-    { "http://www.",          "http://www.abc.com",
-                              "http://www.abc.com", "abc.com",       true },
-    { "http://www.ab",        "http://www.abc.com",
-                              "http://www.abc.com", "c.com",         true },
+    { "http:",             "http://www.abc.com",
+                           "http://www.abc.com", "//www.abc.com", true, false },
+    { "http://w",          "http://www.abc.com",
+                           "http://www.abc.com", "ww.abc.com",    true, false },
+    { "http://www.",       "http://www.abc.com",
+                           "http://www.abc.com", "abc.com",       true, false },
+    { "http://www.ab",     "http://www.abc.com",
+                           "http://www.abc.com", "c.com",         true, false },
     { "http://www.abc.com/p", "http://www.abc.com/path/file.htm?q=x#foo",
                               "http://www.abc.com/path/file.htm?q=x#foo",
                                                   "ath/file.htm?q=x#foo",
-                              true },
+                                                                  true, false },
     { "http://abc.com/p",     "http://abc.com/path/file.htm?q=x#foo",
                               "http://abc.com/path/file.htm?q=x#foo",
-                                              "ath/file.htm?q=x#foo", true},
+                                              "ath/file.htm?q=x#foo",
+                                                                  true, false},
 
     // Inline matches with valid URLPrefixes; only trim "http://".
     { "w",               "http://www.abc.com",
-                                "www.abc.com", "ww.abc.com", true },
+                                "www.abc.com", "ww.abc.com", true, false },
     { "www.a",           "http://www.abc.com",
-                                "www.abc.com", "bc.com",     true },
+                                "www.abc.com", "bc.com",     true, false },
     { "abc",             "http://www.abc.com",
-                                "www.abc.com", ".com",       true },
+                                "www.abc.com", ".com",       true, false },
     { "abc.c",           "http://www.abc.com",
-                                "www.abc.com", "om",         true },
+                                "www.abc.com", "om",         true, false },
     { "abc.com/p",       "http://www.abc.com/path/file.htm?q=x#foo",
                                 "www.abc.com/path/file.htm?q=x#foo",
-                                             "ath/file.htm?q=x#foo", true },
+                                             "ath/file.htm?q=x#foo",
+                                                             true, false },
     { "abc.com/p",       "http://abc.com/path/file.htm?q=x#foo",
                                 "abc.com/path/file.htm?q=x#foo",
-                                         "ath/file.htm?q=x#foo", true },
+                                         "ath/file.htm?q=x#foo",
+                                                             true, false },
 
     // Inline matches using the maximal URLPrefix components.
     { "h",               "http://help.com",
-                                "help.com", "elp.com",     true },
+                                "help.com", "elp.com",     true, false },
     { "http",            "http://http.com",
-                                "http.com", ".com",        true },
+                                "http.com", ".com",        true, false },
     { "h",               "http://www.help.com",
-                                "www.help.com", "elp.com", true },
+                                "www.help.com", "elp.com", true, false },
     { "http",            "http://www.http.com",
-                                "www.http.com", ".com",    true },
+                                "www.http.com", ".com",    true, false },
     { "w",               "http://www.www.com",
-                                "www.www.com",  "ww.com",  true },
+                                "www.www.com",  "ww.com",  true, false },
 
     // Test similar behavior for the ftp and https schemes.
-    { "ftp://www.ab",    "ftp://www.abc.com/path/file.htm?q=x#foo",
-                         "ftp://www.abc.com/path/file.htm?q=x#foo",
-                                     "c.com/path/file.htm?q=x#foo", true },
-    { "www.ab",          "ftp://www.abc.com/path/file.htm?q=x#foo",
-                         "ftp://www.abc.com/path/file.htm?q=x#foo",
-                                     "c.com/path/file.htm?q=x#foo", true },
-    { "ab",              "ftp://www.abc.com/path/file.htm?q=x#foo",
-                         "ftp://www.abc.com/path/file.htm?q=x#foo",
-                                     "c.com/path/file.htm?q=x#foo", true },
-    { "ab",              "ftp://abc.com/path/file.htm?q=x#foo",
-                         "ftp://abc.com/path/file.htm?q=x#foo",
-                                 "c.com/path/file.htm?q=x#foo",     true },
+    { "ftp://www.ab",  "ftp://www.abc.com/path/file.htm?q=x#foo",
+                       "ftp://www.abc.com/path/file.htm?q=x#foo",
+                                  "c.com/path/file.htm?q=x#foo",  true, false },
+    { "www.ab",        "ftp://www.abc.com/path/file.htm?q=x#foo",
+                       "ftp://www.abc.com/path/file.htm?q=x#foo",
+                                   "c.com/path/file.htm?q=x#foo", true, false },
+    { "ab",            "ftp://www.abc.com/path/file.htm?q=x#foo",
+                       "ftp://www.abc.com/path/file.htm?q=x#foo",
+                                   "c.com/path/file.htm?q=x#foo", true, false },
+    { "ab",            "ftp://abc.com/path/file.htm?q=x#foo",
+                       "ftp://abc.com/path/file.htm?q=x#foo",
+                               "c.com/path/file.htm?q=x#foo",     true, false },
     { "https://www.ab",  "https://www.abc.com/path/file.htm?q=x#foo",
                          "https://www.abc.com/path/file.htm?q=x#foo",
-                                       "c.com/path/file.htm?q=x#foo", true },
-    { "www.ab",          "https://www.abc.com/path/file.htm?q=x#foo",
-                         "https://www.abc.com/path/file.htm?q=x#foo",
-                                       "c.com/path/file.htm?q=x#foo", true },
-    { "ab",              "https://www.abc.com/path/file.htm?q=x#foo",
-                         "https://www.abc.com/path/file.htm?q=x#foo",
-                                       "c.com/path/file.htm?q=x#foo", true },
-    { "ab",              "https://abc.com/path/file.htm?q=x#foo",
-                         "https://abc.com/path/file.htm?q=x#foo",
-                                   "c.com/path/file.htm?q=x#foo", true },
+                                       "c.com/path/file.htm?q=x#foo",
+                                                                  true, false },
+    { "www.ab",      "https://www.abc.com/path/file.htm?q=x#foo",
+                     "https://www.abc.com/path/file.htm?q=x#foo",
+                                   "c.com/path/file.htm?q=x#foo", true, false },
+    { "ab",          "https://www.abc.com/path/file.htm?q=x#foo",
+                     "https://www.abc.com/path/file.htm?q=x#foo",
+                                   "c.com/path/file.htm?q=x#foo", true, false },
+    { "ab",          "https://abc.com/path/file.htm?q=x#foo",
+                     "https://abc.com/path/file.htm?q=x#foo",
+                               "c.com/path/file.htm?q=x#foo",     true, false },
 
     // Forced query input should inline and retain the "?" prefix.
     { "?http://www.ab",  "http://www.abc.com",
-                        "?http://www.abc.com", "c.com", true },
+                        "?http://www.abc.com", "c.com", true, false },
     { "?www.ab",         "http://www.abc.com",
-                               "?www.abc.com", "c.com", true },
+                               "?www.abc.com", "c.com", true, false },
     { "?ab",             "http://www.abc.com",
-                               "?www.abc.com", "c.com", true },
+                               "?www.abc.com", "c.com", true, false },
     { "?abc.com",        "http://www.abc.com",
-                               "?www.abc.com", "", true },
+                               "?www.abc.com", "",      true, true },
   };
 
   for (size_t i = 0; i < ARRAYSIZE_UNSAFE(cases); i++) {
+    // First test regular mode.
     QueryForInput(ASCIIToUTF16(cases[i].input), false, false);
     AutocompleteMatch match(
         provider_->NavigationToMatch(SearchProvider::NavigationResult(
@@ -3168,8 +3181,21 @@
     EXPECT_EQ(ASCIIToUTF16(cases[i].inline_autocompletion),
               match.inline_autocompletion);
     EXPECT_EQ(ASCIIToUTF16(cases[i].fill_into_edit), match.fill_into_edit);
-    EXPECT_EQ(cases[i].allowed_to_be_default_match,
+    EXPECT_EQ(cases[i].allowed_to_be_default_match_in_regular_mode,
               match.allowed_to_be_default_match);
+
+    // Then test prevent-inline-autocomplete mode.
+    QueryForInput(ASCIIToUTF16(cases[i].input), true, false);
+    AutocompleteMatch match_prevent_inline(
+        provider_->NavigationToMatch(SearchProvider::NavigationResult(
+            *provider_.get(), GURL(cases[i].url), base::string16(), false, 0,
+            false)));
+    EXPECT_EQ(ASCIIToUTF16(cases[i].inline_autocompletion),
+              match_prevent_inline.inline_autocompletion);
+    EXPECT_EQ(ASCIIToUTF16(cases[i].fill_into_edit),
+              match_prevent_inline.fill_into_edit);
+    EXPECT_EQ(cases[i].allowed_to_be_default_match_in_prevent_inline_mode,
+              match_prevent_inline.allowed_to_be_default_match);
   }
 }
 
@@ -3188,11 +3214,10 @@
   EXPECT_TRUE(match_inline.allowed_to_be_default_match);
   EXPECT_EQ(url, match_inline.contents);
 
-  // Check the same offset and strings when inline autocompletion is prevented.
+  // Check the same strings when inline autocompletion is prevented.
   QueryForInput(input, true, false);
   AutocompleteMatch match_prevent(provider_->NavigationToMatch(result));
   EXPECT_EQ(url, match_prevent.fill_into_edit);
-  EXPECT_TRUE(match_prevent.inline_autocompletion.empty());
   EXPECT_FALSE(match_prevent.allowed_to_be_default_match);
   EXPECT_EQ(url, match_prevent.contents);
 }
diff --git a/chrome/browser/chromeos/extensions/file_manager/private_api_file_system.cc b/chrome/browser/chromeos/extensions/file_manager/private_api_file_system.cc
index f266a19..7e7a1b1 100644
--- a/chrome/browser/chromeos/extensions/file_manager/private_api_file_system.cc
+++ b/chrome/browser/chromeos/extensions/file_manager/private_api_file_system.cc
@@ -33,6 +33,7 @@
 #include "content/public/browser/render_process_host.h"
 #include "content/public/browser/render_view_host.h"
 #include "content/public/browser/storage_partition.h"
+#include "net/base/escape.h"
 #include "webkit/browser/fileapi/file_system_context.h"
 #include "webkit/browser/fileapi/file_system_file_util.h"
 #include "webkit/browser/fileapi/file_system_operation_context.h"
@@ -540,7 +541,7 @@
   fileapi::FileSystemURL source_url(
       file_system_context->CrackURL(GURL(params->source_url)));
   fileapi::FileSystemURL destination_url(file_system_context->CrackURL(
-      GURL(params->parent + "/" + params->new_name)));
+      GURL(params->parent + "/" + net::EscapePath(params->new_name))));
 
   if (!source_url.is_valid() || !destination_url.is_valid()) {
     error_ = base::IntToString(fileapi::PlatformFileErrorToWebFileError(
diff --git a/chrome/browser/chromeos/policy/device_cloud_policy_manager_chromeos.cc b/chrome/browser/chromeos/policy/device_cloud_policy_manager_chromeos.cc
index 2f4b1b0..3bfff34 100644
--- a/chrome/browser/chromeos/policy/device_cloud_policy_manager_chromeos.cc
+++ b/chrome/browser/chromeos/policy/device_cloud_policy_manager_chromeos.cc
@@ -34,6 +34,12 @@
 
 namespace {
 
+// Overridden no requisition value.
+const char kNoRequisition[] = "none";
+
+// Overridden no requisition value.
+const char kRemoraRequisition[] = "remora";
+
 // MachineInfo key names.
 const char kMachineInfoSystemHwqual[] = "hardware_class";
 
@@ -118,6 +124,7 @@
   device_management_service_ = device_management_service;
   device_status_provider_ = device_status_provider.Pass();
 
+  InitalizeRequisition();
   StartIfManaged();
 }
 
@@ -151,13 +158,11 @@
   std::string requisition;
   const PrefService::Preference* pref = local_state_->FindPreference(
       prefs::kDeviceEnrollmentRequisition);
-  if (pref->IsDefaultValue() && !chromeos::StartupUtils::IsOobeCompleted()) {
-    // OEM statistics are only loaded when OOBE is not completed.
-    requisition =
-        GetMachineStatistic(chromeos::system::kOemDeviceRequisitionKey);
-  } else {
+  if (!pref->IsDefaultValue())
     pref->GetValue()->GetAsString(&requisition);
-  }
+
+  if (requisition == kNoRequisition)
+    requisition.clear();
 
   return requisition;
 }
@@ -171,8 +176,13 @@
       local_state_->ClearPref(prefs::kDeviceEnrollmentCanExit);
     } else {
       local_state_->SetString(prefs::kDeviceEnrollmentRequisition, requisition);
-      local_state_->SetBoolean(prefs::kDeviceEnrollmentAutoStart, true);
-      local_state_->SetBoolean(prefs::kDeviceEnrollmentCanExit, false);
+      if (requisition == kNoRequisition) {
+        local_state_->ClearPref(prefs::kDeviceEnrollmentAutoStart);
+        local_state_->ClearPref(prefs::kDeviceEnrollmentCanExit);
+      } else {
+        local_state_->SetBoolean(prefs::kDeviceEnrollmentAutoStart, true);
+        local_state_->SetBoolean(prefs::kDeviceEnrollmentCanExit, false);
+      }
     }
   }
 }
@@ -291,4 +301,35 @@
   }
 }
 
+void DeviceCloudPolicyManagerChromeOS::InitalizeRequisition() {
+  // OEM statistics are only loaded when OOBE is not completed.
+  if (chromeos::StartupUtils::IsOobeCompleted())
+    return;
+
+  const PrefService::Preference* pref = local_state_->FindPreference(
+      prefs::kDeviceEnrollmentRequisition);
+  if (pref->IsDefaultValue()) {
+    std::string requisition =
+        GetMachineStatistic(chromeos::system::kOemDeviceRequisitionKey);
+
+    if (!requisition.empty()) {
+      local_state_->SetString(prefs::kDeviceEnrollmentRequisition,
+                              requisition);
+      if (requisition == kRemoraRequisition) {
+        local_state_->SetBoolean(prefs::kDeviceEnrollmentAutoStart, true);
+        local_state_->SetBoolean(prefs::kDeviceEnrollmentCanExit, false);
+      } else {
+        local_state_->SetBoolean(
+            prefs::kDeviceEnrollmentAutoStart,
+            GetMachineFlag(chromeos::system::kOemIsEnterpriseManagedKey,
+                           false));
+        local_state_->SetBoolean(
+            prefs::kDeviceEnrollmentCanExit,
+            GetMachineFlag(chromeos::system::kOemCanExitEnterpriseEnrollmentKey,
+                           false));
+      }
+    }
+  }
+}
+
 }  // namespace policy
diff --git a/chrome/browser/chromeos/policy/device_cloud_policy_manager_chromeos.h b/chrome/browser/chromeos/policy/device_cloud_policy_manager_chromeos.h
index ec1fc04..f5f36ed 100644
--- a/chrome/browser/chromeos/policy/device_cloud_policy_manager_chromeos.h
+++ b/chrome/browser/chromeos/policy/device_cloud_policy_manager_chromeos.h
@@ -115,6 +115,9 @@
   void EnrollmentCompleted(const EnrollmentCallback& callback,
                            EnrollmentStatus status);
 
+  // Initializes requisition settings at OOBE with values from VPD.
+  void InitalizeRequisition();
+
   // Points to the same object as the base CloudPolicyManager::store(), but with
   // actual device policy specific type.
   scoped_ptr<DeviceCloudPolicyStoreChromeOS> device_store_;
diff --git a/chrome/browser/metrics/chrome_browser_main_extra_parts_metrics.cc b/chrome/browser/metrics/chrome_browser_main_extra_parts_metrics.cc
index a14e30f..1f0db00 100644
--- a/chrome/browser/metrics/chrome_browser_main_extra_parts_metrics.cc
+++ b/chrome/browser/metrics/chrome_browser_main_extra_parts_metrics.cc
@@ -28,7 +28,11 @@
 #include <gnu/libc-version.h>
 
 #include "base/version.h"
-#endif
+#endif  // defined(OS_LINUX) && !defined(OS_CHROMEOS)
+
+#if defined(OS_WIN)
+#include "chrome/installer/util/google_update_settings.h"
+#endif  // defined(OS_WIN)
 
 namespace {
 
@@ -71,6 +75,14 @@
                             ShellIntegration::NUM_DEFAULT_STATES);
 }
 
+// Called on the blocking pool some time after startup to avoid slowing down
+// startup with metrics that aren't trivial to compute.
+void RecordStartupMetricsOnBlockingPool() {
+#if defined(OS_WIN)
+  GoogleUpdateSettings::RecordChromeUpdatePolicyHistograms();
+#endif  // defined(OS_WIN)
+}
+
 void RecordLinuxGlibcVersion() {
 #if defined(OS_LINUX) && !defined(OS_CHROMEOS)
   Version version(gnu_get_libc_version());
@@ -150,6 +162,12 @@
 void ChromeBrowserMainExtraPartsMetrics::PostBrowserStart() {
   RecordLinuxGlibcVersion();
   RecordTouchEventState();
+
+  const int kStartupMetricsGatheringDelaySeconds = 45;
+  content::BrowserThread::GetBlockingPool()->PostDelayedTask(
+      FROM_HERE,
+      base::Bind(&RecordStartupMetricsOnBlockingPool),
+      base::TimeDelta::FromSeconds(kStartupMetricsGatheringDelaySeconds));
 }
 
 namespace chrome {
diff --git a/chrome/browser/password_manager/password_manager.cc b/chrome/browser/password_manager/password_manager.cc
index f1a6347..3a88453 100644
--- a/chrome/browser/password_manager/password_manager.cc
+++ b/chrome/browser/password_manager/password_manager.cc
@@ -44,15 +44,6 @@
 const char kOtherPossibleUsernamesExperiment[] =
     "PasswordManagerOtherPossibleUsernames";
 
-void ReportOsPassword() {
-  password_manager_util::OsPasswordStatus status =
-      password_manager_util::GetOsPasswordStatus();
-
-  UMA_HISTOGRAM_ENUMERATION("PasswordManager.OsPasswordStatus",
-                            status,
-                            password_manager_util::MAX_PASSWORD_STATUS);
-}
-
 // This routine is called when PasswordManagers are constructed.
 //
 // Currently we report metrics only once at startup. We require
@@ -69,13 +60,6 @@
     return;
   ran_once = true;
 
-  // Avoid checking OS password until later on in browser startup
-  // since it calls a few Windows APIs.
-  BrowserThread::PostDelayedTask(BrowserThread::UI,
-                                 FROM_HERE,
-                                 base::Bind(&ReportOsPassword),
-                                 base::TimeDelta::FromSeconds(10));
-
   UMA_HISTOGRAM_BOOLEAN("PasswordManager.Enabled", password_manager_enabled);
 }
 
diff --git a/chrome/browser/resources/chromeos/login/display_manager.js b/chrome/browser/resources/chromeos/login/display_manager.js
index a2a00ff..50d0422 100644
--- a/chrome/browser/resources/chromeos/login/display_manager.js
+++ b/chrome/browser/resources/chromeos/login/display_manager.js
@@ -587,7 +587,7 @@
      */
     onConfirmDeviceRequisitionPrompt_: function(value) {
       this.deviceRequisition_ = value;
-      chrome.send('setDeviceRequisition', [value]);
+      chrome.send('setDeviceRequisition', [value == '' ? 'none' : value]);
     },
 
     /**
@@ -625,8 +625,11 @@
       this.deviceRequisitionRemoraDialog_.showWithTitle(
           loadTimeData.getString('deviceRequisitionRemoraPromptTitle'),
           loadTimeData.getString('deviceRequisitionRemoraPromptText'),
-          function() {
+          function() {  // onShow
             chrome.send('setDeviceRequisition', ['remora']);
+          },
+          function() {  // onCancel
+             chrome.send('setDeviceRequisition', ['none']);
           });
     },
 
diff --git a/chrome/browser/ui/webui/chromeos/login/core_oobe_handler.cc b/chrome/browser/ui/webui/chromeos/login/core_oobe_handler.cc
index e3588c3..ff912fe 100644
--- a/chrome/browser/ui/webui/chromeos/login/core_oobe_handler.cc
+++ b/chrome/browser/ui/webui/chromeos/login/core_oobe_handler.cc
@@ -235,10 +235,16 @@
 
 void CoreOobeHandler::HandleSetDeviceRequisition(
     const std::string& requisition) {
-  g_browser_process->browser_policy_connector()->GetDeviceCloudPolicyManager()->
-      SetDeviceRequisition(requisition);
+  policy::BrowserPolicyConnector* connector =
+      g_browser_process->browser_policy_connector();
+  std::string initial_requisition =
+      connector->GetDeviceCloudPolicyManager()->GetDeviceRequisition();
+  connector->GetDeviceCloudPolicyManager()->SetDeviceRequisition(requisition);
   // Exit Chrome to force the restart as soon as a new requisition is set.
-  chrome::ExitCleanly();
+  if (initial_requisition !=
+          connector->GetDeviceCloudPolicyManager()->GetDeviceRequisition()) {
+    chrome::AttemptRestart();
+  }
 }
 
 void CoreOobeHandler::HandleScreenAssetsLoaded(
diff --git a/chrome/installer/util/google_update_settings.cc b/chrome/installer/util/google_update_settings.cc
index 39ca7c6..508809c3 100644
--- a/chrome/installer/util/google_update_settings.cc
+++ b/chrome/installer/util/google_update_settings.cc
@@ -8,6 +8,9 @@
 #include <string>
 
 #include "base/command_line.h"
+#include "base/files/file_path.h"
+#include "base/logging.h"
+#include "base/metrics/histogram.h"
 #include "base/path_service.h"
 #include "base/strings/string_number_conversions.h"
 #include "base/strings/string_util.h"
@@ -570,6 +573,22 @@
   return update_policy;
 }
 
+void GoogleUpdateSettings::RecordChromeUpdatePolicyHistograms() {
+  const bool is_multi_install = InstallUtil::IsMultiInstall(
+      BrowserDistribution::GetDistribution(), IsSystemInstall());
+  const base::string16 app_guid =
+      BrowserDistribution::GetSpecificDistribution(
+          is_multi_install ? BrowserDistribution::CHROME_BINARIES :
+                             BrowserDistribution::CHROME_BROWSER)->GetAppGuid();
+
+  bool is_overridden = false;
+  const UpdatePolicy update_policy = GetAppUpdatePolicy(app_guid,
+                                                        &is_overridden);
+  UMA_HISTOGRAM_BOOLEAN("GoogleUpdate.UpdatePolicyIsOverridden", is_overridden);
+  UMA_HISTOGRAM_ENUMERATION("GoogleUpdate.EffectivePolicy", update_policy,
+                            UPDATE_POLICIES_COUNT);
+}
+
 string16 GoogleUpdateSettings::GetUninstallCommandLine(bool system_install) {
   const HKEY root_key = system_install ? HKEY_LOCAL_MACHINE : HKEY_CURRENT_USER;
   string16 cmd_line;
diff --git a/chrome/installer/util/google_update_settings.h b/chrome/installer/util/google_update_settings.h
index 7cd4b75..a4331e7 100644
--- a/chrome/installer/util/google_update_settings.h
+++ b/chrome/installer/util/google_update_settings.h
@@ -31,6 +31,7 @@
     AUTOMATIC_UPDATES   = 1,
     MANUAL_UPDATES_ONLY = 2,
     AUTO_UPDATES_ONLY   = 3,
+    UPDATE_POLICIES_COUNT
   };
 
   // Defines product data that is tracked/used by Google Update.
@@ -227,6 +228,9 @@
   static UpdatePolicy GetAppUpdatePolicy(const std::wstring& app_guid,
                                          bool* is_overridden);
 
+  // Records UMA stats about Chrome's update policy.
+  static void RecordChromeUpdatePolicyHistograms();
+
   // Returns Google Update's uninstall command line, or an empty string if none
   // is found.
   static string16 GetUninstallCommandLine(bool system_install);
diff --git a/chrome/installer/util/install_util.cc b/chrome/installer/util/install_util.cc
index 97f2162..75011af 100644
--- a/chrome/installer/util/install_util.cc
+++ b/chrome/installer/util/install_util.cc
@@ -353,8 +353,7 @@
                                  bool system_install) {
   DCHECK(dist);
   ProductState state;
-  return state.Initialize(system_install, dist->GetType()) &&
-         state.is_multi_install();
+  return state.Initialize(system_install, dist) && state.is_multi_install();
 }
 
 bool CheckIsChromeSxSProcess() {
diff --git a/content/app/content_main_runner.cc b/content/app/content_main_runner.cc
index 33bb2a3..776417d 100644
--- a/content/app/content_main_runner.cc
+++ b/content/app/content_main_runner.cc
@@ -140,6 +140,8 @@
     // Could not set the alternate window station. There is a possibility
     // that the theme wont be correctly initialized.
     NOTREACHED() << "Unable to switch to WinSta0, we: "<< ::GetLastError();
+    ::CloseWindowStation(winsta0);
+    return;
   }
 
   HWND window = ::CreateWindowExW(0, L"Static", L"", WS_POPUP | WS_DISABLED,
diff --git a/content/browser/renderer_host/render_widget_host_view_aura.cc b/content/browser/renderer_host/render_widget_host_view_aura.cc
index 4101a78..7f98b5d 100644
--- a/content/browser/renderer_host/render_widget_host_view_aura.cc
+++ b/content/browser/renderer_host/render_widget_host_view_aura.cc
@@ -1579,6 +1579,8 @@
         base::Bind(&RenderWidgetHostViewAura::SendSoftwareFrameAck,
                    AsWeakPtr(),
                    output_surface_id));
+  } else {
+    SendSoftwareFrameAck(output_surface_id);
   }
   if (paint_observer_)
     paint_observer_->OnUpdateCompositorContent();
diff --git a/content/browser/renderer_host/websocket_dispatcher_host.cc b/content/browser/renderer_host/websocket_dispatcher_host.cc
index d64a8a4..e7bb028 100644
--- a/content/browser/renderer_host/websocket_dispatcher_host.cc
+++ b/content/browser/renderer_host/websocket_dispatcher_host.cc
@@ -83,10 +83,13 @@
 }
 
 WebSocketHostState WebSocketDispatcherHost::SendOrDrop(IPC::Message* message) {
+  const uint32 message_type = message->type();
+  const int32 message_routing_id = message->routing_id();
   if (!Send(message)) {
-    DVLOG(1) << "Sending of message type " << message->type()
+    message = NULL;
+    DVLOG(1) << "Sending of message type " << message_type
              << " failed. Dropping channel.";
-    DeleteWebSocketHost(message->routing_id());
+    DeleteWebSocketHost(message_routing_id);
     return WEBSOCKET_HOST_DELETED;
   }
   return WEBSOCKET_HOST_ALIVE;
diff --git a/content/renderer/pepper/pepper_graphics_2d_host.cc b/content/renderer/pepper/pepper_graphics_2d_host.cc
index e2003e8..5103459 100644
--- a/content/renderer/pepper/pepper_graphics_2d_host.cc
+++ b/content/renderer/pepper/pepper_graphics_2d_host.cc
@@ -424,8 +424,6 @@
 void PepperGraphics2DHost::DidChangeView(const ppapi::ViewData& view_data) {
   gfx::Size old_plugin_size = current_plugin_size_;
   current_plugin_size_ = PP_ToGfxSize(view_data.rect.size);
-  if (bound_instance_)
-    bound_instance_->UpdateLayerTransform();
 }
 
 void PepperGraphics2DHost::SetScale(float scale) {
@@ -740,9 +738,6 @@
   queued_operations_.clear();
 
   flushed_plugin_size_ = flushed_plugin_size;
-  if (bound_instance_)
-    bound_instance_->UpdateLayerTransform();
-
   if (!bound_instance_) {
     // As promised in the API, we always schedule callback when unbound.
     ScheduleOffscreenFlushAck();
diff --git a/content/renderer/pepper/pepper_platform_context_3d.cc b/content/renderer/pepper/pepper_platform_context_3d.cc
index b9fd07b..6c3408b 100644
--- a/content/renderer/pepper/pepper_platform_context_3d.cc
+++ b/content/renderer/pepper/pepper_platform_context_3d.cc
@@ -107,6 +107,7 @@
   if (!command_buffer_->ProduceFrontBuffer(names[0]))
     return false;
   mailbox_ = names[0];
+  sync_point_ = command_buffer_->InsertSyncPoint();
 
   command_buffer_->SetChannelErrorCallback(
       base::Bind(&PlatformContext3D::OnContextLost,
@@ -118,8 +119,15 @@
   return true;
 }
 
-void PlatformContext3D::GetBackingMailbox(gpu::Mailbox* mailbox) {
+void PlatformContext3D::GetBackingMailbox(gpu::Mailbox* mailbox,
+                                          uint32* sync_point) {
   *mailbox = mailbox_;
+  *sync_point = sync_point_;
+}
+
+void PlatformContext3D::InsertSyncPointForBackingMailbox() {
+  DCHECK(command_buffer_);
+  sync_point_ = command_buffer_->InsertSyncPoint();
 }
 
 bool PlatformContext3D::IsOpaque() {
diff --git a/content/renderer/pepper/pepper_platform_context_3d.h b/content/renderer/pepper/pepper_platform_context_3d.h
index 2520bbd..dcd42ca 100644
--- a/content/renderer/pepper/pepper_platform_context_3d.h
+++ b/content/renderer/pepper/pepper_platform_context_3d.h
@@ -31,7 +31,11 @@
   bool Init(const int32* attrib_list, PlatformContext3D* share_context);
 
   // Retrieves the mailbox name for the front buffer backing the context.
-  void GetBackingMailbox(gpu::Mailbox* mailbox);
+  void GetBackingMailbox(gpu::Mailbox* mailbox, uint32* sync_point);
+
+  // Inserts a new sync point to associate with the backing mailbox, that should
+  // be waited on before using the mailbox.
+  void InsertSyncPointForBackingMailbox();
 
   // Returns true if the backing texture is always opaque.
   bool IsOpaque();
@@ -68,6 +72,7 @@
 
   scoped_refptr<GpuChannelHost> channel_;
   gpu::Mailbox mailbox_;
+  uint32 sync_point_;
   bool has_alpha_;
   CommandBufferProxyImpl* command_buffer_;
   base::Closure context_lost_callback_;
diff --git a/content/renderer/pepper/pepper_plugin_instance_impl.cc b/content/renderer/pepper/pepper_plugin_instance_impl.cc
index 1277c63..405d6ce 100644
--- a/content/renderer/pepper/pepper_plugin_instance_impl.cc
+++ b/content/renderer/pepper/pepper_plugin_instance_impl.cc
@@ -113,11 +113,9 @@
 #include "third_party/skia/include/core/SkRect.h"
 #include "ui/gfx/image/image_skia.h"
 #include "ui/gfx/image/image_skia_rep.h"
-#include "ui/gfx/point_conversions.h"
 #include "ui/gfx/range/range.h"
 #include "ui/gfx/rect_conversions.h"
 #include "ui/gfx/scoped_ns_graphics_context_save_gstate_mac.h"
-#include "ui/gfx/size_conversions.h"
 #include "v8/include/v8.h"
 #include "webkit/renderer/compositor_bindings/web_layer_impl.h"
 
@@ -702,9 +700,21 @@
   }
 }
 
+static void IgnoreCallback(unsigned, bool) {}
+
 void PepperPluginInstanceImpl::CommitBackingTexture() {
-  if (texture_layer_.get())
-    texture_layer_->SetNeedsDisplay();
+  if (!texture_layer_.get())
+    return;
+  PlatformContext3D* context = bound_graphics_3d_->platform_context();
+  gpu::Mailbox mailbox;
+  uint32 sync_point = 0;
+  context->GetBackingMailbox(&mailbox, &sync_point);
+  DCHECK(!mailbox.IsZero());
+  DCHECK_NE(sync_point, 0u);
+  texture_layer_->SetTextureMailbox(
+      cc::TextureMailbox(mailbox, sync_point),
+      cc::SingleReleaseCallback::Create(base::Bind(&IgnoreCallback)));
+  texture_layer_->SetNeedsDisplay();
 }
 
 void PepperPluginInstanceImpl::InstanceCrashed() {
@@ -1859,16 +1869,16 @@
 #endif
 }
 
-static void IgnoreCallback(unsigned, bool) {}
-
 void PepperPluginInstanceImpl::UpdateLayer() {
   if (!container_)
     return;
 
   gpu::Mailbox mailbox;
+  uint32 sync_point = 0;
   if (bound_graphics_3d_.get()) {
     PlatformContext3D* context = bound_graphics_3d_->platform_context();
-    context->GetBackingMailbox(&mailbox);
+    context->GetBackingMailbox(&mailbox, &sync_point);
+    DCHECK_EQ(mailbox.IsZero(), sync_point == 0);
   }
   bool want_3d_layer = !mailbox.IsZero();
   bool want_2d_layer = bound_graphics_2d_platform_ &&
@@ -1878,8 +1888,9 @@
 
   if ((want_layer == !!texture_layer_.get()) &&
       (want_3d_layer == layer_is_hardware_) &&
-      layer_bound_to_fullscreen_ == !!fullscreen_container_)
+      layer_bound_to_fullscreen_ == !!fullscreen_container_) {
     return;
+  }
 
   if (texture_layer_) {
     if (!layer_bound_to_fullscreen_)
@@ -1891,32 +1902,21 @@
   }
   if (want_layer) {
     bool opaque = false;
-    scoped_refptr<cc::Layer> plugin_layer;
     if (want_3d_layer) {
       DCHECK(bound_graphics_3d_.get());
       texture_layer_ = cc::TextureLayer::CreateForMailbox(NULL);
       opaque = bound_graphics_3d_->IsOpaque();
       texture_layer_->SetTextureMailbox(
-          cc::TextureMailbox(mailbox, 0),
+          cc::TextureMailbox(mailbox, sync_point),
           cc::SingleReleaseCallback::Create(base::Bind(&IgnoreCallback)));
-      plugin_layer = texture_layer_;
     } else {
       DCHECK(bound_graphics_2d_platform_);
       texture_layer_ = cc::TextureLayer::CreateForMailbox(this);
       bound_graphics_2d_platform_->AttachedToNewLayer();
       opaque = bound_graphics_2d_platform_->IsAlwaysOpaque();
       texture_layer_->SetFlipped(false);
-      texture_layer_->SetBounds(bound_graphics_2d_platform_->Size());
-      texture_layer_->SetIsDrawable(true);
-      // WebLayer sets the bounds of its containing layer to be the same size as
-      // the plugin DOM element. Because we want to allow scaling/positioning of
-      // the layer in the 2D case (for SetOffset) we need to add this
-      // intermediate layer. If we wanted to support this functionality for the
-      // 3D case, we would need an intermediate layer in that case also.
-      plugin_layer = cc::Layer::Create();
-      plugin_layer->AddChild(texture_layer_);
     }
-    web_layer_.reset(new webkit::WebLayerImpl(plugin_layer));
+    web_layer_.reset(new webkit::WebLayerImpl(texture_layer_));
     if (fullscreen_container_) {
       fullscreen_container_->SetLayer(web_layer_.get());
       // Ignore transparency in fullscreen, since that's what Flash always
@@ -1930,7 +1930,6 @@
   }
   layer_bound_to_fullscreen_ = !!fullscreen_container_;
   layer_is_hardware_ = want_3d_layer;
-  UpdateLayerTransform();
 }
 
 unsigned PepperPluginInstanceImpl::PrepareTexture() {
@@ -1947,33 +1946,6 @@
       mailbox, release_callback);
 }
 
-void PepperPluginInstanceImpl::UpdateLayerTransform() {
-  if (!bound_graphics_2d_platform_ || !texture_layer_) {
-    // Currently the transform is only applied for Graphics2D.
-    return;
-  }
-
-  gfx::RectF backing_store(bound_graphics_2d_platform_->plugin_offset(),
-                           bound_graphics_2d_platform_->Size());
-  gfx::PointF scale = bound_graphics_2d_platform_->GetResizeScale();
-  backing_store = ScaleRect(backing_store, scale.x(), scale.y());
-
-  gfx::Rect layer_rect(ToEnclosingRect(backing_store));
-  gfx::Size plugin_size(PP_ToGfxSize(view_data_.rect.size));
-  layer_rect.Intersect(gfx::Rect(plugin_size));
-  texture_layer_->SetPosition(layer_rect.origin());
-  texture_layer_->SetBounds(layer_rect.size());
-
-  gfx::PointF u(PointAtOffsetFromOrigin(
-      layer_rect.origin() - backing_store.origin()));
-  gfx::PointF v(PointAtOffsetFromOrigin(
-      layer_rect.bottom_right() - backing_store.origin()));
-  gfx::RectF uv(BoundingRect(u, v));
-  if (!backing_store.IsEmpty())
-    uv.Scale(1.0f / backing_store.width(), 1.0f / backing_store.height());
-  texture_layer_->SetUV(uv.origin(), uv.bottom_right());
-}
-
 void PepperPluginInstanceImpl::AddPluginObject(PluginObject* plugin_object) {
   DCHECK(live_plugin_objects_.find(plugin_object) ==
          live_plugin_objects_.end());
diff --git a/content/renderer/pepper/pepper_plugin_instance_impl.h b/content/renderer/pepper/pepper_plugin_instance_impl.h
index f000bce..0ed093f 100644
--- a/content/renderer/pepper/pepper_plugin_instance_impl.h
+++ b/content/renderer/pepper/pepper_plugin_instance_impl.h
@@ -506,9 +506,6 @@
       scoped_ptr<cc::SingleReleaseCallback>* release_callback,
       bool use_shared_memory) OVERRIDE;
 
-  // Update any transforms that should be applied to the texture layer.
-  void UpdateLayerTransform();
-
  private:
   friend class base::RefCounted<PepperPluginInstanceImpl>;
   friend class PpapiUnittest;
diff --git a/content/renderer/pepper/ppb_graphics_3d_impl.cc b/content/renderer/pepper/ppb_graphics_3d_impl.cc
index 1564279..989b999 100644
--- a/content/renderer/pepper/ppb_graphics_3d_impl.cc
+++ b/content/renderer/pepper/ppb_graphics_3d_impl.cc
@@ -197,6 +197,10 @@
   if (gles2_impl())
     gles2_impl()->SwapBuffers();
 
+  // Since the backing texture has been updated, a new sync point should be
+  // inserted.
+  platform_context_->InsertSyncPointForBackingMailbox();
+
   if (bound_to_instance_) {
     // If we are bound to the instance, we need to ask the compositor
     // to commit our backing texture so that the graphics appears on the page.
diff --git a/content/renderer/renderer_webcolorchooser_impl.h b/content/renderer/renderer_webcolorchooser_impl.h
index d753478..0fa608f 100644
--- a/content/renderer/renderer_webcolorchooser_impl.h
+++ b/content/renderer/renderer_webcolorchooser_impl.h
@@ -36,6 +36,11 @@
 
   blink::WebColorChooserClient* client() { return client_; }
 
+  // Don't destroy the RendererWebColorChooserImpl when the RenderViewImpl goes
+  // away. RendererWebColorChooserImpl is owned by
+  // blink::ColorChooserUIController.
+  virtual void OnDestruct() OVERRIDE {}
+
  private:
   // RenderViewObserver implementation.
   virtual bool OnMessageReceived(const IPC::Message& message) OVERRIDE;
diff --git a/gpu/command_buffer/service/query_manager.cc b/gpu/command_buffer/service/query_manager.cc
index 85e273c..db508e0 100644
--- a/gpu/command_buffer/service/query_manager.cc
+++ b/gpu/command_buffer/service/query_manager.cc
@@ -98,6 +98,9 @@
   mem_params.shm_size = buffer.size;
   mem_params.shm_data_offset = shm_offset();
   mem_params.shm_data_size = sizeof(QuerySync);
+  uint32 end = mem_params.shm_data_offset + mem_params.shm_data_size;
+  if (end > mem_params.shm_size || end < mem_params.shm_data_offset)
+    return false;
 
   observer_ = new AsyncPixelTransferCompletionObserverImpl(submit_count);
 
diff --git a/gpu/config/software_rendering_list_json.cc b/gpu/config/software_rendering_list_json.cc
index 9af3694..f1b737d 100644
--- a/gpu/config/software_rendering_list_json.cc
+++ b/gpu/config/software_rendering_list_json.cc
@@ -18,7 +18,7 @@
 {
   "name": "software rendering list",
   // Please update the version number whenever you change this file.
-  "version": "6.20",
+  "version": "6.21",
   "entries": [
     {
       "id": 1,
@@ -1020,7 +1020,20 @@
       "features": [
         "accelerated_video_decode"
       ]
+    },
+    {
+      "id": 92,
+      "description": "Accelerated video decode does not work with the discrete GPU on AMD switchables",
+      "cr_bugs": [298968],
+      "os": {
+        "type": "win"
+      },
+      "multi_gpu_style": "amd_switchable",
+      "features": [
+        "accelerated_video_decode"
+      ]
     }
+
   ]
 }
 
diff --git a/media/audio/win/waveout_output_win.cc b/media/audio/win/waveout_output_win.cc
index 47d4fa6..0f54817 100644
--- a/media/audio/win/waveout_output_win.cc
+++ b/media/audio/win/waveout_output_win.cc
@@ -248,39 +248,25 @@
   state_ = PCMA_STOPPING;
   base::subtle::MemoryBarrier();
 
-  // Stop watching for buffer event, wait till all the callbacks are complete.
-  // Should be done before ::waveOutReset() call to avoid race condition when
-  // callback that is currently active and already checked that stream is still
-  // being played calls ::waveOutWrite() after ::waveOutReset() returns, later
-  // causing ::waveOutClose() to fail with WAVERR_STILLPLAYING.
-  // TODO(enal): that delays actual stopping of playback. Alternative can be
-  //             to call ::waveOutReset() twice, once before
-  //             ::UnregisterWaitEx() and once after.
+  // Stop watching for buffer event, waits until outstanding callbacks finish.
   if (waiting_handle_) {
-    if (!::UnregisterWaitEx(waiting_handle_, INVALID_HANDLE_VALUE)) {
-      state_ = PCMA_PLAYING;
-      HandleError(MMSYSERR_ERROR);
-      return;
-    }
+    if (!::UnregisterWaitEx(waiting_handle_, INVALID_HANDLE_VALUE))
+      HandleError(::GetLastError());
     waiting_handle_ = NULL;
   }
 
   // Stop playback.
   MMRESULT res = ::waveOutReset(waveout_);
-  if (res != MMSYSERR_NOERROR) {
-    state_ = PCMA_PLAYING;
+  if (res != MMSYSERR_NOERROR)
     HandleError(res);
-    return;
-  }
 
   // Wait for lock to ensure all outstanding callbacks have completed.
   base::AutoLock auto_lock(lock_);
 
   // waveOutReset() leaves buffers in the unpredictable state, causing
   // problems if we want to close, release, or reuse them. Fix the states.
-  for (int ix = 0; ix != num_buffers_; ++ix) {
+  for (int ix = 0; ix != num_buffers_; ++ix)
     GetBuffer(ix)->dwFlags = WHDR_PREPARED;
-  }
 
   // Don't use callback after Stop().
   callback_ = NULL;
diff --git a/media/base/android/java/src/org/chromium/media/AudioManagerAndroid.java b/media/base/android/java/src/org/chromium/media/AudioManagerAndroid.java
index 9d26aad..5305861 100644
--- a/media/base/android/java/src/org/chromium/media/AudioManagerAndroid.java
+++ b/media/base/android/java/src/org/chromium/media/AudioManagerAndroid.java
@@ -171,12 +171,6 @@
         mSavedIsSpeakerphoneOn = mAudioManager.isSpeakerphoneOn();
         mSavedIsMicrophoneMute = mAudioManager.isMicrophoneMute();
 
-        // Always enable speaker phone by default. This state might be reset
-        // by the wired headset receiver when it gets its initial sticky
-        // intent, if any.
-        setSpeakerphoneOn(true);
-        mAudioDeviceState = STATE_SPEAKERPHONE_ON;
-
         // Initialize audio device list with things we know is always available.
         synchronized (mLock) {
             if (hasEarpiece()) {
diff --git a/net/base/net_error_list.h b/net/base/net_error_list.h
index 0585c3e..3416cd0 100644
--- a/net/base/net_error_list.h
+++ b/net/base/net_error_list.h
@@ -570,6 +570,9 @@
 // to read any requests sent, so they may be resent.
 NET_ERROR(QUIC_HANDSHAKE_FAILED, -358)
 
+// An https resource was requested over an insecure QUIC connection.
+NET_ERROR(REQUEST_FOR_SECURE_RESOURCE_OVER_INSECURE_QUIC, -359)
+
 // The cache does not have the requested entry.
 NET_ERROR(CACHE_MISS, -400)
 
diff --git a/net/quic/quic_http_stream.cc b/net/quic/quic_http_stream.cc
index 56dbbab..f8b2e65 100644
--- a/net/quic/quic_http_stream.cc
+++ b/net/quic/quic_http_stream.cc
@@ -58,6 +58,13 @@
     return was_handshake_confirmed_ ? ERR_CONNECTION_CLOSED :
         ERR_QUIC_HANDSHAKE_FAILED;
 
+  if (request_info->url.SchemeIsSecure()) {
+    SSLInfo ssl_info;
+    if (!session_->GetSSLInfo(&ssl_info) || !ssl_info.cert) {
+      return ERR_REQUEST_FOR_SECURE_RESOURCE_OVER_INSECURE_QUIC;
+    }
+  }
+
   stream_net_log_ = stream_net_log;
   request_info_ = request_info;
   priority_ = priority;
diff --git a/sandbox/win/sandbox_poc/main_ui_window.cc b/sandbox/win/sandbox_poc/main_ui_window.cc
index 243075c..1671424 100644
--- a/sandbox/win/sandbox_poc/main_ui_window.cc
+++ b/sandbox/win/sandbox_poc/main_ui_window.cc
@@ -1,4 +1,4 @@
-// Copyright (c) 2006-2010 The Chromium Authors. All rights reserved.
+// Copyright (c) 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
@@ -553,8 +553,9 @@
     if (INVALID_HANDLE_VALUE == pipe_handle_)
       AddDebugMessage(L"Failed to create pipe. Error %d", ::GetLastError());
 
-    if (!sandbox::AddKnownSidToKernelObject(pipe_handle_, WinWorldSid,
-                                            FILE_ALL_ACCESS))
+    if (!sandbox::AddKnownSidToObject(pipe_handle_, SE_KERNEL_OBJECT,
+                                      WinWorldSid, GRANT_ACCESS,
+                                      FILE_ALL_ACCESS))
       AddDebugMessage(L"Failed to set security on pipe. Error %d",
                       ::GetLastError());
 
diff --git a/sandbox/win/src/acl.cc b/sandbox/win/src/acl.cc
index 70d2a8d..bf59d96 100644
--- a/sandbox/win/src/acl.cc
+++ b/sandbox/win/src/acl.cc
@@ -36,10 +36,10 @@
   return true;
 }
 
-bool AddSidToDacl(const Sid& sid, ACL* old_dacl, ACCESS_MASK access,
-                  ACL** new_dacl) {
+bool AddSidToDacl(const Sid& sid, ACL* old_dacl, ACCESS_MODE access_mode,
+                  ACCESS_MASK access, ACL** new_dacl) {
   EXPLICIT_ACCESS new_access = {0};
-  new_access.grfAccessMode = GRANT_ACCESS;
+  new_access.grfAccessMode = access_mode;
   new_access.grfAccessPermissions = access;
   new_access.grfInheritance = NO_INHERITANCE;
 
@@ -64,7 +64,8 @@
     return false;
 
   ACL* new_dacl = NULL;
-  if (!AddSidToDacl(sid, default_dacl->DefaultDacl, access, &new_dacl))
+  if (!AddSidToDacl(sid, default_dacl->DefaultDacl, GRANT_ACCESS, access,
+                    &new_dacl))
     return false;
 
   TOKEN_DEFAULT_DACL new_token_dacl = {0};
@@ -90,23 +91,24 @@
                              access);
 }
 
-bool AddKnownSidToKernelObject(HANDLE object, const Sid& sid,
-                               ACCESS_MASK access) {
+bool AddKnownSidToObject(HANDLE object, SE_OBJECT_TYPE object_type,
+                         const Sid& sid, ACCESS_MODE access_mode,
+                         ACCESS_MASK access) {
   PSECURITY_DESCRIPTOR descriptor = NULL;
   PACL old_dacl = NULL;
   PACL new_dacl = NULL;
 
-  if (ERROR_SUCCESS != ::GetSecurityInfo(object, SE_KERNEL_OBJECT,
+  if (ERROR_SUCCESS != ::GetSecurityInfo(object, object_type,
                                          DACL_SECURITY_INFORMATION, NULL, NULL,
                                          &old_dacl, NULL, &descriptor))
     return false;
 
-  if (!AddSidToDacl(sid.GetPSID(), old_dacl, access, &new_dacl)) {
+  if (!AddSidToDacl(sid.GetPSID(), old_dacl, access_mode, access, &new_dacl)) {
     ::LocalFree(descriptor);
     return false;
   }
 
-  DWORD result = ::SetSecurityInfo(object, SE_KERNEL_OBJECT,
+  DWORD result = ::SetSecurityInfo(object, object_type,
                                    DACL_SECURITY_INFORMATION, NULL, NULL,
                                    new_dacl, NULL);
 
diff --git a/sandbox/win/src/acl.h b/sandbox/win/src/acl.h
index 25d5cdb..531259f 100644
--- a/sandbox/win/src/acl.h
+++ b/sandbox/win/src/acl.h
@@ -5,6 +5,7 @@
 #ifndef SANDBOX_SRC_ACL_H_
 #define SANDBOX_SRC_ACL_H_
 
+#include <AccCtrl.h>
 #include <windows.h>
 
 #include "base/memory/scoped_ptr.h"
@@ -16,11 +17,11 @@
 bool GetDefaultDacl(HANDLE token,
                     scoped_ptr_malloc<TOKEN_DEFAULT_DACL>* default_dacl);
 
-// Appends an ACE represented by |sid| and |access| to |old_dacl|. If the
-// function succeeds, new_dacl contains the new dacl and must be freed using
-// LocalFree.
-bool AddSidToDacl(const Sid& sid, ACL* old_dacl, ACCESS_MASK access,
-                  ACL** new_dacl);
+// Appends an ACE represented by |sid|, |access_mode|, and |access| to
+// |old_dacl|. If the function succeeds, new_dacl contains the new dacl and
+// must be freed using LocalFree.
+bool AddSidToDacl(const Sid& sid, ACL* old_dacl, ACCESS_MODE access_mode,
+                  ACCESS_MASK access, ACL** new_dacl);
 
 // Adds and ACE represented by |sid| and |access| to the default dacl present
 // in the token.
@@ -30,10 +31,11 @@
 // present in the token.
 bool AddUserSidToDefaultDacl(HANDLE token, ACCESS_MASK access);
 
-// Adds an ACE represented by |known_sid| and |access| to the dacl of the kernel
-// object referenced by |object|.
-bool AddKnownSidToKernelObject(HANDLE object, const Sid& sid,
-                               ACCESS_MASK access);
+// Adds an ACE represented by |known_sid|, |access_mode|, and |access| to
+// the dacl of the kernel object referenced by |object| and of |object_type|.
+bool AddKnownSidToObject(HANDLE object, SE_OBJECT_TYPE object_type,
+                         const Sid& sid, ACCESS_MODE access_mode,
+                         ACCESS_MASK access);
 
 }  // namespace sandbox
 
diff --git a/sandbox/win/src/crosscall_params.h b/sandbox/win/src/crosscall_params.h
index c5298ba..cc82c16 100644
--- a/sandbox/win/src/crosscall_params.h
+++ b/sandbox/win/src/crosscall_params.h
@@ -235,7 +235,8 @@
       return false;
     }
 
-    if (param_info_[index].offset_ > sizeof(*this)) {
+    if ((size > sizeof(*this)) ||
+        (param_info_[index].offset_ > (sizeof(*this) - size))) {
       // It does not fit, abort copy.
       return false;
     }
diff --git a/sandbox/win/src/window.cc b/sandbox/win/src/window.cc
index d21858a..6b5766b 100644
--- a/sandbox/win/src/window.cc
+++ b/sandbox/win/src/window.cc
@@ -8,6 +8,8 @@
 
 #include "base/logging.h"
 #include "base/memory/scoped_ptr.h"
+#include "sandbox/win/src/acl.h"
+#include "sandbox/win/src/sid.h"
 
 namespace {
 
@@ -46,8 +48,9 @@
   *winsta = ::CreateWindowStationW(NULL, 0, WINSTA_ALL_ACCESS, &attributes);
   LocalFree(attributes.lpSecurityDescriptor);
 
-  if (*winsta)
+  if (*winsta) {
     return SBOX_ALL_OK;
+  }
 
   return SBOX_ERROR_CANNOT_CREATE_WINSTATION;
 }
@@ -94,8 +97,18 @@
     }
   }
 
-  if (*desktop)
+  if (*desktop) {
+    // Replace the DACL on the new Desktop with a reduced privilege version.
+    // We can soft fail on this for now, as it's just an extra mitigation.
+    static const ACCESS_MASK  kDesktopDenyMask = WRITE_DAC | WRITE_OWNER |
+                                                 DESKTOP_HOOKCONTROL |
+                                                 DESKTOP_JOURNALPLAYBACK |
+                                                 DESKTOP_JOURNALRECORD |
+                                                 DESKTOP_SWITCHDESKTOP;
+    AddKnownSidToObject(*desktop, SE_WINDOW_OBJECT, Sid(WinRestrictedCodeSid),
+                        DENY_ACCESS, kDesktopDenyMask);
     return SBOX_ALL_OK;
+  }
 
   return SBOX_ERROR_CANNOT_CREATE_DESKTOP;
 }
diff --git a/sandbox/win/tests/validation_tests/commands.cc b/sandbox/win/tests/validation_tests/commands.cc
index eefc498..e7620c3 100644
--- a/sandbox/win/tests/validation_tests/commands.cc
+++ b/sandbox/win/tests/validation_tests/commands.cc
@@ -2,6 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+#include <Aclapi.h>
 #include <windows.h>
 #include <string>
 
@@ -240,11 +241,62 @@
 }
 
 int TestSwitchDesktop() {
-  HDESK sbox_desk = ::GetThreadDesktop(::GetCurrentThreadId());
-  if (NULL == sbox_desk) {
+  HDESK desktop = ::GetThreadDesktop(::GetCurrentThreadId());
+  if (NULL == desktop) {
     return SBOX_TEST_FAILED;
   }
-  if (::SwitchDesktop(sbox_desk)) {
+  if (::SwitchDesktop(desktop)) {
+    return SBOX_TEST_SUCCEEDED;
+  }
+  return SBOX_TEST_DENIED;
+}
+
+SBOX_TESTS_COMMAND int OpenAlternateDesktop(int, wchar_t **argv) {
+  return TestOpenAlternateDesktop(argv[0]);
+}
+
+int TestOpenAlternateDesktop(wchar_t *desktop_name) {
+  // Test for WRITE_DAC permission on the handle.
+  HDESK desktop = ::GetThreadDesktop(::GetCurrentThreadId());
+  if (desktop) {
+    HANDLE test_handle;
+    if (::DuplicateHandle(::GetCurrentProcess(), desktop,
+                          ::GetCurrentProcess(), &test_handle,
+                          WRITE_DAC, FALSE, 0)) {
+      DWORD result = ::SetSecurityInfo(test_handle, SE_WINDOW_OBJECT,
+                                       DACL_SECURITY_INFORMATION, NULL, NULL,
+                                       NULL, NULL);
+      ::CloseHandle(test_handle);
+      if (result != ERROR_ACCESS_DENIED) {
+        return SBOX_TEST_SUCCEEDED;
+      }
+    } else if (::GetLastError() != ERROR_ACCESS_DENIED) {
+      return SBOX_TEST_FAILED;
+    }
+  }
+
+  // Open by name with WRITE_DAC.
+  if ((desktop = ::OpenDesktop(desktop_name, 0, FALSE, WRITE_DAC)) ||
+      ::GetLastError() != ERROR_ACCESS_DENIED) {
+    ::CloseDesktop(desktop);
+    return SBOX_TEST_SUCCEEDED;
+  }
+
+  return SBOX_TEST_DENIED;
+}
+
+BOOL CALLBACK DesktopTestEnumProc(LPTSTR desktop_name, LPARAM result) {
+  return TRUE;
+}
+
+SBOX_TESTS_COMMAND int EnumAlternateWinsta(int, wchar_t **) {
+  return TestEnumAlternateWinsta();
+}
+
+int TestEnumAlternateWinsta() {
+  int result = SBOX_TEST_DENIED;
+  // Try to enumerate the destops on the alternate windowstation.
+  if (::EnumDesktopsW(NULL, DesktopTestEnumProc, 0)) {
     return SBOX_TEST_SUCCEEDED;
   }
   return SBOX_TEST_DENIED;
diff --git a/sandbox/win/tests/validation_tests/commands.h b/sandbox/win/tests/validation_tests/commands.h
index 3a6a0f5..f9b6199 100644
--- a/sandbox/win/tests/validation_tests/commands.h
+++ b/sandbox/win/tests/validation_tests/commands.h
@@ -36,6 +36,13 @@
 // Tries to switch the interactive desktop. Returns a SboxTestResult.
 int TestSwitchDesktop();
 
+// Tries to open the alternate desktop. Returns a SboxTestResult.
+int TestOpenAlternateDesktop(wchar_t *desktop_name);
+
+// Tries to enumerate desktops on the alternate windowstation.
+// Returns a SboxTestResult.
+int TestEnumAlternateWinsta();
+
 }  // namespace sandbox
 
 #endif  // SANDBOX_TESTS_VALIDATION_TESTS_COMMANDS_H__
diff --git a/sandbox/win/tests/validation_tests/suite.cc b/sandbox/win/tests/validation_tests/suite.cc
index 95209b7..f85b8da 100644
--- a/sandbox/win/tests/validation_tests/suite.cc
+++ b/sandbox/win/tests/validation_tests/suite.cc
@@ -111,11 +111,31 @@
 // to get to the interactive desktop or to make the sbox desktop interactive.
 TEST(ValidationSuite, TestDesktop) {
   TestRunner runner;
-  runner.GetPolicy()->SetAlternateDesktop(false);
+  runner.GetPolicy()->SetAlternateDesktop(true);
   EXPECT_EQ(SBOX_TEST_DENIED, runner.RunTest(L"OpenInteractiveDesktop NULL"));
   EXPECT_EQ(SBOX_TEST_DENIED, runner.RunTest(L"SwitchToSboxDesktop NULL"));
 }
 
+// Tests that the permissions on the Windowstation does not allow the sandbox
+// to get to the interactive desktop or to make the sbox desktop interactive.
+TEST(ValidationSuite, TestAlternateDesktop) {
+  base::win::Version version = base::win::GetVersion();
+  if (version < base::win::VERSION_WIN7)
+    return;
+
+  TestRunner runner;
+  EXPECT_EQ(SBOX_TEST_DENIED, runner.RunTest(L"EnumAlternateWinsta NULL"));
+
+  wchar_t command[1024] = {0};
+  runner.SetTimeout(3600000);
+  runner.GetPolicy()->SetAlternateDesktop(true);
+  runner.GetPolicy()->SetDelayedIntegrityLevel(INTEGRITY_LEVEL_UNTRUSTED);
+  base::string16 desktop_name = runner.GetPolicy()->GetAlternateDesktop();
+  desktop_name = desktop_name.substr(desktop_name.find('\\') + 1);
+  wsprintf(command, L"OpenAlternateDesktop %lS", desktop_name.c_str());
+  EXPECT_EQ(SBOX_TEST_DENIED, runner.RunTest(command));
+}
+
 // Tests if the windows are correctly protected by the sandbox.
 TEST(ValidationSuite, TestWindows) {
   TestRunner runner;
diff --git a/tools/metrics/histograms/histograms.xml b/tools/metrics/histograms/histograms.xml
index b3d1054..d4fc0ca 100644
--- a/tools/metrics/histograms/histograms.xml
+++ b/tools/metrics/histograms/histograms.xml
@@ -5493,6 +5493,21 @@
   <summary>Events in Google Now component extension.</summary>
 </histogram>
 
+<histogram name="GoogleUpdate.EffectivePolicy" enum="UpdatePolicy">
+  <summary>
+    The effective update policy for Chrome on Windows. Recorded once per startup
+    (following a 45 seconds delay).
+  </summary>
+</histogram>
+
+<histogram name="GoogleUpdate.UpdatePolicyIsOverridden" enum="Boolean">
+  <summary>
+    True if the effective update policy for Chrome on Windows is the result of
+    an app-specific override; false if it is the default for all apps. Recorded
+    once per startup (following a 45 seconds delay).
+  </summary>
+</histogram>
+
 <histogram name="GPU.AcceleratedSurfaceRefreshRate" units="hz">
   <summary>
     Refresh rate of the display in Hz.  This is recorded every time we present a
@@ -30797,6 +30812,13 @@
   <int value="2" label="Forced Full"/>
 </enum>
 
+<enum name="UpdatePolicy" type="int">
+  <int value="0" label="UPDATES_DISABLED"/>
+  <int value="1" label="AUTOMATIC_UPDATES"/>
+  <int value="2" label="MANUAL_UPDATES_ONLY"/>
+  <int value="3" label="AUTO_UPDATES_ONLY"/>
+</enum>
+
 <enum name="UrlResolutionResult" type="int">
   <int value="0" label="Absolute URL"/>
   <int value="1" label="Resolutions Differ"/>