diff --git a/chrome/browser/devtools/device/usb/android_usb_socket.cc b/chrome/browser/devtools/device/usb/android_usb_socket.cc
index a81b37ed..f23b7d7 100644
--- a/chrome/browser/devtools/device/usb/android_usb_socket.cc
+++ b/chrome/browser/devtools/device/usb/android_usb_socket.cc
@@ -12,6 +12,7 @@
 #include "net/base/io_buffer.h"
 #include "net/base/ip_address.h"
 #include "net/base/net_errors.h"
+#include "net/traffic_annotation/network_traffic_annotation.h"
 
 namespace {
 
@@ -133,9 +134,11 @@
   return bytes_to_copy;
 }
 
-int AndroidUsbSocket::Write(net::IOBuffer* buffer,
-                            int length,
-                            const net::CompletionCallback& callback) {
+int AndroidUsbSocket::Write(
+    net::IOBuffer* buffer,
+    int length,
+    const net::CompletionCallback& callback,
+    const net::NetworkTrafficAnnotationTag& /*traffic_annotation*/) {
   DCHECK(!callback.is_null());
   if (!is_connected_)
     return net::ERR_SOCKET_NOT_CONNECTED;
diff --git a/chrome/browser/devtools/device/usb/android_usb_socket.h b/chrome/browser/devtools/device/usb/android_usb_socket.h
index a974168d7..9eb8e12 100644
--- a/chrome/browser/devtools/device/usb/android_usb_socket.h
+++ b/chrome/browser/devtools/device/usb/android_usb_socket.h
@@ -17,6 +17,7 @@
 #include "net/base/ip_endpoint.h"
 #include "net/log/net_log_with_source.h"
 #include "net/socket/stream_socket.h"
+#include "net/traffic_annotation/network_traffic_annotation.h"
 
 class AndroidUsbSocket : public net::StreamSocket {
  public:
@@ -34,9 +35,12 @@
   int Read(net::IOBuffer* buf,
            int buf_len,
            const net::CompletionCallback& callback) override;
+  // TODO(crbug.com/656607): Remove default value.
   int Write(net::IOBuffer* buf,
             int buf_len,
-            const net::CompletionCallback& callback) override;
+            const net::CompletionCallback& callback,
+            const net::NetworkTrafficAnnotationTag& traffic_annotation =
+                NO_TRAFFIC_ANNOTATION_BUG_656607) override;
   int SetReceiveBufferSize(int32_t size) override;
   int SetSendBufferSize(int32_t size) override;
   int Connect(const net::CompletionCallback& callback) override;
diff --git a/chrome/browser/extensions/api/socket/mock_tcp_client_socket.h b/chrome/browser/extensions/api/socket/mock_tcp_client_socket.h
index 0db73de..9dd6af5 100644
--- a/chrome/browser/extensions/api/socket/mock_tcp_client_socket.h
+++ b/chrome/browser/extensions/api/socket/mock_tcp_client_socket.h
@@ -8,6 +8,7 @@
 #include "net/log/net_log_source.h"
 #include "net/log/net_log_with_source.h"
 #include "net/socket/tcp_client_socket.h"
+#include "net/traffic_annotation/network_traffic_annotation_test_helper.h"
 #include "testing/gmock/include/gmock/gmock.h"
 
 namespace extensions {
@@ -18,7 +19,11 @@
   virtual ~MockTCPClientSocket();
 
   MOCK_METHOD3(Read, int(net::IOBuffer*, int, const net::CompletionCallback&));
-  MOCK_METHOD3(Write, int(net::IOBuffer*, int, const net::CompletionCallback&));
+  MOCK_METHOD4(Write,
+               int(net::IOBuffer*,
+                   int,
+                   const net::CompletionCallback&,
+                   const net::NetworkTrafficAnnotationTag&));
   MOCK_METHOD1(SetReceiveBufferSize, int(int32_t));
   MOCK_METHOD1(SetSendBufferSize, int(int32_t));
   MOCK_METHOD1(Connect, int(const net::CompletionCallback&));
diff --git a/chrome/browser/extensions/api/socket/tcp_socket_unittest.cc b/chrome/browser/extensions/api/socket/tcp_socket_unittest.cc
index ac8a6fda..902970d 100644
--- a/chrome/browser/extensions/api/socket/tcp_socket_unittest.cc
+++ b/chrome/browser/extensions/api/socket/tcp_socket_unittest.cc
@@ -14,6 +14,7 @@
 #include "net/log/net_log_source.h"
 #include "net/socket/tcp_client_socket.h"
 #include "net/socket/tcp_server_socket.h"
+#include "net/traffic_annotation/network_traffic_annotation.h"
 #include "testing/gmock/include/gmock/gmock.h"
 
 using testing::_;
@@ -30,8 +31,11 @@
 
   MOCK_METHOD3(Read, int(net::IOBuffer* buf, int buf_len,
                          const net::CompletionCallback& callback));
-  MOCK_METHOD3(Write, int(net::IOBuffer* buf, int buf_len,
-                          const net::CompletionCallback& callback));
+  MOCK_METHOD4(Write,
+               int(net::IOBuffer* buf,
+                   int buf_len,
+                   const net::CompletionCallback& callback,
+                   const net::NetworkTrafficAnnotationTag&));
   MOCK_METHOD2(SetKeepAlive, bool(bool enable, int delay));
   MOCK_METHOD1(SetNoDelay, bool(bool no_delay));
   bool IsConnected() const override {
@@ -100,10 +104,9 @@
   CompleteHandler handler;
 
   net::CompletionCallback callback;
-  EXPECT_CALL(*tcp_client_socket, Write(_, _, _))
+  EXPECT_CALL(*tcp_client_socket, Write(_, _, _, _))
       .Times(2)
-      .WillRepeatedly(testing::DoAll(SaveArg<2>(&callback),
-                                     Return(128)));
+      .WillRepeatedly(testing::DoAll(SaveArg<2>(&callback), Return(128)));
   EXPECT_CALL(handler, OnComplete(_))
       .Times(1);
 
@@ -123,10 +126,10 @@
   CompleteHandler handler;
 
   net::CompletionCallback callback;
-  EXPECT_CALL(*tcp_client_socket, Write(_, _, _))
+  EXPECT_CALL(*tcp_client_socket, Write(_, _, _, _))
       .Times(2)
-      .WillRepeatedly(testing::DoAll(SaveArg<2>(&callback),
-                                     Return(net::ERR_IO_PENDING)));
+      .WillRepeatedly(
+          testing::DoAll(SaveArg<2>(&callback), Return(net::ERR_IO_PENDING)));
 
   std::unique_ptr<TCPSocket> socket(TCPSocket::CreateSocketForTesting(
       std::move(tcp_client_socket), FAKE_ID, true));
@@ -150,10 +153,10 @@
   CompleteHandler handlers[5];
 
   net::CompletionCallback callback;
-  EXPECT_CALL(*tcp_client_socket, Write(_, _, _))
+  EXPECT_CALL(*tcp_client_socket, Write(_, _, _, _))
       .Times(5)
-      .WillRepeatedly(testing::DoAll(SaveArg<2>(&callback),
-                                     Return(net::ERR_IO_PENDING)));
+      .WillRepeatedly(
+          testing::DoAll(SaveArg<2>(&callback), Return(net::ERR_IO_PENDING)));
 
   std::unique_ptr<TCPSocket> socket(TCPSocket::CreateSocketForTesting(
       std::move(tcp_client_socket), FAKE_ID, true));
diff --git a/chrome/browser/extensions/api/socket/tls_socket_unittest.cc b/chrome/browser/extensions/api/socket/tls_socket_unittest.cc
index e882c99a..d9d61c6 100644
--- a/chrome/browser/extensions/api/socket/tls_socket_unittest.cc
+++ b/chrome/browser/extensions/api/socket/tls_socket_unittest.cc
@@ -22,6 +22,7 @@
 #include "net/socket/next_proto.h"
 #include "net/socket/ssl_client_socket.h"
 #include "net/socket/tcp_client_socket.h"
+#include "net/traffic_annotation/network_traffic_annotation.h"
 #include "testing/gmock/include/gmock/gmock.h"
 
 using testing::_;
@@ -43,10 +44,11 @@
                int(net::IOBuffer* buf,
                    int buf_len,
                    const net::CompletionCallback& callback));
-  MOCK_METHOD3(Write,
+  MOCK_METHOD4(Write,
                int(net::IOBuffer* buf,
                    int buf_len,
-                   const net::CompletionCallback& callback));
+                   const net::CompletionCallback& callback,
+                   const net::NetworkTrafficAnnotationTag&));
   MOCK_METHOD1(SetReceiveBufferSize, int(int32_t));
   MOCK_METHOD1(SetSendBufferSize, int(int32_t));
   MOCK_METHOD1(Connect, int(const CompletionCallback&));
@@ -95,10 +97,11 @@
                int(net::IOBuffer* buf,
                    int buf_len,
                    const net::CompletionCallback& callback));
-  MOCK_METHOD3(Write,
+  MOCK_METHOD4(Write,
                int(net::IOBuffer* buf,
                    int buf_len,
-                   const net::CompletionCallback& callback));
+                   const net::CompletionCallback& callback,
+                   const net::NetworkTrafficAnnotationTag&));
   MOCK_METHOD2(SetKeepAlive, bool(bool enable, int delay));
   MOCK_METHOD1(SetNoDelay, bool(bool no_delay));
 
@@ -167,8 +170,9 @@
   CompleteHandler handler;
   net::CompletionCallback callback;
 
-  EXPECT_CALL(*ssl_socket_, Write(_, _, _)).Times(2).WillRepeatedly(
-      DoAll(SaveArg<2>(&callback), Return(128)));
+  EXPECT_CALL(*ssl_socket_, Write(_, _, _, _))
+      .Times(2)
+      .WillRepeatedly(DoAll(SaveArg<2>(&callback), Return(128)));
   EXPECT_CALL(handler, OnComplete(_)).Times(1);
 
   scoped_refptr<net::IOBufferWithSize> io_buffer(
@@ -187,8 +191,10 @@
 
   // Return ERR_IO_PENDING to say the Write()'s blocked. Save the |callback|
   // Write()'s passed.
-  EXPECT_CALL(*ssl_socket_, Write(_, _, _)).Times(2).WillRepeatedly(
-      DoAll(SaveArg<2>(&callback), Return(net::ERR_IO_PENDING)));
+  EXPECT_CALL(*ssl_socket_, Write(_, _, _, _))
+      .Times(2)
+      .WillRepeatedly(
+          DoAll(SaveArg<2>(&callback), Return(net::ERR_IO_PENDING)));
 
   scoped_refptr<net::IOBufferWithSize> io_buffer(new net::IOBufferWithSize(42));
   socket_->Write(
@@ -218,8 +224,10 @@
   // will all be equivalent), and return ERR_IO_PENDING, to indicate a blocked
   // request. The mocked SSLClientSocket::Write() will get one request per
   // TLSSocket::Write() request invoked on |socket_| below.
-  EXPECT_CALL(*ssl_socket_, Write(_, _, _)).Times(kNumIOs).WillRepeatedly(
-      DoAll(SaveArg<2>(&callback), Return(net::ERR_IO_PENDING)));
+  EXPECT_CALL(*ssl_socket_, Write(_, _, _, _))
+      .Times(kNumIOs)
+      .WillRepeatedly(
+          DoAll(SaveArg<2>(&callback), Return(net::ERR_IO_PENDING)));
 
   // Send out |kNuMIOs| requests, each with a different size.
   for (int i = 0; i < kNumIOs; i++) {
@@ -282,9 +290,10 @@
   // from Socket::Write(). If the callback is invoked with a smaller number,
   // Socket::WriteImpl() will get repeatedly invoked until the sum of the
   // callbacks' arguments is equal to the original requested amount.
-  EXPECT_CALL(*ssl_socket_, Write(_, _, _)).WillRepeatedly(
-      DoAll(WithArgs<2, 1>(Invoke(&pending_callbacks, &CallbackList::append)),
-            Return(net::ERR_IO_PENDING)));
+  EXPECT_CALL(*ssl_socket_, Write(_, _, _, _))
+      .WillRepeatedly(DoAll(
+          WithArgs<2, 1>(Invoke(&pending_callbacks, &CallbackList::append)),
+          Return(net::ERR_IO_PENDING)));
 
   // Observe what comes back from Socket::Write() here.
   EXPECT_CALL(handler, OnComplete(Gt(0))).Times(kNumIncrements);
diff --git a/chromecast/net/fake_stream_socket.cc b/chromecast/net/fake_stream_socket.cc
index c1b3b7d..b459194 100644
--- a/chromecast/net/fake_stream_socket.cc
+++ b/chromecast/net/fake_stream_socket.cc
@@ -14,6 +14,7 @@
 #include "net/base/io_buffer.h"
 #include "net/base/net_errors.h"
 #include "net/socket/next_proto.h"
+#include "net/traffic_annotation/network_traffic_annotation.h"
 
 namespace chromecast {
 
@@ -96,9 +97,11 @@
   return buffer_->Read(buf->data(), buf_len, callback);
 }
 
-int FakeStreamSocket::Write(net::IOBuffer* buf,
-                            int buf_len,
-                            const net::CompletionCallback& /* callback */) {
+int FakeStreamSocket::Write(
+    net::IOBuffer* buf,
+    int buf_len,
+    const net::CompletionCallback& /* callback */,
+    const net::NetworkTrafficAnnotationTag& /*traffic_annotation*/) {
   DCHECK(buf);
   if (!peer_) {
     return net::ERR_SOCKET_NOT_CONNECTED;
diff --git a/chromecast/net/fake_stream_socket.h b/chromecast/net/fake_stream_socket.h
index b934d4d..2f1eee6 100644
--- a/chromecast/net/fake_stream_socket.h
+++ b/chromecast/net/fake_stream_socket.h
@@ -13,6 +13,7 @@
 #include "net/base/ip_endpoint.h"
 #include "net/log/net_log_with_source.h"
 #include "net/socket/stream_socket.h"
+#include "net/traffic_annotation/network_traffic_annotation.h"
 
 namespace chromecast {
 class SocketBuffer;
@@ -30,9 +31,12 @@
   int Read(net::IOBuffer* buf,
            int buf_len,
            const net::CompletionCallback& callback) override;
+  // TODO(crbug.com/656607): Remove default value.
   int Write(net::IOBuffer* buf,
             int buf_len,
-            const net::CompletionCallback& callback) override;
+            const net::CompletionCallback& callback,
+            const net::NetworkTrafficAnnotationTag& traffic_annotation =
+                NO_TRAFFIC_ANNOTATION_BUG_656607) override;
   int SetReceiveBufferSize(int32_t size) override;
   int SetSendBufferSize(int32_t size) override;
   int Connect(const net::CompletionCallback& callback) override;
diff --git a/chromecast/net/mock_stream_socket.cc b/chromecast/net/mock_stream_socket.cc
index 638839a..3b9aea3f 100644
--- a/chromecast/net/mock_stream_socket.cc
+++ b/chromecast/net/mock_stream_socket.cc
@@ -7,6 +7,7 @@
 #include "net/base/io_buffer.h"
 #include "net/base/net_errors.h"
 #include "net/socket/next_proto.h"
+#include "net/traffic_annotation/network_traffic_annotation.h"
 
 using ::testing::Invoke;
 using ::testing::Return;
@@ -18,10 +19,13 @@
 MockStreamSocket::MockStreamSocket() {
   // Set default return values.
   ON_CALL(*this, Read(_, _, _)).WillByDefault(Return(net::ERR_IO_PENDING));
-  ON_CALL(*this, Write(_, _, _))
+  ON_CALL(*this, Write(_, _, _, _))
       .WillByDefault(Invoke(
           [](net::IOBuffer* buf, int buf_len,
-             const net::CompletionCallback& callback) { return buf_len; }));
+             const net::CompletionCallback& callback,
+             const net::NetworkTrafficAnnotationTag& traffic_annotation) {
+            return buf_len;
+          }));
   ON_CALL(*this, NetLog()).WillByDefault(ReturnRef(net_log_));
   ON_CALL(*this, GetNegotiatedProtocol())
       .WillByDefault(Return(net::NextProto()));
diff --git a/chromecast/net/mock_stream_socket.h b/chromecast/net/mock_stream_socket.h
index 945ba3e5..3349dfb 100644
--- a/chromecast/net/mock_stream_socket.h
+++ b/chromecast/net/mock_stream_socket.h
@@ -10,6 +10,7 @@
 #include "base/macros.h"
 #include "net/log/net_log_with_source.h"
 #include "net/socket/stream_socket.h"
+#include "net/traffic_annotation/network_traffic_annotation.h"
 #include "testing/gmock/include/gmock/gmock.h"
 
 namespace chromecast {
@@ -20,7 +21,11 @@
   MockStreamSocket();
   ~MockStreamSocket() override;
   MOCK_METHOD3(Read, int(net::IOBuffer*, int, const net::CompletionCallback&));
-  MOCK_METHOD3(Write, int(net::IOBuffer*, int, const net::CompletionCallback&));
+  MOCK_METHOD4(Write,
+               int(net::IOBuffer*,
+                   int,
+                   const net::CompletionCallback&,
+                   const net::NetworkTrafficAnnotationTag&));
   MOCK_METHOD1(SetReceiveBufferSize, int(int32_t));
   MOCK_METHOD1(SetSendBufferSize, int(int32_t));
   MOCK_METHOD1(Connect, int(const net::CompletionCallback&));
diff --git a/components/autofill/core/browser/DEPS b/components/autofill/core/browser/DEPS
index 8267592..ebd3a7e 100644
--- a/components/autofill/core/browser/DEPS
+++ b/components/autofill/core/browser/DEPS
@@ -7,7 +7,6 @@
   "+components/policy",
   "+components/security_state",
   "+components/signin/core/browser",
-  "+components/signin/core/common",
   "+components/sync",
   "+components/variations",
   "+components/version_info",
diff --git a/components/cast_channel/cast_socket_unittest.cc b/components/cast_channel/cast_socket_unittest.cc
index b4f2adbfa..ae543df 100644
--- a/components/cast_channel/cast_socket_unittest.cc
+++ b/components/cast_channel/cast_socket_unittest.cc
@@ -149,7 +149,11 @@
   }
 
   MOCK_METHOD3(Read, int(net::IOBuffer*, int, const net::CompletionCallback&));
-  MOCK_METHOD3(Write, int(net::IOBuffer*, int, const net::CompletionCallback&));
+  MOCK_METHOD4(Write,
+               int(net::IOBuffer*,
+                   int,
+                   const net::CompletionCallback&,
+                   const net::NetworkTrafficAnnotationTag&));
 
   virtual void Disconnect() {
     // Do nothing in tests
diff --git a/components/cast_channel/cast_transport_unittest.cc b/components/cast_channel/cast_transport_unittest.cc
index 9744323c..919a1bb 100644
--- a/components/cast_channel/cast_transport_unittest.cc
+++ b/components/cast_channel/cast_transport_unittest.cc
@@ -22,6 +22,7 @@
 #include "net/base/net_errors.h"
 #include "net/log/test_net_log.h"
 #include "net/socket/socket.h"
+#include "net/traffic_annotation/network_traffic_annotation.h"
 #include "testing/gmock/include/gmock/gmock.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
@@ -125,10 +126,11 @@
                    int buf_len,
                    const net::CompletionCallback& callback));
 
-  MOCK_METHOD3(Write,
+  MOCK_METHOD4(Write,
                int(net::IOBuffer* buf,
                    int buf_len,
-                   const net::CompletionCallback& callback));
+                   const net::CompletionCallback& callback,
+                   const net::NetworkTrafficAnnotationTag&));
 
   virtual int SetReceiveBufferSize(int32_t size) {
     NOTREACHED();
@@ -176,7 +178,7 @@
   std::string serialized_message;
   EXPECT_TRUE(MessageFramer::Serialize(message, &serialized_message));
 
-  EXPECT_CALL(mock_socket_, Write(NotNull(), serialized_message.size(), _))
+  EXPECT_CALL(mock_socket_, Write(NotNull(), serialized_message.size(), _, _))
       .WillOnce(DoAll(ReadBufferToString<0, 1>(&output),
                       EnqueueCallback<2>(&socket_cbs),
                       Return(net::ERR_IO_PENDING)));
@@ -201,15 +203,16 @@
   EXPECT_TRUE(MessageFramer::Serialize(message, &serialized_message));
 
   // Only one byte is written.
-  EXPECT_CALL(mock_socket_,
-              Write(NotNull(), static_cast<int>(serialized_message.size()), _))
+  EXPECT_CALL(
+      mock_socket_,
+      Write(NotNull(), static_cast<int>(serialized_message.size()), _, _))
       .WillOnce(DoAll(ReadBufferToString<0, 1>(&output),
                       EnqueueCallback<2>(&socket_cbs),
                       Return(net::ERR_IO_PENDING)));
   // Remainder of bytes are written.
   EXPECT_CALL(
       mock_socket_,
-      Write(NotNull(), static_cast<int>(serialized_message.size() - 1), _))
+      Write(NotNull(), static_cast<int>(serialized_message.size() - 1), _, _))
       .WillOnce(DoAll(ReadBufferToString<0, 1>(&output),
                       EnqueueCallback<2>(&socket_cbs),
                       Return(net::ERR_IO_PENDING)));
@@ -233,7 +236,7 @@
   CompletionQueue socket_cbs;
   CompleteHandler write_handler;
   CastMessage message = CreateCastMessage();
-  EXPECT_CALL(mock_socket_, Write(NotNull(), _, _))
+  EXPECT_CALL(mock_socket_, Write(NotNull(), _, _, _))
       .WillOnce(
           DoAll(EnqueueCallback<2>(&socket_cbs), Return(net::ERR_IO_PENDING)));
   EXPECT_CALL(write_handler, Complete(net::ERR_FAILED));
@@ -258,7 +261,7 @@
   CastMessage message = CreateCastMessage();
   std::string serialized_message;
   EXPECT_TRUE(MessageFramer::Serialize(message, &serialized_message));
-  EXPECT_CALL(mock_socket_, Write(NotNull(), serialized_message.size(), _))
+  EXPECT_CALL(mock_socket_, Write(NotNull(), serialized_message.size(), _, _))
       .WillOnce(DoAll(ReadBufferToString<0, 1>(&output),
                       Return(serialized_message.size())));
   EXPECT_CALL(write_handler, Complete(net::OK));
@@ -279,10 +282,11 @@
   EXPECT_TRUE(MessageFramer::Serialize(message, &serialized_message));
 
   // Only one byte is written.
-  EXPECT_CALL(mock_socket_, Write(NotNull(), serialized_message.size(), _))
+  EXPECT_CALL(mock_socket_, Write(NotNull(), serialized_message.size(), _, _))
       .WillOnce(DoAll(ReadBufferToString<0, 1>(&output), Return(1)));
   // Remainder of bytes are written.
-  EXPECT_CALL(mock_socket_, Write(NotNull(), serialized_message.size() - 1, _))
+  EXPECT_CALL(mock_socket_,
+              Write(NotNull(), serialized_message.size() - 1, _, _))
       .WillOnce(DoAll(ReadBufferToString<0, 1>(&output),
                       Return(serialized_message.size() - 1)));
 
@@ -298,7 +302,7 @@
 TEST_F(CastTransportTest, TestWriteFailureSync) {
   CompleteHandler write_handler;
   CastMessage message = CreateCastMessage();
-  EXPECT_CALL(mock_socket_, Write(NotNull(), _, _))
+  EXPECT_CALL(mock_socket_, Write(NotNull(), _, _, _))
       .WillOnce(Return(net::ERR_CONNECTION_RESET));
   EXPECT_CALL(write_handler, Complete(net::ERR_FAILED));
   transport_->SendMessage(
diff --git a/components/nacl/zygote/nacl_fork_delegate_linux.cc b/components/nacl/zygote/nacl_fork_delegate_linux.cc
index 04b92f1..802af96 100644
--- a/components/nacl/zygote/nacl_fork_delegate_linux.cc
+++ b/components/nacl/zygote/nacl_fork_delegate_linux.cc
@@ -27,7 +27,6 @@
 #include "base/process/kill.h"
 #include "base/process/launch.h"
 #include "base/strings/string_split.h"
-#include "base/third_party/dynamic_annotations/dynamic_annotations.h"
 #include "build/build_config.h"
 #include "components/nacl/common/nacl_nonsfi_util.h"
 #include "components/nacl/common/nacl_paths.h"
@@ -210,8 +209,6 @@
              !PathService::Get(nacl::FILE_NACL_HELPER_BOOTSTRAP,
                                &helper_bootstrap_exe)) {
     status_ = kNaClHelperBootstrapMissing;
-  } else if (RunningOnValgrind()) {
-    status_ = kNaClHelperValgrind;
   } else {
     base::CommandLine::StringVector argv_to_launch;
     {
diff --git a/components/nacl/zygote/nacl_fork_delegate_linux.h b/components/nacl/zygote/nacl_fork_delegate_linux.h
index e64fb14..1b4695c0 100644
--- a/components/nacl/zygote/nacl_fork_delegate_linux.h
+++ b/components/nacl/zygote/nacl_fork_delegate_linux.h
@@ -59,7 +59,7 @@
     kNaClHelperUnused = 0,
     kNaClHelperMissing = 1,
     kNaClHelperBootstrapMissing = 2,
-    kNaClHelperValgrind = 3,
+    // kNaClHelperValgrind = 3,  // Running in valgrind no longer supported.
     kNaClHelperLaunchFailed = 4,
     kNaClHelperAckFailed = 5,
     kNaClHelperSuccess = 6,
diff --git a/components/password_manager/sync/browser/DEPS b/components/password_manager/sync/browser/DEPS
index 06c81986..5b102b5 100644
--- a/components/password_manager/sync/browser/DEPS
+++ b/components/password_manager/sync/browser/DEPS
@@ -2,7 +2,6 @@
   "+components/keyed_service/core",
   "+components/pref_registry",
   "+components/signin/core/browser",
-  "+components/signin/core/common",
   "+components/sync/base",
   "+components/sync/driver",
   "+components/sync/engine",
diff --git a/content/browser/renderer_host/p2p/socket_host_test_utils.cc b/content/browser/renderer_host/p2p/socket_host_test_utils.cc
index 631f558..ede65259 100644
--- a/content/browser/renderer_host/p2p/socket_host_test_utils.cc
+++ b/content/browser/renderer_host/p2p/socket_host_test_utils.cc
@@ -12,6 +12,7 @@
 #include "net/base/completion_callback.h"
 #include "net/base/io_buffer.h"
 #include "net/base/ip_address.h"
+#include "net/traffic_annotation/network_traffic_annotation.h"
 
 const int kStunHeaderSize = 20;
 const uint16_t kStunBindingRequest = 0x0001;
@@ -75,8 +76,12 @@
   }
 }
 
-int FakeSocket::Write(net::IOBuffer* buf, int buf_len,
-                      const net::CompletionCallback& callback) {
+int FakeSocket::Write(
+    net::IOBuffer* buf,
+    int buf_len,
+    const net::CompletionCallback& callback,
+    const net::NetworkTrafficAnnotationTag& traffic_annotation) {
+  // TODO(crbug.com/656607): Handle traffic annotation.
   DCHECK(buf);
   DCHECK(!write_pending_);
 
diff --git a/content/browser/renderer_host/p2p/socket_host_test_utils.h b/content/browser/renderer_host/p2p/socket_host_test_utils.h
index 7b7552f9..664d357 100644
--- a/content/browser/renderer_host/p2p/socket_host_test_utils.h
+++ b/content/browser/renderer_host/p2p/socket_host_test_utils.h
@@ -16,6 +16,7 @@
 #include "net/base/net_errors.h"
 #include "net/log/net_log_with_source.h"
 #include "net/socket/stream_socket.h"
+#include "net/traffic_annotation/network_traffic_annotation_test_helper.h"
 #include "testing/gmock/include/gmock/gmock.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
@@ -49,9 +50,12 @@
   int Read(net::IOBuffer* buf,
            int buf_len,
            const net::CompletionCallback& callback) override;
+  // TODO(crbug.com/656607): Remove default value.
   int Write(net::IOBuffer* buf,
             int buf_len,
-            const net::CompletionCallback& callback) override;
+            const net::CompletionCallback& callback,
+            const net::NetworkTrafficAnnotationTag& traffic_annotation =
+                NO_TRAFFIC_ANNOTATION_BUG_656607) override;
   int SetReceiveBufferSize(int32_t size) override;
   int SetSendBufferSize(int32_t size) override;
   int Connect(const net::CompletionCallback& callback) override;
diff --git a/gpu/ipc/service/gpu_memory_buffer_factory_android_hardware_buffer.cc b/gpu/ipc/service/gpu_memory_buffer_factory_android_hardware_buffer.cc
index a16b5969..d46185a5 100644
--- a/gpu/ipc/service/gpu_memory_buffer_factory_android_hardware_buffer.cc
+++ b/gpu/ipc/service/gpu_memory_buffer_factory_android_hardware_buffer.cc
@@ -59,7 +59,8 @@
 
   scoped_refptr<gl::GLImageEGL> image(new gl::GLImageAHardwareBuffer(size));
   EGLClientBuffer client_buffer = eglGetNativeClientBufferANDROID(buffer);
-  if (!image->Initialize(EGL_NATIVE_BUFFER_ANDROID, client_buffer, attribs)) {
+  if (!image->Initialize(EGL_NO_CONTEXT, EGL_NATIVE_BUFFER_ANDROID,
+                         client_buffer, attribs)) {
     DLOG(ERROR) << "Failed to create GLImage " << size.ToString();
     image = nullptr;
   }
diff --git a/ios/chrome/browser/prerender/prerender_service_factory.h b/ios/chrome/browser/prerender/prerender_service_factory.h
index 7f7dc9e..394e749c 100644
--- a/ios/chrome/browser/prerender/prerender_service_factory.h
+++ b/ios/chrome/browser/prerender/prerender_service_factory.h
@@ -21,7 +21,7 @@
 class ChromeBrowserState;
 }  // namespace ios
 
-// Singleton that owns the PrerenderService and associates with with
+// Singleton that creates the PrerenderService and associates that service with
 // ios::ChromeBrowserState.
 class PrerenderServiceFactory : public BrowserStateKeyedServiceFactory {
  public:
diff --git a/ios/chrome/browser/reading_list/reading_list_download_service_factory.h b/ios/chrome/browser/reading_list/reading_list_download_service_factory.h
index f8bc94c..8bd150e 100644
--- a/ios/chrome/browser/reading_list/reading_list_download_service_factory.h
+++ b/ios/chrome/browser/reading_list/reading_list_download_service_factory.h
@@ -21,8 +21,8 @@
 class ChromeBrowserState;
 }
 
-// Singleton that owns the ReadingListDownloadService and associates it with
-// ios::ChromeBrowserState.
+// Singleton that creates the ReadingListDownloadService and associates that
+// service with ios::ChromeBrowserState.
 class ReadingListDownloadServiceFactory
     : public BrowserStateKeyedServiceFactory {
  public:
diff --git a/ios/chrome/browser/reading_list/reading_list_model_factory.h b/ios/chrome/browser/reading_list/reading_list_model_factory.h
index 6d18ef1..fada4c8 100644
--- a/ios/chrome/browser/reading_list/reading_list_model_factory.h
+++ b/ios/chrome/browser/reading_list/reading_list_model_factory.h
@@ -20,7 +20,7 @@
 class ChromeBrowserState;
 }
 
-// Singleton that owns the ReadingListModel and associates it with
+// Singleton that creates the ReadingListModel and associates that service with
 // ios::ChromeBrowserState.
 class ReadingListModelFactory : public BrowserStateKeyedServiceFactory {
  public:
diff --git a/ios/chrome/browser/share_extension/share_extension_service_factory.h b/ios/chrome/browser/share_extension/share_extension_service_factory.h
index 020cc1f9..215905b 100644
--- a/ios/chrome/browser/share_extension/share_extension_service_factory.h
+++ b/ios/chrome/browser/share_extension/share_extension_service_factory.h
@@ -21,8 +21,8 @@
 class ChromeBrowserState;
 }
 
-// Singleton that owns the ShareExtensionService and associates it with
-// ios::ChromeBrowserState.
+// Singleton that creates the ShareExtensionService and associates that service
+// with ios::ChromeBrowserState.
 class ShareExtensionServiceFactory : public BrowserStateKeyedServiceFactory {
  public:
   static ShareExtensionService* GetForBrowserState(
diff --git a/ios/chrome/browser/signin/account_consistency_service_factory.h b/ios/chrome/browser/signin/account_consistency_service_factory.h
index beee94c3..4025fe9 100644
--- a/ios/chrome/browser/signin/account_consistency_service_factory.h
+++ b/ios/chrome/browser/signin/account_consistency_service_factory.h
@@ -21,8 +21,8 @@
 
 class ChromeBrowserState;
 
-// Singleton that owns the AccountConsistencyService(s) and associates them with
-// browser states.
+// Singleton that creates the AccountConsistencyService(s) and associates those
+// services  with browser states.
 class AccountConsistencyServiceFactory
     : public BrowserStateKeyedServiceFactory {
  public:
diff --git a/ios/chrome/browser/signin/gaia_cookie_manager_service_factory.h b/ios/chrome/browser/signin/gaia_cookie_manager_service_factory.h
index 9471403..47a572dc 100644
--- a/ios/chrome/browser/signin/gaia_cookie_manager_service_factory.h
+++ b/ios/chrome/browser/signin/gaia_cookie_manager_service_factory.h
@@ -21,8 +21,8 @@
 
 class ChromeBrowserState;
 
-// Singleton that owns the GaiaCookieManagerService(s) and associates them with
-// browser states.
+// Singleton that creates the GaiaCookieManagerService(s) and associates those
+// services with browser states.
 class GaiaCookieManagerServiceFactory : public BrowserStateKeyedServiceFactory {
  public:
   // Returns the instance of GaiaCookieManagerService associated with this
diff --git a/ios/web_view/internal/signin/web_view_gaia_cookie_manager_service_factory.h b/ios/web_view/internal/signin/web_view_gaia_cookie_manager_service_factory.h
index 70737866..92a714b 100644
--- a/ios/web_view/internal/signin/web_view_gaia_cookie_manager_service_factory.h
+++ b/ios/web_view/internal/signin/web_view_gaia_cookie_manager_service_factory.h
@@ -21,8 +21,8 @@
 
 class WebViewBrowserState;
 
-// Singleton that owns the GaiaCookieManagerService(s) and associates them with
-// browser states.
+// Singleton that owns the GaiaCookieManagerService(s) and associates those
+// services  with browser states.
 class WebViewGaiaCookieManagerServiceFactory
     : public BrowserStateKeyedServiceFactory {
  public:
diff --git a/jingle/glue/fake_ssl_client_socket.cc b/jingle/glue/fake_ssl_client_socket.cc
index 51ea164..4d2b5d5 100644
--- a/jingle/glue/fake_ssl_client_socket.cc
+++ b/jingle/glue/fake_ssl_client_socket.cc
@@ -14,6 +14,7 @@
 #include "base/macros.h"
 #include "net/base/io_buffer.h"
 #include "net/base/net_errors.h"
+#include "net/traffic_annotation/network_traffic_annotation.h"
 
 namespace jingle_glue {
 
@@ -99,11 +100,14 @@
   return transport_socket_->Read(buf, buf_len, callback);
 }
 
-int FakeSSLClientSocket::Write(net::IOBuffer* buf, int buf_len,
-                               const net::CompletionCallback& callback) {
+int FakeSSLClientSocket::Write(
+    net::IOBuffer* buf,
+    int buf_len,
+    const net::CompletionCallback& callback,
+    const net::NetworkTrafficAnnotationTag& traffic_annotation) {
   DCHECK_EQ(next_handshake_state_, STATE_NONE);
   DCHECK(handshake_completed_);
-  return transport_socket_->Write(buf, buf_len, callback);
+  return transport_socket_->Write(buf, buf_len, callback, traffic_annotation);
 }
 
 int FakeSSLClientSocket::SetReceiveBufferSize(int32_t size) {
@@ -203,8 +207,7 @@
 
 int FakeSSLClientSocket::DoSendClientHello() {
   int status = transport_socket_->Write(
-      write_buf_.get(),
-      write_buf_->BytesRemaining(),
+      write_buf_.get(), write_buf_->BytesRemaining(),
       base::Bind(&FakeSSLClientSocket::OnSendClientHelloDone,
                  base::Unretained(this)));
   if (status < net::OK) {
diff --git a/jingle/glue/fake_ssl_client_socket.h b/jingle/glue/fake_ssl_client_socket.h
index bad6158..22eac8a8 100644
--- a/jingle/glue/fake_ssl_client_socket.h
+++ b/jingle/glue/fake_ssl_client_socket.h
@@ -27,6 +27,7 @@
 #include "net/base/completion_callback.h"
 #include "net/base/net_errors.h"
 #include "net/socket/stream_socket.h"
+#include "net/traffic_annotation/network_traffic_annotation.h"
 
 namespace net {
 class DrainableIOBuffer;
@@ -50,9 +51,12 @@
   int Read(net::IOBuffer* buf,
            int buf_len,
            const net::CompletionCallback& callback) override;
+  // TODO(crbug.com/656607): Remove default value.
   int Write(net::IOBuffer* buf,
             int buf_len,
-            const net::CompletionCallback& callback) override;
+            const net::CompletionCallback& callback,
+            const net::NetworkTrafficAnnotationTag& traffic_annotation =
+                NO_TRAFFIC_ANNOTATION_BUG_656607) override;
   int SetReceiveBufferSize(int32_t size) override;
   int SetSendBufferSize(int32_t size) override;
   int Connect(const net::CompletionCallback& callback) override;
diff --git a/jingle/glue/fake_ssl_client_socket_unittest.cc b/jingle/glue/fake_ssl_client_socket_unittest.cc
index 99b4be6..12d0bb3 100644
--- a/jingle/glue/fake_ssl_client_socket_unittest.cc
+++ b/jingle/glue/fake_ssl_client_socket_unittest.cc
@@ -22,6 +22,7 @@
 #include "net/log/net_log_with_source.h"
 #include "net/socket/socket_test_util.h"
 #include "net/socket/stream_socket.h"
+#include "net/traffic_annotation/network_traffic_annotation.h"
 #include "testing/gmock/include/gmock/gmock.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
@@ -54,8 +55,11 @@
 
   MOCK_METHOD3(Read, int(net::IOBuffer*, int,
                          const net::CompletionCallback&));
-  MOCK_METHOD3(Write, int(net::IOBuffer*, int,
-                          const net::CompletionCallback&));
+  MOCK_METHOD4(Write,
+               int(net::IOBuffer*,
+                   int,
+                   const net::CompletionCallback&,
+                   const net::NetworkTrafficAnnotationTag&));
   MOCK_METHOD1(SetReceiveBufferSize, int(int32_t));
   MOCK_METHOD1(SetSendBufferSize, int(int32_t));
   MOCK_METHOD1(Connect, int(const net::CompletionCallback&));
diff --git a/jingle/glue/proxy_resolving_client_socket.cc b/jingle/glue/proxy_resolving_client_socket.cc
index 3e37a44..dc96f4ec 100644
--- a/jingle/glue/proxy_resolving_client_socket.cc
+++ b/jingle/glue/proxy_resolving_client_socket.cc
@@ -22,6 +22,7 @@
 #include "net/log/net_log_source_type.h"
 #include "net/socket/client_socket_handle.h"
 #include "net/socket/client_socket_pool_manager.h"
+#include "net/traffic_annotation/network_traffic_annotation.h"
 #include "net/url_request/url_request_context.h"
 #include "net/url_request/url_request_context_getter.h"
 
@@ -123,9 +124,11 @@
 int ProxyResolvingClientSocket::Write(
     net::IOBuffer* buf,
     int buf_len,
-    const net::CompletionCallback& callback) {
+    const net::CompletionCallback& callback,
+    const net::NetworkTrafficAnnotationTag& traffic_annotation) {
   if (transport_.get() && transport_->socket())
-    return transport_->socket()->Write(buf, buf_len, callback);
+    return transport_->socket()->Write(buf, buf_len, callback,
+                                       traffic_annotation);
   NOTREACHED();
   return net::ERR_SOCKET_NOT_CONNECTED;
 }
diff --git a/jingle/glue/proxy_resolving_client_socket.h b/jingle/glue/proxy_resolving_client_socket.h
index cfc1f77..7858691d 100644
--- a/jingle/glue/proxy_resolving_client_socket.h
+++ b/jingle/glue/proxy_resolving_client_socket.h
@@ -25,6 +25,7 @@
 #include "net/socket/next_proto.h"
 #include "net/socket/stream_socket.h"
 #include "net/ssl/ssl_config_service.h"
+#include "net/traffic_annotation/network_traffic_annotation.h"
 #include "url/gurl.h"
 
 namespace net {
@@ -56,9 +57,12 @@
   int Read(net::IOBuffer* buf,
            int buf_len,
            const net::CompletionCallback& callback) override;
+  // TODO(crbug.com/656607): Remove default value.
   int Write(net::IOBuffer* buf,
             int buf_len,
-            const net::CompletionCallback& callback) override;
+            const net::CompletionCallback& callback,
+            const net::NetworkTrafficAnnotationTag& traffic_annotation =
+                NO_TRAFFIC_ANNOTATION_BUG_656607) override;
   int SetReceiveBufferSize(int32_t size) override;
   int SetSendBufferSize(int32_t size) override;
   int Connect(const net::CompletionCallback& callback) override;
diff --git a/net/dns/address_sorter_posix_unittest.cc b/net/dns/address_sorter_posix_unittest.cc
index 3871e7e..5c60aa20 100644
--- a/net/dns/address_sorter_posix_unittest.cc
+++ b/net/dns/address_sorter_posix_unittest.cc
@@ -16,6 +16,7 @@
 #include "net/socket/socket_performance_watcher.h"
 #include "net/socket/ssl_client_socket.h"
 #include "net/socket/stream_socket.h"
+#include "net/traffic_annotation/network_traffic_annotation.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
 namespace net {
@@ -42,7 +43,10 @@
     NOTIMPLEMENTED();
     return OK;
   }
-  int Write(IOBuffer*, int, const CompletionCallback&) override {
+  int Write(IOBuffer*,
+            int,
+            const CompletionCallback&,
+            const NetworkTrafficAnnotationTag& traffic_annotation) override {
     NOTIMPLEMENTED();
     return OK;
   }
diff --git a/net/http/http_proxy_client_socket.cc b/net/http/http_proxy_client_socket.cc
index 4be93e00..a5df1b1 100644
--- a/net/http/http_proxy_client_socket.cc
+++ b/net/http/http_proxy_client_socket.cc
@@ -21,6 +21,7 @@
 #include "net/log/net_log.h"
 #include "net/log/net_log_event_type.h"
 #include "net/socket/client_socket_handle.h"
+#include "net/traffic_annotation/network_traffic_annotation.h"
 #include "url/gurl.h"
 
 namespace net {
@@ -227,12 +228,16 @@
   return transport_->socket()->Read(buf, buf_len, callback);
 }
 
-int HttpProxyClientSocket::Write(IOBuffer* buf, int buf_len,
-                                 const CompletionCallback& callback) {
+int HttpProxyClientSocket::Write(
+    IOBuffer* buf,
+    int buf_len,
+    const CompletionCallback& callback,
+    const NetworkTrafficAnnotationTag& traffic_annotation) {
   DCHECK_EQ(STATE_DONE, next_state_);
   DCHECK(user_callback_.is_null());
 
-  return transport_->socket()->Write(buf, buf_len, callback);
+  return transport_->socket()->Write(buf, buf_len, callback,
+                                     traffic_annotation);
 }
 
 int HttpProxyClientSocket::SetReceiveBufferSize(int32_t size) {
diff --git a/net/http/http_proxy_client_socket.h b/net/http/http_proxy_client_socket.h
index 7c05a29..2b8d30e 100644
--- a/net/http/http_proxy_client_socket.h
+++ b/net/http/http_proxy_client_socket.h
@@ -23,6 +23,7 @@
 #include "net/http/proxy_client_socket.h"
 #include "net/log/net_log_with_source.h"
 #include "net/socket/ssl_client_socket.h"
+#include "net/traffic_annotation/network_traffic_annotation.h"
 
 namespace net {
 
@@ -81,9 +82,12 @@
   int Read(IOBuffer* buf,
            int buf_len,
            const CompletionCallback& callback) override;
+  // TODO(crbug.com/656607): Remove default value.
   int Write(IOBuffer* buf,
             int buf_len,
-            const CompletionCallback& callback) override;
+            const CompletionCallback& callback,
+            const NetworkTrafficAnnotationTag& traffic_annotation =
+                NO_TRAFFIC_ANNOTATION_BUG_656607) override;
   int SetReceiveBufferSize(int32_t size) override;
   int SetSendBufferSize(int32_t size) override;
   int GetPeerAddress(IPEndPoint* address) const override;
diff --git a/net/http/http_proxy_client_socket_wrapper.cc b/net/http/http_proxy_client_socket_wrapper.cc
index cd7a4d3..03e2bf72 100644
--- a/net/http/http_proxy_client_socket_wrapper.cc
+++ b/net/http/http_proxy_client_socket_wrapper.cc
@@ -25,6 +25,7 @@
 #include "net/spdy/chromium/spdy_session_pool.h"
 #include "net/spdy/chromium/spdy_stream.h"
 #include "net/ssl/ssl_cert_request_info.h"
+#include "net/traffic_annotation/network_traffic_annotation.h"
 #include "url/gurl.h"
 
 namespace net {
@@ -299,11 +300,13 @@
   return ERR_SOCKET_NOT_CONNECTED;
 }
 
-int HttpProxyClientSocketWrapper::Write(IOBuffer* buf,
-                                        int buf_len,
-                                        const CompletionCallback& callback) {
+int HttpProxyClientSocketWrapper::Write(
+    IOBuffer* buf,
+    int buf_len,
+    const CompletionCallback& callback,
+    const NetworkTrafficAnnotationTag& traffic_annotation) {
   if (transport_socket_)
-    return transport_socket_->Write(buf, buf_len, callback);
+    return transport_socket_->Write(buf, buf_len, callback, traffic_annotation);
   return ERR_SOCKET_NOT_CONNECTED;
 }
 
diff --git a/net/http/http_proxy_client_socket_wrapper.h b/net/http/http_proxy_client_socket_wrapper.h
index 2697454..af3428d 100644
--- a/net/http/http_proxy_client_socket_wrapper.h
+++ b/net/http/http_proxy_client_socket_wrapper.h
@@ -26,6 +26,7 @@
 #include "net/socket/ssl_client_socket_pool.h"
 #include "net/socket/transport_client_socket_pool.h"
 #include "net/spdy/chromium/spdy_session.h"
+#include "net/traffic_annotation/network_traffic_annotation.h"
 
 namespace net {
 
@@ -113,9 +114,12 @@
   int Read(IOBuffer* buf,
            int buf_len,
            const CompletionCallback& callback) override;
+  // TODO(crbug.com/656607): Remove default value.
   int Write(IOBuffer* buf,
             int buf_len,
-            const CompletionCallback& callback) override;
+            const CompletionCallback& callback,
+            const NetworkTrafficAnnotationTag& traffic_annotation =
+                NO_TRAFFIC_ANNOTATION_BUG_656607) override;
   int SetReceiveBufferSize(int32_t size) override;
   int SetSendBufferSize(int32_t size) override;
   int GetPeerAddress(IPEndPoint* address) const override;
diff --git a/net/quic/chromium/quic_proxy_client_socket.cc b/net/quic/chromium/quic_proxy_client_socket.cc
index e1e39a1..3972c4d7 100644
--- a/net/quic/chromium/quic_proxy_client_socket.cc
+++ b/net/quic/chromium/quic_proxy_client_socket.cc
@@ -16,6 +16,7 @@
 #include "net/log/net_log_source.h"
 #include "net/log/net_log_source_type.h"
 #include "net/spdy/chromium/spdy_http_utils.h"
+#include "net/traffic_annotation/network_traffic_annotation.h"
 
 namespace net {
 
@@ -205,9 +206,11 @@
   }
 }
 
-int QuicProxyClientSocket::Write(IOBuffer* buf,
-                                 int buf_len,
-                                 const CompletionCallback& callback) {
+int QuicProxyClientSocket::Write(
+    IOBuffer* buf,
+    int buf_len,
+    const CompletionCallback& callback,
+    const NetworkTrafficAnnotationTag& traffic_annotation) {
   DCHECK(connect_callback_.is_null());
   DCHECK(write_callback_.is_null());
 
diff --git a/net/quic/chromium/quic_proxy_client_socket.h b/net/quic/chromium/quic_proxy_client_socket.h
index 3b0795e..cf651e96d 100644
--- a/net/quic/chromium/quic_proxy_client_socket.h
+++ b/net/quic/chromium/quic_proxy_client_socket.h
@@ -13,6 +13,7 @@
 #include "net/quic/chromium/quic_chromium_client_session.h"
 #include "net/quic/chromium/quic_chromium_client_stream.h"
 #include "net/spdy/chromium/spdy_read_queue.h"
+#include "net/traffic_annotation/network_traffic_annotation.h"
 
 namespace net {
 
@@ -66,9 +67,12 @@
   int Read(IOBuffer* buf,
            int buf_len,
            const CompletionCallback& callback) override;
+  // TODO(crbug.com/656607): Remove default value.
   int Write(IOBuffer* buf,
             int buf_len,
-            const CompletionCallback& callback) override;
+            const CompletionCallback& callback,
+            const NetworkTrafficAnnotationTag& traffic_annotation =
+                NO_TRAFFIC_ANNOTATION_BUG_656607) override;
   int SetReceiveBufferSize(int32_t size) override;
   int SetSendBufferSize(int32_t size) override;
   int GetPeerAddress(IPEndPoint* address) const override;
diff --git a/net/server/http_server_unittest.cc b/net/server/http_server_unittest.cc
index cd60a7f..9463387 100644
--- a/net/server/http_server_unittest.cc
+++ b/net/server/http_server_unittest.cc
@@ -600,9 +600,13 @@
     pending_read_data_.erase(0, read_len);
     return read_len;
   }
+
+  // TODO(crbug.com/656607): Remove default value.
   int Write(IOBuffer* buf,
             int buf_len,
-            const CompletionCallback& callback) override {
+            const CompletionCallback& callback,
+            const NetworkTrafficAnnotationTag& traffic_annotation =
+                NO_TRAFFIC_ANNOTATION_BUG_656607) override {
     return ERR_NOT_IMPLEMENTED;
   }
   int SetReceiveBufferSize(int32_t size) override {
diff --git a/net/socket/client_socket_pool_base_unittest.cc b/net/socket/client_socket_pool_base_unittest.cc
index 41dbccf..297d694 100644
--- a/net/socket/client_socket_pool_base_unittest.cc
+++ b/net/socket/client_socket_pool_base_unittest.cc
@@ -45,6 +45,7 @@
 #include "net/socket/ssl_client_socket.h"
 #include "net/socket/stream_socket.h"
 #include "net/test/gtest_util.h"
+#include "net/traffic_annotation/network_traffic_annotation.h"
 #include "testing/gmock/include/gmock/gmock.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
@@ -151,9 +152,11 @@
     return ERR_UNEXPECTED;
   }
 
-  int Write(IOBuffer* /* buf */,
-            int len,
-            const CompletionCallback& /* callback */) override {
+  int Write(
+      IOBuffer* /* buf */,
+      int len,
+      const CompletionCallback& /* callback */,
+      const NetworkTrafficAnnotationTag& /*traffic_annotation*/) override {
     was_used_to_convey_data_ = true;
     return len;
   }
diff --git a/net/socket/fuzzed_datagram_client_socket.cc b/net/socket/fuzzed_datagram_client_socket.cc
index 85db485..180fa2b 100644
--- a/net/socket/fuzzed_datagram_client_socket.cc
+++ b/net/socket/fuzzed_datagram_client_socket.cc
@@ -15,6 +15,7 @@
 #include "net/base/io_buffer.h"
 #include "net/base/ip_address.h"
 #include "net/base/net_errors.h"
+#include "net/traffic_annotation/network_traffic_annotation.h"
 
 namespace net {
 
@@ -130,12 +131,16 @@
   return ERR_IO_PENDING;
 }
 
-int FuzzedDatagramClientSocket::Write(IOBuffer* buf,
-                                      int buf_len,
-                                      const CompletionCallback& callback) {
+int FuzzedDatagramClientSocket::Write(
+    IOBuffer* buf,
+    int buf_len,
+    const CompletionCallback& callback,
+    const NetworkTrafficAnnotationTag& traffic_annotation) {
   CHECK(!callback.is_null());
   CHECK(!write_pending_);
 
+  // TODO(crbug.com/656607): Handle traffic annotation.
+
   // Normally this is allowed, but code really shouldn't be doing this - if it
   // is, it's best to figure out why, and fix it.
   CHECK(connected_);
diff --git a/net/socket/fuzzed_datagram_client_socket.h b/net/socket/fuzzed_datagram_client_socket.h
index a354e8e..adb5e41 100644
--- a/net/socket/fuzzed_datagram_client_socket.h
+++ b/net/socket/fuzzed_datagram_client_socket.h
@@ -14,6 +14,7 @@
 #include "net/base/ip_endpoint.h"
 #include "net/base/network_change_notifier.h"
 #include "net/log/net_log_with_source.h"
+#include "net/traffic_annotation/network_traffic_annotation.h"
 
 namespace base {
 class FuzzedDataProvider;
@@ -50,9 +51,12 @@
   int Read(IOBuffer* buf,
            int buf_len,
            const CompletionCallback& callback) override;
+  // TODO(crbug.com/656607): Remove default value.
   int Write(IOBuffer* buf,
             int buf_len,
-            const CompletionCallback& callback) override;
+            const CompletionCallback& callback,
+            const NetworkTrafficAnnotationTag& traffic_annotation =
+                NO_TRAFFIC_ANNOTATION_BUG_656607) override;
   int SetReceiveBufferSize(int32_t size) override;
   int SetSendBufferSize(int32_t size) override;
   int SetDoNotFragment() override;
diff --git a/net/socket/fuzzed_socket.cc b/net/socket/fuzzed_socket.cc
index 08be4bf..11cf601 100644
--- a/net/socket/fuzzed_socket.cc
+++ b/net/socket/fuzzed_socket.cc
@@ -13,6 +13,7 @@
 #include "base/threading/thread_task_runner_handle.h"
 #include "net/base/io_buffer.h"
 #include "net/log/net_log_source_type.h"
+#include "net/traffic_annotation/network_traffic_annotation.h"
 
 namespace net {
 
@@ -91,10 +92,13 @@
 
 int FuzzedSocket::Write(IOBuffer* buf,
                         int buf_len,
-                        const CompletionCallback& callback) {
+                        const CompletionCallback& callback,
+                        const NetworkTrafficAnnotationTag& traffic_annotation) {
   DCHECK(!connect_pending_);
   DCHECK(!write_pending_);
 
+  // TODO(crbug.com/656607): Handle traffic annotation.
+
   bool sync;
   int result;
 
diff --git a/net/socket/fuzzed_socket.h b/net/socket/fuzzed_socket.h
index 2da0b03c..a8c2666 100644
--- a/net/socket/fuzzed_socket.h
+++ b/net/socket/fuzzed_socket.h
@@ -15,6 +15,7 @@
 #include "net/base/net_errors.h"
 #include "net/log/net_log_with_source.h"
 #include "net/socket/stream_socket.h"
+#include "net/traffic_annotation/network_traffic_annotation.h"
 
 namespace base {
 class FuzzedDataProvider;
@@ -61,9 +62,12 @@
   int Read(IOBuffer* buf,
            int buf_len,
            const CompletionCallback& callback) override;
+  // TODO(crbug.com/656607): Remove default value.
   int Write(IOBuffer* buf,
             int buf_len,
-            const CompletionCallback& callback) override;
+            const CompletionCallback& callback,
+            const NetworkTrafficAnnotationTag& traffic_annotation =
+                NO_TRAFFIC_ANNOTATION_BUG_656607) override;
   int SetReceiveBufferSize(int32_t size) override;
   int SetSendBufferSize(int32_t size) override;
 
diff --git a/net/socket/fuzzed_socket_factory.cc b/net/socket/fuzzed_socket_factory.cc
index 55ffd99..2255037 100644
--- a/net/socket/fuzzed_socket_factory.cc
+++ b/net/socket/fuzzed_socket_factory.cc
@@ -16,6 +16,7 @@
 #include "net/socket/fuzzed_datagram_client_socket.h"
 #include "net/socket/fuzzed_socket.h"
 #include "net/socket/ssl_client_socket.h"
+#include "net/traffic_annotation/network_traffic_annotation.h"
 
 namespace net {
 
@@ -37,9 +38,12 @@
     return ERR_UNEXPECTED;
   }
 
+  // TODO(crbug.com/656607): Remove default value.
   int Write(IOBuffer* buf,
             int buf_len,
-            const CompletionCallback& callback) override {
+            const CompletionCallback& callback,
+            const NetworkTrafficAnnotationTag& traffic_annotation =
+                NO_TRAFFIC_ANNOTATION_BUG_656607) override {
     NOTREACHED();
     return ERR_UNEXPECTED;
   }
diff --git a/net/socket/socket.h b/net/socket/socket.h
index 8f5fed6..87fd9cb 100644
--- a/net/socket/socket.h
+++ b/net/socket/socket.h
@@ -10,6 +10,7 @@
 #include "base/feature_list.h"
 #include "net/base/completion_callback.h"
 #include "net/base/net_export.h"
+#include "net/traffic_annotation/network_traffic_annotation.h"
 
 namespace net {
 
@@ -62,8 +63,14 @@
   // closed.  Implementations of this method should not modify the contents
   // of the actual buffer that is written to the socket.  If the socket is
   // Disconnected before the write completes, the callback will not be invoked.
-  virtual int Write(IOBuffer* buf, int buf_len,
-                    const CompletionCallback& callback) = 0;
+  // |traffic_annotation| provides the required description for auditing. Please
+  // refer to //docs/network_traffic_annotations.md for more details.
+  // TODO(crbug.com/656607): Remove default value.
+  virtual int Write(IOBuffer* buf,
+                    int buf_len,
+                    const CompletionCallback& callback,
+                    const NetworkTrafficAnnotationTag& traffic_annotation =
+                        NO_TRAFFIC_ANNOTATION_BUG_656607) = 0;
 
   // Set the receive buffer size (in bytes) for the socket.
   // Note: changing this value can affect the TCP window size on some platforms.
@@ -74,6 +81,15 @@
   // Note: changing this value can affect the TCP window size on some platforms.
   // Returns a net error code.
   virtual int SetSendBufferSize(int32_t size) = 0;
+
+ private:
+  void SetTrafficAnnotation(
+      const NetworkTrafficAnnotationTag& traffic_annotation) {
+    traffic_annotation_ =
+        MutableNetworkTrafficAnnotationTag(traffic_annotation);
+  }
+
+  MutableNetworkTrafficAnnotationTag traffic_annotation_;
 };
 
 }  // namespace net
diff --git a/net/socket/socket_posix.cc b/net/socket/socket_posix.cc
index ae9bb1e..9661928f 100644
--- a/net/socket/socket_posix.cc
+++ b/net/socket/socket_posix.cc
@@ -20,6 +20,7 @@
 #include "net/base/net_errors.h"
 #include "net/base/sockaddr_storage.h"
 #include "net/base/trace_constants.h"
+#include "net/traffic_annotation/network_traffic_annotation.h"
 
 #if defined(OS_FUCHSIA)
 #include <poll.h>
@@ -348,7 +349,8 @@
 
 int SocketPosix::Write(IOBuffer* buf,
                        int buf_len,
-                       const CompletionCallback& callback) {
+                       const CompletionCallback& callback,
+                       const NetworkTrafficAnnotationTag& traffic_annotation) {
   DCHECK(thread_checker_.CalledOnValidThread());
   DCHECK_NE(kInvalidSocket, socket_fd_);
   DCHECK(!waiting_connect_);
@@ -357,6 +359,8 @@
   DCHECK(!callback.is_null());
   DCHECK_LT(0, buf_len);
 
+  // TODO(crbug.com/656607): Handle traffic annotation.
+
   int rv = DoWrite(buf, buf_len);
   if (rv == ERR_IO_PENDING)
     rv = WaitForWrite(buf, buf_len, callback);
diff --git a/net/socket/socket_posix.h b/net/socket/socket_posix.h
index 04ef7f6..3e62f27 100644
--- a/net/socket/socket_posix.h
+++ b/net/socket/socket_posix.h
@@ -15,6 +15,7 @@
 #include "net/base/completion_callback.h"
 #include "net/base/net_export.h"
 #include "net/socket/socket_descriptor.h"
+#include "net/traffic_annotation/network_traffic_annotation.h"
 
 namespace net {
 
@@ -75,7 +76,12 @@
   int ReadIfReady(IOBuffer* buf,
                   int buf_len,
                   const CompletionCallback& callback);
-  int Write(IOBuffer* buf, int buf_len, const CompletionCallback& callback);
+  // TODO(crbug.com/656607): Remove default value.
+  int Write(IOBuffer* buf,
+            int buf_len,
+            const CompletionCallback& callback,
+            const NetworkTrafficAnnotationTag& traffic_annotation =
+                NO_TRAFFIC_ANNOTATION_BUG_656607);
 
   // Waits for next write event. This is called by TCPSocketPosix for TCP
   // fastopen after sending first data. Returns ERR_IO_PENDING if it starts
diff --git a/net/socket/socket_test_util.cc b/net/socket/socket_test_util.cc
index e6b5253..e778fad 100644
--- a/net/socket/socket_test_util.cc
+++ b/net/socket/socket_test_util.cc
@@ -33,6 +33,7 @@
 #include "net/ssl/ssl_cert_request_info.h"
 #include "net/ssl/ssl_connection_status_flags.h"
 #include "net/ssl/ssl_info.h"
+#include "net/traffic_annotation/network_traffic_annotation_test_helper.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
 #define NET_TRACE(level, s) VLOG(level) << s << __FUNCTION__ << "() "
@@ -917,11 +918,16 @@
   return ReadIfReadyImpl(buf, buf_len, callback);
 }
 
-int MockTCPClientSocket::Write(IOBuffer* buf, int buf_len,
-                               const CompletionCallback& callback) {
+int MockTCPClientSocket::Write(
+    IOBuffer* buf,
+    int buf_len,
+    const CompletionCallback& callback,
+    const NetworkTrafficAnnotationTag& traffic_annotation) {
   DCHECK(buf);
   DCHECK_GT(buf_len, 0);
 
+  // TODO(crbug.com/656607): Handle traffic annotation.
+
   if (!connected_ || !data_)
     return ERR_UNEXPECTED;
 
@@ -1189,9 +1195,13 @@
   return transport_->socket()->ReadIfReady(buf, buf_len, callback);
 }
 
-int MockSSLClientSocket::Write(IOBuffer* buf, int buf_len,
-                               const CompletionCallback& callback) {
-  return transport_->socket()->Write(buf, buf_len, callback);
+int MockSSLClientSocket::Write(
+    IOBuffer* buf,
+    int buf_len,
+    const CompletionCallback& callback,
+    const NetworkTrafficAnnotationTag& traffic_annotation) {
+  return transport_->socket()->Write(buf, buf_len, callback,
+                                     traffic_annotation);
 }
 
 int MockSSLClientSocket::Connect(const CompletionCallback& callback) {
@@ -1336,11 +1346,16 @@
   return CompleteRead();
 }
 
-int MockUDPClientSocket::Write(IOBuffer* buf, int buf_len,
-                               const CompletionCallback& callback) {
+int MockUDPClientSocket::Write(
+    IOBuffer* buf,
+    int buf_len,
+    const CompletionCallback& callback,
+    const NetworkTrafficAnnotationTag& traffic_annotation) {
   DCHECK(buf);
   DCHECK_GT(buf_len, 0);
 
+  // TODO(crbug.com/656607): Handle traffic annotation.
+
   if (!connected_ || !data_)
     return ERR_UNEXPECTED;
 
diff --git a/net/socket/socket_test_util.h b/net/socket/socket_test_util.h
index ce0ccf5..b17c1ada 100644
--- a/net/socket/socket_test_util.h
+++ b/net/socket/socket_test_util.h
@@ -38,6 +38,7 @@
 #include "net/socket/ssl_client_socket_pool.h"
 #include "net/socket/transport_client_socket_pool.h"
 #include "net/ssl/ssl_config_service.h"
+#include "net/traffic_annotation/network_traffic_annotation.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
 namespace base {
@@ -570,7 +571,8 @@
            const CompletionCallback& callback) override = 0;
   int Write(IOBuffer* buf,
             int buf_len,
-            const CompletionCallback& callback) override = 0;
+            const CompletionCallback& callback,
+            const NetworkTrafficAnnotationTag& traffic_annotation) override = 0;
   int SetReceiveBufferSize(int32_t size) override;
   int SetSendBufferSize(int32_t size) override;
 
@@ -641,7 +643,8 @@
                   const CompletionCallback& callback) override;
   int Write(IOBuffer* buf,
             int buf_len,
-            const CompletionCallback& callback) override;
+            const CompletionCallback& callback,
+            const NetworkTrafficAnnotationTag& traffic_annotation) override;
 
   // StreamSocket implementation.
   int Connect(const CompletionCallback& callback) override;
@@ -721,7 +724,8 @@
                   const CompletionCallback& callback) override;
   int Write(IOBuffer* buf,
             int buf_len,
-            const CompletionCallback& callback) override;
+            const CompletionCallback& callback,
+            const NetworkTrafficAnnotationTag& traffic_annotation) override;
 
   // StreamSocket implementation.
   int Connect(const CompletionCallback& callback) override;
@@ -772,7 +776,8 @@
            const CompletionCallback& callback) override;
   int Write(IOBuffer* buf,
             int buf_len,
-            const CompletionCallback& callback) override;
+            const CompletionCallback& callback,
+            const NetworkTrafficAnnotationTag& traffic_annotation) override;
   int SetReceiveBufferSize(int32_t size) override;
   int SetSendBufferSize(int32_t size) override;
   int SetDoNotFragment() override;
diff --git a/net/socket/socks5_client_socket.cc b/net/socket/socks5_client_socket.cc
index 19cdfdd..6146e8e 100644
--- a/net/socket/socks5_client_socket.cc
+++ b/net/socket/socks5_client_socket.cc
@@ -16,6 +16,7 @@
 #include "net/log/net_log.h"
 #include "net/log/net_log_event_type.h"
 #include "net/socket/client_socket_handle.h"
+#include "net/traffic_annotation/network_traffic_annotation.h"
 
 namespace net {
 
@@ -166,8 +167,11 @@
 
 // Write is called by the transport layer. This can only be done if the
 // SOCKS handshake is complete.
-int SOCKS5ClientSocket::Write(IOBuffer* buf, int buf_len,
-                              const CompletionCallback& callback) {
+int SOCKS5ClientSocket::Write(
+    IOBuffer* buf,
+    int buf_len,
+    const CompletionCallback& callback,
+    const NetworkTrafficAnnotationTag& traffic_annotation) {
   DCHECK(completed_handshake_);
   DCHECK_EQ(STATE_NONE, next_state_);
   DCHECK(user_callback_.is_null());
@@ -176,7 +180,8 @@
   int rv = transport_->socket()->Write(
       buf, buf_len,
       base::Bind(&SOCKS5ClientSocket::OnReadWriteComplete,
-                 base::Unretained(this), callback));
+                 base::Unretained(this), callback),
+      traffic_annotation);
   if (rv > 0)
     was_ever_used_ = true;
   return rv;
@@ -295,8 +300,8 @@
   handshake_buf_ = new IOBuffer(handshake_buf_len);
   memcpy(handshake_buf_->data(), &buffer_.data()[bytes_sent_],
          handshake_buf_len);
-  return transport_->socket()
-      ->Write(handshake_buf_.get(), handshake_buf_len, io_callback_);
+  return transport_->socket()->Write(handshake_buf_.get(), handshake_buf_len,
+                                     io_callback_);
 }
 
 int SOCKS5ClientSocket::DoGreetWriteComplete(int result) {
@@ -394,8 +399,8 @@
   handshake_buf_ = new IOBuffer(handshake_buf_len);
   memcpy(handshake_buf_->data(), &buffer_[bytes_sent_],
          handshake_buf_len);
-  return transport_->socket()
-      ->Write(handshake_buf_.get(), handshake_buf_len, io_callback_);
+  return transport_->socket()->Write(handshake_buf_.get(), handshake_buf_len,
+                                     io_callback_);
 }
 
 int SOCKS5ClientSocket::DoHandshakeWriteComplete(int result) {
diff --git a/net/socket/socks5_client_socket.h b/net/socket/socks5_client_socket.h
index afef312..ffc8d14 100644
--- a/net/socket/socks5_client_socket.h
+++ b/net/socket/socks5_client_socket.h
@@ -20,6 +20,7 @@
 #include "net/dns/host_resolver.h"
 #include "net/log/net_log_with_source.h"
 #include "net/socket/stream_socket.h"
+#include "net/traffic_annotation/network_traffic_annotation.h"
 #include "url/gurl.h"
 
 namespace net {
@@ -65,9 +66,12 @@
   int Read(IOBuffer* buf,
            int buf_len,
            const CompletionCallback& callback) override;
+  // TODO(crbug.com/656607): Remove default value.
   int Write(IOBuffer* buf,
             int buf_len,
-            const CompletionCallback& callback) override;
+            const CompletionCallback& callback,
+            const NetworkTrafficAnnotationTag& traffic_annotation =
+                NO_TRAFFIC_ANNOTATION_BUG_656607) override;
 
   int SetReceiveBufferSize(int32_t size) override;
   int SetSendBufferSize(int32_t size) override;
diff --git a/net/socket/socks_client_socket.cc b/net/socket/socks_client_socket.cc
index 027d18ab..0a7368c9 100644
--- a/net/socket/socks_client_socket.cc
+++ b/net/socket/socks_client_socket.cc
@@ -14,6 +14,7 @@
 #include "net/log/net_log.h"
 #include "net/log/net_log_event_type.h"
 #include "net/socket/client_socket_handle.h"
+#include "net/traffic_annotation/network_traffic_annotation.h"
 
 namespace net {
 
@@ -195,8 +196,11 @@
 
 // Write is called by the transport layer. This can only be done if the
 // SOCKS handshake is complete.
-int SOCKSClientSocket::Write(IOBuffer* buf, int buf_len,
-                             const CompletionCallback& callback) {
+int SOCKSClientSocket::Write(
+    IOBuffer* buf,
+    int buf_len,
+    const CompletionCallback& callback,
+    const NetworkTrafficAnnotationTag& traffic_annotation) {
   DCHECK(completed_handshake_);
   DCHECK_EQ(STATE_NONE, next_state_);
   DCHECK(user_callback_.is_null());
@@ -205,7 +209,8 @@
   int rv = transport_->socket()->Write(
       buf, buf_len,
       base::Bind(&SOCKSClientSocket::OnReadWriteComplete,
-                 base::Unretained(this), callback));
+                 base::Unretained(this), callback),
+      traffic_annotation);
   if (rv > 0)
     was_ever_used_ = true;
   return rv;
@@ -352,8 +357,7 @@
   memcpy(handshake_buf_->data(), &buffer_[bytes_sent_],
          handshake_buf_len);
   return transport_->socket()->Write(
-      handshake_buf_.get(),
-      handshake_buf_len,
+      handshake_buf_.get(), handshake_buf_len,
       base::Bind(&SOCKSClientSocket::OnIOComplete, base::Unretained(this)));
 }
 
diff --git a/net/socket/socks_client_socket.h b/net/socket/socks_client_socket.h
index c2999ffa..df9949aa 100644
--- a/net/socket/socks_client_socket.h
+++ b/net/socket/socks_client_socket.h
@@ -21,6 +21,7 @@
 #include "net/dns/host_resolver.h"
 #include "net/log/net_log_with_source.h"
 #include "net/socket/stream_socket.h"
+#include "net/traffic_annotation/network_traffic_annotation.h"
 
 namespace net {
 
@@ -62,9 +63,12 @@
   int Read(IOBuffer* buf,
            int buf_len,
            const CompletionCallback& callback) override;
+  // TODO(crbug.com/656607): Remove default value.
   int Write(IOBuffer* buf,
             int buf_len,
-            const CompletionCallback& callback) override;
+            const CompletionCallback& callback,
+            const NetworkTrafficAnnotationTag& traffic_annotation =
+                NO_TRAFFIC_ANNOTATION_BUG_656607) override;
 
   int SetReceiveBufferSize(int32_t size) override;
   int SetSendBufferSize(int32_t size) override;
diff --git a/net/socket/socks_client_socket_unittest.cc b/net/socket/socks_client_socket_unittest.cc
index 6318384..59955b4c 100644
--- a/net/socket/socks_client_socket_unittest.cc
+++ b/net/socket/socks_client_socket_unittest.cc
@@ -21,6 +21,7 @@
 #include "net/socket/socket_test_util.h"
 #include "net/socket/tcp_client_socket.h"
 #include "net/test/gtest_util.h"
+#include "net/traffic_annotation/network_traffic_annotation_test_helper.h"
 #include "testing/gmock/include/gmock/gmock.h"
 #include "testing/gtest/include/gtest/gtest.h"
 #include "testing/platform_test.h"
@@ -199,8 +200,8 @@
 
   scoped_refptr<IOBuffer> buffer(new IOBuffer(payload_write.size()));
   memcpy(buffer->data(), payload_write.data(), payload_write.size());
-  rv = user_sock_->Write(
-      buffer.get(), payload_write.size(), callback_.callback());
+  rv = user_sock_->Write(buffer.get(), payload_write.size(),
+                         callback_.callback(), TRAFFIC_ANNOTATION_FOR_TESTS);
   EXPECT_THAT(rv, IsError(ERR_IO_PENDING));
   rv = callback_.WaitForResult();
   EXPECT_EQ(static_cast<int>(payload_write.size()), rv);
diff --git a/net/socket/ssl_client_socket_impl.cc b/net/socket/ssl_client_socket_impl.cc
index 54c0c56..c03be38 100644
--- a/net/socket/ssl_client_socket_impl.cc
+++ b/net/socket/ssl_client_socket_impl.cc
@@ -49,6 +49,7 @@
 #include "net/ssl/ssl_info.h"
 #include "net/ssl/ssl_private_key.h"
 #include "net/ssl/token_binding.h"
+#include "net/traffic_annotation/network_traffic_annotation.h"
 #include "third_party/boringssl/src/include/openssl/bio.h"
 #include "third_party/boringssl/src/include/openssl/bytestring.h"
 #include "third_party/boringssl/src/include/openssl/err.h"
@@ -749,9 +750,11 @@
   return rv;
 }
 
-int SSLClientSocketImpl::Write(IOBuffer* buf,
-                               int buf_len,
-                               const CompletionCallback& callback) {
+int SSLClientSocketImpl::Write(
+    IOBuffer* buf,
+    int buf_len,
+    const CompletionCallback& callback,
+    const NetworkTrafficAnnotationTag& traffic_annotation) {
   user_write_buf_ = buf;
   user_write_buf_len_ = buf_len;
 
diff --git a/net/socket/ssl_client_socket_impl.h b/net/socket/ssl_client_socket_impl.h
index 0d162d3..fb55303 100644
--- a/net/socket/ssl_client_socket_impl.h
+++ b/net/socket/ssl_client_socket_impl.h
@@ -32,6 +32,7 @@
 #include "net/ssl/openssl_ssl_util.h"
 #include "net/ssl/ssl_client_cert_type.h"
 #include "net/ssl/ssl_config_service.h"
+#include "net/traffic_annotation/network_traffic_annotation.h"
 #include "third_party/boringssl/src/include/openssl/base.h"
 #include "third_party/boringssl/src/include/openssl/ssl.h"
 
@@ -128,9 +129,12 @@
   int ReadIfReady(IOBuffer* buf,
                   int buf_len,
                   const CompletionCallback& callback) override;
+  // TODO(crbug.com/656607): Remove default value.
   int Write(IOBuffer* buf,
             int buf_len,
-            const CompletionCallback& callback) override;
+            const CompletionCallback& callback,
+            const NetworkTrafficAnnotationTag& traffic_annotation =
+                NO_TRAFFIC_ANNOTATION_BUG_656607) override;
   int SetReceiveBufferSize(int32_t size) override;
   int SetSendBufferSize(int32_t size) override;
 
diff --git a/net/socket/ssl_client_socket_unittest.cc b/net/socket/ssl_client_socket_unittest.cc
index d0527ee..6891d8e6 100644
--- a/net/socket/ssl_client_socket_unittest.cc
+++ b/net/socket/ssl_client_socket_unittest.cc
@@ -66,6 +66,7 @@
 #include "net/test/gtest_util.h"
 #include "net/test/spawned_test_server/spawned_test_server.h"
 #include "net/test/test_data_directory.h"
+#include "net/traffic_annotation/network_traffic_annotation.h"
 #include "testing/gmock/include/gmock/gmock.h"
 #include "testing/gtest/include/gtest/gtest.h"
 #include "testing/platform_test.h"
@@ -157,7 +158,9 @@
   }
   int Write(IOBuffer* buf,
             int buf_len,
-            const CompletionCallback& callback) override {
+            const CompletionCallback& callback,
+            const NetworkTrafficAnnotationTag& traffic_annotation =
+                NO_TRAFFIC_ANNOTATION_BUG_656607) override {
     return transport_->Write(buf, buf_len, callback);
   }
   int SetReceiveBufferSize(int32_t size) override {
@@ -347,9 +350,12 @@
   int ReadIfReady(IOBuffer* buf,
                   int buf_len,
                   const CompletionCallback& callback) override;
+  // TODO(crbug.com/656607): Remove default value.
   int Write(IOBuffer* buf,
             int buf_len,
-            const CompletionCallback& callback) override;
+            const CompletionCallback& callback,
+            const NetworkTrafficAnnotationTag& traffic_annotation =
+                NO_TRAFFIC_ANNOTATION_BUG_656607) override;
 
   // Sets the next Read() call and all future calls to return |error|.
   // If there is already a pending asynchronous read, the configured error
@@ -398,9 +404,11 @@
   return transport_->ReadIfReady(buf, buf_len, callback);
 }
 
-int SynchronousErrorStreamSocket::Write(IOBuffer* buf,
-                                        int buf_len,
-                                        const CompletionCallback& callback) {
+int SynchronousErrorStreamSocket::Write(
+    IOBuffer* buf,
+    int buf_len,
+    const CompletionCallback& callback,
+    const NetworkTrafficAnnotationTag& traffic_annotation) {
   if (have_write_error_)
     return pending_write_error_;
   return transport_->Write(buf, buf_len, callback);
@@ -423,9 +431,12 @@
   int ReadIfReady(IOBuffer* buf,
                   int buf_len,
                   const CompletionCallback& callback) override;
+  // TODO(crbug.com/656607): Remove default value.
   int Write(IOBuffer* buf,
             int buf_len,
-            const CompletionCallback& callback) override;
+            const CompletionCallback& callback,
+            const NetworkTrafficAnnotationTag& traffic_annotation =
+                NO_TRAFFIC_ANNOTATION_BUG_656607) override;
 
   int pending_read_result() const { return pending_read_result_; }
   IOBuffer* pending_read_buf() const { return pending_read_buf_.get(); }
@@ -559,9 +570,11 @@
   return rv;
 }
 
-int FakeBlockingStreamSocket::Write(IOBuffer* buf,
-                                    int len,
-                                    const CompletionCallback& callback) {
+int FakeBlockingStreamSocket::Write(
+    IOBuffer* buf,
+    int len,
+    const CompletionCallback& callback,
+    const NetworkTrafficAnnotationTag& traffic_annotation) {
   DCHECK(buf);
   DCHECK_LE(0, len);
 
@@ -713,7 +726,8 @@
   }
   int Write(IOBuffer* buf,
             int buf_len,
-            const CompletionCallback& callback) override {
+            const CompletionCallback& callback,
+            const NetworkTrafficAnnotationTag& traffic_annotation) override {
     write_count_++;
     return transport_->Write(buf, buf_len, callback);
   }
diff --git a/net/socket/ssl_server_socket_impl.cc b/net/socket/ssl_server_socket_impl.cc
index cba12a6b..00a8816f 100644
--- a/net/socket/ssl_server_socket_impl.cc
+++ b/net/socket/ssl_server_socket_impl.cc
@@ -21,6 +21,7 @@
 #include "net/ssl/openssl_ssl_util.h"
 #include "net/ssl/ssl_connection_status_flags.h"
 #include "net/ssl/ssl_info.h"
+#include "net/traffic_annotation/network_traffic_annotation.h"
 #include "third_party/boringssl/src/include/openssl/err.h"
 #include "third_party/boringssl/src/include/openssl/pool.h"
 #include "third_party/boringssl/src/include/openssl/ssl.h"
@@ -52,7 +53,8 @@
            const CompletionCallback& callback) override;
   int Write(IOBuffer* buf,
             int buf_len,
-            const CompletionCallback& callback) override;
+            const CompletionCallback& callback,
+            const NetworkTrafficAnnotationTag& traffic_annotation) override;
   int SetReceiveBufferSize(int32_t size) override;
   int SetSendBufferSize(int32_t size) override;
 
@@ -236,7 +238,8 @@
 int SSLServerContextImpl::SocketImpl::Write(
     IOBuffer* buf,
     int buf_len,
-    const CompletionCallback& callback) {
+    const CompletionCallback& callback,
+    const NetworkTrafficAnnotationTag& traffic_annotation) {
   DCHECK(user_write_callback_.is_null());
   DCHECK(!user_write_buf_);
   DCHECK(!callback.is_null());
diff --git a/net/socket/ssl_server_socket_unittest.cc b/net/socket/ssl_server_socket_unittest.cc
index 73a038d..87a01fa2b 100644
--- a/net/socket/ssl_server_socket_unittest.cc
+++ b/net/socket/ssl_server_socket_unittest.cc
@@ -66,6 +66,7 @@
 #include "net/test/cert_test_util.h"
 #include "net/test/gtest_util.h"
 #include "net/test/test_data_directory.h"
+#include "net/traffic_annotation/network_traffic_annotation.h"
 #include "testing/gmock/include/gmock/gmock.h"
 #include "testing/gtest/include/gtest/gtest.h"
 #include "testing/platform_test.h"
@@ -119,7 +120,12 @@
     return PropagateData(buf, buf_len);
   }
 
-  int Write(IOBuffer* buf, int buf_len, const CompletionCallback& callback) {
+  // TODO(crbug.com/656607): Remove default value.
+  int Write(IOBuffer* buf,
+            int buf_len,
+            const CompletionCallback& callback,
+            const NetworkTrafficAnnotationTag& traffic_annotation =
+                NO_TRAFFIC_ANNOTATION_BUG_656607) {
     DCHECK(write_callback_.is_null());
     if (closed_) {
       if (write_called_after_close_)
@@ -232,9 +238,12 @@
     return incoming_->Read(buf, buf_len, callback);
   }
 
+  // TODO(crbug.com/656607): Remove default value.
   int Write(IOBuffer* buf,
             int buf_len,
-            const CompletionCallback& callback) override {
+            const CompletionCallback& callback,
+            const NetworkTrafficAnnotationTag& traffic_annotation =
+                NO_TRAFFIC_ANNOTATION_BUG_656607) override {
     // Write random number of bytes.
     buf_len = rand() % buf_len + 1;
     return outgoing_->Write(buf, buf_len, callback);
diff --git a/net/socket/tcp_client_socket.cc b/net/socket/tcp_client_socket.cc
index d6dce18..3063630 100644
--- a/net/socket/tcp_client_socket.cc
+++ b/net/socket/tcp_client_socket.cc
@@ -14,6 +14,7 @@
 #include "net/base/ip_endpoint.h"
 #include "net/base/net_errors.h"
 #include "net/socket/socket_performance_watcher.h"
+#include "net/traffic_annotation/network_traffic_annotation.h"
 
 namespace net {
 
@@ -294,16 +295,18 @@
   return ReadCommon(buf, buf_len, callback, /*read_if_ready=*/true);
 }
 
-int TCPClientSocket::Write(IOBuffer* buf,
-                           int buf_len,
-                           const CompletionCallback& callback) {
+int TCPClientSocket::Write(
+    IOBuffer* buf,
+    int buf_len,
+    const CompletionCallback& callback,
+    const NetworkTrafficAnnotationTag& traffic_annotation) {
   DCHECK(!callback.is_null());
 
   // |socket_| is owned by this class and the callback won't be run once
   // |socket_| is gone. Therefore, it is safe to use base::Unretained() here.
   CompletionCallback write_callback = base::Bind(
       &TCPClientSocket::DidCompleteWrite, base::Unretained(this), callback);
-  int result = socket_->Write(buf, buf_len, write_callback);
+  int result = socket_->Write(buf, buf_len, write_callback, traffic_annotation);
   if (result > 0)
     use_history_.set_was_used_to_convey_data();
 
diff --git a/net/socket/tcp_client_socket.h b/net/socket/tcp_client_socket.h
index 8981fb0..06327af2 100644
--- a/net/socket/tcp_client_socket.h
+++ b/net/socket/tcp_client_socket.h
@@ -17,6 +17,7 @@
 #include "net/socket/connection_attempts.h"
 #include "net/socket/stream_socket.h"
 #include "net/socket/tcp_socket.h"
+#include "net/traffic_annotation/network_traffic_annotation.h"
 
 namespace net {
 
@@ -71,9 +72,12 @@
   int ReadIfReady(IOBuffer* buf,
                   int buf_len,
                   const CompletionCallback& callback) override;
+  // TODO(crbug.com/656607): Remove default value.
   int Write(IOBuffer* buf,
             int buf_len,
-            const CompletionCallback& callback) override;
+            const CompletionCallback& callback,
+            const NetworkTrafficAnnotationTag& traffic_annotation =
+                NO_TRAFFIC_ANNOTATION_BUG_656607) override;
   int SetReceiveBufferSize(int32_t size) override;
   int SetSendBufferSize(int32_t size) override;
 
diff --git a/net/socket/tcp_socket_posix.cc b/net/socket/tcp_socket_posix.cc
index b46ccad..6d2743c 100644
--- a/net/socket/tcp_socket_posix.cc
+++ b/net/socket/tcp_socket_posix.cc
@@ -36,6 +36,7 @@
 #include "net/socket/socket_net_log_params.h"
 #include "net/socket/socket_options.h"
 #include "net/socket/socket_posix.h"
+#include "net/traffic_annotation/network_traffic_annotation.h"
 
 // If we don't have a definition for TCPI_OPT_SYN_DATA, create one.
 #if !defined(TCPI_OPT_SYN_DATA)
@@ -340,9 +341,11 @@
   return rv;
 }
 
-int TCPSocketPosix::Write(IOBuffer* buf,
-                          int buf_len,
-                          const CompletionCallback& callback) {
+int TCPSocketPosix::Write(
+    IOBuffer* buf,
+    int buf_len,
+    const CompletionCallback& callback,
+    const NetworkTrafficAnnotationTag& traffic_annotation) {
   DCHECK(socket_);
   DCHECK(!callback.is_null());
 
@@ -357,7 +360,7 @@
   if (use_tcp_fastopen_ && !tcp_fastopen_write_attempted_) {
     rv = TcpFastOpenWrite(buf, buf_len, write_callback);
   } else {
-    rv = socket_->Write(buf, buf_len, write_callback);
+    rv = socket_->Write(buf, buf_len, write_callback, traffic_annotation);
   }
 
   if (rv != ERR_IO_PENDING)
diff --git a/net/socket/tcp_socket_posix.h b/net/socket/tcp_socket_posix.h
index 031dd8c..df1edebf 100644
--- a/net/socket/tcp_socket_posix.h
+++ b/net/socket/tcp_socket_posix.h
@@ -18,6 +18,7 @@
 #include "net/log/net_log_with_source.h"
 #include "net/socket/socket_descriptor.h"
 #include "net/socket/socket_performance_watcher.h"
+#include "net/traffic_annotation/network_traffic_annotation.h"
 
 namespace base {
 class TimeDelta;
@@ -91,7 +92,12 @@
 
   // Writes to the socket.
   // Returns a net error code.
-  int Write(IOBuffer* buf, int buf_len, const CompletionCallback& callback);
+  // TODO(crbug.com/656607): Remove default value.
+  int Write(IOBuffer* buf,
+            int buf_len,
+            const CompletionCallback& callback,
+            const NetworkTrafficAnnotationTag& traffic_annotation =
+                NO_TRAFFIC_ANNOTATION_BUG_656607);
 
   // Copies the local tcp address into |address| and returns a net error code.
   int GetLocalAddress(IPEndPoint* address) const;
diff --git a/net/socket/tcp_socket_win.cc b/net/socket/tcp_socket_win.cc
index 7612291..1b2ddd78 100644
--- a/net/socket/tcp_socket_win.cc
+++ b/net/socket/tcp_socket_win.cc
@@ -519,7 +519,9 @@
 
 int TCPSocketWin::Write(IOBuffer* buf,
                         int buf_len,
-                        const CompletionCallback& callback) {
+                        const CompletionCallback& callback,
+                        const NetworkTrafficAnnotationTag& traffic_annotation) {
+  // TODO(crbug.com/656607): Handle traffic annotation.
   DCHECK_CALLED_ON_VALID_THREAD(thread_checker_);
   DCHECK_NE(socket_, INVALID_SOCKET);
   DCHECK(!waiting_write_);
diff --git a/net/socket/tcp_socket_win.h b/net/socket/tcp_socket_win.h
index 1c1b548..93f8d317 100644
--- a/net/socket/tcp_socket_win.h
+++ b/net/socket/tcp_socket_win.h
@@ -21,6 +21,7 @@
 #include "net/log/net_log_with_source.h"
 #include "net/socket/socket_descriptor.h"
 #include "net/socket/socket_performance_watcher.h"
+#include "net/traffic_annotation/network_traffic_annotation.h"
 
 namespace net {
 
@@ -68,7 +69,12 @@
   int ReadIfReady(IOBuffer* buf,
                   int buf_len,
                   const CompletionCallback& callback);
-  int Write(IOBuffer* buf, int buf_len, const CompletionCallback& callback);
+  // TODO(crbug.com/656607): Remove default value.
+  int Write(IOBuffer* buf,
+            int buf_len,
+            const CompletionCallback& callback,
+            const NetworkTrafficAnnotationTag& traffic_annotation =
+                NO_TRAFFIC_ANNOTATION_BUG_656607);
 
   int GetLocalAddress(IPEndPoint* address) const;
   int GetPeerAddress(IPEndPoint* address) const;
diff --git a/net/socket/transport_client_socket_pool_test_util.cc b/net/socket/transport_client_socket_pool_test_util.cc
index 361d7f8..020acf1 100644
--- a/net/socket/transport_client_socket_pool_test_util.cc
+++ b/net/socket/transport_client_socket_pool_test_util.cc
@@ -25,6 +25,7 @@
 #include "net/socket/client_socket_handle.h"
 #include "net/socket/datagram_client_socket.h"
 #include "net/socket/ssl_client_socket.h"
+#include "net/traffic_annotation/network_traffic_annotation_test_helper.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
 namespace net {
@@ -94,7 +95,8 @@
   }
   int Write(IOBuffer* buf,
             int buf_len,
-            const CompletionCallback& callback) override {
+            const CompletionCallback& callback,
+            const NetworkTrafficAnnotationTag& traffic_annotation) override {
     return ERR_FAILED;
   }
   int SetReceiveBufferSize(int32_t size) override { return OK; }
@@ -159,7 +161,8 @@
 
   int Write(IOBuffer* buf,
             int buf_len,
-            const CompletionCallback& callback) override {
+            const CompletionCallback& callback,
+            const NetworkTrafficAnnotationTag& traffic_annotation) override {
     return ERR_FAILED;
   }
   int SetReceiveBufferSize(int32_t size) override { return OK; }
@@ -286,7 +289,8 @@
 
   int Write(IOBuffer* buf,
             int buf_len,
-            const CompletionCallback& callback) override {
+            const CompletionCallback& callback,
+            const NetworkTrafficAnnotationTag& traffic_annotation) override {
     return ERR_FAILED;
   }
   int SetReceiveBufferSize(int32_t size) override { return OK; }
diff --git a/net/socket/udp_client_socket.cc b/net/socket/udp_client_socket.cc
index aac8ae06..4a1861d 100644
--- a/net/socket/udp_client_socket.cc
+++ b/net/socket/udp_client_socket.cc
@@ -5,6 +5,7 @@
 #include "net/socket/udp_client_socket.h"
 
 #include "net/base/net_errors.h"
+#include "net/traffic_annotation/network_traffic_annotation.h"
 
 namespace net {
 
@@ -81,10 +82,12 @@
   return socket_.Read(buf, buf_len, callback);
 }
 
-int UDPClientSocket::Write(IOBuffer* buf,
-                          int buf_len,
-                          const CompletionCallback& callback) {
-  return socket_.Write(buf, buf_len, callback);
+int UDPClientSocket::Write(
+    IOBuffer* buf,
+    int buf_len,
+    const CompletionCallback& callback,
+    const NetworkTrafficAnnotationTag& traffic_annotation) {
+  return socket_.Write(buf, buf_len, callback, traffic_annotation);
 }
 
 void UDPClientSocket::Close() {
diff --git a/net/socket/udp_client_socket.h b/net/socket/udp_client_socket.h
index 1a7adc4..20b604a 100644
--- a/net/socket/udp_client_socket.h
+++ b/net/socket/udp_client_socket.h
@@ -12,6 +12,7 @@
 #include "net/base/rand_callback.h"
 #include "net/socket/datagram_client_socket.h"
 #include "net/socket/udp_socket.h"
+#include "net/traffic_annotation/network_traffic_annotation.h"
 
 namespace net {
 
@@ -36,9 +37,12 @@
   int Read(IOBuffer* buf,
            int buf_len,
            const CompletionCallback& callback) override;
+  // TODO(crbug.com/656607): Remove default value.
   int Write(IOBuffer* buf,
             int buf_len,
-            const CompletionCallback& callback) override;
+            const CompletionCallback& callback,
+            const NetworkTrafficAnnotationTag& traffic_annotation =
+                NO_TRAFFIC_ANNOTATION_BUG_656607) override;
   void Close() override;
   int GetPeerAddress(IPEndPoint* address) const override;
   int GetLocalAddress(IPEndPoint* address) const override;
diff --git a/net/socket/udp_socket_posix.cc b/net/socket/udp_socket_posix.cc
index b0dfc16e..afe73fe8 100644
--- a/net/socket/udp_socket_posix.cc
+++ b/net/socket/udp_socket_posix.cc
@@ -36,6 +36,7 @@
 #include "net/socket/socket_descriptor.h"
 #include "net/socket/socket_options.h"
 #include "net/socket/udp_net_log_parameters.h"
+#include "net/traffic_annotation/network_traffic_annotation.h"
 
 #if defined(OS_ANDROID)
 #include <dlfcn.h>
@@ -408,9 +409,11 @@
   return ERR_IO_PENDING;
 }
 
-int UDPSocketPosix::Write(IOBuffer* buf,
-                          int buf_len,
-                          const CompletionCallback& callback) {
+int UDPSocketPosix::Write(
+    IOBuffer* buf,
+    int buf_len,
+    const CompletionCallback& callback,
+    const NetworkTrafficAnnotationTag& traffic_annotation) {
   return SendToOrWrite(buf, buf_len, NULL, callback);
 }
 
diff --git a/net/socket/udp_socket_posix.h b/net/socket/udp_socket_posix.h
index e094c43..31bf605 100644
--- a/net/socket/udp_socket_posix.h
+++ b/net/socket/udp_socket_posix.h
@@ -25,6 +25,7 @@
 #include "net/socket/datagram_socket.h"
 #include "net/socket/diff_serv_code_point.h"
 #include "net/socket/socket_descriptor.h"
+#include "net/traffic_annotation/network_traffic_annotation.h"
 
 namespace net {
 
@@ -126,7 +127,12 @@
   // Writes to the socket.
   // Only usable from the client-side of a UDP socket, after the socket
   // has been connected.
-  int Write(IOBuffer* buf, int buf_len, const CompletionCallback& callback);
+  // TODO(crbug.com/656607): Remove default value.
+  int Write(IOBuffer* buf,
+            int buf_len,
+            const CompletionCallback& callback,
+            const NetworkTrafficAnnotationTag& traffic_annotation =
+                NO_TRAFFIC_ANNOTATION_BUG_656607);
 
   // Reads from a socket and receive sender address information.
   // |buf| is the buffer to read data into.
diff --git a/net/socket/udp_socket_win.cc b/net/socket/udp_socket_win.cc
index e030cdc9..72841a1 100644
--- a/net/socket/udp_socket_win.cc
+++ b/net/socket/udp_socket_win.cc
@@ -30,6 +30,7 @@
 #include "net/socket/socket_descriptor.h"
 #include "net/socket/socket_options.h"
 #include "net/socket/udp_net_log_parameters.h"
+#include "net/traffic_annotation/network_traffic_annotation.h"
 
 namespace {
 
@@ -407,7 +408,9 @@
 
 int UDPSocketWin::Write(IOBuffer* buf,
                         int buf_len,
-                        const CompletionCallback& callback) {
+                        const CompletionCallback& callback,
+                        const NetworkTrafficAnnotationTag& traffic_annotation) {
+  // TODO(crbug.com/656607): Handle traffic annotation.
   return SendToOrWrite(buf, buf_len, remote_address_.get(), callback);
 }
 
diff --git a/net/socket/udp_socket_win.h b/net/socket/udp_socket_win.h
index 8af9850..1de52c5 100644
--- a/net/socket/udp_socket_win.h
+++ b/net/socket/udp_socket_win.h
@@ -28,6 +28,7 @@
 #include "net/log/net_log_with_source.h"
 #include "net/socket/datagram_socket.h"
 #include "net/socket/diff_serv_code_point.h"
+#include "net/traffic_annotation/network_traffic_annotation.h"
 
 namespace net {
 
@@ -87,7 +88,12 @@
   // Writes to the socket.
   // Only usable from the client-side of a UDP socket, after the socket
   // has been connected.
-  int Write(IOBuffer* buf, int buf_len, const CompletionCallback& callback);
+  // TODO(crbug.com/656607): Remove default value.
+  int Write(IOBuffer* buf,
+            int buf_len,
+            const CompletionCallback& callback,
+            const NetworkTrafficAnnotationTag& traffic_annotation =
+                NO_TRAFFIC_ANNOTATION_BUG_656607);
 
   // Reads from a socket and receive sender address information.
   // |buf| is the buffer to read data into.
diff --git a/net/socket/unix_domain_client_socket_posix.cc b/net/socket/unix_domain_client_socket_posix.cc
index 037b072..27de3bb 100644
--- a/net/socket/unix_domain_client_socket_posix.cc
+++ b/net/socket/unix_domain_client_socket_posix.cc
@@ -12,6 +12,7 @@
 #include "net/base/net_errors.h"
 #include "net/base/sockaddr_storage.h"
 #include "net/socket/socket_posix.h"
+#include "net/traffic_annotation/network_traffic_annotation.h"
 
 namespace net {
 
@@ -160,10 +161,13 @@
   return socket_->Read(buf, buf_len, callback);
 }
 
-int UnixDomainClientSocket::Write(IOBuffer* buf, int buf_len,
-                                  const CompletionCallback& callback) {
+int UnixDomainClientSocket::Write(
+    IOBuffer* buf,
+    int buf_len,
+    const CompletionCallback& callback,
+    const NetworkTrafficAnnotationTag& traffic_annotation) {
   DCHECK(socket_);
-  return socket_->Write(buf, buf_len, callback);
+  return socket_->Write(buf, buf_len, callback, traffic_annotation);
 }
 
 int UnixDomainClientSocket::SetReceiveBufferSize(int32_t size) {
diff --git a/net/socket/unix_domain_client_socket_posix.h b/net/socket/unix_domain_client_socket_posix.h
index 47fb4fe..50d8ae2 100644
--- a/net/socket/unix_domain_client_socket_posix.h
+++ b/net/socket/unix_domain_client_socket_posix.h
@@ -16,6 +16,7 @@
 #include "net/log/net_log_with_source.h"
 #include "net/socket/socket_descriptor.h"
 #include "net/socket/stream_socket.h"
+#include "net/traffic_annotation/network_traffic_annotation.h"
 
 namespace net {
 
@@ -64,9 +65,12 @@
   int Read(IOBuffer* buf,
            int buf_len,
            const CompletionCallback& callback) override;
+  // TODO(crbug.com/656607): Remove default value.
   int Write(IOBuffer* buf,
             int buf_len,
-            const CompletionCallback& callback) override;
+            const CompletionCallback& callback,
+            const NetworkTrafficAnnotationTag& traffic_annotation =
+                NO_TRAFFIC_ANNOTATION_BUG_656607) override;
   int SetReceiveBufferSize(int32_t size) override;
   int SetSendBufferSize(int32_t size) override;
 
diff --git a/net/socket/websocket_endpoint_lock_manager_unittest.cc b/net/socket/websocket_endpoint_lock_manager_unittest.cc
index e7143ce..07c56b4 100644
--- a/net/socket/websocket_endpoint_lock_manager_unittest.cc
+++ b/net/socket/websocket_endpoint_lock_manager_unittest.cc
@@ -16,6 +16,7 @@
 #include "net/socket/socket_test_util.h"
 #include "net/socket/stream_socket.h"
 #include "net/test/gtest_util.h"
+#include "net/traffic_annotation/network_traffic_annotation.h"
 #include "testing/gmock/include/gmock/gmock.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
@@ -82,7 +83,8 @@
 
   int Write(IOBuffer* buf,
             int buf_len,
-            const CompletionCallback& callback) override {
+            const CompletionCallback& callback,
+            const NetworkTrafficAnnotationTag& traffic_annotation) override {
     return ERR_FAILED;
   }
 
diff --git a/net/spdy/chromium/spdy_proxy_client_socket.cc b/net/spdy/chromium/spdy_proxy_client_socket.cc
index fb1168a..01a92bd 100644
--- a/net/spdy/chromium/spdy_proxy_client_socket.cc
+++ b/net/spdy/chromium/spdy_proxy_client_socket.cc
@@ -26,6 +26,7 @@
 #include "net/log/net_log_event_type.h"
 #include "net/log/net_log_source_type.h"
 #include "net/spdy/chromium/spdy_http_utils.h"
+#include "net/traffic_annotation/network_traffic_annotation.h"
 #include "url/gurl.h"
 
 namespace net {
@@ -219,8 +220,11 @@
   return read_buffer_queue_.Dequeue(data, len);
 }
 
-int SpdyProxyClientSocket::Write(IOBuffer* buf, int buf_len,
-                                 const CompletionCallback& callback) {
+int SpdyProxyClientSocket::Write(
+    IOBuffer* buf,
+    int buf_len,
+    const CompletionCallback& callback,
+    const NetworkTrafficAnnotationTag& traffic_annotation) {
   DCHECK(write_callback_.is_null());
   if (next_state_ != STATE_OPEN)
     return ERR_SOCKET_NOT_CONNECTED;
diff --git a/net/spdy/chromium/spdy_proxy_client_socket.h b/net/spdy/chromium/spdy_proxy_client_socket.h
index 60c095a..2f510fe5 100644
--- a/net/spdy/chromium/spdy_proxy_client_socket.h
+++ b/net/spdy/chromium/spdy_proxy_client_socket.h
@@ -31,6 +31,7 @@
 #include "net/spdy/chromium/spdy_stream.h"
 #include "net/spdy/core/spdy_protocol.h"
 #include "net/spdy/platform/api/spdy_string.h"
+#include "net/traffic_annotation/network_traffic_annotation.h"
 
 namespace net {
 
@@ -83,9 +84,12 @@
   int Read(IOBuffer* buf,
            int buf_len,
            const CompletionCallback& callback) override;
+  // TODO(crbug.com/656607): Remove default value.
   int Write(IOBuffer* buf,
             int buf_len,
-            const CompletionCallback& callback) override;
+            const CompletionCallback& callback,
+            const NetworkTrafficAnnotationTag& traffic_annotation =
+                NO_TRAFFIC_ANNOTATION_BUG_656607) override;
   int SetReceiveBufferSize(int32_t size) override;
   int SetSendBufferSize(int32_t size) override;
   int GetPeerAddress(IPEndPoint* address) const override;
diff --git a/net/spdy/chromium/spdy_test_util_common.cc b/net/spdy/chromium/spdy_test_util_common.cc
index 0c49f71..c1f7530f 100644
--- a/net/spdy/chromium/spdy_test_util_common.cc
+++ b/net/spdy/chromium/spdy_test_util_common.cc
@@ -31,6 +31,7 @@
 #include "net/spdy/core/spdy_alt_svc_wire_format.h"
 #include "net/spdy/core/spdy_framer.h"
 #include "net/test/gtest_util.h"
+#include "net/traffic_annotation/network_traffic_annotation_test_helper.h"
 #include "net/url_request/url_request_job_factory_impl.h"
 #include "testing/gmock/include/gmock/gmock.h"
 
@@ -539,7 +540,8 @@
 
   int Write(IOBuffer* buf,
             int buf_len,
-            const CompletionCallback& callback) override {
+            const CompletionCallback& callback,
+            const NetworkTrafficAnnotationTag& traffic_annotation) override {
     return ERR_IO_PENDING;
   }
 
diff --git a/net/traffic_annotation/network_traffic_annotation.h b/net/traffic_annotation/network_traffic_annotation.h
index 333e839..15f1aea 100644
--- a/net/traffic_annotation/network_traffic_annotation.h
+++ b/net/traffic_annotation/network_traffic_annotation.h
@@ -276,6 +276,12 @@
   net::DefineNetworkTrafficAnnotation( \
       "missing", "Function called without traffic annotation.")
 
+// TODO(crbug.com/656607): Remove this temporary tag which is only used during
+// refactoring.
+#define NO_TRAFFIC_ANNOTATION_BUG_656607                  \
+  net::DefineNetworkTrafficAnnotation("undefined-656607", \
+                                      "Temporary tag for crbug.com/656607.")
+
 #undef COMPUTE_STRING_HASH
 
 #endif  // NET_TRAFFIC_ANNOTATION_NETWORK_TRAFFIC_ANNOTATION_H_
diff --git a/remoting/base/buffered_socket_writer.cc b/remoting/base/buffered_socket_writer.cc
index c5a9b7b..520f9995 100644
--- a/remoting/base/buffered_socket_writer.cc
+++ b/remoting/base/buffered_socket_writer.cc
@@ -10,6 +10,7 @@
 #include "net/base/io_buffer.h"
 #include "net/base/net_errors.h"
 #include "net/socket/socket.h"
+#include "net/traffic_annotation/network_traffic_annotation.h"
 
 namespace remoting {
 
@@ -18,8 +19,9 @@
 int WriteNetSocket(net::Socket* socket,
                    const scoped_refptr<net::IOBuffer>& buf,
                    int buf_len,
-                   const net::CompletionCallback& callback) {
-  return socket->Write(buf.get(), buf_len, callback);
+                   const net::CompletionCallback& callback,
+                   const net::NetworkTrafficAnnotationTag& traffic_annotation) {
+  return socket->Write(buf.get(), buf_len, callback, traffic_annotation);
 }
 
 }  // namespace
@@ -40,6 +42,7 @@
     net::Socket* socket,
     const WriteFailedCallback& write_failed_callback) {
   std::unique_ptr<BufferedSocketWriter> result(new BufferedSocketWriter());
+  // TODO(crbug.com/656607): Add proper network traffic annotation.
   result->Start(base::Bind(&WriteNetSocket, socket), write_failed_callback);
   return result;
 }
@@ -80,10 +83,12 @@
   base::WeakPtr<BufferedSocketWriter> self = weak_factory_.GetWeakPtr();
   while (self && !write_pending_ && !write_callback_.is_null() &&
          !queue_.empty()) {
+    // TODO(crbug.com/656607): Add proper network traffic annotation.
     int result = write_callback_.Run(
         queue_.front()->data.get(), queue_.front()->data->BytesRemaining(),
         base::Bind(&BufferedSocketWriter::OnWritten,
-                   weak_factory_.GetWeakPtr()));
+                   weak_factory_.GetWeakPtr()),
+        NO_TRAFFIC_ANNOTATION_BUG_656607);
     HandleWriteResult(result);
   }
 }
diff --git a/remoting/base/buffered_socket_writer.h b/remoting/base/buffered_socket_writer.h
index 6c0e99c..9ac6517 100644
--- a/remoting/base/buffered_socket_writer.h
+++ b/remoting/base/buffered_socket_writer.h
@@ -14,6 +14,7 @@
 #include "base/threading/thread_checker.h"
 #include "net/base/completion_callback.h"
 #include "net/base/io_buffer.h"
+#include "net/traffic_annotation/network_traffic_annotation.h"
 
 namespace net {
 class Socket;
@@ -24,9 +25,11 @@
 // BufferedSocketWriter implement write data queue for stream sockets.
 class BufferedSocketWriter {
  public:
-  typedef base::Callback<int(const scoped_refptr<net::IOBuffer>& buf,
-                             int buf_len,
-                             const net::CompletionCallback& callback)>
+  typedef base::Callback<int(
+      const scoped_refptr<net::IOBuffer>& buf,
+      int buf_len,
+      const net::CompletionCallback& callback,
+      const net::NetworkTrafficAnnotationTag& traffic_annotation)>
       WriteCallback;
   typedef base::Callback<void(int)> WriteFailedCallback;
 
diff --git a/remoting/base/buffered_socket_writer_unittest.cc b/remoting/base/buffered_socket_writer_unittest.cc
index 8825f631..854804e 100644
--- a/remoting/base/buffered_socket_writer_unittest.cc
+++ b/remoting/base/buffered_socket_writer_unittest.cc
@@ -13,6 +13,7 @@
 #include "net/base/io_buffer.h"
 #include "net/base/net_errors.h"
 #include "net/socket/socket_test_util.h"
+#include "net/traffic_annotation/network_traffic_annotation_test_helper.h"
 #include "testing/gmock/include/gmock/gmock.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
@@ -26,8 +27,9 @@
 int WriteNetSocket(net::Socket* socket,
                    const scoped_refptr<net::IOBuffer>& buf,
                    int buf_len,
-                   const net::CompletionCallback& callback) {
-  return socket->Write(buf.get(), buf_len, callback);
+                   const net::CompletionCallback& callback,
+                   const net::NetworkTrafficAnnotationTag& traffic_annotation) {
+  return socket->Write(buf.get(), buf_len, callback, traffic_annotation);
 }
 
 class SocketDataProvider: public net::SocketDataProvider {
diff --git a/remoting/protocol/channel_multiplexer.cc b/remoting/protocol/channel_multiplexer.cc
index 8c2879ae..fcaf5533 100644
--- a/remoting/protocol/channel_multiplexer.cc
+++ b/remoting/protocol/channel_multiplexer.cc
@@ -19,6 +19,7 @@
 #include "base/single_thread_task_runner.h"
 #include "base/threading/thread_task_runner_handle.h"
 #include "net/base/net_errors.h"
+#include "net/traffic_annotation/network_traffic_annotation.h"
 #include "remoting/protocol/message_serialization.h"
 #include "remoting/protocol/p2p_stream_socket.h"
 
@@ -109,8 +110,11 @@
   // P2PStreamSocket interface.
   int Read(const scoped_refptr<net::IOBuffer>& buffer, int buffer_len,
            const net::CompletionCallback& callback) override;
-  int Write(const scoped_refptr<net::IOBuffer>& buffer, int buffer_len,
-            const net::CompletionCallback& callback) override;
+  int Write(
+      const scoped_refptr<net::IOBuffer>& buffer,
+      int buffer_len,
+      const net::CompletionCallback& callback,
+      const net::NetworkTrafficAnnotationTag& traffic_annotation) override;
 
  private:
   MuxChannel* channel_;
@@ -237,11 +241,15 @@
 }
 
 int ChannelMultiplexer::MuxSocket::Write(
-    const scoped_refptr<net::IOBuffer>& buffer, int buffer_len,
-    const net::CompletionCallback& callback) {
+    const scoped_refptr<net::IOBuffer>& buffer,
+    int buffer_len,
+    const net::CompletionCallback& callback,
+    const net::NetworkTrafficAnnotationTag& traffic_annotation) {
   DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
   DCHECK(write_callback_.is_null());
 
+  // TODO(crbug.com/656607): Handle traffic annotation.
+
   if (base_channel_error_ != net::OK)
     return base_channel_error_;
 
diff --git a/remoting/protocol/fake_stream_socket.cc b/remoting/protocol/fake_stream_socket.cc
index 43a4160..5a550dc2 100644
--- a/remoting/protocol/fake_stream_socket.cc
+++ b/remoting/protocol/fake_stream_socket.cc
@@ -14,6 +14,7 @@
 #include "net/base/address_list.h"
 #include "net/base/io_buffer.h"
 #include "net/base/net_errors.h"
+#include "net/traffic_annotation/network_traffic_annotation.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
 namespace remoting {
@@ -91,9 +92,11 @@
   }
 }
 
-int FakeStreamSocket::Write(const scoped_refptr<net::IOBuffer>& buf,
-                            int buf_len,
-                            const net::CompletionCallback& callback) {
+int FakeStreamSocket::Write(
+    const scoped_refptr<net::IOBuffer>& buf,
+    int buf_len,
+    const net::CompletionCallback& callback,
+    const net::NetworkTrafficAnnotationTag& traffic_annotation) {
   EXPECT_TRUE(task_runner_->BelongsToCurrentThread());
   EXPECT_FALSE(write_pending_);
 
diff --git a/remoting/protocol/fake_stream_socket.h b/remoting/protocol/fake_stream_socket.h
index 0e53fd77..778dbffe 100644
--- a/remoting/protocol/fake_stream_socket.h
+++ b/remoting/protocol/fake_stream_socket.h
@@ -13,6 +13,7 @@
 #include "base/memory/weak_ptr.h"
 #include "base/optional.h"
 #include "net/base/completion_callback.h"
+#include "net/traffic_annotation/network_traffic_annotation.h"
 #include "remoting/protocol/p2p_stream_socket.h"
 #include "remoting/protocol/stream_channel_factory.h"
 
@@ -73,8 +74,12 @@
   // P2PStreamSocket interface.
   int Read(const scoped_refptr<net::IOBuffer>& buf, int buf_len,
            const net::CompletionCallback& callback) override;
-  int Write(const scoped_refptr<net::IOBuffer>& buf, int buf_len,
-            const net::CompletionCallback& callback) override;
+  // TODO(crbug.com/656607): Remove default value.
+  int Write(const scoped_refptr<net::IOBuffer>& buf,
+            int buf_len,
+            const net::CompletionCallback& callback,
+            const net::NetworkTrafficAnnotationTag& traffic_annotation =
+                NO_TRAFFIC_ANNOTATION_BUG_656607) override;
 
  private:
   void DoAsyncWrite(const scoped_refptr<net::IOBuffer>& buf, int buf_len,
diff --git a/remoting/protocol/p2p_stream_socket.h b/remoting/protocol/p2p_stream_socket.h
index 7f841e1..27b605c 100644
--- a/remoting/protocol/p2p_stream_socket.h
+++ b/remoting/protocol/p2p_stream_socket.h
@@ -6,6 +6,7 @@
 #define REMOTING_PROTOCOL_P2P_STREAM_SOCKET_H_
 
 #include "net/base/completion_callback.h"
+#include "net/traffic_annotation/network_traffic_annotation.h"
 
 namespace net {
 class IOBuffer;
@@ -39,8 +40,12 @@
   // the callback is invoked or the socket is closed. Implementations of this
   // method should not modify the contents of the actual buffer that is written
   // to the socket.
-  virtual int Write(const scoped_refptr<net::IOBuffer>& buf, int buf_len,
-                    const net::CompletionCallback& callback) = 0;
+  // TODO(crbug.com/656607): Remove default value.
+  virtual int Write(const scoped_refptr<net::IOBuffer>& buf,
+                    int buf_len,
+                    const net::CompletionCallback& callback,
+                    const net::NetworkTrafficAnnotationTag& traffic_annotation =
+                        NO_TRAFFIC_ANNOTATION_BUG_656607) = 0;
 };
 
 }  // namespace protocol
diff --git a/remoting/protocol/pseudotcp_adapter.cc b/remoting/protocol/pseudotcp_adapter.cc
index ed2b836..ff854123 100644
--- a/remoting/protocol/pseudotcp_adapter.cc
+++ b/remoting/protocol/pseudotcp_adapter.cc
@@ -17,6 +17,7 @@
 #include "net/base/completion_callback.h"
 #include "net/base/io_buffer.h"
 #include "net/base/net_errors.h"
+#include "net/traffic_annotation/network_traffic_annotation.h"
 #include "remoting/protocol/p2p_datagram_socket.h"
 
 using cricket::PseudoTcp;
@@ -466,10 +467,13 @@
   return core_->Read(buffer, buffer_size, callback);
 }
 
-int PseudoTcpAdapter::Write(const scoped_refptr<net::IOBuffer>& buffer,
-                            int buffer_size,
-                            const net::CompletionCallback& callback) {
+int PseudoTcpAdapter::Write(
+    const scoped_refptr<net::IOBuffer>& buffer,
+    int buffer_size,
+    const net::CompletionCallback& callback,
+    const net::NetworkTrafficAnnotationTag& traffic_annotation) {
   DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
+  // TODO(crbug.com/656607): Handle traffic annotation.
   return core_->Write(buffer, buffer_size, callback);
 }
 
diff --git a/remoting/protocol/pseudotcp_adapter.h b/remoting/protocol/pseudotcp_adapter.h
index 93e1ac7..3f89b78 100644
--- a/remoting/protocol/pseudotcp_adapter.h
+++ b/remoting/protocol/pseudotcp_adapter.h
@@ -14,6 +14,7 @@
 #include "base/memory/ref_counted.h"
 #include "base/sequence_checker.h"
 #include "net/log/net_log_with_source.h"
+#include "net/traffic_annotation/network_traffic_annotation.h"
 #include "remoting/protocol/p2p_stream_socket.h"
 #include "third_party/webrtc/p2p/base/pseudotcp.h"
 
@@ -35,8 +36,12 @@
   // P2PStreamSocket implementation.
   int Read(const scoped_refptr<net::IOBuffer>& buffer, int buffer_size,
            const net::CompletionCallback& callback) override;
-  int Write(const scoped_refptr<net::IOBuffer>& buffer, int buffer_size,
-            const net::CompletionCallback& callback) override;
+  // TODO(crbug.com/656607): Remove default value.
+  int Write(const scoped_refptr<net::IOBuffer>& buffer,
+            int buffer_size,
+            const net::CompletionCallback& callback,
+            const net::NetworkTrafficAnnotationTag& traffic_annotation =
+                NO_TRAFFIC_ANNOTATION_BUG_656607) override;
 
   int Connect(const net::CompletionCallback& callback);
 
diff --git a/remoting/protocol/ssl_hmac_channel_authenticator.cc b/remoting/protocol/ssl_hmac_channel_authenticator.cc
index 226c9283..ee703db 100644
--- a/remoting/protocol/ssl_hmac_channel_authenticator.cc
+++ b/remoting/protocol/ssl_hmac_channel_authenticator.cc
@@ -34,6 +34,7 @@
 #include "net/socket/ssl_server_socket.h"
 #include "net/ssl/ssl_config_service.h"
 #include "net/ssl/ssl_server_config.h"
+#include "net/traffic_annotation/network_traffic_annotation.h"
 #include "remoting/base/rsa_key_pair.h"
 #include "remoting/protocol/auth_util.h"
 #include "remoting/protocol/p2p_stream_socket.h"
@@ -93,9 +94,13 @@
            const net::CompletionCallback& callback) override {
     return socket_->Read(buf, buf_len, callback);
   }
-  int Write(net::IOBuffer* buf, int buf_len,
-            const net::CompletionCallback& callback) override {
-    return socket_->Write(buf, buf_len, callback);
+  // TODO(crbug.com/656607): Remove default value.
+  int Write(net::IOBuffer* buf,
+            int buf_len,
+            const net::CompletionCallback& callback,
+            const net::NetworkTrafficAnnotationTag& traffic_annotation =
+                NO_TRAFFIC_ANNOTATION_BUG_656607) override {
+    return socket_->Write(buf, buf_len, callback, traffic_annotation);
   }
 
   int SetReceiveBufferSize(int32_t size) override {
@@ -174,9 +179,12 @@
            const net::CompletionCallback& callback) override {
     return socket_->Read(buf.get(), buf_len, callback);
   }
-  int Write(const scoped_refptr<net::IOBuffer>& buf, int buf_len,
-            const net::CompletionCallback& callback) override {
-    return socket_->Write(buf.get(), buf_len, callback);
+  int Write(
+      const scoped_refptr<net::IOBuffer>& buf,
+      int buf_len,
+      const net::CompletionCallback& callback,
+      const net::NetworkTrafficAnnotationTag& traffic_annotation) override {
+    return socket_->Write(buf.get(), buf_len, callback, traffic_annotation);
   }
 
  private:
@@ -357,11 +365,12 @@
 void SslHmacChannelAuthenticator::WriteAuthenticationBytes(
     bool* callback_called) {
   while (true) {
+    // TODO(crbug.com/656607): Add proper network traffic annotation.
     int result = socket_->Write(
-        auth_write_buf_.get(),
-        auth_write_buf_->BytesRemaining(),
+        auth_write_buf_.get(), auth_write_buf_->BytesRemaining(),
         base::Bind(&SslHmacChannelAuthenticator::OnAuthBytesWritten,
-                   base::Unretained(this)));
+                   base::Unretained(this)),
+        NO_TRAFFIC_ANNOTATION_BUG_656607);
     if (result == net::ERR_IO_PENDING)
       break;
     if (!HandleAuthBytesWritten(result, callback_called))
diff --git a/third_party/WebKit/Source/core/layout/LayoutBoxModelObject.cpp b/third_party/WebKit/Source/core/layout/LayoutBoxModelObject.cpp
index 84d0be0..6fb1200 100644
--- a/third_party/WebKit/Source/core/layout/LayoutBoxModelObject.cpp
+++ b/third_party/WebKit/Source/core/layout/LayoutBoxModelObject.cpp
@@ -78,27 +78,6 @@
     ContinuationMap;
 static ContinuationMap* g_continuation_map = nullptr;
 
-void LayoutBoxModelObject::SetSelectionState(SelectionState state) {
-  if (state == SelectionState::kInside &&
-      GetSelectionState() != SelectionState::kNone)
-    return;
-
-  if ((state == SelectionState::kStart &&
-       GetSelectionState() == SelectionState::kEnd) ||
-      (state == SelectionState::kEnd &&
-       GetSelectionState() == SelectionState::kStart))
-    LayoutObject::SetSelectionState(SelectionState::kStartAndEnd);
-  else
-    LayoutObject::SetSelectionState(state);
-
-  // FIXME: We should consider whether it is OK propagating to ancestor
-  // LayoutInlines. This is a workaround for http://webkit.org/b/32123
-  // The containing block can be null in case of an orphaned tree.
-  LayoutBlock* containing_block = ContainingBlock();
-  if (containing_block && !containing_block->IsLayoutView())
-    containing_block->SetSelectionState(state);
-}
-
 void LayoutBoxModelObject::ContentChanged(ContentChangeType change_type) {
   if (!HasLayer())
     return;
diff --git a/third_party/WebKit/Source/core/layout/LayoutBoxModelObject.h b/third_party/WebKit/Source/core/layout/LayoutBoxModelObject.h
index beffa6b..c42b905 100644
--- a/third_party/WebKit/Source/core/layout/LayoutBoxModelObject.h
+++ b/third_party/WebKit/Source/core/layout/LayoutBoxModelObject.h
@@ -418,8 +418,6 @@
       const LayoutBoxModelObject* ancestor_to_stop_at,
       LayoutGeometryMap&) const override;
 
-  void SetSelectionState(SelectionState) override;
-
   void ContentChanged(ContentChangeType);
   bool HasAcceleratedCompositing() const;
 
diff --git a/third_party/WebKit/Source/core/layout/LayoutObject.h b/third_party/WebKit/Source/core/layout/LayoutObject.h
index e492dd8..f4788877 100644
--- a/third_party/WebKit/Source/core/layout/LayoutObject.h
+++ b/third_party/WebKit/Source/core/layout/LayoutObject.h
@@ -1484,7 +1484,7 @@
   SelectionState GetSelectionState() const {
     return bitfields_.GetSelectionState();
   }
-  virtual void SetSelectionState(SelectionState state) {
+  void SetSelectionState(SelectionState state) {
     bitfields_.SetSelectionState(state);
   }
   bool CanUpdateSelectionOnRootLineBoxes() const;
diff --git a/third_party/WebKit/Source/core/layout/LayoutText.cpp b/third_party/WebKit/Source/core/layout/LayoutText.cpp
index 0939745..7ccb496 100644
--- a/third_party/WebKit/Source/core/layout/LayoutText.cpp
+++ b/third_party/WebKit/Source/core/layout/LayoutText.cpp
@@ -1444,15 +1444,6 @@
   return first_text_box_ ? first_text_box_->Y().ToFloat() : 0;
 }
 
-void LayoutText::SetSelectionState(SelectionState state) {
-  LayoutObject::SetSelectionState(state);
-
-  // The containing block can be null in case of an orphaned tree.
-  LayoutBlock* containing_block = ContainingBlock();
-  if (containing_block && !containing_block->IsLayoutView())
-    containing_block->SetSelectionState(state);
-}
-
 void LayoutText::SetTextWithOffset(scoped_refptr<StringImpl> text,
                                    unsigned offset,
                                    unsigned len,
diff --git a/third_party/WebKit/Source/core/layout/LayoutText.h b/third_party/WebKit/Source/core/layout/LayoutText.h
index 6b1d2467..206ae493 100644
--- a/third_party/WebKit/Source/core/layout/LayoutText.h
+++ b/third_party/WebKit/Source/core/layout/LayoutText.h
@@ -189,7 +189,6 @@
 
   virtual void TransformText();
 
-  void SetSelectionState(SelectionState) final;
   LayoutRect LocalSelectionRect() const final;
   LayoutRect LocalCaretRect(
       const InlineBox*,
diff --git a/ui/gl/BUILD.gn b/ui/gl/BUILD.gn
index 3103048..c151218 100644
--- a/ui/gl/BUILD.gn
+++ b/ui/gl/BUILD.gn
@@ -433,6 +433,10 @@
     sources += [ "gl_image_ahardwarebuffer_unittest.cc" ]
   }
 
+  if (is_desktop_linux) {
+    sources += [ "gl_image_native_pixmap_unittest.cc" ]
+  }
+
   include_dirs = [ "//third_party/khronos" ]
 
   deps = [
diff --git a/ui/gl/generate_bindings.py b/ui/gl/generate_bindings.py
index 5fd7fc1..4cb9e7e 100755
--- a/ui/gl/generate_bindings.py
+++ b/ui/gl/generate_bindings.py
@@ -1942,6 +1942,16 @@
   'arguments':
       'EGLDisplay dpy, EGLSyncKHR sync' },
 { 'return_type': 'EGLBoolean',
+  'versions': [{ 'name': 'eglExportDMABUFImageMESA',
+                 'extensions': ['EGL_MESA_image_dma_buf_export'] }],
+  'arguments': 'EGLDisplay dpy, EGLImageKHR image, int* fds, EGLint* strides, '
+               'EGLint* offsets', },
+{ 'return_type': 'EGLBoolean',
+  'versions': [{ 'name': 'eglExportDMABUFImageQueryMESA',
+                 'extensions': ['EGL_MESA_image_dma_buf_export'] }],
+  'arguments': 'EGLDisplay dpy, EGLImageKHR image, int* fourcc, '
+               'int* num_planes, EGLuint64KHR* modifiers', },
+{ 'return_type': 'EGLBoolean',
   'versions': [{ 'name': 'eglGetCompositorTimingANDROID',
                  'extensions': [
                    'EGL_ANDROID_get_frame_timestamps'
diff --git a/ui/gl/gl_bindings_api_autogen_egl.h b/ui/gl/gl_bindings_api_autogen_egl.h
index 58873a0..8838da3 100644
--- a/ui/gl/gl_bindings_api_autogen_egl.h
+++ b/ui/gl/gl_bindings_api_autogen_egl.h
@@ -65,6 +65,16 @@
 EGLBoolean eglDestroySurfaceFn(EGLDisplay dpy, EGLSurface surface) override;
 EGLBoolean eglDestroySyncKHRFn(EGLDisplay dpy, EGLSyncKHR sync) override;
 EGLint eglDupNativeFenceFDANDROIDFn(EGLDisplay dpy, EGLSyncKHR sync) override;
+EGLBoolean eglExportDMABUFImageMESAFn(EGLDisplay dpy,
+                                      EGLImageKHR image,
+                                      int* fds,
+                                      EGLint* strides,
+                                      EGLint* offsets) override;
+EGLBoolean eglExportDMABUFImageQueryMESAFn(EGLDisplay dpy,
+                                           EGLImageKHR image,
+                                           int* fourcc,
+                                           int* num_planes,
+                                           EGLuint64KHR* modifiers) override;
 EGLBoolean eglGetCompositorTimingANDROIDFn(EGLDisplay dpy,
                                            EGLSurface surface,
                                            EGLint numTimestamps,
diff --git a/ui/gl/gl_bindings_autogen_egl.cc b/ui/gl/gl_bindings_autogen_egl.cc
index 64b59ee..4a1c1ed 100644
--- a/ui/gl/gl_bindings_autogen_egl.cc
+++ b/ui/gl/gl_bindings_autogen_egl.cc
@@ -161,6 +161,8 @@
   ext.b_EGL_KHR_swap_buffers_with_damage =
       HasExtension(extensions, "EGL_KHR_swap_buffers_with_damage");
   ext.b_EGL_KHR_wait_sync = HasExtension(extensions, "EGL_KHR_wait_sync");
+  ext.b_EGL_MESA_image_dma_buf_export =
+      HasExtension(extensions, "EGL_MESA_image_dma_buf_export");
   ext.b_EGL_NV_post_sub_buffer =
       HasExtension(extensions, "EGL_NV_post_sub_buffer");
   ext.b_EGL_NV_stream_consumer_gltexture_yuv =
@@ -197,6 +199,18 @@
         GetGLProcAddress("eglDestroyStreamKHR"));
   }
 
+  if (ext.b_EGL_MESA_image_dma_buf_export) {
+    fn.eglExportDMABUFImageMESAFn =
+        reinterpret_cast<eglExportDMABUFImageMESAProc>(
+            GetGLProcAddress("eglExportDMABUFImageMESA"));
+  }
+
+  if (ext.b_EGL_MESA_image_dma_buf_export) {
+    fn.eglExportDMABUFImageQueryMESAFn =
+        reinterpret_cast<eglExportDMABUFImageQueryMESAProc>(
+            GetGLProcAddress("eglExportDMABUFImageQueryMESA"));
+  }
+
   if (ext.b_EGL_ANDROID_get_frame_timestamps) {
     fn.eglGetCompositorTimingANDROIDFn =
         reinterpret_cast<eglGetCompositorTimingANDROIDProc>(
@@ -464,6 +478,25 @@
   return driver_->fn.eglDupNativeFenceFDANDROIDFn(dpy, sync);
 }
 
+EGLBoolean EGLApiBase::eglExportDMABUFImageMESAFn(EGLDisplay dpy,
+                                                  EGLImageKHR image,
+                                                  int* fds,
+                                                  EGLint* strides,
+                                                  EGLint* offsets) {
+  return driver_->fn.eglExportDMABUFImageMESAFn(dpy, image, fds, strides,
+                                                offsets);
+}
+
+EGLBoolean EGLApiBase::eglExportDMABUFImageQueryMESAFn(
+    EGLDisplay dpy,
+    EGLImageKHR image,
+    int* fourcc,
+    int* num_planes,
+    EGLuint64KHR* modifiers) {
+  return driver_->fn.eglExportDMABUFImageQueryMESAFn(dpy, image, fourcc,
+                                                     num_planes, modifiers);
+}
+
 EGLBoolean EGLApiBase::eglGetCompositorTimingANDROIDFn(
     EGLDisplay dpy,
     EGLSurface surface,
@@ -916,6 +949,28 @@
   return egl_api_->eglDupNativeFenceFDANDROIDFn(dpy, sync);
 }
 
+EGLBoolean TraceEGLApi::eglExportDMABUFImageMESAFn(EGLDisplay dpy,
+                                                   EGLImageKHR image,
+                                                   int* fds,
+                                                   EGLint* strides,
+                                                   EGLint* offsets) {
+  TRACE_EVENT_BINARY_EFFICIENT0("gpu", "TraceGLAPI::eglExportDMABUFImageMESA")
+  return egl_api_->eglExportDMABUFImageMESAFn(dpy, image, fds, strides,
+                                              offsets);
+}
+
+EGLBoolean TraceEGLApi::eglExportDMABUFImageQueryMESAFn(
+    EGLDisplay dpy,
+    EGLImageKHR image,
+    int* fourcc,
+    int* num_planes,
+    EGLuint64KHR* modifiers) {
+  TRACE_EVENT_BINARY_EFFICIENT0("gpu",
+                                "TraceGLAPI::eglExportDMABUFImageQueryMESA")
+  return egl_api_->eglExportDMABUFImageQueryMESAFn(dpy, image, fourcc,
+                                                   num_planes, modifiers);
+}
+
 EGLBoolean TraceEGLApi::eglGetCompositorTimingANDROIDFn(
     EGLDisplay dpy,
     EGLSurface surface,
@@ -1509,6 +1564,39 @@
   return result;
 }
 
+EGLBoolean DebugEGLApi::eglExportDMABUFImageMESAFn(EGLDisplay dpy,
+                                                   EGLImageKHR image,
+                                                   int* fds,
+                                                   EGLint* strides,
+                                                   EGLint* offsets) {
+  GL_SERVICE_LOG("eglExportDMABUFImageMESA"
+                 << "(" << dpy << ", " << image << ", "
+                 << static_cast<const void*>(fds) << ", "
+                 << static_cast<const void*>(strides) << ", "
+                 << static_cast<const void*>(offsets) << ")");
+  EGLBoolean result =
+      egl_api_->eglExportDMABUFImageMESAFn(dpy, image, fds, strides, offsets);
+  GL_SERVICE_LOG("GL_RESULT: " << result);
+  return result;
+}
+
+EGLBoolean DebugEGLApi::eglExportDMABUFImageQueryMESAFn(
+    EGLDisplay dpy,
+    EGLImageKHR image,
+    int* fourcc,
+    int* num_planes,
+    EGLuint64KHR* modifiers) {
+  GL_SERVICE_LOG("eglExportDMABUFImageQueryMESA"
+                 << "(" << dpy << ", " << image << ", "
+                 << static_cast<const void*>(fourcc) << ", "
+                 << static_cast<const void*>(num_planes) << ", "
+                 << static_cast<const void*>(modifiers) << ")");
+  EGLBoolean result = egl_api_->eglExportDMABUFImageQueryMESAFn(
+      dpy, image, fourcc, num_planes, modifiers);
+  GL_SERVICE_LOG("GL_RESULT: " << result);
+  return result;
+}
+
 EGLBoolean DebugEGLApi::eglGetCompositorTimingANDROIDFn(
     EGLDisplay dpy,
     EGLSurface surface,
diff --git a/ui/gl/gl_bindings_autogen_egl.h b/ui/gl/gl_bindings_autogen_egl.h
index 487a2e3..b171dc8 100644
--- a/ui/gl/gl_bindings_autogen_egl.h
+++ b/ui/gl/gl_bindings_autogen_egl.h
@@ -91,6 +91,18 @@
 typedef EGLint(GL_BINDING_CALL* eglDupNativeFenceFDANDROIDProc)(
     EGLDisplay dpy,
     EGLSyncKHR sync);
+typedef EGLBoolean(GL_BINDING_CALL* eglExportDMABUFImageMESAProc)(
+    EGLDisplay dpy,
+    EGLImageKHR image,
+    int* fds,
+    EGLint* strides,
+    EGLint* offsets);
+typedef EGLBoolean(GL_BINDING_CALL* eglExportDMABUFImageQueryMESAProc)(
+    EGLDisplay dpy,
+    EGLImageKHR image,
+    int* fourcc,
+    int* num_planes,
+    EGLuint64KHR* modifiers);
 typedef EGLBoolean(GL_BINDING_CALL* eglGetCompositorTimingANDROIDProc)(
     EGLDisplay dpy,
     EGLSurface surface,
@@ -277,6 +289,7 @@
   bool b_EGL_KHR_stream_consumer_gltexture;
   bool b_EGL_KHR_swap_buffers_with_damage;
   bool b_EGL_KHR_wait_sync;
+  bool b_EGL_MESA_image_dma_buf_export;
   bool b_EGL_NV_post_sub_buffer;
   bool b_EGL_NV_stream_consumer_gltexture_yuv;
   bool b_GL_CHROMIUM_egl_android_native_fence_sync_hack;
@@ -305,6 +318,8 @@
   eglDestroySurfaceProc eglDestroySurfaceFn;
   eglDestroySyncKHRProc eglDestroySyncKHRFn;
   eglDupNativeFenceFDANDROIDProc eglDupNativeFenceFDANDROIDFn;
+  eglExportDMABUFImageMESAProc eglExportDMABUFImageMESAFn;
+  eglExportDMABUFImageQueryMESAProc eglExportDMABUFImageQueryMESAFn;
   eglGetCompositorTimingANDROIDProc eglGetCompositorTimingANDROIDFn;
   eglGetCompositorTimingSupportedANDROIDProc
       eglGetCompositorTimingSupportedANDROIDFn;
@@ -428,6 +443,17 @@
   virtual EGLBoolean eglDestroySyncKHRFn(EGLDisplay dpy, EGLSyncKHR sync) = 0;
   virtual EGLint eglDupNativeFenceFDANDROIDFn(EGLDisplay dpy,
                                               EGLSyncKHR sync) = 0;
+  virtual EGLBoolean eglExportDMABUFImageMESAFn(EGLDisplay dpy,
+                                                EGLImageKHR image,
+                                                int* fds,
+                                                EGLint* strides,
+                                                EGLint* offsets) = 0;
+  virtual EGLBoolean eglExportDMABUFImageQueryMESAFn(
+      EGLDisplay dpy,
+      EGLImageKHR image,
+      int* fourcc,
+      int* num_planes,
+      EGLuint64KHR* modifiers) = 0;
   virtual EGLBoolean eglGetCompositorTimingANDROIDFn(
       EGLDisplay dpy,
       EGLSurface surface,
@@ -607,6 +633,10 @@
 #define eglDestroySyncKHR ::gl::g_current_egl_context->eglDestroySyncKHRFn
 #define eglDupNativeFenceFDANDROID \
   ::gl::g_current_egl_context->eglDupNativeFenceFDANDROIDFn
+#define eglExportDMABUFImageMESA \
+  ::gl::g_current_egl_context->eglExportDMABUFImageMESAFn
+#define eglExportDMABUFImageQueryMESA \
+  ::gl::g_current_egl_context->eglExportDMABUFImageQueryMESAFn
 #define eglGetCompositorTimingANDROID \
   ::gl::g_current_egl_context->eglGetCompositorTimingANDROIDFn
 #define eglGetCompositorTimingSupportedANDROID \
diff --git a/ui/gl/gl_image_ahardwarebuffer_unittest.cc b/ui/gl/gl_image_ahardwarebuffer_unittest.cc
index 1332dd74..6986a0e4 100644
--- a/ui/gl/gl_image_ahardwarebuffer_unittest.cc
+++ b/ui/gl/gl_image_ahardwarebuffer_unittest.cc
@@ -78,8 +78,8 @@
     auto image = base::MakeRefCounted<GLImageAHardwareBuffer>(size);
     EGLint attribs[] = {EGL_IMAGE_PRESERVED_KHR, EGL_TRUE, EGL_NONE};
     EGLClientBuffer client_buffer = eglGetNativeClientBufferANDROID(buffer);
-    bool rv =
-        image->Initialize(EGL_NATIVE_BUFFER_ANDROID, client_buffer, attribs);
+    bool rv = image->Initialize(EGL_NO_CONTEXT, EGL_NATIVE_BUFFER_ANDROID,
+                                client_buffer, attribs);
     EXPECT_TRUE(rv);
     return image;
   }
diff --git a/ui/gl/gl_image_egl.cc b/ui/gl/gl_image_egl.cc
index b95e287..c70202c 100644
--- a/ui/gl/gl_image_egl.cc
+++ b/ui/gl/gl_image_egl.cc
@@ -24,13 +24,14 @@
   }
 }
 
-bool GLImageEGL::Initialize(EGLenum target,
+bool GLImageEGL::Initialize(EGLContext context,
+                            EGLenum target,
                             EGLClientBuffer buffer,
                             const EGLint* attrs) {
   DCHECK(thread_checker_.CalledOnValidThread());
   DCHECK_EQ(EGL_NO_IMAGE_KHR, egl_image_);
-  egl_image_ = eglCreateImageKHR(GLSurfaceEGL::GetHardwareDisplay(),
-                                 EGL_NO_CONTEXT, target, buffer, attrs);
+  egl_image_ = eglCreateImageKHR(GLSurfaceEGL::GetHardwareDisplay(), context,
+                                 target, buffer, attrs);
   if (egl_image_ == EGL_NO_IMAGE_KHR) {
     LOG(ERROR) << "Error creating EGLImage: " << ui::GetLastEGLErrorString();
     return false;
diff --git a/ui/gl/gl_image_egl.h b/ui/gl/gl_image_egl.h
index 4ebc3d7..6a23ba35 100644
--- a/ui/gl/gl_image_egl.h
+++ b/ui/gl/gl_image_egl.h
@@ -18,7 +18,19 @@
  public:
   explicit GLImageEGL(const gfx::Size& size);
 
-  bool Initialize(EGLenum target, EGLClientBuffer buffer, const EGLint* attrs);
+  // Same semantic as specified for eglCreateImageKHR. There two main usages:
+  // 1- When using the |target| EGL_GL_TEXTURE_2D_KHR it is required to pass
+  // a valid |context|. This allows to create an EGLImage from a GL texture.
+  // Then this EGLImage can be converted to an external resource to be shared
+  // with other client APIs.
+  // 2- When using the |target| EGL_NATIVE_PIXMAP_KHR or EGL_LINUX_DMA_BUF_EXT
+  // it is required to pass EGL_NO_CONTEXT. This allows to create an EGLImage
+  // from an external resource. Then this EGLImage can be converted to a GL
+  // texture.
+  bool Initialize(EGLContext context,
+                  EGLenum target,
+                  EGLClientBuffer buffer,
+                  const EGLint* attrs);
 
   // Overridden from GLImage:
   gfx::Size GetSize() override;
diff --git a/ui/gl/gl_image_native_pixmap.cc b/ui/gl/gl_image_native_pixmap.cc
index fdfd1d48..956cd64 100644
--- a/ui/gl/gl_image_native_pixmap.cc
+++ b/ui/gl/gl_image_native_pixmap.cc
@@ -7,6 +7,8 @@
 #include <vector>
 
 #include "ui/gfx/buffer_format_util.h"
+#include "ui/gl/egl_util.h"
+#include "ui/gl/gl_context.h"
 #include "ui/gl/gl_surface_egl.h"
 
 #define FOURCC(a, b, c, d)                                        \
@@ -123,6 +125,34 @@
   return 0;
 }
 
+gfx::BufferFormat GetBufferFormatFromFourCCFormat(int format) {
+  switch (format) {
+    case DRM_FORMAT_R8:
+      return gfx::BufferFormat::R_8;
+    case DRM_FORMAT_GR88:
+      return gfx::BufferFormat::RG_88;
+    case DRM_FORMAT_ABGR8888:
+      return gfx::BufferFormat::RGBA_8888;
+    case DRM_FORMAT_XBGR8888:
+      return gfx::BufferFormat::RGBX_8888;
+    case DRM_FORMAT_ARGB8888:
+      return gfx::BufferFormat::BGRA_8888;
+    case DRM_FORMAT_XRGB8888:
+      return gfx::BufferFormat::BGRX_8888;
+    case DRM_FORMAT_XRGB2101010:
+      return gfx::BufferFormat::BGRX_1010102;
+    case DRM_FORMAT_RGB565:
+      return gfx::BufferFormat::BGR_565;
+    case DRM_FORMAT_NV12:
+      return gfx::BufferFormat::YUV_420_BIPLANAR;
+    case DRM_FORMAT_YVU420:
+      return gfx::BufferFormat::YVU_420;
+    default:
+      NOTREACHED();
+      return gfx::BufferFormat::BGRA_8888;
+  }
+}
+
 }  // namespace
 
 GLImageNativePixmap::GLImageNativePixmap(const gfx::Size& size,
@@ -130,7 +160,9 @@
     : GLImageEGL(size),
       internalformat_(internalformat),
       has_image_flush_external_(
-          gl::GLSurfaceEGL::HasEGLExtension("EGL_EXT_image_flush_external")) {}
+          gl::GLSurfaceEGL::HasEGLExtension("EGL_EXT_image_flush_external")),
+      has_image_dma_buf_export_(
+          gl::GLSurfaceEGL::HasEGLExtension("EGL_MESA_image_dma_buf_export")) {}
 
 GLImageNativePixmap::~GLImageNativePixmap() {}
 
@@ -139,7 +171,7 @@
   DCHECK(!pixmap_);
   if (pixmap->GetEGLClientBuffer()) {
     EGLint attrs[] = {EGL_IMAGE_PRESERVED_KHR, EGL_TRUE, EGL_NONE};
-    if (!GLImageEGL::Initialize(EGL_NATIVE_PIXMAP_KHR,
+    if (!GLImageEGL::Initialize(EGL_NO_CONTEXT, EGL_NATIVE_PIXMAP_KHR,
                                 pixmap->GetEGLClientBuffer(), attrs)) {
       return false;
     }
@@ -196,7 +228,7 @@
     }
     attrs.push_back(EGL_NONE);
 
-    if (!GLImageEGL::Initialize(EGL_LINUX_DMA_BUF_EXT,
+    if (!GLImageEGL::Initialize(EGL_NO_CONTEXT, EGL_LINUX_DMA_BUF_EXT,
                                 static_cast<EGLClientBuffer>(nullptr),
                                 &attrs[0])) {
       return false;
@@ -207,6 +239,93 @@
   return true;
 }
 
+gfx::NativePixmapHandle GLImageNativePixmap::ExportHandle() {
+  DCHECK(!pixmap_);
+  DCHECK(thread_checker_.CalledOnValidThread());
+
+  // Must use GLImageEGL::Initialize.
+  if (egl_image_ == EGL_NO_IMAGE_KHR) {
+    LOG(ERROR) << "GLImageEGL is not initialized";
+    return gfx::NativePixmapHandle();
+  }
+
+  if (!has_image_dma_buf_export_) {
+    LOG(ERROR) << "Error no extension EGL_MESA_image_dma_buf_export";
+    return gfx::NativePixmapHandle();
+  }
+
+  int fourcc = 0;
+  int num_planes = 0;
+  EGLuint64KHR modifiers = 0;
+
+  if (!eglExportDMABUFImageQueryMESA(GLSurfaceEGL::GetHardwareDisplay(),
+                                     egl_image_, &fourcc, &num_planes,
+                                     &modifiers)) {
+    LOG(ERROR) << "Error querying EGLImage: " << ui::GetLastEGLErrorString();
+    return gfx::NativePixmapHandle();
+  }
+
+  if (num_planes <= 0 || num_planes > 4) {
+    LOG(ERROR) << "Invalid number of planes: " << num_planes;
+    return gfx::NativePixmapHandle();
+  }
+
+  gfx::BufferFormat format = GetBufferFormatFromFourCCFormat(fourcc);
+  if (num_planes > 0 && static_cast<size_t>(num_planes) !=
+                            gfx::NumberOfPlanesForBufferFormat(format)) {
+    LOG(ERROR) << "Invalid number of planes: " << num_planes
+               << " for format: " << static_cast<int>(format);
+    return gfx::NativePixmapHandle();
+  }
+
+  if (!ValidInternalFormat(internalformat_, format)) {
+    // A driver has returned a format different than what has been requested.
+    // This can happen if RGBX is implemented using RGBA. Otherwise there is
+    // a real mistake from the user and we have to fail.
+    if (internalformat_ == GL_RGB && format != gfx::BufferFormat::RGBA_8888) {
+      LOG(ERROR) << "Invalid internalformat: 0x" << std::hex << internalformat_
+                 << " for format: " << static_cast<int>(format);
+      return gfx::NativePixmapHandle();
+    }
+  }
+
+  std::vector<int> fds(num_planes);
+  std::vector<EGLint> strides(num_planes);
+  std::vector<EGLint> offsets(num_planes);
+
+  // It is specified for eglExportDMABUFImageMESA that the app is responsible
+  // for closing any fds retrieved.
+  if (!eglExportDMABUFImageMESA(GLSurfaceEGL::GetHardwareDisplay(), egl_image_,
+                                &fds[0], &strides[0], &offsets[0])) {
+    LOG(ERROR) << "Error exporting EGLImage: " << ui::GetLastEGLErrorString();
+    return gfx::NativePixmapHandle();
+  }
+
+  gfx::NativePixmapHandle handle;
+
+  for (int i = 0; i < num_planes; ++i) {
+    // Sanity check. In principle all the fds are meant to be valid when
+    // eglExportDMABUFImageMESA succeeds.
+    base::ScopedFD scoped_fd(fds[i]);
+    if (!scoped_fd.is_valid()) {
+      LOG(ERROR) << "Invalid dmabuf";
+      return gfx::NativePixmapHandle();
+    }
+
+    // scoped_fd.release() transfers ownership to the caller so it will not
+    // call close when going out of scope. base::FileDescriptor never closes
+    // the fd when going out of scope. The auto_close flag is just a hint for
+    // the user. When true it means the user has ownership of it so he is
+    // responsible for closing the fd.
+    handle.fds.emplace_back(
+        base::FileDescriptor(scoped_fd.release(), true /* auto_close */));
+    handle.planes.emplace_back(strides[i], offsets[i], 0 /* size opaque */,
+                               modifiers);
+  }
+
+  return handle;
+}
+
 unsigned GLImageNativePixmap::GetInternalFormat() {
   return internalformat_;
 }
diff --git a/ui/gl/gl_image_native_pixmap.h b/ui/gl/gl_image_native_pixmap.h
index 837a4b0..d8987691 100644
--- a/ui/gl/gl_image_native_pixmap.h
+++ b/ui/gl/gl_image_native_pixmap.h
@@ -20,6 +20,7 @@
   GLImageNativePixmap(const gfx::Size& size, unsigned internalformat);
 
   bool Initialize(gfx::NativePixmap* pixmap, gfx::BufferFormat format);
+  gfx::NativePixmapHandle ExportHandle();
 
   // Overridden from GLImage:
   unsigned GetInternalFormat() override;
@@ -47,6 +48,7 @@
   unsigned internalformat_;
   scoped_refptr<gfx::NativePixmap> pixmap_;
   bool has_image_flush_external_;
+  bool has_image_dma_buf_export_;
 };
 
 }  // namespace gl
diff --git a/ui/gl/gl_image_native_pixmap_unittest.cc b/ui/gl/gl_image_native_pixmap_unittest.cc
new file mode 100644
index 0000000..bc8107ec
--- /dev/null
+++ b/ui/gl/gl_image_native_pixmap_unittest.cc
@@ -0,0 +1,137 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "ui/gl/gl_image_native_pixmap.h"
+
+#include "base/files/file_util.h"
+#include "base/files/platform_file.h"
+#include "base/logging.h"
+#include "testing/gtest/include/gtest/gtest.h"
+#include "ui/gfx/buffer_format_util.h"
+#include "ui/gl/gl_context.h"
+#include "ui/gl/gl_surface.h"
+#include "ui/gl/init/gl_factory.h"
+#include "ui/gl/test/gl_surface_test_support.h"
+
+namespace gl {
+
+namespace {
+
+class GLImageNativePixmapTest : public testing::Test {
+ protected:
+  // Overridden from testing::Test:
+  void SetUp() override {
+    std::vector<GLImplementation> allowed_impls =
+        init::GetAllowedGLImplementations();
+
+    GLImplementation gl_impl = kGLImplementationEGLGLES2;
+    bool found = false;
+    for (auto impl : allowed_impls) {
+      if (impl == gl_impl) {
+        found = true;
+        break;
+      }
+    }
+
+    if (!found) {
+      LOG(WARNING) << "Skip test, egl is required";
+      return;
+    }
+
+    GLSurfaceTestSupport::InitializeOneOffImplementation(
+        gl_impl, /* fallback_to_osmesa */ false);
+
+    const std::string dmabuf_import_ext = "EGL_MESA_image_dma_buf_export";
+    std::string platform_extensions(DriverEGL::GetPlatformExtensions());
+    ExtensionSet extensions(MakeExtensionSet(platform_extensions));
+    if (!HasExtension(extensions, dmabuf_import_ext)) {
+      LOG(WARNING) << "Skip test, missing extension " << dmabuf_import_ext;
+      return;
+    }
+
+    surface_ = gl::init::CreateOffscreenGLSurface(gfx::Size());
+    context_ =
+        gl::init::CreateGLContext(nullptr, surface_.get(), GLContextAttribs());
+    context_->MakeCurrent(surface_.get());
+
+    skip_test_ = false;
+  }
+
+  void TearDown() override {
+    if (context_)
+      context_->ReleaseCurrent(surface_.get());
+    context_ = nullptr;
+    surface_ = nullptr;
+    init::ShutdownGL(false);
+  }
+
+  bool skip_test_ = true;
+  scoped_refptr<GLSurface> surface_;
+  scoped_refptr<GLContext> context_;
+};
+
+void GLTexture2DToDmabuf(gfx::BufferFormat image_format,
+                         GLint tex_internal_format,
+                         GLenum tex_format) {
+  const gfx::Size image_size(64, 64);
+
+  EXPECT_NE(nullptr, GLContext::GetCurrent());
+
+  EGLContext context =
+      reinterpret_cast<EGLContext>(GLContext::GetCurrent()->GetHandle());
+  EXPECT_NE(EGL_NO_CONTEXT, context);
+
+  scoped_refptr<gl::GLImageNativePixmap> image(new gl::GLImageNativePixmap(
+      image_size,
+      gl::GLImageNativePixmap::GetInternalFormatForTesting(image_format)));
+
+  GLuint texture_id = 0;
+  glGenTextures(1, &texture_id);
+  EXPECT_NE(0u, texture_id);
+  glBindTexture(GL_TEXTURE_2D, texture_id);
+  glTexParameterf(GL_TEXTURE_2D, GL_TEXTURE_WRAP_S, GL_CLAMP_TO_EDGE);
+  glTexParameterf(GL_TEXTURE_2D, GL_TEXTURE_WRAP_T, GL_CLAMP_TO_EDGE);
+  glTexParameteri(GL_TEXTURE_2D, GL_TEXTURE_MAG_FILTER, GL_NEAREST);
+  glTexParameteri(GL_TEXTURE_2D, GL_TEXTURE_MIN_FILTER, GL_NEAREST);
+  glTexImage2D(GL_TEXTURE_2D, 0, tex_internal_format, image_size.width(),
+               image_size.height(), 0, tex_format, GL_UNSIGNED_BYTE, nullptr);
+
+  scoped_refptr<gl::GLImageEGL> base_image = image;
+  EXPECT_TRUE(base_image->Initialize(
+      context, EGL_GL_TEXTURE_2D_KHR,
+      reinterpret_cast<EGLClientBuffer>(texture_id), nullptr));
+
+  gfx::NativePixmapHandle native_pixmap_handle = image->ExportHandle();
+
+  size_t num_planes = gfx::NumberOfPlanesForBufferFormat(image_format);
+  EXPECT_EQ(num_planes, native_pixmap_handle.planes.size());
+
+  std::vector<base::ScopedFD> scoped_fds;
+  for (auto& fd : native_pixmap_handle.fds) {
+    EXPECT_TRUE(fd.auto_close);
+    scoped_fds.emplace_back(fd.fd);
+    EXPECT_TRUE(scoped_fds.back().is_valid());
+  }
+
+  // Close all fds.
+  scoped_fds.clear();
+
+  image = nullptr;
+  glDeleteTextures(1, &texture_id);
+}
+
+TEST_F(GLImageNativePixmapTest, GLTexture2DToDmabuf) {
+  if (skip_test_)
+    return;
+
+  // Add more cases if needed.
+  GLTexture2DToDmabuf(gfx::BufferFormat::RGBA_8888, GL_RGBA, GL_RGBA);
+  GLTexture2DToDmabuf(gfx::BufferFormat::BGRA_8888, GL_RGBA, GL_RGBA);
+  GLTexture2DToDmabuf(gfx::BufferFormat::RGBX_8888, GL_RGBA, GL_RGBA);
+  GLTexture2DToDmabuf(gfx::BufferFormat::BGRX_8888, GL_RGBA, GL_RGBA);
+}
+
+}  // namespace
+
+}  // namespace gl