diff --git a/DEPS b/DEPS
index 0b765af..e83fa9c 100644
--- a/DEPS
+++ b/DEPS

@@ -36,7 +36,7 @@
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling Skia
   # and whatever else without interference from each other.
-  'skia_revision': 'ec559591ae8f2c7005ad3824b718df5f01747851',
+  'skia_revision': 'dad1aef9a8bcdcb2ef68d674035ba076467beef2',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling V8
   # and whatever else without interference from each other.

diff --git a/third_party/WebKit/Source/core/core.gypi b/third_party/WebKit/Source/core/core.gypi
index 96062ce..c704acf 100644
--- a/third_party/WebKit/Source/core/core.gypi
+++ b/third_party/WebKit/Source/core/core.gypi

@@ -4164,6 +4164,7 @@
             'html/parser/HTMLSrcsetParserTest.cpp',
             'html/parser/HTMLTokenizerTest.cpp',
             'html/parser/HTMLTreeBuilderSimulatorTest.cpp',
+            'html/parser/TextResourceDecoderTest.cpp',
             'html/shadow/MediaControlsTest.cpp',
             'html/track/TextTrackListTest.cpp',
             'html/track/vtt/BufferedLineReaderTest.cpp',

diff --git a/third_party/WebKit/Source/core/html/parser/TextResourceDecoder.cpp b/third_party/WebKit/Source/core/html/parser/TextResourceDecoder.cpp
index 1185bd8..6c97585 100644
--- a/third_party/WebKit/Source/core/html/parser/TextResourceDecoder.cpp
+++ b/third_party/WebKit/Source/core/html/parser/TextResourceDecoder.cpp

@@ -214,7 +214,7 @@
         setEncoding(UTF8Encoding(), AutoDetectedEncoding);
         lengthOfBOM = 3;
     } else if (m_encodingDetectionOption != AlwaysUseUTF8ForText) {
-        if (c1 == 0xFF && c2 == 0xFE) {
+        if (c1 == 0xFF && c2 == 0xFE && bufferLength + len >= 4) {
             if (c3 || c4) {
                 setEncoding(UTF16LittleEndianEncoding(), AutoDetectedEncoding);
                 lengthOfBOM = 2;
@@ -369,9 +369,18 @@
 String TextResourceDecoder::decode(const char* data, size_t len)
 {
     size_t lengthOfBOM = 0;
-    if (!m_checkedForBOM)
+    if (!m_checkedForBOM) {
         lengthOfBOM = checkForBOM(data, len);
 
+        // BOM check can fail when the available data is not enough.
+        if (!m_checkedForBOM) {
+            DCHECK_EQ(0u, lengthOfBOM);
+            m_buffer.append(data, len);
+            return emptyString();
+        }
+    }
+    DCHECK_LE(lengthOfBOM, m_buffer.size() + len);
+
     bool movedDataToBuffer = false;
 
     if (m_contentType == CSSContent && !m_checkedForCSSCharset) {

diff --git a/third_party/WebKit/Source/core/html/parser/TextResourceDecoderTest.cpp b/third_party/WebKit/Source/core/html/parser/TextResourceDecoderTest.cpp
new file mode 100644
index 0000000..636deec
--- /dev/null
+++ b/third_party/WebKit/Source/core/html/parser/TextResourceDecoderTest.cpp

@@ -0,0 +1,46 @@
+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "core/html/parser/TextResourceDecoder.h"
+
+#include "testing/gtest/include/gtest/gtest.h"
+
+namespace blink {
+
+namespace {
+
+const char kUTF16TextMimeType[] = "text/plain; charset=utf-16";
+
+} // namespace
+
+TEST(TextResourceDecoderTest, BasicUTF16)
+{
+    std::unique_ptr<TextResourceDecoder> decoder = TextResourceDecoder::create(kUTF16TextMimeType);
+    WTF::String decoded;
+
+    const unsigned char fooLE[] = {0xff, 0xfe, 0x66, 0x00, 0x6f, 0x00, 0x6f, 0x00};
+    decoded = decoder->decode(reinterpret_cast<const char*>(fooLE), sizeof(fooLE));
+    decoded = decoded + decoder->flush();
+    EXPECT_EQ("foo", decoded);
+
+    decoder = TextResourceDecoder::create(kUTF16TextMimeType);
+    const unsigned char fooBE[] = {0xfe, 0xff, 0x00, 0x66, 0x00, 0x6f, 0x00, 0x6f};
+    decoded = decoder->decode(reinterpret_cast<const char*>(fooBE), sizeof(fooBE));
+    decoded = decoded + decoder->flush();
+    EXPECT_EQ("foo", decoded);
+}
+
+TEST(TextResourceDecoderTest, UTF16Pieces)
+{
+    std::unique_ptr<TextResourceDecoder> decoder = TextResourceDecoder::create(kUTF16TextMimeType);
+
+    WTF::String decoded;
+    const unsigned char foo[] = {0xff, 0xfe, 0x66, 0x00, 0x6f, 0x00, 0x6f, 0x00};
+    for (char c : foo)
+        decoded = decoded + decoder->decode(reinterpret_cast<const char*>(&c), 1);
+    decoded = decoded + decoder->flush();
+    EXPECT_EQ("foo", decoded);
+}
+
+} // namespace blink