diff --git a/DEPS b/DEPS
index 985d02a..2d52db01 100644
--- a/DEPS
+++ b/DEPS
@@ -40,11 +40,11 @@
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling Skia
   # and whatever else without interference from each other.
-  'skia_revision': '6f1d36cc54dc635f5e4d0f925ef79c14914342bb',
+  'skia_revision': '7a6c9f7be115031a8a86fdae20e8869fd973fdb6',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling V8
   # and whatever else without interference from each other.
-  'v8_revision': 'c03b077628ad7cb42f5c1790652e3d2ddcb805eb',
+  'v8_revision': 'd9b95e9cafba1c5e9e55a6b43fb269c5123ca3d6',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling swarming_client
   # and whatever else without interference from each other.
diff --git a/device/bluetooth/bluetooth_remote_gatt_characteristic.cc b/device/bluetooth/bluetooth_remote_gatt_characteristic.cc
index 8c94e7a5..3be984a 100644
--- a/device/bluetooth/bluetooth_remote_gatt_characteristic.cc
+++ b/device/bluetooth/bluetooth_remote_gatt_characteristic.cc
@@ -145,15 +145,14 @@
 // rid of the entire check, and run SubscribeToNotifications on all
 // platforms.
 //
-// TODO(http://crbug.com/633191): Remove OS_MACOSX from this check.
 // TODO(http://crbug.com/636270): Remove OS_WIN from this check.
-#if defined(OS_MACOSX) || defined(OS_WIN)
+#if defined(OS_WIN)
   base::ThreadTaskRunnerHandle::Get()->PostTask(
       FROM_HERE,
       base::Bind(&BluetoothRemoteGattCharacteristic::OnStartNotifySessionError,
                  GetWeakPtr(), error_callback,
                  BluetoothRemoteGattService::GATT_ERROR_NOT_SUPPORTED));
-#else   // !(defined(OS_MACOSX) || defined(OS_WIN))
+#else   // defined(OS_WIN))
   // Find the Client Characteristic Configuration descriptor.
   std::vector<BluetoothRemoteGattDescriptor*> ccc_descriptor =
       GetDescriptorsByUUID(BluetoothRemoteGattDescriptor::
@@ -183,7 +182,7 @@
           GetWeakPtr(), callback),
       base::Bind(&BluetoothRemoteGattCharacteristic::OnStartNotifySessionError,
                  GetWeakPtr(), error_callback));
-#endif  // defined(OS_MACOSX) || defined(OS_WIN)
+#endif  // defined(OS_WIN)
 }
 
 void BluetoothRemoteGattCharacteristic::CancelStartNotifySession(
diff --git a/device/bluetooth/bluetooth_remote_gatt_characteristic_mac.h b/device/bluetooth/bluetooth_remote_gatt_characteristic_mac.h
index c690aea..4132f8e 100644
--- a/device/bluetooth/bluetooth_remote_gatt_characteristic_mac.h
+++ b/device/bluetooth/bluetooth_remote_gatt_characteristic_mac.h
@@ -48,10 +48,6 @@
   std::vector<BluetoothRemoteGattDescriptor*> GetDescriptors() const override;
   BluetoothRemoteGattDescriptor* GetDescriptor(
       const std::string& identifier) const override;
-  void StartNotifySession(const NotifySessionCallback& callback,
-                          const ErrorCallback& error_callback) override;
-  void StopNotifySession(BluetoothGattNotifySession* session,
-                         const base::Closure& callback) override;
   void ReadRemoteCharacteristic(const ValueCallback& callback,
                                 const ErrorCallback& error_callback) override;
   void WriteRemoteCharacteristic(const std::vector<uint8_t>& value,
@@ -126,9 +122,8 @@
   std::pair<ValueCallback, ErrorCallback> read_characteristic_value_callbacks_;
   // WriteRemoteCharacteristic request callbacks.
   std::pair<base::Closure, ErrorCallback> write_characteristic_value_callbacks_;
-  // Stores StartNotifySession request callbacks.
-  typedef std::pair<NotifySessionCallback, ErrorCallback>
-      PendingStartNotifyCall;
+  // Stores SubscribeToNotifications request callbacks.
+  typedef std::pair<base::Closure, const ErrorCallback> PendingStartNotifyCall;
   std::vector<PendingStartNotifyCall> start_notify_session_callbacks_;
   // Flag indicates if GATT event registration is in progress.
   bool start_notifications_in_progress_;
diff --git a/device/bluetooth/bluetooth_remote_gatt_characteristic_mac.mm b/device/bluetooth/bluetooth_remote_gatt_characteristic_mac.mm
index c04df6a..c5b2b14a 100644
--- a/device/bluetooth/bluetooth_remote_gatt_characteristic_mac.mm
+++ b/device/bluetooth/bluetooth_remote_gatt_characteristic_mac.mm
@@ -150,50 +150,6 @@
       searched_pair->second.get());
 }
 
-void BluetoothRemoteGattCharacteristicMac::StartNotifySession(
-    const NotifySessionCallback& callback,
-    const ErrorCallback& error_callback) {
-  if (IsNotifying()) {
-    VLOG(2) << "Already notifying. Creating notify session.";
-    std::unique_ptr<BluetoothGattNotifySession> notify_session(
-        new BluetoothGattNotifySession(weak_ptr_factory_.GetWeakPtr()));
-    base::ThreadTaskRunnerHandle::Get()->PostTask(
-        FROM_HERE,
-        base::Bind(callback, base::Passed(std::move(notify_session))));
-    return;
-  }
-
-  if (!SupportsNotificationsOrIndications()) {
-    base::ThreadTaskRunnerHandle::Get()->PostTask(
-        FROM_HERE,
-        base::Bind(error_callback,
-                   BluetoothRemoteGattService::GATT_ERROR_NOT_SUPPORTED));
-    return;
-  }
-
-  start_notify_session_callbacks_.push_back(
-      std::make_pair(callback, error_callback));
-
-  if (start_notifications_in_progress_) {
-    VLOG(2) << "Start Notifications already in progress. "
-            << "Request has been queued.";
-    return;
-  }
-
-  [GetCBPeripheral() setNotifyValue:YES
-                  forCharacteristic:cb_characteristic_.get()];
-  start_notifications_in_progress_ = true;
-}
-
-void BluetoothRemoteGattCharacteristicMac::StopNotifySession(
-    BluetoothGattNotifySession* session,
-    const base::Closure& callback) {
-  // TODO(http://crbug.com/633191): Remove this method and use the base version.
-  //   Instead, we should implement SubscribeToNotifications and
-  //   UnsubscribeFromNotifications.
-  base::ThreadTaskRunnerHandle::Get()->PostTask(FROM_HERE, callback);
-}
-
 void BluetoothRemoteGattCharacteristicMac::ReadRemoteCharacteristic(
     const ValueCallback& callback,
     const ErrorCallback& error_callback) {
@@ -256,8 +212,34 @@
     BluetoothRemoteGattDescriptor* ccc_descriptor,
     const base::Closure& callback,
     const ErrorCallback& error_callback) {
-  // TODO(http://crbug.com/633191): Implement this method
-  NOTIMPLEMENTED();
+  if (IsNotifying()) {
+    VLOG(2) << "Already notifying. Creating notify session.";
+    std::unique_ptr<BluetoothGattNotifySession> notify_session(
+        new BluetoothGattNotifySession(weak_ptr_factory_.GetWeakPtr()));
+    callback.Run();
+    return;
+  }
+
+  if (!SupportsNotificationsOrIndications()) {
+    base::ThreadTaskRunnerHandle::Get()->PostTask(
+        FROM_HERE,
+        base::Bind(error_callback,
+                   BluetoothRemoteGattService::GATT_ERROR_NOT_SUPPORTED));
+    return;
+  }
+
+  start_notify_session_callbacks_.push_back(
+      std::make_pair(callback, error_callback));
+
+  if (start_notifications_in_progress_) {
+    VLOG(2) << "Start Notifications already in progress. "
+            << "Request has been queued.";
+    return;
+  }
+
+  [GetCBPeripheral() setNotifyValue:YES
+                  forCharacteristic:cb_characteristic_.get()];
+  start_notifications_in_progress_ = true;
 }
 
 void BluetoothRemoteGattCharacteristicMac::UnsubscribeFromNotifications(
@@ -336,8 +318,7 @@
 
 void BluetoothRemoteGattCharacteristicMac::DidUpdateNotificationState(
     NSError* error) {
-  std::vector<std::pair<NotifySessionCallback, ErrorCallback>>
-      reentrant_safe_callbacks;
+  std::vector<PendingStartNotifyCall> reentrant_safe_callbacks;
   reentrant_safe_callbacks.swap(start_notify_session_callbacks_);
   start_notifications_in_progress_ = false;
   if (error) {
@@ -354,8 +335,7 @@
     return;
   }
   for (const auto& callback : reentrant_safe_callbacks) {
-    callback.first.Run(base::MakeUnique<BluetoothGattNotifySession>(
-        weak_ptr_factory_.GetWeakPtr()));
+    callback.first.Run();
   }
 }
 
diff --git a/third_party/WebKit/LayoutTests/TestExpectations b/third_party/WebKit/LayoutTests/TestExpectations
index da8d276d..01f68414 100644
--- a/third_party/WebKit/LayoutTests/TestExpectations
+++ b/third_party/WebKit/LayoutTests/TestExpectations
@@ -2141,9 +2141,6 @@
 crbug.com/674858 [ Linux ] virtual/threaded/printing/offscreencanvas-2d-printing.html [ Pass Failure Crash ]
 crbug.com/674858 [ Linux ] virtual/threaded/printing/offscreencanvas-webgl-printing.html [ Pass Failure Crash ]
 
-# Added 2016-12-20
-crbug.com/675907 fast/input/placeholder-wrongly-placed-if-too-tall.html [ Pass Timeout ]
-
 # Added 2016-12-22
 crbug.com/676537 fast/css/imageTileOpacity.html [ Pass Failure ]
 
@@ -2334,6 +2331,9 @@
 crbug.com/678499 http/tests/security/contentSecurityPolicy/require-sri-for/require-sri-for-script-preload-allowed.php [ Failure Pass ]
 crbug.com/678499 virtual/mojo-loading/http/tests/security/contentSecurityPolicy/require-sri-for/require-sri-for-script-preload-allowed.php [ Failure Pass ]
 
+crbug.com/681391 virtual/gpu-rasterization/images/imagemap-circle-focus-ring.html [ NeedsManualRebaseline ]
+crbug.com/681391 virtual/gpu-rasterization/images/imagemap-overflowing-circle-focus-ring.html [ NeedsManualRebaseline ]
+
 crbug.com/680043 sensor/ambient-light-sensor.html [ Pass Failure ]
 
 crbug.com/680050 inspector/sources/debugger-ui/watch-expressions-panel-switch.html [ Pass Timeout ]
diff --git a/third_party/WebKit/Tools/Scripts/webkitpy/common/checkout/scm/git.py b/third_party/WebKit/Tools/Scripts/webkitpy/common/checkout/scm/git.py
index 47c841e..442173fb 100644
--- a/third_party/WebKit/Tools/Scripts/webkitpy/common/checkout/scm/git.py
+++ b/third_party/WebKit/Tools/Scripts/webkitpy/common/checkout/scm/git.py
@@ -211,7 +211,7 @@
 
     def changed_files(self, git_commit=None):
         # FIXME: --diff-filter could be used to avoid the "extract_filenames" step.
-        status_command = [self.executable_name, 'diff', '-r', '--name-status',
+        status_command = ['diff', '-r', '--name-status',
                           "--no-renames", "--no-ext-diff", "--full-index", self._merge_base(git_commit)]
         # FIXME: I'm not sure we're returning the same set of files that SVN.changed_files is.
         # Added (A), Copied (C), Deleted (D), Modified (M), Renamed (R)
diff --git a/ui/accessibility/platform/ax_platform_node_mac.mm b/ui/accessibility/platform/ax_platform_node_mac.mm
index 7e4e171..0cabd69 100644
--- a/ui/accessibility/platform/ax_platform_node_mac.mm
+++ b/ui/accessibility/platform/ax_platform_node_mac.mm
@@ -427,27 +427,8 @@
   return nil;
 }
 
-// NSAccessibility attributes.
-
-- (NSArray*)AXChildren {
-  if (!node_)
-    return nil;
-  int count = node_->GetChildCount();
-  NSMutableArray* children = [NSMutableArray arrayWithCapacity:count];
-  for (int i = 0; i < count; ++i)
-    [children addObject:node_->ChildAtIndex(i)];
-  return NSAccessibilityUnignoredChildren(children);
-}
-
-- (id)AXParent {
-  if (!node_)
-    return nil;
-  return NSAccessibilityUnignoredAncestor(node_->GetParent());
-}
-
-- (NSValue*)AXPosition {
-  return [NSValue valueWithPoint:self.boundsInScreen.origin];
-}
+// NSAccessibility attributes. Order them according to
+// NSAccessibilityConstants.h, or see https://crbug.com/678898.
 
 - (NSString*)AXRole {
   if (!node_)
@@ -455,6 +436,10 @@
   return [[self class] nativeRoleFromAXRole:node_->GetData().role];
 }
 
+- (NSString*)AXRoleDescription {
+  return NSAccessibilityRoleDescription([self AXRole], [self AXSubrole]);
+}
+
 - (NSString*)AXSubrole {
   ui::AXRole role = node_->GetData().role;
   switch (role) {
@@ -469,8 +454,54 @@
   return [AXPlatformNodeCocoa nativeSubroleFromAXRole:role];
 }
 
-- (NSString*)AXRoleDescription {
-  return NSAccessibilityRoleDescription([self AXRole], [self AXSubrole]);
+- (NSString*)AXHelp {
+  return [self getStringAttribute:ui::AX_ATTR_DESCRIPTION];
+}
+
+- (NSString*)AXValue {
+  return [self getStringAttribute:ui::AX_ATTR_VALUE];
+}
+
+- (NSNumber*)AXEnabled {
+  return [NSNumber
+      numberWithBool:!ui::AXNodeData::IsFlagSet(node_->GetData().state,
+                                                ui::AX_STATE_DISABLED)];
+}
+
+- (NSNumber*)AXFocused {
+  if (ui::AXNodeData::IsFlagSet(node_->GetData().state,
+                                ui::AX_STATE_FOCUSABLE))
+    return [NSNumber numberWithBool:(node_->GetDelegate()->GetFocus() ==
+                                     node_->GetNativeViewAccessible())];
+  return [NSNumber numberWithBool:NO];
+}
+
+- (id)AXParent {
+  if (!node_)
+    return nil;
+  return NSAccessibilityUnignoredAncestor(node_->GetParent());
+}
+
+- (NSArray*)AXChildren {
+  if (!node_)
+    return nil;
+  int count = node_->GetChildCount();
+  NSMutableArray* children = [NSMutableArray arrayWithCapacity:count];
+  for (int i = 0; i < count; ++i)
+    [children addObject:node_->ChildAtIndex(i)];
+  return NSAccessibilityUnignoredChildren(children);
+}
+
+- (id)AXWindow {
+  return node_->GetDelegate()->GetTopLevelWidget();
+}
+
+- (id)AXTopLevelUIElement {
+  return [self AXWindow];
+}
+
+- (NSValue*)AXPosition {
+  return [NSValue valueWithPoint:self.boundsInScreen.origin];
 }
 
 - (NSValue*)AXSize {
@@ -481,51 +512,14 @@
   return [self getStringAttribute:ui::AX_ATTR_NAME];
 }
 
-- (NSString*)AXValue {
-  return [self getStringAttribute:ui::AX_ATTR_VALUE];
-}
-
-- (NSValue*)AXEnabled {
-  return [NSNumber
-      numberWithBool:!ui::AXNodeData::IsFlagSet(node_->GetData().state,
-                                                ui::AX_STATE_DISABLED)];
-}
-
-- (NSValue*)AXFocused {
-  if (ui::AXNodeData::IsFlagSet(node_->GetData().state,
-                                ui::AX_STATE_FOCUSABLE))
-    return [NSNumber numberWithBool:(node_->GetDelegate()->GetFocus() ==
-                                     node_->GetNativeViewAccessible())];
-  return [NSNumber numberWithBool:NO];
-}
-
-- (NSString*)AXHelp {
-  return [self getStringAttribute:ui::AX_ATTR_DESCRIPTION];
-}
-
-- (NSWindow*)AXTopLevelUIElement {
-  return [self AXWindow];
-}
-
-- (NSWindow*)AXWindow {
-  return node_->GetDelegate()->GetTopLevelWidget();
-}
-
-// Textfield-specific NSAccessibility attributes.
-
-- (NSNumber*)AXInsertionPointLineNumber {
-  // Multiline is not supported on views.
-  return [NSNumber numberWithInteger:0];
-}
-
-- (NSNumber*)AXNumberOfCharacters {
-  return [NSNumber numberWithInteger:[[self AXValue] length]];
-}
+// Misc attributes.
 
 - (NSString*)AXPlaceholderValue {
   return [self getStringAttribute:ui::AX_ATTR_PLACEHOLDER];
 }
 
+// Text-specific attributes.
+
 - (NSString*)AXSelectedText {
   NSRange selectedTextRange;
   [[self AXSelectedTextRange] getValue:&selectedTextRange];
@@ -547,11 +541,20 @@
       valueWithRange:NSMakeRange(beginSelectionIndex, abs(end - start))];
 }
 
+- (NSNumber*)AXNumberOfCharacters {
+  return [NSNumber numberWithInteger:[[self AXValue] length]];
+}
+
 - (NSValue*)AXVisibleCharacterRange {
   return [NSValue
       valueWithRange:NSMakeRange(0, [[self AXNumberOfCharacters] intValue])];
 }
 
+- (NSNumber*)AXInsertionPointLineNumber {
+  // Multiline is not supported on views.
+  return [NSNumber numberWithInteger:0];
+}
+
 @end
 
 namespace ui {