diff --git a/DEPS b/DEPS
index 31efd22..2b4a2dcb 100644
--- a/DEPS
+++ b/DEPS
@@ -44,7 +44,7 @@
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling V8
   # and whatever else without interference from each other.
-  'v8_revision': '97674cb813b238739f33a160b20b2dd0f0033af8',
+  'v8_revision': 'b2a59097e71accee26a17f644c0b89cd148db4cf',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling swarming_client
   # and whatever else without interference from each other.
diff --git a/chrome/browser/chromeos/hats/hats_notification_controller_unittest.cc b/chrome/browser/chromeos/hats/hats_notification_controller_unittest.cc
index 15049be..b8f32d1 100644
--- a/chrome/browser/chromeos/hats/hats_notification_controller_unittest.cc
+++ b/chrome/browser/chromeos/hats/hats_notification_controller_unittest.cc
@@ -76,6 +76,7 @@
   MOCK_METHOD1(SetImageFetcherDelegate, void(ImageFetcherDelegate*));
   MOCK_METHOD1(SetDataUseServiceName, void(DataUseServiceName));
   MOCK_METHOD1(SetDesiredImageFrameSize, void(const gfx::Size&));
+  MOCK_METHOD0(GetImageDecoder, image_fetcher::ImageDecoder*());
 
  private:
   DISALLOW_COPY_AND_ASSIGN(MockImageFetcher);
diff --git a/chrome/browser/ntp_snippets/content_suggestions_service_factory.cc b/chrome/browser/ntp_snippets/content_suggestions_service_factory.cc
index 99012936..bbcc05400 100644
--- a/chrome/browser/ntp_snippets/content_suggestions_service_factory.cc
+++ b/chrome/browser/ntp_snippets/content_suggestions_service_factory.cc
@@ -208,7 +208,6 @@
       service->category_ranker(), std::move(suggestions_fetcher),
       base::MakeUnique<ImageFetcherImpl>(base::MakeUnique<ImageDecoderImpl>(),
                                          request_context.get()),
-      base::MakeUnique<ImageDecoderImpl>(),
       base::MakeUnique<RemoteSuggestionsDatabase>(database_dir, task_runner),
       base::MakeUnique<RemoteSuggestionsStatusService>(signin_manager,
                                                        pref_service));
diff --git a/components/exo/surface.cc b/components/exo/surface.cc
index 87653987..b3ef1cea 100644
--- a/components/exo/surface.cc
+++ b/components/exo/surface.cc
@@ -783,22 +783,17 @@
                           1.f / scaled_buffer_size.height());
   }
 
-  gfx::Rect damage_rect;
-  gfx::Rect output_rect = gfx::Rect(contents_surface_size);
-  if (full_damage) {
-    damage_rect = output_rect;
-  } else {
-    // pending_damage_ is in Surface coordinates.
-    gfx::Rect damage_rect = gfx::SkIRectToRect(pending_damage_.getBounds());
-    damage_rect.Intersect(output_rect);
-  }
+  // pending_damage_ is in Surface coordinates.
+  gfx::Rect damage_rect = full_damage
+                              ? gfx::Rect(contents_surface_size)
+                              : gfx::SkIRectToRect(pending_damage_.getBounds());
 
   const int kRenderPassId = 1;
   std::unique_ptr<cc::RenderPass> render_pass = cc::RenderPass::Create();
-  render_pass->SetNew(kRenderPassId, output_rect, damage_rect,
-                      gfx::Transform());
+  render_pass->SetNew(kRenderPassId, gfx::Rect(contents_surface_size),
+                      damage_rect, gfx::Transform());
 
-  gfx::Rect quad_rect = output_rect;
+  gfx::Rect quad_rect = gfx::Rect(contents_surface_size);
   cc::SharedQuadState* quad_state =
       render_pass->CreateAndAppendSharedQuadState();
   quad_state->quad_layer_bounds = contents_surface_size;
diff --git a/components/exo/surface_unittest.cc b/components/exo/surface_unittest.cc
index 3b8f4c47..dc67d75 100644
--- a/components/exo/surface_unittest.cc
+++ b/components/exo/surface_unittest.cc
@@ -75,10 +75,6 @@
   EXPECT_TRUE(surface->HasPendingDamageForTesting(gfx::Rect(0, 0, 10, 10)));
   EXPECT_TRUE(surface->HasPendingDamageForTesting(gfx::Rect(10, 10, 10, 10)));
   EXPECT_FALSE(surface->HasPendingDamageForTesting(gfx::Rect(5, 5, 10, 10)));
-
-  // Check that damage larger than contents is handled correctly at commit.
-  surface->Damage(gfx::Rect(gfx::ScaleToCeiledSize(buffer_size, 2.0f)));
-  surface->Commit();
 }
 
 void SetFrameTime(base::TimeTicks* result, base::TimeTicks frame_time) {
diff --git a/components/image_fetcher/image_fetcher.h b/components/image_fetcher/image_fetcher.h
index 3626c3af..a5b1c7f1 100644
--- a/components/image_fetcher/image_fetcher.h
+++ b/components/image_fetcher/image_fetcher.h
@@ -20,6 +20,8 @@
 
 namespace image_fetcher {
 
+class ImageDecoder;
+
 // A class used to fetch server images. It can be called from any thread and the
 // callback will be called on the thread which initiated the fetch.
 class ImageFetcher {
@@ -50,8 +52,7 @@
       const GURL& image_url,
       base::Callback<void(const std::string&, const gfx::Image&)> callback) = 0;
 
-  // TODO(treib,markusheintz): Now that iOS uses the same ImageFetcherImpl (see
-  // crbug.com/689020), add a getter for the ImageDecoder here.
+  virtual ImageDecoder* GetImageDecoder() = 0;
 
  private:
   DISALLOW_COPY_AND_ASSIGN(ImageFetcher);
diff --git a/components/image_fetcher/image_fetcher_impl.cc b/components/image_fetcher/image_fetcher_impl.cc
index f65155c6..bee92cb 100644
--- a/components/image_fetcher/image_fetcher_impl.cc
+++ b/components/image_fetcher/image_fetcher_impl.cc
@@ -102,4 +102,8 @@
   pending_net_requests_.erase(image_iter);
 }
 
+ImageDecoder* ImageFetcherImpl::GetImageDecoder() {
+  return image_decoder_.get();
+}
+
 }  // namespace image_fetcher
diff --git a/components/image_fetcher/image_fetcher_impl.h b/components/image_fetcher/image_fetcher_impl.h
index 16b348f..954f84b 100644
--- a/components/image_fetcher/image_fetcher_impl.h
+++ b/components/image_fetcher/image_fetcher_impl.h
@@ -53,6 +53,8 @@
       base::Callback<void(const std::string&, const gfx::Image&)> callback)
       override;
 
+  ImageDecoder* GetImageDecoder() override;
+
  private:
   using CallbackVector =
       std::vector<base::Callback<void(const std::string&, const gfx::Image&)>>;
diff --git a/components/ntp_snippets/remote/remote_suggestions_provider_impl.cc b/components/ntp_snippets/remote/remote_suggestions_provider_impl.cc
index accf328..ac29b517 100644
--- a/components/ntp_snippets/remote/remote_suggestions_provider_impl.cc
+++ b/components/ntp_snippets/remote/remote_suggestions_provider_impl.cc
@@ -162,11 +162,9 @@
 
 CachedImageFetcher::CachedImageFetcher(
     std::unique_ptr<image_fetcher::ImageFetcher> image_fetcher,
-    std::unique_ptr<image_fetcher::ImageDecoder> image_decoder,
     PrefService* pref_service,
     RemoteSuggestionsDatabase* database)
     : image_fetcher_(std::move(image_fetcher)),
-      image_decoder_(std::move(image_decoder)),
       database_(database),
       thumbnail_requests_throttler_(
           pref_service,
@@ -214,9 +212,9 @@
     const ContentSuggestion::ID& suggestion_id,
     const GURL& url,
     std::string data) {  // SnippetImageCallback requires by-value.
-  // |image_decoder_| is null in tests.
-  if (image_decoder_ && !data.empty()) {
-    image_decoder_->DecodeImage(
+  // The image decoder is null in tests.
+  if (image_fetcher_->GetImageDecoder() && !data.empty()) {
+    image_fetcher_->GetImageDecoder()->DecodeImage(
         data,
         // We're not dealing with multi-frame images.
         /*desired_image_frame_size=*/gfx::Size(),
@@ -269,7 +267,6 @@
     CategoryRanker* category_ranker,
     std::unique_ptr<RemoteSuggestionsFetcher> suggestions_fetcher,
     std::unique_ptr<image_fetcher::ImageFetcher> image_fetcher,
-    std::unique_ptr<image_fetcher::ImageDecoder> image_decoder,
     std::unique_ptr<RemoteSuggestionsDatabase> database,
     std::unique_ptr<RemoteSuggestionsStatusService> status_service)
     : RemoteSuggestionsProvider(observer),
@@ -282,7 +279,6 @@
       suggestions_fetcher_(std::move(suggestions_fetcher)),
       database_(std::move(database)),
       image_fetcher_(std::move(image_fetcher),
-                     std::move(image_decoder),
                      pref_service,
                      database_.get()),
       status_service_(std::move(status_service)),
diff --git a/components/ntp_snippets/remote/remote_suggestions_provider_impl.h b/components/ntp_snippets/remote/remote_suggestions_provider_impl.h
index ecd1566b..bc17c90 100644
--- a/components/ntp_snippets/remote/remote_suggestions_provider_impl.h
+++ b/components/ntp_snippets/remote/remote_suggestions_provider_impl.h
@@ -39,7 +39,6 @@
 }  // namespace gfx
 
 namespace image_fetcher {
-class ImageDecoder;
 class ImageFetcher;
 }  // namespace image_fetcher
 
@@ -60,7 +59,6 @@
   // |pref_service| and |database| need to outlive the created image fetcher
   // instance.
   CachedImageFetcher(std::unique_ptr<image_fetcher::ImageFetcher> image_fetcher,
-                     std::unique_ptr<image_fetcher::ImageDecoder> image_decoder,
                      PrefService* pref_service,
                      RemoteSuggestionsDatabase* database);
   ~CachedImageFetcher() override;
@@ -94,7 +92,6 @@
                              const ImageFetchedCallback& callback);
 
   std::unique_ptr<image_fetcher::ImageFetcher> image_fetcher_;
-  std::unique_ptr<image_fetcher::ImageDecoder> image_decoder_;
   RemoteSuggestionsDatabase* database_;
   // Request throttler for limiting requests to thumbnail images.
   RequestThrottler thumbnail_requests_throttler_;
@@ -120,7 +117,6 @@
       CategoryRanker* category_ranker,
       std::unique_ptr<RemoteSuggestionsFetcher> suggestions_fetcher,
       std::unique_ptr<image_fetcher::ImageFetcher> image_fetcher,
-      std::unique_ptr<image_fetcher::ImageDecoder> image_decoder,
       std::unique_ptr<RemoteSuggestionsDatabase> database,
       std::unique_ptr<RemoteSuggestionsStatusService> status_service);
 
diff --git a/components/ntp_snippets/remote/remote_suggestions_provider_impl_unittest.cc b/components/ntp_snippets/remote/remote_suggestions_provider_impl_unittest.cc
index b59db1b38..3e592bb8 100644
--- a/components/ntp_snippets/remote/remote_suggestions_provider_impl_unittest.cc
+++ b/components/ntp_snippets/remote/remote_suggestions_provider_impl_unittest.cc
@@ -66,6 +66,7 @@
 using testing::MockFunction;
 using testing::NiceMock;
 using testing::Not;
+using testing::Return;
 using testing::SaveArg;
 using testing::SizeIs;
 using testing::StartsWith;
@@ -347,6 +348,7 @@
       void(const std::string&,
            const GURL&,
            base::Callback<void(const std::string&, const gfx::Image&)>));
+  MOCK_METHOD0(GetImageDecoder, image_fetcher::ImageDecoder*());
 };
 
 class FakeImageDecoder : public image_fetcher::ImageDecoder {
@@ -395,7 +397,6 @@
         user_classifier_(/*pref_service=*/nullptr),
         suggestions_fetcher_(nullptr),
         image_fetcher_(nullptr),
-        image_decoder_(nullptr),
         database_(nullptr) {
     RemoteSuggestionsProviderImpl::RegisterProfilePrefs(
         utils_.pref_service()->registry());
@@ -439,8 +440,8 @@
 
     image_fetcher_ = image_fetcher.get();
     EXPECT_CALL(*image_fetcher, SetImageFetcherDelegate(_));
-    auto image_decoder = base::MakeUnique<FakeImageDecoder>();
-    image_decoder_ = image_decoder.get();
+    ON_CALL(*image_fetcher, GetImageDecoder())
+        .WillByDefault(Return(&image_decoder_));
     EXPECT_FALSE(observer_);
     observer_ = base::MakeUnique<FakeContentSuggestionsProviderObserver>();
     auto database = base::MakeUnique<RemoteSuggestionsDatabase>(
@@ -449,7 +450,7 @@
     return base::MakeUnique<RemoteSuggestionsProviderImpl>(
         observer_.get(), utils_.pref_service(), "fr", category_ranker_.get(),
         std::move(suggestions_fetcher), std::move(image_fetcher),
-        std::move(image_decoder), std::move(database),
+        std::move(database),
         base::MakeUnique<RemoteSuggestionsStatusService>(
             utils_.fake_signin_manager(), utils_.pref_service()));
   }
@@ -513,7 +514,7 @@
   // TODO(tschumann): Make this a strict-mock. We want to avoid unneccesary
   // network requests.
   NiceMock<MockImageFetcher>* image_fetcher() { return image_fetcher_; }
-  FakeImageDecoder* image_decoder() { return image_decoder_; }
+  FakeImageDecoder* image_decoder() { return &image_decoder_; }
   PrefService* pref_service() { return utils_.pref_service(); }
   RemoteSuggestionsDatabase* database() { return database_; }
 
@@ -561,7 +562,7 @@
   std::unique_ptr<FakeContentSuggestionsProviderObserver> observer_;
   RemoteSuggestionsFetcher* suggestions_fetcher_;
   NiceMock<MockImageFetcher>* image_fetcher_;
-  FakeImageDecoder* image_decoder_;
+  FakeImageDecoder image_decoder_;
 
   base::ScopedTempDir database_dir_;
   RemoteSuggestionsDatabase* database_;
diff --git a/components/ntp_tiles/icon_cacher_impl_unittest.cc b/components/ntp_tiles/icon_cacher_impl_unittest.cc
index bab8c30..e371742 100644
--- a/components/ntp_tiles/icon_cacher_impl_unittest.cc
+++ b/components/ntp_tiles/icon_cacher_impl_unittest.cc
@@ -49,6 +49,7 @@
                     base::Callback<void(const std::string& id,
                                         const gfx::Image& image)> callback));
   MOCK_METHOD1(SetDesiredImageFrameSize, void(const gfx::Size&));
+  MOCK_METHOD0(GetImageDecoder, image_fetcher::ImageDecoder*());
 };
 
 // This class provides methods to inject an image resource where a real resource
diff --git a/components/suggestions/image_manager_unittest.cc b/components/suggestions/image_manager_unittest.cc
index 8846aef..4244be92 100644
--- a/components/suggestions/image_manager_unittest.cc
+++ b/components/suggestions/image_manager_unittest.cc
@@ -55,6 +55,7 @@
   MOCK_METHOD1(SetImageFetcherDelegate, void(ImageFetcherDelegate*));
   MOCK_METHOD1(SetDataUseServiceName, void(DataUseServiceName));
   MOCK_METHOD1(SetDesiredImageFrameSize, void(const gfx::Size&));
+  MOCK_METHOD0(GetImageDecoder, image_fetcher::ImageDecoder*());
 };
 
 class ImageManagerTest : public testing::Test {
diff --git a/content/browser/frame_host/render_frame_host_manager_browsertest.cc b/content/browser/frame_host/render_frame_host_manager_browsertest.cc
index 02027b0..9f6afe7 100644
--- a/content/browser/frame_host/render_frame_host_manager_browsertest.cc
+++ b/content/browser/frame_host/render_frame_host_manager_browsertest.cc
@@ -1617,7 +1617,15 @@
 // BrowsingInstance swap to occur on pages like view-source and extensions,
 // which broke chrome://crash and javascript: URLs.
 // See http://crbug.com/335503.
-IN_PROC_BROWSER_TEST_F(RenderFrameHostManagerTest, RendererDebugURLsDontSwap) {
+// The test fails on Mac OSX with ASAN.
+// See http://crbug.com/699062.
+#if defined(OS_MACOSX) && defined(ADDRESS_SANITIZER)
+#define MAYBE_RendererDebugURLsDontSwap DISABLED_RendererDebugURLsDontSwap
+#else
+#define MAYBE_RendererDebugURLsDontSwap RendererDebugURLsDontSwap
+#endif
+IN_PROC_BROWSER_TEST_F(RenderFrameHostManagerTest,
+                       MAYBE_RendererDebugURLsDontSwap) {
   StartEmbeddedServer();
 
   GURL original_url(embedded_test_server()->GetURL("/title2.html"));
diff --git a/ios/chrome/browser/ntp_snippets/ios_chrome_content_suggestions_service_factory.cc b/ios/chrome/browser/ntp_snippets/ios_chrome_content_suggestions_service_factory.cc
index b9f30774..8493ae5 100644
--- a/ios/chrome/browser/ntp_snippets/ios_chrome_content_suggestions_service_factory.cc
+++ b/ios/chrome/browser/ntp_snippets/ios_chrome_content_suggestions_service_factory.cc
@@ -170,7 +170,6 @@
         base::MakeUnique<ImageFetcherImpl>(
             CreateIOSImageDecoder(web::WebThread::GetBlockingPool()),
             request_context.get()),
-        CreateIOSImageDecoder(task_runner),
         base::MakeUnique<RemoteSuggestionsDatabase>(database_dir, task_runner),
         base::MakeUnique<RemoteSuggestionsStatusService>(signin_manager,
                                                          prefs));