I believe we do have a test for UGI for touch. Does this one covers what you have mind?
fast/events/popup-allowed-from-touch-only-once.html

I did notice that test and thought it needs to be done only for touch events and not pointer events. This gesture indicator is the one that prevents the js to randomly open popups and doing stuff only as the result of user interaction. Right?

Ah, thanks - I missed that one.  I've just finished writing a more thorough test, so I may replace it :-)

Right, a bunch of things (including pop ups) are limited to working only in the context of a user gesture (eg. also going fullscreen, starting audio playback, etc).  So if it's possible to open a pop-up (or whatever) in some touch listener, it would be bad if switching to pointer events meant you could no longer do that.  Normally "click" is the better event to use for this stuff, but it's not unreasonable to want to use pointerup instead.

Actually, I wonder if pointer events would be a good opportunity to consider changing this?  I'm in the process of making user gestures more strict for touch events (https://docs.google.com/document/d/1oF1T3O7_E4t1PYHV6gyCwHxOi3ystm0eSL5xZu7nvOg/edit) but it's a tricky balance between web compat and optimum user experience.

We could use pointer events as an opportunity to say that you MUST to any sensitive operations in response to touch inside of a "click" event (though the pointer events for mouse probably still need to take a user gesture).

One disadvantage here is that it would make the mouse and touch cases of pointer events very different (developers may test on mouse and later be surprised it doesn't work for touch).  This is fundamental to the issue of ambiguity with scroll though, and something we've basically decided we need to do for  issue 582140 .

Anyway I think this is all rolled up in the question of what we want to do long term for user gestures for touch.  For now we're keeping the restrictions limited to cross-origin iframes, mainly because we don't want to say it's impossible to build certain UIs (eg. a toggle switch you swipe to enable fullscreen).  Given that position, pointer events should match the touch event behavior.

But that's really still an open quesiton.  Perhaps it's simpler to just say that ideally the only way to do any sensitive operation on touch is via the "click" (or "dblclik", "contextmenu") event, and anything more (like touchend on tap) is just legacy for web compat.

Some discussion in https://codereview.chromium.org/2392773002/#msg33. Navid, we are taking a UGI still for pointer events with pointerType=mouse, right?  At least my test page (http://output.jsbin.com/hodesa) seems to show no problem opening pop-ups on pointerdown for mouse.  If that was broken this would probably be a PointerEvent launch-blocking issue (it would mean developers couldn't move from mouse* to pointer* without breaking some key use cases).

As for touch, I don't think it's particularly urgent because developers should really be using "click" as the only touch action that does anything sensitive.  If we can avoid it, I'd rather not add the complexity of matching the UGI behavior for touch events (which is under flux in  issue 582140 ).  But I do think it would be reasonable (and possibly useful) to take a UGI on pointerup for touch (pointerup never occurs for a touch scroll, you get pointercancel instead).

So should this bug just track adding a UGI to the codepath that generates pointerup for touch?

Yup. Sorry that is what I meant. We do create the token for mouse before PE but not for touch. Maybe if we can share the path somewhere we can do them for both. But for now as you suggested I'll just create a token for touch pointerup.

Is "sensitive tasks in click only" across /all pointer-types/ a bit too risky, despite the low usage of pointer events now? It could be the case that most early users of pointer events are modern sites hence well-designed even for mouse handling (I have no data though). For new sites switching to pointer events from mouse events, the "sensitive tasks in click only" idea could be a good motivation to move a better design, right?

In any case, we shouldn't leave the bug as a p3 even though I see it is not urgent.

Found a site relying on having a user gesture in 'pointerup' handler: play the video at http://indianexpress.com/article/india/india-news-india/pm-modi-doing-dalali-rahul-gandhi-surgical-strikes/.  With PointerEvents enabled you get a "Failed to execute 'play' on 'HTMLMediaElement': API can only be initiated by a user gesture." error and the video doesn't play.

That means I was wrong about the risk being low for the touch case.  We should plan to get the pointerup case fixed for M55 (should be trivial).

Issue 653553 has been merged into this issue.

**** Bulk edit -  please ignore if not applicable ****

This bug  is reported as M55 Beta blocker and we're getting closer to M55 Beta promotion. 
Please plan to have fix ready and merged to M55 branch (2883) by 5:00 PM PT, Monday(10/10) so it has enough baking time in Dev before Beta promotion. Thank you.

This is already in 54 beta due to the 50% PointerEvents finch trial and we've only heard of a single issue so far.  I don't think there's any reason to block 55 beta on it.

Issue 652845 has been merged into this issue.

Could you tell where do you do the trial (i.e. Dev/Beta) and how to disable it in the code? I'd like to do some tests for Issue 652845.

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/53723b1ce879dcd1e5500fe8a3ad070f9dd3543a

commit 53723b1ce879dcd1e5500fe8a3ad070f9dd3543a
Author: nzolghadr <nzolghadr@chromium.org>
Date: Thu Oct 13 14:25:23 2016

Create user gesture indicator for pointerup

Creating a user gesture token before dispatching
pointerup event

BUG= 609363 

Review-Url: https://codereview.chromium.org/2401643005
Cr-Commit-Position: refs/heads/master@{#425022}

[add] https://crrev.com/53723b1ce879dcd1e5500fe8a3ad070f9dd3543a/third_party/WebKit/LayoutTests/fast/events/popup-allowed-from-pointerup-exactly-once.html
[modify] https://crrev.com/53723b1ce879dcd1e5500fe8a3ad070f9dd3543a/third_party/WebKit/Source/core/input/PointerEventManager.cpp

The fix has landed in master. Waiting for the next Canary to test the fix once again and if everything goes well I merge it to M55.

I verified the fix and Chrome canary works fine when touch to play the video in this link
http://indianexpress.com/article/india/india-news-india/pm-modi-doing-dalali-rahul-gandhi-surgical-strikes/

Your change meets the bar and is auto-approved for M55 (branch: 2883)

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/8fba3d4353e6bd3bbe9ec97a8113e8f3aa3ee7f9

commit 8fba3d4353e6bd3bbe9ec97a8113e8f3aa3ee7f9
Author: Navid Zolghadr <nzolghadr@chromium.org>
Date: Tue Oct 18 16:11:17 2016

Create user gesture indicator for pointerup

Creating a user gesture token before dispatching
pointerup event

BUG= 609363 

Review-Url: https://codereview.chromium.org/2401643005
Cr-Commit-Position: refs/heads/master@{#425022}
(cherry picked from commit 53723b1ce879dcd1e5500fe8a3ad070f9dd3543a)
(cherry picked from commit 0d036a80df877e6c4863e8834ddca8c11ae7706c)

Review URL: https://codereview.chromium.org/2426993002 .

Cr-Commit-Position: refs/branch-heads/2883@{#176}
Cr-Branched-From: 614d31daee2f61b0180df403a8ad43f20b9f6dd7-refs/heads/master@{#423768}

[add] https://crrev.com/8fba3d4353e6bd3bbe9ec97a8113e8f3aa3ee7f9/third_party/WebKit/LayoutTests/fast/events/popup-allowed-from-pointerup-exactly-once.html
[modify] https://crrev.com/8fba3d4353e6bd3bbe9ec97a8113e8f3aa3ee7f9/third_party/WebKit/Source/core/input/PointerEventManager.cpp

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/8fba3d4353e6bd3bbe9ec97a8113e8f3aa3ee7f9

commit 8fba3d4353e6bd3bbe9ec97a8113e8f3aa3ee7f9
Author: Navid Zolghadr <nzolghadr@chromium.org>
Date: Tue Oct 18 16:11:17 2016

Create user gesture indicator for pointerup

Creating a user gesture token before dispatching
pointerup event

BUG= 609363 

Review-Url: https://codereview.chromium.org/2401643005
Cr-Commit-Position: refs/heads/master@{#425022}
(cherry picked from commit 53723b1ce879dcd1e5500fe8a3ad070f9dd3543a)
(cherry picked from commit 0d036a80df877e6c4863e8834ddca8c11ae7706c)

Review URL: https://codereview.chromium.org/2426993002 .

Cr-Commit-Position: refs/branch-heads/2883@{#176}
Cr-Branched-From: 614d31daee2f61b0180df403a8ad43f20b9f6dd7-refs/heads/master@{#423768}

[add] https://crrev.com/8fba3d4353e6bd3bbe9ec97a8113e8f3aa3ee7f9/third_party/WebKit/LayoutTests/fast/events/popup-allowed-from-pointerup-exactly-once.html
[modify] https://crrev.com/8fba3d4353e6bd3bbe9ec97a8113e8f3aa3ee7f9/third_party/WebKit/Source/core/input/PointerEventManager.cpp

[Automated comment] removing mislabelled merge-merged-2840