Sometimes I can get the engine renderer to crash by scrolling around a page and tapping. I can repro this ~50% of the time.

Steps:
1. visit www.slate.com, allowing images to render in their entirety;
2. quickly scroll to the page bottom via tap/fling gestures;
3. scroll back up to the the page top;
4. press the hamburger menu button in the top right hand corner;
5. *engine crashes*

Here's the output I see from the engine:
[15089:15089:0511/165120:FATAL:tap_suppression_controller.cc(109)] Check failed: false. Invalid tap end on LAST_CANCEL_STOPPED_FLING state
#0 0x7f07e53446de base::debug::StackTrace::StackTrace()
#1 0x7f07e53a6cef logging::LogMessage::~LogMessage()
#2 0x7f07e16f04db content::TapSuppressionController::ShouldSuppressTapEnd()
#3 0x7f07e17036d0 content::TouchscreenTapSuppressionController::FilterTapEvent()
#4 0x7f07e16c0fca content::GestureEventQueue::ShouldForwardForTapSuppression()
#5 0x7f07e16c0c28 content::GestureEventQueue::QueueEvent()
#6 0x7f07e16c9cc9 content::InputRouterImpl::SendGestureEvent()
#7 0x7f07e180ebdb content::RenderWidgetHostImpl::ForwardGestureEventWithLatencyInfo()
#8 0x7f07e180e6a0 content::RenderWidgetHostImpl::ForwardGestureEvent()
#9 0x00000051b6dc blimp::engine::BlimpEngineSession::OnWebGestureEvent()
#10 0x000000526acf blimp::engine::EngineRenderWidgetFeature::ProcessMessage()
#11 0x7f07e58d7f1d blimp::(anonymous namespace)::DispatchProcessMessage()
#12 0x7f07e58d9e47 _ZN4base8internal15RunnableAdapterIPFvNS_7WeakPtrIN5blimp22BlimpMessageThreadPipeEEESt10unique_ptrINS3_12BlimpMessageESt14default_deleteIS7_EERKNS_8CallbackIFviELNS0_8CopyModeE1EEEEE3RunIJRKS5_SA_SG_EEEvDpOT_
#13 0x7f07e58d9d3f _ZN4base8internal12InvokeHelperILb0EvNS0_15RunnableAdapterIPFvNS_7WeakPtrIN5blimp22BlimpMessageThreadPipeEEESt10unique_ptrINS4_12BlimpMessageESt14default_deleteIS8_EERKNS_8CallbackIFviELNS0_8CopyModeE1EEEEEEE8MakeItSoIJRKS6_SB_SH_EEEvSK_DpOT_
#14 0x7f07e58d9cde _ZN4base8internal7InvokerINS_13IndexSequenceIJLm0ELm1ELm2EEEENS0_9BindStateINS0_15RunnableAdapterIPFvNS_7WeakPtrIN5blimp22BlimpMessageThreadPipeEEESt10unique_ptrINS7_12BlimpMessageESt14default_deleteISB_EERKNS_8CallbackIFviELNS0_8CopyModeE1EEEEEESL_JRS9_NS0_13PassedWrapperISE_EERSI_EEENS0_12InvokeHelperILb0EvSN_EEFvvEE3RunEPNS0_13BindStateBaseE
#15 0x7f07e53248be base::Callback<>::Run()
#16 0x7f07e534a12e base::debug::TaskAnnotator::RunTask()
#17 0x7f07e53c404c base::MessageLoop::RunTask()
#18 0x7f07e53c42e8 base::MessageLoop::DeferOrRunPendingTask()
#19 0x7f07e53c4542 base::MessageLoop::DoWork()
#20 0x7f07e53dd02e base::MessagePumpLibevent::Run()
#21 0x7f07e53c3a3f base::MessageLoop::RunHandler()
#22 0x7f07e546a364 base::RunLoop::Run()
#23 0x7f07e10314e6 content::BrowserMainLoop::MainMessageLoopRun()
#24 0x7f07e1031241 content::BrowserMainLoop::RunMainMessageLoopParts()
#25 0x7f07e103a9a5 content::BrowserMainRunnerImpl::Run()
#26 0x7f07e102b046 content::BrowserMain()
#27 0x7f07e2bbb496 content::RunNamedProcessTypeMain()
#28 0x7f07e2bbd712 content::ContentMainRunnerImpl::Run()
#29 0x7f07e2bba552 content::ContentMain()
#30 0x00000041bab5 main
#31 0x7f07d9c35ec5 __libc_start_main
#32 0x00000041b985 <unknown>