Last time ( issue 615512 ), I think xiyuan fixed a similar issue.  Perhaps this one is related.

The FATAL line is indeed the problem.

This stack trace might help:

Happens on ChromeOS too with touch pad two-finger scrolling on hangout window.

Program received signal SIGILL, Illegal instruction.
[Switching to Thread 13819]
ui::FlingCurve::FlingCurve (this=0x30c3d4ab92c0, velocity=..., start_timestamp=...) at ../../ui/events/gestures/fling_curve.cc:48
48        CHECK_GT(max_start_velocity, 0);
(gdb) bt
#0  ui::FlingCurve::FlingCurve (this=0x30c3d4ab92c0, velocity=..., start_timestamp=...) at ../../ui/events/gestures/fling_curve.cc:48
#1  0x00007f9563307d3c in CreateDefaultPlatformCurve (initial_velocity=...) at ../../ui/events/gestures/blink/web_gesture_curve_impl.cc:46
#2  ui::WebGestureCurveImpl::CreateFromDefaultPlatformCurve (initial_velocity=..., initial_offset=..., on_main_thread=<optimized out>)
    at ../../ui/events/gestures/blink/web_gesture_curve_impl.cc:60
#3  0x00007f95632a221c in content::BlinkPlatformImpl::createFlingAnimationCurve (this=<optimized out>, device_source=<optimized out>, velocity=..., cumulative_scroll=...)
    at ../../content/child/blink_platform_impl.cc:846
#4  0x00007f9563343e33 in ui::InputHandlerProxy::HandleGestureFlingStart (this=this@entry=0x30c3cf1cf918, gesture_event=...) at ../../ui/events/blink/input_handler_proxy.cc:733
#5  0x00007f9563344a9b in ui::InputHandlerProxy::HandleInputEvent (this=0x30c3cf1cf918, event=...) at ../../ui/events/blink/input_handler_proxy.cc:346
#6  0x00007f9563346293 in ui::InputHandlerProxy::HandleInputEventWithLatencyInfo (this=0x30c3cf1cf918, event=..., latency_info=latency_info@entry=0x7f955436d250)
    at ../../ui/events/blink/input_handler_proxy.cc:278
#7  0x00007f9561191568 in content::InputHandlerManager::HandleInputEvent (this=0x30c3ceea8c00, routing_id=13, input_event=0x30c3cfede638, latency_info=0x7f955436d250)
    at ../../content/renderer/input/input_handler_manager.cc:231
#8  0x00007f956118fea4 in Run (args#2=0x7f955436d250, args#1=0x30c3cfede638, args#0=13, this=0x30c3cee18a50) at ../../base/callback.h:389
#9  content::InputEventFilter::ForwardToHandler (this=0x30c3cee18a00, message=...) at ../../content/renderer/input/input_event_filter.cc:194
#10 0x00007f955d70ad41 in Run (this=0x7f955436db88) at ../../base/callback.h:389
#11 base::debug::TaskAnnotator::RunTask (this=0x30c3cee20180, queue_function=<optimized out>, pending_task=...) at ../../base/debug/task_annotator.cc:51
#12 0x00007f955d6b0454 in base::MessageLoop::RunTask (this=0x30c3cee20000, pending_task=...) at ../../base/message_loop/message_loop.cc:494
#13 0x00007f955d6b085e in base::MessageLoop::DeferOrRunPendingTask (this=0x30c3cee20000, pending_task=...) at ../../base/message_loop/message_loop.cc:503
#14 0x00007f955d6b2a58 in base::MessageLoop::DoWork (this=0x30c3cee20000) at ../../base/message_loop/message_loop.cc:627
#15 0x00007f955d6b2e09 in base::MessagePumpDefault::Run (this=0x30c3ceefcc60, delegate=0x30c3cee20000) at ../../base/message_loop/message_pump_default.cc:35
#16 0x00007f955d6cdbca in base::RunLoop::Run (this=0x7f955436dcc0) at ../../base/run_loop.cc:35
#17 0x00007f955d6afb49 in base::MessageLoop::Run (this=<optimized out>) at ../../base/message_loop/message_loop.cc:295
#18 0x00007f955d6ed142 in base::Thread::ThreadMain (this=0x30c3cee488c0) at ../../base/threading/thread.cc:256
#19 0x00007f955d6e9666 in base::(anonymous namespace)::ThreadFunc (params=<optimized out>) at ../../base/threading/platform_thread_posix.cc:70
#20 0x00007f955c0d2307 in start_thread (arg=0x7f955436e700) at pthread_create.c:309
#21 0x00007f955ab905cd in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:111
(gdb) p max_start_velocity 
$1 = 0

De-duped from  issue 628525  since sahel@ wants to focus on event_sender.cc validation for the test and does not think that would fix the issue on chromeos.

Pass to asimjour@ per aldr@:
Adding Amir who may have been looking into fling generation code on Chrome OS recently

fyi, I have added some log in MakeWebGestureEventFromAuraEvent [1] and confirmed that x_offset() and y_offset() of ET_SCROLL_FLING_START typed ui::ScrollEvent are both 0.

https://cs.chromium.org/chromium/src/content/browser/renderer_host/web_input_event_aura.cc?rcl=0&l=165-167

I am currently fixing 627623 and it seems these bugs are dup. I was able to repro crash in Hangout as described in https://chromium-review.googlesource.com/#/c/361789. With that CL no more crash is observed for both bugs (the same for Files.app).

 Issue 628829  has been merged into this issue.

Can we confirm that the fix for  bug 627623  fixes this as well?

I tested and CL for  bug 627623   did fix. However CL was banned since it affects 2-finger Chrome navigation. Need alternative fix that is safe for Chrome navigation and for our bugs. I can confirm only that source of this problems is the same (Chrome OS Scroll manager issues empty fling event that is not compatible with all Chrome parts).