On ToT, start mash and drag a window to the side of the screen. You'll see the semi-transparent half-window docking animation. Release the mouse button and crash:

#0 0x7fa9acc74d2e base::debug::StackTrace::StackTrace()
#1 0x7fa9acc7486f base::debug::(anonymous namespace)::StackDumpSignalHandler()
#2 0x7fa99aaf1330 <unknown>
#3 0x7fa9ad9c4f6c std::_Rb_tree<>::_S_left()
#4 0x7fa9b3222350 std::_Rb_tree<>::find()
#5 0x7fa9b321cf5f std::__cxx1998::set<>::count()
#6 0x7fa9b3213567 ui::ws::WindowTree::HasRoot()
#7 0x7fa9b31f96e3 ui::ws::WindowManagerState::GetEventTargetClientId()
#8 0x7fa9b3234476 ui::ws::EventDispatcher::DispatchToPointerTarget()
#9 0x7fa9b32357ed ui::ws::EventDispatcher::ProcessLocatedEvent()
#10 0x7fa9b3235084 ui::ws::EventDispatcher::ProcessEvent()
#11 0x7fa9b31f8161 ui::ws::WindowManagerState::ProcessNextEventFromQueue()
#12 0x7fa9b31f7a13 ui::ws::WindowManagerState::OnEventAck()
#13 0x7fa9b3219f02 ui::ws::WindowTree::OnWindowInputEventAck()
#14 0x7fa9af564007 ui::mojom::WindowTreeStub::Accept()
#15 0x7fa9b123312d mojo::InterfaceEndpointClient::HandleValidatedMessage()
#16 0x7fa9b1232be1 mojo::InterfaceEndpointClient::HandleIncomingMessageThunk::Accept()
#17 0x7fa9af5693df ui::mojom::WindowTreeRequestValidator::Accept()
#18 0x7fa9b1234812 mojo::InterfaceEndpointClient::HandleIncomingMessage()
#19 0x7fa9b124194a mojo::internal::MultiplexRouter::ProcessIncomingMessage()
#20 0x7fa9b12411b4 mojo::internal::MultiplexRouter::Accept()
#21 0x7fa9b123def1 mojo::MessageHeaderValidator::Accept()
#22 0x7fa9b122dd88 mojo::Connector::ReadSingleMessage()
#23 0x7fa9b122e83c mojo::Connector::ReadAllAvailableMessages()
#24 0x7fa9b122e763 mojo::Connector::OnHandleReadyInternal()
#25 0x7fa9b122e63b mojo::Connector::OnWatcherHandleReady()
[I cut off the rest]

After doing a bisect, I narrowed it down to https://codereview.chromium.org/2068093002 / 4d3588cbec, which was the patch that added embed event intercepts, and modified GetEventTargetClientId() which is in the stack above.

I added some basic logging inside WindowManagerState::GetEventTargetClientId(). The case which handles |in_nonclient_area| being true isn't handling all cases; |tree| can still be null after looking up GetTreeWithId().