This may be caused by  https://crbug.com/672998 .  I'm not confident of this yet, but the shoe seems to fit.  I'm paring down our code to make reproducing the issue easy.

A bisect shows that 672998 is most likely unrelated.  The break happens at this commit:

Author: skia-deps-roller <skia-deps-roller@chromium.org>
Date:   Fri Jan 20 22:23:55 2017 -0800

    Roll src/third_party/skia/ 151722434..17b5e5c59 (52 commits).
    
    https://skia.googlesource.com/skia.git/+log/1517224346e9..17b5e5c591fc

I reduced my repro to a single html file with inline styling and script.  I serve the file on my workstation, and use port-forwarding to let my Pixel load the page.

I'm running a ToT Chromium for Android debug build.

Our page has some interesting device-width properties.  Removing these hides (or fixes) the problem.

Here's a video of what I'm seeing:

https://goo.gl/photos/hzomK4BqAHB7s1gd8

Deleted: test.html 1.7 KB

test.html 1.7 KB View Download

Note...  This issue was found using mouseenter/mouseleave, but can be reproduced by tapping on and off the button on an Android phone.

crashes on mac as well:

[53742:76035:0126/121824.448452:FATAL:PointerEventFactory.cpp(273)] Check failed: mouseEvent.pointerProperties().pointerType == coalescedMouseEvent.pointerProperties().pointerType (1 vs. 0)
0   libbase.dylib                       0x000000010d13d35e _ZN4base5debug10StackTraceC2Ev + 30
1   libbase.dylib                       0x000000010d13d3d5 _ZN4base5debug10StackTraceC1Ev + 21
2   libbase.dylib                       0x000000010d1d5d80 _ZN7logging10LogMessageD2Ev + 80
3   libbase.dylib                       0x000000010d1d3885 _ZN7logging10LogMessageD1Ev + 21
4   libblink_core.dylib                 0x000000013cc225eb _ZN5blink19PointerEventFactory6createERKN3WTF12AtomicStringERKNS_18PlatformMouseEventERKNS1_6VectorIS5_Lm0ENS1_18PartitionAllocatorEEEPNS_14LocalDOMWindowE + 1531
5   libblink_core.dylib                 0x000000013d168b1f _ZN5blink19PointerEventManager21sendMousePointerEventEPNS_4NodeERKN3WTF12AtomicStringERKNS_18PlatformMouseEventERKNS3_6VectorIS7_Lm0ENS3_18PartitionAllocatorEEE + 143
6   libblink_core.dylib                 0x000000013d148ed0 _ZN5blink12EventHandler36updatePointerTargetAndDispatchEventsERKN3WTF12AtomicStringEPNS_4NodeERKNS_18PlatformMouseEventERKNS1_6VectorIS7_Lm0ENS1_18PartitionAllocatorEEE + 384
7   libblink_core.dylib                 0x000000013d149e5f _ZN5blink12EventHandler27handleMouseMoveOrLeaveEventERKNS_18PlatformMouseEventERKN3WTF6VectorIS1_Lm0ENS4_18PartitionAllocatorEEEPNS_13HitTestResultEbb + 2607
8   libblink_core.dylib                 0x000000013d1492a2 _ZN5blink12EventHandler20handleMouseMoveEventERKNS_18PlatformMouseEventERKN3WTF6VectorIS1_Lm0ENS4_18PartitionAllocatorEEE + 370
9   libblink_web.dylib                  0x000000013aa97569 _ZN5blink22PageWidgetEventHandler15handleMouseMoveERNS_10LocalFrameERKNS_13WebMouseEventERKNSt3__16vectorIPKNS_13WebInputEventENS6_9allocatorISA_EEEE + 153
10  libblink_web.dylib                  0x000000013aa97119 _ZN5blink18PageWidgetDelegate16handleInputEventERNS_22PageWidgetEventHandlerERKNS_22WebCoalescedInputEventEPNS_10LocalFrameE + 745
11  libblink_web.dylib                  0x000000013abfde2f _ZN5blink11WebViewImpl16handleInputEventERKNS_22WebCoalescedInputEventE + 4287
12  libblink_web.dylib                  0x000000013abf3c7c _ZN5blink18WebViewFrameWidget16handleInputEventERKNS_22WebCoalescedInputEventE + 44
13  libcontent.dylib                    0x000000012ecb05da _ZN7content24RenderWidgetInputHandler16HandleInputEventERKN5blink22WebCoalescedInputEventERKN2ui11LatencyInfoENS_22InputEventDispatchTypeE + 3130

reed@, I'm not reporting a crash, but a rendering error caused by skia changes.  Are you sure your crash is related?

Actually, sorry reed@, I missed that Ethan was going to assign this to you.  Can you take it, or were you saying there's a different issue at hand?

Assigning to reed@, please punt if necessary.

The "crash" I saw was an assert in PointerEventFactory.cpp(273). I think this is unrelated to skia.

Maybe the crash, yes.  But I found that a skia roll commit caused the rendering issue to start happening (see bisect comments above).  Doesn't that seem highly related to skia?  What am I missing?

Agreed. The assert in PointerEventFactory seems unrelated, as I just commented it out, and can see the bug (when I force GPU backend).

Manually bisected to this Skia change:

https://skia.googlesource.com/skia.git/+/de4d301881e7fd084f1f0b359ec6f9b2bf8bd4c5
Replaced all calls to fragmentPosition() with sk_FragCoord

 Issue 684753  has been merged into this issue.

This is quite a severe visual regression, so adding RB-S for M58.

regression seems to have been introduced in 58.0.2989.0

 Issue 688125  has been merged into this issue.

 Issue 687302  has been merged into this issue.

ethannicholas@: Can we get an update on this, we have seen multiple reports of this on canary channel in  Issue 684753   Issue 688186   Issue 687302  & probably  Issue 683799 

Changing the blocker/OS label based on the duped issues.

Should be fixed with the latest Skia roll.

 Issue 688857  has been merged into this issue.

ethannicholas@ can you link the CL referenced in #24 thanks.