Assigning to the concern owner from Predator results --
The result is a list of CLs that change the crashed files. 

Author: szager
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src/+/a84f6044bfe3bc52dde4c2cdddbbc92be1b56ab1
Time: Mon Jan 30 23:56:54 2017
Lines 195, 985-989 of file ScrollingCoordinator.cpp which potentially caused crash are changed in this cl (frame #2, "blink::ScrollingCoordinator::computeShouldHandleScrollGestureOnMainThreadRegion"; frame #3, "blink::ScrollingCoordinator::updateAfterCompositingChangeIfNeeded"). 

Files FrameView.cpp, PaintLayerScrollableArea.cpp are changed in this cl (and is part of stack frame #4, "blink::FrameView::updateLifecyclePhasesInternal")
Minimum distance from crash line to modified line: 0. (file: ScrollingCoordinator.cpp, crashed on: 195, modified: 195).

@szager -- Could you please look into the issue, kindly re-assign if this is not related to your changes.
Thank You.

Stefan and I looked at this and we do not think it is a security bug, nor a bug that would occur on real pages with non-planet-sized scrollers.