Chrome Version: ToT 61.0.3140.0
OS: Chrome OS (simulation)

What steps will reproduce the problem?
(1) Run with --mus
(2) Drag a tab (even when only a single tab in a window)

--- in Browser:

Received signal 11 SEGV_MAPERR 000000000080
#0 0x7f1693d0db6c base::debug::StackTrace::StackTrace()
#1 0x7f1693d0d6d1 base::debug::(anonymous namespace)::StackDumpSignalHandler()
#2 0x7f1693e4e330 <unknown>
#3 0x5586cac1f05b GetLocalProcessWindowAtPointMus()
#4 0x5586cac18c38 WindowFinder::GetLocalProcessWindowAtPoint()
#5 0x5586cac1750e TabDragController::GetLocalProcessWindow()
#6 0x5586cac15d89 TabDragController::GetTargetTabStripForPoint()
#7 0x5586cac155cc TabDragController::ContinueDragging()
#8 0x5586cac14073 TabDragController::Drag()
#9 0x5586caa6235f TabStrip::ContinueDrag()
#10 0x5586caa59f7a Tab::OnMouseDragged()
#11 0x7f168fce9384 views::View::ProcessMouseDragged()
#12 0x7f168fce9054 views::View::OnMouseEvent()
#13 0x7f16909397db ui::EventDispatcher::ProcessEvent()
#14 0x7f1690939587 ui::EventDispatcherDelegate::DispatchEvent()
#15 0x7f168fcee962 views::internal::RootView::OnMouseDragged()
#16 0x7f168fcf4124 views::Widget::OnMouseEvent()
#17 0x7f16909397db ui::EventDispatcher::ProcessEvent()
#18 0x7f1690939587 ui::EventDispatcherDelegate::DispatchEvent()
#19 0x7f169093a23c ui::EventProcessor::OnEventFromSource()
#20 0x7f169093a6db ui::EventSource::SendEventToSink()
#21 0x7f169056707c aura::WindowTreeClient::OnWindowInputEvent()
#22 0x7f169058556b ui::mojom::WindowTreeClientStubDispatch::Accept()
#23 0x7f1692a0176b mojo::internal::MultiplexRouter::ProcessIncomingMessage()
#24 0x7f1692a006d2 mojo::internal::MultiplexRouter::ProcessTasks()
#25 0x7f1692a01e13 mojo::internal::MultiplexRouter::LockAndCallProcessTasks()
#26 0x7f1693d0e502 base::debug::TaskAnnotator::RunTask()
#27 0x7f1693d33a7b base::MessageLoop::RunTask()
#28 0x7f1693d33e4b base::MessageLoop::DeferOrRunPendingTask()
#29 0x7f1693d342b1 base::MessageLoop::DoWork()
#30 0x7f1693d35b69 base::MessagePumpLibevent::Run()
#31 0x7f1693d5e3a3 base::RunLoop::Run()
#32 0x5586c990d908 ChromeBrowserMainParts::MainMessageLoopRun()
#33 0x7f169190f877 content::BrowserMainLoop::RunMainMessageLoopParts()
#34 0x7f1691911ec2 content::BrowserMainRunnerImpl::Run()
#35 0x7f169190b60f content::BrowserMain()
#36 0x7f1691f77f97 content::ContentMainRunnerImpl::Run()
#37 0x7f169421a21b service_manager::Main()
#38 0x7f1691f76f54 content::ContentMain()
#39 0x5586c913ac7f ChromeMain
#40 0x7f1689478f45 __libc_start_main
#41 0x5586c913aae4 <unknown>
  r8: 0000000000000000  r9: 0000000000000001 r10: 000016afd488ac20 r11: 00007f16895e0cf0
 r12: 00007ffc482eeb20 r13: 00007ffc482eeb20 r14: 00007ffc482ee8b8 r15: 00007ffc482ee958
  di: 00005586cb69af22  si: 000016afd2ac0dda  bp: 00007ffc482ee870  bx: 00007ffc482ee888
  dx: 0000000000000012  ax: 0000000000000000  cx: 000016afd2aa9100  sp: 00007ffc482ee7f0
  ip: 00005586cac1f05b efl: 0000000000010202 cgf: 0000000000000033 erf: 0000000000000004
 trp: 000000000000000e msk: 0000000000000000 cr2: 0000000000000080
[end of stack trace]


--- in WS:

Received signal 11 SEGV_MAPERR 000000000070
#0 0x7f5426c58b6c base::debug::StackTrace::StackTrace()
#1 0x7f5426c586d1 base::debug::(anonymous namespace)::StackDumpSignalHandler()
#2 0x7f5426d99330 <unknown>
#3 0x5623f32293c0 [12608:12608:0623/110800.263705:2590359865177:ERROR:chrome_main_delegate.cc(1187)] Main process exiting because service ash quit unexpectedly.
<unknown>
#4 0x5623f322341f ui::ws::WindowManagerState::GetEventTargetClientId()
#5 0x5623f323635e ui::ws::EventDispatcher::GetCurrentMouseCursor()
#6 0x5623f3222c61 ui::ws::WindowManagerState::UpdateNativeCursorFromDispatcher()
#7 0x5623f3238241 ui::ws::EventTargeter::FindTargetForLocationNow()
#8 0x5623f32381aa ui::ws::EventTargeter::ProcessFindTarget()
#9 0x5623f3237fc0 ui::ws::EventTargeter::FindTargetForLocation()
#10 0x5623f323607a ui::ws::EventDispatcher::CancelPointerEventsToTarget()
#11 0x5623f323bdb6 ui::ws::ServerWindow::Remove()
#12 0x5623f323b7fe ui::ws::ServerWindow::~ServerWindow()
#13 0x5623f32287d9 ui::ws::WindowTree::DestroyWindows()
#14 0x5623f3228373 ui::ws::WindowTree::~WindowTree()
#15 0x5623f322889e ui::ws::WindowTree::~WindowTree()
#16 0x5623f3224bfd ui::ws::WindowServer::DestroyTree()
#17 0x7f5425946ff5 mojo::InterfaceEndpointClient::NotifyError()
#18 0x7f542594ca0a mojo::internal::MultiplexRouter::ProcessNotifyErrorTask()
#19 0x7f542594b64f mojo::internal::MultiplexRouter::ProcessTasks()
#20 0x7f542594a228 mojo::internal::MultiplexRouter::OnPipeConnectionError()
#21 0x7f5425943ff9 mojo::Connector::HandleError()
#22 0x7f54259241c3 mojo::SimpleWatcher::OnHandleReady()
#23 0x7f5426c59502 base::debug::TaskAnnotator::RunTask()
#24 0x7f5426c7ea7b base::MessageLoop::RunTask()
#25 0x7f5426c7ee4b base::MessageLoop::DeferOrRunPendingTask()
#26 0x7f5426c7f2b1 base::MessageLoop::DoWork()
#27 0x7f5426c80b69 base::MessagePumpLibevent::Run()
#28 0x7f5426ca93a3 base::RunLoop::Run()
#29 0x7f5427165f3f _ZN4base8internal7InvokerINS0_9BindStateIZN15service_manager12_GLOBAL__N_110RunServiceEPNS3_12MainDelegateEE3$_0JS6_PiEEEFvN4mojo16InterfaceRequestINS3_5mojom7ServiceEEEEE3RunEPNS0_13BindStateBaseEOSE_
#30 0x7f5427167a19 service_manager::RunStandaloneService()
#31 0x7f54271654bc service_manager::Main()
#32 0x7f5424ec1f54 content::ContentMain()
#33 0x5623f12f3c7f ChromeMain
#34 0x7f541c3c3f45 __libc_start_main
#35 0x5623f12f3ae4 <unknown>
  r8: 0000000000000000  r9: 0000000080000000 r10: 0000000000000000 r11: 0000000000000000
 r12: 00007fffbf9cb188 r13: 000007df710642c4 r14: 000007df71064180 r15: 0000000000000000
  di: 0000000000000000  si: 000007df720b5500  bp: 00007fffbf9caff0  bx: 000007df720b5500
  dx: 0000000000000000  ax: 0000000000000000  cx: 000007df72050ae0  sp: 00007fffbf9cafc8
  ip: 00005623f32293c0 efl: 0000000000010246 cgf: 0000000000000033 erf: 0000000000000004
 trp: 000000000000000e msk: 0000000000000000 cr2: 0000000000000070
[end of stack trace]