While debugging 735196, I noticed that I can consistently hit the following dcheck. The steps to reproduce is, navigate to https://blog.google/products/g-suite/track-projects-g-suite-and-asana/ (I used N7). Wait for the page to load, in the middle there's a black rect that appears and if I try scrolling around that rect, I hit this:

[FATAL:legacy_input_router_impl.cc(504)] Check failed: touch_event_queue_->IsPendingAckTouchStart().

The backtrace as far as I could symbolize it is:
I/DEBUG   (  177):     #00  pc 00021f90  /system/lib/libc.so (tgkill+12)
I/DEBUG   (  177):     #01  pc 00012fe1  /system/lib/libc.so (pthread_kill+48)
I/DEBUG   (  177):     #02  pc 000131f5  /system/lib/libc.so (raise+10)
I/DEBUG   (  177):     #03  pc 00011f2b  /system/lib/libc.so
I/DEBUG   (  177):     #04  pc 00021844  /system/lib/libc.so (abort+4)
I/DEBUG   (  177):     #05  pc 000954b5  /data/app-lib/org.chromium.chrome-2/libbase.cr.so (base::debug::BreakDebugger()+20)
I/DEBUG   (  177):     #06  pc 000ad551  /data/app-lib/org.chromium.chrome-2/libbase.cr.so (logging::LogMessage::~LogMessage()+960)
I/DEBUG   (  177):     #07  pc 008154d1  /data/app-lib/org.chromium.chrome-2/libcontent.cr.so (content::LegacyInputRouterImpl::OnSetTouchAction(cc::TouchAction)+52)
I/DEBUG   (  177):     #08  pc 0081543d  /data/app-lib/org.chromium.chrome-2/libcontent.cr.so
I/DEBUG   (  177):     #09  pc 00814e0f  /data/app-lib/org.chromium.chrome-2/libcontent.cr.so (content::LegacyInputRouterImpl::OnMessageReceived(IPC::Message const&)+650)
I/DEBUG   (  177):     #10  pc 0085f239  /data/app-lib/org.chromium.chrome-2/libcontent.cr.so (content::RenderWidgetHostImpl::OnMessageReceived(IPC::Message const&)+524)
I/DEBUG   (  177):     #11  pc 0001548d  /data/app-lib/org.chromium.chrome-2/libipc.cr.so (IPC::ChannelProxy::Context::OnDispatchMessage(IPC::Message const&)+24)
I/DEBUG   (  177):     #12  pc 00089027  /data/app-lib/org.chromium.chrome-2/libbase.cr.so
I/DEBUG   (  177):     #13  pc 00095c6f  /data/app-lib/org.chromium.chrome-2/libbase.cr.so (base::debug::TaskAnnotator::RunTask(char const*, base::PendingTask*)+150)
I/DEBUG   (  177):     #14  pc 000b57e9  /data/app-lib/org.chromium.chrome-2/libbase.cr.so (base::MessageLoop::RunTask(base::PendingTask*)+264)
I/DEBUG   (  177):     #15  pc 000b5a07  /data/app-lib/org.chromium.chrome-2/libbase.cr.so (base::MessageLoop::DeferOrRunPendingTask(base::PendingTask)+102)
I/DEBUG   (  177):     #16  pc 000b5c31  /data/app-lib/org.chromium.chrome-2/libbase.cr.so (base::MessageLoop::DoWork()+296)
I/DEBUG   (  177):     #17  pc 000b6ee5  /data/app-lib/org.chromium.chrome-2/libbase.cr.so (Java_org_chromium_base_SystemMessageHandler_nativeDoRunLoopOnce+36)
I/DEBUG   (  177):     #18  pc 0001dbcc  /system/lib/libdvm.so (dvmPlatformInvoke+112)
I/DEBUG   (  177):     #19  pc 0004e123  /system/lib/libdvm.so (dvmCallJNIMethod(unsigned int const*, JValue*, Method const*, Thread*)+398)
I/DEBUG   (  177):     #20  pc 00000214  /dev/ashmem/dalvik-jit-code-cache (deleted)


Assigning to dtapuska as the last person to touch that dcheck, but feel free to reassign.