Splitting the user gesture token for pointerup/touchend into two (one for each event) would allow two popups per user gesture, which would be off by a single popup.  Given that Safari allowed unlimited popups until recently, and Firefox still allows unlimited popups, allowing just two is not that bad.

Another reason I prefer token splitting here is to avoid code complexity.  If we want to allow only one here, we have to fix the case where touchend and pointerup goes to different frames because of capturing.  This looks overkill for a very little benefit.  Note that we currently have complex token maintainer code to unify mousedown and mouseup tokens, and we want to drop mousedown as a user gesture because of this (among other reasons), see Issue 769796.

I think this is probably OK (at least for now).  There's a longstanding bug
somewhere about touchend and click getting separate tokens and IIRC we've
never seen a problem in practice and everyone has been fine considering it
a low-priority bug.

Sounds good. Now that my refactoring wave passed that point of the code this might be a good time to revisit this issue. mustaq@ do you like to take a look at this or do you want me to separate the gesture tokens?

This is almost like a code-health issue because the impact of the split token should be negligible.