Adding more details Navid mentioned in another discussion:

> The scenario that I was hitting was that it received an Action::CANCEL for a touch point but it continued receiving Action::MOVE for the other pen pointer that was also on the screen. At some point it would receive an Action:POINTER_UP for the other pen pointer. However, the current implementation of gesture recognizer ignores all those move and up events and only expects a cancel for the second pointer. Since it never receives it, it goes to a bad state and never recovers.

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/c4c13ca59f7518ce7933c08f2d7138c87adcc059

commit c4c13ca59f7518ce7933c08f2d7138c87adcc059
Author: Navid Zolghadr <nzolghadr@chromium.org>
Date: Fri Jul 20 16:34:23 2018

Clean up pointer state in gesture detection

Gesture detection code needs to clean up regardless of whether
input stream is valid or not to prevent lock down of the input
to the renderer.

Bug:  865462 
Change-Id: I97f785a8bc0534cf7f23e33d65550921627789db
Reviewed-on: https://chromium-review.googlesource.com/1143592
Reviewed-by: Timothy Dresser <tdresser@chromium.org>
Reviewed-by: Mustaq Ahmed <mustaq@chromium.org>
Commit-Queue: Navid Zolghadr <nzolghadr@chromium.org>
Cr-Commit-Position: refs/heads/master@{#576895}
[modify] https://crrev.com/c4c13ca59f7518ce7933c08f2d7138c87adcc059/ui/events/gestures/gesture_provider_aura.cc
[modify] https://crrev.com/c4c13ca59f7518ce7933c08f2d7138c87adcc059/ui/events/gestures/gesture_provider_aura_unittest.cc

Pls apply appropriate OSs label. Thank you.

Your change meets the bar and is auto-approved for M69. Please go ahead and merge the CL to branch 3497 manually. Please contact milestone owner if you have questions.
Owners: amineer@(Android), kariahda@(iOS), cindyb@(ChromeOS), govind@(Desktop)

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Please merge your change to M69 branch 3497 by 4:00 PM PT today, so we can pick it up for next week last M69 Dev release. Thank you.

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/2b1700e532d11873f926bf519b3e84e298863561

commit 2b1700e532d11873f926bf519b3e84e298863561
Author: Navid Zolghadr <nzolghadr@chromium.org>
Date: Thu Jul 26 16:56:14 2018

Clean up pointer state in gesture detection

Gesture detection code needs to clean up regardless of whether
input stream is valid or not to prevent lock down of the input
to the renderer.

Bug:  865462 
Change-Id: I97f785a8bc0534cf7f23e33d65550921627789db
Reviewed-on: https://chromium-review.googlesource.com/1143592
Reviewed-by: Timothy Dresser <tdresser@chromium.org>
Reviewed-by: Mustaq Ahmed <mustaq@chromium.org>
Commit-Queue: Navid Zolghadr <nzolghadr@chromium.org>
Cr-Original-Commit-Position: refs/heads/master@{#576895}(cherry picked from commit c4c13ca59f7518ce7933c08f2d7138c87adcc059)
Reviewed-on: https://chromium-review.googlesource.com/1151509
Reviewed-by: Navid Zolghadr <nzolghadr@chromium.org>
Cr-Commit-Position: refs/branch-heads/3497@{#113}
Cr-Branched-From: 271eaf50594eb818c9295dc78d364aea18c82ea8-refs/heads/master@{#576753}
[modify] https://crrev.com/2b1700e532d11873f926bf519b3e84e298863561/ui/events/gestures/gesture_provider_aura.cc
[modify] https://crrev.com/2b1700e532d11873f926bf519b3e84e298863561/ui/events/gestures/gesture_provider_aura_unittest.cc