Repro steps:
1. Get on the login screen;
2. Turn on spoken feedback (either by ctrl+alt+z or system tray menu)

Chrome crashes after step 2, prior showing the ChromeVox panel. The crash is because ChromeVoxPanel tries to access ash shelf, which is not created on the login screen.

Stack:

Program received signal SIGSEGV, Segmentation fault.
0x00007fdbedfa87e3 in DidFirstVisuallyNonEmptyPaint (this=<optimized out>) at ../../chrome/browser/chromeos/accessibility/chromevox_panel.cc:114
warning: Source file is more recent than executable.
114           ->SetChromeVoxPanelHeight(kPanelHeight);
(gdb) bt
#0  0x00007fdbedfa87e3 in DidFirstVisuallyNonEmptyPaint (this=<optimized out>) at ../../chrome/browser/chromeos/accessibility/chromevox_panel.cc:114
#1  ChromeVoxPanelWebContentsObserver::DidFirstVisuallyNonEmptyPaint (this=<optimized out>) at ../../chrome/browser/chromeos/accessibility/chromevox_panel.cc:42
#2  0x00007fdbed5164e4 in content::WebContentsImpl::OnFirstVisuallyNonEmptyPaint (this=<optimized out>) at ../../content/browser/web_contents/web_contents_impl.cc:3605
#3  0x00007fdbed51e3b2 in DispatchToMethodImpl<content::WebContentsImpl*, void (content::WebContentsImpl::*)()> (obj=<optimized out>, arg=..., method=<optimized out>)
    at ../../base/tuple.h:166
#4  DispatchToMethod<content::WebContentsImpl*, void (content::WebContentsImpl::*)()> (obj=<optimized out>, arg=..., method=<optimized out>) at ../../base/tuple.h:173
#5  DispatchToMethod<content::WebContentsImpl, void (content::WebContentsImpl::*)(), void, std::tuple<> > (tuple=..., method=<optimized out>, obj=<optimized out>)
    at ../../ipc/ipc_message_templates.h:25
#6  Dispatch<content::WebContentsImpl, content::WebContentsImpl, void, void (content::WebContentsImpl::*)()> (sender=<optimized out>, parameter=<optimized out>, 
    func=<optimized out>, obj=<optimized out>, msg=<optimized out>) at ../../ipc/ipc_message_templates.h:119
#7  content::WebContentsImpl::OnMessageReceived (this=<optimized out>, render_view_host=<optimized out>, render_frame_host=<optimized out>, message=...)
    at ../../content/browser/web_contents/web_contents_impl.cc:606
#8  0x00007fdbed477431 in content::RenderViewHostImpl::OnMessageReceived (this=<optimized out>, msg=...) at ../../content/browser/renderer_host/render_view_host_impl.cc:892
#9  0x00007fdbed483123 in content::RenderWidgetHostImpl::OnMessageReceived (this=<optimized out>, msg=...) at ../../content/browser/renderer_host/render_widget_host_impl.cc:443
#10 0x00007fdbed46f3d5 in content::RenderProcessHostImpl::OnMessageReceived (this=<optimized out>, msg=...) at ../../content/browser/renderer_host/render_process_host_impl.cc:1804
#11 0x00007fdbed480399 in content::RenderWidgetHostImpl::OnSwapCompositorFrame (this=<optimized out>, message=...)
    at ../../content/browser/renderer_host/render_widget_host_impl.cc:1617
#12 0x00007fdbed482c35 in content::RenderWidgetHostImpl::OnMessageReceived (this=<optimized out>, msg=...) at ../../content/browser/renderer_host/render_widget_host_impl.cc:459
#13 0x00007fdbed46f3d5 in content::RenderProcessHostImpl::OnMessageReceived (this=<optimized out>, msg=...) at ../../content/browser/renderer_host/render_process_host_impl.cc:1804
#14 0x00007fdbeac79c28 in IPC::ChannelProxy::Context::OnDispatchMessage (this=<optimized out>, message=...) at ../../ipc/ipc_channel_proxy.cc:293

...