It happens after it runs for several seconds.
One workaround is to comment out WallpaperManagerBase::MoveLoggedInUserCustomWallpaper()

The code that is crashing was added in https://codereview.chromium.org/1886653002. 
I am not sure how is it supposed to work. there seems to be no code which would set raw_salt_ in SystemSaltGetter, and when raw_salt_ is not set, we hit LOG(FATAL) in HashWallpaperFilesIdStr()...

[24127:24127:0414/145243:FATAL:wallpaper_manager.cc(153)] WallpaperManager HashWallpaperFilesIdStr(): no 
salt!
#0 0x7f54753b310e base::debug::StackTrace::StackTrace()
#1 0x7f5475408d3c logging::LogMessage::~LogMessage()
#2 0x7f5479a175dd chromeos::(anonymous namespace)::HashWallpaperFilesIdStr()
#3 0x7f5479a17405 chromeos::WallpaperManager::GetFilesId()
#4 0x7f5467b07347 wallpaper::WallpaperManagerBase::MoveLoggedInUserCustomWallpaper()
#5 0x7f5476106029 _ZN4base8internal15RunnableAdapterIM19BrowsingDataCounterFvvEE3RunIJEEEvPS2_DpOT_
#6 0x7f5476135f90 _ZN4base8internal12InvokeHelperILb1EvNS0_15RunnableAdapterIM19BrowsingDataRemoverFvvEEE
E8MakeItSoINS_7WeakPtrIS3_EEJEEEvS6_T_DpOT0_
#7 0x7f5479a1c10d _ZN4base8internal7InvokerINS_13IndexSequenceIJLm0EEEENS0_9BindStateINS0_15RunnableAdapt
erIMN9wallpaper20WallpaperManagerBaseEFvvEEEFvPS7_EJNS_7WeakPtrIN8chromeos16WallpaperManagerEEEEEENS0_12I
nvokeHelperILb1EvSA_EEFvvEE3RunEPNS0_13BindStateBaseE
#8 0x7f547539707e base::Callback<>::Run()
#9 0x7f54753b88be base::debug::TaskAnnotator::RunTask()
#10 0x7f54754244d1 base::MessageLoop::RunTask()
#11 0x7f5475424758 base::MessageLoop::DeferOrRunPendingTask()
#12 0x7f5475424b86 base::MessageLoop::DoDelayedWork()
#13 0x7f547543644e base::MessagePumpLibevent::Run()
#14 0x7f5475423f4a base::MessageLoop::RunHandler()
#15 0x7f54754b4d04 base::RunLoop::Run()
#16 0x7f547618d537 ChromeBrowserMainParts::MainMessageLoopRun()
#17 0x7f546f06d669 content::BrowserMainLoop::RunMainMessageLoopParts()
#18 0x7f546f076af5 content::BrowserMainRunnerImpl::Run()
#19 0x7f546f067716 content::BrowserMain()
#20 0x7f547096f816 content::RunNamedProcessTypeMain()
#21 0x7f54709711b9 content::ContentMainRunnerImpl::Run()
#22 0x7f547096edd2 content::ContentMain()
#23 0x7f547609296e ChromeMain
#24 0x7f54760928d2 main
#25 0x7f54636dcec5 __libc_start_main
#26 0x7f54760927b4 <unknown>