For searchability, here's one CHECK failure:

[4828:4828:1129/104359:FATAL:shell.cc(194)] Check failed: instance_. 
#0 0x7fc041e42096 base::debug::StackTrace::StackTrace()
#1 0x7fc041e5a8ae logging::LogMessage::~LogMessage()
#2 0x7fc043ee09d3 ash::Shell::GetInstance()
#3 0x7fc041639f3a chromeos::InputEventsBlocker::InputEventsBlocker()
#4 0x7fc04163ef15 chromeos::ShowLoginWizard()
#5 0x7fc04161cd83 chromeos::ChromeSessionManager::Initialize()
#6 0x7fc0415455c0 chromeos::ChromeBrowserMainPartsChromeos::PostProfileInit()
#7 0x7fc041a6ced8 ChromeBrowserMainParts::PreMainMessageLoopRunImpl()
#8 0x7fc041a6d946 ChromeBrowserMainParts::PreMainMessageLoopRun()
#9 0x7fc041544b81 chromeos::ChromeBrowserMainPartsChromeos::PreMainMessageLoopRun()
#10 0x7fc040e4df25 content::BrowserMainLoop::PreMainMessageLoopRun()
#11 0x7fc0411b0cd1 content::StartupTaskRunner::RunAllTasksNow()
#12 0x7fc040e4f3bc content::BrowserMainLoop::CreateStartupTasks()
#13 0x7fc040e55607 content::BrowserMainRunnerImpl::Initialize()
#14 0x7fc040e4d568 content::BrowserMain()
#15 0x7fc0419e441d content::ContentMainRunnerImpl::Run()
#16 0x7fc0419e3839 content::ContentMain()
#17 0x7fc03ff4f776 ChromeMain
#18 0x7fc03da1bfb6 __libc_start_main
#19 0x7fc03ff4f5b4 <unknown>

I'm going to add some IsRunningInMash checks to work around these.

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/f8ce9a7a8bd9e9ccf8a661a051c8fc3055323396

commit f8ce9a7a8bd9e9ccf8a661a051c8fc3055323396
Author: jamescook <jamescook@chromium.org>
Date: Wed Nov 30 17:00:17 2016

chromeos: Make InputEventsBlocker NOTIMPLEMENTED for mash

This avoids a couple places in login/OOBE that crash under mash.

BUG=648764
TEST=manual, start --mash --login-manager

Review-Url: https://codereview.chromium.org/2536113003
Cr-Commit-Position: refs/heads/master@{#435297}

[modify] https://crrev.com/f8ce9a7a8bd9e9ccf8a661a051c8fc3055323396/chrome/browser/chromeos/login/session/user_session_manager.cc
[modify] https://crrev.com/f8ce9a7a8bd9e9ccf8a661a051c8fc3055323396/chrome/browser/chromeos/login/ui/input_events_blocker.cc

This issue has been Available for over a year. If it's no longer important or seems unlikely to be fixed, please consider closing it out. If it is important, please re-triage the issue.

Sorry for the inconvenience if the bug really should have been left as Available. If you change it back, also remove the "Hotlist-Recharge-Cold" label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

+jamescook@ to triage if this is still a concern

Probably still needed, but still low priority. Might get easier with views-based login screen and ash/mus processes being combined. Keeping open.