This is reproducible on Linux by changing FakeAuthPolicyClient::RefreshDevicePolicy() to always return false.  Then just try to enroll (this fails) and then shutdown and restart Chrome.

Interestingly, enrollment only fails in step 12.  This means we fetch policy too late in the enrollment process.

[31912:31912:0119/204440.215421:VERBOSE1:enrollment_handler_chromeos.cc(564)] Step: 1
[31912:31912:0119/204440.215590:VERBOSE1:enrollment_handler_chromeos.cc(564)] Step: 2
[31912:31912:0119/204440.215664:VERBOSE1:enrollment_handler_chromeos.cc(564)] Step: 3
[31912:31912:0119/204441.207683:VERBOSE1:enrollment_handler_chromeos.cc(564)] Step: 4
[31912:31912:0119/204441.854685:VERBOSE1:enrollment_handler_chromeos.cc(564)] Step: 5
[31912:31912:0119/204441.861053:VERBOSE1:enrollment_handler_chromeos.cc(564)] Step: 8
[31912:31912:0119/204441.861791:VERBOSE1:enrollment_handler_chromeos.cc(564)] Step: 9
[31912:31912:0119/204441.877124:VERBOSE1:enrollment_handler_chromeos.cc(564)] Step: 10
[31912:31912:0119/204441.877179:VERBOSE1:enrollment_handler_chromeos.cc(564)] Step: 11
[31912:31912:0119/204441.877234:ERROR:enrollment_handler_chromeos.cc(528)] Failed to load Active Directory policy.
[31912:31912:0119/204441.877280:VERBOSE1:enrollment_handler_chromeos.cc(564)] Step: 12
[31912:31912:0119/204441.877322:WARNING:enrollment_handler_chromeos.cc(551)] Enrollment failed: 17, client: 0, validation: 0, store: 0, lock: 0
[31912:31912:0119/204441.877364:VERBOSE1:enrollment_handler_chromeos.cc(564)] Step: 12
[31912:31912:0119/204441.877398:VERBOSE1:enrollment_handler_chromeos.cc(564)] Step: 12
[31912:31912:0119/204441.877481:WARNING:enterprise_enrollment_helper_impl.cc(238)] Enrollment finished
[31912:31912:0119/204441.877574:WARNING:enrollment_screen.cc(238)] Enrollment error occured: status=17 http status=200 DM status=0

(gdb) bt
#0  0x00007f302f7ba3d0 in policy::DeviceCloudPolicyManagerChromeOS::GetDeviceRequisition (this=0x0)
    at ../../chrome/browser/chromeos/policy/device_cloud_policy_manager_chromeos.cc:146
#1  0x00007f302f7ba92c in policy::DeviceCloudPolicyManagerChromeOS::IsRemoraRequisition (this=0x0)
    at ../../chrome/browser/chromeos/policy/device_cloud_policy_manager_chromeos.cc:178
#2  0x00007f303389006b in chromeos::EnrollmentScreenHandler::DoShow (this=0x101bef013b20)
    at ../../chrome/browser/ui/webui/chromeos/login/enrollment_screen_handler.cc:693
#3  0x00007f303388fe50 in chromeos::EnrollmentScreenHandler::Show (this=0x101bef013b20)
    at ../../chrome/browser/ui/webui/chromeos/login/enrollment_screen_handler.cc:182
#4  0x00007f3033890ede in chromeos::EnrollmentScreenHandler::Initialize (this=0x101bef013b20)
    at ../../chrome/browser/ui/webui/chromeos/login/enrollment_screen_handler.cc:379
#5  0x00007f3033880f9e in chromeos::BaseScreenHandler::InitializeBase (this=0x101bef013b20)
    at ../../chrome/browser/ui/webui/chromeos/login/base_screen_handler.cc:38
#6  0x00007f3033405593 in chromeos::OobeUI::OnScreenAssetsLoaded (this=0x101bef3ed460, async_assets_load_id="oauth-enrollment")
    at ../../chrome/browser/ui/webui/chromeos/login/oobe_ui.cc:550
#7  0x00007f3033887044 in chromeos::CoreOobeHandler::HandleScreenAssetsLoaded (this=0x101bee5cede0, screen_async_load_id="oauth-enrollment")
    at ../../chrome/browser/ui/webui/chromeos/login/core_oobe_handler.cc:369
#8  0x00007f302ea6be7d in base::internal::FunctorTraits<void (ValueStoreFrontend::*)(std::string const&), void>::Invoke<ValueStoreFrontend*, std::string const&>(void (ValueStoreFrontend::*)(std::string const&), ValueStoreFrontend*&&, std::string const&) (method=
    (void (ValueStoreFrontend::*)(ValueStoreFrontend * const, const std::basic_string<char, std::char_traits<char>, std::allocator<char> > &)) 0x7f3033887020 <chromeos::CoreOobeHandler::HandleScreenAssetsLoaded(std::string const&)>, 
    receiver_ptr=<unknown type in /ssd/tnagel/chromium/src/out/cros-debug/chrome, CU 0x0, DIE 0x19ca2>, args="oauth-enrollment")
    at ../../base/bind_internal.h:214
#9  0x00007f302ea6bdb6 in base::internal::InvokeHelper<false, void>::MakeItSo<void (ValueStoreFrontend::* const&)(std::string const&), ValueStoreFrontend*, std::string const&>(void (ValueStoreFrontend::* const&)(std::string const&), ValueStoreFrontend*&&, std::string const&) (functor=
    @0x101bef4f6270: (void (ValueStoreFrontend::*)(ValueStoreFrontend * const, const std::basic_string<char, std::char_traits<char>, std::allocator<char> > &)) 0x7f3033887020 <chromeos::CoreOobeHandler::HandleScreenAssetsLoaded(std::string const&)>, args="oauth-enrollment", args="oauth-enrollment")
    at ../../base/bind_internal.h:285
#10 0x00007f3033889f47 in base::internal::Invoker<base::internal::BindState<void (chromeos::CoreOobeHandler::*)(std::string const&), base::internal::UnretainedWrapper<chromeos::CoreOobeHandler> >, void (std::string const&)>::RunImpl<void (chromeos::CoreOobeHandler::* const&)(std::string const&), std::tuple<base::internal::UnretainedWrapper<chromeos::CoreOobeHandler> > const&, 0ul>(void (chromeos::CoreOobeHandler::* const&)(std::string const&), std::tuple<base::internal::UnretainedWrapper<chromeos::CoreOobeHandler> > const&, base::IndexSequence<0ul>, std::string const&) (functor=
    @0x101bef4f6270: (void (chromeos::CoreOobeHandler::*)(chromeos::CoreOobeHandler * const, const std::basic_string<char, std::char_traits<char>, std::allocator<char> > &)) 0x7f3033887020 <chromeos::CoreOobeHandler::HandleScreenAssetsLoaded(std::string const&)>, bound=empty std::tuple, 
    unbound_args="oauth-enrollment") at ../../base/bind_internal.h:361
#11 0x00007f3033889e7c in base::internal::Invoker<base::internal::BindState<void (chromeos::CoreOobeHandler::*)(std::string const&), base::internal::UnretainedWrapper<chromeos::CoreOobeHandler> >, void (std::string const&)>::Run(base::internal::BindStateBase*, std::string const&) (
    base=0x101bef4f6250, unbound_args="oauth-enrollment") at ../../base/bind_internal.h:339
#12 0x00007f302e79aa46 in base::internal::RunMixin<base::Callback<void (base::Callback<void (), (base::internal::CopyMode)1, (base::internal::RepeatMode)1> const&), (base::internal::CopyMode)1, (base::internal::RepeatMode)1> >::Run(base::Callback<void (), (base::internal::CopyMode)1, (base::internal::RepeatMode)1> const&) const (this=0x101bef4f62e8, args=...) at ../../base/callback.h:85
#13 0x00007f30333e64cd in login::DispatchToCallback<std::string const&, 0ul>(base::Callback<void (std::string const&), (base::internal::CopyMode)1, (base::internal::RepeatMode)1> const&, base::ListValue const*, base::IndexSequence<0ul>) (callback=..., args=0x7ffc6038a450, indexes=...)
    at ../../components/login/base_screen_handler_utils.h:93
#14 0x00007f30333e5d1d in login::CallbackWrapper<std::string const&>(base::Callback<void (std::string const&), (base::internal::CopyMode)1, (base::internal::RepeatMode)1> const&, base::ListValue const*) (callback=..., args=0x7ffc6038a450) at ../../components/login/base_screen_handler_utils.h:99
#15 0x00007f302e79594f in base::internal::FunctorTraits<void (*)(base::Callback<std::unique_ptr<base::Value, std::default_delete<base::Value> > (), (base::internal::CopyMode)1, (base::internal::RepeatMode)1> const&, std::unique_ptr<base::Value, std::default_delete<base::Value> >*), void>::Invoke<base::Callback<std::unique_ptr<base::Value, std::default_delete<base::Value> > (), (base::internal::CopyMode)1, (base::internal::RepeatMode)1> const&, std::unique_ptr<base::Value, std::default_delete<base::Value> >* const&>(void (*)(base::Callback<std::unique_ptr<base::Value, std::default_delete<base::Value> > (), (base::internal::CopyMode)1, (base::internal::RepeatMode)1> const&, std::unique_ptr<base::Value, std::default_delete<base::Value> >*), base::Callback<std::unique_ptr<base::Value, std::default_delete<base::Value> > (), (base::internal::CopyMode)1, (base::internal::RepeatMode)1> const&, std::unique_ptr<base::Value, std::default_delete<base::Value> >* const&) (
    function=0x7f30333e5d00 <login::CallbackWrapper<std::string const&>(base::Callback<void (std::string const&), (base::internal::CopyMode)1, (base::internal::RepeatMode)1> const&, base::ListValue const*)>, args=@0x7ffc60389e70: 0x7ffc6038a450, args=@0x7ffc60389e70: 0x7ffc6038a450)
    at ../../base/bind_internal.h:164

I've filed  issue 684679  for the general problem of fetching device policy only after install attributes have been finalized.

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/a36717f4c79513664b45ba0248ebd731cf6e3e0c

commit a36717f4c79513664b45ba0248ebd731cf6e3e0c
Author: rsorokin <rsorokin@chromium.org>
Date: Tue Jan 24 20:00:54 2017

Fix crash in EnrollmentScreenHandler for Active Directory devices.

BUG= 682779 
TEST=manual

Review-Url: https://codereview.chromium.org/2655573003
Cr-Commit-Position: refs/heads/master@{#445788}

[modify] https://crrev.com/a36717f4c79513664b45ba0248ebd731cf6e3e0c/chrome/browser/ui/webui/chromeos/login/enrollment_screen_handler.cc

Your change meets the bar and is auto-approved for M57. Please go ahead and merge the CL to branch 2987 manually. Please contact milestone owner if you have questions.
Owners: amineer@(clank), cmasso@(bling), ketakid@(cros), govind@(desktop)

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/603a9352a8dcda5fc9f5f5ff1e835269e7da995a

commit 603a9352a8dcda5fc9f5f5ff1e835269e7da995a
Author: Roman Sorokin <rsorokin@chromium.org>
Date: Fri Jan 27 14:42:46 2017

Fix crash in EnrollmentScreenHandler for Active Directory devices.

BUG= 682779 
TEST=manual

Review-Url: https://codereview.chromium.org/2655573003
Cr-Commit-Position: refs/heads/master@{#445788}
(cherry picked from commit a36717f4c79513664b45ba0248ebd731cf6e3e0c)

Review-Url: https://codereview.chromium.org/2654233004 .
Cr-Commit-Position: refs/branch-heads/2987@{#143}
Cr-Branched-From: ad51088c0e8776e8dcd963dbe752c4035ba6dab6-refs/heads/master@{#444943}

[modify] https://crrev.com/603a9352a8dcda5fc9f5f5ff1e835269e7da995a/chrome/browser/ui/webui/chromeos/login/enrollment_screen_handler.cc

bulk Verify of older or not-user-facing Chromad bugs