Issue 755215  has been merged into this issue.

Looks like regression introduced in https://chromium-review.googlesource.com/608846, where WallpaperController is null under mash.

=== crash stack ====
Program terminated with signal SIGSEGV, Segmentation fault.
#0  begin ()
    at /usr/local/google/home/xiyuan/src/cros/.cache/chrome-sdk/tarballs/samus+9816.0.0+target_toolchain/usr/bin/../lib/gcc/x86_64-cros-linux-gnu/4.9.x/include/g++-v4/bits/stl_vect
or.h:612
612             return const_iterator(this->_M_impl._M_start);
(gdb) bt
#0  begin ()
    at /usr/local/google/home/xiyuan/src/cros/.cache/chrome-sdk/tarballs/samus+9816.0.0+target_toolchain/usr/bin/../lib/gcc/x86_64-cros-linux-gnu/4.9.x/include/g++-v4/bits/stl_vect
or.h:612
#1  begin<std::vector<content::TextInputManager::Observer*, std::allocator<content::TextInputManager::Observer*> > > ()
    at /usr/local/google/home/xiyuan/src/cros/.cache/chrome-sdk/tarballs/samus+9816.0.0+target_toolchain/usr/bin/../lib/gcc/x86_64-cros-linux-gnu/4.9.x/include/g++-v4/bits/range_ac
cess.h:59
#2  ContainsValue<std::vector<content::TextInputManager::Observer*, std::allocator<content::TextInputManager::Observer*> >, content::TextInputManager::Observer*, 0> ()
    at ../../base/stl_util.h:110
#3  AddObserver () at ../../base/observer_list.h:275
#4  AddObserver () at ../../content/browser/renderer_host/text_input_manager.cc:278
#5  0x0000607314c412ec in SigninScreenHandler () at ../../chrome/browser/ui/webui/chromeos/login/signin_screen_handler.cc:308
#6  0x0000607314c3c604 in MakeUnique<chromeos::SigninScreenHandler, scoped_refptr<chromeos::NetworkStateInformer>&, chromeos::ErrorScreen*&, chromeos::CoreOobeHandler*&, chromeos::
GaiaScreenHandler*, chromeos::JSCallsContainer*> () at ../../base/memory/ptr_util.h:56
#7  OobeUI () at ../../chrome/browser/ui/webui/chromeos/login/oobe_ui.cc:303
#8  0x0000607314c2afcb in content::WebUIController* (anonymous namespace)::NewWebUI<chromeos::OobeUI>(content::WebUI*, GURL const&) ()
    at ../../chrome/browser/ui/webui/chrome_web_ui_controller_factory.cc:241

Repros on linux desktop with chrome --mash. WallpaperController is null.

[124073:124073:0814/121946.128067:FATAL:signin_screen_handler.cc(307)] Check failed: wallpaper_controller. 
#0 0x7fc914448dbc base::debug::StackTrace::StackTrace()
#1 0x7fc91446e2fc logging::LogMessage::~LogMessage()
#2 0x55b04aa14ad0 chromeos::SigninScreenHandler::SigninScreenHandler()
#3 0x55b04aa0f689 chromeos::OobeUI::OobeUI()
#4 0x55b04a9fd15b (anonymous namespace)::NewWebUI<>()
#5 0x7fc911e6bd90 content::WebUIControllerFactoryRegistry::CreateWebUIControllerForURL()
#6 0x7fc911e48b39 content::WebContentsImpl::CreateWebUI()
#7 0x7fc911e58518 content::WebContentsImpl::CreateWebUIForRenderFrameHost()
#8 0x7fc911b5ec37 content::RenderFrameHostImpl::UpdatePendingWebUI()
#9 0x7fc911b6665a content::RenderFrameHostManager::UpdateStateForNavigate()
#10 0x7fc911b660f5 content::RenderFrameHostManager::Navigate()
#11 0x7fc911b428c9 content::NavigatorImpl::NavigateToEntry()
#12 0x7fc911b432d5 content::NavigatorImpl::NavigateToPendingEntry()
#13 0x7fc911b319e7 content::NavigationControllerImpl::NavigateToPendingEntryInternal()
#14 0x7fc911b2c54b content::NavigationControllerImpl::NavigateToPendingEntry()
#15 0x7fc911b2c905 content::NavigationControllerImpl::LoadEntry()
#16 0x7fc911b2db0a content::NavigationControllerImpl::LoadURLWithParams()
#17 0x7fc911b2d4dd content::NavigationControllerImpl::LoadURL()
#18 0x7fc90ec554df views::WebView::LoadInitialURL()
#19 0x55b04941768e chromeos::WebUILoginView::LoadURL()
#20 0x55b04940c4c4 chromeos::LoginDisplayHostImpl::StartSignInScreen()
#21 0x55b04940f3b1 (anonymous namespace)::ShowLoginWizardFinish()
#22 0x55b04940edc8 chromeos::ShowLoginWizard()
#23 0x55b0493ee924 chromeos::ChromeSessionManager::Initialize()
#24 0x55b0493030d4 chromeos::ChromeBrowserMainPartsChromeos::PostProfileInit()
#25 0x55b0497f2235 ChromeBrowserMainParts::PreMainMessageLoopRunImpl()
#26 0x55b0497f165d ChromeBrowserMainParts::PreMainMessageLoopRun()
#27 0x55b049302432 chromeos::ChromeBrowserMainPartsChromeos::PreMainMessageLoopRun()
#28 0x7fc911a144f1 content::BrowserMainLoop::PreMainMessageLoopRun()
#29 0x7fc911e17cd7 content::StartupTaskRunner::RunAllTasksNow()
#30 0x7fc911a1296b content::BrowserMainLoop::CreateStartupTasks()
#31 0x7fc911a17079 content::BrowserMainRunnerImpl::Initialize()
#32 0x7fc911a0ff57 content::BrowserMain()

Reverting https://chromium-review.googlesource.com/608846 fixes it

I'll try to come up with a better fix...

https://chromium-review.googlesource.com/608846 has been merged to M61. Please do not revert it. I will add a patch that checks WallpaperController.

And I'm wondering since when WallpaperController is NULL under MASH, is it intended?

https://chromium-review.googlesource.com/c/614313 is a speculative fix for M61.

https://chromium-review.googlesource.com/c/614319 should fix it.

ash::Shell is null under mash, since you are trying to access it from the browser process and it doesn't live there. WallpaperController exists in the ash process.

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/19d2fb0b6420fa9a5470a40d321f3ad9e061aab5

commit 19d2fb0b6420fa9a5470a40d321f3ad9e061aab5
Author: James Cook <jamescook@chromium.org>
Date: Mon Aug 14 21:03:10 2017

cros: Fix login crash with chrome --mash

SigninScreenHandler was trying to deference a null WallpaperController

Bug:  755237 
Test: manually login with chrome --mash, chromeos desktopui_MashLogin autotest
Change-Id: I4ca39f35b872c307d3e9ad47f84e8d2f2093598e
Reviewed-on: https://chromium-review.googlesource.com/614319
Reviewed-by: Alexander Alekseev <alemate@chromium.org>
Reviewed-by: Wenzhao (Colin) Zang <wzang@chromium.org>
Commit-Queue: James Cook <jamescook@chromium.org>
Cr-Commit-Position: refs/heads/master@{#494187}
[modify] https://crrev.com/19d2fb0b6420fa9a5470a40d321f3ad9e061aab5/chrome/browser/ui/webui/chromeos/login/signin_screen_handler.cc

https://cs.chromium.org/chromium/src/chrome/browser/chromeos/arc/wallpaper/arc_wallpaper_service.cc?type=cs&q=ArcWallpaperService&l=187 uses the same pattern and maybe it also crashes under Mash, but I didn't manage trigger this.. And maybe we need to merge the fix to M61 as well?

I think we only need to merge to M61 if you have other CLs that change this file that you're going to merge (just to reduce merge conflicts). If not, it's OK for --mash to be broken in M61.

Do you want me to merge-request?

Then there's no need to merge. Thanks for fixing this!

Informational build turns green after the fix. Per #13, mark this as fixed.

Thanks!