I just hit this myself; I'll add some logging to figure out what's happening.

[38374:38374:0921/091105.104107:FATAL:chrome_launcher_controller.cc(286)] Check failed: 2 == model_->item_count() (2 vs. 3)
#0 0x7f00b454feec base::debug::StackTrace::StackTrace()
#1 0x7f00b4575a5c logging::LogMessage::~LogMessage()
#2 0x5637543b5395 ChromeLauncherController::Init()
#3 0x563752c8d5c8 chromeos::internal::ChromeLauncherControllerInitializer::OnSessionStateChanged()
#4 0x7f00aeb5cc30 session_manager::SessionManager::SetSessionState()
#5 0x563752d7d734 chromeos::ChromeSessionManager::SessionStarted()
#6 0x7f00b455077f base::debug::TaskAnnotator::RunTask()
#7 0x7f00b45800f9 base::internal::IncomingTaskQueue::RunTask()
#8 0x7f00b45823a3 base::MessageLoop::RunTask()
#9 0x7f00b4582ace base::MessageLoop::DoWork()
#10 0x7f00b4585369 base::MessagePumpLibevent::Run()
#11 0x7f00b4581eb2 base::MessageLoop::Run()
#12 0x7f00b45b617f base::RunLoop::Run()
#13 0x5637530a004a ChromeBrowserMainParts::MainMessageLoopRun()
#14 0x7f00b19f4ac7 content::BrowserMainLoop::RunMainMessageLoopParts()
#15 0x7f00b19f74a6 content::BrowserMainRunnerImpl::Run()
#16 0x7f00b19f031f content::BrowserMain()
#17 0x7f00b2268bac content::ContentMainRunnerImpl::Run()
#18 0x7f00b4a9a09e service_manager::Main()
#19 0x7f00b2267584 content::ContentMain()
#20 0x5637526802c8 ChromeMain
#21 0x7f00a8610f45 __libc_start_main
#22 0x563752680104 <unknown>

 Issue 767547  has been merged into this issue.

I found a reliable repro for this defect from  Issue 767547 .

On ChromeOS ToT (or after #502992) with --login-manager:
(1) Pin Chrome Web Store to the shelf (from the app list).
(2) In the item's right-click context menu, select "Open as Window"
(3) Click the item to open a Chrome Web Store window.
(4a) Quit and re-run with --ash-enable-shelf-model-synchronization
(4b) Enable shelf model sync in about:flags and logout/login on device.
Expected: The session starts up just fine.
Actual: ChromeLauncherController::Init crash with a third ShelfModel item for the Web Store.

Here's the crash with some additional local logging:

[79823:79823:0921/115510.810606:ERROR:chrome_launcher_controller.cc(289)] Expected two shelf items, actual: 3
[79823:79823:0921/115510.810613:ERROR:chrome_launcher_controller.cc(291)] Shelf Item: Launcher (app_id:jlfapfmkapbjlfbpjedlinehodkccjee, launch_id:)
[79823:79823:0921/115510.810621:ERROR:chrome_launcher_controller.cc(291)] Shelf Item:  (app_id:mgndgikekgjfcpckkfioiadnlibdjbkf, launch_id:)
[79823:79823:0921/115510.810627:ERROR:chrome_launcher_controller.cc(291)] Shelf Item: Web Store (app_id:ahfgeienlihckogmohjhadlkjgocpleb, launch_id:)
[79823:79823:0921/115510.810637:FATAL:chrome_launcher_controller.cc(292)] Check failed: false. Please report the above errors to  http://crbug.com/766864 
#0 0x7fd8bd4e2eec base::debug::StackTrace::StackTrace()
#1 0x7fd8bd508a5c logging::LogMessage::~LogMessage()
#2 0x55c6e5d31cd1 ChromeLauncherController::Init()
#3 0x55c6e4609d58 chromeos::internal::ChromeLauncherControllerInitializer::OnSessionStateChanged()
#4 0x7fd8b7af1c30 session_manager::SessionManager::SetSessionState()
#5 0x55c6e46f9ec4 chromeos::ChromeSessionManager::SessionStarted()
#6 0x7fd8bd4e377f base::debug::TaskAnnotator::RunTask()
#7 0x7fd8bd5130f9 base::internal::IncomingTaskQueue::RunTask()
#8 0x7fd8bd5153a3 base::MessageLoop::RunTask()
#9 0x7fd8bd515ace base::MessageLoop::DoWork()
#10 0x7fd8bd518369 base::MessagePumpLibevent::Run()
#11 0x7fd8bd514eb2 base::MessageLoop::Run()
#12 0x7fd8bd54917f base::RunLoop::Run()
#13 0x55c6e4a1c7da ChromeBrowserMainParts::MainMessageLoopRun()
#14 0x7fd8ba987567 content::BrowserMainLoop::RunMainMessageLoopParts()
#15 0x7fd8ba989f46 content::BrowserMainRunnerImpl::Run()
#16 0x7fd8ba982dbf content::BrowserMain()
#17 0x7fd8bb1fb64c content::ContentMainRunnerImpl::Run()
#18 0x7fd8bda2d09e service_manager::Main()
#19 0x7fd8bb1fa024 content::ContentMain()
#20 0x55c6e3ffd1c8 ChromeMain
#21 0x7fd8b15a5f45 __libc_start_main
#22 0x55c6e3ffd004 <unknown>

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/1adf58e0bf122ca8e625ba8cb1168934917be8a2

commit 1adf58e0bf122ca8e625ba8cb1168934917be8a2
Author: Mike Wasserman <msw@chromium.org>
Date: Fri Sep 22 16:28:57 2017

mash: Connect Chrome to ShelfController before BrowserStatusMonitor init.

Connect Chrome to Ash for shelf synchronization earlier.
This ensures that BrowserStatusMonitor adds items after sync begins.
(otherwise, ash attempts to apply synced changes to an unknown item)

Nix the should-sync flag, check for a connected controller instead.

Bug:  766864 
Change-Id: I1c32a7cd286303f1ed040869aced4c023deabbef
Reviewed-on: https://chromium-review.googlesource.com/677884
Reviewed-by: James Cook <jamescook@chromium.org>
Commit-Queue: Michael Wasserman <msw@chromium.org>
Cr-Commit-Position: refs/heads/master@{#503762}
[modify] https://crrev.com/1adf58e0bf122ca8e625ba8cb1168934917be8a2/chrome/browser/ui/ash/launcher/chrome_launcher_controller.cc
[modify] https://crrev.com/1adf58e0bf122ca8e625ba8cb1168934917be8a2/chrome/browser/ui/ash/launcher/chrome_launcher_controller.h