https://chromium-review.googlesource.com/c/chromium/src/+/734945 may help with this. The CL just landed. Can you try with that?

For crash #1 it's because there are two ways to fake displays and --mus isn't wired correctly. It mixes things up. The display management stack looks like this:

<ash>
display::DisplayManager
display::DisplayChangeObserver
display::DisplayConfiguration
display::NativeDisplayDelegate
<ozone>
<hardware>

In classic ash everything is faked in display::DisplayManager. All the code underneath that doesn't get run off device.

In --mash I added FakeDisplayDelegate so we could exercise all the code. It implements NativeDisplayDelegate and pretends there is hardware to talk to. All the display configuration code runs, even off device, which avoids errors. I did this work before --mus and it never got completed. I'll fix --mus but I just tested and --mash does work correctly (for adding a display at least, crash #2 happens for removing still).

For crash #2 it's related to the issue sadrul fixed. In classic ash there is a synchronous IPC when shutting down the display compositor that makes sure certain GPU things are destroyed before the PlatformWindow is destroyed. This synchronous IPC doesn't exist in mus/mash. The problem is GLX specific and it disappears if you use EGL. 

msw: You can use this command line assuming --mash works for you.

$ ./chrome --mash --ash-dev-shortcuts --use-gl=egl

sadrul: There is a still a shutdown GLX crash in mus/mash with your CL landed.

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/7e4f46fe768fd1a5f3ef36dea88550ab77de6d9f

commit 7e4f46fe768fd1a5f3ef36dea88550ab77de6d9f
Author: kylechar <kylechar@chromium.org>
Date: Tue Oct 31 23:26:57 2017

mus: Fix ash add/remove display accelerator.

This CL fixes the ash add/remove display accelerators when running with
--mus. When the accelerator is pressed it needs to call
TestDisplayController::AddRemoveDisplay(). The TestDisplayControllerPtr
is moved into DisplayManager to simplify things. This allows removing
the special case for the DEV_ADD_REMOVE_DISPLAY accelerator.

Both --mus and --mash will set TestDisplayControllerPtr on startup if
they are running on Linux desktop. It would be possible to do something
similar with classic ash in the future.

Bug:  779845 
Change-Id: I70b058777944217e55ef105b9d1ac65f05e28b3a
Reviewed-on: https://chromium-review.googlesource.com/746375
Reviewed-by: Scott Violet <sky@chromium.org>
Reviewed-by: Tom Sepez <tsepez@chromium.org>
Commit-Queue: kylechar <kylechar@chromium.org>
Cr-Commit-Position: refs/heads/master@{#512996}
[modify] https://crrev.com/7e4f46fe768fd1a5f3ef36dea88550ab77de6d9f/ash/accelerators/accelerator_controller.cc
[modify] https://crrev.com/7e4f46fe768fd1a5f3ef36dea88550ab77de6d9f/ash/accelerators/accelerator_controller_delegate_classic.cc
[modify] https://crrev.com/7e4f46fe768fd1a5f3ef36dea88550ab77de6d9f/ash/mus/accelerators/accelerator_controller_delegate_mus.cc
[modify] https://crrev.com/7e4f46fe768fd1a5f3ef36dea88550ab77de6d9f/ash/mus/accelerators/accelerator_controller_delegate_mus.h
[modify] https://crrev.com/7e4f46fe768fd1a5f3ef36dea88550ab77de6d9f/ash/mus/manifest.json
[modify] https://crrev.com/7e4f46fe768fd1a5f3ef36dea88550ab77de6d9f/ash/mus/standalone/manifest.json
[modify] https://crrev.com/7e4f46fe768fd1a5f3ef36dea88550ab77de6d9f/ash/shell.cc
[modify] https://crrev.com/7e4f46fe768fd1a5f3ef36dea88550ab77de6d9f/chrome/browser/chrome_content_browser_manifest_overlay.json
[modify] https://crrev.com/7e4f46fe768fd1a5f3ef36dea88550ab77de6d9f/services/ui/display/screen_manager_forwarding.cc
[modify] https://crrev.com/7e4f46fe768fd1a5f3ef36dea88550ab77de6d9f/services/ui/display/screen_manager_forwarding.h
[modify] https://crrev.com/7e4f46fe768fd1a5f3ef36dea88550ab77de6d9f/services/ui/display/screen_manager_ozone_internal.cc
[modify] https://crrev.com/7e4f46fe768fd1a5f3ef36dea88550ab77de6d9f/services/ui/display/screen_manager_ozone_internal.h
[modify] https://crrev.com/7e4f46fe768fd1a5f3ef36dea88550ab77de6d9f/services/ui/manifest.json
[modify] https://crrev.com/7e4f46fe768fd1a5f3ef36dea88550ab77de6d9f/services/ui/public/interfaces/display/BUILD.gn
[modify] https://crrev.com/7e4f46fe768fd1a5f3ef36dea88550ab77de6d9f/ui/display/manager/display_manager.cc
[modify] https://crrev.com/7e4f46fe768fd1a5f3ef36dea88550ab77de6d9f/ui/display/manager/display_manager.h
[modify] https://crrev.com/7e4f46fe768fd1a5f3ef36dea88550ab77de6d9f/ui/display/mojo/BUILD.gn
[rename] https://crrev.com/7e4f46fe768fd1a5f3ef36dea88550ab77de6d9f/ui/display/mojo/dev_display_controller.mojom

The add/remove shortcuts work at ToT in --mus now. Sadrul got crash #2 fixed in / crbug.com/777594  too.