Testcase found while fuzzing mozilla-central rev 51efc4b931f7.

==18551==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000001 (pc 0x7f5c8cc070a1 bp 0x7fffd6c12850 sp 0x7fffd6c12830 T0)
==18551==The signal is caused by a WRITE memory access.
==18551==Hint: address points to the zero page.
    #0 0x7f5c8cc070a0 in AssertIsCorrectThread /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/ThreadBound.h:135:3
    #1 0x7f5c8cc070a0 in mozilla::ThreadBound<mozilla::dom::RemoteWorkerChild::LauncherBoundData>::Accessor<false>::Accessor(mozilla::ThreadBound<mozilla::dom::RemoteWorkerChild::LauncherBoundData>&) /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/ThreadBound.h:100:20
    #2 0x7f5c8cc0d1a4 in mozilla::dom::RemoteWorkerChild::ErrorPropagation(mozilla::dom::ErrorValue const&) /builds/worker/workspace/build/src/dom/workers/remoteworkers/RemoteWorkerChild.cpp:619:3
    #3 0x7f5c8cc20ff7 in mozilla::dom::RemoteWorkerChild::SharedWorkerOp::Exec(mozilla::dom::SelfHolder&) /builds/worker/workspace/build/src/dom/workers/remoteworkers/RemoteWorkerChild.cpp:919:17
    #4 0x7f5c8cc209fe in mozilla::dom::RemoteWorkerChild::SharedWorkerOp::MaybeStart(mozilla::dom::RemoteWorkerChild*, mozilla::Variant<mozilla::dom::RemoteWorkerChild::Pending, mozilla::dom::RemoteWorkerChild::Running, mozilla::dom::RemoteWorkerChild::PendingTerminated, mozilla::dom::RemoteWorkerChild::Terminated>&)::'lambda'()::operator()() /builds/worker/workspace/build/src/dom/workers/remoteworkers/RemoteWorkerChild.cpp:861:17
    #5 0x7f5c8cc206ac in mozilla::detail::RunnableFunction<mozilla::dom::RemoteWorkerChild::SharedWorkerOp::MaybeStart(mozilla::dom::RemoteWorkerChild*, mozilla::Variant<mozilla::dom::RemoteWorkerChild::Pending, mozilla::dom::RemoteWorkerChild::Running, mozilla::dom::RemoteWorkerChild::PendingTerminated, mozilla::dom::RemoteWorkerChild::Terminated>&)::'lambda'()>::Run() /builds/worker/workspace/build/src/obj-firefox/dist/include/nsThreadUtils.h:557:5
    #6 0x7f5c84f7ddad in mozilla::SchedulerGroup::Runnable::Run() /builds/worker/workspace/build/src/xpcom/threads/SchedulerGroup.cpp:282:20
    #7 0x7f5c84fb2328 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:1220:14
    #8 0x7f5c84fbd18c in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.cpp:481:10
    #9 0x7f5c86223def in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /builds/worker/workspace/build/src/ipc/glue/MessagePump.cpp:87:21
    #10 0x7f5c861167c7 in RunInternal /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:315:10
    #11 0x7f5c861167c7 in RunHandler /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:308:3
    #12 0x7f5c861167c7 in MessageLoop::Run() /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:290:3
    #13 0x7f5c8d2ad738 in nsBaseAppShell::Run() /builds/worker/workspace/build/src/widget/nsBaseAppShell.cpp:137:27
    #14 0x7f5c90e29b76 in XRE_RunAppShell() /builds/worker/workspace/build/src/toolkit/xre/nsEmbedFunctions.cpp:926:20
    #15 0x7f5c861167c7 in RunInternal /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:315:10
    #16 0x7f5c861167c7 in RunHandler /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:308:3
    #17 0x7f5c861167c7 in MessageLoop::Run() /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:290:3
    #18 0x7f5c90e29238 in XRE_InitChildProcess(int, char**, XREChildData const*) /builds/worker/workspace/build/src/toolkit/xre/nsEmbedFunctions.cpp:761:34
    #19 0x555b12564f83 in content_process_main /builds/worker/workspace/build/src/browser/app/../../ipc/contentproc/plugin-container.cpp:56:28
    #20 0x555b12564f83 in main /builds/worker/workspace/build/src/browser/app/nsBrowserApp.cpp:303:18
    #21 0x7f5ca7c0fb96 in __libc_start_main /build/glibc-OTsEL5/glibc-2.27/csu/../csu/libc-start.c:310

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/ThreadBound.h:135:3 in AssertIsCorrectThread

Please note, the testcase reproduces but takes up to 60 seconds or more and BugMon cannot currently handle this condition.

Hi Andrew, are you able to get to this soon?

Patch up.

https://hg.mozilla.org/mozilla-central/rev/a19376112fb6