This is a tracking bug for a VC++ 2017 code-gen bug, filed here:

https://developercommunity.visualstudio.com/content/problem/40904/bad-code-gen-in-chromes-mojo-public-bindings-unitt.html

Repro steps: Generate an out\vs2017_test directory with these gn args: is_debug = true target_cpu = "x86"

> ninja -C out\vs2017_test mojo_public_bindings_unittests
> out\vs2017_test\mojo_public_bindings_unittests.exe --gtest_filter=PickleTest.BlinkProxyTo* --single-process-tests

If you run the test binary under the debugger it will crash and be caught by the debugger. A partial call stack is:
mojo_public_bindings_unittests.exe!scoped_refptr<base::internal::BindStateBase>::operator->() Line 484 C++
mojo_public_bindings_unittests.exe!base::internal::CallbackBase<0>::polymorphic_invoke() Line 127 C++
mojo_public_bindings_unittests.exe!base::Callback<void __cdecl(mojo::test::PickledStructBlink),1,1>::Run(mojo::test::PickledStructBlink <args_0>) Line 79 C++
mojo_public_bindings_unittests.exe!mojo::test::`anonymous namespace'::BlinkPicklePasserImpl::PassPickledStruct(mojo::test::PickledStructBlink pickle, const base::Callback<void __cdecl(mojo::test::PickledStructBlink),1,1> & callback) Line 126 C++
mojo_public_bindings_unittests.exe!mojo::test::blink::PicklePasserStubDispatch::AcceptWithResponder(mojo::test::blink::PicklePasser impl, mojo::Message message, std::unique_ptr<mojo::MessageReceiverWithStatus,std::default_delete<mojo::MessageReceiverWithStatus> > responder) Line 907 C++
mojo_public_bindings_unittests.exe!mojo::test::blink::PicklePasserStub<mojo::RawPtrImplRefTraits<mojo::test::blink::PicklePasser> >::AcceptWithResponder(mojo::Message message, std::unique_ptr<mojo::MessageReceiverWithStatus,std::default_delete<mojo::MessageReceiverWithStatus> > responder) Line 238 C++
mojo_public_bindings_unittests.exe!mojo::InterfaceEndpointClient::HandleValidatedMessage(mojo::Message message) Line 383 C++
mojo_public_bindings_unittests.exe!mojo::InterfaceEndpointClient::HandleIncomingMessageThunk::Accept(mojo::Message message) Line 130 C++
mojo_public_bindings_unittests.exe!mojo::FilterChain::Accept(mojo::Message message) Line 41 C++

The bug occurs with is_component_build = false or = true.

The discovery and analysis of this bug is discussed on comment #76 of the Chromium VS 2017 tracking bug, here:

https://bugs.chromium.org/p/chromium/issues/detail?id=683729#c76