I was looking into a different cursor bug and noticed that when running ./chrome --mus CursorFactoryOzone is accessed from multiple threads. The easiest way to verify this is to put a ThreadChecker in X11CursorFactoryOzone. 

I think this is related to OzoneCursorFactory having some thread problems? There are two instances of it. One is created/destroyed by ash on the same thread. That's fine. The second is created on the WS thread and destroyed on the chrome thread? I have verified the constructor and destructor are running on separate threads for the stack trace below.

Constructor in WS:
#0 0x7f8e6fca8f6c base::debug::StackTrace::StackTrace()
#1 0x7f8e700db818 ui::CursorLoaderOzone::CursorLoaderOzone()
#2 0x7f8e700dbecb ui::CursorLoader::Create()
#3 0x7f8e700d944b ui::ImageCursors::Initialize()
#4 0x558b433ff695 ui::ws::ThreadedImageCursors::ThreadedImageCursors()
#5 0x558b41a2063a ui::(anonymous namespace)::ThreadedImageCursorsFactoryImpl::CreateCursors()
#6 0x558b4342a1c4 ui::ws::PlatformDisplay::Create()
#7 0x558b434219ce ui::ws::Display::Init()
#8 0x558b433fc105 ui::ws::DisplayManager::OnDisplayAdded()
#9 0x558b433fb5e7 ui::ws::DisplayManager::AddDisplayForWindowManager()
#10 0x558b4340f9ef ui::ws::WindowTree::ProcessSetDisplayRoot()
#11 0x558b4341ba9e ui::ws::WindowTree::SetDisplayRoot()
#12 0x558b41465ea6 ui::mojom::WindowManagerClientStubDispatch::AcceptWithResponder()
#13 0x558b4341f026 ui::mojom::WindowManagerClientStub<>::AcceptWithResponder()
#14 0x7f8e6ef0a11c mojo::InterfaceEndpointClient::HandleValidatedMessage()
#15 0x7f8e6ef09a76 mojo::FilterChain::Accept()
#16 0x7f8e6ef0b3b5 mojo::InterfaceEndpointClient::HandleIncomingMessage()
#17 0x7f8e6ef14b69 mojo::internal::MultiplexRouter::ProcessIncomingMessage()
#18 0x7f8e6ef14087 mojo::internal::MultiplexRouter::Accept()
#19 0x7f8e6ef09a76 mojo::FilterChain::Accept()
#20 0x7f8e6ef04c85 mojo::Connector::ReadSingleMessage()
#21 0x7f8e6ef05761 mojo::Connector::ReadAllAvailableMessages()
#22 0x7f8e6ef05619 mojo::Connector::OnHandleReadyInternal()
#23 0x7f8e6ef05db5 mojo::SimpleWatcher::DiscardReadyState()
#24 0x7f8e6eedcf04 mojo::SimpleWatcher::OnHandleReady()
#25 0x7f8e6eedd44f _ZN4base8internal7InvokerINS0_9BindStateIMN4mojo13SimpleWatcherEFvijRKNS3_18HandleSignalsStateEEJNS_7WeakPtrIS4_EEijS5_EEEFvvEE7RunImplIRKS9_RKNSt3__15tupleIJSB_ijS5_EEEJLm0ELm1ELm2ELm3EEEEvOT_OT0_NSI_16integer_sequenceImJXspT1_EEEE
#26 0x7f8e6fca9818 base::debug::TaskAnnotator::RunTask()
#27 0x7f8e6fcd8b25 base::internal::IncomingTaskQueue::RunTask()
#28 0x7f8e6fcdacf2 base::MessageLoop::RunTask()
#29 0x7f8e6fcdb40c base::MessageLoop::DoWork()
#30 0x7f8e6fcddc99 base::MessagePumpLibevent::Run()
#31 0x7f8e6fcda802 base::MessageLoop::Run()
#32 0x7f8e6fd0e3ca base::RunLoop::Run()
#33 0x7f8e6fd4b2e7 base::Thread::Run()
#34 0x7f8e6fd4b89b base::Thread::ThreadMain()
#35 0x7f8e6fd42cff base::(anonymous namespace)::ThreadFunc()
#36 0x7f8e6fe22184 start_thread
#37 0x7f8e63fbeffd clone

Destructor in content:
#0 0x7f8e6fca8f6c base::debug::StackTrace::StackTrace()
#1 0x7f8e700db91b ui::CursorLoaderOzone::~CursorLoaderOzone()
#2 0x7f8e700dba0e ui::CursorLoaderOzone::~CursorLoaderOzone()
#3 0x558b418edf62 std::__1::__tree<>::destroy()
#4 0x558b41a4581f BrowserProcessPlatformPart::DestroyImageCursorsSet()
#5 0x558b42efa6d1 AshInit::~AshInit()
#6 0x558b42d814d1 ChromeBrowserMainExtraPartsAsh::PostMainMessageLoopRun()
#7 0x558b41a4c9ea ChromeBrowserMainParts::PostMainMessageLoopRun()
#8 0x558b416393f3 chromeos::ChromeBrowserMainPartsChromeos::PostMainMessageLoopRun()
#9 0x7f8e6d15e9a2 content::BrowserMainLoop::ShutdownThreadsAndCleanUp()
#10 0x7f8e6d1614b3 content::BrowserMainRunnerImpl::Shutdown()
#11 0x7f8e6d159e0b content::BrowserMain()
#12 0x7f8e6d9b80e8 content::ContentMainRunnerImpl::Run()
#13 0x7f8e701f3071 service_manager::Main()
#14 0x7f8e6d9b6af4 content::ContentMain()
#15 0x558b4106a5a8 ChromeMain
#16 0x7f8e63ee2f45 __libc_start_main
#17 0x558b4106a3e4 <unknown>