Set a new TLS when using CLONE_VM.

sandbox/linux/services/credentials_unittest.cc

Index: sandbox/linux/services/credentials_unittest.cc
diff --git a/sandbox/linux/services/credentials_unittest.cc b/sandbox/linux/services/credentials_unittest.cc
index 6b93c86c3ecbc2104282b50da80e32f3d9ad06d3..3ce4fc3fc61dd224fab55b27662cba6d7b2839df 100644
--- a/sandbox/linux/services/credentials_unittest.cc
+++ b/sandbox/linux/services/credentials_unittest.cc
@@ -6,6 +6,7 @@
 
 #include <errno.h>
 #include <fcntl.h>
+#include <pthread.h>
 #include <stdio.h>
 #include <sys/capability.h>
 #include <sys/stat.h>
@@ -237,6 +238,18 @@ SANDBOX_TEST(Credentials, SetCapabilitiesMatchesLibCap2) {
   CHECK_EQ(0, cap_compare(expected_cap.get(), actual_cap.get()));
 }
 
+// Disabled on ASAN because of crbug.com/451603.
+SANDBOX_TEST(Credentials, DISABLE_ON_ASAN(DropFileSystemAccessPreservesTLS)) {
+  // Probably missing kernel support.
+  if (!Credentials::MoveToNewUserNS()) return;
+  CHECK(Credentials::DropFileSystemAccess(ProcUtil::OpenProc().get()));
+
+  // In glibc, pthread_getattr_np makes an assertion about the cached PID/TID in
+  // TLS.
+  pthread_attr_t attr;
+  EXPECT_EQ(0, pthread_getattr_np(pthread_self(), &attr));
+}
+
 }  // namespace.
 
 }  // namespace sandbox.