SamplingProfiler: stop the stack walk at a null entry frame instead of dereferencing vmEntryRecord(nullptr)

Source/JavaScriptCore/interpreter/CallFrame.cpp

@@ -178,6 +178,15 @@ CallFrame* CallFrame::callerFrame(EntryFrame*& currEntryFrame) const
 SUPPRESS_ASAN CallFrame* CallFrame::unsafeCallerFrame(EntryFrame*& currEntryFrame) const
 {
     if (unsafeCallerFrameOrEntryFrame() == currEntryFrame) {
+        // The sampling profiler walks the sampled thread's unsafe state: it can
+        // start from a stale vm.topCallFrame, or from a machine frame inside
+        // vmEntryToJavaScript's prologue/epilogue, while its vm.topEntryFrame
+        // snapshot is null. A walked frame whose caller slot reads null then
+        // matches the null entry frame here, and vmEntryRecord(nullptr) faults
+        // reading near address zero. Treat a null entry frame as the end of the
+        // walk instead.
+        if (!currEntryFrame)
+            return nullptr;
         VMEntryRecord* currVMEntryRecord = vmEntryRecord(currEntryFrame);
         currEntryFrame = currVMEntryRecord->unsafePrevTopEntryFrame();
         return currVMEntryRecord->unsafePrevTopCallFrame();

Tools/TestWebKitAPI/CMakeLists.txt

@@ -186,6 +186,7 @@ if (ENABLE_JAVASCRIPTCORE)
         Tests/JavaScriptCore/MarkedVector.cpp
         Tests/JavaScriptCore/PropertySlot.cpp
         Tests/JavaScriptCore/RegularExpression.cpp
+        Tests/JavaScriptCore/UnsafeCallerFrame.cpp
     )
 
     set(TestJavaScriptCore_LIBRARIES

Tools/TestWebKitAPI/Tests/JavaScriptCore/UnsafeCallerFrame.cpp

@@ -0,0 +1,52 @@
+/*
+ * Copyright (C) 2026 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include <JavaScriptCore/CallFrame.h>
+#include <JavaScriptCore/InitializeThreading.h>
+
+namespace TestWebKitAPI {
+
+// The sampling profiler walks stacks through CallFrame::unsafeCallerFrame
+// while its EntryFrame cursor can be null: vm.topEntryFrame is null in the
+// windows around vmEntryToJavaScript where vm.entryScope is already set, and
+// the walk can start from a stale vm.topCallFrame or a half-built entry
+// frame. A walked frame whose caller slot reads null used to match the null
+// cursor and dereference vmEntryRecord(nullptr), faulting just below address
+// zero. Model that exact state with a zeroed frame and a null entry frame:
+// unsafeCallerFrame must report the end of the stack instead of crashing.
+TEST(JavaScriptCore_CallFrame, UnsafeCallerFrameWithNullEntryFrame)
+{
+    JSC::initialize();
+
+    alignas(JSC::Register) uint64_t zeroedFrame[16] = { };
+    JSC::CallFrame* callFrame = JSC::CallFrame::create(reinterpret_cast<JSC::Register*>(zeroedFrame));
+
+    JSC::EntryFrame* entryFrame = nullptr;
+    EXPECT_EQ(callFrame->unsafeCallerFrame(entryFrame), nullptr);
+    EXPECT_EQ(entryFrame, nullptr);
+}
+
+} // namespace TestWebKitAPI