Suppress debug asserts in at()/cast_to() under crash protection

During signal-handler stack walking, GC or class unloading can free
VMNMethod/VMMethod memory concurrently. In release builds, setjmp/longjmp
crash protection catches the SIGSEGV. In debug builds, the assert fires
first with uncatchable SIGABRT. Skip the readability asserts when crash
protection is established — the SIGSEGV recovery already covers bad reads.

Uses ProfiledThread (pthread_getspecific) instead of thread_local to avoid
async-signal-unsafe TLS allocation in dlopen-ed libraries.

Also adds defense-in-depth readability checks in findNMethod and
getMethodId to prevent walking with garbage data in release builds.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: jbachorik

ddprof-lib/src/main/cpp/stackWalker.cpp

@@ -60,7 +60,8 @@ static inline void fillFrame(ASGCT_CallFrame& frame, FrameTypeId type, int bci,
 }
 
 static jmethodID getMethodId(VMMethod* method) {
-    if (!inDeadZone(method) && aligned((uintptr_t)method) && SafeAccess::isReadable((void*)method)) {
+    if (!inDeadZone(method) && aligned((uintptr_t)method)
+            && SafeAccess::isReadableRange(method, VMMethod::type_size())) {
         return method->validatedId();
     }
     return NULL;
@@ -285,11 +286,15 @@ __attribute__((no_sanitize("address"))) int StackWalker::walkVM(void* ucontext,
     volatile int depth = 0;
     int actual_max_depth = truncated ? max_depth + 1 : max_depth;
 
+    ProfiledThread* profiled_thread = ProfiledThread::currentSignalSafe();
+
     VMJavaFrameAnchor* anchor = NULL;
     if (vm_thread != NULL) {
         anchor = vm_thread->anchor();
         vm_thread->exception() = &crash_protection_ctx;
+        if (profiled_thread != nullptr) profiled_thread->setCrashProtectionActive(true);
         if (setjmp(crash_protection_ctx) != 0) {
+            if (profiled_thread != nullptr) profiled_thread->setCrashProtectionActive(false);
             vm_thread->exception() = saved_exception;
             if (depth < max_depth) {
                 fillFrame(frames[depth++], BCI_ERROR, "break_not_walkable");
@@ -654,6 +659,7 @@ __attribute__((no_sanitize("address"))) int StackWalker::walkVM(void* ucontext,
         goto unwind_loop;
     }
 
+    if (profiled_thread != nullptr) profiled_thread->setCrashProtectionActive(false);
     if (vm_thread != NULL) vm_thread->exception() = saved_exception;
 
     // Drop unknown leaf frame - it provides no useful information and breaks

ddprof-lib/src/main/cpp/thread.h

@@ -70,11 +70,12 @@ class ProfiledThread : public ThreadLocalData {
   int _filter_slot_id; // Slot ID for thread filtering
   UnwindFailures _unwind_failures;
   bool _ctx_tls_initialized;
+  bool _crash_protection_active;
   Context* _ctx_tls_ptr;
 
   ProfiledThread(int buffer_pos, int tid)
       : ThreadLocalData(), _pc(0), _sp(0), _span_id(0), _root_span_id(0), _crash_depth(0), _buffer_pos(buffer_pos), _tid(tid), _cpu_epoch(0),
-        _wall_epoch(0), _call_trace_id(0), _recording_epoch(0), _misc_flags(0), _filter_slot_id(-1), _ctx_tls_initialized(false), _ctx_tls_ptr(nullptr) {};
+        _wall_epoch(0), _call_trace_id(0), _recording_epoch(0), _misc_flags(0), _filter_slot_id(-1), _ctx_tls_initialized(false), _crash_protection_active(false), _ctx_tls_ptr(nullptr) {};
 
   void releaseFromBuffer();
 
@@ -212,6 +213,9 @@ class ProfiledThread : public ThreadLocalData {
     _misc_flags |= FLAG_JAVA_THREAD_KNOWN | (isJava ? FLAG_JAVA_THREAD : 0);
   }
 
+  inline bool isCrashProtectionActive() const { return _crash_protection_active; }
+  inline void setCrashProtectionActive(bool active) { _crash_protection_active = active; }
+
 private:
   // Atomic flag for signal handler reentrancy protection within the same thread
   // Must be atomic because a signal handler can interrupt normal execution mid-instruction,

ddprof-lib/src/main/cpp/vmStructs.cpp

@@ -871,7 +871,18 @@ VMNMethod* CodeHeap::findNMethod(char* heap, const void* pc) {
     }
 
     unsigned char* block = heap_start + (idx << _code_heap_segment_shift) + _heap_block_used_offset;
-    return *block ? align<VMNMethod*>(block + sizeof(uintptr_t)) : NULL;
+    if (!*block) {
+        return NULL;
+    }
+    VMNMethod* nm = align<VMNMethod*>(block + sizeof(uintptr_t));
+    // Validate the nmethod memory is still readable. findNMethod is called from
+    // signal-handler context (walkVM) where nmethods can be freed concurrently
+    // during class unloading. Unlike other VMStructs casts that go through
+    // cast_to<T> with readability validation, align<> provides none.
+    if (!SafeAccess::isReadableRange(nm, VMNMethod::type_size())) {
+        return NULL;
+    }
+    return nm;
 }
 
 int VMNMethod::findScopeOffset(const void* pc) {

ddprof-lib/src/main/cpp/vmStructs.h

@@ -22,10 +22,23 @@ class HeapUsage;
 
 #define TYPE_SIZE_NAME(name)    _##name##_size
 
+// During stack walking in the profiler's signal handler, GC or class unloading
+// on another thread can free VMNMethod/VMMethod memory concurrently, making
+// pointers stale between the readability check and the actual dereference.
+// In release builds the setjmp/longjmp crash protection in walkVM catches the
+// resulting SIGSEGV. In debug builds the assert(isReadable) fires first,
+// sending SIGABRT which is uncatchable by crash protection.
+// When crash protection is active the assert is redundant — any bad read will
+// be caught by the SIGSEGV handler and recovered via longjmp — so we skip it.
+inline bool crashProtectionActive() {
+    ProfiledThread* pt = ProfiledThread::currentSignalSafe();
+    return pt != nullptr && pt->isCrashProtectionActive();
+}
+
 template <typename T>
 inline T* cast_to(const void* ptr) {
     assert(T::type_size() > 0); // Ensure type size has been initialized
-    assert(ptr == nullptr || SafeAccess::isReadableRange(ptr, T::type_size()));
+    assert(crashProtectionActive() || ptr == nullptr || SafeAccess::isReadableRange(ptr, T::type_size()));
     return reinterpret_cast<T*>(const_cast<void*>(ptr));
 }
 
@@ -204,7 +217,7 @@ class VMStructs {
 
     const char* at(int offset) {
         const char* ptr = (const char*)this + offset;
-        assert(SafeAccess::isReadable(ptr));
+        assert(crashProtectionActive() || SafeAccess::isReadable(ptr));
         return ptr;
     }