301497 2025-10-26 22:08:57 -0700 [JSC] null pointer dereference in SamplingProfiler::processUnverifiedStackTraces() 2025-10-27 23:45:49 -0700 1 1 1 Unclassified WebKit JavaScriptCore WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 1 jarred ysuzuki keith_miller syg webkit-bug-importer ysuzuki oldest_to_newest 2154371 0 jarred 2025-10-26 22:08:57 -0700 If `calleeBits.asCell()` returns a null pointer, we get a null pointer dereference: https://github.com/WebKit/WebKit/blob/e4254ec2a5ac077d06a3d9574e36912c95a6dcdb/Source/JavaScriptCore/runtime/SamplingProfiler.cpp#L563-L564 `JSValue::isCell` returns `true` when the `JSValue` is `0`. So this check in HeapUtil is insufficient: https://github.com/WebKit/WebKit/blob/e4254ec2a5ac077d06a3d9574e36912c95a6dcdb/Source/JavaScriptCore/heap/HeapUtil.h#L86-L90 With UBSAN, this error shows up as: > runtime error: member call on null pointer of type 'const JSC::HeapCell *' A fix is to check it's not empty: diff --git i/Source/JavaScriptCore/runtime/SamplingProfiler.cpp w/Source/JavaScriptCore/runtime/SamplingProfiler.cpp index 2cafdc0dd6d5..dbc629bbb4ff 100644 --- i/Source/JavaScriptCore/runtime/SamplingProfiler.cpp +++ w/Source/JavaScriptCore/runtime/SamplingProfiler.cpp @@ -561,7 +561,7 @@ void SamplingProfiler::processUnverifiedStackTraces() } JSValue callee = calleeBits.asCell(); - if (!HeapUtil::isValueGCObject(m_vm.heap, filter, callee)) { + if (callee.isEmpty() || !HeapUtil::isValueGCObject(m_vm.heap, filter, callee)) { if (!alreadyHasExecutable) stackFrame.frameType = FrameType::Unknown; return; I don't know why there's a null pointer in there to begin with though. That seems like the bigger question. 2154644 1 ysuzuki 2025-10-27 22:31:27 -0700 I think this is possible since stack collection happens at arbitrary timing. Let's suppress UBSan message via check. 2154645 2 ysuzuki 2025-10-27 22:31:47 -0700 As it happens only when it is nullptr, it is deterministic crash issue. 2154646 3 webkit-bug-importer 2025-10-27 22:34:15 -0700 <rdar://problem/163537650> 2154647 4 ysuzuki 2025-10-27 22:35:22 -0700 Pull request: https://github.com/WebKit/WebKit/pull/53074 2154656 5 ews-feeder 2025-10-27 23:45:46 -0700 Committed 302226@main (c249a7798f86): <https://commits.webkit.org/302226@main> Reviewed commits have been landed. Closing PR #53074 and removing active labels.