Ruby

During thread cleanup, if a ruby sampling profiler calls thread_profile_frames at just the wrong time, the ec's stack is cleared but the CFP still exists on the EC, so thread_profile_frames assumes it can walk the stack and crashes.

In rb_ec_clear_vm_stack, it should set cfp to NULL before clearing the stack. If during rc_ec_clear_vm_stack the process gets a signal and this thread handles it and calls thread_profile_frames, the early return check of if (!cfp) fails, it continues and crashes in this function.