Fatal SIGSEGV Crash When running "Enable Sampling Profiler"

## Bug Description

I'm trying to profile an app's JS code, so I opened the dev-menu and pressed "Enable Sampling Profiler". This crashes the app.

Hermes version: 0.9.0
React Native version (if any): 0.67
OS version (if any):
Platform (most likely one of arm64-v8a, armeabi-v7a, x86, x86_64): arm64-v8a

## Steps To Reproduce

1. Run a React Native 0.67 app with Hermes 0.9.0 on Android
2. Press "Enable Sampling Profiler"
3. See crash

## The Expected Behavior

I expect the profiler to work for me to get a sampling profile.

## Logs

Raw

```
--------- beginning of crash
01-18 11:46:07.768 10842 11131 F libc : Fatal signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 0xd0 in tid 11131 (icationsHandler), pid 10842 (steakwallet.app)
01-18 11:46:07.888 10842 11073 W libEGL : EGLNativeWindowType 0x7374b4b010 disconnect failed
01-18 11:46:07.888 10842 11073 D OpenGLRenderer: endAllActiveAnimators on 0x73551faa00 (AlertController$RecycleListView) with handle 0x735b589a00
01-18 11:46:07.891 1292 2373 V WindowManager: removeIfPossible: Window{7ffaa56 u0 fi.steakwallet.app/fi.steakwallet.app.MainActivity}
01-18 11:46:07.897 1292 2373 V WindowManager: Not removing Window{7ffaa56 u0 fi.steakwallet.app/fi.steakwallet.app.MainActivity EXITING} due to exit animation
01-18 11:46:07.899 1292 1351 I StatusBarDisable: setFlags what=0 which=1 pkg=Window{c5b275 u0 fi.steakwallet.app/fi.steakwallet.app.MainActivity}
01-18 11:46:07.899 1292 2373 D ZrHung.AppEyeTransparentWindow: TransparentWindow cancelCheckFreezeScreen
01-18 11:46:07.900 1292 2373 E : [ZeroHung]zrhung_get_config: Get config failed for wp[0x0111]
01-18 11:46:07.900 1292 2373 D ZrHung.AppEyeTransparentWindow: TransparentWindow mHungConfigStatus = 1,mHungConfigEnable =
01-18 11:46:07.904 1292 1351 I chatty : uid=1000(system) android.ui identical 1 line
01-18 11:46:07.909 10842 11056 E : [ZeroHung]zrhung_get_config: Get config failed for wp[0x0102]
01-18 11:46:07.918 1292 1351 I StatusBarDisable: setFlags what=0 which=1 pkg=Window{c5b275 u0 fi.steakwallet.app/fi.steakwallet.app.MainActivity}
01-18 11:46:07.927 2203 2712 I PG_ash : view add pid:10842 uid:10160
01-18 11:46:07.930 10842 11073 D OpenGLRenderer: HWUI Binary is enabled
01-18 11:46:07.934 1292 2373 E WindowManager: App trying to use insecure INPUT_FEATURE_NO_INPUT_CHANNEL flag. Ignoring
01-18 11:46:07.941 1292 2373 V WindowManager: addWindow: Window{64f8963 u0 Toast}
01-18 11:46:08.045 12656 12656 I crash_dump64: obtaining output fd from tombstoned, type: kDebuggerdTombstone
01-18 11:46:08.056 754 754 I /system/bin/tombstoned: received crash request for pid 11131
01-18 11:46:08.059 1292 1484 V WindowManager: Exit animation finished in Window{7ffaa56 u0 fi.steakwallet.app/fi.steakwallet.app.MainActivity EXITING}: remove=true
01-18 11:46:08.059 1292 1484 E WindowManager: win=Window{7ffaa56 u0 fi.steakwallet.app/fi.steakwallet.app.MainActivity EXITING} destroySurfaces: appStopped=false win.mWindowRemovalAllowed=true win.mRemoveOnExit=true
01-18 11:46:08.060 1292 1484 V WindowManager: postWindowRemoveCleanupLocked: Window{7ffaa56 u0 fi.steakwallet.app/fi.steakwallet.app.MainActivity}
01-18 11:46:08.060 1292 1484 V WindowManager: Removing Window{7ffaa56 u0 fi.steakwallet.app/fi.steakwallet.app.MainActivity} from AppWindowToken{f8dadf6 token=Token{8d41a91 ActivityRecord{d523cb8 u0 fi.steakwallet.app/.MainActivity t44}}}
01-18 11:46:08.061 12656 12656 I crash_dump64: performing dump of process 10842 (target tid = 11131)
01-18 11:46:08.063 1292 1351 I StatusBarDisable: setFlags what=0 which=1 pkg=Window{c5b275 u0 fi.steakwallet.app/fi.steakwallet.app.MainActivity}
01-18 11:46:08.088 10842 11073 D mali_winsys: EGLint new_window_surface(egl_winsys_display *, void *, EGLSurface, EGLConfig, egl_winsys_surface **, EGLBoolean) returns 0x3000
01-18 11:46:08.088 10842 11073 D OpenGLRenderer: HWUI Binary is enabled
01-18 11:46:08.089 590 590 I GRALLOC : getCallingPid=644, shrFd=32,fmt=0x1,intFmt=0x1,btStrd=2304,size=241664,pid=590
01-18 11:46:08.089 590 590 I GRALLOC : yuv=2,w=540,h=101,Stride u=0 v=0,offset u=0 v=0
01-18 11:46:08.089 590 590 I GRALLOC : iova_size=241664,conUsg=0x900,proUsg=0x900, strd=576,[afbc]HdrStrd=0 PyldStrd=0 Scrmbl=0,ionhnd = 1
01-18 11:46:08.092 590 2933 I GRALLOC : getCallingPid=644, shrFd=34,fmt=0x1,intFmt=0x1,btStrd=2304,size=241664,pid=590
01-18 11:46:08.092 590 2933 I GRALLOC : yuv=2,w=540,h=101,Stride u=0 v=0,offset u=0 v=0
01-18 11:46:08.092 590 2933 I GRALLOC : iova_size=241664,conUsg=0x900,proUsg=0x900, strd=576,[afbc]HdrStrd=0 PyldStrd=0 Scrmbl=0,ionhnd = 2
01-18 11:46:08.092 590 1015 I GRALLOC : getCallingPid=644, shrFd=36,fmt=0x1,intFmt=0x1,btStrd=2304,size=241664,pid=590
01-18 11:46:08.092 590 1015 I GRALLOC : yuv=2,w=540,h=101,Stride u=0 v=0,offset u=0 v=0
01-18 11:46:08.092 590 1015 I GRALLOC : iova_size=241664,conUsg=0x900,proUsg=0x900, strd=576,[afbc]HdrStrd=0 PyldStrd=0 Scrmbl=0,ionhnd = 3
01-18 11:46:08.093 10842 10842 V InputMethodManager: Reporting focus gain, without startInput
01-18 11:46:08.097 12656 12656 F DEBUG : *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
01-18 11:46:08.098 12656 12656 F DEBUG : Build fingerprint: 'HUAWEI/VTR-L29/HWVTR:9/HUAWEIVTR-L29/9.1.0.275C432:user/release-keys'
01-18 11:46:08.098 590 590 I GRALLOC : getCallingPid=644, shrFd=32,fmt=0x1,intFmt=0x1,btStrd=2304,size=241664,pid=590
01-18 11:46:08.098 590 590 I GRALLOC : yuv=2,w=540,h=101,Stride u=0 v=0,offset u=0 v=0
01-18 11:46:08.098 590 590 I GRALLOC : iova_size=241664,conUsg=0xb00,proUsg=0xb00, strd=576,[afbc]HdrStrd=0 PyldStrd=0 Scrmbl=0,ionhnd = 1
01-18 11:46:08.098 12656 12656 F DEBUG : Revision: '0'
01-18 11:46:08.098 12656 12656 F DEBUG : ABI: 'arm64'
01-18 11:46:08.099 12656 12656 F DEBUG : Happend: 'Tue Jan 18 11:46:08 2022
01-18 11:46:08.099 12656 12656 F DEBUG : '
01-18 11:46:08.099 12656 12656 F DEBUG : SYSVMTYPE: Art
01-18 11:46:08.099 12656 12656 F DEBUG : APPVMTYPE: Art
01-18 11:46:08.099 12656 12656 F DEBUG : pid: 10842, tid: 11131, name: icationsHandler >>> fi.steakwallet.app <<<
01-18 11:46:08.099 12656 12656 F DEBUG : signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 0xd0
01-18 11:46:08.099 12656 12656 F DEBUG : Cause: null pointer dereference
01-18 11:46:08.099 12656 12656 F DEBUG : x0 0000000000000000 x1 0000007399bde298 x2 0000000000000010 x3 00000000ffffffff
01-18 11:46:08.099 12656 12656 F DEBUG : x4 0000000000000000 x5 0000000000000008 x6 0000007447eb3000 x7 0000000002b7a236
01-18 11:46:08.099 12656 12656 F DEBUG : x8 0000007399bdf790 x9 0000000000000001 x10 0000000000000000 x11 0000000009f81af2
01-18 11:46:08.099 12656 12656 F DEBUG : x12 0000000000000016 x13 0000000061e699f4 x14 00066e889e87422f x15 000017e43b3545ad
01-18 11:46:08.099 12656 12656 F DEBUG : x16 000000739d2a33d0 x17 0000007446b4622c x18 0000000000000002 x19 0000007399bdf598
01-18 11:46:08.099 12656 12656 F DEBUG : x20 000000739d2a5b58 x21 0000000000000000 x22 000000739d2a5b50 x23 000000739b628460
01-18 11:46:08.099 12656 12656 F DEBUG : x24 0000000000000028 x25 0000000000000001 x26 0000000013f400b8 x27 00000073a17f74c0
01-18 11:46:08.099 12656 12656 F DEBUG : x28 0000000071661c70 x29 0000007399bdcfe0
01-18 11:46:08.099 12656 12656 F DEBUG : sp 0000007399bdcfb0 lr 000000739d083a90 pc 000000739d083a90
01-18 11:46:08.132 1292 1351 I chatty : uid=1000(system) android.ui identical 3 lines
01-18 11:46:08.133 590 590 I GRALLOC : getCallingPid=644, shrFd=32,fmt=0x1,intFmt=0x1,btStrd=2304,size=241664,pid=590
01-18 11:46:08.133 590 590 I GRALLOC : yuv=2,w=540,h=101,Stride u=0 v=0,offset u=0 v=0
01-18 11:46:08.133 590 590 I GRALLOC : iova_size=241664,conUsg=0xb00,proUsg=0xb00, strd=576,[afbc]HdrStrd=0 PyldStrd=0 Scrmbl=0,ionhnd = 1
01-18 11:46:08.135 644 968 D : doWinFrameOptStatusRecog begin to recog Layer result=2
01-18 11:46:08.240 1292 1351 I StatusBarDisable: setFlags what=0 which=1 pkg=Window{c5b275 u0 fi.steakwallet.app/fi.steakwallet.app.MainActivity}
01-18 11:46:08.241 1292 1484 I DebugKeepScreenOn: setHoldScreenLocked newHoldScreen:Session{c2f73fe 10842:u0a10160} currentHoldScreen:null wakeLockState:false
01-18 11:46:08.241 1292 1484 I DebugKeepScreenOn: Acquiring screen wakelock due to Window{64f8963 u0 Toast}
01-18 11:46:08.242 1292 1484 D PowerMS : acquire:L=130435697,F=0x2000000a,T="WindowManager",N=android,WS=WorkSource{10160},U=1000,P=1292
01-18 11:46:08.259 1292 1351 I StatusBarDisable: setFlags what=0 which=1 pkg=Window{c5b275 u0 fi.steakwallet.app/fi.steakwallet.app.MainActivity}
01-18 11:46:08.349 12656 12656 F DEBUG :
01-18 11:46:08.349 12656 12656 F DEBUG : backtrace:
01-18 11:46:08.350 12656 12656 F DEBUG : #00 pc 000000000009fa90 /data/app/fi.steakwallet.app-7apQxMeULcJ559GkHbo28g==/lib/arm64/libhermes.so
01-18 11:46:08.350 12656 12656 F DEBUG : #01 pc 0000000000000690 [vdso:0000007447eb4000]
01-18 11:46:08.350 12656 12656 F DEBUG : #02 pc 000000000007018c /system/lib64/libc.so (__epoll_pwait+4)
01-18 11:46:08.350 12656 12656 F DEBUG : #03 pc 0000000000014040 /system/lib64/libutils.so (android::Looper::pollInner(int)+148)
01-18 11:46:08.350 12656 12656 F DEBUG : #04 pc 0000000000013f10 /system/lib64/libutils.so (android::Looper::pollOnce(int, int*, int*, void**)+60)
01-18 11:46:08.350 12656 12656 F DEBUG : #05 pc 000000000012aacc /system/lib64/libandroid_runtime.so (android::android_os_MessageQueue_nativePollOnce(_JNIEnv*, _jobject*, long, int)+44)
01-18 11:46:08.350 12656 12656 F DEBUG : #06 pc 000000000042a35c /system/framework/arm64/boot-framework.oat (offset 0x415000) (android.media.MediaExtractor.seekTo [DEDUPED]+140)
01-18 11:46:08.350 12656 12656 F DEBUG : #07 pc 000000000001c690 /dev/ashmem/dalvik-jit-code-cache (deleted) (android.os.MessageQueue.next+256)
01-18 11:46:08.350 12656 12656 F DEBUG : #08 pc 0000000000580588 /system/lib64/libart.so (art_quick_invoke_stub+584)
01-18 11:46:08.350 12656 12656 F DEBUG : #09 pc 00000000000d8608 /system/lib64/libart.so (art::ArtMethod::Invoke(art::Thread*, unsigned int*, unsigned int, art::JValue*, char const*)+200)
01-18 11:46:08.350 12656 12656 F DEBUG : #10 pc 000000000028cec8 /system/lib64/libart.so (art::interpreter::ArtInterpreterToCompiledCodeBridge(art::Thread*, art::ArtMethod*, art::ShadowFrame*, unsigned short, art::JValue*)+344)
01-18 11:46:08.350 12656 12656 F DEBUG : #11 pc 0000000000286ed0 /system/lib64/libart.so (bool art::interpreter::DoCall(art::ArtMethod*, art::Thread*, art::ShadowFrame&, art::Instruction const*, unsigned short, art::JValue*)+968)
01-18 11:46:08.350 12656 12656 F DEBUG : #12 pc 0000000000547bf8 /system/lib64/libart.so (MterpInvokeVirtual+588)
01-18 11:46:08.350 12656 12656 F DEBUG : #13 pc 0000000000572c94 /system/lib64/libart.so (ExecuteMterpImpl+14228)
01-18 11:46:08.350 12656 12656 F DEBUG : #14 pc 0000000000b51ba8 /system/framework/boot-framework.vdex (android.os.Looper.loop+142)
01-18 11:46:08.350 12656 12656 F DEBUG : #15 pc 0000000000260bd4 /system/lib64/libart.so (_ZN3art11interpreterL7ExecuteEPNS_6ThreadERKNS_20CodeItemDataAccessorERNS_11ShadowFrameENS_6JValueEb.llvm.4179671085+488)
01-18 11:46:08.350 12656 12656 F DEBUG : #16 pc 00000000002666c8 /system/lib64/libart.so (art::interpreter::ArtInterpreterToInterpreterBridge(art::Thread*, art::CodeItemDataAccessor const&, art::ShadowFrame*, art::JValue*)+216)
01-18 11:46:08.350 12656 12656 F DEBUG : #17 pc 0000000000286eb4 /system/lib64/libart.so (bool art::interpreter::DoCall(art::ArtMethod*, art::Thread*, art::ShadowFrame&, art::Instruction const*, unsigned short, art::JValue*)+940)
01-18 11:46:08.350 12656 12656 F DEBUG : #18 pc 0000000000549100 /system/lib64/libart.so (MterpInvokeStatic+204)
01-18 11:46:08.350 12656 12656 F DEBUG : #19 pc 0000000000572e14 /system/lib64/libart.so (ExecuteMterpImpl+14612)
01-18 11:46:08.350 12656 12656 F DEBUG : #20 pc 0000000000b49968 /system/framework/boot-framework.vdex (android.os.HandlerThread.run+56)
01-18 11:46:08.350 12656 12656 F DEBUG : #21 pc 0000000000260bd4 /system/lib64/libart.so (_ZN3art11interpreterL7ExecuteEPNS_6ThreadERKNS_20CodeItemDataAccessorERNS_11ShadowFrameENS_6JValueEb.llvm.4179671085+488)
01-18 11:46:08.350 12656 12656 F DEBUG : #22 pc 0000000000533b90 /system/lib64/libart.so (artQuickToInterpreterBridge+1020)
01-18 11:46:08.350 12656 12656 F DEBUG : #23 pc 00000000005896fc /system/lib64/libart.so (art_quick_to_interpreter_bridge+92)
01-18 11:46:08.350 12656 12656 F DEBUG : #24 pc 0000000000580588 /system/lib64/libart.so (art_quick_invoke_stub+584)
01-18 11:46:08.350 12656 12656 F DEBUG : #25 pc 00000000000d8608 /system/lib64/libart.so (art::ArtMethod::Invoke(art::Thread*, unsigned int*, unsigned int, art::JValue*, char const*)+200)
01-18 11:46:08.350 12656 12656 F DEBUG : #26 pc 000000000047b3e8 /system/lib64/libart.so (art::(anonymous namespace)::InvokeWithArgArray(art::ScopedObjectAccessAlreadyRunnable const&, art::ArtMethod*, art::(anonymous namespace)::ArgArray*, art::JValue*, char const*)+104)
01-18 11:46:08.350 12656 12656 F DEBUG : #27 pc 000000000047c4a4 /system/lib64/libart.so (art::InvokeVirtualOrInterfaceWithJValues(art::ScopedObjectAccessAlreadyRunnable const&, _jobject*, _jmethodID*, jvalue*)+424)
01-18 11:46:08.350 12656 12656 F DEBUG : #28 pc 00000000004a8238 /system/lib64/libart.so (art::Thread::CreateCallback(void*)+1120)
01-18 11:46:08.350 12656 12656 F DEBUG : #29 pc 0000000000083a6c /system/lib64/libc.so (__pthread_start(void*)+36)
01-18 11:46:08.350 12656 12656 F DEBUG : #30 pc 00000000000246e4 /system/lib64/libc.so (__start_thread+68)
01-18 11:46:08.550 572 633 I PreDnsController: canPreDnsQuery,persist.sys.predns is false!
01-18 11:46:08.911 10842 11056 E : [ZeroHung]zrhung_get_config: Get config failed for wp[0x0102]
```

Symbolicated

```
********** Crash dump: **********
Build fingerprint: 'HUAWEI/VTR-L29/HWVTR:9/HUAWEIVTR-L29/9.1.0.275C432:user/release-keys'
#00 0x000000000009fa90 /data/app/fi.steakwallet.app-7apQxMeULcJ559GkHbo28g==/lib/arm64/libhermes.so
hermes::vm::SamplingProfiler::GlobalProfiler::profilingSignalHandler(int)
/tmp/hermes/hermes/lib/VM/Profiler/SamplingProfilerPosix.cpp:121:43
#01 0x0000000000000690 [vdso:0000007447eb4000]
#02 0x000000000007018c /system/lib64/libc.so (__epoll_pwait+4)
#03 0x0000000000014040 /system/lib64/libutils.so (android::Looper::pollInner(int)+148)
#04 0x0000000000013f10 /system/lib64/libutils.so (android::Looper::pollOnce(int, int*, int*, void**)+60)
#05 0x000000000012aacc /system/lib64/libandroid_runtime.so (android::android_os_MessageQueue_nativePollOnce(_JNIEnv*, _jobject*, long, int)+44)
#06 0x000000000042a35c /system/framework/arm64/boot-framework.oat (offset 0x415000) (android.media.MediaExtractor.seekTo [DEDUPED]+140)
#07 0x000000000001c690 /dev/ashmem/dalvik-jit-code-cache (deleted) (android.os.MessageQueue.next+256)
#08 0x0000000000580588 /system/lib64/libart.so (art_quick_invoke_stub+584)
#09 0x00000000000d8608 /system/lib64/libart.so (art::ArtMethod::Invoke(art::Thread*, unsigned int*, unsigned int, art::JValue*, char const*)+200)
#10 0x000000000028cec8 /system/lib64/libart.so (art::interpreter::ArtInterpreterToCompiledCodeBridge(art::Thread*, art::ArtMethod*, art::ShadowFrame*, unsigned short, art::JValue*)+344)
#11 0x0000000000286ed0 /system/lib64/libart.so (bool art::interpreter::DoCall(art::ArtMethod*, art::Thread*, art::ShadowFrame&, art::Instruction const*, unsigned short, art::JValue*)+968)
#12 0x0000000000547bf8 /system/lib64/libart.so (MterpInvokeVirtual+588)
#13 0x0000000000572c94 /system/lib64/libart.so (ExecuteMterpImpl+14228)
#14 0x0000000000b51ba8 /system/framework/boot-framework.vdex (android.os.Looper.loop+142)
#15 0x0000000000260bd4 /system/lib64/libart.so (_ZN3art11interpreterL7ExecuteEPNS_6ThreadERKNS_20CodeItemDataAccessorERNS_11ShadowFrameENS_6JValueEb.llvm.4179671085+488)
#16 0x00000000002666c8 /system/lib64/libart.so (art::interpreter::ArtInterpreterToInterpreterBridge(art::Thread*, art::CodeItemDataAccessor const&, art::ShadowFrame*, art::JValue*)+216)
#17 0x0000000000286eb4 /system/lib64/libart.so (bool art::interpreter::DoCall(art::ArtMethod*, art::Thread*, art::ShadowFrame&, art::Instruction const*, unsigned short, art::JValue*)+940)
#18 0x0000000000549100 /system/lib64/libart.so (MterpInvokeStatic+204)
#19 0x0000000000572e14 /system/lib64/libart.so (ExecuteMterpImpl+14612)
#20 0x0000000000b49968 /system/framework/boot-framework.vdex (android.os.HandlerThread.run+56)
#21 0x0000000000260bd4 /system/lib64/libart.so (_ZN3art11interpreterL7ExecuteEPNS_6ThreadERKNS_20CodeItemDataAccessorERNS_11ShadowFrameENS_6JValueEb.llvm.4179671085+488)
#22 0x0000000000533b90 /system/lib64/libart.so (artQuickToInterpreterBridge+1020)
#23 0x00000000005896fc /system/lib64/libart.so (art_quick_to_interpreter_bridge+92)
#24 0x0000000000580588 /system/lib64/libart.so (art_quick_invoke_stub+584)
#25 0x00000000000d8608 /system/lib64/libart.so (art::ArtMethod::Invoke(art::Thread*, unsigned int*, unsigned int, art::JValue*, char const*)+200)
#26 0x000000000047b3e8 /system/lib64/libart.so (art::(anonymous namespace)::InvokeWithArgArray(art::ScopedObjectAccessAlreadyRunnable const&, art::ArtMethod*, art::(anonymous namespace)::ArgArray*, art::JValue*, char const*)+104)
#27 0x000000000047c4a4 /system/lib64/libart.so (art::InvokeVirtualOrInterfaceWithJValues(art::ScopedObjectAccessAlreadyRunnable const&, _jobject*, _jmethodID*, jvalue*)+424)
#28 0x00000000004a8238 /system/lib64/libart.so (art::Thread::CreateCallback(void*)+1120)
#29 0x0000000000083a6c /system/lib64/libc.so (__pthread_start(void*)+36)
#30 0x00000000000246e4 /system/lib64/libc.so (__start_thread+68)
Crash dump is completed
```

Looks like `profilerInstance->threadLocalProfiler_` is null: https://github.com/facebook/hermes/blob/8bebc9b534fd6d1ae407b9d46a15a5681631d6c7/lib/VM/Profiler/SamplingProfilerPosix.cpp#L120
I assume there's something going wrong before that function, as I can't see why that variable should be null here.