@@ -81,17 +81,24 @@ unsigned int Dictionary::hash(const char *key, size_t length) {
 }
 
 unsigned int Dictionary::lookup(const char *key) {
-  DEBUG_ASSERT_NOT_IN_SIGNAL();
   return lookup(key, strlen(key));
 }
 
 unsigned int Dictionary::lookup(const char *key, size_t length) {
-  DEBUG_ASSERT_NOT_IN_SIGNAL();
   return lookup(key, length, true, 0);
 }
 
 unsigned int Dictionary::lookup(const char *key, size_t length, bool for_insert,
                                 unsigned int sentinel) {
+  // The insert path mallocs (allocateKey) and may calloc a DictTable —
+  // both AS-unsafe.  Read-only lookups (for_insert == false, used by
+  // check() and bounded_lookup at capacity) only touch already-allocated
+  // memory and are AS-safe.  Assert here rather than in the overloads
+  // so bounded_lookup's runtime-decided for_insert is also covered.
+  if (for_insert) {
+    DEBUG_ASSERT_NOT_IN_SIGNAL();
+  }
+
   DictTable *table = _table;
   unsigned int h = hash(key, length);
 
 
@@ -35,6 +35,14 @@ bool isInSignalContext() {
     return pt == nullptr || pt->signalDepth() != 0;
 }
 
+bool isInTrackedSignalContext() {
+    ProfiledThread *pt = ProfiledThread::currentSignalSafe();
+    // null ProfiledThread = no thread context; the SignalHandlerScope
+    // never ran, so we have no positive evidence of a signal frame.
+    // See header comment for the rationale of returning false here.
+    return pt != nullptr && pt->signalDepth() != 0;
+}
+
 SignalHandlerScope::SignalHandlerScope() : _active(true) {
     ProfiledThread *pt = ProfiledThread::currentSignalSafe();
     if (pt != nullptr) {
 
@@ -61,6 +61,17 @@ int getInSignalDepth();
 // assume signal" — fail-safe for AS-safety gating).
 bool isInSignalContext();
 
+// Returns true ONLY when we have positively tracked entering one of our
+// installed signal handlers on this thread.  null ProfiledThread → false
+// (we have no way to know, so callers that prefer to do work
+// synchronously on uninstrumented threads — Profiler::dlopen_hook —
+// can use this.)  Accepts the small theoretical risk that an
+// uninstrumented JVM-internal thread (VM Thread, JIT, GC) doing a dlopen
+// from inside a *foreign* signal handler will look like regular code;
+// prewarmUnwinder() covers the known libgcc_s case and JVM-internal
+// signal handlers are generally AS-safe by design.
+bool isInTrackedSignalContext();
+
 // Internal RAII type — do not instantiate directly; use the macros below.
 class SignalHandlerScope {
 public:
 
@@ -69,14 +69,13 @@ void Libraries::refresh() {
 void *Libraries::refresherLoop(void *arg) {
   Libraries *self = static_cast<Libraries *>(arg);
 
-  // Publish our TID so sampler thread-list enumerations can skip us.
-  self->_refresher_tid.store(OS::threadId(), std::memory_order_release);
-
-  // Block profiling signals so this thread is never sampled.  Without
-  // this, SIGPROF can fire on the refresher and run the full stack-walk
-  // path here — pure overhead, and in debug builds with
-  // DDPROF_FORCE_STACKWALK_CRASH it inflates the SIGSEGV recovery count
-  // enough to starve the test work thread and break
+  // Block profiling signals BEFORE publishing our TID.  Otherwise a
+  // SIGPROF / SIGVTALRM armed for this thread (e.g. a stale per-thread
+  // timer from a previous lifecycle, or an in-flight signal queued during
+  // pthread_create) could fire on us between TID-publish and sigmask, and
+  // run the full stack-walk path here — pure overhead, and in debug
+  // builds with DDPROF_FORCE_STACKWALK_CRASH it inflates the SIGSEGV
+  // recovery count enough to starve the test work thread and break
   // vmStackwalkerCrashRecoveryTest.  SIGIO (WAKEUP_SIGNAL) is left
   // unmasked because stopRefresher() relies on it to interrupt sleep.
   sigset_t mask;
@@ -85,10 +84,27 @@ void *Libraries::refresherLoop(void *arg) {
   sigaddset(&mask, SIGVTALRM);
   pthread_sigmask(SIG_BLOCK, &mask, nullptr);
 
+  // Publish our TID so sampler thread-list enumerations can skip us.
+  self->_refresher_tid.store(OS::threadId(), std::memory_order_release);
+
   while (self->_refresher_running.load(std::memory_order_acquire)) {
-    // OS::sleep uses nanosleep, which returns early on EINTR — the wakeup
-    // signal sent from stopRefresher() will interrupt this immediately.
-    OS::sleep(REFRESH_INTERVAL_NS);
+    // Sleep until the next tick or until interrupted.  OS::sleep wraps a
+    // single nanosleep that returns early on EINTR; loop on the remaining
+    // time so unrelated unmasked signals (SIGCHLD, debugger SIGSTOP/CONT,
+    // etc.) do not cause premature ticks.  The stopRefresher path sends
+    // SIGIO and flips _refresher_running first, so the outer-loop check
+    // catches the wake-up and exits without sleeping again.
+    u64 remaining = REFRESH_INTERVAL_NS;
+    while (remaining > 0 &&
+           self->_refresher_running.load(std::memory_order_acquire)) {
+      u64 before = OS::nanotime();
+      OS::sleep(remaining);
+      u64 elapsed = OS::nanotime() - before;
+      if (elapsed >= remaining) {
+        break;
+      }
+      remaining -= elapsed;
+    }
     if (!self->_refresher_running.load(std::memory_order_acquire)) {
       break;
     }
 
@@ -777,20 +777,24 @@ void *Profiler::dlopen_hook(const char *filename, int flags) {
   void *result = dlopen(filename, flags);
 
   if (result != NULL) {
-    if (!isInSignalContext()) {
-      // Normal (non-signal) dlopen: refresh synchronously so symbols in
-      // the new library are resolved immediately.
+    if (!isInTrackedSignalContext()) {
+      // Either confirmed non-signal context, or no ProfiledThread on this
+      // thread (uninstrumented JVM internals — VM Thread, JIT, GC).  We
+      // prefer synchronous refresh for the null-PT case too because (a)
+      // those threads call dlopen synchronously during normal JVM
+      // operation, and (b) wasmtime's broken sigaction patching depends
+      // on switchLibraryTrap running its work inline (the original reason
+      // for the trap).  The residual risk — an uninstrumented thread
+      // calling dlopen from inside a foreign signal handler — is small:
+      // prewarmUnwinder() closes the known libgcc_s lazy-load case, and
+      // mainstream JVM signal handlers are AS-safe by design.
       Libraries::instance()->refresh();
     } else {
-      // Async-signal context.  Profiler::prewarmUnwinder closes the known
-      // libgcc_s case, but JVM/JIT lazy loads have been observed from
-      // signal handlers under Graal on aarch64.  refresh() must NOT run
-      // here — parseLibraries acquires a Mutex and calls malloc, both
-      // AS-unsafe.  Mark the library set dirty; the Libraries refresher
-      // thread picks it up within REFRESH_INTERVAL_NS (5s), bounding the
-      // window during which the new library is unresolvable.  flushJfr /
-      // dump / stop also call refresh() unconditionally, so this works
-      // even before the refresher thread starts.
+      // Confirmed signal context (one of our SignalHandlerScopes is on
+      // the stack).  refresh() must NOT run here — parseLibraries
+      // acquires a Mutex and calls malloc, both AS-unsafe.  Mark the
+      // library set dirty; the Libraries refresher thread picks it up
+      // within REFRESH_INTERVAL_NS (500 ms).
       Libraries::instance()->markDirty();
     }
   }
@@ -837,6 +841,13 @@ void Profiler::segvHandler(int signo, siginfo_t *siginfo, void *ucontext) {
   // destructor, permanently leaking depth on the thread.  Release the guard
   // before chaining so depth is correct whether the chained handler returns
   // or longjmps.
+  //
+  // Sanitizer-coverage note: this also means depth == 0 inside the chained
+  // handler, so DEBUG_ASSERT_NOT_IN_SIGNAL() will NOT fire for AS-unsafe
+  // code reachable from a chained handler that returns normally.  This is
+  // the lesser of two evils — leaking depth on longjmp would silently
+  // break the production deferred-refresh gate, while the sanitizer gap
+  // is bounded to third-party signal handler code we don't own.
   SIGNAL_HANDLER_GUARD();
   if (crashHandlerInternal(signo, siginfo, ucontext)) {
     return;  // Handled — destructor decrements depth
@@ -1313,14 +1324,14 @@ Error Profiler::start(Arguments &args, bool reset) {
 
   enableEngines();
 
-  // Always enable library trap to catch wasmtime loading and patch its broken sigaction
-  switchLibraryTrap(true);
-
   // Refresher must be running before the trap fires: dlopen_hook's
   // signal-context branch only marks dirty and relies on the refresher
-  // to call refresh() within ~5s.
+  // to call refresh() within REFRESH_INTERVAL_NS (500 ms).
   _libs->startRefresher();
 
+  // Always enable library trap to catch wasmtime loading and patch its broken sigaction
+  switchLibraryTrap(true);
+
   JfrMetadata::reset();
   JfrMetadata::initialize(args._context_attributes);
   _num_context_attributes = args._context_attributes.size();
 
@@ -68,3 +68,20 @@ TEST(SignalSafetyTestNoContext, NullProfiledThreadIsTreatedAsSignal) {
     EXPECT_TRUE(isInSignalContext());
     EXPECT_EQ(0, getInSignalDepth());
 }
+
+TEST(SignalSafetyTestNoContext, NullProfiledThreadIsNotTrackedSignal) {
+    // isInTrackedSignalContext() returns false on null because the
+    // SignalHandlerScope never ran — used by Profiler::dlopen_hook so
+    // uninstrumented JVM threads doing a normal dlopen take the fast
+    // (synchronous refresh) path instead of deferring.
+    EXPECT_FALSE(isInTrackedSignalContext());
+}
+
+TEST_F(SignalSafetyTest, TrackedSignalContextRequiresScope) {
+    EXPECT_FALSE(isInTrackedSignalContext());
+    {
+        SignalHandlerScope scope;
+        EXPECT_TRUE(isInTrackedSignalContext());
+    }
+    EXPECT_FALSE(isInTrackedSignalContext());
+}