The problem is an assymetry between nmethod::oops_do and nmethod::do_unloading. In do_unloading we've got some magic where if the weak reference for the InstalledCode referring to an nmethod is cleared then we cause the nmethod to be unloaded, even though nothing about the current class unloading is related to this nmethod. But there's no matching logic on the oops_do side which would keep the nmethod alive so even if we visit this nmethod during the stack walk, if the weak reference is cleared then we allow it to be unloaded while there's a live frame. There isn't actually any logic we could put into the oops_do to make this work correctly because the weak reference has already been cleared at this point so there's nothing to mark.