diff --git a/TEST_MAPPING b/TEST_MAPPING
index 7aeb09e..9f60ae7 100644
--- a/TEST_MAPPING
+++ b/TEST_MAPPING
@@ -4,6 +4,9 @@
       "name": "CtsBionicTestCases"
     },
     {
+      "name": "fdtrack_test"
+    },
+    {
       "name": "malloc_debug_system_tests"
     },
     {
diff --git a/benchmarks/property_benchmark.cpp b/benchmarks/property_benchmark.cpp
index ba54ed1..15a621b 100644
--- a/benchmarks/property_benchmark.cpp
+++ b/benchmarks/property_benchmark.cpp
@@ -20,6 +20,7 @@
 #include <unistd.h>
 
 #include <string>
+#include <vector>
 
 #include <android-base/file.h>
 
@@ -192,4 +193,30 @@
 }
 BIONIC_BENCHMARK_WITH_ARG(BM_property_serial, "NUM_PROPS");
 
+// This benchmarks find the actual properties currently set on the system and accessible by the
+// user that runs this benchmark (aka this is best run as root).  It is not comparable between
+// devices, nor even boots, but is useful to understand the the real end-to-end speed, including
+// costs to find the correct property file within /dev/__properties__.
+static void BM_property_find_real(benchmark::State& state) {
+  std::vector<std::string> properties;
+  __system_property_foreach(
+      [](const prop_info* pi, void* cookie) {
+        __system_property_read_callback(pi,
+                                        [](void* cookie, const char* name, const char*, unsigned) {
+                                          auto properties =
+                                              reinterpret_cast<std::vector<std::string>*>(cookie);
+                                          properties->emplace_back(name);
+                                        },
+                                        cookie);
+      },
+      &properties);
+
+  while (state.KeepRunning()) {
+    for (const auto& property : properties) {
+      __system_property_find(property.c_str());
+    }
+  }
+}
+BIONIC_BENCHMARK(BM_property_find_real);
+
 #endif  // __BIONIC__
diff --git a/libc/Android.bp b/libc/Android.bp
index 040b179..84b4b12 100644
--- a/libc/Android.bp
+++ b/libc/Android.bp
@@ -1286,12 +1286,14 @@
         // The following implementations depend on pthread data or implementation,
         // so we can't include them in libc_ndk.a.
         "bionic/__cxa_thread_atexit_impl.cpp",
+        "bionic/android_unsafe_frame_pointer_chase.cpp",
         "stdlib/atexit.c",
         "bionic/fork.cpp",
     ],
 
     cppflags: ["-Wold-style-cast"],
     include_dirs: ["bionic/libstdc++/include"],
+    header_libs: ["bionic_libc_platform_headers"],
     name: "libc_pthread",
 }
 
diff --git a/libc/bionic/__libc_init_main_thread.cpp b/libc/bionic/__libc_init_main_thread.cpp
index 94cf1f8..56a8488 100644
--- a/libc/bionic/__libc_init_main_thread.cpp
+++ b/libc/bionic/__libc_init_main_thread.cpp
@@ -81,6 +81,7 @@
   __set_tls(&temp_tcb->tls_slot(0));
   main_thread.tid = __getpid();
   main_thread.set_cached_pid(main_thread.tid);
+  main_thread.stack_top = reinterpret_cast<uintptr_t>(args.argv);
 }
 
 // This code is used both by each new pthread and the code that initializes the main thread.
diff --git a/libc/bionic/android_unsafe_frame_pointer_chase.cpp b/libc/bionic/android_unsafe_frame_pointer_chase.cpp
new file mode 100644
index 0000000..0fb086e
--- /dev/null
+++ b/libc/bionic/android_unsafe_frame_pointer_chase.cpp
@@ -0,0 +1,75 @@
+/*
+ * Copyright (C) 2020 The Android Open Source Project
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+ * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
+ * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
+ * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
+ * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+ * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
+ * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include "platform/bionic/android_unsafe_frame_pointer_chase.h"
+
+#include "pthread_internal.h"
+#include "platform/bionic/mte.h"
+
+/*
+ * Implement fast stack unwinding for stack frames with frame pointers. Stores at most num_entries
+ * return addresses to buffer buf. Returns the number of available return addresses, which may be
+ * greater than num_entries.
+ *
+ * This function makes no guarantees about its behavior on encountering a frame built without frame
+ * pointers, except that it should not crash or enter an infinite loop, and that any frames prior to
+ * the frame built without frame pointers should be correct.
+ *
+ * This function is only meant to be used with memory safety tools such as sanitizers which need to
+ * take stack traces efficiently. Normal applications should use APIs such as libunwindstack or
+ * _Unwind_Backtrace.
+ */
+__attribute__((no_sanitize("address", "hwaddress"))) size_t android_unsafe_frame_pointer_chase(
+    uintptr_t* buf, size_t num_entries) {
+  // Disable MTE checks for the duration of this function, since we can't be sure that following
+  // next_frame pointers won't cause us to read from tagged memory. ASAN/HWASAN are disabled here
+  // for the same reason.
+  ScopedDisableMTE x;
+
+  struct frame_record {
+    uintptr_t next_frame, return_addr;
+  };
+
+  auto begin = reinterpret_cast<uintptr_t>(__builtin_frame_address(0));
+  uintptr_t end = __get_thread()->stack_top;
+  size_t num_frames = 0;
+  while (1) {
+    auto* frame = reinterpret_cast<frame_record*>(begin);
+    if (num_frames < num_entries) {
+      buf[num_frames] = frame->return_addr;
+    }
+    ++num_frames;
+    if (frame->next_frame < begin + sizeof(frame_record) || frame->next_frame >= end ||
+        frame->next_frame % sizeof(void*) != 0) {
+      break;
+    }
+    begin = frame->next_frame;
+  }
+
+  return num_frames;
+}
diff --git a/libc/bionic/pthread_create.cpp b/libc/bionic/pthread_create.cpp
index 4f7ac2b..d4a8bef 100644
--- a/libc/bionic/pthread_create.cpp
+++ b/libc/bionic/pthread_create.cpp
@@ -300,6 +300,7 @@
   thread->mmap_size = mapping.mmap_size;
   thread->mmap_base_unguarded = mapping.mmap_base_unguarded;
   thread->mmap_size_unguarded = mapping.mmap_size_unguarded;
+  thread->stack_top = reinterpret_cast<uintptr_t>(stack_top);
 
   *tcbp = tcb;
   *child_stack = stack_top;
diff --git a/libc/bionic/pthread_internal.h b/libc/bionic/pthread_internal.h
index 22b0558..ab8b955 100644
--- a/libc/bionic/pthread_internal.h
+++ b/libc/bionic/pthread_internal.h
@@ -125,6 +125,10 @@
   //    code to handle retries.
   void* shadow_call_stack_guard_region;
 
+  // A pointer to the top of the stack. This lets android_unsafe_frame_pointer_chase determine the
+  // top of the stack quickly, which would otherwise require special logic for the main thread.
+  uintptr_t stack_top;
+
   Lock startup_handshake_lock;
 
   void* mmap_base;
diff --git a/libc/libc.map.txt b/libc/libc.map.txt
index 2ca4b21..54da02e 100644
--- a/libc/libc.map.txt
+++ b/libc/libc.map.txt
@@ -1707,6 +1707,7 @@
     android_gethostbyaddrfornetcontext;
     android_gethostbynamefornet;
     android_gethostbynamefornetcontext;
+    android_unsafe_frame_pointer_chase;
     arc4random_addrandom; # arm x86 mips
     arc4random_stir; # arm x86 mips
     atexit; # arm
diff --git a/libc/platform/bionic/android_unsafe_frame_pointer_chase.h b/libc/platform/bionic/android_unsafe_frame_pointer_chase.h
new file mode 100644
index 0000000..2b9a32f
--- /dev/null
+++ b/libc/platform/bionic/android_unsafe_frame_pointer_chase.h
@@ -0,0 +1,47 @@
+/*
+ * Copyright (C) 2020 The Android Open Source Project
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+ * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
+ * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
+ * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
+ * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+ * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
+ * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include <stddef.h>
+#include <stdint.h>
+
+/*
+ * Implement fast stack unwinding for stack frames with frame pointers. Stores at most num_entries
+ * return addresses to buffer buf. Returns the number of available return addresses, which may be
+ * greater than num_entries.
+ *
+ * This function makes no guarantees about its behavior on encountering a frame built without frame
+ * pointers, except that it should not crash or enter an infinite loop, and that any frames prior to
+ * the frame built without frame pointers should be correct.
+ *
+ * This function is only meant to be used with memory safety tools such as sanitizers which need to
+ * take stack traces efficiently. Normal applications should use APIs such as libunwindstack or
+ * _Unwind_Backtrace.
+ */
+extern "C" size_t android_unsafe_frame_pointer_chase(uintptr_t* buf, size_t num_entries);
diff --git a/libfdtrack/Android.bp b/libfdtrack/Android.bp
index fd13512..a907d9a 100644
--- a/libfdtrack/Android.bp
+++ b/libfdtrack/Android.bp
@@ -16,3 +16,11 @@
     allow_undefined_symbols: true,
     recovery_available: true,
 }
+
+cc_test {
+    name: "fdtrack_test",
+    srcs: ["fdtrack_test.cpp"],
+    whole_static_libs: ["libBionicCtsGtestMain"],
+    static_libs: ["liblog"],
+    test_suites: ["device-tests"],
+}
diff --git a/libfdtrack/fdtrack.cpp b/libfdtrack/fdtrack.cpp
index 831a50d..b20e65e 100644
--- a/libfdtrack/fdtrack.cpp
+++ b/libfdtrack/fdtrack.cpp
@@ -27,6 +27,7 @@
  */
 
 #include <inttypes.h>
+#include <stdint.h>
 
 #include <array>
 #include <mutex>
@@ -47,6 +48,11 @@
 };
 
 extern "C" void fdtrack_dump();
+
+using fdtrack_callback_t = bool (*)(int fd, const char* const* function_names,
+                                    const uint64_t* function_offsets, size_t count, void* arg);
+extern "C" void fdtrack_iterate(fdtrack_callback_t callback, void* arg);
+
 static void fd_hook(android_fdtrack_event* event);
 
 // Backtraces for the first 4k file descriptors ought to be enough to diagnose an fd leak.
@@ -61,6 +67,10 @@
 }
 
 __attribute__((constructor)) static void ctor() {
+  for (auto& entry : stack_traces) {
+    entry.backtrace.reserve(kStackDepth);
+  }
+
   signal(BIONIC_SIGNAL_FDTRACK, [](int) { fdtrack_dump(); });
   if (Unwinder().Init()) {
     android_fdtrack_hook_t expected = nullptr;
@@ -97,15 +107,12 @@
   }
 }
 
-void fdtrack_dump() {
-  if (!installed) {
-    async_safe_format_log(ANDROID_LOG_INFO, "fdtrack", "fdtrack not installed");
-  } else {
-    async_safe_format_log(ANDROID_LOG_INFO, "fdtrack", "fdtrack dumping...");
-  }
-
+void fdtrack_iterate(fdtrack_callback_t callback, void* arg) {
   bool prev = android_fdtrack_set_enabled(false);
+
   for (int fd = 0; fd < static_cast<int>(stack_traces.size()); ++fd) {
+    const char* function_names[kStackDepth];
+    uint64_t function_offsets[kStackDepth];
     FdEntry* entry = GetFdEntry(fd);
     if (!entry) {
       continue;
@@ -117,26 +124,60 @@
     }
 
     if (entry->backtrace.empty()) {
+      entry->mutex.unlock();
+      continue;
+    } else if (entry->backtrace.size() < 2) {
+      async_safe_format_log(ANDROID_LOG_WARN, "fdtrack", "fd %d missing frames: size = %zu", fd,
+                            entry->backtrace.size());
+
+      entry->mutex.unlock();
       continue;
     }
 
-    uint64_t fdsan_owner = android_fdsan_get_owner_tag(fd);
-
-    if (fdsan_owner != 0) {
-      async_safe_format_log(ANDROID_LOG_INFO, "fdtrack", "fd %d: (owner = %#" PRIx64 ")", fd,
-                            fdsan_owner);
-    } else {
-      async_safe_format_log(ANDROID_LOG_INFO, "fdtrack", "fd %d: (unowned)", fd);
-    }
-
-    const size_t frame_skip = 2;
+    constexpr size_t frame_skip = 2;
     for (size_t i = frame_skip; i < entry->backtrace.size(); ++i) {
-      auto& frame = entry->backtrace[i];
-      async_safe_format_log(ANDROID_LOG_INFO, "fdtrack", "  %zu: %s+%" PRIu64, i - frame_skip,
-                            frame.function_name.c_str(), frame.function_offset);
+      size_t j = i - frame_skip;
+      function_names[j] = entry->backtrace[i].function_name.c_str();
+      function_offsets[j] = entry->backtrace[i].function_offset;
     }
 
+    bool should_continue =
+        callback(fd, function_names, function_offsets, entry->backtrace.size() - frame_skip, arg);
+
     entry->mutex.unlock();
+
+    if (!should_continue) {
+      break;
+    }
   }
+
   android_fdtrack_set_enabled(prev);
 }
+
+void fdtrack_dump() {
+  if (!installed) {
+    async_safe_format_log(ANDROID_LOG_INFO, "fdtrack", "fdtrack not installed");
+  } else {
+    async_safe_format_log(ANDROID_LOG_INFO, "fdtrack", "fdtrack dumping...");
+  }
+
+  fdtrack_iterate(
+      [](int fd, const char* const* function_names, const uint64_t* function_offsets, size_t count,
+         void*) {
+        uint64_t fdsan_owner = android_fdsan_get_owner_tag(fd);
+        if (fdsan_owner != 0) {
+          async_safe_format_log(ANDROID_LOG_INFO, "fdtrack", "fd %d: (owner = %#" PRIx64 ")", fd,
+                                fdsan_owner);
+        } else {
+          async_safe_format_log(ANDROID_LOG_INFO, "fdtrack", "fd %d: (unowned)", fd);
+        }
+
+        for (size_t i = 0; i < count; ++i) {
+          async_safe_format_log(ANDROID_LOG_INFO, "fdtrack", "  %zu: %s+%" PRIu64, i,
+                                function_names[i], function_offsets[i]);
+        }
+
+        return true;
+      },
+      nullptr);
+}
diff --git a/libfdtrack/fdtrack_test.cpp b/libfdtrack/fdtrack_test.cpp
new file mode 100644
index 0000000..0edf0b8
--- /dev/null
+++ b/libfdtrack/fdtrack_test.cpp
@@ -0,0 +1,111 @@
+/*
+ * Copyright (C) 2020 The Android Open Source Project
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+ * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
+ * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
+ * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
+ * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+ * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
+ * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include <dlfcn.h>
+#include <err.h>
+#include <fcntl.h>
+#include <stdio.h>
+#include <unistd.h>
+
+#include <map>
+#include <vector>
+
+#include <gtest/gtest.h>
+
+struct FdtrackFrame {
+  const char* function_name;
+  uint64_t function_offset;
+};
+
+std::map<int, std::vector<FdtrackFrame>> RunFdtrack(std::function<void()> f) {
+  void* libfdtrack = dlopen("libfdtrack.so", RTLD_NOW);
+  if (!libfdtrack) {
+    errx(1, "failed to dlopen libfdtrack.so: %s", dlerror());
+  }
+
+  using fdtrack_callback_t = bool (*)(int fd, const char* const* function_names,
+                                      const uint64_t* function_offsets, size_t count, void* arg);
+  auto fdtrack_iterate = reinterpret_cast<void (*)(fdtrack_callback_t, void* arg)>(
+      dlsym(libfdtrack, "fdtrack_iterate"));
+  if (!fdtrack_iterate) {
+    errx(1, "failed to dlsym fdtrack_iterate");
+  }
+
+  f();
+
+  std::map<int, std::vector<FdtrackFrame>> result;
+  fdtrack_iterate(
+      [](int fd, const char* const* function_names, const uint64_t* function_offsets, size_t count,
+         void* arg) {
+        auto& map = *static_cast<decltype(result)*>(arg);
+        for (size_t i = 0; i < count; ++i) {
+          map[fd].push_back(FdtrackFrame{
+              .function_name = function_names[i],
+              .function_offset = function_offsets[i],
+          });
+        }
+
+        return true;
+      },
+      &result);
+
+  return result;
+}
+
+TEST(fdtrack, open) {
+  static int fd = -1;
+  auto result = RunFdtrack([]() { fd = open("/dev/null", O_RDONLY | O_CLOEXEC); });
+
+  ASSERT_NE(-1, fd);
+  ASSERT_EQ(1, result.size());
+  ASSERT_EQ(fd, result.begin()->first);
+  ASSERT_NE(nullptr, strstr(result.begin()->second.at(0).function_name, "open"));
+}
+
+TEST(fdtrack, close) {
+  static int fd1 = -1;
+  static int fd2 = -1;
+  static int fd3 = -1;
+  auto result = RunFdtrack([]() {
+    fd1 = open("/dev/null", O_RDONLY | O_CLOEXEC);
+    fd2 = open("/dev/null", O_RDONLY | O_CLOEXEC);
+    fd3 = open("/dev/null", O_RDONLY | O_CLOEXEC);
+    close(fd2);
+  });
+
+  ASSERT_NE(-1, fd1);
+  ASSERT_NE(-1, fd2);
+  ASSERT_NE(-1, fd3);
+
+  ASSERT_EQ(2, result.size());
+  ASSERT_EQ(1, result.count(fd1));
+  ASSERT_EQ(1, result.count(fd3));
+
+  ASSERT_NE(nullptr, strstr(result[fd1].at(0).function_name, "open"));
+  ASSERT_NE(nullptr, strstr(result[fd3].at(0).function_name, "open"));
+}
diff --git a/libfdtrack/libfdtrack.map.txt b/libfdtrack/libfdtrack.map.txt
index 7a54c35..7a23954 100644
--- a/libfdtrack/libfdtrack.map.txt
+++ b/libfdtrack/libfdtrack.map.txt
@@ -1,6 +1,7 @@
 LIBFDTRACK {
   global:
     fdtrack_dump;
+    fdtrack_iterate;
   local:
     *;
 };
diff --git a/tests/Android.bp b/tests/Android.bp
index e530132..cb275a2 100644
--- a/tests/Android.bp
+++ b/tests/Android.bp
@@ -295,6 +295,20 @@
     },
 }
 
+cc_test_library {
+    name: "libBionicFramePointerTests",
+    defaults: ["bionic_tests_defaults"],
+    srcs: [
+        "android_unsafe_frame_pointer_chase_test.cpp",
+    ],
+    include_dirs: [
+        "bionic/libc",
+    ],
+    cflags: [
+        "-fno-omit-frame-pointer",
+    ],
+}
+
 // -----------------------------------------------------------------------------
 // Fortify tests.
 // -----------------------------------------------------------------------------
@@ -444,6 +458,7 @@
     whole_static_libs: [
         "libBionicStandardTests",
         "libBionicElfTlsTests",
+        "libBionicFramePointerTests",
         "libfortify1-tests-clang",
         "libfortify1-new-tests-clang",
         "libfortify2-tests-clang",
diff --git a/tests/android_unsafe_frame_pointer_chase_test.cpp b/tests/android_unsafe_frame_pointer_chase_test.cpp
new file mode 100644
index 0000000..dd04c33
--- /dev/null
+++ b/tests/android_unsafe_frame_pointer_chase_test.cpp
@@ -0,0 +1,98 @@
+/*
+ * Copyright (C) 2020 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <gtest/gtest.h>
+
+#if defined(__BIONIC__)
+
+#include "platform/bionic/android_unsafe_frame_pointer_chase.h"
+
+// Prevent tail calls inside recurse.
+__attribute__((weak, noinline)) size_t nop(size_t val) {
+  return val;
+}
+
+// Call android_unsafe_frame_pointer_chase inside count recurse stack frames.
+__attribute__((weak, noinline)) int recurse(int count, uintptr_t* buf, size_t num_entries) {
+  if (count != 0) return nop(recurse(count - 1, buf, num_entries));
+  return nop(android_unsafe_frame_pointer_chase(buf, num_entries));
+}
+
+static constexpr size_t kNumFrames = 32;
+
+static bool CheckFrames(uintptr_t* frames, size_t num_frames) {
+  // We expect one recurse frame calling android_unsafe_frame_pointer_chase, followed by kNumFrames identical
+  // recurse frames calling themselves, followed by at least one frame (the first caller of
+  // recurse).
+  if (num_frames < kNumFrames + 2) {
+    printf("num_frames (0x%zu) < kNumFrames + 2", num_frames);
+    return false;
+  }
+
+  if (frames[0] == frames[1]) {
+    printf("frames[0] == frames[1] (0x%zx)", frames[0]);
+    return false;
+  }
+
+  for (size_t i = 2; i <= kNumFrames; ++i) {
+    if (frames[i] != frames[1]) {
+      printf("frames[i] (0x%zx) != frames[1] (0x%zx)", frames[i], frames[1]);
+      return false;
+    }
+  }
+
+  if (frames[kNumFrames] == frames[kNumFrames + 1]) {
+    printf("frames[kNumFrames] == frames[kNumFrames + 1] (0x%zx)", frames[kNumFrames]);
+    return false;
+  }
+
+  return true;
+}
+
+TEST(android_unsafe_frame_pointer_chase, main_thread) {
+  size_t size = recurse(kNumFrames, 0, 0);
+
+  uintptr_t frames[kNumFrames + 2];
+  size_t size2 = recurse(kNumFrames, frames, kNumFrames + 2);
+  EXPECT_EQ(size2, size);
+
+  EXPECT_TRUE(CheckFrames(frames, size));
+}
+
+static void *BacktraceThread(void *) {
+  size_t size = recurse(kNumFrames, 0, 0);
+
+  uintptr_t frames[kNumFrames + 2];
+  size_t size2 = recurse(kNumFrames, frames, kNumFrames + 2);
+  if (size2 != size) {
+    return (void*)"size2 != size";
+  }
+
+  if (!CheckFrames(frames, size)) {
+    return (void*)"CheckFrames failed";
+  }
+  return nullptr;
+}
+
+TEST(android_unsafe_frame_pointer_chase, pthread) {
+  pthread_t t;
+  ASSERT_EQ(0, pthread_create(&t, nullptr, BacktraceThread, nullptr));
+  void* retval;
+  ASSERT_EQ(0, pthread_join(t, &retval));
+  EXPECT_EQ(nullptr, reinterpret_cast<char*>(retval));
+}
+
+#endif // __BIONIC__