Merge branch 'main' into zgu/thread_exit_cleanup

Author: jbachorik

.github/PULL_REQUEST_TEMPLATE.md

@@ -17,7 +17,9 @@ unless the change does not modify code (e.g. only modifies docs, comments).
 
 **For Datadog employees**:
 - [ ] If this PR touches code that signs or publishes builds or packages, or handles
-  credentials of any kind, I've requested a review from `@DataDog/security-design-and-guidance`.
+  credentials of any kind, I've requested a security review (run the `dd:platform-security-review`
+  skill, or file a request via the [PSEC review form](https://datadoghq.atlassian.net/jira/software/c/projects/PSEC/forms/form/direct/7861446195161534/37715)).
+  `bewaire` also runs automatically on every PR.
 - [ ] This PR doesn't touch any of that.
 - [ ] JIRA: [JIRA-XXXX]
 

.github/chainguard/async-profiler-build.ci.sts.yaml

@@ -6,4 +6,7 @@ subject_pattern: "project_path:DataDog/java-profiler:ref_type:branch:ref:.*"
 permissions:
   contents: write
   issues: write
-  pull_requests: read
+  # write (not read) is required to post comments on pull requests via the
+  # issues/comments endpoint — GitLab CI back-reports benchmark & reliability
+  # results to the PR (see .gitlab/scripts/upsert-github-pr-comment.sh).
+  pull_requests: write

.github/workflows/test_workflow.yml

@@ -191,6 +191,13 @@ jobs:
           name: signal-safety-violation-glibc-${{ matrix.java_version }}-${{ matrix.config }}-amd64
           path: /tmp/signal-safety-violation.txt
           if-no-files-found: ignore
+      - name: Upload ASan logs
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        if: failure() && matrix.config == 'asan'
+        with:
+          name: asan-logs-glibc-${{ matrix.java_version }}-amd64
+          path: /tmp/asan.log.*
+          if-no-files-found: ignore
 
   test-linux-musl-amd64:
     needs: [cache-jdks, filter-musl-configs]
@@ -317,6 +324,13 @@ jobs:
           name: signal-safety-violation-musl-${{ matrix.java_version }}-${{ matrix.config }}-amd64
           path: /tmp/signal-safety-violation.txt
           if-no-files-found: ignore
+      - name: Upload ASan logs
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        if: failure() && matrix.config == 'asan'
+        with:
+          name: asan-logs-musl-${{ matrix.java_version }}-amd64
+          path: /tmp/asan.log.*
+          if-no-files-found: ignore
 
   test-linux-glibc-aarch64:
     needs: cache-jdks
@@ -495,6 +509,13 @@ jobs:
           name: signal-safety-violation-glibc-${{ matrix.java_version }}-${{ matrix.config }}-aarch64
           path: /tmp/signal-safety-violation.txt
           if-no-files-found: ignore
+      - name: Upload ASan logs
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        if: failure() && matrix.config == 'asan'
+        with:
+          name: asan-logs-glibc-${{ matrix.java_version }}-aarch64
+          path: /tmp/asan.log.*
+          if-no-files-found: ignore
 
   test-linux-musl-aarch64:
      needs: [cache-jdks, filter-musl-configs]
@@ -599,3 +620,10 @@ jobs:
            name: signal-safety-violation-musl-${{ matrix.java_version }}-${{ matrix.config }}-aarch64
            path: /tmp/signal-safety-violation.txt
            if-no-files-found: ignore
+       - name: Upload ASan logs
+         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+         if: failure() && matrix.config == 'asan'
+         with:
+           name: asan-logs-musl-${{ matrix.java_version }}-aarch64
+           path: /tmp/asan.log.*
+           if-no-files-found: ignore

build-logic/conventions/src/main/kotlin/com/datadoghq/native/config/ConfigurationPresets.kt

@@ -211,10 +211,22 @@ object ConfigurationPresets {
                 if (libasan != null) {
                     config.testEnvironment.apply {
                         put("LD_PRELOAD", libasan)
-                        put("ASAN_OPTIONS", "allocator_may_return_null=1:unwind_abort_on_malloc=1:use_sigaltstack=0:detect_stack_use_after_return=0:handle_segv=0:halt_on_error=0:abort_on_error=0:print_stacktrace=1:symbolize=1:suppressions=$rootDir/gradle/sanitizers/asan.supp")
+                        put("ASAN_OPTIONS", "allocator_may_return_null=1:unwind_abort_on_malloc=1:use_sigaltstack=0:detect_stack_use_after_return=0:handle_segv=0:halt_on_error=0:abort_on_error=0:print_stacktrace=1:symbolize=1:log_path=/tmp/asan.log:suppressions=$rootDir/gradle/sanitizers/asan.supp")
                         put("UBSAN_OPTIONS", "halt_on_error=0:abort_on_error=0:print_stacktrace=1:suppressions=$rootDir/gradle/sanitizers/ubsan.supp")
                         put("LSAN_OPTIONS", "detect_leaks=0")
                     }
+                    // JDK 25's G1GC reserves heap virtual address space starting just below 2 GB
+                    // (0x7fff7000), which is exactly where ASan needs to mmap its shadow bytes
+                    // [0x7fff7000-0x10007fff7fff].  Force the heap to a very low base address so
+                    // the entire JVM footprint (heap + class space + code cache) stays well below
+                    // the shadow range and the two regions no longer conflict.
+                    if (PlatformUtils.testJvmMajorVersion() >= 25) {
+                        config.testJvmArgs.addAll(listOf(
+                            "-XX:HeapBaseMinAddress=0x4000000",
+                            "-Xmx512m",
+                            "-XX:CompressedClassSpaceSize=256m"
+                        ))
+                    }
                 }
             }
             Platform.MACOS -> {

build-logic/conventions/src/main/kotlin/com/datadoghq/native/model/BuildConfiguration.kt

@@ -15,6 +15,7 @@ abstract class BuildConfiguration @Inject constructor(
     abstract val compilerArgs: ListProperty<String>
     abstract val linkerArgs: ListProperty<String>
     abstract val testEnvironment: MapProperty<String, String>
+    abstract val testJvmArgs: ListProperty<String>
     abstract val active: Property<Boolean>
 
     override fun getName(): String = configName
@@ -23,6 +24,7 @@ abstract class BuildConfiguration @Inject constructor(
         // Default to active unless overridden
         active.convention(true)
         testEnvironment.convention(emptyMap())
+        testJvmArgs.convention(emptyList())
     }
 
     fun isActiveFor(targetPlatform: Platform, targetArch: Architecture): Boolean {

build-logic/conventions/src/main/kotlin/com/datadoghq/native/util/PlatformUtils.kt

@@ -367,4 +367,24 @@ object PlatformUtils {
             false
         }
     }
+
+    /**
+     * Returns the major version of the test JVM (e.g. 8, 11, 17, 21, 25).
+     * Returns 0 if the version cannot be determined.
+     */
+    fun testJvmMajorVersion(): Int {
+        val javaHome = testJavaHome()
+        return try {
+            val process = ProcessBuilder("$javaHome/bin/java", "-version")
+                .redirectErrorStream(true)
+                .start()
+            val output = process.inputStream.bufferedReader().readText()
+            process.waitFor(10, TimeUnit.SECONDS)
+            // version line: java version "1.8.0_xxx" or java version "21.0.x" etc.
+            val match = Regex("""version "(?:1\.)?(\d+)""").find(output)
+            match?.groupValues?.get(1)?.toIntOrNull() ?: 0
+        } catch (_: Exception) {
+            0
+        }
+    }
 }

build-logic/conventions/src/main/kotlin/com/datadoghq/profiler/ProfilerTestPlugin.kt

@@ -111,6 +111,7 @@ class ProfilerTestPlugin : Plugin<Project> {
         val testClasspath: FileCollection,
         val standardJvmArgs: List<String>,
         val extraJvmArgs: List<String>,
+        val configJvmArgs: List<String>,
         val systemProperties: Map<String, String>,
         val environmentVariables: Map<String, String>
     )
@@ -164,6 +165,7 @@ class ProfilerTestPlugin : Plugin<Project> {
             testClasspath = testClasspath,
             standardJvmArgs = extension.standardJvmArgs.get(),
             extraJvmArgs = extension.extraJvmArgs.get(),
+            configJvmArgs = config.testJvmArgs.get(),
             systemProperties = systemProps,
             environmentVariables = envVars
         )
@@ -247,6 +249,7 @@ class ProfilerTestPlugin : Plugin<Project> {
                 }
 
                 allArgs.addAll(testConfig.extraJvmArgs)
+                allArgs.addAll(testConfig.configJvmArgs)
                 testTask.jvmArgs(allArgs)
             }
 
@@ -303,6 +306,7 @@ class ProfilerTestPlugin : Plugin<Project> {
                     allArgs.add("-Djava.library.path=${extension.nativeLibDir.get().asFile.absolutePath}")
                 }
                 allArgs.addAll(testConfig.extraJvmArgs)
+                allArgs.addAll(testConfig.configJvmArgs)
 
                 // System properties
                 testConfig.systemProperties.forEach { (key, value) ->

ddprof-lib/src/main/cpp/buffers.h

@@ -80,6 +80,7 @@ class Buffer {
     _data[_offset++] = v;
   }
 
+  __attribute__((no_sanitize("undefined")))
   __attribute__((no_sanitize("bounds")))
   void put16(short v) {
     assert(_offset + 2 < limit());

ddprof-lib/src/main/cpp/callTraceStorage.h

@@ -34,7 +34,7 @@ class CallTraceStorage {
     // Reserved trace ID for dropped samples due to contention
     // Real trace IDs are generated as (instance_id << 32) | slot, where instance_id starts from 1
     // Any ID with 0 in upper 32 bits is guaranteed to not clash with real trace IDs
-    static const u64 DROPPED_TRACE_ID = 1ULL;
+    static constexpr u64 DROPPED_TRACE_ID = 1ULL;
 
     // Static dropped trace object that appears in JFR constant pool
     static CallTrace* getDroppedTrace();

ddprof-lib/src/main/cpp/context_api.cpp

@@ -18,15 +18,10 @@
 #include "context.h"
 #include "guards.h"
 #include "otel_context.h"
-#include "otel_process_ctx.h"
 #include "profiler.h"
 #include "thread.h"
 #include <cstring>
 
-// Reserved attribute index for local root span ID in OTEL attrs_data.
-// Only used within this translation unit; not part of the public ContextApi header.
-static const uint8_t LOCAL_ROOT_SPAN_ATTR_INDEX = 0;
-
 /**
  * Initialize context TLS for the current thread on first use.
  * Must be called with signals blocked to prevent musl TLS deadlock:
@@ -71,55 +66,3 @@ Context ContextApi::snapshot() {
     size_t numAttrs = Profiler::instance()->numContextAttributes();
     return thrd->snapshotContext(numAttrs);
 }
-
-void ContextApi::registerAttributeKeys(const char** keys, int count) {
-    // Clip to DD_TAGS_CAPACITY: that is the actual sidecar slot limit and the
-    // maximum keyIndex accepted by ThreadContext.setContextAttribute.
-    int n = count < (int)DD_TAGS_CAPACITY ? count : (int)DD_TAGS_CAPACITY;
-
-    // Build NULL-terminated key array for the process context config.
-    // Index LOCAL_ROOT_SPAN_ATTR_INDEX (0) is reserved for local_root_span_id; user keys start at index 1.
-    // otel_process_ctx_publish copies all strings, so no strdup is needed.
-    const char* key_ptrs[DD_TAGS_CAPACITY + 2]; // +1 reserved, +1 null
-    key_ptrs[LOCAL_ROOT_SPAN_ATTR_INDEX] = "datadog.local_root_span_id";
-    for (int i = 0; i < n; i++) {
-        key_ptrs[i + 1] = keys[i];
-    }
-    key_ptrs[n + 1] = nullptr;
-
-    otel_thread_ctx_config_data config = {
-        .schema_version = "tlsdesc_v1_dev",
-        .attribute_key_map = key_ptrs,
-    };
-
-#ifndef OTEL_PROCESS_CTX_NO_READ
-    otel_process_ctx_read_result read_result = otel_process_ctx_read();
-    if (read_result.success) {
-        otel_process_ctx_data data = {
-            .deployment_environment_name = read_result.data.deployment_environment_name,
-            .service_instance_id = read_result.data.service_instance_id,
-            .service_name = read_result.data.service_name,
-            .service_version = read_result.data.service_version,
-            .telemetry_sdk_language = read_result.data.telemetry_sdk_language,
-            .telemetry_sdk_version = read_result.data.telemetry_sdk_version,
-            .telemetry_sdk_name = read_result.data.telemetry_sdk_name,
-            .resource_attributes = read_result.data.resource_attributes,
-            .extra_attributes = read_result.data.extra_attributes,
-            .thread_ctx_config = &config,
-        };
-
-        otel_process_ctx_publish(&data);
-        otel_process_ctx_read_drop(&read_result);
-    }
-#endif
-}
-
-void ContextApi::registerAttributeKeys(const std::vector<std::string>& keys) {
-    // Clip to DD_TAGS_CAPACITY before materializing C string pointers.
-    size_t n = keys.size() < DD_TAGS_CAPACITY ? keys.size() : DD_TAGS_CAPACITY;
-    const char* key_ptrs[DD_TAGS_CAPACITY];
-    for (size_t i = 0; i < n; i++) {
-        key_ptrs[i] = keys[i].c_str();
-    }
-    registerAttributeKeys(key_ptrs, (int)n);
-}