fix(profiler): lock-free class/endpoint/context maps via StringDictionary

[jbachorik]

What does this PR do?:

Replaces the SpinLock-guarded Dictionary instances for _class_map, _string_label_map, and _context_value_map with a new StringDictionary that eliminates all locking from the read/write fast paths.

StringDictionary holds three StringDictionaryBuffer instances (_a, _b, _c) cycling through three roles via TripleBufferRotator<StringDictionaryBuffer>:

• active — receives new writes (signal handlers + JNI threads), lock-free via CAS
• dump — stable snapshot being read by the dump/stop thread after rotate()
• scratch (clearTarget()) — two rotations behind; safe to clear by clearStandby()

_next_id is a global monotonic counter starting at 1; it is never reset between rotations, so every key gets a globally stable id for the lifetime of a profiler session.

rotate() — two-phase ID-preserving rotation (called under SignalBlocker via rotateDictsAndRun()):

sequenceDiagram
participant Caller
participant clearTarget as clearTarget (scratch)
participant old_active as old_active (→ dump)
participant new_active as new_active (← scratch)
Caller->>clearTarget: Phase 1: copyFrom(*old_active)
Caller->>Caller: _rot.rotate()
Note over Caller: old active → dump, scratch → active, old dump → scratch
Caller->>old_active: waitForRefCountToClear(old_active)
Note over Caller,old_active: drain any JNI thread mid-lookup on old active
Caller->>new_active: Phase 2: copyFrom(*old_active)
Note over Caller,new_active: catch entries inserted between Phase 1 and drain

Loading

lookupDuringDump(key) — called during jfr.dump() to resolve a key that may have arrived after rotate(). Probes dump buffer first, then active; inserts into both on a miss so the dump chunk contains the id.

clearAll() — called by Profiler::start(reset=true). Sets _accepting=false (prevents new RefCountGuard creation), drains all in-flight guards via RefCountGuard::waitForAllRefCountsToClear(), clears all three buffers, resets _rot, resets _next_id to 1.

bounded_lookup(key, len) (no size_limit) — signal-safe read-only probe of active; returns 0 on miss without inserting.

rotateDictsAndRun(action) — new Profiler helper that wraps dump/stop operations:

sequenceDiagram
participant Caller
participant Dicts as StringDictionary ×3
participant Locks as lockAll / unlockAll
Caller->>Caller: acquire SignalBlocker
Caller->>Dicts: rotate() each dictionary
Caller->>Locks: lockAll()
Caller->>Caller: run action (e.g. jfr.dump())
Caller->>Locks: unlockAll()
Caller->>Dicts: clearStandby() each dictionary

Loading

RefCountGuard — extracted from CallTraceStorage into its own refCountGuard.h/cpp. RefCountSlot now carries an outer_stack[OUTER_STACK_DEPTH=3] array to keep all displaced outer guards' buffers visible to waitForRefCountToClear during nested signal delivery (up to 3 reentrant levels). waitForAllRefCountsToClear() gains a timeout warning log when the drain exceeds ~500ms.

libraryPatcher_linux.cpp — adds run_with_musl_cleanup() (__attribute__((noinline, no_stack_protector))) to host the pthread_cleanup_push/pop pair in its own frame, keeping struct __ptcb out of start_routine_wrapper_spec's DEOPT-corruption zone on musl/aarch64/JDK11.

ASAN build fix (ConfigurationPresets.kt, PlatformUtils.kt) — locateLibasan() now returns libclang_rt.asan-<arch>.so when the compiler is clang (falling back to GCC's libasan otherwise). configureAsan derives the -l flag and adds -Wl,-rpath from the located library. Fixes "incompatible ASan runtimes" crash (caused by two different ASan runtimes — clang's from -fsanitize=address and GCC's from explicit -lasan — landing in the binary's NEEDED entries simultaneously).

Removed:

• classMapTrySharedGuard() / tryLockSharedBounded() / BoundedOptionalSharedLockGuard (bounded-CAS shared-lock primitives no longer needed)
• dictionary_concurrent_ut.cpp and spinlock_bounded_ut.cpp (tests for removed locking primitives)
• Profiler::flushJfr() (inlined into rotateDictsAndRun)

Note: _class_map_lock and classMapSharedGuard() are intentionally retained — writeClasses (PR #527 vtable resolver) still acquires a shared guard around class-map reads during dump.

Motivation:

Three production crashes (PROF-14583, fingerprint v10.DAECC680F0728EAB44F26DB0B91B703F, 2026-05-06 to 2026-05-08) showed SIGSEGV in std::_Rb_tree_increment via Recording::writeCpool → Recording::writeClasses → Dictionary::collect, caused by a race between writeClasses and concurrent Dictionary::clear().

PR #516 patched this with a shared-lock, but that introduced tryLockSharedBounded(5) in the signal-handler path (walkVM). Under heavy 100 µs wall-clock load on aarch64 the bounded CAS retries were consistently exhausted, causing class lookups to return -1 and corrupting JFR recordings.

Supersedes PR #522.

Root Cause:

ebdcbc76 (Jan 20, 2026) — structural bug: During CPU/wall-clock profiling, walkVM() runs in a SIGPROF/SIGVTALRM signal handler. When it encounters a vtable stub frame (megamorphic virtual call), it resolves the dispatch receiver's class via classMap()->lookup() and records it as a synthetic BCI_ALLOC-tagged frame. That lookup() can insert into the old Dictionary's std::map — without holding _class_map_lock — while the dump thread's writeClasses concurrently iterates the same map via Dictionary::collect(). Concurrent insert + iteration corrupts the red-black tree → std::_Rb_tree_increment crash.

The trigger is CPU or wall-clock profiling being active on code with megamorphic virtual calls (vtable stubs). No allocation or native-malloc profiling is required.

Additional Notes:

• clearStandby() is safe without any explicit drain because the scratch buffer (clearTarget()) is two full rotations behind active — its RefCountGuard drain was completed by the previous rotate() call, and _state_lock serializes all JFR operations so no new cycle starts before clearStandby() runs.
• At most two non-empty buffers exist at any time (active + dump).
• walkVM's vtable-stub class resolution remains best-effort; a proper fix via JVMTI ClassPrepare pre-population is left to a follow-up.

How to test the change?:

• :ddprof-lib:gtestDebug_stringDictionary_ut — rotation, RefCountGuard, concurrent writer safety
• :ddprof-lib:gtest (stress target stress_stringDictionary) — concurrent insert/lookup/rotate stress
• DictionaryRotationTest (Java) — counter reset after clearStandby; correct counts after fill-path inserts
• BoundMethodHandleProfilerTest (Java) — profiling smoke test for bound method handles
• EndpointTest (Java) — endpoint label dictionary correctness under stop/start cycles

For Datadog employees:

• If this PR touches code that signs or publishes builds or packages, or handles
  credentials of any kind, I've requested a review from @DataDog/security-design-and-guidance.
• This PR doesn't touch any of that.
• JIRA: PROF-14583

[dd-octo-sts]

CI Test Results

Run:#28552199969 | Commit:4847685 | Duration: 0s (longest job)

✅ All 0 test jobs passed

Summary: Total: 0 | Passed: 0 | Failed: 0

---

Updated: 2026-07-01 22:39:57 UTC

[jbachorik]

@codex review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit:66451207c3

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[Copilot]

Pull request overview

Replaces the SpinLock-guarded Dictionary instances (_class_map, _string_label_map, _context_value_map) with a new TripleBufferedDictionary that rotates three Dictionary buffers (active / dump / scratch) under a generic TripleBufferRotator<T> template. Writes go to the active buffer lock-free; the dump thread reads standby() after rotate()/rotatePersistent() drains in-flight readers via RefCountGuard. The previous bounded shared-lock primitives in spinLock.h and the related classMap*Guard() factory methods are removed, and RefCountGuard is generalised (extracted to refCountGuard.h) to operate on void* so it can protect dictionaries as well as call-trace tables.

Changes:

• New TripleBufferRotator<T> + TripleBufferedDictionary (with rotate, rotatePersistent, clearStandby, clearAll) and a new Dictionary::mergeFrom used by rotatePersistent.
• Generalised RefCountGuard to void* and extracted it from callTraceStorage.h into refCountGuard.h; removed tryLockSharedBounded / BoundedOptionalSharedLockGuard and the _class_map_lock member.
• Wired Profiler::dump/stop/start to rotate / clearStandby / clearAll, switched flightRecorder.cpp and hotspotSupport.cpp to read standby() / call bounded_lookup() directly without locking, replaced old gtest suites with a new dictionary_ut.cpp, added a Java DictionaryRotationTest, and disabled ContendedCallTraceStorageTest on musl/aarch64.

Reviewed changes

Copilot reviewed 18 out of 18 changed files in this pull request and generated 15 comments.

Show a summary per file

File	Description
ddprof-lib/src/main/cpp/tripleBuffer.h	New generic 3-buffer rotator with atomic CAS rotate.
ddprof-lib/src/main/cpp/refCountGuard.h	New header extracting RefCountGuard/RefCountSlot and generalising active_ptr to void*.
ddprof-lib/src/main/cpp/dictionary.h	Adds TripleBufferedDictionary, Dictionary::mergeFrom, counterId(), size() accessors.
ddprof-lib/src/main/cpp/dictionary.cpp	Implements mergeFrom (recursive re-insert via lookup).
ddprof-lib/src/main/cpp/spinLock.h	Removes tryLockSharedBounded and BoundedOptionalSharedLockGuard.
ddprof-lib/src/main/cpp/profiler.h	Replaces Dictionary members with TripleBufferedDictionary; drops _class_map_lock + guard factories.
ddprof-lib/src/main/cpp/profiler.cpp	Switches start/stop/dump/lookupClass to triple-buffer ops; removes shared-lock dance.
ddprof-lib/src/main/cpp/flightRecorder.cpp	writeCpool/writeClasses now read standby() snapshot without lock.
ddprof-lib/src/main/cpp/hotspot/hotspotSupport.cpp	Removes classMapTrySharedGuard; uses bounded_lookup directly in vtable-stub path.
ddprof-lib/src/main/cpp/callTraceStorage.h/.cpp	Removes the inline RefCountGuard definitions and updates the impl to void* resource.
ddprof-lib/src/test/cpp/dictionary_ut.cpp	New gtest covering rotate / clearStandby / merge / counter id / concurrent writes.
ddprof-lib/src/test/cpp/dictionary_concurrent_ut.cpp	Removed (covered the old shared-lock contract).
ddprof-lib/src/test/cpp/spinlock_bounded_ut.cpp	Removed alongside the deleted bounded shared-lock primitive.
ddprof-test/.../DictionaryRotationTest.java	New Java test asserting pre/post-dump separation and counter recalibration.
ddprof-test/.../BoundMethodHandleMetadataSizeTest.java	Drops the (now unused) counter-size assertion.
ddprof-test/.../ContendedCallTraceStorageTest.java	Skips on musl/aarch64 due to a separately tracked native bug.
AGENTS.md	Adds musl/aarch64/JDK11 frame-corruption rule for start_routine_wrapper_spec.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[jbachorik]

@codex review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit:9f8f6fc8c8

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[Copilot]

Pull request overview

Copilot reviewed 34 out of 34 changed files in this pull request and generated 4 comments.

Comments suppressed due to low confidence (1)

ddprof-test/src/test/java/com/datadoghq/profiler/memleak/WriteStackTracesAfterClassUnloadTest.java:126

• This test bypasses stopProfiler() from AbstractProfilerTest (which sets the stopped flag and prevents the @AfterEach hook from calling profiler.stop() again). After this finally block runs profiler.stop(), the base-class teardown will call stop() a second time on an already-stopped profiler. Other tests that drive the profiler manually (e.g. CleanupAfterClassUnloadTest) wrap the redundant stop in try { ... } catch (Exception ignored) {}; this test does not, so any exception from the double-stop will surface as a test failure even though the actual scenario succeeded. Consider routing through stopProfiler() or setting the equivalent guard.

[jbachorik]

@codex review

[Copilot]

Pull request overview

Copilot reviewed 28 out of 29 changed files in this pull request and generated 3 comments.

[Copilot]

Pull request overview

Copilot reviewed 31 out of 32 changed files in this pull request and generated 3 comments.

[Copilot]

Pull request overview

Copilot reviewed 31 out of 32 changed files in this pull request and generated 3 comments.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit:0995390da6

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[jbachorik]

@copilot resolve the merge conflicts in this pull request

[Copilot]

@copilot resolve the merge conflicts in this pull request

Resolved the merge conflicts by merging origin/main into this branch and fixing the conflict in ddprof-lib/src/main/cpp/profiler.cpp while preserving the current PR behavior. Addressed in commit 26f041be.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• groovy.jfrog.io
  • Triggering command: /usr/lib/jvm/temurin-17-jdk-amd64/bin/java /usr/lib/jvm/temurin-17-jdk-amd64/bin/java --add-opens=java.base/java.lang=ALL-UNNAMED --add-opens=java.base/java.lang.invoke=ALL-UNNAMED --add-opens=java.base/java.util=ALL-UNNAMED --add-opens=java.prefs/java.util.prefs=ALL-UNNAMED --add-exports=jdk.compiler/com.sun.tools.javac.api=ALL-UNNAMED --add-exports=jdk.compiler/com.sun.tools.javac.util=ALL-UNNAMED --add-opens=java.base/java.nio.charset=ALL-UNNAMED --add-opens=java.base/java.net=ALL-UNNAMED --add-opens=java.base/java.util.concurrent=ALL-UNNAMED --add-opens=java.base/java.util.concurrent.atomic=ALL-UNNAMED --add-opens=java.xml/javax.xml.namespace=ALL-UNNAMED --add-opens=java.base/java.time=ALL-UNNAMED -XX:MaxMetaspaceSize=384m -XX:+HeapDumpOnOutOfMemoryError -Xms256m -Xmx512m -Dfile.encoding=UTF-8 -Duser.country -Duser.language=en (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

[jbachorik]

I am going to merge this. Can't wait for official review, @rkennke and @zhengyu123 please review retroactively when you have time. I need to cut a release and start testing so we can get the fix to the next release of dd-trace-java.