JFR event types and emission for reference chains by jbachorik · Pull Request #796 · DataDog/java-profiler

jbachorik · 2026-09-17T17:25:14Z

What does this PR do?:
Adds the JFR plumbing for reference-chain events: the ReferenceChainEvent / ReferenceChainAbandonedEvent payloads (event.h), their dynamic JFR metadata and constant-pool handling (jfrMetadata.*), the FlightRecorder emission paths that serialize chain events and per-hop edge labels into recording buffers (flightRecorder.*), and the referencechains Arguments block (arguments.*) that configures the feature.

Motivation:
Part 2 of the stacked series for reference chains (PROF-15341). Emission is pull-style — the later tracker layer snapshots events and hands them to FlightRecorder — so this layer is independently reviewable and compiles/links without the tracker.

Additional Notes:
Stacked series for PROF-15341. Merge order: #804 (scan-build crashNow fix) -> this PR -> #797 -> #798 -> #799 -> #800 -> #801 -> #802. #795 (UBSan ELF fix) is already merged. Until #804 lands, this PR's diff additionally shows the small faultInjection.cpp change from #804.

How to test the change?:
The JFR round-trip unit tests for chain events land in the gtest PR later in this stack; buildDebug compiles and links this layer standalone.

For Datadog employees:

This PR doesn't touch any of that.
JIRA: PROF-15341

dd-octo-sts · 2026-09-17T17:28:31Z

Scan-Build Report

User:	runner@runnervmlun5p
Working Directory:	/home/runner/work/java-profiler/java-profiler/ddprof-lib/src/test/make
Command Line:	make -j4 all
Clang Version:	Ubuntu clang version 18.1.3 (1ubuntu1)
Date:	Thu Sep 17 20:07:29 2026

Bug Summary

Logic error
Bug Type	Quantity	Display?
All Bugs	1
Dereference of null pointer	1

Reports

Bug Group	Bug Type ▾	File	Function/Method	Line	Path Length
Logic error	Dereference of null pointer	faultInjection.cpp	crashNow	24	2

dd-octo-sts · 2026-09-17T17:43:07Z

CI Test Results

Run: #35356941211 | Commit: d3bcb32 | Duration: 15m 10s (longest job)

✅ All 32 test jobs passed

Status Overview

JDK	glibc-aarch64/debug	glibc-amd64/debug	musl-aarch64/debug	musl-amd64/debug
8	-	✅	-	-
8-ibm	-	✅	-	-
8-j9	✅	✅	-	-
8-librca	-	-	✅	✅
8-orcl	-	✅	-	-
11	-	✅	-	-
11-j9	✅	✅	-	-
11-librca	-	-	✅	✅
17	✅	✅	-	-
17-graal	✅	✅	-	-
17-j9	✅	✅	-	-
17-librca	-	-	✅	✅
21	✅	✅	-	-
21-graal	✅	✅	-	-
21-librca	-	-	✅	✅
25	✅	✅	-	-
25-graal	✅	✅	-	-
25-librca	-	-	✅	✅

Legend: ✅ passed | ❌ failed | ⚪ skipped | 🚫 cancelled

Summary: Total: 32 | Passed: 32 | Failed: 0

Updated: 2026-09-18 14:51:18 UTC

dd-octo-sts · 2026-09-17T17:53:15Z

✅ All 40 integration tests passed

📊 Dashboard · 👷 Pipeline · 📦 b7bdec26

chatgpt-codex-connector · 2026-09-17T20:03:39Z

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-17T20:06:39.828052Z	`ab3b0eb`	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: ab3b0ebbe1

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

datadog-official

Normal liveness events can write an unknown leak tag. A long reference chain can also exceed the fixed JFR buffer and damage memory.

_{Open Bits AI session}

_{🤖 Datadog Autotest · Commit ab3b0eb · What is Autotest? · @DataDog review to ask questions · Any feedback? Reach out in #autotest}

The null-pointer store is the deliberate never-returning crash, but clang scan-build reports a null dereference. Under __clang_analyzer__, replace it with __builtin_trap() - the analyzer understands the trap as a halt and explores no false path past it; the real build keeps the store.

Introduces the ReferenceChainEvent/ReferenceChainAbandonedEvent payloads (event.h), their JFR metadata (jfrMetadata.*), and the FlightRecorder emission paths that serialize chain events into JFR recording buffers, including the constant-pool handling for per-hop edge labels. Emission is pull-style: profiler.cpp snapshots events and hands them to FlightRecorder; this layer does not depend on the tracker itself.

Review findings on the JFR plumbing layer: - MAX_REFERENCE_CHAIN_EVENT_HOPS was a fixed 4096, permitting a ~438 KB worst-case event (near-limit edge labels) against a ~61 KB recording buffer - the reservation flushed first but the margin underflowed, so the write ran past the buffer (debug assert, release corruption). The cap is now derived from RECORDING_BUFFER_LIMIT minus the event's fixed fields, divided by the per-hop worst case, so a full-cap event always fits. - Truncation dropped ALL edge labels: the label count was gated on _edges.size() == emitted_size, which only holds for untruncated chains. Labels align with the chain's leaf-first element order, so truncation now emits the first emitted_size labels and loses only the root-side ones. - ObjectLivenessEvent::leak_tag is default-initialized to 0 so any construction path that forgets to set it serializes a defined untagged value (flush_table() overwrites it from the entry, which track() zeroes at insert). Moves the JFR round-trip and arguments parsing unit tests into this layer (they test exactly this code), rewrites the round-trip test to construct events directly instead of through the tracker, and adds byte-level boundary tests: oversize-chain truncation with label preservation, the size-prefix invariant, and the default leak tag.

rkennke

Nice change. I did a manual review, see below some findings.

rkennke · 2026-09-18T11:30:12Z

+          char *eq = strchr(cursor, '=');
+          if (eq) {
+            *(eq++) = 0;
+            // Floor every sub-option at the parse boundary rather than


That comment is way to verbose to justify why the values need to be floored and ceiling'ed. Either make them very concise or remove it altogether, it's kinda obvious that it's not a good idea to allow values outside the reasonable bounds here.

Compressed to four lines: the hops negative-wrap case, the negative-budget collapse, the unbounded-values-into-loop-bounds case, and the one-boundary rationale. The details live in the constant comments in arguments.h now, stated once.

rkennke · 2026-09-18T11:32:50Z

 const int DEFAULT_WALL_THREADS_PER_TICK = 16;
 const int DEFAULT_JSTACKDEPTH = 2048;

+// Every constant below is a provisional default pending empirical


Similar problem in this file: way too much comments explaining the same fact over and over again. Make it short and concise once, and drop all the other repetitions.

Done - the block now states the provisional-default fact once up front, and each constant keeps only a note that says something the name does not.

rkennke · 2026-09-18T11:34:17Z

  bool _record_heap_usage;
  bool _gc_generations;
+  // Reference-chain tracking (PROF-15341 - see
+  // doc/architecture/LiveHeapReferenceChains-ImplementationPlan.md and


I don't think those docs exist in this PR, and they shouldn't, but the reference to them also needs to go. Also, I don't think we want Jira-ticket references in our code.

Plan-document references are gone, and so are the Jira references in code (also swept the same pattern out of the upper layers of the stack).

rkennke · 2026-09-18T11:40:01Z

+  // otherwise; ReferenceChainTracker::fillHopEdgeLabels). Empty for events
+  // built before the edge-label change or when label resolution is
+  // unavailable (partial mock environments).
+  std::vector<std::string> _edges;


If _chain and _edges need to go hand-in-hand, then maybe make it a single vector of struct {u32; std::string } instead?

Done - ReferenceChainEvent now carries a single std::vector<ReferenceChainHop> ({u32 klass_id; std::string edge_label;}), and the JFR writer derives both the chain array and the labels array from it. Labels are all-or-none per event (canary events carry none), so the writer treats any empty label in the emitted range as "no labels" - same bytes as before.

rkennke · 2026-09-18T11:41:06Z

+};
+
+// Search-level abandonment signal (design doc's Termination section:
+// "explicit reporting of abandoned searches ... no silent truncation").


again, don't reference a non-existing design doc.

Removed; the abandoned-event comment now states the rationale without citing the document.

rkennke · 2026-09-18T11:44:47Z

-// documented in fillJavaMethodInfo below), the paired out-param size is just
-// as likely to be corrupted, and an implausible size should be rejected
-// before it is trusted to compute a byte range.
+// JVM spec SS4.7.3 caps a method's bytecode (code_length) at 65535 bytes (u2).


This change seems unrelated?

Reverted - it was an accuracy nitpick on a pre-existing comment and does not belong in this PR.

rkennke · 2026-09-18T11:54:09Z

+// out-of-range index.
+//
+// STACK_LOCAL (24) and JNI_LOCAL (25) are labeled "first_observed_via:..."
+// rather than plain "stack_local"/"jni_local" (design doc's "Honest labeling


stale referencs to design doc, again

Removed the design-doc reference; kept the mechanism explanation (first_observed_via labels overstate what a popped frame proves).

Uncommitted plan documents, rotted .cpp:NNN line references, and a nonexistent j9WallClock.cpp path replaced with symbol references that stay valid as the code moves.

rkennke

🗿 🤖 🔴

Sphinx Review found 1 critical/high severity finding(s) that must be addressed.

rkennke · 2026-09-18T12:57:19Z

+  // a count of 0 means label collection never ran for this event.
+  buf->putVar32(edge_count);
+  for (u32 i = 0; i < edge_count; i++) {
+    buf->putUtf8(edge_labels[i]);


🗿 🤖 🔴

[Sphinx Review — HIGH] recordReferenceChain() reserves MAX_REFERENCE_CHAIN_EDGE_LABEL (96) + 6 bytes per edge label, but writes labels with putUtf8(const char*), which truncates at MAX_STRING_LENGTH (8191). Any label longer than 96 bytes (a real Java field name easily can be) under-reserves by up to ~8 KB per hop and writes past the recording buffer - Buffer::put()'s only guard is an assert() that is compiled out in release builds. This is exactly the 'do not trust an upstream cap' argument the function's own comment makes for the chain length, but it is not applied to the labels.

Suggestion: Clamp each label's length to MAX_REFERENCE_CHAIN_EDGE_LABEL at the write site by using the two-argument putUtf8(v, len) overload, so the serializer's worst case matches its own reservation regardless of what the producer hands it.

Suggested change

buf->putUtf8(edge_labels[i]);

buf->putUtf8(edge_labels[i], (u32)(strlen(edge_labels[i]) < MAX_REFERENCE_CHAIN_EDGE_LABEL ? strlen(edge_labels[i]) : MAX_REFERENCE_CHAIN_EDGE_LABEL));

- ReferenceChainEvent carries one vector of ReferenceChainHop (klass id + retention-edge label) instead of two parallel vectors - Compress the sub-option floor/ceiling rationale and the provisional default constant comments to one concise statement each - Drop design-doc and Jira references from code comments; revert the unrelated LineNumberTable comment rewrite

datadog-official · 2026-09-18T14:36:03Z

Pipelines

_{This comment will be updated automatically if new data arrives.

🔗 Commit SHA: b7bdec2 | Docs | View more details | Give us feedback!}

jbachorik added AI AI: Author Signed-off labels Sep 17, 2026

jbachorik mentioned this pull request Sep 17, 2026

Reference-chain tracker and leak-signal engine #797

Draft

2 tasks

jbachorik added this pull request to stack #803 September 17, 2026 20:02

jbachorik marked this pull request as ready for review September 17, 2026 20:03

jbachorik requested a review from a team as a code owner September 17, 2026 20:03

Base automatically changed from jb/rc-1-ubsan-elf-vaddr to main September 17, 2026 20:05

jbachorik force-pushed the jb/rc-2-jfr-chain-events branch from ab3b0eb to 4534a7f Compare September 17, 2026 20:05

chatgpt-codex-connector Bot reviewed Sep 17, 2026

View reviewed changes

Comment thread ddprof-lib/src/main/cpp/flightRecorder.h Outdated

Comment thread ddprof-lib/src/main/cpp/event.h Outdated

Comment thread ddprof-lib/src/main/cpp/flightRecorder.cpp Outdated

Comment thread ddprof-lib/src/main/cpp/flightRecorder.cpp

datadog-official Bot reviewed Sep 17, 2026

View reviewed changes

Comment thread ddprof-lib/src/main/cpp/event.h Outdated

Comment thread ddprof-lib/src/main/cpp/flightRecorder.cpp

jbachorik force-pushed the jb/rc-2-jfr-chain-events branch from 4534a7f to 71320e1 Compare September 17, 2026 20:18

jbachorik added 2 commits September 17, 2026 22:20

jbachorik force-pushed the jb/rc-2-jfr-chain-events branch from 71320e1 to 80173ad Compare September 17, 2026 20:20

jbachorik force-pushed the jb/rc-2-jfr-chain-events branch 2 times, most recently from d51dfb8 to 8b7de9c Compare September 18, 2026 07:06

rkennke requested changes Sep 18, 2026

View reviewed changes

Drop transient and stale line-number references from comments

e3b3f66

Uncommitted plan documents, rotted .cpp:NNN line references, and a nonexistent j9WallClock.cpp path replaced with symbol references that stay valid as the code moves.

rkennke requested changes Sep 18, 2026

View reviewed changes

rkennke added the sphinx:critical Sphinx: critical — human review required label Sep 18, 2026

jbachorik force-pushed the jb/rc-2-jfr-chain-events branch from 8b7de9c to e3b3f66 Compare September 18, 2026 12:59

	buf->putUtf8(edge_labels[i]);
	buf->putUtf8(edge_labels[i], (u32)(strlen(edge_labels[i]) < MAX_REFERENCE_CHAIN_EDGE_LABEL ? strlen(edge_labels[i]) : MAX_REFERENCE_CHAIN_EDGE_LABEL));

Conversation

jbachorik commented Sep 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

dd-octo-sts Bot commented Sep 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Scan-Build Report

Bug Summary

Reports

Uh oh!

dd-octo-sts Bot commented Sep 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

CI Test Results

Status Overview

Uh oh!

dd-octo-sts Bot commented Sep 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

chatgpt-codex-connector Bot commented Sep 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codex Review Summary

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

datadog-official Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

rkennke left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

rkennke left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

datadog-official Bot commented Sep 18, 2026 • edited by datadog-prod-us1-5 Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

jbachorik commented Sep 17, 2026 •

edited

Loading

dd-octo-sts Bot commented Sep 17, 2026 •

edited

Loading

dd-octo-sts Bot commented Sep 17, 2026 •

edited

Loading

dd-octo-sts Bot commented Sep 17, 2026 •

edited

Loading

chatgpt-codex-connector Bot commented Sep 17, 2026 •

edited

Loading

datadog-official Bot commented Sep 18, 2026 •

edited by datadog-prod-us1-5 Bot

Loading