Skip to content

Conversation

@clutchski
Copy link
Contributor

No description provided.

@clutchski clutchski merged commit 8b596cb into master Jun 21, 2016
@clutchski clutchski deleted the matt/pkg branch June 21, 2016 22:28
labbati added a commit that referenced this pull request Sep 12, 2018
nsrip-dd added a commit that referenced this pull request Oct 29, 2024
The ThreadSpanLinks singleton holds the active span (if one exists) for
a given thread ID. The `get_active_span_from_thread_id` member function
returns a pointer to the active span for a thread. The `link_span`
member function sets the active span for a thread.
`get_active_span_from_thread_id` accesses the map of spans under a
mutex, but returns the pointer after releasing the mutex, meaning
`link_span` can modify the members of the Span while the caller of
`get_active_span_from_thread_id` is reading them.

Fix this by returning a copy of the `Span`. Use a `std::optional` to wrap
the return value of `get_active_span_from_thread_id`, rather than
returning a pointer. We want to tell whether or not there actually was a
span associated with the thread, but returning a pointer would require
us to heap allocate the copy of the Span.

I added a simplistic regression test which fails reliably without this
fix when built with the thread sanitizer enabled. Output like:

```
WARNING: ThreadSanitizer: data race (pid=2971510)
  Read of size 8 at 0x7b2000004080 by thread T2:
    #0 memcpy ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:823 (libtsan.so.0+0x42313)
    #1 memcpy ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:815 (libtsan.so.0+0x42313)
    #2 std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >::_M_assign(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&) <null> (libstdc++.so.6+0x1432b4)
    #3 std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > std::__invoke_impl<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > (*)()>(std::__invoke_other, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > (*&&)()) <null> (thread_span_links+0xe46e)
    #4 std::__invoke_result<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > (*)()>::type std::__invoke<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > (*)()>(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > (*&&)()) <null> (thread_span_links+0xe2fe)
    #5 std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > std::thread::_Invoker<std::tuple<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > (*)()> >::_M_invoke<0ul>(std::_Index_tuple<0ul>) <null> (thread_span_links+0xe1cf)
    #6 std::thread::_Invoker<std::tuple<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > (*)()> >::operator()() <null> (thread_span_links+0xe0f6)
    #7 std::thread::_State_impl<std::thread::_Invoker<std::tuple<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > (*)()> > >::_M_run() <null> (thread_span_links+0xdf40)
    #8 <null> <null> (libstdc++.so.6+0xd6df3)

  Previous write of size 8 at 0x7b2000004080 by thread T1 (mutexes: write M47):
    #0 memcpy ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:823 (libtsan.so.0+0x42313)
    #1 memcpy ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:815 (libtsan.so.0+0x42313)
    #2 std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >::_M_assign(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocato
r<char> > const&) <null> (libstdc++.so.6+0x1432b4)
    #3 get() <null> (thread_span_links+0xb570)
    #4 void std::__invoke_impl<void, void (*)()>(std::__invoke_other, void (*&&)()) <null> (thread_span_links+0xe525)
    #5 std::__invoke_result<void (*)()>::type std::__invoke<void (*)()>(void (*&&)()) <null> (thread_span_links+0xe3b5)
    #6 void std::thread::_Invoker<std::tuple<void (*)()> >::_M_invoke<0ul>(std::_Index_tuple<0ul>) <null> (thread_span_links+0xe242)
    #7 std::thread::_Invoker<std::tuple<void (*)()> >::operator()() <null> (thread_span_links+0xe158)
[ ... etc ... ]
```
github-actions bot pushed a commit that referenced this pull request Oct 29, 2024
The ThreadSpanLinks singleton holds the active span (if one exists) for
a given thread ID. The `get_active_span_from_thread_id` member function
returns a pointer to the active span for a thread. The `link_span`
member function sets the active span for a thread.
`get_active_span_from_thread_id` accesses the map of spans under a
mutex, but returns the pointer after releasing the mutex, meaning
`link_span` can modify the members of the Span while the caller of
`get_active_span_from_thread_id` is reading them.

Fix this by returning a copy of the `Span`. Use a `std::optional` to wrap
the return value of `get_active_span_from_thread_id`, rather than
returning a pointer. We want to tell whether or not there actually was a
span associated with the thread, but returning a pointer would require
us to heap allocate the copy of the Span.

I added a simplistic regression test which fails reliably without this
fix when built with the thread sanitizer enabled. Output like:

```
WARNING: ThreadSanitizer: data race (pid=2971510)
  Read of size 8 at 0x7b2000004080 by thread T2:
    #0 memcpy ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:823 (libtsan.so.0+0x42313)
    #1 memcpy ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:815 (libtsan.so.0+0x42313)
    #2 std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >::_M_assign(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&) <null> (libstdc++.so.6+0x1432b4)
    #3 std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > std::__invoke_impl<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > (*)()>(std::__invoke_other, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > (*&&)()) <null> (thread_span_links+0xe46e)
    #4 std::__invoke_result<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > (*)()>::type std::__invoke<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > (*)()>(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > (*&&)()) <null> (thread_span_links+0xe2fe)
    #5 std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > std::thread::_Invoker<std::tuple<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > (*)()> >::_M_invoke<0ul>(std::_Index_tuple<0ul>) <null> (thread_span_links+0xe1cf)
    #6 std::thread::_Invoker<std::tuple<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > (*)()> >::operator()() <null> (thread_span_links+0xe0f6)
    #7 std::thread::_State_impl<std::thread::_Invoker<std::tuple<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > (*)()> > >::_M_run() <null> (thread_span_links+0xdf40)
    #8 <null> <null> (libstdc++.so.6+0xd6df3)

  Previous write of size 8 at 0x7b2000004080 by thread T1 (mutexes: write M47):
    #0 memcpy ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:823 (libtsan.so.0+0x42313)
    #1 memcpy ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:815 (libtsan.so.0+0x42313)
    #2 std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >::_M_assign(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocato
r<char> > const&) <null> (libstdc++.so.6+0x1432b4)
    #3 get() <null> (thread_span_links+0xb570)
    #4 void std::__invoke_impl<void, void (*)()>(std::__invoke_other, void (*&&)()) <null> (thread_span_links+0xe525)
    #5 std::__invoke_result<void (*)()>::type std::__invoke<void (*)()>(void (*&&)()) <null> (thread_span_links+0xe3b5)
    #6 void std::thread::_Invoker<std::tuple<void (*)()> >::_M_invoke<0ul>(std::_Index_tuple<0ul>) <null> (thread_span_links+0xe242)
    #7 std::thread::_Invoker<std::tuple<void (*)()> >::operator()() <null> (thread_span_links+0xe158)
[ ... etc ... ]
```

(cherry picked from commit 64b3374)
nsrip-dd added a commit that referenced this pull request Oct 29, 2024
The ThreadSpanLinks singleton holds the active span (if one exists) for
a given thread ID. The `get_active_span_from_thread_id` member function
returns a pointer to the active span for a thread. The `link_span`
member function sets the active span for a thread.
`get_active_span_from_thread_id` accesses the map of spans under a
mutex, but returns the pointer after releasing the mutex, meaning
`link_span` can modify the members of the Span while the caller of
`get_active_span_from_thread_id` is reading them.

Fix this by returning a copy of the `Span`. Use a `std::optional` to wrap
the return value of `get_active_span_from_thread_id`, rather than
returning a pointer. We want to tell whether or not there actually was a
span associated with the thread, but returning a pointer would require
us to heap allocate the copy of the Span.

I added a simplistic regression test which fails reliably without this
fix when built with the thread sanitizer enabled. Output like:

```
WARNING: ThreadSanitizer: data race (pid=2971510)
  Read of size 8 at 0x7b2000004080 by thread T2:
    #0 memcpy ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:823 (libtsan.so.0+0x42313)
    #1 memcpy ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:815 (libtsan.so.0+0x42313)
    #2 std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >::_M_assign(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&) <null> (libstdc++.so.6+0x1432b4)
    #3 std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > std::__invoke_impl<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > (*)()>(std::__invoke_other, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > (*&&)()) <null> (thread_span_links+0xe46e)
    #4 std::__invoke_result<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > (*)()>::type std::__invoke<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > (*)()>(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > (*&&)()) <null> (thread_span_links+0xe2fe)
    #5 std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > std::thread::_Invoker<std::tuple<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > (*)()> >::_M_invoke<0ul>(std::_Index_tuple<0ul>) <null> (thread_span_links+0xe1cf)
    #6 std::thread::_Invoker<std::tuple<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > (*)()> >::operator()() <null> (thread_span_links+0xe0f6)
    #7 std::thread::_State_impl<std::thread::_Invoker<std::tuple<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > (*)()> > >::_M_run() <null> (thread_span_links+0xdf40)
    #8 <null> <null> (libstdc++.so.6+0xd6df3)

  Previous write of size 8 at 0x7b2000004080 by thread T1 (mutexes: write M47):
    #0 memcpy ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:823 (libtsan.so.0+0x42313)
    #1 memcpy ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:815 (libtsan.so.0+0x42313)
    #2 std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >::_M_assign(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocato
r<char> > const&) <null> (libstdc++.so.6+0x1432b4)
    #3 get() <null> (thread_span_links+0xb570)
    #4 void std::__invoke_impl<void, void (*)()>(std::__invoke_other, void (*&&)()) <null> (thread_span_links+0xe525)
    #5 std::__invoke_result<void (*)()>::type std::__invoke<void (*)()>(void (*&&)()) <null> (thread_span_links+0xe3b5)
    #6 void std::thread::_Invoker<std::tuple<void (*)()> >::_M_invoke<0ul>(std::_Index_tuple<0ul>) <null> (thread_span_links+0xe242)
    #7 std::thread::_Invoker<std::tuple<void (*)()> >::operator()() <null> (thread_span_links+0xe158)
[ ... etc ... ]
```

(cherry picked from commit 64b3374)
nsrip-dd added a commit that referenced this pull request Oct 29, 2024
The ThreadSpanLinks singleton holds the active span (if one exists) for
a given thread ID. The `get_active_span_from_thread_id` member function
returns a pointer to the active span for a thread. The `link_span`
member function sets the active span for a thread.
`get_active_span_from_thread_id` accesses the map of spans under a
mutex, but returns the pointer after releasing the mutex, meaning
`link_span` can modify the members of the Span while the caller of
`get_active_span_from_thread_id` is reading them.

Fix this by returning a copy of the `Span`. Use a `std::optional` to wrap
the return value of `get_active_span_from_thread_id`, rather than
returning a pointer. We want to tell whether or not there actually was a
span associated with the thread, but returning a pointer would require
us to heap allocate the copy of the Span.

I added a simplistic regression test which fails reliably without this
fix when built with the thread sanitizer enabled. Output like:

```
WARNING: ThreadSanitizer: data race (pid=2971510)
  Read of size 8 at 0x7b2000004080 by thread T2:
    #0 memcpy ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:823 (libtsan.so.0+0x42313)
    #1 memcpy ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:815 (libtsan.so.0+0x42313)
    #2 std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >::_M_assign(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&) <null> (libstdc++.so.6+0x1432b4)
    #3 std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > std::__invoke_impl<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > (*)()>(std::__invoke_other, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > (*&&)()) <null> (thread_span_links+0xe46e)
    #4 std::__invoke_result<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > (*)()>::type std::__invoke<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > (*)()>(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > (*&&)()) <null> (thread_span_links+0xe2fe)
    #5 std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > std::thread::_Invoker<std::tuple<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > (*)()> >::_M_invoke<0ul>(std::_Index_tuple<0ul>) <null> (thread_span_links+0xe1cf)
    #6 std::thread::_Invoker<std::tuple<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > (*)()> >::operator()() <null> (thread_span_links+0xe0f6)
    #7 std::thread::_State_impl<std::thread::_Invoker<std::tuple<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > (*)()> > >::_M_run() <null> (thread_span_links+0xdf40)
    #8 <null> <null> (libstdc++.so.6+0xd6df3)

  Previous write of size 8 at 0x7b2000004080 by thread T1 (mutexes: write M47):
    #0 memcpy ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:823 (libtsan.so.0+0x42313)
    #1 memcpy ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:815 (libtsan.so.0+0x42313)
    #2 std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >::_M_assign(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocato
r<char> > const&) <null> (libstdc++.so.6+0x1432b4)
    #3 get() <null> (thread_span_links+0xb570)
    #4 void std::__invoke_impl<void, void (*)()>(std::__invoke_other, void (*&&)()) <null> (thread_span_links+0xe525)
    #5 std::__invoke_result<void (*)()>::type std::__invoke<void (*)()>(void (*&&)()) <null> (thread_span_links+0xe3b5)
    #6 void std::thread::_Invoker<std::tuple<void (*)()> >::_M_invoke<0ul>(std::_Index_tuple<0ul>) <null> (thread_span_links+0xe242)
    #7 std::thread::_Invoker<std::tuple<void (*)()> >::operator()() <null> (thread_span_links+0xe158)
[ ... etc ... ]
```

(cherry picked from commit 64b3374)
nsrip-dd added a commit that referenced this pull request Oct 29, 2024
The ThreadSpanLinks singleton holds the active span (if one exists) for
a given thread ID. The `get_active_span_from_thread_id` member function
returns a pointer to the active span for a thread. The `link_span`
member function sets the active span for a thread.
`get_active_span_from_thread_id` accesses the map of spans under a
mutex, but returns the pointer after releasing the mutex, meaning
`link_span` can modify the members of the Span while the caller of
`get_active_span_from_thread_id` is reading them.

Fix this by returning a copy of the `Span`. Use a `std::optional` to wrap
the return value of `get_active_span_from_thread_id`, rather than
returning a pointer. We want to tell whether or not there actually was a
span associated with the thread, but returning a pointer would require
us to heap allocate the copy of the Span.

I added a simplistic regression test which fails reliably without this
fix when built with the thread sanitizer enabled. Output like:

```
WARNING: ThreadSanitizer: data race (pid=2971510)
  Read of size 8 at 0x7b2000004080 by thread T2:
    #0 memcpy ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:823 (libtsan.so.0+0x42313)
    #1 memcpy ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:815 (libtsan.so.0+0x42313)
    #2 std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >::_M_assign(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&) <null> (libstdc++.so.6+0x1432b4)
    #3 std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > std::__invoke_impl<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > (*)()>(std::__invoke_other, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > (*&&)()) <null> (thread_span_links+0xe46e)
    #4 std::__invoke_result<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > (*)()>::type std::__invoke<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > (*)()>(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > (*&&)()) <null> (thread_span_links+0xe2fe)
    #5 std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > std::thread::_Invoker<std::tuple<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > (*)()> >::_M_invoke<0ul>(std::_Index_tuple<0ul>) <null> (thread_span_links+0xe1cf)
    #6 std::thread::_Invoker<std::tuple<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > (*)()> >::operator()() <null> (thread_span_links+0xe0f6)
    #7 std::thread::_State_impl<std::thread::_Invoker<std::tuple<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > (*)()> > >::_M_run() <null> (thread_span_links+0xdf40)
    #8 <null> <null> (libstdc++.so.6+0xd6df3)

  Previous write of size 8 at 0x7b2000004080 by thread T1 (mutexes: write M47):
    #0 memcpy ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:823 (libtsan.so.0+0x42313)
    #1 memcpy ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:815 (libtsan.so.0+0x42313)
    #2 std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >::_M_assign(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocato
r<char> > const&) <null> (libstdc++.so.6+0x1432b4)
    #3 get() <null> (thread_span_links+0xb570)
    #4 void std::__invoke_impl<void, void (*)()>(std::__invoke_other, void (*&&)()) <null> (thread_span_links+0xe525)
    #5 std::__invoke_result<void (*)()>::type std::__invoke<void (*)()>(void (*&&)()) <null> (thread_span_links+0xe3b5)
    #6 void std::thread::_Invoker<std::tuple<void (*)()> >::_M_invoke<0ul>(std::_Index_tuple<0ul>) <null> (thread_span_links+0xe242)
    #7 std::thread::_Invoker<std::tuple<void (*)()> >::operator()() <null> (thread_span_links+0xe158)
[ ... etc ... ]
```

(cherry picked from commit 64b3374)
nsrip-dd added a commit that referenced this pull request Oct 29, 2024
The ThreadSpanLinks singleton holds the active span (if one exists) for
a given thread ID. The `get_active_span_from_thread_id` member function
returns a pointer to the active span for a thread. The `link_span`
member function sets the active span for a thread.
`get_active_span_from_thread_id` accesses the map of spans under a
mutex, but returns the pointer after releasing the mutex, meaning
`link_span` can modify the members of the Span while the caller of
`get_active_span_from_thread_id` is reading them.

Fix this by returning a copy of the `Span`. Use a `std::optional` to wrap
the return value of `get_active_span_from_thread_id`, rather than
returning a pointer. We want to tell whether or not there actually was a
span associated with the thread, but returning a pointer would require
us to heap allocate the copy of the Span.

I added a simplistic regression test which fails reliably without this
fix when built with the thread sanitizer enabled. Output like:

```
WARNING: ThreadSanitizer: data race (pid=2971510)
  Read of size 8 at 0x7b2000004080 by thread T2:
    #0 memcpy ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:823 (libtsan.so.0+0x42313)
    #1 memcpy ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:815 (libtsan.so.0+0x42313)
    #2 std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >::_M_assign(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&) <null> (libstdc++.so.6+0x1432b4)
    #3 std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > std::__invoke_impl<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > (*)()>(std::__invoke_other, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > (*&&)()) <null> (thread_span_links+0xe46e)
    #4 std::__invoke_result<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > (*)()>::type std::__invoke<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > (*)()>(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > (*&&)()) <null> (thread_span_links+0xe2fe)
    #5 std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > std::thread::_Invoker<std::tuple<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > (*)()> >::_M_invoke<0ul>(std::_Index_tuple<0ul>) <null> (thread_span_links+0xe1cf)
    #6 std::thread::_Invoker<std::tuple<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > (*)()> >::operator()() <null> (thread_span_links+0xe0f6)
    #7 std::thread::_State_impl<std::thread::_Invoker<std::tuple<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > (*)()> > >::_M_run() <null> (thread_span_links+0xdf40)
    #8 <null> <null> (libstdc++.so.6+0xd6df3)

  Previous write of size 8 at 0x7b2000004080 by thread T1 (mutexes: write M47):
    #0 memcpy ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:823 (libtsan.so.0+0x42313)
    #1 memcpy ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:815 (libtsan.so.0+0x42313)
    #2 std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >::_M_assign(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocato
r<char> > const&) <null> (libstdc++.so.6+0x1432b4)
    #3 get() <null> (thread_span_links+0xb570)
    #4 void std::__invoke_impl<void, void (*)()>(std::__invoke_other, void (*&&)()) <null> (thread_span_links+0xe525)
    #5 std::__invoke_result<void (*)()>::type std::__invoke<void (*)()>(void (*&&)()) <null> (thread_span_links+0xe3b5)
    #6 void std::thread::_Invoker<std::tuple<void (*)()> >::_M_invoke<0ul>(std::_Index_tuple<0ul>) <null> (thread_span_links+0xe242)
    #7 std::thread::_Invoker<std::tuple<void (*)()> >::operator()() <null> (thread_span_links+0xe158)
[ ... etc ... ]
```

(cherry picked from commit 64b3374)
nsrip-dd added a commit that referenced this pull request Oct 29, 2024
The ThreadSpanLinks singleton holds the active span (if one exists) for
a given thread ID. The `get_active_span_from_thread_id` member function
returns a pointer to the active span for a thread. The `link_span`
member function sets the active span for a thread.
`get_active_span_from_thread_id` accesses the map of spans under a
mutex, but returns the pointer after releasing the mutex, meaning
`link_span` can modify the members of the Span while the caller of
`get_active_span_from_thread_id` is reading them.

Fix this by returning a copy of the `Span`. Use a `std::optional` to wrap
the return value of `get_active_span_from_thread_id`, rather than
returning a pointer. We want to tell whether or not there actually was a
span associated with the thread, but returning a pointer would require
us to heap allocate the copy of the Span.

I added a simplistic regression test which fails reliably without this
fix when built with the thread sanitizer enabled. Output like:

```
WARNING: ThreadSanitizer: data race (pid=2971510)
  Read of size 8 at 0x7b2000004080 by thread T2:
    #0 memcpy ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:823 (libtsan.so.0+0x42313)
    #1 memcpy ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:815 (libtsan.so.0+0x42313)
    #2 std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >::_M_assign(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&) <null> (libstdc++.so.6+0x1432b4)
    #3 std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > std::__invoke_impl<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > (*)()>(std::__invoke_other, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > (*&&)()) <null> (thread_span_links+0xe46e)
    #4 std::__invoke_result<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > (*)()>::type std::__invoke<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > (*)()>(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > (*&&)()) <null> (thread_span_links+0xe2fe)
    #5 std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > std::thread::_Invoker<std::tuple<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > (*)()> >::_M_invoke<0ul>(std::_Index_tuple<0ul>) <null> (thread_span_links+0xe1cf)
    #6 std::thread::_Invoker<std::tuple<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > (*)()> >::operator()() <null> (thread_span_links+0xe0f6)
    #7 std::thread::_State_impl<std::thread::_Invoker<std::tuple<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > (*)()> > >::_M_run() <null> (thread_span_links+0xdf40)
    #8 <null> <null> (libstdc++.so.6+0xd6df3)

  Previous write of size 8 at 0x7b2000004080 by thread T1 (mutexes: write M47):
    #0 memcpy ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:823 (libtsan.so.0+0x42313)
    #1 memcpy ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:815 (libtsan.so.0+0x42313)
    #2 std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >::_M_assign(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocato
r<char> > const&) <null> (libstdc++.so.6+0x1432b4)
    #3 get() <null> (thread_span_links+0xb570)
    #4 void std::__invoke_impl<void, void (*)()>(std::__invoke_other, void (*&&)()) <null> (thread_span_links+0xe525)
    #5 std::__invoke_result<void (*)()>::type std::__invoke<void (*)()>(void (*&&)()) <null> (thread_span_links+0xe3b5)
    #6 void std::thread::_Invoker<std::tuple<void (*)()> >::_M_invoke<0ul>(std::_Index_tuple<0ul>) <null> (thread_span_links+0xe242)
    #7 std::thread::_Invoker<std::tuple<void (*)()> >::operator()() <null> (thread_span_links+0xe158)
[ ... etc ... ]
```

(cherry picked from commit 64b3374)
nsrip-dd added a commit that referenced this pull request Oct 29, 2024
The ThreadSpanLinks singleton holds the active span (if one exists) for
a given thread ID. The `get_active_span_from_thread_id` member function
returns a pointer to the active span for a thread. The `link_span`
member function sets the active span for a thread.
`get_active_span_from_thread_id` accesses the map of spans under a
mutex, but returns the pointer after releasing the mutex, meaning
`link_span` can modify the members of the Span while the caller of
`get_active_span_from_thread_id` is reading them.

Fix this by returning a copy of the `Span`. Use a `std::optional` to wrap
the return value of `get_active_span_from_thread_id`, rather than
returning a pointer. We want to tell whether or not there actually was a
span associated with the thread, but returning a pointer would require
us to heap allocate the copy of the Span.

I added a simplistic regression test which fails reliably without this
fix when built with the thread sanitizer enabled. Output like:

```
WARNING: ThreadSanitizer: data race (pid=2971510)
  Read of size 8 at 0x7b2000004080 by thread T2:
    #0 memcpy ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:823 (libtsan.so.0+0x42313)
    #1 memcpy ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:815 (libtsan.so.0+0x42313)
    #2 std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >::_M_assign(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&) <null> (libstdc++.so.6+0x1432b4)
    #3 std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > std::__invoke_impl<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > (*)()>(std::__invoke_other, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > (*&&)()) <null> (thread_span_links+0xe46e)
    #4 std::__invoke_result<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > (*)()>::type std::__invoke<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > (*)()>(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > (*&&)()) <null> (thread_span_links+0xe2fe)
    #5 std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > std::thread::_Invoker<std::tuple<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > (*)()> >::_M_invoke<0ul>(std::_Index_tuple<0ul>) <null> (thread_span_links+0xe1cf)
    #6 std::thread::_Invoker<std::tuple<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > (*)()> >::operator()() <null> (thread_span_links+0xe0f6)
    #7 std::thread::_State_impl<std::thread::_Invoker<std::tuple<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > (*)()> > >::_M_run() <null> (thread_span_links+0xdf40)
    #8 <null> <null> (libstdc++.so.6+0xd6df3)

  Previous write of size 8 at 0x7b2000004080 by thread T1 (mutexes: write M47):
    #0 memcpy ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:823 (libtsan.so.0+0x42313)
    #1 memcpy ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:815 (libtsan.so.0+0x42313)
    #2 std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >::_M_assign(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocato
r<char> > const&) <null> (libstdc++.so.6+0x1432b4)
    #3 get() <null> (thread_span_links+0xb570)
    #4 void std::__invoke_impl<void, void (*)()>(std::__invoke_other, void (*&&)()) <null> (thread_span_links+0xe525)
    #5 std::__invoke_result<void (*)()>::type std::__invoke<void (*)()>(void (*&&)()) <null> (thread_span_links+0xe3b5)
    #6 void std::thread::_Invoker<std::tuple<void (*)()> >::_M_invoke<0ul>(std::_Index_tuple<0ul>) <null> (thread_span_links+0xe242)
    #7 std::thread::_Invoker<std::tuple<void (*)()> >::operator()() <null> (thread_span_links+0xe158)
[ ... etc ... ]
```

(cherry picked from commit 64b3374)
nsrip-dd added a commit that referenced this pull request Oct 29, 2024
The ThreadSpanLinks singleton holds the active span (if one exists) for
a given thread ID. The `get_active_span_from_thread_id` member function
returns a pointer to the active span for a thread. The `link_span`
member function sets the active span for a thread.
`get_active_span_from_thread_id` accesses the map of spans under a
mutex, but returns the pointer after releasing the mutex, meaning
`link_span` can modify the members of the Span while the caller of
`get_active_span_from_thread_id` is reading them.

Fix this by returning a copy of the `Span`. Use a `std::optional` to wrap
the return value of `get_active_span_from_thread_id`, rather than
returning a pointer. We want to tell whether or not there actually was a
span associated with the thread, but returning a pointer would require
us to heap allocate the copy of the Span.

I added a simplistic regression test which fails reliably without this
fix when built with the thread sanitizer enabled. Output like:

```
WARNING: ThreadSanitizer: data race (pid=2971510)
  Read of size 8 at 0x7b2000004080 by thread T2:
    #0 memcpy ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:823 (libtsan.so.0+0x42313)
    #1 memcpy ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:815 (libtsan.so.0+0x42313)
    #2 std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >::_M_assign(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&) <null> (libstdc++.so.6+0x1432b4)
    #3 std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > std::__invoke_impl<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > (*)()>(std::__invoke_other, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > (*&&)()) <null> (thread_span_links+0xe46e)
    #4 std::__invoke_result<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > (*)()>::type std::__invoke<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > (*)()>(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > (*&&)()) <null> (thread_span_links+0xe2fe)
    #5 std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > std::thread::_Invoker<std::tuple<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > (*)()> >::_M_invoke<0ul>(std::_Index_tuple<0ul>) <null> (thread_span_links+0xe1cf)
    #6 std::thread::_Invoker<std::tuple<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > (*)()> >::operator()() <null> (thread_span_links+0xe0f6)
    #7 std::thread::_State_impl<std::thread::_Invoker<std::tuple<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > (*)()> > >::_M_run() <null> (thread_span_links+0xdf40)
    #8 <null> <null> (libstdc++.so.6+0xd6df3)

  Previous write of size 8 at 0x7b2000004080 by thread T1 (mutexes: write M47):
    #0 memcpy ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:823 (libtsan.so.0+0x42313)
    #1 memcpy ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:815 (libtsan.so.0+0x42313)
    #2 std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >::_M_assign(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocato
r<char> > const&) <null> (libstdc++.so.6+0x1432b4)
    #3 get() <null> (thread_span_links+0xb570)
    #4 void std::__invoke_impl<void, void (*)()>(std::__invoke_other, void (*&&)()) <null> (thread_span_links+0xe525)
    #5 std::__invoke_result<void (*)()>::type std::__invoke<void (*)()>(void (*&&)()) <null> (thread_span_links+0xe3b5)
    #6 void std::thread::_Invoker<std::tuple<void (*)()> >::_M_invoke<0ul>(std::_Index_tuple<0ul>) <null> (thread_span_links+0xe242)
    #7 std::thread::_Invoker<std::tuple<void (*)()> >::operator()() <null> (thread_span_links+0xe158)
[ ... etc ... ]
```

(cherry picked from commit 64b3374)
nsrip-dd added a commit that referenced this pull request Oct 29, 2024
The ThreadSpanLinks singleton holds the active span (if one exists) for
a given thread ID. The `get_active_span_from_thread_id` member function
returns a pointer to the active span for a thread. The `link_span`
member function sets the active span for a thread.
`get_active_span_from_thread_id` accesses the map of spans under a
mutex, but returns the pointer after releasing the mutex, meaning
`link_span` can modify the members of the Span while the caller of
`get_active_span_from_thread_id` is reading them.

Fix this by returning a copy of the `Span`. Use a `std::optional` to wrap
the return value of `get_active_span_from_thread_id`, rather than
returning a pointer. We want to tell whether or not there actually was a
span associated with the thread, but returning a pointer would require
us to heap allocate the copy of the Span.

I added a simplistic regression test which fails reliably without this
fix when built with the thread sanitizer enabled. Output like:

```
WARNING: ThreadSanitizer: data race (pid=2971510)
  Read of size 8 at 0x7b2000004080 by thread T2:
    #0 memcpy ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:823 (libtsan.so.0+0x42313)
    #1 memcpy ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:815 (libtsan.so.0+0x42313)
    #2 std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >::_M_assign(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&) <null> (libstdc++.so.6+0x1432b4)
    #3 std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > std::__invoke_impl<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > (*)()>(std::__invoke_other, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > (*&&)()) <null> (thread_span_links+0xe46e)
    #4 std::__invoke_result<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > (*)()>::type std::__invoke<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > (*)()>(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > (*&&)()) <null> (thread_span_links+0xe2fe)
    #5 std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > std::thread::_Invoker<std::tuple<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > (*)()> >::_M_invoke<0ul>(std::_Index_tuple<0ul>) <null> (thread_span_links+0xe1cf)
    #6 std::thread::_Invoker<std::tuple<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > (*)()> >::operator()() <null> (thread_span_links+0xe0f6)
    #7 std::thread::_State_impl<std::thread::_Invoker<std::tuple<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > (*)()> > >::_M_run() <null> (thread_span_links+0xdf40)
    #8 <null> <null> (libstdc++.so.6+0xd6df3)

  Previous write of size 8 at 0x7b2000004080 by thread T1 (mutexes: write M47):
    #0 memcpy ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:823 (libtsan.so.0+0x42313)
    #1 memcpy ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:815 (libtsan.so.0+0x42313)
    #2 std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >::_M_assign(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocato
r<char> > const&) <null> (libstdc++.so.6+0x1432b4)
    #3 get() <null> (thread_span_links+0xb570)
    #4 void std::__invoke_impl<void, void (*)()>(std::__invoke_other, void (*&&)()) <null> (thread_span_links+0xe525)
    #5 std::__invoke_result<void (*)()>::type std::__invoke<void (*)()>(void (*&&)()) <null> (thread_span_links+0xe3b5)
    #6 void std::thread::_Invoker<std::tuple<void (*)()> >::_M_invoke<0ul>(std::_Index_tuple<0ul>) <null> (thread_span_links+0xe242)
    #7 std::thread::_Invoker<std::tuple<void (*)()> >::operator()() <null> (thread_span_links+0xe158)
[ ... etc ... ]
```

(cherry picked from commit 64b3374)
nsrip-dd added a commit that referenced this pull request Oct 30, 2024
…t 2.12] (#11215)

Backport 64b3374 from #11167 to 2.12.

The ThreadSpanLinks singleton holds the active span (if one exists) for
a given thread ID. The `get_active_span_from_thread_id` member function
returns a pointer to the active span for a thread. The `link_span`
member function sets the active span for a thread.
`get_active_span_from_thread_id` accesses the map of spans under a
mutex, but returns the pointer after releasing the mutex, meaning
`link_span` can modify the members of the Span while the caller of
`get_active_span_from_thread_id` is reading them.

Fix this by returning a copy of the `Span`. Use a `std::optional` to
wrap
the return value of `get_active_span_from_thread_id`, rather than
returning a pointer. We want to tell whether or not there actually was a
span associated with the thread, but returning a pointer would require
us to heap allocate the copy of the Span.

I added a simplistic regression test which fails reliably without this
fix when built with the thread sanitizer enabled. Output like:

```
WARNING: ThreadSanitizer: data race (pid=2971510)
  Read of size 8 at 0x7b2000004080 by thread T2:
    #0 memcpy ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:823 (libtsan.so.0+0x42313)
    #1 memcpy ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:815 (libtsan.so.0+0x42313)
    #2 std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >::_M_assign(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&) <null> (libstdc++.so.6+0x1432b4)
    #3 std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > std::__invoke_impl<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > (*)()>(std::__invoke_other, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > (*&&)()) <null> (thread_span_links+0xe46e)
    #4 std::__invoke_result<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > (*)()>::type std::__invoke<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > (*)()>(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > (*&&)()) <null> (thread_span_links+0xe2fe)
    #5 std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > std::thread::_Invoker<std::tuple<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > (*)()> >::_M_invoke<0ul>(std::_Index_tuple<0ul>) <null> (thread_span_links+0xe1cf)
    #6 std::thread::_Invoker<std::tuple<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > (*)()> >::operator()() <null> (thread_span_links+0xe0f6)
    #7 std::thread::_State_impl<std::thread::_Invoker<std::tuple<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > (*)()> > >::_M_run() <null> (thread_span_links+0xdf40)
    #8 <null> <null> (libstdc++.so.6+0xd6df3)

  Previous write of size 8 at 0x7b2000004080 by thread T1 (mutexes: write M47):
    #0 memcpy ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:823 (libtsan.so.0+0x42313)
    #1 memcpy ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:815 (libtsan.so.0+0x42313)
    #2 std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >::_M_assign(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocato
r<char> > const&) <null> (libstdc++.so.6+0x1432b4)
    #3 get() <null> (thread_span_links+0xb570)
    #4 void std::__invoke_impl<void, void (*)()>(std::__invoke_other, void (*&&)()) <null> (thread_span_links+0xe525)
    #5 std::__invoke_result<void (*)()>::type std::__invoke<void (*)()>(void (*&&)()) <null> (thread_span_links+0xe3b5)
    #6 void std::thread::_Invoker<std::tuple<void (*)()> >::_M_invoke<0ul>(std::_Index_tuple<0ul>) <null> (thread_span_links+0xe242)
    #7 std::thread::_Invoker<std::tuple<void (*)()> >::operator()() <null> (thread_span_links+0xe158)
[ ... etc ... ]
```

(cherry picked from commit 64b3374)

## Checklist
- [x] PR author has checked that all the criteria below are met
- The PR description includes an overview of the change
- The PR description articulates the motivation for the change
- The change includes tests OR the PR description describes a testing
strategy
- The PR description notes risks associated with the change, if any
- Newly-added code is easy to change
- The change follows the [library release note
guidelines](https://ddtrace.readthedocs.io/en/stable/releasenotes.html)
- The change includes or references documentation updates if necessary
- Backport labels are set (if
[applicable](https://ddtrace.readthedocs.io/en/latest/contributing.html#backporting))

## Reviewer Checklist
- [x] Reviewer has checked that all the criteria below are met 
- Title is accurate
- All changes are related to the pull request's stated goal
- Avoids breaking
[API](https://ddtrace.readthedocs.io/en/stable/versioning.html#interfaces)
changes
- Testing strategy adequately addresses listed risks
- Newly-added code is easy to change
- Release note makes sense to a user of the library
- If necessary, author has acknowledged and discussed the performance
implications of this PR as reported in the benchmarks PR comment
- Backport labels are set in a manner that is consistent with the
[release branch maintenance
policy](https://ddtrace.readthedocs.io/en/latest/contributing.html#backporting)
nsrip-dd added a commit that referenced this pull request Oct 30, 2024
…t 2.13] (#11214)

Backport 64b3374 from #11167 to 2.13.

The ThreadSpanLinks singleton holds the active span (if one exists) for
a given thread ID. The `get_active_span_from_thread_id` member function
returns a pointer to the active span for a thread. The `link_span`
member function sets the active span for a thread.
`get_active_span_from_thread_id` accesses the map of spans under a
mutex, but returns the pointer after releasing the mutex, meaning
`link_span` can modify the members of the Span while the caller of
`get_active_span_from_thread_id` is reading them.

Fix this by returning a copy of the `Span`. Use a `std::optional` to
wrap
the return value of `get_active_span_from_thread_id`, rather than
returning a pointer. We want to tell whether or not there actually was a
span associated with the thread, but returning a pointer would require
us to heap allocate the copy of the Span.

I added a simplistic regression test which fails reliably without this
fix when built with the thread sanitizer enabled. Output like:

```
WARNING: ThreadSanitizer: data race (pid=2971510)
  Read of size 8 at 0x7b2000004080 by thread T2:
    #0 memcpy ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:823 (libtsan.so.0+0x42313)
    #1 memcpy ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:815 (libtsan.so.0+0x42313)
    #2 std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >::_M_assign(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&) <null> (libstdc++.so.6+0x1432b4)
    #3 std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > std::__invoke_impl<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > (*)()>(std::__invoke_other, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > (*&&)()) <null> (thread_span_links+0xe46e)
    #4 std::__invoke_result<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > (*)()>::type std::__invoke<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > (*)()>(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > (*&&)()) <null> (thread_span_links+0xe2fe)
    #5 std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > std::thread::_Invoker<std::tuple<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > (*)()> >::_M_invoke<0ul>(std::_Index_tuple<0ul>) <null> (thread_span_links+0xe1cf)
    #6 std::thread::_Invoker<std::tuple<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > (*)()> >::operator()() <null> (thread_span_links+0xe0f6)
    #7 std::thread::_State_impl<std::thread::_Invoker<std::tuple<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > (*)()> > >::_M_run() <null> (thread_span_links+0xdf40)
    #8 <null> <null> (libstdc++.so.6+0xd6df3)

  Previous write of size 8 at 0x7b2000004080 by thread T1 (mutexes: write M47):
    #0 memcpy ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:823 (libtsan.so.0+0x42313)
    #1 memcpy ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:815 (libtsan.so.0+0x42313)
    #2 std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >::_M_assign(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocato
r<char> > const&) <null> (libstdc++.so.6+0x1432b4)
    #3 get() <null> (thread_span_links+0xb570)
    #4 void std::__invoke_impl<void, void (*)()>(std::__invoke_other, void (*&&)()) <null> (thread_span_links+0xe525)
    #5 std::__invoke_result<void (*)()>::type std::__invoke<void (*)()>(void (*&&)()) <null> (thread_span_links+0xe3b5)
    #6 void std::thread::_Invoker<std::tuple<void (*)()> >::_M_invoke<0ul>(std::_Index_tuple<0ul>) <null> (thread_span_links+0xe242)
    #7 std::thread::_Invoker<std::tuple<void (*)()> >::operator()() <null> (thread_span_links+0xe158)
[ ... etc ... ]
```

(cherry picked from commit 64b3374)

## Checklist
- [x] PR author has checked that all the criteria below are met
- The PR description includes an overview of the change
- The PR description articulates the motivation for the change
- The change includes tests OR the PR description describes a testing
strategy
- The PR description notes risks associated with the change, if any
- Newly-added code is easy to change
- The change follows the [library release note
guidelines](https://ddtrace.readthedocs.io/en/stable/releasenotes.html)
- The change includes or references documentation updates if necessary
- Backport labels are set (if
[applicable](https://ddtrace.readthedocs.io/en/latest/contributing.html#backporting))

## Reviewer Checklist
- [x] Reviewer has checked that all the criteria below are met 
- Title is accurate
- All changes are related to the pull request's stated goal
- Avoids breaking
[API](https://ddtrace.readthedocs.io/en/stable/versioning.html#interfaces)
changes
- Testing strategy adequately addresses listed risks
- Newly-added code is easy to change
- Release note makes sense to a user of the library
- If necessary, author has acknowledged and discussed the performance
implications of this PR as reported in the benchmarks PR comment
- Backport labels are set in a manner that is consistent with the
[release branch maintenance
policy](https://ddtrace.readthedocs.io/en/latest/contributing.html#backporting)
taegyunkim added a commit that referenced this pull request Oct 30, 2024
…t 2.15] (#11211)

Backport 64b3374 from #11167 to 2.15.

The ThreadSpanLinks singleton holds the active span (if one exists) for
a given thread ID. The `get_active_span_from_thread_id` member function
returns a pointer to the active span for a thread. The `link_span`
member function sets the active span for a thread.
`get_active_span_from_thread_id` accesses the map of spans under a
mutex, but returns the pointer after releasing the mutex, meaning
`link_span` can modify the members of the Span while the caller of
`get_active_span_from_thread_id` is reading them.

Fix this by returning a copy of the `Span`. Use a `std::optional` to
wrap
the return value of `get_active_span_from_thread_id`, rather than
returning a pointer. We want to tell whether or not there actually was a
span associated with the thread, but returning a pointer would require
us to heap allocate the copy of the Span.

I added a simplistic regression test which fails reliably without this
fix when built with the thread sanitizer enabled. Output like:

```
WARNING: ThreadSanitizer: data race (pid=2971510)
  Read of size 8 at 0x7b2000004080 by thread T2:
    #0 memcpy ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:823 (libtsan.so.0+0x42313)
    #1 memcpy ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:815 (libtsan.so.0+0x42313)
    #2 std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >::_M_assign(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&) <null> (libstdc++.so.6+0x1432b4)
    #3 std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > std::__invoke_impl<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > (*)()>(std::__invoke_other, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > (*&&)()) <null> (thread_span_links+0xe46e)
    #4 std::__invoke_result<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > (*)()>::type std::__invoke<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > (*)()>(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > (*&&)()) <null> (thread_span_links+0xe2fe)
    #5 std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > std::thread::_Invoker<std::tuple<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > (*)()> >::_M_invoke<0ul>(std::_Index_tuple<0ul>) <null> (thread_span_links+0xe1cf)
    #6 std::thread::_Invoker<std::tuple<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > (*)()> >::operator()() <null> (thread_span_links+0xe0f6)
    #7 std::thread::_State_impl<std::thread::_Invoker<std::tuple<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > (*)()> > >::_M_run() <null> (thread_span_links+0xdf40)
    #8 <null> <null> (libstdc++.so.6+0xd6df3)

  Previous write of size 8 at 0x7b2000004080 by thread T1 (mutexes: write M47):
    #0 memcpy ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:823 (libtsan.so.0+0x42313)
    #1 memcpy ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:815 (libtsan.so.0+0x42313)
    #2 std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >::_M_assign(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocato
r<char> > const&) <null> (libstdc++.so.6+0x1432b4)
    #3 get() <null> (thread_span_links+0xb570)
    #4 void std::__invoke_impl<void, void (*)()>(std::__invoke_other, void (*&&)()) <null> (thread_span_links+0xe525)
    #5 std::__invoke_result<void (*)()>::type std::__invoke<void (*)()>(void (*&&)()) <null> (thread_span_links+0xe3b5)
    #6 void std::thread::_Invoker<std::tuple<void (*)()> >::_M_invoke<0ul>(std::_Index_tuple<0ul>) <null> (thread_span_links+0xe242)
    #7 std::thread::_Invoker<std::tuple<void (*)()> >::operator()() <null> (thread_span_links+0xe158)
[ ... etc ... ]
```

(cherry picked from commit 64b3374)

## Checklist
- [x] PR author has checked that all the criteria below are met
- The PR description includes an overview of the change
- The PR description articulates the motivation for the change
- The change includes tests OR the PR description describes a testing
strategy
- The PR description notes risks associated with the change, if any
- Newly-added code is easy to change
- The change follows the [library release note
guidelines](https://ddtrace.readthedocs.io/en/stable/releasenotes.html)
- The change includes or references documentation updates if necessary
- Backport labels are set (if
[applicable](https://ddtrace.readthedocs.io/en/latest/contributing.html#backporting))

## Reviewer Checklist
- [x] Reviewer has checked that all the criteria below are met 
- Title is accurate
- All changes are related to the pull request's stated goal
- Avoids breaking
[API](https://ddtrace.readthedocs.io/en/stable/versioning.html#interfaces)
changes
- Testing strategy adequately addresses listed risks
- Newly-added code is easy to change
- Release note makes sense to a user of the library
- If necessary, author has acknowledged and discussed the performance
implications of this PR as reported in the benchmarks PR comment
- Backport labels are set in a manner that is consistent with the
[release branch maintenance
policy](https://ddtrace.readthedocs.io/en/latest/contributing.html#backporting)

Co-authored-by: Taegyun Kim <[email protected]>
taegyunkim added a commit that referenced this pull request Oct 30, 2024
…t 2.16] (#11210)

Backport 64b3374 from #11167 to 2.16.

The ThreadSpanLinks singleton holds the active span (if one exists) for
a given thread ID. The `get_active_span_from_thread_id` member function
returns a pointer to the active span for a thread. The `link_span`
member
function sets the active span for a thread.
`get_active_span_from_thread_id`
accesses the map of spans under a mutex, but returns the pointer after
releasing the mutex, meaning `link_span` can modify the members of the
Span while the caller of `get_active_span_from_thread_id` is reading
them.

Fix this by returning a copy of the `Span`. Use a `std::optional` to
wrap
the return value of `get_active_span_from_thread_id`, rather than
returning a pointer. We want to tell whether or not there actually was a
span associated with the thread, but returning a pointer would require
us to heap allocate the copy of the Span.

I added a simplistic regression test which fails reliably without this
fix
when built with the thread sanitizer enabled. Output like:

```
WARNING: ThreadSanitizer: data race (pid=2971510)
  Read of size 8 at 0x7b2000004080 by thread T2:
    #0 memcpy ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:823 (libtsan.so.0+0x42313)
    #1 memcpy ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:815 (libtsan.so.0+0x42313)
    #2 std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >::_M_assign(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&) <null> (libstdc++.so.6+0x1432b4)
    #3 std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > std::__invoke_impl<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > (*)()>(std::__invoke_other, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > (*&&)()) <null> (thread_span_links+0xe46e)
    #4 std::__invoke_result<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > (*)()>::type std::__invoke<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > (*)()>(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > (*&&)()) <null> (thread_span_links+0xe2fe)
    #5 std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > std::thread::_Invoker<std::tuple<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > (*)()> >::_M_invoke<0ul>(std::_Index_tuple<0ul>) <null> (thread_span_links+0xe1cf)
    #6 std::thread::_Invoker<std::tuple<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > (*)()> >::operator()() <null> (thread_span_links+0xe0f6)
    #7 std::thread::_State_impl<std::thread::_Invoker<std::tuple<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > (*)()> > >::_M_run() <null> (thread_span_links+0xdf40)
    #8 <null> <null> (libstdc++.so.6+0xd6df3)

  Previous write of size 8 at 0x7b2000004080 by thread T1 (mutexes: write M47):
    #0 memcpy ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:823 (libtsan.so.0+0x42313)
    #1 memcpy ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:815 (libtsan.so.0+0x42313)
    #2 std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >::_M_assign(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocato
r<char> > const&) <null> (libstdc++.so.6+0x1432b4)
    #3 get() <null> (thread_span_links+0xb570)
    #4 void std::__invoke_impl<void, void (*)()>(std::__invoke_other, void (*&&)()) <null> (thread_span_links+0xe525)
    #5 std::__invoke_result<void (*)()>::type std::__invoke<void (*)()>(void (*&&)()) <null> (thread_span_links+0xe3b5)
    #6 void std::thread::_Invoker<std::tuple<void (*)()> >::_M_invoke<0ul>(std::_Index_tuple<0ul>) <null> (thread_span_links+0xe242)
    #7 std::thread::_Invoker<std::tuple<void (*)()> >::operator()() <null> (thread_span_links+0xe158)
[ ... etc ... ]
```

## Checklist
- [x] PR author has checked that all the criteria below are met
- The PR description includes an overview of the change
- The PR description articulates the motivation for the change
- The change includes tests OR the PR description describes a testing
strategy
- The PR description notes risks associated with the change, if any
- Newly-added code is easy to change
- The change follows the [library release note
guidelines](https://ddtrace.readthedocs.io/en/stable/releasenotes.html)
- The change includes or references documentation updates if necessary
- Backport labels are set (if
[applicable](https://ddtrace.readthedocs.io/en/latest/contributing.html#backporting))

## Reviewer Checklist
- [x] Reviewer has checked that all the criteria below are met 
- Title is accurate
- All changes are related to the pull request's stated goal
- Avoids breaking
[API](https://ddtrace.readthedocs.io/en/stable/versioning.html#interfaces)
changes
- Testing strategy adequately addresses listed risks
- Newly-added code is easy to change
- Release note makes sense to a user of the library
- If necessary, author has acknowledged and discussed the performance
implications of this PR as reported in the benchmarks PR comment
- Backport labels are set in a manner that is consistent with the
[release branch maintenance
policy](https://ddtrace.readthedocs.io/en/latest/contributing.html#backporting)

Co-authored-by: Nick Ripley <[email protected]>
Co-authored-by: Taegyun Kim <[email protected]>
@h0rv h0rv mentioned this pull request Mar 20, 2025
brettlangdon added a commit that referenced this pull request Mar 25, 2025
KowalskiThomas added a commit that referenced this pull request Nov 28, 2025
## Description

https://datadoghq.atlassian.net/browse/PROF-13114

This PR makes sure the Python Profiler's signal handler (for `SIGSEGV`
and `SIGBUS`) is properly installed when the Sampler thread starts.
Note that this (reinstalling our signal handler) does NOT break any
other signal handler (Python's or another extension's) as our signal
handler only swallows faults / jumps to the recovery path if it's been
"armed" (otherwise it re-raises). What matters is that we should be the
"first responder" when a fault happens.

This is an attempt to fix a crash we saw in the testing environment
where some workloads receive segmentation faults clearly coming from
`safe_memcpy` in FastAPI / Django apps.
The "real" root cause isn't yet known of me – Django and FastAPI don't
seem to use `PYTHONFAULTHANDLER` or `faulthandler` based on the Github
code – but after deploying those changes, we stopped seeing those
crashes (0 in the past 4 days).

<img width="2089" height="480" alt="image"
src="https://github.com/user-attachments/assets/c554ec0c-cfae-4311-bded-8082d8f79ed9"
/>


```
Error UnixSignal: Process terminated with SEGV_MAPERR (SIGSEGV)
#0   0x0000755d4295c18f safe_memcpy 
#1   0x0000755d42954879 copy_memory 
#2   0x0000755d42956826 GenInfo::create 
#3   0x0000755d42958c25 TaskInfo::create 
#4   0x0000755d42958cc7 TaskInfo::create 
#5   0x0000755d4295a618 ThreadInfo::unwind_tasks 
#6   0x0000755d4295b98b std::_Function_handler<void (_ts*, ThreadInfo&), Datadog::Sampler::sampling_thread(unsigned long)::{lambda(InterpreterInfo&)#1}::operator()(InterpreterInfo&) const::{lambda(_ts*, ThreadInfo&)#1}>::_M_invoke 
#7   0x0000755d42959906 for_each_thread 
#8   0x0000755d429599e5 std::_Function_handler<void (InterpreterInfo&), Datadog::Sampler::sampling_thread(unsigned long)::{lambda(InterpreterInfo&)#1}>::_M_invoke 
#9   0x0000755d4295c5b2 Datadog::Sampler::sampling_thread 
#10  0x0000755d4295c685 call_sampling_thread 
#11  0x0000755d45aeeea7 start_thread 
#12  0x0000755d45c05def clone 
```
avara1986 added a commit that referenced this pull request Dec 9, 2025
IAST-enabled applications using Gunicorn/Uvicorn workers were
experiencing segmentation faults (~33% crash rate on MCP streaming
requests) due to memory corruption when processes fork.

## Root Cause
- C++ global singletons (`taint_engine_context`, `initializer`)
initialized at module load
- Taint maps storing PyObject pointers by memory address
- Child processes after fork inherited stale pointers from parent
process memory
- Accessing these stale pointers → use-after-free → SIGSEGV crash

## Solution
- Implemented `pthread_atfork` handler that automatically resets C++
global state in child processes after every fork:
- Added comprehensive null-check wrappers around all native functions to
prevent crashes when native state is
- Fixed test regression issues where context slots weren't being freed:

## ASAN Verification

**[AddressSanitizer
(ASAN)](https://github.com/google/sanitizers/wiki/AddressSanitizer)** is
a fast memory error detector that catches use-after-free, buffer
overflows, and other memory corruption bugs at runtime.

**1. Runtime Environment (No Recompilation Required)**

The simplest way to test is using LD_PRELOAD with the system's libasan:

```bash
# Find your system's ASAN library
ASAN_LIB=$(gcc -print-file-name=libasan.so)

# Run tests with ASAN enabled
LD_PRELOAD=$ASAN_LIB \
ASAN_OPTIONS="detect_leaks=0:symbolize=1:abort_on_error=0" \
python3 -m pytest tests/appsec/iast/test_fork_handler_regression.py -v
```
**ASAN_OPTIONS explained:**
- `detect_leaks=0` - Disable leak detection (Python has many false
positives)
- `symbolize=1` - Show human-readable stack traces
- `abort_on_error=0` - Continue after first error (collect all errors)


**2. Build with ASAN (Optional, for deeper analysis)**

For more thorough testing, compile the native extension with ASAN:

```bash
# Set compilation flags
export CFLAGS="-fsanitize=address -fno-omit-frame-pointer -g"
export CXXFLAGS="-fsanitize=address -fno-omit-frame-pointer -g"
export LDFLAGS="-fsanitize=address"

# Rebuild the extension
pip install --no-build-isolation --force-reinstall -e .

# Run tests (LD_PRELOAD not needed when compiled with ASAN)
ASAN_OPTIONS="detect_leaks=0:symbolize=1:abort_on_error=0" \
python3 -m pytest tests/appsec/iast/test_fork_handler_regression.py -v
```

#### Minimal Reproduction Test

This script demonstrates the fork safety fix and can be used to verify
ASAN finds no errors:

```python
#!/usr/bin/env python3
"""Minimal fork safety reproduction test for ASAN verification."""
import os
from ddtrace.appsec._iast._taint_tracking import OriginType
from ddtrace.appsec._iast._taint_tracking._native import initialize_native_state
from ddtrace.appsec._iast._taint_tracking._taint_objects import taint_pyobject
from ddtrace.appsec._iast._taint_tracking._context import (
    start_request_context,
    debug_context_array_free_slots_number,
    debug_num_tainted_objects
)

def main():
    print(f"[Parent PID {os.getpid()}] Initializing IAST...")

    # Initialize native state
    initialize_native_state()

    # Create context and tainted objects in parent
    ctx_id = start_request_context()
    print(f"[Parent] Context created: {ctx_id}")

    # Create some tainted objects (populates native maps)
    for i in range(10):
        taint_pyobject(f"data_{i}", "source", f"value_{i}", OriginType.PARAMETER)

    tainted_count = debug_num_tainted_objects(ctx_id)
    print(f"[Parent] Tainted objects: {tainted_count}")

    # Fork
    pid = os.fork()

    if pid == 0:
        # Child process
        print(f"[Child PID {os.getpid()}] Started after fork")

        # Verify pthread_atfork reset worked
        free_slots = debug_context_array_free_slots_number()
        print(f"[Child] Free slots: {free_slots}")

        if free_slots > 0:
            print("[Child] ✅ Context slots were reset (pthread_atfork worked!)")
            os._exit(0)  # Success
        else:
            print("[Child] ❌ Context slots NOT reset")
            os._exit(1)  # Failure
    else:
        # Parent waits for child
        _, status = os.waitpid(pid, 0)
        exit_code = os.WEXITSTATUS(status)

        if exit_code == 0:
            print(f"[Parent] ✅ Child exited cleanly - Fork safety verified!")
            return 0
        else:
            print(f"[Parent] ❌ Child failed with exit code {exit_code}")
            return 1

if __name__ == "__main__":
    exit(main())
```

**Run with ASAN:**
```bash
# Save the script as test_fork_asan.py
# Run with ASAN enabled
LD_PRELOAD=$(gcc -print-file-name=libasan.so) \
ASAN_OPTIONS="detect_leaks=0:symbolize=1:abort_on_error=0" \
python3 test_fork_asan.py
```

**Expected output (success):**
```
[Parent PID 12345] Initializing IAST...
[Parent] Context created: 0
[Parent] Tainted objects: 10
[Child PID 12346] Started after fork
[Child] Free slots: 2
[Child] ✅ Context slots were reset (pthread_atfork worked!)
[Parent] ✅ Child exited cleanly - Fork safety verified!
```

**What ASAN would report WITHOUT this fix:**
```
==12346==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000040
==12346==The signal is caused by a READ memory access.
    #0 0x7f... in get_tainted_object_map_by_ctx_id
    #1 0x7f... in debug_context_array_free_slots_number
```
avara1986 added a commit that referenced this pull request Dec 9, 2025
IAST-enabled applications using Gunicorn/Uvicorn workers were
experiencing segmentation faults (~33% crash rate on MCP streaming
requests) due to memory corruption when processes fork.

- C++ global singletons (`taint_engine_context`, `initializer`)
initialized at module load
- Taint maps storing PyObject pointers by memory address
- Child processes after fork inherited stale pointers from parent
process memory
- Accessing these stale pointers → use-after-free → SIGSEGV crash

- Implemented `pthread_atfork` handler that automatically resets C++
global state in child processes after every fork:
- Added comprehensive null-check wrappers around all native functions to
prevent crashes when native state is
- Fixed test regression issues where context slots weren't being freed:

**[AddressSanitizer
(ASAN)](https://github.com/google/sanitizers/wiki/AddressSanitizer)** is
a fast memory error detector that catches use-after-free, buffer
overflows, and other memory corruption bugs at runtime.

**1. Runtime Environment (No Recompilation Required)**

The simplest way to test is using LD_PRELOAD with the system's libasan:

```bash
ASAN_LIB=$(gcc -print-file-name=libasan.so)

LD_PRELOAD=$ASAN_LIB \
ASAN_OPTIONS="detect_leaks=0:symbolize=1:abort_on_error=0" \
python3 -m pytest tests/appsec/iast/test_fork_handler_regression.py -v
```
**ASAN_OPTIONS explained:**
- `detect_leaks=0` - Disable leak detection (Python has many false
positives)
- `symbolize=1` - Show human-readable stack traces
- `abort_on_error=0` - Continue after first error (collect all errors)

**2. Build with ASAN (Optional, for deeper analysis)**

For more thorough testing, compile the native extension with ASAN:

```bash
export CFLAGS="-fsanitize=address -fno-omit-frame-pointer -g"
export CXXFLAGS="-fsanitize=address -fno-omit-frame-pointer -g"
export LDFLAGS="-fsanitize=address"

pip install --no-build-isolation --force-reinstall -e .

ASAN_OPTIONS="detect_leaks=0:symbolize=1:abort_on_error=0" \
python3 -m pytest tests/appsec/iast/test_fork_handler_regression.py -v
```

This script demonstrates the fork safety fix and can be used to verify
ASAN finds no errors:

```python
"""Minimal fork safety reproduction test for ASAN verification."""
import os
from ddtrace.appsec._iast._taint_tracking import OriginType
from ddtrace.appsec._iast._taint_tracking._native import initialize_native_state
from ddtrace.appsec._iast._taint_tracking._taint_objects import taint_pyobject
from ddtrace.appsec._iast._taint_tracking._context import (
    start_request_context,
    debug_context_array_free_slots_number,
    debug_num_tainted_objects
)

def main():
    print(f"[Parent PID {os.getpid()}] Initializing IAST...")

    # Initialize native state
    initialize_native_state()

    # Create context and tainted objects in parent
    ctx_id = start_request_context()
    print(f"[Parent] Context created: {ctx_id}")

    # Create some tainted objects (populates native maps)
    for i in range(10):
        taint_pyobject(f"data_{i}", "source", f"value_{i}", OriginType.PARAMETER)

    tainted_count = debug_num_tainted_objects(ctx_id)
    print(f"[Parent] Tainted objects: {tainted_count}")

    # Fork
    pid = os.fork()

    if pid == 0:
        # Child process
        print(f"[Child PID {os.getpid()}] Started after fork")

        # Verify pthread_atfork reset worked
        free_slots = debug_context_array_free_slots_number()
        print(f"[Child] Free slots: {free_slots}")

        if free_slots > 0:
            print("[Child] ✅ Context slots were reset (pthread_atfork worked!)")
            os._exit(0)  # Success
        else:
            print("[Child] ❌ Context slots NOT reset")
            os._exit(1)  # Failure
    else:
        # Parent waits for child
        _, status = os.waitpid(pid, 0)
        exit_code = os.WEXITSTATUS(status)

        if exit_code == 0:
            print(f"[Parent] ✅ Child exited cleanly - Fork safety verified!")
            return 0
        else:
            print(f"[Parent] ❌ Child failed with exit code {exit_code}")
            return 1

if __name__ == "__main__":
    exit(main())
```

**Run with ASAN:**
```bash
LD_PRELOAD=$(gcc -print-file-name=libasan.so) \
ASAN_OPTIONS="detect_leaks=0:symbolize=1:abort_on_error=0" \
python3 test_fork_asan.py
```

**Expected output (success):**
```
[Parent PID 12345] Initializing IAST...
[Parent] Context created: 0
[Parent] Tainted objects: 10
[Child PID 12346] Started after fork
[Child] Free slots: 2
[Child] ✅ Context slots were reset (pthread_atfork worked!)
[Parent] ✅ Child exited cleanly - Fork safety verified!
```

**What ASAN would report WITHOUT this fix:**
```
==12346==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000040
==12346==The signal is caused by a READ memory access.
    #0 0x7f... in get_tainted_object_map_by_ctx_id
    #1 0x7f... in debug_context_array_free_slots_number
```

(cherry picked from commit d1b4fd8)
avara1986 added a commit that referenced this pull request Dec 9, 2025
IAST-enabled applications using Gunicorn/Uvicorn workers were
experiencing segmentation faults (~33% crash rate on MCP streaming
requests) due to memory corruption when processes fork.

- C++ global singletons (`taint_engine_context`, `initializer`)
initialized at module load
- Taint maps storing PyObject pointers by memory address
- Child processes after fork inherited stale pointers from parent
process memory
- Accessing these stale pointers → use-after-free → SIGSEGV crash

- Implemented `pthread_atfork` handler that automatically resets C++
global state in child processes after every fork:
- Added comprehensive null-check wrappers around all native functions to
prevent crashes when native state is
- Fixed test regression issues where context slots weren't being freed:

**[AddressSanitizer
(ASAN)](https://github.com/google/sanitizers/wiki/AddressSanitizer)** is
a fast memory error detector that catches use-after-free, buffer
overflows, and other memory corruption bugs at runtime.

**1. Runtime Environment (No Recompilation Required)**

The simplest way to test is using LD_PRELOAD with the system's libasan:

```bash
ASAN_LIB=$(gcc -print-file-name=libasan.so)

LD_PRELOAD=$ASAN_LIB \
ASAN_OPTIONS="detect_leaks=0:symbolize=1:abort_on_error=0" \
python3 -m pytest tests/appsec/iast/test_fork_handler_regression.py -v
```
**ASAN_OPTIONS explained:**
- `detect_leaks=0` - Disable leak detection (Python has many false
positives)
- `symbolize=1` - Show human-readable stack traces
- `abort_on_error=0` - Continue after first error (collect all errors)

**2. Build with ASAN (Optional, for deeper analysis)**

For more thorough testing, compile the native extension with ASAN:

```bash
export CFLAGS="-fsanitize=address -fno-omit-frame-pointer -g"
export CXXFLAGS="-fsanitize=address -fno-omit-frame-pointer -g"
export LDFLAGS="-fsanitize=address"

pip install --no-build-isolation --force-reinstall -e .

ASAN_OPTIONS="detect_leaks=0:symbolize=1:abort_on_error=0" \
python3 -m pytest tests/appsec/iast/test_fork_handler_regression.py -v
```

This script demonstrates the fork safety fix and can be used to verify
ASAN finds no errors:

```python
"""Minimal fork safety reproduction test for ASAN verification."""
import os
from ddtrace.appsec._iast._taint_tracking import OriginType
from ddtrace.appsec._iast._taint_tracking._native import initialize_native_state
from ddtrace.appsec._iast._taint_tracking._taint_objects import taint_pyobject
from ddtrace.appsec._iast._taint_tracking._context import (
    start_request_context,
    debug_context_array_free_slots_number,
    debug_num_tainted_objects
)

def main():
    print(f"[Parent PID {os.getpid()}] Initializing IAST...")

    # Initialize native state
    initialize_native_state()

    # Create context and tainted objects in parent
    ctx_id = start_request_context()
    print(f"[Parent] Context created: {ctx_id}")

    # Create some tainted objects (populates native maps)
    for i in range(10):
        taint_pyobject(f"data_{i}", "source", f"value_{i}", OriginType.PARAMETER)

    tainted_count = debug_num_tainted_objects(ctx_id)
    print(f"[Parent] Tainted objects: {tainted_count}")

    # Fork
    pid = os.fork()

    if pid == 0:
        # Child process
        print(f"[Child PID {os.getpid()}] Started after fork")

        # Verify pthread_atfork reset worked
        free_slots = debug_context_array_free_slots_number()
        print(f"[Child] Free slots: {free_slots}")

        if free_slots > 0:
            print("[Child] ✅ Context slots were reset (pthread_atfork worked!)")
            os._exit(0)  # Success
        else:
            print("[Child] ❌ Context slots NOT reset")
            os._exit(1)  # Failure
    else:
        # Parent waits for child
        _, status = os.waitpid(pid, 0)
        exit_code = os.WEXITSTATUS(status)

        if exit_code == 0:
            print(f"[Parent] ✅ Child exited cleanly - Fork safety verified!")
            return 0
        else:
            print(f"[Parent] ❌ Child failed with exit code {exit_code}")
            return 1

if __name__ == "__main__":
    exit(main())
```

**Run with ASAN:**
```bash
LD_PRELOAD=$(gcc -print-file-name=libasan.so) \
ASAN_OPTIONS="detect_leaks=0:symbolize=1:abort_on_error=0" \
python3 test_fork_asan.py
```

**Expected output (success):**
```
[Parent PID 12345] Initializing IAST...
[Parent] Context created: 0
[Parent] Tainted objects: 10
[Child PID 12346] Started after fork
[Child] Free slots: 2
[Child] ✅ Context slots were reset (pthread_atfork worked!)
[Parent] ✅ Child exited cleanly - Fork safety verified!
```

**What ASAN would report WITHOUT this fix:**
```
==12346==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000040
==12346==The signal is caused by a READ memory access.
    #0 0x7f... in get_tainted_object_map_by_ctx_id
    #1 0x7f... in debug_context_array_free_slots_number
```

(cherry picked from commit d1b4fd8)
christophe-papazian pushed a commit that referenced this pull request Dec 11, 2025
…t 3.19] (#15565)

Backport
d1b4fd8
from #15514 to 3.19.

----
IAST-enabled applications using Gunicorn/Uvicorn workers were
experiencing segmentation faults (~33% crash rate on MCP streaming
requests) due to memory corruption when processes fork.

- C++ global singletons (`taint_engine_context`, `initializer`)
initialized at module load
- Taint maps storing PyObject pointers by memory address
- Child processes after fork inherited stale pointers from parent
process memory
- Accessing these stale pointers → use-after-free → SIGSEGV crash

- Implemented `pthread_atfork` handler that automatically resets C++
global state in child processes after every fork:
- Added comprehensive null-check wrappers around all native functions to
prevent crashes when native state is
- Fixed test regression issues where context slots weren't being freed:

**[AddressSanitizer
(ASAN)](https://github.com/google/sanitizers/wiki/AddressSanitizer)** is
a fast memory error detector that catches use-after-free, buffer
overflows, and other memory corruption bugs at runtime.

**1. Runtime Environment (No Recompilation Required)**

The simplest way to test is using LD_PRELOAD with the system's libasan:

```bash
ASAN_LIB=$(gcc -print-file-name=libasan.so)

LD_PRELOAD=$ASAN_LIB \
ASAN_OPTIONS="detect_leaks=0:symbolize=1:abort_on_error=0" \
python3 -m pytest tests/appsec/iast/test_fork_handler_regression.py -v
```
**ASAN_OPTIONS explained:**
- `detect_leaks=0` - Disable leak detection (Python has many false
positives)
- `symbolize=1` - Show human-readable stack traces
- `abort_on_error=0` - Continue after first error (collect all errors)

**2. Build with ASAN (Optional, for deeper analysis)**

For more thorough testing, compile the native extension with ASAN:

```bash
export CFLAGS="-fsanitize=address -fno-omit-frame-pointer -g"
export CXXFLAGS="-fsanitize=address -fno-omit-frame-pointer -g"
export LDFLAGS="-fsanitize=address"

pip install --no-build-isolation --force-reinstall -e .

ASAN_OPTIONS="detect_leaks=0:symbolize=1:abort_on_error=0" \
python3 -m pytest tests/appsec/iast/test_fork_handler_regression.py -v
```

This script demonstrates the fork safety fix and can be used to verify
ASAN finds no errors:

```python
"""Minimal fork safety reproduction test for ASAN verification."""
import os
from ddtrace.appsec._iast._taint_tracking import OriginType
from ddtrace.appsec._iast._taint_tracking._native import initialize_native_state
from ddtrace.appsec._iast._taint_tracking._taint_objects import taint_pyobject
from ddtrace.appsec._iast._taint_tracking._context import (
    start_request_context,
    debug_context_array_free_slots_number,
    debug_num_tainted_objects
)

def main():
    print(f"[Parent PID {os.getpid()}] Initializing IAST...")

    # Initialize native state
    initialize_native_state()

    # Create context and tainted objects in parent
    ctx_id = start_request_context()
    print(f"[Parent] Context created: {ctx_id}")

    # Create some tainted objects (populates native maps)
    for i in range(10):
        taint_pyobject(f"data_{i}", "source", f"value_{i}", OriginType.PARAMETER)

    tainted_count = debug_num_tainted_objects(ctx_id)
    print(f"[Parent] Tainted objects: {tainted_count}")

    # Fork
    pid = os.fork()

    if pid == 0:
        # Child process
        print(f"[Child PID {os.getpid()}] Started after fork")

        # Verify pthread_atfork reset worked
        free_slots = debug_context_array_free_slots_number()
        print(f"[Child] Free slots: {free_slots}")

        if free_slots > 0:
            print("[Child] ✅ Context slots were reset (pthread_atfork worked!)")
            os._exit(0)  # Success
        else:
            print("[Child] ❌ Context slots NOT reset")
            os._exit(1)  # Failure
    else:
        # Parent waits for child
        _, status = os.waitpid(pid, 0)
        exit_code = os.WEXITSTATUS(status)

        if exit_code == 0:
            print(f"[Parent] ✅ Child exited cleanly - Fork safety verified!")
            return 0
        else:
            print(f"[Parent] ❌ Child failed with exit code {exit_code}")
            return 1

if __name__ == "__main__":
    exit(main())
```

**Run with ASAN:**
```bash
LD_PRELOAD=$(gcc -print-file-name=libasan.so) \
ASAN_OPTIONS="detect_leaks=0:symbolize=1:abort_on_error=0" \
python3 test_fork_asan.py
```

**Expected output (success):**
```
[Parent PID 12345] Initializing IAST...
[Parent] Context created: 0
[Parent] Tainted objects: 10
[Child PID 12346] Started after fork
[Child] Free slots: 2
[Child] ✅ Context slots were reset (pthread_atfork worked!)
[Parent] ✅ Child exited cleanly - Fork safety verified!
```

**What ASAN would report WITHOUT this fix:**
```
==12346==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000040
==12346==The signal is caused by a READ memory access.
    #0 0x7f... in get_tainted_object_map_by_ctx_id
    #1 0x7f... in debug_context_array_free_slots_number
```

(cherry picked from commit d1b4fd8)

## Description

<!-- Provide an overview of the change and motivation for the change -->

## Testing

<!-- Describe your testing strategy or note what tests are included -->

## Risks

<!-- Note any risks associated with this change, or "None" if no risks
-->

## Additional Notes

<!-- Any other information that would be helpful for reviewers -->
avara1986 added a commit that referenced this pull request Dec 12, 2025
…t 4.0] (#15566)

Backport
d1b4fd8
from #15514 to 4.0.

----
IAST-enabled applications using Gunicorn/Uvicorn workers were
experiencing segmentation faults (~33% crash rate on MCP streaming
requests) due to memory corruption when processes fork.

- C++ global singletons (`taint_engine_context`, `initializer`)
initialized at module load
- Taint maps storing PyObject pointers by memory address
- Child processes after fork inherited stale pointers from parent
process memory
- Accessing these stale pointers → use-after-free → SIGSEGV crash

- Implemented `pthread_atfork` handler that automatically resets C++
global state in child processes after every fork:
- Added comprehensive null-check wrappers around all native functions to
prevent crashes when native state is
- Fixed test regression issues where context slots weren't being freed:

**[AddressSanitizer
(ASAN)](https://github.com/google/sanitizers/wiki/AddressSanitizer)** is
a fast memory error detector that catches use-after-free, buffer
overflows, and other memory corruption bugs at runtime.

**1. Runtime Environment (No Recompilation Required)**

The simplest way to test is using LD_PRELOAD with the system's libasan:

```bash
ASAN_LIB=$(gcc -print-file-name=libasan.so)

LD_PRELOAD=$ASAN_LIB \
ASAN_OPTIONS="detect_leaks=0:symbolize=1:abort_on_error=0" \
python3 -m pytest tests/appsec/iast/test_fork_handler_regression.py -v
```
**ASAN_OPTIONS explained:**
- `detect_leaks=0` - Disable leak detection (Python has many false
positives)
- `symbolize=1` - Show human-readable stack traces
- `abort_on_error=0` - Continue after first error (collect all errors)

**2. Build with ASAN (Optional, for deeper analysis)**

For more thorough testing, compile the native extension with ASAN:

```bash
export CFLAGS="-fsanitize=address -fno-omit-frame-pointer -g"
export CXXFLAGS="-fsanitize=address -fno-omit-frame-pointer -g"
export LDFLAGS="-fsanitize=address"

pip install --no-build-isolation --force-reinstall -e .

ASAN_OPTIONS="detect_leaks=0:symbolize=1:abort_on_error=0" \
python3 -m pytest tests/appsec/iast/test_fork_handler_regression.py -v
```

This script demonstrates the fork safety fix and can be used to verify
ASAN finds no errors:

```python
"""Minimal fork safety reproduction test for ASAN verification."""
import os
from ddtrace.appsec._iast._taint_tracking import OriginType
from ddtrace.appsec._iast._taint_tracking._native import initialize_native_state
from ddtrace.appsec._iast._taint_tracking._taint_objects import taint_pyobject
from ddtrace.appsec._iast._taint_tracking._context import (
    start_request_context,
    debug_context_array_free_slots_number,
    debug_num_tainted_objects
)

def main():
    print(f"[Parent PID {os.getpid()}] Initializing IAST...")

    # Initialize native state
    initialize_native_state()

    # Create context and tainted objects in parent
    ctx_id = start_request_context()
    print(f"[Parent] Context created: {ctx_id}")

    # Create some tainted objects (populates native maps)
    for i in range(10):
        taint_pyobject(f"data_{i}", "source", f"value_{i}", OriginType.PARAMETER)

    tainted_count = debug_num_tainted_objects(ctx_id)
    print(f"[Parent] Tainted objects: {tainted_count}")

    # Fork
    pid = os.fork()

    if pid == 0:
        # Child process
        print(f"[Child PID {os.getpid()}] Started after fork")

        # Verify pthread_atfork reset worked
        free_slots = debug_context_array_free_slots_number()
        print(f"[Child] Free slots: {free_slots}")

        if free_slots > 0:
            print("[Child] ✅ Context slots were reset (pthread_atfork worked!)")
            os._exit(0)  # Success
        else:
            print("[Child] ❌ Context slots NOT reset")
            os._exit(1)  # Failure
    else:
        # Parent waits for child
        _, status = os.waitpid(pid, 0)
        exit_code = os.WEXITSTATUS(status)

        if exit_code == 0:
            print(f"[Parent] ✅ Child exited cleanly - Fork safety verified!")
            return 0
        else:
            print(f"[Parent] ❌ Child failed with exit code {exit_code}")
            return 1

if __name__ == "__main__":
    exit(main())
```

**Run with ASAN:**
```bash
LD_PRELOAD=$(gcc -print-file-name=libasan.so) \
ASAN_OPTIONS="detect_leaks=0:symbolize=1:abort_on_error=0" \
python3 test_fork_asan.py
```

**Expected output (success):**
```
[Parent PID 12345] Initializing IAST...
[Parent] Context created: 0
[Parent] Tainted objects: 10
[Child PID 12346] Started after fork
[Child] Free slots: 2
[Child] ✅ Context slots were reset (pthread_atfork worked!)
[Parent] ✅ Child exited cleanly - Fork safety verified!
```

**What ASAN would report WITHOUT this fix:**
```
==12346==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000040
==12346==The signal is caused by a READ memory access.
    #0 0x7f... in get_tainted_object_map_by_ctx_id
    #1 0x7f... in debug_context_array_free_slots_number
```

(cherry picked from commit d1b4fd8)

## Description

<!-- Provide an overview of the change and motivation for the change -->

## Testing

<!-- Describe your testing strategy or note what tests are included -->

## Risks

<!-- Note any risks associated with this change, or "None" if no risks
-->

## Additional Notes

<!-- Any other information that would be helpful for reviewers -->
KowalskiThomas added a commit that referenced this pull request Jan 6, 2026
## Description

https://datadoghq.atlassian.net/browse/PROF-13112

This is an attempt to address the following crash. There seems to be a
case (that I wasn't able to reproduce in a Docker image, but maybe my
"code environment" didn't match the customer's exactly) where using
`uvloop` results in a crash caused by `PeriodicThread_start` after
`uvloop` tries to restart Threads after a fork.

```
#0   0x00007f9a7acdbefa cfree 
#1   0x00007f9a7accc6b5 pthread_create 
#2   0x00007f9a7a63aaa5 std::thread::_M_start_thread 
#3   0x00007f9a7a639d18 PeriodicThread_start 
#4   0x00007f9a2e71d565 __pyx_f_6uvloop_4loop_9UVProcess__after_fork (uvloop/loop.c:120214:3)
#5   0x00007f9a2e6369a8 __pyx_f_6uvloop_4loop___get_fork_handler (uvloop/loop.c:163075:24)
#6   0x00007f9a7ad17073 __fork 
#7   0x00007f9a2e732d62 uv__spawn_and_init_child_fork (src/unix/process.c:831:10)
#8   0x00007f9a2e732d62 uv__spawn_and_init_child (src/unix/process.c:919:9)
#9   0x00007f9a2e732d62 uv_spawn (src/unix/process.c:1013:18)
#10  0x00007f9a2e71fb87 __pyx_f_6uvloop_4loop_9UVProcess__init (uvloop/loop.c:119056:19)
#11  0x00007f9a2e711bf7 __pyx_f_6uvloop_4loop_18UVProcessTransport_new (uvloop/loop.c:126866:16)
#12  0x00007f9a2e712aa7 __pyx_gb_6uvloop_4loop_4Loop_116generator16 (uvloop/loop.c:54030:28)
#13  0x00007f9a2e631419 __Pyx_Coroutine_SendEx (uvloop/loop.c:196315:14)
#14  0x00007f9a2e699f8a __Pyx_Coroutine_AmSend (uvloop/loop.c:196492:18)
#15  0x00007f9a2e69a052 __Pyx_Coroutine_Yield_From_Coroutine (uvloop/loop.c:197380:14)
#16  0x00007f9a2e69b0e5 __Pyx_Coroutine_Yield_From (uvloop/loop.c:197408:16)
#17  0x00007f9a2e69b0e5 __pyx_gb_6uvloop_4loop_4Loop_122generator18 (uvloop/loop.c:55002:15)
#18  0x00007f9a2e631419 __Pyx_Coroutine_SendEx (uvloop/loop.c:196315:14)
#19  0x00007f9a2e69bb86 __Pyx_Generator_Next (uvloop/loop.c:196581:18)
#20  0x00007f9a2e6398eb __Pyx_PyObject_Call (uvloop/loop.c:191431:15)
#21  0x00007f9a2e6398eb __Pyx_PyObject_FastCallDict (uvloop/loop.c:191552:16)
#22  0x00007f9a2e715a69 __pyx_f_6uvloop_4loop_6Handle__run (uvloop/loop.c:66873:27)
#23  0x00007f9a2e71996b __pyx_f_6uvloop_4loop_4Loop__on_idle (uvloop/loop.c:17975:25)
#24  0x00007f9a2e713e52 __pyx_f_6uvloop_4loop_6Handle__run (uvloop/loop.c:66927:24)
#25  0x00007f9a2e715c88 __pyx_f_6uvloop_4loop_cb_idle_callback (uvloop/loop.c:87335:19)
#26  0x00007f9a2e731311 uv__run_idle (unix/loop-watcher.c:68:1)
#27  0x00007f9a2e72e647 uv_run (src/unix/core.c:439:5)
#28  0x00007f9a2e64fdb5 __pyx_f_6uvloop_4loop_4Loop__Loop__run (uvloop/loop.c:18458:23)
#29  0x00007f9a2e6b7e50 __pyx_f_6uvloop_4loop_4Loop__run (uvloop/loop.c:18876:18)
#30  0x00007f9a2e6c8cf0 __pyx_pf_6uvloop_4loop_4Loop_24run_forever (uvloop/loop.c:31528:18)
#31  0x00007f9a2e6c8cf0 __pyx_pw_6uvloop_4loop_4Loop_25run_forever (uvloop/loop.c:31331:13)
#32  0x00007f9a7b065c25 PyObject_VectorcallMethod 
#33  0x00007f9a2e6ccd60 __pyx_pf_6uvloop_4loop_4Loop_44run_until_complete (uvloop/loop.c:33768:23)
#34  0x00007f9a2e6ce591 __pyx_pw_6uvloop_4loop_4Loop_45run_until_complete (uvloop/loop.c:33318:13)
#35  0x00007f9a7b039358 PyObject_Vectorcall 
```

## Fix

The `_after_fork` boolean field marks that this thread object is in a
"post-fork zombie state." When the flag is set to true, Thread methods
(e.g. `join`) become no-ops because the threads do not exist anymore so
we should not try to do something with them. By checking that same flag,
we can tell that we are trying to start a Thread that doesn't really
exist and so we shouldn't try to do it.
dd-octo-sts bot pushed a commit that referenced this pull request Jan 6, 2026
## Description

https://datadoghq.atlassian.net/browse/PROF-13112

This is an attempt to address the following crash. There seems to be a
case (that I wasn't able to reproduce in a Docker image, but maybe my
"code environment" didn't match the customer's exactly) where using
`uvloop` results in a crash caused by `PeriodicThread_start` after
`uvloop` tries to restart Threads after a fork.

```
#0   0x00007f9a7acdbefa cfree
#1   0x00007f9a7accc6b5 pthread_create
#2   0x00007f9a7a63aaa5 std::thread::_M_start_thread
#3   0x00007f9a7a639d18 PeriodicThread_start
#4   0x00007f9a2e71d565 __pyx_f_6uvloop_4loop_9UVProcess__after_fork (uvloop/loop.c:120214:3)
#5   0x00007f9a2e6369a8 __pyx_f_6uvloop_4loop___get_fork_handler (uvloop/loop.c:163075:24)
#6   0x00007f9a7ad17073 __fork
#7   0x00007f9a2e732d62 uv__spawn_and_init_child_fork (src/unix/process.c:831:10)
#8   0x00007f9a2e732d62 uv__spawn_and_init_child (src/unix/process.c:919:9)
#9   0x00007f9a2e732d62 uv_spawn (src/unix/process.c:1013:18)
#10  0x00007f9a2e71fb87 __pyx_f_6uvloop_4loop_9UVProcess__init (uvloop/loop.c:119056:19)
#11  0x00007f9a2e711bf7 __pyx_f_6uvloop_4loop_18UVProcessTransport_new (uvloop/loop.c:126866:16)
#12  0x00007f9a2e712aa7 __pyx_gb_6uvloop_4loop_4Loop_116generator16 (uvloop/loop.c:54030:28)
#13  0x00007f9a2e631419 __Pyx_Coroutine_SendEx (uvloop/loop.c:196315:14)
#14  0x00007f9a2e699f8a __Pyx_Coroutine_AmSend (uvloop/loop.c:196492:18)
#15  0x00007f9a2e69a052 __Pyx_Coroutine_Yield_From_Coroutine (uvloop/loop.c:197380:14)
#16  0x00007f9a2e69b0e5 __Pyx_Coroutine_Yield_From (uvloop/loop.c:197408:16)
#17  0x00007f9a2e69b0e5 __pyx_gb_6uvloop_4loop_4Loop_122generator18 (uvloop/loop.c:55002:15)
#18  0x00007f9a2e631419 __Pyx_Coroutine_SendEx (uvloop/loop.c:196315:14)
#19  0x00007f9a2e69bb86 __Pyx_Generator_Next (uvloop/loop.c:196581:18)
#20  0x00007f9a2e6398eb __Pyx_PyObject_Call (uvloop/loop.c:191431:15)
#21  0x00007f9a2e6398eb __Pyx_PyObject_FastCallDict (uvloop/loop.c:191552:16)
#22  0x00007f9a2e715a69 __pyx_f_6uvloop_4loop_6Handle__run (uvloop/loop.c:66873:27)
#23  0x00007f9a2e71996b __pyx_f_6uvloop_4loop_4Loop__on_idle (uvloop/loop.c:17975:25)
#24  0x00007f9a2e713e52 __pyx_f_6uvloop_4loop_6Handle__run (uvloop/loop.c:66927:24)
#25  0x00007f9a2e715c88 __pyx_f_6uvloop_4loop_cb_idle_callback (uvloop/loop.c:87335:19)
#26  0x00007f9a2e731311 uv__run_idle (unix/loop-watcher.c:68:1)
#27  0x00007f9a2e72e647 uv_run (src/unix/core.c:439:5)
#28  0x00007f9a2e64fdb5 __pyx_f_6uvloop_4loop_4Loop__Loop__run (uvloop/loop.c:18458:23)
#29  0x00007f9a2e6b7e50 __pyx_f_6uvloop_4loop_4Loop__run (uvloop/loop.c:18876:18)
#30  0x00007f9a2e6c8cf0 __pyx_pf_6uvloop_4loop_4Loop_24run_forever (uvloop/loop.c:31528:18)
#31  0x00007f9a2e6c8cf0 __pyx_pw_6uvloop_4loop_4Loop_25run_forever (uvloop/loop.c:31331:13)
#32  0x00007f9a7b065c25 PyObject_VectorcallMethod
#33  0x00007f9a2e6ccd60 __pyx_pf_6uvloop_4loop_4Loop_44run_until_complete (uvloop/loop.c:33768:23)
#34  0x00007f9a2e6ce591 __pyx_pw_6uvloop_4loop_4Loop_45run_until_complete (uvloop/loop.c:33318:13)
#35  0x00007f9a7b039358 PyObject_Vectorcall
```

## Fix

The `_after_fork` boolean field marks that this thread object is in a
"post-fork zombie state." When the flag is set to true, Thread methods
(e.g. `join`) become no-ops because the threads do not exist anymore so
we should not try to do something with them. By checking that same flag,
we can tell that we are trying to start a Thread that doesn't really
exist and so we shouldn't try to do it.

(cherry picked from commit 4c69fdd)
KowalskiThomas added a commit that referenced this pull request Jan 6, 2026
## Description

https://datadoghq.atlassian.net/browse/PROF-13112

This is an attempt to address the following crash. There seems to be a
case (that I wasn't able to reproduce in a Docker image, but maybe my
"code environment" didn't match the customer's exactly) where using
`uvloop` results in a crash caused by `PeriodicThread_start` after
`uvloop` tries to restart Threads after a fork.

```
#0   0x00007f9a7acdbefa cfree
#1   0x00007f9a7accc6b5 pthread_create
#2   0x00007f9a7a63aaa5 std::thread::_M_start_thread
#3   0x00007f9a7a639d18 PeriodicThread_start
#4   0x00007f9a2e71d565 __pyx_f_6uvloop_4loop_9UVProcess__after_fork (uvloop/loop.c:120214:3)
#5   0x00007f9a2e6369a8 __pyx_f_6uvloop_4loop___get_fork_handler (uvloop/loop.c:163075:24)
#6   0x00007f9a7ad17073 __fork
#7   0x00007f9a2e732d62 uv__spawn_and_init_child_fork (src/unix/process.c:831:10)
#8   0x00007f9a2e732d62 uv__spawn_and_init_child (src/unix/process.c:919:9)
#9   0x00007f9a2e732d62 uv_spawn (src/unix/process.c:1013:18)
#10  0x00007f9a2e71fb87 __pyx_f_6uvloop_4loop_9UVProcess__init (uvloop/loop.c:119056:19)
#11  0x00007f9a2e711bf7 __pyx_f_6uvloop_4loop_18UVProcessTransport_new (uvloop/loop.c:126866:16)
#12  0x00007f9a2e712aa7 __pyx_gb_6uvloop_4loop_4Loop_116generator16 (uvloop/loop.c:54030:28)
#13  0x00007f9a2e631419 __Pyx_Coroutine_SendEx (uvloop/loop.c:196315:14)
#14  0x00007f9a2e699f8a __Pyx_Coroutine_AmSend (uvloop/loop.c:196492:18)
#15  0x00007f9a2e69a052 __Pyx_Coroutine_Yield_From_Coroutine (uvloop/loop.c:197380:14)
#16  0x00007f9a2e69b0e5 __Pyx_Coroutine_Yield_From (uvloop/loop.c:197408:16)
#17  0x00007f9a2e69b0e5 __pyx_gb_6uvloop_4loop_4Loop_122generator18 (uvloop/loop.c:55002:15)
#18  0x00007f9a2e631419 __Pyx_Coroutine_SendEx (uvloop/loop.c:196315:14)
#19  0x00007f9a2e69bb86 __Pyx_Generator_Next (uvloop/loop.c:196581:18)
#20  0x00007f9a2e6398eb __Pyx_PyObject_Call (uvloop/loop.c:191431:15)
#21  0x00007f9a2e6398eb __Pyx_PyObject_FastCallDict (uvloop/loop.c:191552:16)
#22  0x00007f9a2e715a69 __pyx_f_6uvloop_4loop_6Handle__run (uvloop/loop.c:66873:27)
#23  0x00007f9a2e71996b __pyx_f_6uvloop_4loop_4Loop__on_idle (uvloop/loop.c:17975:25)
#24  0x00007f9a2e713e52 __pyx_f_6uvloop_4loop_6Handle__run (uvloop/loop.c:66927:24)
#25  0x00007f9a2e715c88 __pyx_f_6uvloop_4loop_cb_idle_callback (uvloop/loop.c:87335:19)
#26  0x00007f9a2e731311 uv__run_idle (unix/loop-watcher.c:68:1)
#27  0x00007f9a2e72e647 uv_run (src/unix/core.c:439:5)
#28  0x00007f9a2e64fdb5 __pyx_f_6uvloop_4loop_4Loop__Loop__run (uvloop/loop.c:18458:23)
#29  0x00007f9a2e6b7e50 __pyx_f_6uvloop_4loop_4Loop__run (uvloop/loop.c:18876:18)
#30  0x00007f9a2e6c8cf0 __pyx_pf_6uvloop_4loop_4Loop_24run_forever (uvloop/loop.c:31528:18)
#31  0x00007f9a2e6c8cf0 __pyx_pw_6uvloop_4loop_4Loop_25run_forever (uvloop/loop.c:31331:13)
#32  0x00007f9a7b065c25 PyObject_VectorcallMethod
#33  0x00007f9a2e6ccd60 __pyx_pf_6uvloop_4loop_4Loop_44run_until_complete (uvloop/loop.c:33768:23)
#34  0x00007f9a2e6ce591 __pyx_pw_6uvloop_4loop_4Loop_45run_until_complete (uvloop/loop.c:33318:13)
#35  0x00007f9a7b039358 PyObject_Vectorcall
```

## Fix

The `_after_fork` boolean field marks that this thread object is in a
"post-fork zombie state." When the flag is set to true, Thread methods
(e.g. `join`) become no-ops because the threads do not exist anymore so
we should not try to do something with them. By checking that same flag,
we can tell that we are trying to start a Thread that doesn't really
exist and so we shouldn't try to do it.

(cherry picked from commit 4c69fdd)
dd-octo-sts bot pushed a commit that referenced this pull request Jan 6, 2026
## Description

https://datadoghq.atlassian.net/browse/PROF-13112

This is an attempt to address the following crash. There seems to be a
case (that I wasn't able to reproduce in a Docker image, but maybe my
"code environment" didn't match the customer's exactly) where using
`uvloop` results in a crash caused by `PeriodicThread_start` after
`uvloop` tries to restart Threads after a fork.

```
#0   0x00007f9a7acdbefa cfree
#1   0x00007f9a7accc6b5 pthread_create
#2   0x00007f9a7a63aaa5 std::thread::_M_start_thread
#3   0x00007f9a7a639d18 PeriodicThread_start
#4   0x00007f9a2e71d565 __pyx_f_6uvloop_4loop_9UVProcess__after_fork (uvloop/loop.c:120214:3)
#5   0x00007f9a2e6369a8 __pyx_f_6uvloop_4loop___get_fork_handler (uvloop/loop.c:163075:24)
#6   0x00007f9a7ad17073 __fork
#7   0x00007f9a2e732d62 uv__spawn_and_init_child_fork (src/unix/process.c:831:10)
#8   0x00007f9a2e732d62 uv__spawn_and_init_child (src/unix/process.c:919:9)
#9   0x00007f9a2e732d62 uv_spawn (src/unix/process.c:1013:18)
#10  0x00007f9a2e71fb87 __pyx_f_6uvloop_4loop_9UVProcess__init (uvloop/loop.c:119056:19)
#11  0x00007f9a2e711bf7 __pyx_f_6uvloop_4loop_18UVProcessTransport_new (uvloop/loop.c:126866:16)
#12  0x00007f9a2e712aa7 __pyx_gb_6uvloop_4loop_4Loop_116generator16 (uvloop/loop.c:54030:28)
#13  0x00007f9a2e631419 __Pyx_Coroutine_SendEx (uvloop/loop.c:196315:14)
#14  0x00007f9a2e699f8a __Pyx_Coroutine_AmSend (uvloop/loop.c:196492:18)
#15  0x00007f9a2e69a052 __Pyx_Coroutine_Yield_From_Coroutine (uvloop/loop.c:197380:14)
#16  0x00007f9a2e69b0e5 __Pyx_Coroutine_Yield_From (uvloop/loop.c:197408:16)
#17  0x00007f9a2e69b0e5 __pyx_gb_6uvloop_4loop_4Loop_122generator18 (uvloop/loop.c:55002:15)
#18  0x00007f9a2e631419 __Pyx_Coroutine_SendEx (uvloop/loop.c:196315:14)
#19  0x00007f9a2e69bb86 __Pyx_Generator_Next (uvloop/loop.c:196581:18)
#20  0x00007f9a2e6398eb __Pyx_PyObject_Call (uvloop/loop.c:191431:15)
#21  0x00007f9a2e6398eb __Pyx_PyObject_FastCallDict (uvloop/loop.c:191552:16)
#22  0x00007f9a2e715a69 __pyx_f_6uvloop_4loop_6Handle__run (uvloop/loop.c:66873:27)
#23  0x00007f9a2e71996b __pyx_f_6uvloop_4loop_4Loop__on_idle (uvloop/loop.c:17975:25)
#24  0x00007f9a2e713e52 __pyx_f_6uvloop_4loop_6Handle__run (uvloop/loop.c:66927:24)
#25  0x00007f9a2e715c88 __pyx_f_6uvloop_4loop_cb_idle_callback (uvloop/loop.c:87335:19)
#26  0x00007f9a2e731311 uv__run_idle (unix/loop-watcher.c:68:1)
#27  0x00007f9a2e72e647 uv_run (src/unix/core.c:439:5)
#28  0x00007f9a2e64fdb5 __pyx_f_6uvloop_4loop_4Loop__Loop__run (uvloop/loop.c:18458:23)
#29  0x00007f9a2e6b7e50 __pyx_f_6uvloop_4loop_4Loop__run (uvloop/loop.c:18876:18)
#30  0x00007f9a2e6c8cf0 __pyx_pf_6uvloop_4loop_4Loop_24run_forever (uvloop/loop.c:31528:18)
#31  0x00007f9a2e6c8cf0 __pyx_pw_6uvloop_4loop_4Loop_25run_forever (uvloop/loop.c:31331:13)
#32  0x00007f9a7b065c25 PyObject_VectorcallMethod
#33  0x00007f9a2e6ccd60 __pyx_pf_6uvloop_4loop_4Loop_44run_until_complete (uvloop/loop.c:33768:23)
#34  0x00007f9a2e6ce591 __pyx_pw_6uvloop_4loop_4Loop_45run_until_complete (uvloop/loop.c:33318:13)
#35  0x00007f9a7b039358 PyObject_Vectorcall
```

## Fix

The `_after_fork` boolean field marks that this thread object is in a
"post-fork zombie state." When the flag is set to true, Thread methods
(e.g. `join`) become no-ops because the threads do not exist anymore so
we should not try to do something with them. By checking that same flag,
we can tell that we are trying to start a Thread that doesn't really
exist and so we shouldn't try to do it.

(cherry picked from commit 4c69fdd)
KowalskiThomas added a commit that referenced this pull request Jan 6, 2026
## Description

https://datadoghq.atlassian.net/browse/PROF-13112

This is an attempt to address the following crash. There seems to be a
case (that I wasn't able to reproduce in a Docker image, but maybe my
"code environment" didn't match the customer's exactly) where using
`uvloop` results in a crash caused by `PeriodicThread_start` after
`uvloop` tries to restart Threads after a fork.

```
#0   0x00007f9a7acdbefa cfree
#1   0x00007f9a7accc6b5 pthread_create
#2   0x00007f9a7a63aaa5 std::thread::_M_start_thread
#3   0x00007f9a7a639d18 PeriodicThread_start
#4   0x00007f9a2e71d565 __pyx_f_6uvloop_4loop_9UVProcess__after_fork (uvloop/loop.c:120214:3)
#5   0x00007f9a2e6369a8 __pyx_f_6uvloop_4loop___get_fork_handler (uvloop/loop.c:163075:24)
#6   0x00007f9a7ad17073 __fork
#7   0x00007f9a2e732d62 uv__spawn_and_init_child_fork (src/unix/process.c:831:10)
#8   0x00007f9a2e732d62 uv__spawn_and_init_child (src/unix/process.c:919:9)
#9   0x00007f9a2e732d62 uv_spawn (src/unix/process.c:1013:18)
#10  0x00007f9a2e71fb87 __pyx_f_6uvloop_4loop_9UVProcess__init (uvloop/loop.c:119056:19)
#11  0x00007f9a2e711bf7 __pyx_f_6uvloop_4loop_18UVProcessTransport_new (uvloop/loop.c:126866:16)
#12  0x00007f9a2e712aa7 __pyx_gb_6uvloop_4loop_4Loop_116generator16 (uvloop/loop.c:54030:28)
#13  0x00007f9a2e631419 __Pyx_Coroutine_SendEx (uvloop/loop.c:196315:14)
#14  0x00007f9a2e699f8a __Pyx_Coroutine_AmSend (uvloop/loop.c:196492:18)
#15  0x00007f9a2e69a052 __Pyx_Coroutine_Yield_From_Coroutine (uvloop/loop.c:197380:14)
#16  0x00007f9a2e69b0e5 __Pyx_Coroutine_Yield_From (uvloop/loop.c:197408:16)
#17  0x00007f9a2e69b0e5 __pyx_gb_6uvloop_4loop_4Loop_122generator18 (uvloop/loop.c:55002:15)
#18  0x00007f9a2e631419 __Pyx_Coroutine_SendEx (uvloop/loop.c:196315:14)
#19  0x00007f9a2e69bb86 __Pyx_Generator_Next (uvloop/loop.c:196581:18)
#20  0x00007f9a2e6398eb __Pyx_PyObject_Call (uvloop/loop.c:191431:15)
#21  0x00007f9a2e6398eb __Pyx_PyObject_FastCallDict (uvloop/loop.c:191552:16)
#22  0x00007f9a2e715a69 __pyx_f_6uvloop_4loop_6Handle__run (uvloop/loop.c:66873:27)
#23  0x00007f9a2e71996b __pyx_f_6uvloop_4loop_4Loop__on_idle (uvloop/loop.c:17975:25)
#24  0x00007f9a2e713e52 __pyx_f_6uvloop_4loop_6Handle__run (uvloop/loop.c:66927:24)
#25  0x00007f9a2e715c88 __pyx_f_6uvloop_4loop_cb_idle_callback (uvloop/loop.c:87335:19)
#26  0x00007f9a2e731311 uv__run_idle (unix/loop-watcher.c:68:1)
#27  0x00007f9a2e72e647 uv_run (src/unix/core.c:439:5)
#28  0x00007f9a2e64fdb5 __pyx_f_6uvloop_4loop_4Loop__Loop__run (uvloop/loop.c:18458:23)
#29  0x00007f9a2e6b7e50 __pyx_f_6uvloop_4loop_4Loop__run (uvloop/loop.c:18876:18)
#30  0x00007f9a2e6c8cf0 __pyx_pf_6uvloop_4loop_4Loop_24run_forever (uvloop/loop.c:31528:18)
#31  0x00007f9a2e6c8cf0 __pyx_pw_6uvloop_4loop_4Loop_25run_forever (uvloop/loop.c:31331:13)
#32  0x00007f9a7b065c25 PyObject_VectorcallMethod
#33  0x00007f9a2e6ccd60 __pyx_pf_6uvloop_4loop_4Loop_44run_until_complete (uvloop/loop.c:33768:23)
#34  0x00007f9a2e6ce591 __pyx_pw_6uvloop_4loop_4Loop_45run_until_complete (uvloop/loop.c:33318:13)
#35  0x00007f9a7b039358 PyObject_Vectorcall
```

## Fix

The `_after_fork` boolean field marks that this thread object is in a
"post-fork zombie state." When the flag is set to true, Thread methods
(e.g. `join`) become no-ops because the threads do not exist anymore so
we should not try to do something with them. By checking that same flag,
we can tell that we are trying to start a Thread that doesn't really
exist and so we shouldn't try to do it.

(cherry picked from commit 4c69fdd)
KowalskiThomas added a commit that referenced this pull request Jan 7, 2026
## Description

https://datadoghq.atlassian.net/browse/PROF-13112

This is an attempt to address the following crash. There seems to be a
case (that I wasn't able to reproduce in a Docker image, but maybe my
"code environment" didn't match the customer's exactly) where using
`uvloop` results in a crash caused by `PeriodicThread_start` after
`uvloop` tries to restart Threads after a fork.

```
#0   0x00007f9a7acdbefa cfree
#1   0x00007f9a7accc6b5 pthread_create
#2   0x00007f9a7a63aaa5 std::thread::_M_start_thread
#3   0x00007f9a7a639d18 PeriodicThread_start
#4   0x00007f9a2e71d565 __pyx_f_6uvloop_4loop_9UVProcess__after_fork (uvloop/loop.c:120214:3)
#5   0x00007f9a2e6369a8 __pyx_f_6uvloop_4loop___get_fork_handler (uvloop/loop.c:163075:24)
#6   0x00007f9a7ad17073 __fork
#7   0x00007f9a2e732d62 uv__spawn_and_init_child_fork (src/unix/process.c:831:10)
#8   0x00007f9a2e732d62 uv__spawn_and_init_child (src/unix/process.c:919:9)
#9   0x00007f9a2e732d62 uv_spawn (src/unix/process.c:1013:18)
#10  0x00007f9a2e71fb87 __pyx_f_6uvloop_4loop_9UVProcess__init (uvloop/loop.c:119056:19)
#11  0x00007f9a2e711bf7 __pyx_f_6uvloop_4loop_18UVProcessTransport_new (uvloop/loop.c:126866:16)
#12  0x00007f9a2e712aa7 __pyx_gb_6uvloop_4loop_4Loop_116generator16 (uvloop/loop.c:54030:28)
#13  0x00007f9a2e631419 __Pyx_Coroutine_SendEx (uvloop/loop.c:196315:14)
#14  0x00007f9a2e699f8a __Pyx_Coroutine_AmSend (uvloop/loop.c:196492:18)
#15  0x00007f9a2e69a052 __Pyx_Coroutine_Yield_From_Coroutine (uvloop/loop.c:197380:14)
#16  0x00007f9a2e69b0e5 __Pyx_Coroutine_Yield_From (uvloop/loop.c:197408:16)
#17  0x00007f9a2e69b0e5 __pyx_gb_6uvloop_4loop_4Loop_122generator18 (uvloop/loop.c:55002:15)
#18  0x00007f9a2e631419 __Pyx_Coroutine_SendEx (uvloop/loop.c:196315:14)
#19  0x00007f9a2e69bb86 __Pyx_Generator_Next (uvloop/loop.c:196581:18)
#20  0x00007f9a2e6398eb __Pyx_PyObject_Call (uvloop/loop.c:191431:15)
#21  0x00007f9a2e6398eb __Pyx_PyObject_FastCallDict (uvloop/loop.c:191552:16)
#22  0x00007f9a2e715a69 __pyx_f_6uvloop_4loop_6Handle__run (uvloop/loop.c:66873:27)
#23  0x00007f9a2e71996b __pyx_f_6uvloop_4loop_4Loop__on_idle (uvloop/loop.c:17975:25)
#24  0x00007f9a2e713e52 __pyx_f_6uvloop_4loop_6Handle__run (uvloop/loop.c:66927:24)
#25  0x00007f9a2e715c88 __pyx_f_6uvloop_4loop_cb_idle_callback (uvloop/loop.c:87335:19)
#26  0x00007f9a2e731311 uv__run_idle (unix/loop-watcher.c:68:1)
#27  0x00007f9a2e72e647 uv_run (src/unix/core.c:439:5)
#28  0x00007f9a2e64fdb5 __pyx_f_6uvloop_4loop_4Loop__Loop__run (uvloop/loop.c:18458:23)
#29  0x00007f9a2e6b7e50 __pyx_f_6uvloop_4loop_4Loop__run (uvloop/loop.c:18876:18)
#30  0x00007f9a2e6c8cf0 __pyx_pf_6uvloop_4loop_4Loop_24run_forever (uvloop/loop.c:31528:18)
#31  0x00007f9a2e6c8cf0 __pyx_pw_6uvloop_4loop_4Loop_25run_forever (uvloop/loop.c:31331:13)
#32  0x00007f9a7b065c25 PyObject_VectorcallMethod
#33  0x00007f9a2e6ccd60 __pyx_pf_6uvloop_4loop_4Loop_44run_until_complete (uvloop/loop.c:33768:23)
#34  0x00007f9a2e6ce591 __pyx_pw_6uvloop_4loop_4Loop_45run_until_complete (uvloop/loop.c:33318:13)
#35  0x00007f9a7b039358 PyObject_Vectorcall
```

## Fix

The `_after_fork` boolean field marks that this thread object is in a
"post-fork zombie state." When the flag is set to true, Thread methods
(e.g. `join`) become no-ops because the threads do not exist anymore so
we should not try to do something with them. By checking that same flag,
we can tell that we are trying to start a Thread that doesn't really
exist and so we shouldn't try to do it.

(cherry picked from commit 4c69fdd)
KowalskiThomas added a commit that referenced this pull request Jan 7, 2026
…15858)

Backport 4c69fdd from #15798 to 4.1.

## Description

https://datadoghq.atlassian.net/browse/PROF-13112

This is an attempt to address the following crash. There seems to be a
case (that I wasn't able to reproduce in a Docker image, but maybe my
"code environment" didn't match the customer's exactly) where using
`uvloop` results in a crash caused by `PeriodicThread_start` after
`uvloop` tries to restart Threads after a fork.

```
#0   0x00007f9a7acdbefa cfree 
#1   0x00007f9a7accc6b5 pthread_create 
#2   0x00007f9a7a63aaa5 std::thread::_M_start_thread 
#3   0x00007f9a7a639d18 PeriodicThread_start 
#4   0x00007f9a2e71d565 __pyx_f_6uvloop_4loop_9UVProcess__after_fork (uvloop/loop.c:120214:3)
#5   0x00007f9a2e6369a8 __pyx_f_6uvloop_4loop___get_fork_handler (uvloop/loop.c:163075:24)
#6   0x00007f9a7ad17073 __fork 
#7   0x00007f9a2e732d62 uv__spawn_and_init_child_fork (src/unix/process.c:831:10)
#8   0x00007f9a2e732d62 uv__spawn_and_init_child (src/unix/process.c:919:9)
#9   0x00007f9a2e732d62 uv_spawn (src/unix/process.c:1013:18)
#10  0x00007f9a2e71fb87 __pyx_f_6uvloop_4loop_9UVProcess__init (uvloop/loop.c:119056:19)
#11  0x00007f9a2e711bf7 __pyx_f_6uvloop_4loop_18UVProcessTransport_new (uvloop/loop.c:126866:16)
#12  0x00007f9a2e712aa7 __pyx_gb_6uvloop_4loop_4Loop_116generator16 (uvloop/loop.c:54030:28)
#13  0x00007f9a2e631419 __Pyx_Coroutine_SendEx (uvloop/loop.c:196315:14)
#14  0x00007f9a2e699f8a __Pyx_Coroutine_AmSend (uvloop/loop.c:196492:18)
#15  0x00007f9a2e69a052 __Pyx_Coroutine_Yield_From_Coroutine (uvloop/loop.c:197380:14)
#16  0x00007f9a2e69b0e5 __Pyx_Coroutine_Yield_From (uvloop/loop.c:197408:16)
#17  0x00007f9a2e69b0e5 __pyx_gb_6uvloop_4loop_4Loop_122generator18 (uvloop/loop.c:55002:15)
#18  0x00007f9a2e631419 __Pyx_Coroutine_SendEx (uvloop/loop.c:196315:14)
#19  0x00007f9a2e69bb86 __Pyx_Generator_Next (uvloop/loop.c:196581:18)
#20  0x00007f9a2e6398eb __Pyx_PyObject_Call (uvloop/loop.c:191431:15)
#21  0x00007f9a2e6398eb __Pyx_PyObject_FastCallDict (uvloop/loop.c:191552:16)
#22  0x00007f9a2e715a69 __pyx_f_6uvloop_4loop_6Handle__run (uvloop/loop.c:66873:27)
#23  0x00007f9a2e71996b __pyx_f_6uvloop_4loop_4Loop__on_idle (uvloop/loop.c:17975:25)
#24  0x00007f9a2e713e52 __pyx_f_6uvloop_4loop_6Handle__run (uvloop/loop.c:66927:24)
#25  0x00007f9a2e715c88 __pyx_f_6uvloop_4loop_cb_idle_callback (uvloop/loop.c:87335:19)
#26  0x00007f9a2e731311 uv__run_idle (unix/loop-watcher.c:68:1)
#27  0x00007f9a2e72e647 uv_run (src/unix/core.c:439:5)
#28  0x00007f9a2e64fdb5 __pyx_f_6uvloop_4loop_4Loop__Loop__run (uvloop/loop.c:18458:23)
#29  0x00007f9a2e6b7e50 __pyx_f_6uvloop_4loop_4Loop__run (uvloop/loop.c:18876:18)
#30  0x00007f9a2e6c8cf0 __pyx_pf_6uvloop_4loop_4Loop_24run_forever (uvloop/loop.c:31528:18)
#31  0x00007f9a2e6c8cf0 __pyx_pw_6uvloop_4loop_4Loop_25run_forever (uvloop/loop.c:31331:13)
#32  0x00007f9a7b065c25 PyObject_VectorcallMethod 
#33  0x00007f9a2e6ccd60 __pyx_pf_6uvloop_4loop_4Loop_44run_until_complete (uvloop/loop.c:33768:23)
#34  0x00007f9a2e6ce591 __pyx_pw_6uvloop_4loop_4Loop_45run_until_complete (uvloop/loop.c:33318:13)
#35  0x00007f9a7b039358 PyObject_Vectorcall 
```

## Fix

The `_after_fork` boolean field marks that this thread object is in a
"post-fork zombie state." When the flag is set to true, Thread methods
(e.g. `join`) become no-ops because the threads do not exist anymore so
we should not try to do something with them. By checking that same flag,
we can tell that we are trying to start a Thread that doesn't really
exist and so we shouldn't try to do it.

Co-authored-by: Thomas Kowalski <[email protected]>
KowalskiThomas added a commit that referenced this pull request Jan 7, 2026
## Description

https://datadoghq.atlassian.net/browse/PROF-13112

This is an attempt to address the following crash. There seems to be a
case (that I wasn't able to reproduce in a Docker image, but maybe my
"code environment" didn't match the customer's exactly) where using
`uvloop` results in a crash caused by `PeriodicThread_start` after
`uvloop` tries to restart Threads after a fork.

```
#0   0x00007f9a7acdbefa cfree
#1   0x00007f9a7accc6b5 pthread_create
#2   0x00007f9a7a63aaa5 std::thread::_M_start_thread
#3   0x00007f9a7a639d18 PeriodicThread_start
#4   0x00007f9a2e71d565 __pyx_f_6uvloop_4loop_9UVProcess__after_fork (uvloop/loop.c:120214:3)
#5   0x00007f9a2e6369a8 __pyx_f_6uvloop_4loop___get_fork_handler (uvloop/loop.c:163075:24)
#6   0x00007f9a7ad17073 __fork
#7   0x00007f9a2e732d62 uv__spawn_and_init_child_fork (src/unix/process.c:831:10)
#8   0x00007f9a2e732d62 uv__spawn_and_init_child (src/unix/process.c:919:9)
#9   0x00007f9a2e732d62 uv_spawn (src/unix/process.c:1013:18)
#10  0x00007f9a2e71fb87 __pyx_f_6uvloop_4loop_9UVProcess__init (uvloop/loop.c:119056:19)
#11  0x00007f9a2e711bf7 __pyx_f_6uvloop_4loop_18UVProcessTransport_new (uvloop/loop.c:126866:16)
#12  0x00007f9a2e712aa7 __pyx_gb_6uvloop_4loop_4Loop_116generator16 (uvloop/loop.c:54030:28)
#13  0x00007f9a2e631419 __Pyx_Coroutine_SendEx (uvloop/loop.c:196315:14)
#14  0x00007f9a2e699f8a __Pyx_Coroutine_AmSend (uvloop/loop.c:196492:18)
#15  0x00007f9a2e69a052 __Pyx_Coroutine_Yield_From_Coroutine (uvloop/loop.c:197380:14)
#16  0x00007f9a2e69b0e5 __Pyx_Coroutine_Yield_From (uvloop/loop.c:197408:16)
#17  0x00007f9a2e69b0e5 __pyx_gb_6uvloop_4loop_4Loop_122generator18 (uvloop/loop.c:55002:15)
#18  0x00007f9a2e631419 __Pyx_Coroutine_SendEx (uvloop/loop.c:196315:14)
#19  0x00007f9a2e69bb86 __Pyx_Generator_Next (uvloop/loop.c:196581:18)
#20  0x00007f9a2e6398eb __Pyx_PyObject_Call (uvloop/loop.c:191431:15)
#21  0x00007f9a2e6398eb __Pyx_PyObject_FastCallDict (uvloop/loop.c:191552:16)
#22  0x00007f9a2e715a69 __pyx_f_6uvloop_4loop_6Handle__run (uvloop/loop.c:66873:27)
#23  0x00007f9a2e71996b __pyx_f_6uvloop_4loop_4Loop__on_idle (uvloop/loop.c:17975:25)
#24  0x00007f9a2e713e52 __pyx_f_6uvloop_4loop_6Handle__run (uvloop/loop.c:66927:24)
#25  0x00007f9a2e715c88 __pyx_f_6uvloop_4loop_cb_idle_callback (uvloop/loop.c:87335:19)
#26  0x00007f9a2e731311 uv__run_idle (unix/loop-watcher.c:68:1)
#27  0x00007f9a2e72e647 uv_run (src/unix/core.c:439:5)
#28  0x00007f9a2e64fdb5 __pyx_f_6uvloop_4loop_4Loop__Loop__run (uvloop/loop.c:18458:23)
#29  0x00007f9a2e6b7e50 __pyx_f_6uvloop_4loop_4Loop__run (uvloop/loop.c:18876:18)
#30  0x00007f9a2e6c8cf0 __pyx_pf_6uvloop_4loop_4Loop_24run_forever (uvloop/loop.c:31528:18)
#31  0x00007f9a2e6c8cf0 __pyx_pw_6uvloop_4loop_4Loop_25run_forever (uvloop/loop.c:31331:13)
#32  0x00007f9a7b065c25 PyObject_VectorcallMethod
#33  0x00007f9a2e6ccd60 __pyx_pf_6uvloop_4loop_4Loop_44run_until_complete (uvloop/loop.c:33768:23)
#34  0x00007f9a2e6ce591 __pyx_pw_6uvloop_4loop_4Loop_45run_until_complete (uvloop/loop.c:33318:13)
#35  0x00007f9a7b039358 PyObject_Vectorcall
```

## Fix

The `_after_fork` boolean field marks that this thread object is in a
"post-fork zombie state." When the flag is set to true, Thread methods
(e.g. `join`) become no-ops because the threads do not exist anymore so
we should not try to do something with them. By checking that same flag,
we can tell that we are trying to start a Thread that doesn't really
exist and so we shouldn't try to do it.

(cherry picked from commit 4c69fdd)
KowalskiThomas added a commit that referenced this pull request Jan 7, 2026
…15861)

Backport 4c69fdd from #15798 to 4.0.

## Description

https://datadoghq.atlassian.net/browse/PROF-13112

This is an attempt to address the following crash. There seems to be a
case (that I wasn't able to reproduce in a Docker image, but maybe my
"code environment" didn't match the customer's exactly) where using
`uvloop` results in a crash caused by `PeriodicThread_start` after
`uvloop` tries to restart Threads after a fork.

```
#0   0x00007f9a7acdbefa cfree 
#1   0x00007f9a7accc6b5 pthread_create 
#2   0x00007f9a7a63aaa5 std::thread::_M_start_thread 
#3   0x00007f9a7a639d18 PeriodicThread_start 
#4   0x00007f9a2e71d565 __pyx_f_6uvloop_4loop_9UVProcess__after_fork (uvloop/loop.c:120214:3)
#5   0x00007f9a2e6369a8 __pyx_f_6uvloop_4loop___get_fork_handler (uvloop/loop.c:163075:24)
#6   0x00007f9a7ad17073 __fork 
#7   0x00007f9a2e732d62 uv__spawn_and_init_child_fork (src/unix/process.c:831:10)
#8   0x00007f9a2e732d62 uv__spawn_and_init_child (src/unix/process.c:919:9)
#9   0x00007f9a2e732d62 uv_spawn (src/unix/process.c:1013:18)
#10  0x00007f9a2e71fb87 __pyx_f_6uvloop_4loop_9UVProcess__init (uvloop/loop.c:119056:19)
#11  0x00007f9a2e711bf7 __pyx_f_6uvloop_4loop_18UVProcessTransport_new (uvloop/loop.c:126866:16)
#12  0x00007f9a2e712aa7 __pyx_gb_6uvloop_4loop_4Loop_116generator16 (uvloop/loop.c:54030:28)
#13  0x00007f9a2e631419 __Pyx_Coroutine_SendEx (uvloop/loop.c:196315:14)
#14  0x00007f9a2e699f8a __Pyx_Coroutine_AmSend (uvloop/loop.c:196492:18)
#15  0x00007f9a2e69a052 __Pyx_Coroutine_Yield_From_Coroutine (uvloop/loop.c:197380:14)
#16  0x00007f9a2e69b0e5 __Pyx_Coroutine_Yield_From (uvloop/loop.c:197408:16)
#17  0x00007f9a2e69b0e5 __pyx_gb_6uvloop_4loop_4Loop_122generator18 (uvloop/loop.c:55002:15)
#18  0x00007f9a2e631419 __Pyx_Coroutine_SendEx (uvloop/loop.c:196315:14)
#19  0x00007f9a2e69bb86 __Pyx_Generator_Next (uvloop/loop.c:196581:18)
#20  0x00007f9a2e6398eb __Pyx_PyObject_Call (uvloop/loop.c:191431:15)
#21  0x00007f9a2e6398eb __Pyx_PyObject_FastCallDict (uvloop/loop.c:191552:16)
#22  0x00007f9a2e715a69 __pyx_f_6uvloop_4loop_6Handle__run (uvloop/loop.c:66873:27)
#23  0x00007f9a2e71996b __pyx_f_6uvloop_4loop_4Loop__on_idle (uvloop/loop.c:17975:25)
#24  0x00007f9a2e713e52 __pyx_f_6uvloop_4loop_6Handle__run (uvloop/loop.c:66927:24)
#25  0x00007f9a2e715c88 __pyx_f_6uvloop_4loop_cb_idle_callback (uvloop/loop.c:87335:19)
#26  0x00007f9a2e731311 uv__run_idle (unix/loop-watcher.c:68:1)
#27  0x00007f9a2e72e647 uv_run (src/unix/core.c:439:5)
#28  0x00007f9a2e64fdb5 __pyx_f_6uvloop_4loop_4Loop__Loop__run (uvloop/loop.c:18458:23)
#29  0x00007f9a2e6b7e50 __pyx_f_6uvloop_4loop_4Loop__run (uvloop/loop.c:18876:18)
#30  0x00007f9a2e6c8cf0 __pyx_pf_6uvloop_4loop_4Loop_24run_forever (uvloop/loop.c:31528:18)
#31  0x00007f9a2e6c8cf0 __pyx_pw_6uvloop_4loop_4Loop_25run_forever (uvloop/loop.c:31331:13)
#32  0x00007f9a7b065c25 PyObject_VectorcallMethod 
#33  0x00007f9a2e6ccd60 __pyx_pf_6uvloop_4loop_4Loop_44run_until_complete (uvloop/loop.c:33768:23)
#34  0x00007f9a2e6ce591 __pyx_pw_6uvloop_4loop_4Loop_45run_until_complete (uvloop/loop.c:33318:13)
#35  0x00007f9a7b039358 PyObject_Vectorcall 
```

## Fix

The `_after_fork` boolean field marks that this thread object is in a
"post-fork zombie state." When the flag is set to true, Thread methods
(e.g. `join`) become no-ops because the threads do not exist anymore so
we should not try to do something with them. By checking that same flag,
we can tell that we are trying to start a Thread that doesn't really
exist and so we shouldn't try to do it.

Co-authored-by: Thomas Kowalski <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants