Resolve mallinfo2 at runtime; fix always-zero malloc arena counters in el8 builds

ddprof-lib/src/main/cpp/flightRecorder.cpp

@@ -8,15 +8,6 @@
 #include <inttypes.h>
 #include <dlfcn.h>
 
-// mallinfo2() replaced the int-based mallinfo() in glibc 2.33; the older struct
-// silently truncates past 2 GiB, so it is not a usable fallback for byte
-// accounting. Absent on musl and macOS, where the arena counters stay zero.
-#if defined(__linux__) && defined(__GLIBC__) &&                                \
-    (__GLIBC__ > 2 || (__GLIBC__ == 2 && __GLIBC_MINOR__ >= 33))
-  #include <malloc.h>
-  #define DD_HAVE_MALLINFO2 1
-#endif
-
 #include "buffers.h"
 #include "callTraceHashTable.h"
 #include "context.h"
@@ -29,6 +20,7 @@
 #include "jfrMetadata.h"
 #include "jniHelper.h"
 #include "jvmSupport.inline.h"
+#include "mallocInfo.h"
 #include "os.h"
 #include "profiler.h"
 #include "signalSafety.h"
@@ -2141,14 +2133,24 @@ void Recording::writeLogLevels(Buffer *buf) {
 // mallinfo2(), which then reports all zeros. Neither runtime exports
 // mallctl/tc_malloc_size, so the dlsym probe alone would miss them.
 //
-// Not cached: called once per JFR chunk flush, so two dlsym() lookups are
-// negligible.
+// Resolved once: the lookup result cannot change after process start, and the
+// loader lock is not worth taking on every chunk flush. The sentinel is zero-
+// initialized (no dynamic-init guard) and read/written with acquire/release,
+// so a racing first caller can only repeat the same lookup. Flush path only,
+// never signal context.
 bool Recording::glibcMallocActive() {
 #if defined(ASAN_ENABLED) || defined(TSAN_ENABLED)
   return false;
 #else
-  return dlsym(RTLD_DEFAULT, "mallctl") == nullptr &&
-         dlsym(RTLD_DEFAULT, "tc_malloc_size") == nullptr;
+  static int cached = 0; // 0 = unresolved, 1 = active, 2 = inactive
+  int state = __atomic_load_n(&cached, __ATOMIC_ACQUIRE);
+  if (state == 0) {
+    bool active = dlsym(RTLD_DEFAULT, "mallctl") == nullptr &&
+                  dlsym(RTLD_DEFAULT, "tc_malloc_size") == nullptr;
+    state = active ? 1 : 2;
+    __atomic_store_n(&cached, state, __ATOMIC_RELEASE);
+  }
+  return state == 1;
 #endif
 }
 
@@ -2166,17 +2168,26 @@ bool Recording::glibcMallocActive() {
 // from the sampling signal handler. Once per JFR chunk is negligible.
 //
 // Left unset (rather than published as zero) when a replacement allocator is
-// active: see glibcMallocActive() above.
+// active: see glibcMallocActive() above. Also left unset when the runtime
+// allocator does not provide mallinfo2() (glibc < 2.33, musl, macOS) -- the
+// symbol is resolved at runtime, so a build made against old headers still
+// picks it up from a newer runtime glibc (see mallocInfo.cpp).
 void Recording::updateMallocArenaStats() {
-#ifdef DD_HAVE_MALLINFO2
   if (!glibcMallocActive()) {
     return;
   }
-  struct mallinfo2 mi = mallinfo2();
-  // arena:    bytes obtained from the OS via brk, excluding mmap'd chunks
+  MallocArenaInfo mi;
+  if (!mallocArenaSnapshot(&mi)) {
+    return;
+  }
+  // arena:    system memory held by glibc's arenas, summed per arena
+  //           (glibc int_mallinfo: m->arena += av->system_mem) -- NOT just
+  //           the main sbrk heap; non-main arenas live on their own mmap'd
+  //           heaps, so arena growth tracks per-thread arenas too
   // uordblks: bytes currently handed out to callers
   // fordblks: bytes free but retained in the arenas -- the waste term
-  // keepcost: the trimmable top block, i.e. what malloc_trim could return;
+  // keepcost: the main arena's top chunk only (glibc sets it under
+  //           `if (av == &main_arena)`), i.e. what malloc_trim could return;
   //           separating it distinguishes trim-threshold policy from genuine
   //           fragmentation, which trimming cannot reclaim
   // hblkhd:   bytes in mmap'd chunks, which are returned to the OS on free
@@ -2185,7 +2196,6 @@ void Recording::updateMallocArenaStats() {
   Counters::set(MALLOC_FREE_HELD_BYTES, (long long)mi.fordblks);
   Counters::set(MALLOC_TRIMMABLE_BYTES, (long long)mi.keepcost);
   Counters::set(MALLOC_MMAP_BYTES, (long long)mi.hblkhd);
-#endif
 }
 
 void Recording::capturePostFlushNativeMem() {

ddprof-lib/src/main/cpp/flightRecorder.h

@@ -444,9 +444,11 @@ class Recording {
   // updateMallocArenaStats() for why this matters. Exposed for
   // RecordingTestAccessor.
   static bool glibcMallocActive();
-  // Process-wide malloc arena state (glibc mallinfo2). Flush path only --
-  // takes every arena lock, so not async-signal-safe. No-op off glibc 2.33+,
-  // and also when glibcMallocActive() reports a replacement allocator.
+  // Process-wide malloc arena state (glibc mallinfo2, resolved at runtime --
+  // see mallocInfo.h). Flush path only -- takes every arena lock, so not
+  // async-signal-safe. No-op when the runtime allocator does not provide
+  // mallinfo2() (glibc < 2.33, musl, macOS), and also when
+  // glibcMallocActive() reports a replacement allocator.
   void updateMallocArenaStats();
   void writeNativeMem(Buffer *buf);
 

ddprof-lib/src/main/cpp/mallocInfo.cpp

@@ -0,0 +1,106 @@
+/*
+ * Copyright 2026, Datadog, Inc.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+#include "mallocInfo.h"
+#include <dlfcn.h>
+#if defined(__linux__)
+// The glibc guard below must see __GLIBC_PREREQ here, not via a transitive
+// include: if <dlfcn.h> ever stopped pulling in <features.h>, the guard would
+// silently turn false and the mirror pins would stop compiling on every
+// glibc build. <features.h> exists on musl too, so the include is unconditional
+// on Linux.
+#include <features.h>
+#endif
+
+// mallinfo2() replaced the int-based mallinfo() in glibc 2.33. The release
+// libraries are built against older glibc headers (the el8 image has 2.28),
+// where <malloc.h> declares neither mallinfo2() nor its struct -- so instead
+// of gating the call on __GLIBC_MINOR__ at compile time, which compiled the
+// arena counters out of every shipped build, the symbol is resolved at
+// runtime with dlsym(). A dlsym string lookup adds no symbol-version
+// reference, so the binary keeps loading on runtimes older than 2.33: there
+// dlsym returns NULL and the counters stay unset, exactly as on musl and
+// macOS where the symbol does not exist either.
+//
+// The mirror must match the real struct field for field: mallinfo2() is
+// called through this type, and the return-by-value ABI (hidden sret pointer
+// vs registers) is selected from it. Ten size_t fields, same order as the
+// old struct mallinfo; verified against glibc 2.33+ <malloc.h>.
+struct Mallinfo2 {
+  size_t arena;
+  size_t ordblks;
+  size_t smblks;
+  size_t hblks;
+  size_t hblkhd;
+  size_t usmblks;
+  size_t fsmblks;
+  size_t uordblks;
+  size_t fordblks;
+  size_t keepcost;
+};
+
+#if defined(__GLIBC__) && defined(__GLIBC_PREREQ)
+  #if __GLIBC_PREREQ(2, 33)
+    #include <malloc.h>
+    #include <stddef.h>
+    // On builds whose headers do declare struct mallinfo2, the mirror is
+    // pinned to it field by field: every one of the ten offsets, not just the
+    // five mallocArenaSnapshot() copies out (arena, hblkhd, uordblks,
+    // fordblks, keepcost). On older headers -- including the el8 release
+    // image (glibc 2.28), the builds this path exists for -- struct mallinfo2
+    // is not declared, so this pin cannot run and the mirror is the only
+    // definition. There the field mapping is cross-checked at runtime by
+    // mallocArenaStats_ut.cpp wherever the test runtime provides mallinfo2:
+    // glibc's accounting identity (arena == uordblks + fordblks, keepcost <=
+    // fordblks), a large mmapped chunk moving only hblkhd, signed in-use
+    // deltas across an allocation burst, and post-trim keepcost bounds. On
+    // runtimes older than 2.33 those tests skip.
+    static_assert(sizeof(Mallinfo2) == sizeof(struct mallinfo2),
+                  "Mallinfo2 mirror does not match glibc's struct mallinfo2");
+    #define DDPROF_PIN_MALLINFO2_FIELD(f)                                      \
+      static_assert(offsetof(Mallinfo2, f) == offsetof(struct mallinfo2, f),   \
+                    "Mallinfo2::" #f " offset diverges from glibc's struct mallinfo2")
+    DDPROF_PIN_MALLINFO2_FIELD(arena);
+    DDPROF_PIN_MALLINFO2_FIELD(ordblks);
+    DDPROF_PIN_MALLINFO2_FIELD(smblks);
+    DDPROF_PIN_MALLINFO2_FIELD(hblks);
+    DDPROF_PIN_MALLINFO2_FIELD(hblkhd);
+    DDPROF_PIN_MALLINFO2_FIELD(usmblks);
+    DDPROF_PIN_MALLINFO2_FIELD(fsmblks);
+    DDPROF_PIN_MALLINFO2_FIELD(uordblks);
+    DDPROF_PIN_MALLINFO2_FIELD(fordblks);
+    DDPROF_PIN_MALLINFO2_FIELD(keepcost);
+    #undef DDPROF_PIN_MALLINFO2_FIELD
+  #endif
+#endif
+
+bool mallocArenaSnapshot(MallocArenaInfo *out) {
+  typedef Mallinfo2 (*mallinfo2_fn)();
+  // Resolved once. The RTLD_DEFAULT lookup result cannot change after libc is
+  // loaded, and the loader lock is not worth taking on every chunk flush while
+  // application threads may be inside dlopen(). The statics are zero-
+  // initialized (no dynamic-init guard), and the handoff is published with
+  // release/acquire: dlsym() is thread-safe, so racing first callers compute
+  // the same value; a concurrent reader can only repeat the lookup once.
+  // Flush path only, never signal context.
+  static mallinfo2_fn cached_fn = NULL;
+  static int resolved = 0;
+  if (__atomic_load_n(&resolved, __ATOMIC_ACQUIRE) == 0) {
+    __atomic_store_n(&cached_fn, (mallinfo2_fn)dlsym(RTLD_DEFAULT, "mallinfo2"),
+                     __ATOMIC_RELEASE);
+    __atomic_store_n(&resolved, 1, __ATOMIC_RELEASE);
+  }
+  mallinfo2_fn fn = __atomic_load_n(&cached_fn, __ATOMIC_ACQUIRE);
+  if (fn == NULL) {
+    return false;
+  }
+  Mallinfo2 mi = fn();
+  out->arena = mi.arena;
+  out->hblkhd = mi.hblkhd;
+  out->uordblks = mi.uordblks;
+  out->fordblks = mi.fordblks;
+  out->keepcost = mi.keepcost;
+  return true;
+}

ddprof-lib/src/main/cpp/mallocInfo.h

@@ -0,0 +1,33 @@
+/*
+ * Copyright 2026, Datadog, Inc.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+#ifndef MALLOC_INFO_H
+#define MALLOC_INFO_H
+
+#include <stddef.h>
+
+// The process-wide malloc arena figures the profiler publishes, in the units
+// glibc's allocator accounting reports them (see mallocArenaSnapshot()).
+struct MallocArenaInfo {
+  size_t arena;    // system memory held by all arenas, summed per arena
+  size_t hblkhd;   // bytes in mmap'd chunks
+  size_t uordblks; // bytes currently handed out to callers
+  size_t fordblks; // bytes free but retained inside the arenas
+  size_t keepcost; // the main arena's top chunk only
+};
+
+// Snapshot the process-wide glibc malloc arena state via mallinfo2(), resolved
+// at runtime with dlsym() so a binary built against old glibc headers (the el8
+// image ships glibc 2.28 headers) still picks mallinfo2() up from a newer
+// runtime glibc. Fills *out and returns true on success; returns false and
+// leaves *out untouched when the runtime allocator does not provide
+// mallinfo2() (glibc < 2.33 at runtime, musl, macOS) -- callers leave the
+// arena counters unset, exactly as they already do on musl.
+//
+// NOT async-signal-safe: mallinfo2() walks every arena taking each arena lock.
+// Flush path only -- must never be reached from the sampling signal handler.
+bool mallocArenaSnapshot(MallocArenaInfo *out);
+
+#endif // MALLOC_INFO_H