Skip to content

WIP: fix(crashtracker): unwind from saved crash context - #2398

Draft
pawelchcki wants to merge 1 commit into
mainfrom
pawelchcki/crashtracker-causal-stack
Draft

WIP: fix(crashtracker): unwind from saved crash context#2398
pawelchcki wants to merge 1 commit into
mainfrom
pawelchcki/crashtracker-causal-stack

Conversation

@pawelchcki

Copy link
Copy Markdown
Contributor

Summary

  • seed the stopped crashing thread's registers from the saved signal ucontext before remote libunwind collection
  • restore the stopped registers before detaching and promote the causal unwind to the primary error stack
  • retain all-thread data, synthesize module+offset names for unresolved native frames, and trim leading libc delivery frames for software-generated signals

Validation

  • cargo check -p libdd-crashtracker --features collector,receiver
  • Linux musl cargo check -p libdd-crashtracker --features collector,receiver --tests --target x86_64-unknown-linux-musl
  • dd-trace-c optimized -fomit-frame-pointer crash integration test

@pawelchcki
pawelchcki requested a review from a team as a code owner August 24, 2026 14:55
@github-actions

Copy link
Copy Markdown
Contributor

📚 Documentation Check Results

⚠️ 1156 documentation warning(s) found

📦 libdd-crashtracker - 1156 warning(s)


Updated: 2026-08-24 14:57:49 UTC | Commit: 10c82de | missing-docs job results

@datadog-prod-us1-6

datadog-prod-us1-6 Bot commented Aug 24, 2026

Copy link
Copy Markdown

Pipelines  Tests

⚠️ Warnings

🚦 3 Pipeline jobs failed

semver-check | validate — 🔧 Needs a code fix, caused by this PR

View more details · View in GitHub Actions

Could not parse type from branch title 'WIP: fix(crashtracker): unwind from saved crash context'.

Required checks pass | allchecks

View more details · View in GitHub Actions

Job failed due to some checks failing or timing out. Please check the workflow run summary for more details.

pr-name | pr_name_lint

View more details · View in GitHub Actions

PR title linting failed: type must be lower-case and must be one of [build, chore, ci, docs, feat, fix, perf, refactor, revert, style, test].

📋 Copy fix prompt
CI on my pull request is failing. Help me find and fix the root cause of each failing job below — they were flagged as caused by changes in this PR, so focus on the diff. For each job, explain the failure and propose a fix.

Before you start, set up the Datadog software-delivery tooling so you can
query the CI data yourself:

1. Check whether you already have the Datadog software-delivery MCP tools
   (e.g. a `search_datadog_ci_pipeline_events` tool) and the `unblock-pr` skill.
2. If either is missing, STOP and ask me for permission before installing
   anything. Do not install or run anything until I have said yes.
3. Only with my explicit approval, set up the Datadog software-delivery MCP
   server and skills by following:
     https://docs.datadoghq.com/getting_started/software_delivery_mcp_tools/
   then restart so the skill is picked up.
4. If I decline, skip all of the above and work from the context below alone.

Then run /unblock-pr — it will pull the CI data itself. The job context below is what we already know.

If /unblock-pr is not available — because I declined the setup above, or it did not install — work from the context below instead.

Datadog has already classified this failure as caused by changes in this PR.
Take that as given and work the fix:

1. Locate the change. Diff this branch against its base and find the change
   that produces this error. Explain the mechanism, don't just name a file:
     git fetch origin && git diff $(git merge-base origin/main HEAD)...HEAD
2. Reproduce it locally. Run the failing job's command or test before
   proposing anything.
3. Propose the smallest fix that addresses the root cause — not a workaround,
   not a broadened assertion, not a disabled or skipped test.
4. Re-run the same command to confirm, and say exactly what you ran.
5. If the failure turns out to be intermittent rather than deterministic, say
   so plainly instead of "fixing" it — that is a flaky test, and patching it
   hides the problem.

If the right move is to re-run the job rather than change code, use the job
link in the context below. For GitHub Actions: `gh run rerun <run-id> --failed`,
where the run ID is the number after `/runs/` in that URL (not the trailing
number, which is the job ID).

Branch: pawelchcki/crashtracker-causal-stack

semver-check | validate
Commit: 10c82dee4b1ab54b7f5b833f3cd06503752939f4
Error (code / build):
Could not parse type from branch title 'WIP: fix(crashtracker): unwind from saved crash context'.
CI job: https://github.com/DataDog/libdatadog/actions/runs/32741700246/job/97479172364

ℹ️ Info

No other issues found (see more)

🧪 All tests passed
❄️ No new flaky tests detected

🎯 Code Coverage (details)
Patch Coverage: 41.85%
Overall Coverage: 76.55% (-0.08%)

Useful? React with 👍 / 👎

This comment will be updated automatically if new data arrives.
🔗 Commit SHA: 5ea1627 | Docs | View more details | Give us feedback!

@github-actions

Copy link
Copy Markdown
Contributor

🔒 Cargo Deny Results

⚠️ 3 issue(s) found, showing only errors (advisories, bans, sources)

📦 libdd-crashtracker - 3 error(s)

Show output
error[vulnerability]: Invalid pointer dereference in `fmt::Pointer` impl for `Atomic` and `Shared` when the underlying pointer is invalid
   ┌─ /home/runner/work/libdatadog/libdatadog/Cargo.lock:61:1
   │
61 │ crossbeam-epoch 0.9.18 registry+https://github.com/rust-lang/crates.io-index
   │ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ security vulnerability detected
   │
   ├ ID: RUSTSEC-2026-0204
   ├ Advisory: https://rustsec.org/advisories/RUSTSEC-2026-0204
   ├ Affected versions of `fmt::Display` dereference the underlying pointer. This causes a invalid pointer dereference e.g., when a pointer created with `Atomic::null` or `Shared::null`. `fmt::Debug` impls and pre-0.9 `fmt::Display` impls, which do not dereference pointers, are not affected by this issue.
   ├ Announcement: https://github.com/crossbeam-rs/crossbeam/pull/1276
   ├ Solution: Upgrade to >=0.9.20 (try `cargo update -p crossbeam-epoch`)
   ├ crossbeam-epoch v0.9.18
     └── crossbeam-deque v0.8.5
         └── rayon-core v1.12.1
             └── rayon v1.10.0
                 └── criterion v0.5.1
                     ├── (dev) libdd-crashtracker v2.0.0
                     └── (dev) libdd-ddsketch v1.1.1
                         └── libdd-telemetry v7.0.0
                             └── libdd-crashtracker v2.0.0 (*)

error[vulnerability]: h2 unbounded empty DATA frames
   ┌─ /home/runner/work/libdatadog/libdatadog/Cargo.lock:99:1
   │
99 │ h2 0.4.6 registry+https://github.com/rust-lang/crates.io-index
   │ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ security vulnerability detected
   │
   ├ ID: RUSTSEC-2026-0258
   ├ Advisory: https://rustsec.org/advisories/RUSTSEC-2026-0258
   ├ The h2 crate, used internally by hyper, had a flaw that would accept and queue empty DATA frames without limit.
     If streams were not actively drained, this could lead to unbounded memory usage, or a panic if the length overflows.
     
     Low severity.
     
     Patched in v0.4.16.
   ├ Announcement: https://github.com/hyperium/hyper/security/advisories/GHSA-q83h-524g-xf6h
   ├ Solution: Upgrade to >=0.4.16 (try `cargo update -p h2`)
   ├ h2 v0.4.6
     └── hyper v1.6.0
         ├── httpmock v0.8.0-alpha.1
         │   └── (dev) libdd-telemetry v7.0.0
         │       └── libdd-crashtracker v2.0.0
         ├── hyper-rustls v0.27.7
         │   └── libdd-common v5.2.0
         │       ├── libdd-capabilities-impl v4.0.0
         │       │   ├── libdd-crashtracker v2.0.0 (*)
         │       │   ├── libdd-shared-runtime v3.0.0
         │       │   │   └── libdd-telemetry v7.0.0 (*)
         │       │   └── (dev) libdd-telemetry v7.0.0 (*)
         │       ├── (build) libdd-crashtracker v2.0.0 (*)
         │       ├── libdd-shared-runtime v3.0.0 (*)
         │       └── libdd-telemetry v7.0.0 (*)
         ├── hyper-util v0.1.17
         │   ├── httpmock v0.8.0-alpha.1 (*)
         │   ├── hyper-rustls v0.27.7 (*)
         │   └── libdd-common v5.2.0 (*)
         └── libdd-common v5.2.0 (*)

error[unsound]: Rand is unsound with a custom logger using `rand::rng()`
    ┌─ /home/runner/work/libdatadog/libdatadog/Cargo.lock:210:1
    │
210 │ rand 0.8.5 registry+https://github.com/rust-lang/crates.io-index
    │ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ unsound advisory detected
    │
    ├ ID: RUSTSEC-2026-0097
    ├ Advisory: https://rustsec.org/advisories/RUSTSEC-2026-0097
    ├ It has been reported (by [@lopopolo](https://github.com/lopopolo)) that the `rand` library is [unsound](https://rust-lang.github.io/unsafe-code-guidelines/glossary.html#soundness-of-code--of-a-library) (i.e. that safe code using the public API can cause Undefined Behaviour) when all the following conditions are met:
      
      - The `log` and `thread_rng` features are enabled
      - A [custom logger](https://docs.rs/log/latest/log/#implementing-a-logger) is defined
      - The custom logger accesses `rand::rng()` (previously `rand::thread_rng()`) and calls any `TryRng` (previously `RngCore`) methods on `ThreadRng`
      - The `ThreadRng` (attempts to) reseed while called from the custom logger (this happens every 64 kB of generated data)
      - Trace-level logging is enabled or warn-level logging is enabled and the random source (the `getrandom` crate) is unable to provide a new seed
      
      `TryRng` (previously `RngCore`) methods for `ThreadRng` use `unsafe` code to cast `*mut BlockRng<ReseedingCore>` to `&mut BlockRng<ReseedingCore>`. When all the above conditions are met this results in an aliased mutable reference, violating the Stacked Borrows rules. Miri is able to detect this violation in sample code. Since construction of [aliased mutable references is Undefined Behaviour](https://doc.rust-lang.org/stable/nomicon/references.html), the behaviour of optimized builds is hard to predict.
    ├ Announcement: https://github.com/rust-random/rand/pull/1763
    ├ Solution: Upgrade to >=0.10.1 OR <0.10.0, >=0.9.3 OR <0.9.0, >=0.8.6 (try `cargo update -p rand`)
    ├ rand v0.8.5
      ├── libdd-common v5.2.0
      │   ├── libdd-capabilities-impl v4.0.0
      │   │   ├── libdd-crashtracker v2.0.0
      │   │   ├── libdd-shared-runtime v3.0.0
      │   │   │   └── libdd-telemetry v7.0.0
      │   │   │       └── libdd-crashtracker v2.0.0 (*)
      │   │   └── (dev) libdd-telemetry v7.0.0 (*)
      │   ├── (build) libdd-crashtracker v2.0.0 (*)
      │   ├── libdd-shared-runtime v3.0.0 (*)
      │   └── libdd-telemetry v7.0.0 (*)
      ├── libdd-crashtracker v2.0.0 (*)
      ├── (dev) libdd-ddsketch v1.1.1
      │   └── libdd-telemetry v7.0.0 (*)
      └── proptest v1.5.0
          └── (dev) libdd-common v5.2.0 (*)

advisories FAILED, bans ok, sources ok

Updated: 2026-08-24 14:59:13 UTC | Commit: 10c82de | dependency-check job results

@dd-octo-sts

dd-octo-sts Bot commented Aug 24, 2026

Copy link
Copy Markdown
Contributor

Artifact Size Benchmark Report

aarch64-alpine-linux-musl
Artifact Baseline Commit Change
/aarch64-alpine-linux-musl/lib/libdatadog_profiling.a 89.52 MB 89.56 MB +.04% (+40.52 KB) 🔍
/aarch64-alpine-linux-musl/lib/libdatadog_profiling.so 8.26 MB 8.26 MB 0% (0 B) 👌
aarch64-unknown-linux-gnu
Artifact Baseline Commit Change
/aarch64-unknown-linux-gnu/lib/libdatadog_profiling.a 100.70 MB 100.74 MB +.03% (+40.30 KB) 🔍
/aarch64-unknown-linux-gnu/lib/libdatadog_profiling.so 11.06 MB 11.07 MB +.01% (+1.47 KB) 🔍
libdatadog-x64-windows
Artifact Baseline Commit Change
/libdatadog-x64-windows/debug/dynamic/datadog_profiling_ffi.dll 26.64 MB 26.64 MB 0% (0 B) 👌
/libdatadog-x64-windows/debug/dynamic/datadog_profiling_ffi.lib 94.96 KB 94.96 KB 0% (0 B) 👌
/libdatadog-x64-windows/debug/dynamic/datadog_profiling_ffi.pdb 180.73 MB 180.74 MB +0% (+8.00 KB) 👌
/libdatadog-x64-windows/debug/static/datadog_profiling_ffi.lib 772.85 MB 772.85 MB 0% (0 B) 👌
/libdatadog-x64-windows/release/dynamic/datadog_profiling_ffi.dll 8.73 MB 8.73 MB 0% (0 B) 👌
/libdatadog-x64-windows/release/dynamic/datadog_profiling_ffi.lib 94.96 KB 94.96 KB 0% (0 B) 👌
/libdatadog-x64-windows/release/dynamic/datadog_profiling_ffi.pdb 25.65 MB 25.65 MB 0% (0 B) 👌
/libdatadog-x64-windows/release/static/datadog_profiling_ffi.lib 51.09 MB 51.09 MB 0% (0 B) 👌
libdatadog-x86-windows
Artifact Baseline Commit Change
/libdatadog-x86-windows/debug/dynamic/datadog_profiling_ffi.dll 23.22 MB 23.22 MB 0% (0 B) 👌
/libdatadog-x86-windows/debug/dynamic/datadog_profiling_ffi.lib 96.45 KB 96.45 KB 0% (0 B) 👌
/libdatadog-x86-windows/debug/dynamic/datadog_profiling_ffi.pdb 185.66 MB 185.67 MB +0% (+8.00 KB) 👌
/libdatadog-x86-windows/debug/static/datadog_profiling_ffi.lib 759.09 MB 759.09 MB 0% (0 B) 👌
/libdatadog-x86-windows/release/dynamic/datadog_profiling_ffi.dll 6.74 MB 6.74 MB 0% (0 B) 👌
/libdatadog-x86-windows/release/dynamic/datadog_profiling_ffi.lib 96.45 KB 96.45 KB 0% (0 B) 👌
/libdatadog-x86-windows/release/dynamic/datadog_profiling_ffi.pdb 27.59 MB 27.59 MB 0% (0 B) 👌
/libdatadog-x86-windows/release/static/datadog_profiling_ffi.lib 48.62 MB 48.62 MB 0% (0 B) 👌
x86_64-alpine-linux-musl
Artifact Baseline Commit Change
/x86_64-alpine-linux-musl/lib/libdatadog_profiling.a 79.78 MB 79.82 MB +.04% (+38.34 KB) 🔍
/x86_64-alpine-linux-musl/lib/libdatadog_profiling.so 9.16 MB 9.16 MB +.04% (+4.00 KB) 🔍
x86_64-unknown-linux-gnu
Artifact Baseline Commit Change
/x86_64-unknown-linux-gnu/lib/libdatadog_profiling.a 95.42 MB 95.46 MB +.03% (+38.11 KB) 🔍
/x86_64-unknown-linux-gnu/lib/libdatadog_profiling.so 11.17 MB 11.18 MB +.04% (+4.64 KB) 🔍

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 5ea16272ec

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment on lines +573 to +574
if let Some(stack) = crashing_stack {
builder.with_stack(stack)?;

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Preserve in-process symbols when promoting the remote stack

When Linux callers enable both collect_all_threads and EnabledWithInprocessSymbols, the original collector stack contains function names from unw_get_proc_name (collector/emitters.rs), but this unconditional replacement promotes a remote stack containing only ip/sp. resolve_frames does not enrich that configuration because it only handles EnabledWithSymbolsInReceiver, so every successfully captured crash loses its primary stack's function names and degrades Error Tracking grouping and display. Preserve the collector's enrichment when promoting the causal unwind, or restrict replacement to configurations that subsequently symbolize the remote frames.

Useful? React with 👍 / 👎.

Comment on lines +553 to +554
if tid == crashing_tid && !stack.frames.is_empty() {
crashing_stack = Some(stack.clone());

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Keep the supplied stack for unhandled exceptions

When report_unhandled_exception is used with collect_all_threads, no ucontext is emitted, so this candidate stack is captured from the reporting thread's current registers while it is waiting for the receiver rather than from the exception site. Nevertheless, it is accepted here and later replaces the explicit StackTrace supplied by the caller, causing every successful all-thread collection for an unhandled exception to report the receiver-wait/reporting machinery as the primary error stack. Only promote this stack when a saved crash context was actually used, or limit promotion to UnixSignal reports.

Useful? React with 👍 / 👎.

Comment on lines +178 to +183
if crash_info
.sig_info
.as_ref()
.is_some_and(|sig_info| sig_info.si_code <= 0)
{
trim_signal_delivery_frames(&mut crash_info.error.stack);

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Trim only verified signal-delivery frames

A nonpositive si_code only says that the signal originated in user space; it does not prove that the receiving thread was executing raise or pthread_kill. For example, an external kill produces SI_USER, and pthread_kill can target a different thread whose saved context is anywhere. If that thread is interrupted while legitimately executing libc, this predicate causes the following path-based trimming to remove its real top frames and changes the reported grouping location. Restrict trimming to frames whose symbols identify the delivery path rather than classifying every user-originated signal as self-raised.

Useful? React with 👍 / 👎.

Comment on lines +499 to +500
if let Some(registers) = original_registers.as_mut() {
let _ = set_registers(tid, registers);

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Do not detach after a failed register restore

If the second PTRACE_SETREGSET fails while the tracee still exists, discarding the error and immediately detaching resumes the crashing thread with the temporary crash-time registers instead of the saved crash-handler registers. It can therefore re-execute the fault or otherwise leave the handler before the receiver symbolizes the report, violating the requirement that the process remain alive for /proc/<pid>/maps; restoration failure must be propagated or handled without resuming the tracee in the modified state.

AGENTS.md reference: AGENTS.md:L71-L73

Useful? React with 👍 / 👎.

@gyuheon0h

Copy link
Copy Markdown
Contributor

Do you want this to be taken a look at? or is this still WIP

@pawelchcki
pawelchcki marked this pull request as draft August 24, 2026 19:14
@pawelchcki

Copy link
Copy Markdown
Contributor Author

@gyuheon0h still WIP.

I was looking at a crash today. first surfaced through crashtracking, then digging through coredump - I found hte actual crashing stack pointed to elsewhere. IDK how widespread this issue is or was it just my C handler implemetnation doing something really wrong. I need some time to properly understand what is up

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants