What does this PR do?:

Fixes two gaps in the dictionary reclamation from #839, both found by Bits Code Review on #840.

1. Guard scan could miss a protected resource (use-after-free window). A nested guard used to install its resource in active_ptr and park the displaced outer resource in outer_stack, then move it back when it ended. The scanner reads active_ptr, then the stack, so it could read each location while the resource was in the other one:

   • after one nested guard ended;
   • or across one ending and the next starting. Re-reading active_ptr does not close this case (see the review thread).

   Nested guards now record their own resource in nested[depth - 1] (formerly outer_stack) and never touch active_ptr, which keeps the root guard's resource. Every protected resource stays in one place from its guard's construction to its destruction, so one pass over active_ptr and nested[] cannot miss it.

   • Nested guards no longer save and restore active_ptr.
   • On nesting deeper than NESTED_DEPTH (3), the innermost guard's resource goes unrecorded (logged once); the old protocol instead lost track of a suspended outer one. Both need four nested signal deliveries on one thread.
   • The nested[] store is SEQ_CST, CallTraceStorage::put()'s re-check load is SEQ_CST, and each scan pass starts with a SEQ_CST fence, so a guard's publication is ordered before its re-check and a drainer's unpublication before its scan.
   • Adds RefCountGuard::isReferenced(), a single non-waiting scan.

2. Reused uncleared buffer could resurrect a stale id. When clearStandby() skips its target because a guard is still held, the next rotate() makes that buffer active again.

   • How the stale id gets there: a straggler that outlived an earlier rotate()'s drain can have inserted a key into that buffer after both copies, with an id the active buffer has since assigned differently. Phase 1's copyFrom() keeps the existing entry's id, so the stale id won and cached ids could go missing from later constant pools.
   • The fix: StringDictionary now remembers the skipped buffer, and rotate() checks it again with a short series of non-waiting scans, clearing it if no guard remains, before reusing it. rotate() returns false if the buffer is still in use, which rotateDictsAndRun() reports (dictionary_drain_timeouts and a warning).

Motivation:

PROF-16136. Gap 1 is the same use-after-free class as the original ticket.

• When it happens: a JNI dictionary lookup (for example registerConstant0() → bounded_lookup()) is interrupted by a profiling signal whose handler's put() takes a nested RefCountGuard on a call-trace table. A clearAll() running at that moment could report a clean drain and free storage the lookup was still using.
• Why Never reclaim dictionary storage after a timed-out drain #839 exposed it: Never reclaim dictionary storage after a timed-out drain #839 moved clearAll() from the global drain, which saw count > 0 and waited, to the targeted drain. The single-target waitForRefCountToClear() (used by CallTraceStorage and rotate()) already had the gap.

Gap 2 needs a straggler insert that stalls across a whole dump cycle to matter. The retry covers everything short of a thread stuck that long, and that remaining case is now reported.

Additional Notes:

rotate() now returns bool. It is not [[nodiscard]], so existing test and fuzz callers are unchanged.

How to test the change?:

• RefCountGuardScanTest.SeesOuterResourceAcrossNestedGuards: a thread holds an outer guard and repeatedly opens and closes a nested one, while the test scans with isReferenced() for 500 ms.
  • On main: 0.1–1.5% of scans miss the outer resource (34–217 misses per run, debug and release).
  • With the fix: 0 misses.
• RefCountGuardScanTest.NestedGuardsNeverMoveProtectedResources: checks deterministically the property that rules out torn scans. Across repeated two-level nesting, active_ptr stays the outer resource and each nested resource stays in its own nested[] entry.
• StringDictionaryReclamationTest.ReusedUnclearedBufferKeepsCurrentIds: reproduces the straggler and skipped-clear sequence.
  • Without the fix: the reused buffer returns the stale id (999999 instead of 2).
  • With the fix: it returns the current id.
• Ran: full gtestDebug; refCountGuard_ut in debug, release, ASan and TSan (×3); stringDictionary_ut and test_callTraceStorage under ASan and TSan; compileFuzzer; testDebug (225 tests, 0 failures).

For Datadog employees:

• If this PR touches code that signs or publishes builds or packages, or handles
  credentials of any kind, I've requested a security review (run the dd:platform-security-review
  skill, or file a request via the PSEC review form).
  bewaire also runs automatically on every PR.
• This PR doesn't touch any of that.
• JIRA: PROF-16136

🤖 Generated with Claude Code