feat(profiling): add heap-live profiling for memory leak detection

Track allocations that survive across profile exports using heap-live-samples
and heap-live-size sample types. Samples are emitted in batches at export time.

Enabled via DD_PROFILING_HEAP_LIVE_ENABLED when allocation profiling is active.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Author: realFlowControl

Cargo.lock

@@ -22,6 +22,7 @@ cfg-if = { version = "1.0" }
 cpu-time = { version = "1.0" }
 chrono = { version = "0.4" }
 crossbeam-channel = { version = "0.5", default-features = false, features = ["std"] }
+dashmap = { version = "6.1" }
 libdd-alloc = {  git = "https://github.com/DataDog/libdatadog", tag = "v25.0.0" }
 libdd-profiling = {  git = "https://github.com/DataDog/libdatadog", tag = "v25.0.0" }
 libdd-common = {  git = "https://github.com/DataDog/libdatadog", tag = "v25.0.0" }

profiling/Cargo.toml

@@ -1,4 +1,4 @@
-use crate::allocation::{allocation_profiling_stats_should_collect, collect_allocation};
+use crate::allocation::{allocation_profiling_stats_should_collect, collect_allocation, free_allocation};
 use crate::bindings as zend;
 use crate::PROFILER_NAME;
 use core::ptr;
@@ -286,7 +286,7 @@ unsafe extern "C" fn alloc_prof_malloc(len: size_t) -> *mut c_void {
     }
 
     if allocation_profiling_stats_should_collect(len) {
-        collect_allocation(len);
+        collect_allocation(ptr, len);
     }
 
     ptr
@@ -316,6 +316,11 @@ unsafe fn alloc_prof_orig_alloc(len: size_t) -> *mut c_void {
 /// custom handlers won't be installed. We cannot just point to the original
 /// `zend::_zend_mm_free()` as the function definitions differ.
 unsafe extern "C" fn alloc_prof_free(ptr: *mut c_void) {
+    // Check if this was a tracked allocation (before freeing!)
+    if !ptr.is_null() {
+        free_allocation(ptr);
+    }
+
     tls_zend_mm_state_get!(free)(ptr);
 }
 
@@ -348,12 +353,21 @@ unsafe extern "C" fn alloc_prof_realloc(prev_ptr: *mut c_void, len: size_t) -> *
 
     // during startup, minit, rinit, ... current_execute_data is null
     // we are only interested in allocations during userland operations
-    if zend::ddog_php_prof_get_current_execute_data().is_null() || ptr::eq(ptr, prev_ptr) {
+    if zend::ddog_php_prof_get_current_execute_data().is_null() {
         return ptr;
     }
 
-    if allocation_profiling_stats_should_collect(len) {
-        collect_allocation(len);
+    // If pointer changed, treat as free(old) + alloc(new)
+    if !ptr::eq(ptr, prev_ptr) {
+        // Untrack the old allocation if it was tracked
+        if !prev_ptr.is_null() {
+            free_allocation(prev_ptr);
+        }
+
+        // Sample the new allocation
+        if allocation_profiling_stats_should_collect(len) {
+            collect_allocation(ptr, len);
+        }
     }
 
     ptr

profiling/src/allocation/allocation_ge84.rs

@@ -1,4 +1,4 @@
-use crate::allocation::{allocation_profiling_stats_should_collect, collect_allocation};
+use crate::allocation::{allocation_profiling_stats_should_collect, collect_allocation, free_allocation};
 use crate::bindings::{
     self as zend, datadog_php_install_handler, datadog_php_zif_handler,
     ddog_php_prof_copy_long_into_zval,
@@ -300,7 +300,7 @@ unsafe extern "C" fn alloc_prof_malloc(len: size_t) -> *mut c_void {
     }
 
     if allocation_profiling_stats_should_collect(len) {
-        collect_allocation(len);
+        collect_allocation(ptr, len);
     }
 
     ptr
@@ -330,6 +330,11 @@ unsafe fn alloc_prof_orig_alloc(len: size_t) -> *mut c_void {
 /// custom handlers won't be installed. We cannot just point to the original
 /// `zend::_zend_mm_free()` as the function definitions differ.
 unsafe extern "C" fn alloc_prof_free(ptr: *mut c_void) {
+    // Check if this was a tracked allocation (before freeing!)
+    if !ptr.is_null() {
+        free_allocation(ptr);
+    }
+
     tls_zend_mm_state_get!(free)(ptr);
 }
 
@@ -358,12 +363,21 @@ unsafe extern "C" fn alloc_prof_realloc(prev_ptr: *mut c_void, len: size_t) -> *
 
     // during startup, minit, rinit, ... current_execute_data is null
     // we are only interested in allocations during userland operations
-    if zend::ddog_php_prof_get_current_execute_data().is_null() || ptr::eq(ptr, prev_ptr) {
+    if zend::ddog_php_prof_get_current_execute_data().is_null() {
         return ptr;
     }
 
-    if allocation_profiling_stats_should_collect(len) {
-        collect_allocation(len);
+    // If pointer changed, treat as free(old) + alloc(new)
+    if !ptr::eq(ptr, prev_ptr) {
+        // Untrack the old allocation if it was tracked
+        if !prev_ptr.is_null() {
+            free_allocation(prev_ptr);
+        }
+
+        // Sample the new allocation
+        if allocation_profiling_stats_should_collect(len) {
+            collect_allocation(ptr, len);
+        }
     }
 
     ptr

profiling/src/allocation/allocation_le83.rs

@@ -135,8 +135,13 @@ impl AllocationProfilingStats {
     }
 }
 
+/// Collect an allocation sample and optionally track it for live heap profiling.
+///
+/// # Arguments
+/// * `ptr` - The pointer returned by the allocator (used for live heap tracking)
+/// * `len` - The size of the allocation in bytes
 #[cold]
-pub fn collect_allocation(len: size_t) {
+pub fn collect_allocation(ptr: *mut c_void, len: size_t) {
     if let Some(profiler) = Profiler::get() {
         // Check if there's a pending time interrupt that we can handle now
         // instead of waiting for an interrupt handler. This is slightly more
@@ -150,6 +155,7 @@ pub fn collect_allocation(len: size_t) {
         unsafe {
             profiler.collect_allocations(
                 zend::ddog_php_prof_get_current_execute_data(),
+                ptr,
                 1_i64,
                 len as i64,
                 (interrupt_count > 0).then_some(interrupt_count),
@@ -158,6 +164,14 @@ pub fn collect_allocation(len: size_t) {
     }
 }
 
+/// Called when memory is freed. If this pointer was tracked for live heap,
+/// sends the deallocation sample to cancel out the original allocation.
+pub fn free_allocation(ptr: *mut c_void) {
+    if let Some(profiler) = Profiler::get() {
+        profiler.free_allocation(ptr);
+    }
+}
+
 #[cfg(not(php_zend_mm_set_custom_handlers_ex))]
 pub fn alloc_prof_startup() {
     allocation_le83::alloc_prof_startup();

profiling/src/allocation/mod.rs

@@ -45,6 +45,7 @@ pub struct SystemSettings {
     pub profiling_experimental_cpu_time_enabled: bool,
     pub profiling_allocation_enabled: bool,
     pub profiling_allocation_sampling_distance: NonZeroU32,
+    pub profiling_heap_live_enabled: bool,
     pub profiling_timeline_enabled: bool,
     pub profiling_exception_enabled: bool,
     pub profiling_exception_message_enabled: bool,
@@ -69,6 +70,7 @@ impl SystemSettings {
             profiling_experimental_cpu_time_enabled: false,
             profiling_allocation_enabled: false,
             profiling_allocation_sampling_distance: NonZeroU32::MAX,
+            profiling_heap_live_enabled: false,
             profiling_timeline_enabled: false,
             profiling_exception_enabled: false,
             profiling_exception_message_enabled: false,
@@ -98,6 +100,7 @@ impl SystemSettings {
             profiling_experimental_cpu_time_enabled: profiling_experimental_cpu_time_enabled(),
             profiling_allocation_enabled: profiling_allocation_enabled(),
             profiling_allocation_sampling_distance: profiling_allocation_sampling_distance(),
+            profiling_heap_live_enabled: profiling_heap_live_enabled(),
             profiling_timeline_enabled: profiling_timeline_enabled(),
             profiling_exception_enabled: profiling_exception_enabled(),
             profiling_exception_message_enabled: profiling_exception_message_enabled(),
@@ -404,6 +407,7 @@ pub(crate) enum ConfigId {
     ProfilingExperimentalCpuTimeEnabled,
     ProfilingAllocationEnabled,
     ProfilingAllocationSamplingDistance,
+    ProfilingHeapLiveEnabled,
     ProfilingTimelineEnabled,
     ProfilingExceptionEnabled,
     ProfilingExceptionMessageEnabled,
@@ -436,6 +440,7 @@ impl ConfigId {
             ProfilingExperimentalCpuTimeEnabled => b"DD_PROFILING_EXPERIMENTAL_CPU_TIME_ENABLED\0",
             ProfilingAllocationEnabled => b"DD_PROFILING_ALLOCATION_ENABLED\0",
             ProfilingAllocationSamplingDistance => b"DD_PROFILING_ALLOCATION_SAMPLING_DISTANCE\0",
+            ProfilingHeapLiveEnabled => b"DD_PROFILING_HEAP_LIVE_ENABLED\0",
             ProfilingTimelineEnabled => b"DD_PROFILING_TIMELINE_ENABLED\0",
             ProfilingExceptionEnabled => b"DD_PROFILING_EXCEPTION_ENABLED\0",
             ProfilingExceptionMessageEnabled => b"DD_PROFILING_EXCEPTION_MESSAGE_ENABLED\0",
@@ -474,6 +479,7 @@ static DEFAULT_SYSTEM_SETTINGS: SystemSettings = SystemSettings {
     profiling_allocation_enabled: true,
     // SAFETY: value is > 0.
     profiling_allocation_sampling_distance: unsafe { NonZeroU32::new_unchecked(1024 * 4096) },
+    profiling_heap_live_enabled: false,
     profiling_timeline_enabled: true,
     profiling_exception_enabled: true,
     profiling_exception_message_enabled: false,
@@ -552,6 +558,17 @@ unsafe fn profiling_allocation_sampling_distance() -> NonZeroU32 {
     unsafe { NonZeroU32::new_unchecked(int) }
 }
 
+/// # Safety
+/// This function must only be called after config has been initialized in
+/// rinit, and before it is uninitialized in mshutdown.
+unsafe fn profiling_heap_live_enabled() -> bool {
+    profiling_allocation_enabled()
+        && get_system_bool(
+            ProfilingHeapLiveEnabled,
+            DEFAULT_SYSTEM_SETTINGS.profiling_heap_live_enabled,
+        )
+}
+
 /// # Safety
 /// This function must only be called after config has been initialized in
 /// rinit, and before it is uninitialized in mshutdown.
@@ -1013,6 +1030,18 @@ pub(crate) fn minit(module_number: libc::c_int) {
                     displayer: None,
                     env_config_fallback: None,
                 },
+                zai_config_entry {
+                    id: transmute::<ConfigId, u16>(ProfilingHeapLiveEnabled),
+                    name: ProfilingHeapLiveEnabled.env_var_name(),
+                    type_: ZAI_CONFIG_TYPE_BOOL,
+                    default_encoded_value: ZaiStr::literal(b"0\0"),
+                    aliases: ptr::null_mut(),
+                    aliases_count: 0,
+                    ini_change: Some(zai_config_system_ini_change),
+                    parser: None,
+                    displayer: None,
+                    env_config_fallback: None,
+                },
                 zai_config_entry {
                     id: transmute::<ConfigId, u16>(ProfilingTimelineEnabled),
                     name: ProfilingTimelineEnabled.env_var_name(),

profiling/src/config.rs

@@ -860,6 +860,19 @@ unsafe extern "C" fn minfo(module_ptr: *mut zend::ModuleEntry) {
                         no_all
                     }
                 );
+                zend::php_info_print_table_row(
+                    2,
+                    c"Heap Live Profiling Enabled".as_ptr(),
+                    if system_settings.profiling_heap_live_enabled {
+                        yes
+                    } else if !system_settings.profiling_allocation_enabled {
+                        c"false (requires allocation profiling)".as_ptr()
+                    } else if system_settings.profiling_enabled {
+                        no
+                    } else {
+                        no_all
+                    },
+                );
                 zend::php_info_print_table_row(
                     2,
                     c"Timeline Enabled".as_ptr(),

profiling/src/lib.rs

@@ -1,7 +1,7 @@
 use crate::profiling::stack_walking::ZendFrame;
 use core::ops::Deref;
 
-#[derive(Debug)]
+#[derive(Clone, Debug)]
 pub struct Backtrace {
     frames: Vec<ZendFrame>,
 }