datadog 2.17.0 → 2.19.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 28053ce1bca4cce2032cb068c38e99a56524e6ccecec3068c4d26d1e750f9790
-  data.tar.gz: 29b6b57640638184370c5176e4da94e74c9770bae8afd7884d1c2baea782350d
+  metadata.gz: 9c533682b9a96989e1ad8d4eb96339af4bffdb5fd9cbfe447bd0a034bc387c03
+  data.tar.gz: 5d7808aa6b7fd5f9c68e453fef4fff8c5345c62fb26a7f7839d630ec0da2fe9f
 SHA512:
-  metadata.gz: caf719b7c9a2e5ee3f47ad0c3e02670b90b1f76bfa5de56c10f69169c97b827f4b9e81df822e548d1390f152f15e756c54c200e9f35904138e7c672af99ef30b
-  data.tar.gz: eda75252942b8c7d278bab14da78c7752b17b136a3f0bd9ed145512a64b3fb8acb110a8cbbfb280b2bcf7c558409ce83b5d311fce5f019ff34516ceb3883255c
+  metadata.gz: 6b35d7ef1ce2f9e565727037f9e5b329d019202ff20c01a15bb5096cf14253b3ab9812d4fc84fc23e265ec2e7e0096e34acc6a845ad510b215ef7df4093107e7
+  data.tar.gz: 72fff247b51de201e4373638627fa419a3a679979f880dfa44c73d1c9a7c062991746045d41cbe5fa47d824b025fb9cad2f34c0139e034df1b85ddb4a07bccd9

data/CHANGELOG.md

@@ -2,6 +2,62 @@
 
 ## [Unreleased]
 
+## [2.19.0] - 2025-07-24
+
+### Added
+
+* AppSec: Added Business Logic Events SDK v2. ([#4802][])
+* Tracing: Add `record_exception` API to capture and attach error information to spans via span events. ([#4771][])
+* Tracing: Add `:cache_store` option to ActiveSupport integration to allow tracing only specified cache backends. ([#4693][])
+* SSI: Rework SSI from the ground up. ([#4366][])
+
+### Changed
+
+* Profiling: Switch profiler stack truncation strategy and improve sampling performance ([#4819][])
+* Profiling: Report GC tuning environment variables with profiles ([#4813][])
+* Profiling: Tag profiles with sequence number ([#4794][])
+* Profiling: Enable sample from inside signal handler by default on modern Rubies ([#4786][], [#4785][])
+
+### Fixed
+
+* Core: Fix emitting duplicate warnings on agent configuration mismatch ([#4814][])
+* Appsec: Fix an error in AppSec route extractor for not-found routes in Rails 8 ([#4793][])
+* Profiling: Add workaround for Ruby VM bug ([#4787][])
+* Profiling: Fix checking for dladdr in profiling ([#4783][])
+* Profiling: Fix potential profiler compilation issue. ([#4783][])
+* Tracing: The mysql integration now only sets the `db.name` tag if there is a valid value ([#4776][])
+* Tracing: The Rails Runner instrumentation should now create Rails Runner spans. ([#4681][])
+* Tracing: Fix sampling rules and sample rate reporting in environment logger. ([#4772][])
+
+### Removed
+
+## [2.18.0] - 2025-07-03
+
+### Added
+
+* AppSec: Add API Security with new sampling algorithm to the Rack, Rails, Sinatra and Grape frameworks ([#4699][])
+* Core: Add support for tracer configuration through Fleet Automation ([#4651][])
+* Tracing: Add Rails view render times and database query times to the spans, when available ([#4697][])
+* Core: Add Service Discovery capability, enabling the tracer to reliably determine which process are instrumented
+
+### Changed
+
+* AppSec: Enable API Security feature by default ([#4756][])
+* AppSec: Improve overall threat detection ([#4757][])
+* AppSec: Deprecate `config.appsec.ip_passlist`, `config.appsec.ip_denylist`, and `config.appsec.user_id_denylist` ([#4757][])
+* Profiling: Graduate Heap Profiling from alpha to preview ([#4401][], [#4460][])
+* Dynamic Instrumentation: Add instance variable capture to method and line probes ([#4668][])
+* Profiling: Add capturing of native filenames in backtraces ([#4745][])
+* Profiling: Clean up profiler logging ([#4728][])
+Tracing: Add support for `DD_RUNTIME_METRICS_RUNTIME_ID_ENABLED` to tag runtime metrics with the current runtime ID, allowing correlation across processes ([#4718][])
+* Tracing: Improve performance of `http.route` tag computation for Rails ([#4688][])
+
+### Fixed
+
+* AppSec: Fix authenticated users tracking in anonymization mode for Devise ([#4731][])
+* Dynamic Instrumentation: Fix source code display in dynamic instrumentation/live debugger ([#4743][])
+* Profiling: Fix profiler stopping due to bug in heap profiling serialization ([#4721][])
+
 ## [2.17.0] - 2025-06-02
 
 ### Added
@@ -3241,7 +3297,9 @@ Release notes: https://github.com/DataDog/dd-trace-rb/releases/tag/v0.3.1
 Git diff: https://github.com/DataDog/dd-trace-rb/compare/v0.3.0...v0.3.1
 
 
-[Unreleased]: https://github.com/DataDog/dd-trace-rb/compare/v2.17.0...master
+[Unreleased]: https://github.com/DataDog/dd-trace-rb/compare/v2.19.0...master
+[2.19.0]: https://github.com/DataDog/dd-trace-rb/compare/v2.18.0...v2.19.0
+[2.18.0]: https://github.com/DataDog/dd-trace-rb/compare/v2.17.0...v2.18.0
 [2.17.0]: https://github.com/DataDog/dd-trace-rb/compare/v2.16.0...v2.17.0
 [2.16.0]: https://github.com/DataDog/dd-trace-rb/compare/v2.15.0...v2.16.0
 [2.15.0]: https://github.com/DataDog/dd-trace-rb/compare/v2.14.0...v2.15.0
@@ -4742,9 +4800,11 @@ Git diff: https://github.com/DataDog/dd-trace-rb/compare/v0.3.0...v0.3.1
 [#4353]: https://github.com/DataDog/dd-trace-rb/issues/4353
 [#4360]: https://github.com/DataDog/dd-trace-rb/issues/4360
 [#4363]: https://github.com/DataDog/dd-trace-rb/issues/4363
+[#4366]: https://github.com/DataDog/dd-trace-rb/issues/4366
 [#4391]: https://github.com/DataDog/dd-trace-rb/issues/4391
 [#4398]: https://github.com/DataDog/dd-trace-rb/issues/4398
 [#4399]: https://github.com/DataDog/dd-trace-rb/issues/4399
+[#4401]: https://github.com/DataDog/dd-trace-rb/issues/4401
 [#4403]: https://github.com/DataDog/dd-trace-rb/issues/4403
 [#4406]: https://github.com/DataDog/dd-trace-rb/issues/4406
 [#4411]: https://github.com/DataDog/dd-trace-rb/issues/4411
@@ -4755,6 +4815,7 @@ Git diff: https://github.com/DataDog/dd-trace-rb/compare/v0.3.0...v0.3.1
 [#4433]: https://github.com/DataDog/dd-trace-rb/issues/4433
 [#4437]: https://github.com/DataDog/dd-trace-rb/issues/4437
 [#4455]: https://github.com/DataDog/dd-trace-rb/issues/4455
+[#4460]: https://github.com/DataDog/dd-trace-rb/issues/4460
 [#4473]: https://github.com/DataDog/dd-trace-rb/issues/4473
 [#4493]: https://github.com/DataDog/dd-trace-rb/issues/4493
 [#4497]: https://github.com/DataDog/dd-trace-rb/issues/4497
@@ -4787,14 +4848,42 @@ Git diff: https://github.com/DataDog/dd-trace-rb/compare/v0.3.0...v0.3.1
 [#4616]: https://github.com/DataDog/dd-trace-rb/issues/4616
 [#4625]: https://github.com/DataDog/dd-trace-rb/issues/4625
 [#4644]: https://github.com/DataDog/dd-trace-rb/issues/4644
+[#4651]: https://github.com/DataDog/dd-trace-rb/issues/4651
 [#4653]: https://github.com/DataDog/dd-trace-rb/issues/4653
 [#4656]: https://github.com/DataDog/dd-trace-rb/issues/4656
 [#4665]: https://github.com/DataDog/dd-trace-rb/issues/4665
+[#4668]: https://github.com/DataDog/dd-trace-rb/issues/4668
 [#4669]: https://github.com/DataDog/dd-trace-rb/issues/4669
 [#4672]: https://github.com/DataDog/dd-trace-rb/issues/4672
 [#4673]: https://github.com/DataDog/dd-trace-rb/issues/4673
 [#4678]: https://github.com/DataDog/dd-trace-rb/issues/4678
 [#4679]: https://github.com/DataDog/dd-trace-rb/issues/4679
+[#4681]: https://github.com/DataDog/dd-trace-rb/issues/4681
+[#4688]: https://github.com/DataDog/dd-trace-rb/issues/4688
+[#4693]: https://github.com/DataDog/dd-trace-rb/issues/4693
+[#4697]: https://github.com/DataDog/dd-trace-rb/issues/4697
+[#4699]: https://github.com/DataDog/dd-trace-rb/issues/4699
+[#4718]: https://github.com/DataDog/dd-trace-rb/issues/4718
+[#4721]: https://github.com/DataDog/dd-trace-rb/issues/4721
+[#4728]: https://github.com/DataDog/dd-trace-rb/issues/4728
+[#4731]: https://github.com/DataDog/dd-trace-rb/issues/4731
+[#4743]: https://github.com/DataDog/dd-trace-rb/issues/4743
+[#4745]: https://github.com/DataDog/dd-trace-rb/issues/4745
+[#4756]: https://github.com/DataDog/dd-trace-rb/issues/4756
+[#4757]: https://github.com/DataDog/dd-trace-rb/issues/4757
+[#4771]: https://github.com/DataDog/dd-trace-rb/issues/4771
+[#4772]: https://github.com/DataDog/dd-trace-rb/issues/4772
+[#4776]: https://github.com/DataDog/dd-trace-rb/issues/4776
+[#4783]: https://github.com/DataDog/dd-trace-rb/issues/4783
+[#4785]: https://github.com/DataDog/dd-trace-rb/issues/4785
+[#4786]: https://github.com/DataDog/dd-trace-rb/issues/4786
+[#4787]: https://github.com/DataDog/dd-trace-rb/issues/4787
+[#4793]: https://github.com/DataDog/dd-trace-rb/issues/4793
+[#4794]: https://github.com/DataDog/dd-trace-rb/issues/4794
+[#4802]: https://github.com/DataDog/dd-trace-rb/issues/4802
+[#4813]: https://github.com/DataDog/dd-trace-rb/issues/4813
+[#4814]: https://github.com/DataDog/dd-trace-rb/issues/4814
+[#4819]: https://github.com/DataDog/dd-trace-rb/issues/4819
 [@AdrianLC]: https://github.com/AdrianLC
 [@Azure7111]: https://github.com/Azure7111
 [@BabyGroot]: https://github.com/BabyGroot

data/ext/datadog_profiling_native_extension/collectors_cpu_and_wall_time_worker.c

@@ -102,6 +102,7 @@ typedef struct {
   bool allocation_counting_enabled;
   bool gvl_profiling_enabled;
   bool skip_idle_samples_for_testing;
+  bool sighandler_sampling_enabled;
   VALUE self_instance;
   VALUE thread_context_collector_instance;
   VALUE idle_sampling_helper_instance;
@@ -122,7 +123,11 @@ typedef struct {
   // Others
 
   // Used to detect/avoid nested sampling, e.g. when on_newobj_event gets triggered by a memory allocation
-  // that happens during another sample.
+  // that happens during another sample, or when the signal handler gets triggered while we're already in the middle of
+  // sampling.
+  //
+  // @ivoanjo: Right now we always sample inside `safely_call`; if that ever changes, this flag may need to become
+  // volatile/atomic/have some barriers to ensure it's visible during e.g. signal handlers.
   bool during_sample;
 
   #ifndef NO_GVL_INSTRUMENTATION
@@ -138,23 +143,15 @@ typedef struct {
     unsigned int trigger_simulated_signal_delivery_attempts;
     // How many times we actually simulated signal delivery
     unsigned int simulated_signal_delivery;
-    // How many times we actually called rb_postponed_job_register_one from a signal handler
+    // How many times we actually called rb_postponed_job_register_one from the signal handler
     unsigned int signal_handler_enqueued_sample;
+    // How many times we prepared a sample (sampled directly) from the signal handler
+    unsigned int signal_handler_prepared_sample;
     // How many times the signal handler was called from the wrong thread
     unsigned int signal_handler_wrong_thread;
     // How many times we actually tried to interrupt a thread for sampling
     unsigned int interrupt_thread_attempts;
 
-    // # Stats for the results of calling rb_postponed_job_register_one
-    // The same function was already waiting to be executed
-    unsigned int postponed_job_skipped_already_existed;
-    // The function was added to the queue successfully
-    unsigned int postponed_job_success;
-    // The queue was full
-    unsigned int postponed_job_full;
-    // The function returned an unknown result code
-    unsigned int postponed_job_unknown_result;
-
     // # CPU/Walltime sampling stats
     // How many times we actually CPU/wall sampled
     unsigned int cpu_sampled;
@@ -238,6 +235,8 @@ static void after_gvl_running_from_postponed_job(DDTRACE_UNUSED void *_unused);
 #endif
 static VALUE rescued_after_gvl_running_from_postponed_job(VALUE self_instance);
 static VALUE _native_gvl_profiling_hook_active(DDTRACE_UNUSED VALUE self, VALUE instance);
+static inline void during_sample_enter(cpu_and_wall_time_worker_state* state);
+static inline void during_sample_exit(cpu_and_wall_time_worker_state* state);
 
 // We're using `on_newobj_event` function with `rb_add_event_hook2`, which requires in its public signature a function
 // with signature `rb_event_hook_func_t` which doesn't match `on_newobj_event`.
@@ -362,6 +361,7 @@ static VALUE _native_new(VALUE klass) {
   state->allocation_counting_enabled = false;
   state->gvl_profiling_enabled = false;
   state->skip_idle_samples_for_testing = false;
+  state->sighandler_sampling_enabled = false;
   state->thread_context_collector_instance = Qnil;
   state->idle_sampling_helper_instance = Qnil;
   state->owner_thread = Qnil;
@@ -372,7 +372,7 @@ static VALUE _native_new(VALUE klass) {
   state->failure_exception = Qnil;
   state->stop_thread = Qnil;
 
-  state->during_sample = false;
+  during_sample_exit(state);
 
   #ifndef NO_GVL_INSTRUMENTATION
     state->gvl_profiling_hook = NULL;
@@ -404,6 +404,7 @@ static VALUE _native_initialize(int argc, VALUE *argv, DDTRACE_UNUSED VALUE _sel
   VALUE allocation_counting_enabled = rb_hash_fetch(options, ID2SYM(rb_intern("allocation_counting_enabled")));
   VALUE gvl_profiling_enabled = rb_hash_fetch(options, ID2SYM(rb_intern("gvl_profiling_enabled")));
   VALUE skip_idle_samples_for_testing = rb_hash_fetch(options, ID2SYM(rb_intern("skip_idle_samples_for_testing")));
+  VALUE sighandler_sampling_enabled = rb_hash_fetch(options, ID2SYM(rb_intern("sighandler_sampling_enabled")));
 
   ENFORCE_BOOLEAN(gc_profiling_enabled);
   ENFORCE_BOOLEAN(no_signals_workaround_enabled);
@@ -413,6 +414,7 @@ static VALUE _native_initialize(int argc, VALUE *argv, DDTRACE_UNUSED VALUE _sel
   ENFORCE_BOOLEAN(allocation_counting_enabled);
   ENFORCE_BOOLEAN(gvl_profiling_enabled);
   ENFORCE_BOOLEAN(skip_idle_samples_for_testing)
+  ENFORCE_BOOLEAN(sighandler_sampling_enabled)
 
   cpu_and_wall_time_worker_state *state;
   TypedData_Get_Struct(self_instance, cpu_and_wall_time_worker_state, &cpu_and_wall_time_worker_typed_data, state);
@@ -424,6 +426,7 @@ static VALUE _native_initialize(int argc, VALUE *argv, DDTRACE_UNUSED VALUE _sel
   state->allocation_counting_enabled = (allocation_counting_enabled == Qtrue);
   state->gvl_profiling_enabled = (gvl_profiling_enabled == Qtrue);
   state->skip_idle_samples_for_testing = (skip_idle_samples_for_testing == Qtrue);
+  state->sighandler_sampling_enabled = (sighandler_sampling_enabled == Qtrue);
 
   double total_overhead_target_percentage = NUM2DBL(dynamic_sampling_rate_overhead_target_percentage);
   if (!state->allocation_profiling_enabled) {
@@ -589,25 +592,30 @@ static void handle_sampling_signal(DDTRACE_UNUSED int _signal, DDTRACE_UNUSED si
     return;
   }
 
-  // We implicitly assume there can be no concurrent nor nested calls to handle_sampling_signal because
-  // a) we get triggered using SIGPROF, and the docs state a second SIGPROF will not interrupt an existing one
+  // We assume there can be no concurrent nor nested calls to handle_sampling_signal because
+  // a) we get triggered using SIGPROF, and the docs state a second SIGPROF will not interrupt an existing one (see sigaction docs on sa_mask)
   // b) we validate we are in the thread that has the global VM lock; if a different thread gets a signal, it will return early
   //    because it will not have the global VM lock
 
-  // Note: rb_postponed_job_register_one ensures that if there's a previous sample_from_postponed_job queued for execution
-  // then we will not queue a second one. It does this by doing a linear scan on the existing jobs; in the future we
-  // may want to implement that check ourselves.
-
   state->stats.signal_handler_enqueued_sample++;
 
-  // Note: If we ever want to get rid of rb_postponed_job_register_one, remember not to clobber Ruby exceptions, as
-  // this function does this helpful job for us now -- https://github.com/ruby/ruby/commit/a98e343d39c4d7bf1e2190b076720f32d9f298b3.
+  bool sample_from_signal_handler =
+    state->sighandler_sampling_enabled &&
+    // Don't sample if we're already in the middle of processing a sample
+    !state->during_sample;
+
+  if (sample_from_signal_handler) {
+    // Buffer current stack trace. Note that this will not actually record the sample, for that we still need to wait
+    // until the postponed job below gets run.
+    bool prepared = thread_context_collector_prepare_sample_inside_signal_handler(state->thread_context_collector_instance);
+
+    if (prepared) state->stats.signal_handler_prepared_sample++;
+  }
+
   #ifndef NO_POSTPONED_TRIGGER // Ruby 3.3+
     rb_postponed_job_trigger(sample_from_postponed_job_handle);
-    state->stats.postponed_job_success++; // Always succeeds
   #else
-
-    // This is a workaround for https://bugs.ruby-lang.org/issues/19991 (for Ruby < 3.3)
+    // Passing in `gc_finalize_deferred_workaround` is a workaround for https://bugs.ruby-lang.org/issues/19991 (for Ruby < 3.3)
     //
     // TL;DR the `rb_postponed_job_register_one` API is not atomic (which is why it got replaced by `rb_postponed_job_trigger`)
     // and in rare cases can cause VM crashes.
@@ -631,20 +639,7 @@ static void handle_sampling_signal(DDTRACE_UNUSED int _signal, DDTRACE_UNUSED si
     //
     // Thus, our workaround is simple: we pass in objspace as our argument, just in case the clobbering happens.
     // In the happy path, we never use this argument so it makes no difference. In the buggy path, we avoid crashing the VM.
-    int result = rb_postponed_job_register(0, sample_from_postponed_job, gc_finalize_deferred_workaround /* instead of NULL */);
-
-    // Officially, the result of rb_postponed_job_register_one is documented as being opaque, but in practice it does not
-    // seem to have changed between Ruby 2.3 and 3.2, and so we track it as a debugging mechanism
-    switch (result) {
-      case 0:
-        state->stats.postponed_job_full++; break;
-      case 1:
-        state->stats.postponed_job_success++; break;
-      case 2:
-        state->stats.postponed_job_skipped_already_existed++; break;
-      default:
-        state->stats.postponed_job_unknown_result++;
-    }
+    rb_postponed_job_register(0, sample_from_postponed_job, gc_finalize_deferred_workaround /* instead of NULL */);
   #endif
 }
 
@@ -714,6 +709,8 @@ static void interrupt_sampling_trigger_loop(void *state_ptr) {
   atomic_store(&state->should_run, false);
 }
 
+  // Note: If we ever want to get rid of the postponed job execution, remember not to clobber Ruby exceptions, as
+  // this function does this helpful job for us now -- https://github.com/ruby/ruby/commit/a98e343d39c4d7bf1e2190b076720f32d9f298b3.
 static void sample_from_postponed_job(DDTRACE_UNUSED void *_unused) {
   cpu_and_wall_time_worker_state *state = active_sampler_instance_state; // Read from global variable, see "sampler global state safety" note above
 
@@ -726,12 +723,12 @@ static void sample_from_postponed_job(DDTRACE_UNUSED void *_unused) {
     return; // We're not on the main Ractor; we currently don't support profiling non-main Ractors
   }
 
-  state->during_sample = true;
+  during_sample_enter(state);
 
   // Rescue against any exceptions that happen during sampling
   safely_call(rescued_sample_from_postponed_job, state->self_instance, state->self_instance);
 
-  state->during_sample = false;
+  during_sample_exit(state);
 }
 
 static VALUE rescued_sample_from_postponed_job(VALUE self_instance) {
@@ -937,11 +934,11 @@ static void after_gc_from_postponed_job(DDTRACE_UNUSED void *_unused) {
     return; // We're not on the main Ractor; we currently don't support profiling non-main Ractors
   }
 
-  state->during_sample = true;
+  during_sample_enter(state);
 
   safely_call(thread_context_collector_sample_after_gc, state->thread_context_collector_instance, state->self_instance);
 
-  state->during_sample = false;
+  during_sample_exit(state);
 }
 
 // Equivalent to Ruby begin/rescue call, where we call a C function and jump to the exception handler if an
@@ -1019,11 +1016,8 @@ static VALUE _native_stats(DDTRACE_UNUSED VALUE self, VALUE instance) {
     ID2SYM(rb_intern("trigger_simulated_signal_delivery_attempts")), /* => */ UINT2NUM(state->stats.trigger_simulated_signal_delivery_attempts),
     ID2SYM(rb_intern("simulated_signal_delivery")),                  /* => */ UINT2NUM(state->stats.simulated_signal_delivery),
     ID2SYM(rb_intern("signal_handler_enqueued_sample")),             /* => */ UINT2NUM(state->stats.signal_handler_enqueued_sample),
+    ID2SYM(rb_intern("signal_handler_prepared_sample")),             /* => */ UINT2NUM(state->stats.signal_handler_prepared_sample),
     ID2SYM(rb_intern("signal_handler_wrong_thread")),                /* => */ UINT2NUM(state->stats.signal_handler_wrong_thread),
-    ID2SYM(rb_intern("postponed_job_skipped_already_existed")),      /* => */ UINT2NUM(state->stats.postponed_job_skipped_already_existed),
-    ID2SYM(rb_intern("postponed_job_success")),                      /* => */ UINT2NUM(state->stats.postponed_job_success),
-    ID2SYM(rb_intern("postponed_job_full")),                         /* => */ UINT2NUM(state->stats.postponed_job_full),
-    ID2SYM(rb_intern("postponed_job_unknown_result")),               /* => */ UINT2NUM(state->stats.postponed_job_unknown_result),
     ID2SYM(rb_intern("interrupt_thread_attempts")),                  /* => */ UINT2NUM(state->stats.interrupt_thread_attempts),
 
     // CPU Stats
@@ -1073,8 +1067,7 @@ void *simulate_sampling_signal_delivery(DDTRACE_UNUSED void *_unused) {
 
   state->stats.simulated_signal_delivery++;
 
-  // @ivoanjo: We could instead directly call sample_from_postponed_job, but I chose to go through the signal handler
-  // so that the simulated case is as close to the original one as well (including any metrics increases, etc).
+  // `handle_sampling_signal` does a few things extra on top of `sample_from_postponed_job` so that's why we don't shortcut here
   handle_sampling_signal(0, NULL, NULL);
 
   return NULL; // Unused
@@ -1207,11 +1200,7 @@ static void on_newobj_event(DDTRACE_UNUSED VALUE unused1, DDTRACE_UNUSED void *u
     &state->allocation_sampler, HANDLE_CLOCK_FAILURE(monotonic_wall_time_now_ns(DO_NOT_RAISE_ON_FAILURE))
   );
 
-  // @ivoanjo: Strictly speaking, this is not needed because Ruby should not call the same tracepoint while a previous
-  // invocation is still pending, (e.g. it wouldn't call `on_newobj_event` while it's already running), but I decided
-  // to keep this here for consistency -- every call to the thread context (other than the special gc calls which are
-  // defined as not being able to allocate) sets this.
-  state->during_sample = true;
+  during_sample_enter(state);
 
   // Rescue against any exceptions that happen during sampling
   safely_call(rescued_sample_allocation, Qnil, state->self_instance);
@@ -1232,7 +1221,7 @@ static void on_newobj_event(DDTRACE_UNUSED VALUE unused1, DDTRACE_UNUSED void *u
 
   state->stats.allocation_sampled++;
 
-  state->during_sample = false;
+  during_sample_exit(state);
 }
 
 static void disable_tracepoints(cpu_and_wall_time_worker_state *state) {
@@ -1373,12 +1362,12 @@ static VALUE _native_resume_signals(DDTRACE_UNUSED VALUE self) {
     // This can potentially happen if the CpuAndWallTimeWorker was stopped while the postponed job was waiting to be executed; nothing to do
     if (state == NULL) return;
 
-    state->during_sample = true;
+    during_sample_enter(state);
 
     // Rescue against any exceptions that happen during sampling
     safely_call(rescued_after_gvl_running_from_postponed_job, state->self_instance, state->self_instance);
 
-    state->during_sample = false;
+    during_sample_exit(state);
   }
 
   static VALUE rescued_after_gvl_running_from_postponed_job(VALUE self_instance) {
@@ -1414,3 +1403,21 @@ static VALUE _native_resume_signals(DDTRACE_UNUSED VALUE self) {
     return Qfalse;
   }
 #endif
+
+static inline void during_sample_enter(cpu_and_wall_time_worker_state* state) {
+  // Tell the compiler it's not allowed to reorder the `during_sample` flag with anything that happens after.
+  //
+  // In a few cases, we may be checking this flag from a signal handler, so we need to make sure the compiler didn't
+  // get clever and reordered things in such a way that makes us miss the flag update.
+  //
+  // See https://github.com/ruby/ruby/pull/11036 for a similar change made to the Ruby VM with more context.
+  state->during_sample = true;
+  atomic_signal_fence(memory_order_seq_cst);
+}
+
+static inline void during_sample_exit(cpu_and_wall_time_worker_state* state) {
+  // See `during_sample_enter` for more context; in this case we set the fence before to make sure anything that
+  // happens before the fence is not reordered with the flag update.
+  atomic_signal_fence(memory_order_seq_cst);
+  state->during_sample = false;
+}