datadog 2.46.0 → 2.48.0

data/lib/datadog/di/capture_expression_evaluator.rb

@@ -7,6 +7,7 @@ require_relative "evaluation_failure"
 require_relative "fatal_exceptions"
 require_relative "guardrails_telemetry"
 require_relative "../core/utils/time"
+require_relative "el"
 
 module Datadog
   module DI
@@ -16,7 +17,7 @@ module Datadog
       # @param settings [Datadog::Core::Configuration::Settings] tracer settings
       # @param serializer [Serializer] serializer for captured expression values
       # @param logger [DI::Logger] logger for evaluation failure diagnostics
-      # @param guardrails_telemetry [GuardrailsTelemetry] emitter for the canonical capture-timeout skip metric
+      # @param guardrails_telemetry [GuardrailsTelemetry] emitter for the canonical evaluation-timeout skip metric
       # @param telemetry [Datadog::Core::Telemetry::Component, nil] component evaluation failures are reported through
       # @return [void]
       def initialize(settings:, serializer:, logger:, guardrails_telemetry:, telemetry: nil)
@@ -42,8 +43,13 @@ module Datadog
       # Evaluates each of the probe's capture expressions against the given
       # context, serializing the captured values under one capture deadline
       # resolved through the serializer and shared across all expressions.
-      # An expression that fails to evaluate or serialize contributes an entry
-      # to the returned errors.
+      # Each expression resolves its own evaluation deadline immediately
+      # before its evaluation and is evaluated under the earlier of that
+      # deadline and the capture deadline, so the capture expressions
+      # together stay within the capture budget. An expression the capture
+      # budget stops is reported as not captured; an expression that fails
+      # to evaluate or serialize otherwise contributes an entry to the
+      # returned errors.
       #
       # @param probe [Probe] the probe whose capture expressions are evaluated
       # @param context [Context] evaluation context the expressions are evaluated against
@@ -59,18 +65,14 @@ module Datadog
         probe.capture_expressions.each do |capture_expression|
           name = capture_expression.name
 
-          if Core::Utils::Time.get_time >= deadline
-            output[name] = {notCapturedReason: "timeout"}
-            telemetry&.inc(DI::TELEMETRY_NAMESPACE, "capture_expressions_skipped_by_timeout", 1)
-            guardrails_telemetry.skipped(
-              reason: GuardrailsTelemetry::Reason::EVALUATION_TIMEOUT,
-              probe: probe,
-            )
+          if capture_deadline_passed?(deadline)
+            record_capture_timeout(output, name, probe)
             next
           end
 
           begin
-            value = capture_expression.expr.evaluate(context)
+            evaluation_deadline = [serializer.evaluation_deadline, deadline].min
+            value = capture_expression.expr.evaluate(context, evaluation_deadline: evaluation_deadline)
             limits = CaptureLimits.resolve(
               expr_limits: capture_expression.limits,
               probe: probe,
@@ -86,6 +88,14 @@ module Datadog
             )
           rescue Exception => exc # standard:disable Lint/RescueException
             Datadog::DI.reraise_if_fatal(exc)
+            if exc.is_a?(DI::Error::EvaluationTimeout) && capture_deadline_passed?(deadline)
+              record_capture_timeout(output, name, probe)
+              next
+            end
+            DI.report_evaluation_timeout(
+              telemetry: telemetry, guardrails_telemetry: guardrails_telemetry, logger: logger,
+              probe: probe, kind: "capture expression", exc: exc,
+            )
             evaluation_errors << EvaluationFailure.new(expr: name, message: "#{exc.class}: #{exc.message}")
             logger.debug do
               "di: probe #{probe.id}: capture expression #{name}: evaluation failed: #{exc.class}: #{exc.message}"
@@ -96,6 +106,33 @@ module Datadog
 
         Result.new(serialized_values: output, errors: evaluation_errors)
       end
+
+      private
+
+      # Returns whether the thread CPU clock has reached +capture_deadline+.
+      #
+      # @param capture_deadline [Float] the capture deadline, as
+      #   CLOCK_THREAD_CPUTIME_ID float seconds.
+      # @return [Boolean]
+      def capture_deadline_passed?(capture_deadline)
+        Process.clock_gettime(Process::CLOCK_THREAD_CPUTIME_ID, :float_second) >= capture_deadline
+      end
+
+      # Reports capture expression +name+ as not captured because the
+      # capture budget ran out.
+      #
+      # @param output [Hash{String => Object}] serialized values by name.
+      # @param name [String] the capture expression's name.
+      # @param probe [Probe] the probe whose capture expression is stopped.
+      # @return [void]
+      def record_capture_timeout(output, name, probe)
+        output[name] = {notCapturedReason: "timeout"}
+        telemetry&.inc(DI::TELEMETRY_NAMESPACE, "capture_expressions_skipped_by_timeout", 1)
+        guardrails_telemetry.skipped(
+          reason: GuardrailsTelemetry::Reason::EVALUATION_TIMEOUT,
+          probe: probe,
+        )
+      end
     end
   end
 end

data/lib/datadog/di/component.rb

@@ -100,10 +100,11 @@ module Datadog
         )
         @instrumenter = Instrumenter.new(settings, serializer, logger, code_tracker: code_tracker, telemetry: telemetry,
           guardrails_telemetry: guardrails_telemetry,
-          capture_expression_evaluator: capture_expression_evaluator,)
+          capture_expression_evaluator: capture_expression_evaluator)
         @probe_repository = ProbeRepository.new
         @probe_notification_builder = ProbeNotificationBuilder.new(settings, serializer, logger,
-          capture_expression_evaluator: capture_expression_evaluator,)
+          capture_expression_evaluator: capture_expression_evaluator, guardrails_telemetry: guardrails_telemetry,
+          telemetry: telemetry)
         @probe_notifier_worker = ProbeNotifierWorker.new(
           settings, logger,
           agent_settings: agent_settings,
@@ -122,6 +123,7 @@ module Datadog
         # cannot race a foreground start! with a background stop!.
         @lifecycle_mutex = Mutex.new
         @started = false
+        @rc_enablement_signal_paths = []
       end
 
       attr_reader :settings
@@ -201,6 +203,75 @@ module Datadog
         @started
       end
 
+      # Whether the component is started while the customer left
+      # DD_DYNAMIC_INSTRUMENTATION_ENABLED at its default, the state produced
+      # by remote-configuration enablement.
+      #
+      # An explicit `enabled = false` takes precedence over a prior RC
+      # enablement: once the customer sets the option, this returns false
+      # even while the component is still started.
+      #
+      # @return [Boolean]
+      def implicitly_enabled?
+        started? && settings.dynamic_instrumentation.using_default?(:enabled)
+      end
+
+      # Whether an APM_TRACING merge that omitted dynamic_instrumentation_enabled
+      # withdraws this component's RC enable signal, so the component must stop.
+      #
+      # Returns true when the component is implicitly enabled and no unparseable
+      # content can be the signal carrier. A content at a recorded signal path can be
+      # the carrier. When no paths are recorded, every unparseable content can be the
+      # carrier.
+      #
+      # @param unparseable_contents [Array<Core::Remote::Configuration::Content>] the APM_TRACING contents that failed to parse at this merge
+      # @return [Boolean]
+      def rc_enablement_signal_withdrawn?(unparseable_contents)
+        return false unless implicitly_enabled?
+
+        recorded_signal_paths = rc_enablement_signal_paths
+        signal_source_unparseable =
+          if recorded_signal_paths.empty?
+            unparseable_contents.any?
+          else
+            unparseable_contents.any? { |content| recorded_signal_paths.include?(content.path) }
+          end
+        if signal_source_unparseable
+          if recorded_signal_paths.empty?
+            logger.trace do
+              "APM_TRACING RC: dynamic_instrumentation_enabled absent while an APM_TRACING config " \
+              "failed to parse; the enable signal carrier is unknown (no signal paths recorded), " \
+              "keeping the DI state"
+            end
+          else
+            logger.trace do
+              "APM_TRACING RC: dynamic_instrumentation_enabled absent while the config that carried " \
+              "the enable signal failed to parse; keeping the DI state"
+            end
+          end
+          false
+        else
+          logger.trace { "APM_TRACING RC: dynamic_instrumentation_enabled withdrawn; treating as false" }
+          true
+        end
+      end
+
+      # The repository paths of the APM_TRACING contents that supplied the
+      # dynamic_instrumentation_enabled value at the last merge where the field was
+      # present. The component holds the paths so that they outlive the RC client.
+      #
+      # @return [Array<Core::Remote::Configuration::Path>]
+      attr_reader :rc_enablement_signal_paths
+
+      # Replaces the recorded enable-signal carrier paths.
+      #
+      # @param paths [Array<Core::Remote::Configuration::Path>] the carrier paths, empty when the merged field was absent
+      # @return [void]
+      def record_rc_enablement_signal_paths(paths)
+        @rc_enablement_signal_paths = paths.dup
+        nil
+      end
+
       # Shuts down dynamic instrumentation permanently.
       #
       # Removes all code hooks and stops background threads.

data/lib/datadog/di/configuration.rb

@@ -169,6 +169,25 @@ module Datadog
                 end
               end
 
+              # Maximum thread CPU time, in milliseconds, allowed for
+              # evaluating expressions. The env var key is shared with
+              # other tracers, which measure wall time for it.
+              #
+              # @return [Integer]
+              option :max_time_to_evaluate_ms do |o|
+                o.type :int
+                o.default 50
+                o.env "DD_DYNAMIC_INSTRUMENTATION_EVALUATION_TIMEOUT_MS"
+                o.setter do |value, _old|
+                  if value < 0
+                    raise ArgumentError,
+                      "The setting `dynamic_instrumentation.max_time_to_evaluate_ms` must not be negative, " \
+                        "but `#{value.inspect}` was provided."
+                  end
+                  value
+                end
+              end
+
               # Settings in the 'internal' group are for internal Datadog
               # use only, and are needed to test dynamic instrumentation or
               # experiment with features not released to customers.

data/lib/datadog/di/contrib/active_record.rb

@@ -9,7 +9,7 @@ Datadog::DI::Serializer.register(
   # An alternative could have been to make DI specifically provide lookup
   # logic for "instances of classes derived from X", but a condition Proc
   # is more universal.
-  condition: lambda { |value| ActiveRecord::Base === value }
+  condition: lambda { |value| ActiveRecord::Base === value },
 ) do |serializer, value, name:, depth:, deadline:|
   # +serializer+ is an instance of DI::Serializer.
   # Use it to perform the serialization to primitive values.

data/lib/datadog/di/el/compiler.rb

@@ -133,7 +133,7 @@ module Datadog
                   raise DI::Error::BadVariableName, "Bad variable name: #{target}"
                 end
                 method_name = (($1 == "@") ? "iref" : "ref")
-                "#{method_name}('#{target}')"
+                "#{method_name}(context, '#{target}')"
               end
             when *SINGLE_ARG_METHODS
               method_name = op.gsub(/[A-Z]/) { |m| "_#{m.downcase}" }
@@ -146,10 +146,10 @@ module Datadog
               if String === second
                 # Match against a literal regular expression (string).
                 index = precompile_regexp(second, regexps)
-                "matches_compiled(#{compile_partial(first, regexps)}, #{index})"
+                "matches_compiled(#{compile_partial(first, regexps)}, #{index}, evaluation_deadline)"
               else
                 # Match against a (complex) expression.
-                "matches(#{compile_partial(first, regexps)}, (#{compile_partial(second, regexps)}))"
+                "matches(#{compile_partial(first, regexps)}, (#{compile_partial(second, regexps)}), evaluation_deadline)"
               end
             when *TWO_ARG_METHODS
               method_name = op.gsub(/[A-Z]/) { |m| "_#{m.downcase}" }
@@ -185,7 +185,7 @@ module Datadog
               unless Array === target && target.length == 2
                 raise DI::Error::InvalidExpression, "Improper #{op} syntax"
               end
-              "#{op}(#{compile_partial(target.first, regexps)}) { |current_item, current_key, current_value| #{compile_partial(target.last, regexps)} }"
+              "#{op}(#{compile_partial(target.first, regexps)}, evaluation_deadline) { |current_item, current_key, current_value| #{compile_partial(target.last, regexps)} }"
             else
               raise DI::Error::InvalidExpression, "Unknown operation: #{op}"
             end

data/lib/datadog/di/el/evaluator.rb

@@ -12,8 +12,29 @@ module Datadog
       # @api private
       class Evaluator
         # Maximum wall-clock time allowed for evaluating a single `matches`
-        # operator.
-        MATCHES_TIMEOUT_SECONDS = 0.5
+        # operator. Wall clock, while the evaluation budget is thread CPU
+        # time: the regexp engine's `timeout:` keyword and Timeout.timeout
+        # offer no CPU-time mode.
+        MATCHES_TIMEOUT_SECONDS = 0.05
+
+        MATCHES_TIMEOUT_MESSAGE = "matches operator timeout"
+
+        # Number of collection items processed between cooperative
+        # evaluation-deadline checks; evaluation aborts within one
+        # interval's worth of items past the deadline. A `matches`
+        # invocation can spend MATCHES_TIMEOUT_SECONDS of wall time, so
+        # #matches and #matches_compiled check the deadline before each
+        # match; a predicate that runs `matches` per item therefore
+        # adds at most the one match in flight when the deadline
+        # passes to the overshoot.
+        EVALUATION_DEADLINE_CHECK_INTERVAL = 64
+
+        # Built-in Array#each and Hash#each, resolved once at load and
+        # bound per invocation: the collection operators' iteration then
+        # dispatches no customer each override during probe evaluation.
+        ARRAY_EACH = Array.instance_method(:each)
+        HASH_EACH = Hash.instance_method(:each)
+        private_constant :ARRAY_EACH, :HASH_EACH
 
         # @param regexps [Array<Regexp>] Regexps precompiled from literal
         #   `matches` patterns, looked up by index by #matches_compiled.
@@ -25,12 +46,110 @@ module Datadog
 
         attr_reader :regexps
 
-        def ref(var)
-          @context.fetch(var)
+        # Raises DI::Error::EvaluationTimeout when the evaluation deadline
+        # has been exceeded, aborting evaluation cooperatively.
+        #
+        # @param evaluation_deadline [Float] invocation-local evaluation
+        #   deadline, passed from the compiled #evaluate into the operator
+        #   calls.
+        # @return [void]
+        # @raise [DI::Error::EvaluationTimeout] the deadline has been exceeded.
+        def raise_if_evaluation_deadline_exceeded(evaluation_deadline)
+          if self.class.evaluation_deadline_exceeded?(evaluation_deadline)
+            raise DI::Error::EvaluationTimeout
+          end
+        end
+        private :raise_if_evaluation_deadline_exceeded
+
+        # Raises DI::Error::EvaluationTimeout when +item_index+ falls on
+        # a cooperative check boundary and the evaluation deadline has
+        # been exceeded. The thread CPU clock is read only at every
+        # EVALUATION_DEADLINE_CHECK_INTERVAL-th item, so an already-exceeded
+        # deadline raises at the first boundary at or after it passes.
+        #
+        # @param item_index [Integer] zero-based index of the collection
+        #   element being processed.
+        # @param evaluation_deadline [Float] invocation-local evaluation
+        #   deadline, passed from the compiled #evaluate into the operator
+        #   calls.
+        # @return [void]
+        # @raise [DI::Error::EvaluationTimeout] a check boundary was reached
+        #   with the deadline exceeded.
+        def raise_if_deadline_check_due_and_exceeded(item_index, evaluation_deadline)
+          if (item_index % EVALUATION_DEADLINE_CHECK_INTERVAL).zero?
+            raise_if_evaluation_deadline_exceeded(evaluation_deadline)
+          end
+        end
+        private :raise_if_deadline_check_due_and_exceeded
+
+        # Yields the evaluation values for one collection element — the
+        # item alone for an Array element, or the [key, value] pair as
+        # @it together with the @key and the @value for a Hash element —
+        # iterating through the built-in iteration methods bound per
+        # invocation and performing the interval-gated evaluation-deadline
+        # check and its counter advance between elements.
+        #
+        # @param collection [Array, Hash] collection whose elements the
+        #   block receives.
+        # @param evaluation_deadline [Float] invocation-local evaluation deadline.
+        # @param operator_name [String] name of the invoking collection
+        #   operator, reported in the bad-collection-type error.
+        # @yield [current_item, current_key, current_value] evaluation
+        #   values for one element.
+        # @return [void]
+        # @raise [DI::Error::EvaluationTimeout] the evaluation deadline was
+        #   exceeded mid-iteration.
+        # @raise [DI::Error::ExpressionEvaluationError] +collection+ is
+        #   not an Array or a Hash.
+        def each_collection_item(collection, evaluation_deadline, operator_name)
+          case collection
+          when Array
+            i = 0
+            ARRAY_EACH.bind(collection).call do |item|
+              raise_if_deadline_check_due_and_exceeded(i, evaluation_deadline)
+              i += 1
+              yield item, nil, nil
+            end
+          when Hash
+            i = 0
+            HASH_EACH.bind(collection).call do |key, value|
+              raise_if_deadline_check_due_and_exceeded(i, evaluation_deadline)
+              i += 1
+              yield [key, value], key, value
+            end
+          else
+            raise DI::Error::ExpressionEvaluationError, "Bad collection type for #{operator_name}: #{collection.class}"
+          end
+          nil
+        end
+        private :each_collection_item
+
+        # Returns whether the thread CPU clock has passed +evaluation_deadline+.
+        #
+        # @param evaluation_deadline [Float] the deadline to check.
+        # @return [Boolean] whether the deadline has been exceeded.
+        def self.evaluation_deadline_exceeded?(evaluation_deadline)
+          Process.clock_gettime(Process::CLOCK_THREAD_CPUTIME_ID, :float_second) >= evaluation_deadline
+        end
+
+        # Resolves the value of the local variable or argument +var+ from
+        # the evaluation +context+.
+        #
+        # @param context [Context] context holding the evaluation locals.
+        # @param var [Symbol, String] name of the local variable or argument.
+        # @return [Object] value of the local variable or argument.
+        def ref(context, var)
+          context.fetch(var)
         end
 
-        def iref(var)
-          @context.fetch_ivar(var)
+        # Resolves the value of the instance variable +var+ from the
+        # receiver of the evaluation +context+.
+        #
+        # @param context [Context] context holding the evaluation receiver.
+        # @param var [Symbol, String] name of the instance variable.
+        # @return [Object] value of the instance variable.
+        def iref(context, var)
+          context.fetch_ivar(var)
         end
 
         def len(var, var_name)
@@ -92,10 +211,14 @@ module Datadog
         #
         # @param haystack [String] string to match against.
         # @param needle [String] regexp source.
+        # @param evaluation_deadline [Float] invocation-local evaluation
+        #   deadline.
         # @return [Boolean] whether the haystack matches the regexp.
-        # @raise [Regexp::TimeoutError] (Ruby 3.2+) regexp engine exceeded MATCHES_TIMEOUT_SECONDS.
-        # @raise [Timeout::Error] (Ruby < 3.2) Timeout.timeout fired.
-        def matches(haystack, needle)
+        # @raise [DI::Error::EvaluationTimeout] the evaluation deadline was
+        #   exceeded before the match started, or the match exceeded
+        #   MATCHES_TIMEOUT_SECONDS.
+        def matches(haystack, needle, evaluation_deadline)
+          raise_if_evaluation_deadline_exceeded(evaluation_deadline)
           bounded_match?(Evaluator.compile_regexp(needle), haystack)
         end
 
@@ -104,10 +227,14 @@ module Datadog
         #
         # @param haystack [String] string to match against.
         # @param index [Integer] position of the precompiled Regexp in +regexps+.
+        # @param evaluation_deadline [Float] invocation-local evaluation
+        #   deadline.
         # @return [Boolean] whether the haystack matches the regexp.
-        # @raise [Regexp::TimeoutError] (Ruby 3.2+) regexp engine exceeded MATCHES_TIMEOUT_SECONDS.
-        # @raise [Timeout::Error] (Ruby < 3.2) Timeout.timeout fired.
-        def matches_compiled(haystack, index)
+        # @raise [DI::Error::EvaluationTimeout] the evaluation deadline was
+        #   exceeded before the match started, or the match exceeded
+        #   MATCHES_TIMEOUT_SECONDS.
+        def matches_compiled(haystack, index, evaluation_deadline)
+          raise_if_evaluation_deadline_exceeded(evaluation_deadline)
           bounded_match?(regexps.fetch(index), haystack)
         end
 
@@ -117,18 +244,32 @@ module Datadog
         # @param re [Regexp] regexp to match against.
         # @param haystack [String] string to match against.
         # @return [Boolean] whether the haystack matches the regexp.
+        # @raise [DI::Error::EvaluationTimeout] the match exceeded
+        #   MATCHES_TIMEOUT_SECONDS.
         if Datadog::RubyVersion.is?(">= 3.2")
           def bounded_match?(re, haystack)
             # Uses Regexp#match? rather than =~ so that the
             # thread-local match data ($~, $1, ...) is not mutated as a side
             # effect of DI expression evaluation.
             re.match?(haystack)
+          rescue Regexp::TimeoutError
+            raise DI::Error::EvaluationTimeout.new(message: MATCHES_TIMEOUT_MESSAGE)
           end
         else
+          # Raised by Timeout.timeout in the matching thread. A dedicated
+          # class because Timeout.timeout passes a positional message,
+          # which EvaluationTimeout does not accept, and because rescuing
+          # Timeout::Error would also catch an enclosing customer timeout.
+          class MatchTimeoutSignal < StandardError
+          end
+          private_constant :MatchTimeoutSignal
+
           def bounded_match?(re, haystack)
-            Timeout.timeout(MATCHES_TIMEOUT_SECONDS) do
+            Timeout.timeout(MATCHES_TIMEOUT_SECONDS, MatchTimeoutSignal) do
               re.match?(haystack)
             end
+          rescue MatchTimeoutSignal
+            raise DI::Error::EvaluationTimeout.new(message: MATCHES_TIMEOUT_MESSAGE)
           end
         end
         private :bounded_match?
@@ -171,50 +312,113 @@ module Datadog
           String === haystack && haystack.end_with?(needle)
         end
 
-        def all(collection, &block)
-          case collection
-          when Array
-            collection.all? do |item|
-              block.call(item)
-            end
-          when Hash
-            # For hashes, the expression language has both @it and
-            # @key/@value. Manufacture @it from the key and value.
-            collection.all? do |key, value|
-              block.call([key, value], key, value)
+        # Returns true when +block+ returns a truthy value for every element
+        # of +collection+.
+        #
+        # @param collection [Array, Hash] collection to test.
+        # @param evaluation_deadline [Float] invocation-local evaluation deadline.
+        # @return [Boolean] whether the block is satisfied by every element.
+        # @raise [DI::Error::EvaluationTimeout] the evaluation deadline was
+        #   exceeded mid-iteration.
+        # @raise [DI::Error::ExpressionEvaluationError] +collection+ is not
+        #   an Array or a Hash.
+        def all(collection, evaluation_deadline, &block)
+          result = true
+          each_collection_item(collection, evaluation_deadline, "all") do |current_item, current_key, current_value|
+            unless block.call(current_item, current_key, current_value)
+              result = false
+              break
             end
-          else
-            raise DI::Error::ExpressionEvaluationError, "Bad collection type for all: #{collection.class}"
           end
+          result
         end
 
-        def any(collection, &block)
-          case collection
-          when Array
-            collection.any? do |item|
-              block.call(item)
+        # Returns true when +block+ returns a truthy value for any element
+        # of +collection+.
+        #
+        # @param collection [Array, Hash] collection to test.
+        # @param evaluation_deadline [Float] invocation-local evaluation deadline.
+        # @return [Boolean] whether the block is satisfied by any element.
+        # @raise [DI::Error::EvaluationTimeout] the evaluation deadline was
+        #   exceeded mid-iteration.
+        # @raise [DI::Error::ExpressionEvaluationError] +collection+ is not
+        #   an Array or a Hash.
+        def any(collection, evaluation_deadline, &block)
+          result = false
+          each_collection_item(collection, evaluation_deadline, "any") do |current_item, current_key, current_value|
+            if block.call(current_item, current_key, current_value)
+              result = true
+              break
             end
-          when Hash
-            collection.any? do |key, value|
-              # For hashes, the expression language has both @it and
-              # @key/@value. Manufacture @it from the key and value.
+          end
+          result
+        end
+
+        # Returns the key-value pairs of the Hash +collection+ for which
+        # +block+ returns a truthy value.
+        #
+        # Ruby 3.1 changed Hash#select to reuse the stored key hashes
+        # instead of invoking the keys' hash methods and to keep a
+        # compare_by_identity hash's distinct-but-eql? keys and identity
+        # flag, so this Ruby filters through the built-in Hash#select
+        # bound per invocation. Earlier Rubies invoke the keys' hash
+        # methods and collapse identity hashes, so they keep the manual
+        # iteration through #each_collection_item, preserving the source
+        # hash's identity mode in the result.
+        if Datadog::RubyVersion.is?(">= 3.1")
+          # Built-in Hash#select, resolved once at load and bound per
+          # invocation: #filter's Hash iteration then dispatches no
+          # customer select override during probe evaluation.
+          HASH_SELECT = Hash.instance_method(:select)
+          private_constant :HASH_SELECT
+
+          def filter_hash(collection, evaluation_deadline, &block)
+            i = 0
+            HASH_SELECT.bind(collection).call do |key, value|
+              raise_if_deadline_check_due_and_exceeded(i, evaluation_deadline)
+              i += 1
               block.call([key, value], key, value)
+            end.to_h
+          end
+        else
+          # Core identity-mode check, resolved once at load and bound per
+          # invocation so that #filter dispatches no customer
+          # compare_by_identity? override during probe evaluation.
+          IDENTITY_MODE_CHECK = Hash.instance_method(:compare_by_identity?)
+          private_constant :IDENTITY_MODE_CHECK
+
+          def filter_hash(collection, evaluation_deadline, &block)
+            result = {}
+            result.compare_by_identity if IDENTITY_MODE_CHECK.bind(collection).call
+            each_collection_item(collection, evaluation_deadline, "filter") do |_current_item, current_key, current_value|
+              result[current_key] = current_value if block.call([current_key, current_value], current_key, current_value)
             end
-          else
-            raise DI::Error::ExpressionEvaluationError, "Bad collection type for any: #{collection.class}"
+            result
           end
         end
+        private :filter_hash
 
-        def filter(collection, &block)
+        # Returns the elements of +collection+ for which +block+ returns a
+        # truthy value: the selected items of an Array collection, and a
+        # Hash of the selected key-value pairs of a Hash collection.
+        #
+        # @param collection [Array, Hash] collection to filter.
+        # @param evaluation_deadline [Float] invocation-local evaluation deadline.
+        # @return [Array, Hash] the selected elements.
+        # @raise [DI::Error::EvaluationTimeout] the evaluation deadline was
+        #   exceeded mid-iteration.
+        # @raise [DI::Error::ExpressionEvaluationError] +collection+ is not
+        #   an Array or a Hash.
+        def filter(collection, evaluation_deadline, &block)
           case collection
           when Array
-            collection.select do |item|
-              block.call(item)
+            result = []
+            each_collection_item(collection, evaluation_deadline, "filter") do |current_item, current_key, current_value|
+              result << current_item if block.call(current_item, current_key, current_value)
             end
+            result
           when Hash
-            collection.select do |key, value|
-              block.call([key, value], key, value)
-            end.to_h
+            filter_hash(collection, evaluation_deadline, &block)
           else
             raise DI::Error::ExpressionEvaluationError, "Bad collection type for filter: #{collection.class}"
           end