ddtrace 0.35.2 → 1.1.0

data/ext/ddtrace_profiling_loader/ddtrace_profiling_loader.c

@@ -0,0 +1,118 @@
+#include <stdbool.h>
+#include <dlfcn.h>
+#include <ruby.h>
+
+// Why this exists:
+//
+// The Datadog::Profiling::Loader exists because when Ruby loads a native extension (using `require`), it uses
+// `dlopen(..., RTLD_LAZY | RTLD_GLOBAL)` (https://github.com/ruby/ruby/blob/67950a4c0a884bdb78d9beb4405ebf7459229b21/dln.c#L362).
+// This means that every symbol exposed directly or indirectly by that native extension becomes visible to every other
+// extension in the Ruby process. This can cause issues, see https://github.com/rubyjs/mini_racer/pull/179.
+//
+// Instead of `RTLD_LAZY | RTLD_GLOBAL`, we want to call `dlopen` with `RTLD_LAZY | RTLD_LOCAL | RTLD_DEEPBIND` when
+// loading the profiling native extension, to avoid leaking any unintended symbols (`RTLD_LOCAL`) and avoid picking
+// up other's symbols (`RTLD_DEEPBIND`).
+//
+// But Ruby's extension loading mechanism is not configurable -- there's no way to tell it to use different flags when
+// calling `dlopen`. To get around this, this file (ddtrace_profiling_loader.c) introduces another extension
+// (profiling loader) which has only a single responsibility: mimic Ruby's extension loading mechanism, but when calling
+// `dlopen` use a different set of flags.
+// This idea was shamelessly stolen from @lloeki's work in https://github.com/rubyjs/mini_racer/pull/179, big thanks!
+//
+// Extra note: Currently (May 2022), that we know of, the profiling native extension only exposes one potentially
+// problematic symbol: `rust_eh_personality` (coming from libddprof/libdatadog).
+// Future versions of Rust have been patched not to expose this
+// (see https://github.com/rust-lang/rust/pull/95604#issuecomment-1108563434) so we may want to revisit the need
+// for this loader in the future, and perhaps delete it if we no longer require its services :)
+
+#ifndef RTLD_DEEPBIND
+  #define RTLD_DEEPBIND 0
+#endif
+
+static VALUE ok_symbol = Qnil; // :ok in Ruby
+static VALUE error_symbol = Qnil; // :error in Ruby
+
+static VALUE _native_load(VALUE self, VALUE ruby_path, VALUE ruby_init_name);
+static bool failed_to_load(void *handle, VALUE *failure_details);
+static bool incompatible_library(void *handle, VALUE *failure_details);
+static bool failed_to_initialize(void *handle, char *init_name, VALUE *failure_details);
+static void set_failure_from_dlerror(VALUE *failure_details);
+static void unload_failed_library(void *handle);
+
+#define DDTRACE_EXPORT __attribute__ ((visibility ("default")))
+
+void DDTRACE_EXPORT Init_ddtrace_profiling_loader() {
+  VALUE datadog_module = rb_define_module("Datadog");
+  VALUE profiling_module = rb_define_module_under(datadog_module, "Profiling");
+  VALUE loader_module = rb_define_module_under(profiling_module, "Loader");
+  rb_define_singleton_method(loader_module, "_native_load", _native_load, 2);
+
+  ok_symbol = ID2SYM(rb_intern_const("ok"));
+  error_symbol = ID2SYM(rb_intern_const("error"));
+}
+
+static VALUE _native_load(VALUE self, VALUE ruby_path, VALUE ruby_init_name) {
+  Check_Type(ruby_path, T_STRING);
+  Check_Type(ruby_init_name, T_STRING);
+
+  char *path = StringValueCStr(ruby_path);
+  char *init_name = StringValueCStr(ruby_init_name);
+
+  void *handle = dlopen(path, RTLD_LAZY | RTLD_LOCAL | RTLD_DEEPBIND);
+
+  VALUE failure_details = Qnil;
+
+  if (
+    failed_to_load(handle, &failure_details) ||
+    incompatible_library(handle, &failure_details) ||
+    failed_to_initialize(handle, init_name, &failure_details)
+  ) {
+    return rb_ary_new_from_args(2, error_symbol, failure_details);
+  }
+
+  return rb_ary_new_from_args(2, ok_symbol, Qnil);
+}
+
+static bool failed_to_load(void *handle, VALUE *failure_details) {
+  if (handle == NULL) {
+    set_failure_from_dlerror(failure_details);
+    return true;
+  } else {
+    return false;
+  }
+}
+
+static bool incompatible_library(void *handle, VALUE *failure_details) {
+  // The library being loaded may be linked to a different libruby than the current executing Ruby.
+  // We check if this is the case by checking if a well-known symbol resolves to a common address.
+  if (dlsym(handle, "ruby_xmalloc") != &ruby_xmalloc) {
+    *failure_details = rb_str_new_cstr("library was compiled and linked to a different Ruby version");
+    unload_failed_library(handle);
+    return true;
+  } else {
+    return false;
+  }
+}
+
+static bool failed_to_initialize(void *handle, char *init_name, VALUE *failure_details) {
+  void (*initialization_function)(void) = dlsym(handle, init_name);
+
+  if (initialization_function == NULL) {
+    set_failure_from_dlerror(failure_details);
+    unload_failed_library(handle);
+    return true;
+  } else {
+    (*initialization_function)();
+    return false;
+  }
+}
+
+static void set_failure_from_dlerror(VALUE *failure_details) {
+  char *failure = dlerror();
+  *failure_details = failure == NULL ? Qnil : rb_str_new_cstr(failure);
+}
+
+static void unload_failed_library(void *handle) {
+  // Note: According to the Ruby VM sources, this may fail with a segfault on really old versions of macOS (< 10.11)
+  dlclose(handle);
+}

data/ext/ddtrace_profiling_loader/extconf.rb

@@ -0,0 +1,53 @@
+# typed: ignore
+# rubocop:disable Style/StderrPuts
+# rubocop:disable Style/GlobalVars
+
+if RUBY_ENGINE != 'ruby' || Gem.win_platform?
+  $stderr.puts(
+    'WARN: Skipping build of ddtrace profiling loader. See ddtrace profiling native extension note for details.'
+  )
+
+  File.write('Makefile', 'all install clean: # dummy makefile that does nothing')
+  exit
+end
+
+require 'mkmf'
+
+# mkmf on modern Rubies actually has an append_cflags that does something similar
+# (see https://github.com/ruby/ruby/pull/5760), but as usual we need a bit more boilerplate to deal with legacy Rubies
+def add_compiler_flag(flag)
+  if try_cflags(flag)
+    $CFLAGS << ' ' << flag
+  else
+    $stderr.puts("WARNING: '#{flag}' not accepted by compiler, skipping it")
+  end
+end
+
+# Gets really noisy when we include the MJIT header, let's omit it
+add_compiler_flag '-Wno-unused-function'
+
+# Allow defining variables at any point in a function
+add_compiler_flag '-Wno-declaration-after-statement'
+
+# If we forget to include a Ruby header, the function call may still appear to work, but then
+# cause a segfault later. Let's ensure that never happens.
+add_compiler_flag '-Werror-implicit-function-declaration'
+
+# The native extension is not intended to expose any symbols/functions for other native libraries to use;
+# the sole exception being `Init_ddtrace_profiling_loader` which needs to be visible for Ruby to call it when
+# it `dlopen`s the library.
+#
+# By setting this compiler flag, we tell it to assume that everything is private unless explicitly stated.
+# For more details see https://gcc.gnu.org/wiki/Visibility
+add_compiler_flag '-fvisibility=hidden'
+
+# Tag the native extension library with the Ruby version and Ruby platform.
+# This makes it easier for development (avoids "oops I forgot to rebuild when I switched my Ruby") and ensures that
+# the wrong library is never loaded.
+# When requiring, we need to use the exact same string, including the version and the platform.
+EXTENSION_NAME = "ddtrace_profiling_loader.#{RUBY_VERSION}_#{RUBY_PLATFORM}".freeze
+
+create_makefile(EXTENSION_NAME)
+
+# rubocop:enable Style/GlobalVars
+# rubocop:enable Style/StderrPuts

data/ext/ddtrace_profiling_native_extension/NativeExtensionDesign.md

@@ -0,0 +1,112 @@
+# Profiling Native Extension Design
+
+The profiling native extension is used to:
+1. Implement features which are expensive (in terms of resources) or otherwise impossible to implement using Ruby code.
+2. Bridge between Ruby-specific profiling features and [`libddprof`](https://github.com/DataDog/libddprof), a Rust-based
+library with common profiling functionality.
+
+Due to (1), this extension is quite coupled with MRI Ruby ("C Ruby") internals, and is not intended to support other rubies such as
+JRuby or TruffleRuby. When below we say "Ruby", read it as "MRI Ruby".
+
+## Disabling
+
+The profiling native extension can be disabled by setting `DD_PROFILING_NO_EXTENSION=true` when installing or running
+the gem. Setting `DD_PROFILING_NO_EXTENSION` at installation time skips compilation of the extension entirely.
+
+(If you're a customer and needed to use this, please tell us why on <https://github.com/DataDog/dd-trace-rb/issues/new>.)
+
+Currently the profiler can still "limp along" when the native extension is disabled, but the plan is to require it
+in future releases -- e.g. disabling the extension will disable profiling entirely.
+
+## Must not block or break users that cannot use it
+
+The profiling native extension is (and must always be) designed to **not cause failures** during gem installation, even
+if some features, Ruby versions, or operating systems are not supported.
+
+E.g. the extension must not break installation on Ruby 2.1 (or the oldest Ruby version we support at the time) on 64-bit ARM macOS,
+even if at run time it will effectively do nothing for such a setup.
+
+We have a CI setup to help validate this, but this is really important to keep in mind when adding to or changing the
+existing codebase.
+
+## Memory leaks and Interaction with Ruby VM APIs
+
+When adding to or changing the native extension, we must always consider what API calls can lead to Ruby exceptions to
+be raised, and whether there are is dynamically-allocated memory that can be leaked if that happens.
+
+(When a Ruby exception is raised, the VM will use `setjmp` and `longjmp` to jump back in the stack and thus skip
+our clean-up code, like in a Ruby-level exception.)
+
+We avoid issues using a combination of:
+
+* Avoiding dynamic allocation as much as possible
+* Getting all needed data and doing all validations before doing any dynamic allocations
+* Avoiding calling Ruby VM APIs after doing dynamic allocations
+* Wrapping dynamic allocations into Ruby GC-managed objects (using `TypedData_Wrap_Struct`), so that Ruby will manage
+  their lifetime and call `free` when the GC-managed object is no longer being referenced
+
+Non-exhaustive list of APIs that cause exceptions to be raised:
+
+* `Check_TypedStruct`, `Check_Type`
+* `rb_funcall`
+* `rb_thread_call_without_gvl`, `rb_thread_call_without_gvl2`
+* [Numeric conversion APIs, e.g. `NUM2LONG`, `NUM2INT`, etc.](https://silverhammermba.github.io/emberb/c/?utm_source=pocket_mylist#translation)
+* Our `char_slice_from_ruby_string` helper
+
+## Usage of private VM headers
+
+To implement some of the features below, we sometimes require access to private Ruby header files (that describe VM
+internal types, structures and functions).
+
+Because these private header files are not included in regular Ruby installations, we have two different workarounds:
+
+1. for Ruby versions >= 2.6 we make use use the Ruby private MJIT header
+2. for Ruby versions < 2.6 (legacy Rubies) we make use of the `debase-ruby_core_source` gem
+
+Functions which make use of these headers are defined in the <private_vm_api_acccess.c> file.
+
+**Important Note**: Our medium/long-term plan is to stop relying on all private Ruby headers, and instead request and
+contribute upstream changes so that they become official public VM APIs.
+
+### Approach 1: Using the Ruby private MJIT header
+
+Ruby versions >= 2.6 introduced a JIT compiler called MJIT. This compiler does not directly generate machine code;
+instead it generates C code and uses the system C compiler to turn it into machine code.
+
+The generated C code `#include`s a private header -- which we reference as "the MJIT header" everywhere.
+The MJIT header gets shipped with all MJIT-enabled Rubies and includes the layout of many internal VM structures;
+and of course the intention is that it is only used by the Ruby MJIT compiler.
+
+This header is placed inside the `include/` directory in a Ruby installation, and is named for that specific Ruby
+version. e.g. `rb_mjit_min_header-2.7.4.h`.
+
+### Approach 2: Using the `debase-ruby_core_source` gem
+
+The [`debase-ruby_core_source`](https://github.com/ruby-debug/debase-ruby_core_source) contains almost no code;
+instead, it just contains per-Ruby-version folders with the private VM headers (`.h`) files for that version.
+
+Thus, even though a regular Ruby installation does not include these files, we can access the copy inside this gem.
+
+## Feature: Getting thread CPU-time clock_ids
+
+* **OS support**: Linux
+* **Ruby support**: 2.6+
+
+To enable CPU-time profiling, we use the `pthread_getcpuclockid(pthread_t thread, clockid_t *clockid)` C function to
+obtain a `clockid_t` that can then be used with the `Process.clock_gettime` method (or directly with the
+`clock_gettime()` C function).
+
+The challenge with using `pthread_getcpuclockid()` is that we need to get the `pthread_t` for a given Ruby `Thread`
+object. We previously did this with a weird combination of monkey patching and `pthread_self()` (effectively patching
+every `Thread` to run `pthread_self()` at initialization time and stash that value somewhere), but this had a number
+of downsides.
+
+The approach we use in the profiling native extension is to reach inside the internal structure of the `Thread` object,
+and extract the `pthread_t` that Ruby itself keeps, but does not expose. This is implemented in the `pthread_id_for()`
+function in `private_vm_api_acccess.c`. Thus, using this trick we can at any point in execution go from a `Thread`
+object into the `clockid_t` that we need.
+
+Note that `pthread_getcpuclockid()` is not available on macOS (nor, obviously, on Windows), and hence this feature
+is currently Linux-specific. Thus, in the <clock_id_from_pthread.c> file we implement the feature for supported Ruby
+setups but if something is missing we instead compile in <clock_id_noop.c> that includes a no-op implementation of the
+feature.

data/ext/ddtrace_profiling_native_extension/clock_id.h

@@ -0,0 +1,4 @@
+#pragma once
+
+void self_test_clock_id();
+VALUE clock_id_for(VALUE self, VALUE thread);

data/ext/ddtrace_profiling_native_extension/clock_id_from_pthread.c

@@ -0,0 +1,44 @@
+#include "extconf.h"
+
+// This file is only compiled on systems where pthread_getcpuclockid() is available;
+// Otherwise we compile clock_id_noop.c
+#ifdef HAVE_PTHREAD_GETCPUCLOCKID
+
+#include <pthread.h>
+#include <time.h>
+#include <errno.h>
+
+#include <ruby.h>
+#include "private_vm_api_access.h"
+#include "clock_id.h"
+
+// Validate that our home-cooked pthread_id_for() matches pthread_self() for the current thread
+void self_test_clock_id() {
+  rb_nativethread_id_t expected_pthread_id = pthread_self();
+  rb_nativethread_id_t actual_pthread_id = pthread_id_for(rb_thread_current());
+
+  if (expected_pthread_id != actual_pthread_id) rb_raise(rb_eRuntimeError, "pthread_id_for() self-test failed");
+}
+
+VALUE clock_id_for(VALUE self, VALUE thread) {
+  rb_nativethread_id_t thread_id = pthread_id_for(thread);
+
+  clockid_t clock_id;
+  int error = pthread_getcpuclockid(thread_id, &clock_id);
+
+  if (error == 0) {
+    return CLOCKID2NUM(clock_id);
+  } else {
+    switch(error) {
+      // The more specific error messages are based on the pthread_getcpuclockid(3) man page
+      case ENOENT:
+        rb_exc_raise(rb_syserr_new(error, "Failed to get clock_id for given thread: Per-thread CPU time clocks are not supported by the system."));
+      case ESRCH:
+        rb_exc_raise(rb_syserr_new(error, "Failed to get clock_id for given thread: No thread could be found."));
+      default:
+        rb_exc_raise(rb_syserr_new(error, "Failed to get clock_id for given thread"));
+    }
+  }
+}
+
+#endif

data/ext/ddtrace_profiling_native_extension/clock_id_noop.c

@@ -0,0 +1,14 @@
+#include "extconf.h"
+
+// This file is the dual of clock_id_from_pthread.c for systems where that info
+// is not available.
+#ifndef HAVE_PTHREAD_GETCPUCLOCKID
+
+#include <ruby.h>
+
+#include "clock_id.h"
+
+void self_test_clock_id() { } // Nothing to check
+VALUE clock_id_for(VALUE self, VALUE thread) { return Qnil; } // Nothing to return
+
+#endif

data/ext/ddtrace_profiling_native_extension/collectors_stack.c

@@ -0,0 +1,278 @@
+#include <ruby.h>
+#include <ruby/debug.h>
+#include "extconf.h"
+#include "libddprof_helpers.h"
+#include "private_vm_api_access.h"
+#include "stack_recorder.h"
+
+// Gathers stack traces from running threads, storing them in a StackRecorder instance
+// This file implements the native bits of the Datadog::Profiling::Collectors::Stack class
+
+#define MAX_FRAMES_LIMIT            10000
+#define MAX_FRAMES_LIMIT_AS_STRING "10000"
+
+static VALUE missing_string = Qnil;
+
+// Used as scratch space during sampling
+typedef struct sampling_buffer {
+  unsigned int max_frames;
+  VALUE *stack_buffer;
+  int *lines_buffer;
+  bool *is_ruby_frame;
+  ddprof_ffi_Location *locations;
+  ddprof_ffi_Line *lines;
+} sampling_buffer;
+
+static VALUE _native_sample(VALUE self, VALUE thread, VALUE recorder_instance, VALUE metric_values_hash, VALUE labels_array, VALUE max_frames);
+void sample(VALUE thread, sampling_buffer* buffer, VALUE recorder_instance, ddprof_ffi_Slice_i64 metric_values, ddprof_ffi_Slice_label labels);
+void maybe_add_placeholder_frames_omitted(VALUE thread, sampling_buffer* buffer, char *frames_omitted_message, int frames_omitted_message_size);
+void record_placeholder_stack_in_native_code(VALUE recorder_instance, ddprof_ffi_Slice_i64 metric_values, ddprof_ffi_Slice_label labels);
+sampling_buffer *sampling_buffer_new(unsigned int max_frames);
+void sampling_buffer_free(sampling_buffer *buffer);
+
+void collectors_stack_init(VALUE profiling_module) {
+  VALUE collectors_module = rb_define_module_under(profiling_module, "Collectors");
+  VALUE collectors_stack_class = rb_define_class_under(collectors_module, "Stack", rb_cObject);
+
+  rb_define_singleton_method(collectors_stack_class, "_native_sample", _native_sample, 5);
+
+  missing_string = rb_str_new2("");
+  rb_global_variable(&missing_string);
+}
+
+// This method exists only to enable testing Collectors::Stack behavior using RSpec.
+// It SHOULD NOT be used for other purposes.
+static VALUE _native_sample(VALUE self, VALUE thread, VALUE recorder_instance, VALUE metric_values_hash, VALUE labels_array, VALUE max_frames) {
+  Check_Type(metric_values_hash, T_HASH);
+  Check_Type(labels_array, T_ARRAY);
+
+  if (RHASH_SIZE(metric_values_hash) != ENABLED_VALUE_TYPES_COUNT) {
+    rb_raise(
+      rb_eArgError,
+      "Mismatched values for metrics; expected %lu values and got %lu instead",
+      ENABLED_VALUE_TYPES_COUNT,
+      RHASH_SIZE(metric_values_hash)
+    );
+  }
+
+  int64_t metric_values[ENABLED_VALUE_TYPES_COUNT];
+  for (unsigned int i = 0; i < ENABLED_VALUE_TYPES_COUNT; i++) {
+    VALUE metric_value = rb_hash_fetch(metric_values_hash, rb_str_new_cstr(enabled_value_types[i].type_.ptr));
+    metric_values[i] = NUM2LONG(metric_value);
+  }
+
+  long labels_count = RARRAY_LEN(labels_array);
+  ddprof_ffi_Label labels[labels_count];
+
+  for (int i = 0; i < labels_count; i++) {
+    VALUE key_str_pair = rb_ary_entry(labels_array, i);
+
+    labels[i] = (ddprof_ffi_Label) {
+      .key = char_slice_from_ruby_string(rb_ary_entry(key_str_pair, 0)),
+      .str = char_slice_from_ruby_string(rb_ary_entry(key_str_pair, 1))
+    };
+  }
+
+  int max_frames_requested = NUM2INT(max_frames);
+  if (max_frames_requested < 0) rb_raise(rb_eArgError, "Invalid max_frames: value must not be negative");
+
+  sampling_buffer *buffer = sampling_buffer_new(max_frames_requested);
+
+  sample(
+    thread,
+    buffer,
+    recorder_instance,
+    (ddprof_ffi_Slice_i64) {.ptr = metric_values, .len = ENABLED_VALUE_TYPES_COUNT},
+    (ddprof_ffi_Slice_label) {.ptr = labels, .len = labels_count}
+  );
+
+  sampling_buffer_free(buffer);
+
+  return Qtrue;
+}
+
+void sample(VALUE thread, sampling_buffer* buffer, VALUE recorder_instance, ddprof_ffi_Slice_i64 metric_values, ddprof_ffi_Slice_label labels) {
+  int captured_frames = ddtrace_rb_profile_frames(
+    thread,
+    0 /* stack starting depth */,
+    buffer->max_frames,
+    buffer->stack_buffer,
+    buffer->lines_buffer,
+    buffer->is_ruby_frame
+  );
+
+  // Idea: Should we release the global vm lock (GVL) after we get the data from `rb_profile_frames`? That way other Ruby threads
+  // could continue making progress while the sample was ingested into the profile.
+  //
+  // Other things to take into consideration if we go in that direction:
+  // * Is it safe to call `rb_profile_frame_...` methods on things from the `stack_buffer` without the GVL acquired?
+  // * We need to make `VALUE` references in the `stack_buffer` visible to the Ruby GC
+  // * Should we move this into a different thread entirely?
+  // * If we don't move it into a different thread, does releasing the GVL on a Ruby thread mean that we're introducing
+  //   a new thread switch point where there previously was none?
+
+  // Ruby does not give us path and line number for methods implemented using native code.
+  // The convention in Kernel#caller_locations is to instead use the path and line number of the first Ruby frame
+  // on the stack that is below (e.g. directly or indirectly has called) the native method.
+  // Thus, we keep that frame here to able to replicate that behavior.
+  // (This is why we also iterate the sampling buffers backwards below -- so that it's easier to keep the last_ruby_frame)
+  VALUE last_ruby_frame = Qnil;
+  int last_ruby_line = 0;
+
+  if (captured_frames == PLACEHOLDER_STACK_IN_NATIVE_CODE) {
+    record_placeholder_stack_in_native_code(recorder_instance, metric_values, labels);
+    return;
+  }
+
+  for (int i = captured_frames - 1; i >= 0; i--) {
+    VALUE name, filename;
+    int line;
+
+    if (buffer->is_ruby_frame[i]) {
+      last_ruby_frame = buffer->stack_buffer[i];
+      last_ruby_line = buffer->lines_buffer[i];
+
+      name = rb_profile_frame_base_label(buffer->stack_buffer[i]);
+      filename = rb_profile_frame_path(buffer->stack_buffer[i]);
+      line = buffer->lines_buffer[i];
+    } else {
+      // **IMPORTANT**: Be very careful when calling any `rb_profile_frame_...` API with a non-Ruby frame, as legacy
+      // Rubies may assume that what's in a buffer will lead to a Ruby frame.
+      //
+      // In particular for Ruby 2.2 and below the buffer contains a Ruby string (see the notes on our custom
+      // rb_profile_frames for Ruby 2.2 and below) and CALLING **ANY** OF THOSE APIs ON IT WILL CAUSE INSTANT VM CRASHES
+
+#ifndef USE_LEGACY_RB_PROFILE_FRAMES // Modern Rubies
+      name = ddtrace_rb_profile_frame_method_name(buffer->stack_buffer[i]);
+#else // Ruby < 2.3
+      name = buffer->stack_buffer[i];
+#endif
+
+      filename = NIL_P(last_ruby_frame) ? Qnil : rb_profile_frame_path(last_ruby_frame);
+      line = last_ruby_line;
+    }
+
+    name = NIL_P(name) ? missing_string : name;
+    filename = NIL_P(filename) ? missing_string : filename;
+
+    buffer->lines[i] = (ddprof_ffi_Line) {
+      .function = (ddprof_ffi_Function) {
+        .name = char_slice_from_ruby_string(name),
+        .filename = char_slice_from_ruby_string(filename)
+      },
+      .line = line,
+    };
+
+    buffer->locations[i] = (ddprof_ffi_Location) {.lines = (ddprof_ffi_Slice_line) {.ptr = &buffer->lines[i], .len = 1}};
+  }
+
+  // Used below; since we want to stack-allocate this, we must do it here rather than in maybe_add_placeholder_frames_omitted
+  const int frames_omitted_message_size = sizeof(MAX_FRAMES_LIMIT_AS_STRING " frames omitted");
+  char frames_omitted_message[frames_omitted_message_size];
+
+  // If we filled up the buffer, some frames may have been omitted. In that case, we'll add a placeholder frame
+  // with that info.
+  if (captured_frames == (long) buffer->max_frames) {
+    maybe_add_placeholder_frames_omitted(thread, buffer, frames_omitted_message, frames_omitted_message_size);
+  }
+
+  record_sample(
+    recorder_instance,
+    (ddprof_ffi_Sample) {
+      .locations = (ddprof_ffi_Slice_location) {.ptr = buffer->locations, .len = captured_frames},
+      .values = metric_values,
+      .labels = labels,
+    }
+  );
+}
+
+void maybe_add_placeholder_frames_omitted(VALUE thread, sampling_buffer* buffer, char *frames_omitted_message, int frames_omitted_message_size) {
+  ptrdiff_t frames_omitted = stack_depth_for(thread) - buffer->max_frames;
+
+  if (frames_omitted == 0) return; // Perfect fit!
+
+  // The placeholder frame takes over a space, so if 10 frames were left out and we consume one other space for the
+  // placeholder, then 11 frames are omitted in total
+  frames_omitted++;
+
+  snprintf(frames_omitted_message, frames_omitted_message_size, "%td frames omitted", frames_omitted);
+
+  // Important note: `frames_omitted_message` MUST have a lifetime that is at least as long as the call to
+  // `record_sample`. So be careful where it gets allocated. (We do have tests for this, at least!)
+  buffer->lines[buffer->max_frames - 1] = (ddprof_ffi_Line) {
+    .function = (ddprof_ffi_Function) {
+      .name = DDPROF_FFI_CHARSLICE_C(""),
+      .filename = ((ddprof_ffi_CharSlice) {.ptr = frames_omitted_message, .len = strlen(frames_omitted_message)})
+    },
+    .line = 0,
+  };
+}
+
+// Our custom rb_profile_frames returning PLACEHOLDER_STACK_IN_NATIVE_CODE is equivalent to when the
+// Ruby `Thread#backtrace` API returns an empty array: we know that a thread is alive but we don't know what it's doing:
+//
+// 1. It can be starting up
+//    ```
+//    > Thread.new { sleep }.backtrace
+//    => [] # <-- note the thread hasn't actually started running sleep yet, we got there first
+//    ```
+// 2. It can be running native code
+//    ```
+//    > t = Process.detach(fork { sleep })
+//    => #<Process::Waiter:0x00007ffe7285f7a0 run>
+//    > t.backtrace
+//    => [] # <-- this can happen even minutes later, e.g. it's not a race as in 1.
+//    ```
+//    This effect has been observed in threads created by the Iodine web server and the ffi gem,
+//    see for instance https://github.com/ffi/ffi/pull/883 and https://github.com/DataDog/dd-trace-rb/pull/1719 .
+//
+// To give customers visibility into these threads, rather than reporting an empty stack, we replace the empty stack
+// with one containing a placeholder frame, so that these threads are properly represented in the UX.
+void record_placeholder_stack_in_native_code(VALUE recorder_instance, ddprof_ffi_Slice_i64 metric_values, ddprof_ffi_Slice_label labels) {
+  ddprof_ffi_Line placeholder_stack_in_native_code_line = {
+    .function = (ddprof_ffi_Function) {
+      .name = DDPROF_FFI_CHARSLICE_C(""),
+      .filename = DDPROF_FFI_CHARSLICE_C("In native code")
+    },
+    .line = 0
+  };
+  ddprof_ffi_Location placeholder_stack_in_native_code_location =
+    {.lines = (ddprof_ffi_Slice_line) {.ptr = &placeholder_stack_in_native_code_line, .len = 1}};
+
+  record_sample(
+    recorder_instance,
+    (ddprof_ffi_Sample) {
+      .locations = (ddprof_ffi_Slice_location) {.ptr = &placeholder_stack_in_native_code_location, .len = 1},
+      .values = metric_values,
+      .labels = labels,
+    }
+  );
+}
+
+sampling_buffer *sampling_buffer_new(unsigned int max_frames) {
+  if (max_frames < 5) rb_raise(rb_eArgError, "Invalid max_frames: value must be >= 5");
+  if (max_frames > MAX_FRAMES_LIMIT) rb_raise(rb_eArgError, "Invalid max_frames: value must be <= " MAX_FRAMES_LIMIT_AS_STRING);
+
+  // Note: never returns NULL; if out of memory, it calls the Ruby out-of-memory handlers
+  sampling_buffer* buffer = ruby_xcalloc(1, sizeof(sampling_buffer));
+
+  buffer->max_frames = max_frames;
+
+  buffer->stack_buffer  = ruby_xcalloc(max_frames, sizeof(VALUE));
+  buffer->lines_buffer  = ruby_xcalloc(max_frames, sizeof(int));
+  buffer->is_ruby_frame = ruby_xcalloc(max_frames, sizeof(bool));
+  buffer->locations     = ruby_xcalloc(max_frames, sizeof(ddprof_ffi_Location));
+  buffer->lines         = ruby_xcalloc(max_frames, sizeof(ddprof_ffi_Line));
+
+  return buffer;
+}
+
+void sampling_buffer_free(sampling_buffer *buffer) {
+  ruby_xfree(buffer->stack_buffer);
+  ruby_xfree(buffer->lines_buffer);
+  ruby_xfree(buffer->is_ruby_frame);
+  ruby_xfree(buffer->locations);
+  ruby_xfree(buffer->lines);
+
+  ruby_xfree(buffer);
+}