rails-profiler 0.30.11 → 0.30.13

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e7bb3bed351c863507d670d29552cb6751bb023300728a48e9baf9c718a53659
-  data.tar.gz: 8af241a6ca0278f3ada6a4d0d88599e93b952f67057ba6b826ea36935976ba67
+  metadata.gz: 2613fd14e9adfbb7911645a1bd23fcd1043d4424f532e64c267601d021db7ad0
+  data.tar.gz: 1f474b73d65dd2aac23151a8ea4f61aba98399f7182cd7db9dda39947afb7b28
 SHA512:
-  metadata.gz: 04d1ce9d5e1c0a2527ddb60280aa82e89e04ccc32a202a4f79e09b4a5fa87319b8f6d6c95a93f212a61cb4bc7213b92d15bb914567669a2f079eec502c075822
-  data.tar.gz: 91db3673cbcd3debdcf9fc1e02690601c4a70aaf10f4a17a070eed4b7f9359ae6261b5a9256ab43b9a13108aec0fa61677dddc9b735f72bf8103261f7e8b24f5
+  metadata.gz: 67dd8e4b429926a3fdef908c1491650c796497c177cb263cfdd94e7b14a5587a7a6ef48ea09c33b430ef5bca1ac0c921a4294d16c093127a39b1eac9db5c5cd3
+  data.tar.gz: 004f12ec514d606d212f49b0ac5c8c1f593437d62cf58e2a2b1242eef67fd144caa1ef165e8371947db4c9d8ae291a9bbdb83a2acf40058a8b53e5e50a78be71

data/CHANGELOG.md

@@ -19,6 +19,81 @@ every commit of every tag interval is accounted for one way or the other.
 
 ## [Unreleased]
 
+## [0.30.13] - 2026-10-04
+
+<!-- stamped -->
+
+### Fixed
+
+- **Middleware:** A request that raises below the profiler no longer runs your application a
+  second time, and no longer leaves the collectors installed. Until now the exception made the
+  profiler call the application again, duplicating its side effects (two emails sent, two
+  records written), and every SQL, view, cache, mailer and controller subscriber, the log sink on
+  `Rails.logger`, the StackProf sampler or the `TracePoint` of the function profiler stayed active
+  for the life of the process: memory and request time grew with each failed request until the
+  process was killed. Any exception between the profiler and `ShowExceptions` triggers it, for
+  example `ActionDispatch::RemoteIp::IpSpoofAttackError` on contradictory `Client-IP` and
+  `X-Forwarded-For` headers, and in tests every exception a controller raises. The exception now
+  goes on to the server unchanged, and the profile of the failed request is kept, with status 500
+  and the exception in the Exception tab.
+- **Collectors:** Collectors gain `unsubscribe`, which releases what `subscribe` installed and runs
+  after `collect` and on every error path, for requests, jobs, console commands and tests alike.
+  A collector that fails to subscribe no longer leaves the others installed: the work runs once,
+  unprofiled. A custom collector that subscribes to something should implement `unsubscribe`, as
+  the README example now does.
+- **Logs:** On Rails 7.0, the log collector no longer extends `Rails.logger` with a new module on
+  every request; one shared sink is attached once, and only records while a profile runs on the
+  thread.
+- **Collectors:** A job performed inline during a profiled request (`perform_now`, or the
+  `:inline` adapter) no longer takes the request's records with it. The job's collectors now hand
+  back the thread-local slots they borrow, so the request keeps its logs, dumps, outbound HTTP
+  calls and timeline events from before and after the job, and the job's profile gets only what
+  the job did. Until now the job erased the request's logs and dumps recorded before it, and the
+  request lost its HTTP calls and timeline events from after it.
+- **Middleware:** A request cut short by a timeout (`Timeout::ExitException`,
+  `Rack::Timeout::RequestTimeoutException`) keeps its profile too, with status 500. A request
+  stopped by a signal or by `exit` keeps none. An exception outside `StandardError` raised while
+  the collectors are being set up no longer leaves them installed.
+- **Function profiler:** In sampling (`lite`) mode, a request no longer stops the StackProf
+  sampler that a concurrent request started, nor takes its samples: its profile says the sampler
+  was busy instead.
+- **Dumps:** `Profiler.dump` called outside a profile that collects dumps (a request the profiler
+  skips, a test profile) no longer keeps the value on the thread. Nothing ever read those dumps,
+  and the thread held on to them, and to everything they referenced, for good.
+
+## [0.30.12] - 2026-10-04
+
+<!-- stamped -->
+
+### Security
+
+- **Toolbar:** The toolbar endpoint (`/_profiler/api/toolbar/:token`) now answers `403` when the
+  profiler is disabled, like the rest of the API. It used to keep serving any profile left in
+  storage, request headers and environment included, after `enabled = false`. The toolbar is only
+  injected while the profiler is enabled, so it is not affected.
+- **Profile page:** The profile embedded as JSON in the profile page is now escaped explicitly
+  (`<`, `>`, `&`, U+2028 and U+2029), whatever the application sets for
+  `ActiveSupport.escape_html_entities_in_json`. An application that turned that setting off let a
+  captured value (a parameter, a header, a body) close the `<script>` element and run JavaScript
+  in the application's origin. The token and the CSP nonce written into the application's pages
+  by the toolbar injector are escaped too.
+- **Dashboard:** Captured bodies offered for download are no longer typed with their captured
+  content type: opened in a tab, a `text/html` or `image/svg+xml` body ran its scripts in the
+  application's origin. Previews keep their type for raster images and PDF only. Email previews
+  are rendered in a fully sandboxed iframe, with an opaque origin. The unused SQL highlighter,
+  which wrote captured SQL into the page as HTML, is removed.
+- **Access control:** A disabled profiler now answers its API requests with a JSON error, like
+  any other refusal of the API, instead of plain text.
+- **Toolbar:** The toolbar is now injected before the `</body>` that closes the page, looked for
+  outside comments, tags (attributes read as the browser reads them, quoted values included) and
+  the elements whose content is not markup (`<script>`, `<style>`, `<textarea>`, `<title>`,
+  `<xmp>`, `<iframe>`, `<noembed>`, `<noframes>`, `<noscript>`), instead of the first `</body>`
+  found. A `</body>` inside a script string of the page used to receive it, and the toolbar's own
+  `</script>` then turned the rest of that string into live markup. A page whose only `</body>`
+  sits in one of those, that leaves a comment, a tag, a quoted value or one of those elements
+  open, or that holds a `<plaintext>`, a double-escaped script or a CDATA section with a `>`
+  before its end, gets no toolbar.
+
 ## [0.30.11] - 2026-10-04
 
 <!-- stamped -->

data/app/assets/builds/profiler.js

@@ -4054,7 +4054,7 @@
   function DownloadTextButton({ text, mime }) {
     const [url, setUrl] = d2(null);
     y2(() => {
-      const objectUrl = URL.createObjectURL(new Blob([text], { type: mime }));
+      const objectUrl = URL.createObjectURL(new Blob([text], { type: "application/octet-stream" }));
       setUrl(objectUrl);
       return () => URL.revokeObjectURL(objectUrl);
     }, [text, mime]);
@@ -4142,11 +4142,17 @@
     };
     return map[category] || "text/plain";
   }
+  var INERT_PREVIEW_TYPES = ["image/png", "image/jpeg", "image/gif", "image/webp", "image/avif", "application/pdf"];
+  function inertPreviewType(mime) {
+    const m3 = mime.toLowerCase();
+    return INERT_PREVIEW_TYPES.includes(m3) ? m3 : "application/octet-stream";
+  }
   var PREVIEW_LIMIT = 500;
   var CSV_ROW_LIMIT = 10;
   function SmartBodyPreview({ body, encoding, headers }) {
     const [expanded, setExpanded] = d2(false);
     const [objectUrl, setObjectUrl] = d2(null);
+    const [downloadUrl, setDownloadUrl] = d2(null);
     const category = detectContentType(headers);
     y2(() => {
       if (encoding !== "base64" || !body) return;
@@ -4154,19 +4160,27 @@
       const raw = atob(body);
       const bytes = new Uint8Array(raw.length);
       for (let i3 = 0; i3 < raw.length; i3++) bytes[i3] = raw.charCodeAt(i3);
-      const url = URL.createObjectURL(new Blob([bytes], { type: mime }));
+      const url = URL.createObjectURL(new Blob([bytes], { type: inertPreviewType(mime) }));
+      const download = URL.createObjectURL(new Blob([bytes], { type: "application/octet-stream" }));
       setObjectUrl(url);
-      return () => URL.revokeObjectURL(url);
+      setDownloadUrl(download);
+      return () => {
+        URL.revokeObjectURL(url);
+        URL.revokeObjectURL(download);
+      };
     }, [body, encoding, headers]);
     if (!body) return /* @__PURE__ */ u3("span", { class: "profiler-text--muted profiler-text--xs", children: "empty" });
     if (encoding === "base64") {
       const mime = Object.entries(headers).find(([k3]) => k3.toLowerCase() === "content-type")?.[1]?.split(";")[0].trim() || "application/octet-stream";
       const filename = `body${mimeToExt(mime)}`;
       return /* @__PURE__ */ u3("div", { class: "profiler-body-binary", children: [
-        objectUrl && (category === "image" || category === "svg") && /* @__PURE__ */ u3("img", { src: objectUrl, alt: "response preview", style: "max-width:100%;max-height:300px;display:block;margin-bottom:8px;border-radius:4px;border:1px solid var(--profiler-border)" }),
+        objectUrl && category === "image" && /* @__PURE__ */ u3("img", { src: objectUrl, alt: "response preview", style: "max-width:100%;max-height:300px;display:block;margin-bottom:8px;border-radius:4px;border:1px solid var(--profiler-border)" }),
+        category === "svg" && // A data: URL rather than a blob: one: an <img> runs no script, and browsers refuse
+        // to open a data: URL in a tab of its own.
+        /* @__PURE__ */ u3("img", { src: `data:image/svg+xml;base64,${body}`, alt: "response preview", style: "max-width:100%;max-height:300px;display:block;margin-bottom:8px;border-radius:4px;border:1px solid var(--profiler-border)" }),
         objectUrl && category === "pdf" && /* @__PURE__ */ u3("iframe", { src: objectUrl, class: "profiler-body-preview-frame", title: "PDF preview" }),
         /* @__PURE__ */ u3("div", { style: "display:flex;gap:8px;margin-top:4px", children: [
-          objectUrl && /* @__PURE__ */ u3("a", { href: objectUrl, download: filename, class: "profiler-body-download-btn profiler-text--xs", children: [
+          downloadUrl && /* @__PURE__ */ u3("a", { href: downloadUrl, download: filename, class: "profiler-body-download-btn profiler-text--xs", children: [
             "Download ",
             mime
           ] }),
@@ -8615,7 +8629,7 @@
         "iframe",
         {
           srcdoc: email.body_html ?? void 0,
-          sandbox: "allow-same-origin",
+          sandbox: "",
           style: { width: "100%", height: "300px", border: "1px solid var(--profiler-border)", borderRadius: "var(--profiler-radius-md)", background: "#fff", display: "block" }
         }
       ),
@@ -9421,62 +9435,6 @@ Duration: ${event.duration.toFixed(2)}ms`;
     return "#dcdcaa";
   }
 
-  // app/assets/typescript/profiler/sql-formatter.ts
-  var SQL_KEYWORDS = [
-    "SELECT",
-    "FROM",
-    "WHERE",
-    "INSERT",
-    "UPDATE",
-    "DELETE",
-    "JOIN",
-    "LEFT",
-    "RIGHT",
-    "INNER",
-    "OUTER",
-    "ON",
-    "AS",
-    "AND",
-    "OR",
-    "NOT",
-    "IN",
-    "EXISTS",
-    "LIKE",
-    "ORDER",
-    "BY",
-    "GROUP",
-    "HAVING",
-    "LIMIT",
-    "OFFSET",
-    "DISTINCT",
-    "COUNT",
-    "SUM",
-    "AVG",
-    "MAX",
-    "MIN",
-    "CASE",
-    "WHEN",
-    "THEN",
-    "ELSE",
-    "END"
-  ];
-  function formatSQL(element) {
-    const sql = element.textContent || "";
-    const formatted = highlightSQL(sql);
-    element.innerHTML = formatted;
-  }
-  function highlightSQL(sql) {
-    let highlighted = sql;
-    SQL_KEYWORDS.forEach((keyword) => {
-      const regex = new RegExp(`\\b${keyword}\\b`, "gi");
-      highlighted = highlighted.replace(regex, `<span class="sql-keyword">${keyword}</span>`);
-    });
-    highlighted = highlighted.replace(/'([^']*)'/g, `<span class="sql-string">'$1'</span>`);
-    highlighted = highlighted.replace(/\b(\d+)\b/g, '<span class="sql-number">$1</span>');
-    highlighted = highlighted.replace(/--([^\n]*)/g, '<span class="sql-comment">--$1</span>');
-    return highlighted;
-  }
-
   // app/assets/typescript/profiler/theme.ts
   var STORAGE_KEY2 = "profiler-theme";
   var THEME_ATTRIBUTE = "data-theme";
@@ -9663,8 +9621,5 @@ Duration: ${event.duration.toFixed(2)}ms`;
     if (timeline) {
       initTimeline(timeline);
     }
-    document.querySelectorAll('pre[data-language="sql"]').forEach((block) => {
-      formatSQL(block);
-    });
   });
 })();

data/app/controllers/profiler/api/toolbar_controller.rb

@@ -3,8 +3,6 @@
 module Profiler
   module Api
     class ToolbarController < Profiler::ApplicationController
-      skip_before_action :check_authorization
-
       def show
         profile = Profiler.storage.load(params[:token])
 

data/app/controllers/profiler/application_controller.rb

@@ -14,9 +14,7 @@ module Profiler
     private
 
     def check_authorization
-      unless Profiler.configuration.enabled
-        render plain: "Profiler is disabled", status: :forbidden
-      end
+      deny("Profiler is disabled") unless Profiler.configuration.enabled
     end
 
     def authorize_request

data/app/views/profiler/profiles/show.html.erb

@@ -1,4 +1,6 @@
 <div id="profiler-show" data-embedded="<%= @embedded %>"></div>
+<%# json_escape turns <, >, & and U+2028/U+2029 into \u escapes, so that no captured value can
+    close the element, whatever the application sets for escape_html_entities_in_json. %>
 <script type="application/json" id="profiler-show-data">
-  <%= @profile_data.to_json.html_safe %>
+  <%= raw json_escape(@profile_data.to_json) %>
 </script>

data/lib/profiler/collectors/base_collector.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require_relative "../redaction"
+require_relative "lifecycle"
 
 module Profiler
   module Collectors
@@ -59,6 +60,13 @@ module Profiler
         # Override in subclasses to subscribe to ActiveSupport::Notifications
       end
 
+      # Releases whatever subscribe installed: notification subscribers, samplers, log sinks,
+      # thread-local slots. Called after collect, and on every path where collect never runs,
+      # so it has to be idempotent and safe when subscribe failed part way or never ran.
+      def unsubscribe
+        # Override in subclasses that install something in subscribe
+      end
+
       def collect
         # Override in subclasses to collect data
       end
@@ -89,6 +97,27 @@ module Profiler
         @data = data
         @profile.add_collector_data(name, data)
       end
+
+      # Thread-local slots follow a stack: subscribe takes one over and remembers what it held,
+      # unsubscribe hands it back. A job performed inline during a request thus records into
+      # its own slots, and the request gets its own back, with what it recorded before the job.
+      def claim_thread_slot(key, value)
+        @claimed_thread_slots ||= {}
+        @claimed_thread_slots[key] = Thread.current[key] unless @claimed_thread_slots.key?(key)
+        Thread.current[key] = value
+      end
+
+      def restore_thread_slots
+        @claimed_thread_slots&.each { |key, previous| Thread.current[key] = previous }
+        @claimed_thread_slots = nil
+      end
+
+      def unsubscribe_notifications(subscriptions)
+        return unless defined?(ActiveSupport::Notifications)
+
+        subscriptions.each { |sub| ActiveSupport::Notifications.unsubscribe(sub) }
+        subscriptions.clear
+      end
     end
   end
 end

data/lib/profiler/collectors/cache_collector.rb

@@ -62,7 +62,7 @@ module Profiler
       end
 
       def collect
-        @subscriptions.each { |sub| ActiveSupport::Notifications.unsubscribe(sub) }
+        unsubscribe
 
         hits = @cache_reads.count { |r| r[:hit] }
         misses = @cache_reads.count { |r| !r[:hit] }
@@ -82,6 +82,10 @@ module Profiler
         store_data(data)
       end
 
+      def unsubscribe
+        unsubscribe_notifications(@subscriptions)
+      end
+
       def toolbar_summary
         hits = @cache_reads.count { |r| r[:hit] }
         total = @cache_reads.size

data/lib/profiler/collectors/database_collector.rb

@@ -55,8 +55,7 @@ module Profiler
       end
 
       def collect
-        # Unsubscribe from notifications
-        ActiveSupport::Notifications.unsubscribe(@subscription) if @subscription
+        unsubscribe
 
         data = {
           total_queries: @queries.size,
@@ -69,6 +68,13 @@ module Profiler
         store_data(data)
       end
 
+      def unsubscribe
+        return unless @subscription
+
+        ActiveSupport::Notifications.unsubscribe(@subscription)
+        @subscription = nil
+      end
+
       def toolbar_summary
         total = @queries.size
         slow = @queries.select { |q| q.slow?(Profiler.configuration.slow_query_threshold) }.size

data/lib/profiler/collectors/dump_collector.rb

@@ -30,7 +30,8 @@ module Profiler
       end
 
       def collect
-        dumps = Thread.current[:profiler_dumps] || []
+        dumps = @dumps || Thread.current[:profiler_dumps] || []
+        unsubscribe
 
         formatted_dumps = dumps.map do |dump|
           {
@@ -47,9 +48,15 @@ module Profiler
           count: formatted_dumps.size,
           dumps: formatted_dumps
         })
+      end
+
+      # Profiler.dump fills this slot while the profile runs.
+      def subscribe
+        @dumps = claim_thread_slot(:profiler_dumps, [])
+      end
 
-        # Clear dumps for next request
-        Thread.current[:profiler_dumps] = []
+      def unsubscribe
+        restore_thread_slots
       end
 
       def toolbar_summary

data/lib/profiler/collectors/exception_collector.rb

@@ -43,11 +43,18 @@ module Profiler
       end
 
       def collect
-        ActiveSupport::Notifications.unsubscribe(@subscriber) if @subscriber
+        unsubscribe
 
         store_data(@exception_data || {})
       end
 
+      def unsubscribe
+        return unless @subscriber
+
+        ActiveSupport::Notifications.unsubscribe(@subscriber)
+        @subscriber = nil
+      end
+
       def has_data?
         !@exception_data.nil? && !@exception_data.empty?
       end

data/lib/profiler/collectors/flamegraph_collector.rb

@@ -35,7 +35,7 @@ module Profiler
       def subscribe
         return unless defined?(ActiveSupport::Notifications)
 
-        Thread.current[:profiler_flamegraph_collector] = self
+        claim_thread_slot(:profiler_flamegraph_collector, self)
 
         # Controller action
         @subscriptions << ActiveSupport::Notifications.monotonic_subscribe("process_action.action_controller") do |_name, started, finished, _unique_id, payload|
@@ -133,8 +133,7 @@ module Profiler
       end
 
       def collect
-        @subscriptions.each { |sub| ActiveSupport::Notifications.unsubscribe(sub) }
-        Thread.current[:profiler_flamegraph_collector] = nil
+        unsubscribe
 
         root_events = build_hierarchy(@events)
 
@@ -145,6 +144,11 @@ module Profiler
         })
       end
 
+      def unsubscribe
+        unsubscribe_notifications(@subscriptions)
+        restore_thread_slots
+      end
+
       def toolbar_summary
         {
           text: "#{@events.size} events",

data/lib/profiler/collectors/function_profiler_collector.rb

@@ -55,42 +55,66 @@ module Profiler
 
         mode  = Profiler.function_profiling_mode
         clock = Profiler.function_profiling_clock
-        Thread.current[:fn_profiler_mode]  = mode
-        Thread.current[:fn_profiler_clock] = clock
+        @subscribed = true
+        claim_thread_slot(:fn_profiler_mode, mode)
+        claim_thread_slot(:fn_profiler_clock, clock)
 
         if mode == "lite" && defined?(StackProf)
           # Always record wall + cpu at request level for the comparison stat
-          Thread.current[:fn_profiler_wall_start] = Process.clock_gettime(Process::CLOCK_MONOTONIC)
-          Thread.current[:fn_profiler_cpu_start]  = Process.clock_gettime(Process::CLOCK_PROCESS_CPUTIME_ID)
+          claim_thread_slot(:fn_profiler_wall_start, Process.clock_gettime(Process::CLOCK_MONOTONIC))
+          claim_thread_slot(:fn_profiler_cpu_start, Process.clock_gettime(Process::CLOCK_PROCESS_CPUTIME_ID))
 
           sp_mode = case clock
                     when "cpu"    then :cpu
                     when "object" then :object
                     else               :wall
                     end
-          StackProf.start(mode: sp_mode, interval: 1000, raw: true)
+          # false when another request already runs the process-wide sampler: then it is not
+          # this collector's to stop on release.
+          @stackprof_started = StackProf.start(mode: sp_mode, interval: 1000, raw: true)
         else
           subscribe_tracepoint(mode)
         end
       end
 
       def collect
+        # Disabled: subscribe stored the "off" data, and there is no sampler of ours to read.
+        return unless @subscribed
+
         mode  = Thread.current[:fn_profiler_mode]  || Profiler.function_profiling_mode
         clock = Thread.current[:fn_profiler_clock] || Profiler.function_profiling_clock
-        Thread.current[:fn_profiler_mode]  = nil
-        Thread.current[:fn_profiler_clock] = nil
 
         if mode == "lite" && defined?(StackProf)
+          # The sampler is process-wide: when another request started it, its samples are not
+          # this request's to take, nor is it this collector's to stop.
+          return store_sampler_busy(mode, clock) unless @stackprof_started
+
           StackProf.stop
+          @stackprof_started = false
           result   = StackProf.results
           wall_ms  = (Process.clock_gettime(Process::CLOCK_MONOTONIC) - (Thread.current[:fn_profiler_wall_start] || 0)) * 1000
           cpu_ms   = (Process.clock_gettime(Process::CLOCK_PROCESS_CPUTIME_ID) - (Thread.current[:fn_profiler_cpu_start] || 0)) * 1000
-          Thread.current[:fn_profiler_wall_start] = nil
-          Thread.current[:fn_profiler_cpu_start]  = nil
           collect_stackprof(result, mode, clock, wall_ms, cpu_ms)
         else
           collect_tracepoint(mode)
         end
+      ensure
+        unsubscribe
+      end
+
+      def unsubscribe
+        if @stackprof_started
+          @stackprof_started = false
+          if StackProf.running?
+            StackProf.stop
+            StackProf.results # discards the samples and frees the sampler's buffers
+          end
+        end
+
+        @trace&.disable
+        @trace = nil
+
+        restore_thread_slots
       end
 
       def toolbar_summary
@@ -105,6 +129,12 @@ module Profiler
 
       # ── StackProf (lite mode) ──────────────────────────────────────────────────
 
+      def store_sampler_busy(mode, clock)
+        store_data({ enabled: true, mode: mode, clock: clock, sampler_busy: true, max_frames: 0,
+                     frame_cap_reached: false, total_calls: 0, total_duration: 0,
+                     functions: [], root_calls: [] })
+      end
+
       def collect_stackprof(result, mode, clock, wall_ms, cpu_ms)
         unless result
           store_data({ enabled: true, mode: mode, clock: clock, max_frames: 0,
@@ -261,10 +291,10 @@ module Profiler
         app_root   = app_root_path
         max_frames = Profiler.function_profiling_max_frames
 
-        Thread.current[:fn_profiler_stack] = []
-        Thread.current[:fn_profiler_roots] = []
-        Thread.current[:fn_profiler_count] = 0
-        Thread.current[:fn_profiler_depth] = Hash.new(0)
+        claim_thread_slot(:fn_profiler_stack, [])
+        claim_thread_slot(:fn_profiler_roots, [])
+        claim_thread_slot(:fn_profiler_count, 0)
+        claim_thread_slot(:fn_profiler_depth, Hash.new(0))
 
         @trace = TracePoint.new(:call, :return) do |tp|
           next unless tp.path&.start_with?(app_root)
@@ -336,11 +366,6 @@ module Profiler
           end
         end
 
-        Thread.current[:fn_profiler_stack] = nil
-        Thread.current[:fn_profiler_roots] = nil
-        Thread.current[:fn_profiler_count] = nil
-        Thread.current[:fn_profiler_depth] = nil
-
         stats = {}
         aggregate(roots, stats)
         sorted_functions = stats.values.sort_by { |s| -s[:total_duration] }

data/lib/profiler/collectors/http_collector.rb

@@ -36,11 +36,17 @@ module Profiler
         return unless Profiler.configuration.track_http
 
         Profiler::Instrumentation::NetHttpInstrumentation.install!
-        Thread.current[:profiler_http_collector] = self
+        claim_thread_slot(:profiler_http_collector, self)
+      end
+
+      # The Net::HTTP patch installed by subscribe stays: it is installed once per process and
+      # records nothing when no collector holds the thread-local slot.
+      def unsubscribe
+        restore_thread_slots
       end
 
       def collect
-        Thread.current[:profiler_http_collector] = nil
+        unsubscribe
 
         data = @mutex.synchronize do
           @collected = true

data/lib/profiler/collectors/i18n_collector.rb

@@ -53,11 +53,17 @@ module Profiler
           I18n.singleton_class.prepend(Profiler::I18nLookupTracker)
         end
 
-        Thread.current[:profiler_i18n_collector] = self
+        claim_thread_slot(:profiler_i18n_collector, self)
+      end
+
+      # The I18n patch installed by subscribe stays: it is prepended once per process and
+      # records nothing when no collector holds the thread-local slot.
+      def unsubscribe
+        restore_thread_slots
       end
 
       def collect
-        Thread.current[:profiler_i18n_collector] = nil
+        unsubscribe
 
         missing_count = @lookups.count { |l| l[:missing] }
 

data/lib/profiler/collectors/lifecycle.rb

@@ -0,0 +1,31 @@
+# frozen_string_literal: true
+
+module Profiler
+  module Collectors
+    # Subscribes and releases the collectors of one profile, for every entry point that runs
+    # them (the request middleware, jobs, console commands, tests).
+    module Lifecycle
+      module_function
+
+      # Subscribes each collector in turn. When one fails, releases them all, the ones that
+      # never subscribed included, and returns false: the caller then runs the work unprofiled.
+      def subscribe_all(collectors, label)
+        collectors.each { |collector| collector.subscribe if collector.respond_to?(:subscribe) }
+        true
+      rescue => e
+        warn "Profiler #{label}: Collector subscribe failed: #{e.message}"
+        release_all(collectors)
+        false
+      end
+
+      # Releases every collector, whatever happened before, one failure not stopping the others.
+      def release_all(collectors)
+        collectors&.each do |collector|
+          collector.unsubscribe if collector.respond_to?(:unsubscribe)
+        rescue => e
+          warn "Profiler: Collector #{collector.class} release failed: #{e.message}"
+        end
+      end
+    end
+  end
+end

data/lib/profiler/collectors/log_collector.rb

@@ -8,18 +8,26 @@ module Profiler
     class LogCollector < BaseCollector
       SEVERITY_LABELS = %w[DEBUG INFO WARN ERROR FATAL UNKNOWN].freeze
 
+      # Records into the thread's buffer, which only exists while a LogCollector of this thread
+      # is subscribed: lines logged by other threads, or after release, are not kept. A logger
+      # bound to one collector's buffer records only while that buffer is the thread's current
+      # one, so a job performed inline during a request does not log twice into the job.
       class CaptureLogger < ::Logger
-        def initialize
+        def initialize(buffer = nil)
           super(File::NULL)
+          @buffer = buffer
         end
 
         def add(severity, message = nil, progname = nil)
+          logs = Thread.current[:profiler_logs]
+          return true unless logs
+          return true if @buffer && !logs.equal?(@buffer)
+
           msg = message || progname
           msg = yield if block_given? && msg.nil?
           return true if msg.nil?
 
-          Thread.current[:profiler_logs] ||= []
-          Thread.current[:profiler_logs] << {
+          logs << {
             level: SEVERITY_LABELS[severity] || "UNKNOWN",
             message: msg.to_s.strip,
             timestamp: Time.now.iso8601(3)
@@ -55,31 +63,48 @@ module Profiler
         }
       end
 
+      # Rails 7.0 broadcasts by extending the logger with a module, which cannot be taken off
+      # again: the logger gets one shared CaptureLogger, once, instead of one per request.
+      LEGACY_CAPTURE_LOGGER = CaptureLogger.new
+      LEGACY_BROADCAST_MUTEX = Mutex.new
+
+      def self.attach_legacy_broadcast(logger)
+        LEGACY_BROADCAST_MUTEX.synchronize do
+          return if logger.instance_variable_get(:@profiler_capture_attached)
+
+          logger.extend(ActiveSupport::Logger.broadcast(LEGACY_CAPTURE_LOGGER))
+          logger.instance_variable_set(:@profiler_capture_attached, true)
+        end
+      end
+
       def subscribe
-        Thread.current[:profiler_logs] = []
-        @capture_logger = CaptureLogger.new
+        @logs = claim_thread_slot(:profiler_logs, [])
 
         if defined?(Rails) && Rails.logger
           if Rails.logger.respond_to?(:broadcast_to)
-            Rails.logger.broadcast_to(@capture_logger)
-          elsif defined?(ActiveSupport::Logger)
-            Rails.logger.extend(ActiveSupport::Logger.broadcast(@capture_logger))
+            @capture_logger = CaptureLogger.new(@logs)
+            @broadcaster = Rails.logger
+            @broadcaster.broadcast_to(@capture_logger)
+          elsif defined?(ActiveSupport::Logger) && ActiveSupport::Logger.respond_to?(:broadcast)
+            self.class.attach_legacy_broadcast(Rails.logger)
           end
         end
       rescue => e
         warn "LogCollector#subscribe failed: #{e.message}"
       end
 
-      def collect
-        logs = Thread.current[:profiler_logs] || []
-
-        if defined?(Rails) && Rails.logger && @capture_logger
-          if Rails.logger.respond_to?(:stop_broadcasting_to)
-            Rails.logger.stop_broadcasting_to(@capture_logger)
-          end
+      def unsubscribe
+        if @capture_logger
+          @broadcaster.stop_broadcasting_to(@capture_logger) if @broadcaster.respond_to?(:stop_broadcasting_to)
+          @capture_logger = nil
+          @broadcaster = nil
         end
+        restore_thread_slots
+      end
 
-        Thread.current[:profiler_logs] = []
+      def collect
+        logs = @logs || Thread.current[:profiler_logs] || []
+        unsubscribe
 
         errors   = logs.count { |l| %w[ERROR FATAL].include?(l[:level]) }
         warnings = logs.count { |l| l[:level] == "WARN" }

data/lib/profiler/collectors/mailer_collector.rb

@@ -45,7 +45,7 @@ module Profiler
         @subscriber_thread = Thread.current
 
         # Use a stack so multiple deliver_later calls in the same request are all tracked.
-        Thread.current[:profiler_pending_processes] ||= []
+        claim_thread_slot(:profiler_pending_processes, [])
 
         @subscriptions << ActiveSupport::Notifications.monotonic_subscribe("process.action_mailer") do |_name, started, finished, _id, payload|
           next unless Thread.current.equal?(@subscriber_thread)
@@ -53,7 +53,10 @@ module Profiler
 
           mailer_class = payload[:mailer].to_s
           action = payload[:action].to_s
-          (Thread.current[:profiler_pending_processes] ||= []) << {
+          pending = Thread.current[:profiler_pending_processes]
+          next unless pending
+
+          pending << {
             mailer_class: mailer_class,
             action: action,
             duration_ms: ((finished - started) * 1000).round(2),
@@ -67,7 +70,7 @@ module Profiler
           next if rails_preview_request?
 
           delivery_ms = ((finished - started) * 1000).round(2)
-          process_info = (Thread.current[:profiler_pending_processes] ||= []).pop || {}
+          process_info = Thread.current[:profiler_pending_processes]&.pop || {}
           mail = payload[:mail]
 
           mailer_class = process_info[:mailer_class] || payload[:mailer_class].to_s
@@ -87,7 +90,7 @@ module Profiler
         # Any remaining pending process entries had no matching deliver event:
         # they were enqueued via deliver_later in the HTTP context.
         pending = Thread.current[:profiler_pending_processes] || []
-        Thread.current[:profiler_pending_processes] = nil
+        unsubscribe
 
         pending.each do |info|
           @queued << {
@@ -102,8 +105,6 @@ module Profiler
           }
         end
 
-        @subscriptions.each { |sub| ActiveSupport::Notifications.unsubscribe(sub) }
-
         detect_loops
 
         truncated = @emails.size > MAX_EMAILS
@@ -124,6 +125,11 @@ module Profiler
         )
       end
 
+      def unsubscribe
+        unsubscribe_notifications(@subscriptions)
+        restore_thread_slots
+      end
+
       def has_data?
         @emails.any? || @errors.any? || @queued.any?
       end

data/lib/profiler/collectors/view_collector.rb

@@ -53,7 +53,7 @@ module Profiler
       end
 
       def collect
-        @subscriptions.each { |sub| ActiveSupport::Notifications.unsubscribe(sub) }
+        unsubscribe
 
         data = {
           views: @views,
@@ -66,6 +66,10 @@ module Profiler
         store_data(data)
       end
 
+      def unsubscribe
+        unsubscribe_notifications(@subscriptions)
+      end
+
       def toolbar_summary
         total_duration = (@views + @partials).sum { |v| v[:duration] }.round(2)
 

data/lib/profiler/console_profiler.rb

@@ -44,7 +44,7 @@ module Profiler
 
       console_collector = Collectors::ConsoleCollector.new(profile, expression: @expression)
       collectors = [console_collector] + CONSOLE_COLLECTOR_CLASSES.map { |klass| klass.new(profile) }
-      collectors.each { |c| c.subscribe if c.respond_to?(:subscribe) }
+      return block.call unless Collectors::Lifecycle.subscribe_all(collectors, "ConsoleProfiler")
 
       exception_collector = collectors.find { |c| c.is_a?(Collectors::ExceptionCollector) }
 
@@ -82,6 +82,9 @@ module Profiler
 
         Profiler.storage.save(profile.token, profile)
       end
+    ensure
+      # After collect, and also when collect or the storage failed.
+      Collectors::Lifecycle.release_all(collectors)
     end
 
     private

data/lib/profiler/job_profiler.rb

@@ -67,7 +67,7 @@ module Profiler
       })
 
       collectors = [job_collector] + JOB_COLLECTOR_CLASSES.map { |klass| klass.new(profile) }
-      collectors.each { |c| c.subscribe if c.respond_to?(:subscribe) }
+      return block.call unless Collectors::Lifecycle.subscribe_all(collectors, "JobProfiler")
 
       exception_collector = collectors.find { |c| c.is_a?(Collectors::ExceptionCollector) }
 
@@ -109,6 +109,9 @@ module Profiler
 
         Profiler.storage.save(profile.token, profile)
       end
+    ensure
+      # After collect, and also when collect or the storage failed.
+      Collectors::Lifecycle.release_all(collectors)
     end
 
     private

data/lib/profiler/middleware/profiler_middleware.rb

@@ -2,6 +2,7 @@
 
 require_relative "../models/profile"
 require_relative "../current_context"
+require_relative "../collectors/lifecycle"
 require_relative "toolbar_injector"
 
 module Profiler
@@ -14,28 +15,55 @@ module Profiler
       def call(env)
         return @app.call(env) unless should_profile?(env)
 
-        status = nil
-        headers = nil
-        body = nil
         collectors = nil
+        begin
+          begin
+            profile = Models::Profile.new(build_request(env))
+            profile.gem_version = Profiler::VERSION
+            Profiler::CurrentContext.token = profile.token
+
+            # Capture request body before app processes it
+            req_body_raw = read_rack_input(env)
+
+            # Store profile in env for collectors
+            env["profiler.profile"] = profile
+
+            collectors = create_collectors(profile)
+            env["profiler.collectors"] = collectors
+            subscribed = Collectors::Lifecycle.subscribe_all(collectors, "ProfilerMiddleware")
+          rescue => e
+            warn "Profiler error: #{e.message}\n#{e.backtrace.join("\n")}"
+            subscribed = false
+          end
 
-        profile = Models::Profile.new(build_request(env))
-        profile.gem_version = Profiler::VERSION
-        Profiler::CurrentContext.token = profile.token
+          unless subscribed
+            # The application has not run yet: serve the request once, unprofiled.
+            release(collectors)
+            return @app.call(env)
+          end
 
-        # Capture request body before app processes it
-        req_body_raw = read_rack_input(env)
+          # Measure memory before
+          memory_before = current_memory if Profiler.configuration.track_memory
 
-        # Store profile in env for collectors
-        env["profiler.profile"] = profile
+          begin
+            response = @app.call(env)
+          rescue Exception => e # rubocop:disable Lint/RescueException
+            record_failed_request(env, profile, collectors, req_body_raw, memory_before, e) if failed_request?(e)
+            raise
+          end
 
-        collectors = create_collectors(profile)
-        env["profiler.collectors"] = collectors
+          complete_profile(env, profile, collectors, req_body_raw, memory_before, response)
+        ensure
+          # Opened before the first subscribe: whatever happens from there on, an exception
+          # outside StandardError included, nothing a collector installed outlives the request.
+          release(collectors)
+        end
+      end
 
-        # Measure memory before
-        memory_before = current_memory if Profiler.configuration.track_memory
+      private
 
-        status, headers, body = @app.call(env)
+      def complete_profile(env, profile, collectors, req_body_raw, memory_before, response)
+        status, headers, body = response
         headers = headers.dup
 
         # Measure memory after
@@ -56,17 +84,9 @@ module Profiler
           resp_content_type: (headers["content-type"] || headers["Content-Type"]).to_s
         )
 
-        collectors.each do |collector|
-          begin
-            collector.collect if collector.respond_to?(:collect)
-            profile.add_collector_metadata(collector)
-          rescue => e
-            warn "Collector #{collector.class} failed: #{e.message}"
-          end
-        end
+        collect_all(profile, collectors)
 
         Profiler.storage.save(profile.token, profile)
-        Profiler::CurrentContext.clear
 
         headers["X-Profiler-Token"] = profile.token
 
@@ -77,13 +97,50 @@ module Profiler
 
         [status, headers, body]
       rescue => e
+        # The application has run: its response goes out, profiled or not.
         warn "Profiler error: #{e.message}\n#{e.backtrace.join("\n")}"
-        collectors&.each { |c| c.unsubscribe if c.respond_to?(:unsubscribe) }
-        Profiler::CurrentContext.clear
-        status ? [status, headers, body || []] : @app.call(env)
+        [status, headers, body || []]
       end
 
-      private
+      # A request cut short by a timeout (Timeout::ExitException, Rack::Timeout) is profiled like
+      # one that raised; one stopped by a signal or an exit is not, the process is going away.
+      def failed_request?(error)
+        !error.is_a?(SignalException) && !error.is_a?(SystemExit)
+      end
+
+      # The profile of a request that raised is kept: status 500, which the server answers once
+      # the exception leaves the stack, and the exception itself. Never masks the exception.
+      def record_failed_request(env, profile, collectors, req_body_raw, memory_before, error)
+        collectors.each { |collector| collector.capture(error) if collector.respond_to?(:capture) }
+        profile.memory = current_memory - memory_before if Profiler.configuration.track_memory
+        profile.finish(500)
+        profile.set_bodies(
+          request_body: req_body_raw,
+          response_body: "",
+          req_content_type: env["CONTENT_TYPE"].to_s,
+          resp_content_type: ""
+        )
+        collect_all(profile, collectors)
+        Profiler.storage.save(profile.token, profile)
+      rescue => e
+        warn "Profiler error while recording a failed request: #{e.message}"
+      end
+
+      def collect_all(profile, collectors)
+        collectors.each do |collector|
+          begin
+            collector.collect if collector.respond_to?(:collect)
+            profile.add_collector_metadata(collector)
+          rescue => e
+            warn "Collector #{collector.class} failed: #{e.message}"
+          end
+        end
+      end
+
+      def release(collectors)
+        Collectors::Lifecycle.release_all(collectors)
+        Profiler::CurrentContext.clear
+      end
 
       def should_profile?(env)
         return false unless Profiler.enabled?
@@ -104,12 +161,10 @@ module Profiler
         end
       end
 
+      # Builds the collectors without subscribing them: Lifecycle.subscribe_all does, so that
+      # a failure part way leaves every collector reachable for release.
       def create_collectors(profile)
-        Profiler.configuration.collectors.map do |collector_class|
-          collector = collector_class.new(profile)
-          collector.subscribe if collector.respond_to?(:subscribe)
-          collector
-        end
+        Profiler.configuration.collectors.map { |collector_class| collector_class.new(profile) }
       end
 
       def html_response?(headers)

data/lib/profiler/middleware/toolbar_injector.rb

@@ -1,9 +1,31 @@
 # frozen_string_literal: true
 
+require "json"
+require "strscan"
+require "active_support/core_ext/string/output_safety"
+
 module Profiler
   module Middleware
     class ToolbarInjector
-      CLOSING_BODY_TAG = "</body>"
+      # The only characters HTML counts as white space between attributes (\s also takes \v).
+      WS = "[\\t\\n\\f\\r ]"
+      # Elements whose content the browser does not parse as markup: a </body> inside one of
+      # them is text, not the end of the page. Each maps to the end tag that closes it.
+      RAW_TEXT_ELEMENTS = %w[script style textarea title xmp iframe noembed noframes noscript]
+                          .to_h { |name| [name, %r{</#{name}(?=#{WS}|[/>])}i] }.freeze
+      # Never closed: whatever follows it is text.
+      PLAINTEXT = "plaintext"
+      # An attribute as the HTML tokenizer reads it: the name may start with = (or a quote),
+      # and a value only follows a name, after =. A quoted value may hold a > or a </body>.
+      ATTRIBUTE = %r{
+        [^\t\n\f\r\ />][^\t\n\f\r\ />=]*+
+        (?:#{WS}*+(?:=#{WS}*+(?:"[^"]*+"|'[^']*+'|[^\t\n\f\r\ >"'][^\t\n\f\r\ >]*+|(?=>))|(?!=)))
+      }x
+      # The rest of a tag, up to its >. A quoted value that is never closed fails the match,
+      # as does a tag without its >. Possessive, so that a failure costs no backtracking.
+      TAG_REST = %r{(?:#{WS}++|/|#{ATTRIBUTE})*+>}
+      # A whole start or end tag, read after its <: the slash and the name are captured.
+      TAG = %r{(/)?([a-z][^\t\n\f\r\ />]*+)#{TAG_REST}}i
 
       def initialize(body, token, nonce = nil)
         @body = body
@@ -13,9 +35,12 @@ module Profiler
 
       def inject
         content = extract_content(@body)
-        return @body unless content.include?(CLOSING_BODY_TAG)
+        # Bytes, so that a page that is not valid UTF-8 can still be scanned.
+        bytes = content.b
+        position = closing_body_position(bytes)
+        return @body unless position
 
-        injected_content = content.sub(CLOSING_BODY_TAG, toolbar_html + CLOSING_BODY_TAG)
+        injected_content = bytes.insert(position, toolbar_html.b).force_encoding(content.encoding)
 
         # Return as array for Rack compatibility
         [injected_content]
@@ -23,12 +48,70 @@ module Profiler
 
       private
 
+      # Byte offset of the </body> that closes the page: the last one outside comments, tags
+      # (an attribute value) and raw-text elements, where a page can carry the string
+      # "</body>" (a script building markup, a cached fragment in a final comment). nil when
+      # there is none, or when the page leaves a comment, a tag, a quoted value or a raw-text
+      # element open, or holds a <plaintext> or a double-escaped script: no toolbar rather than
+      # a toolbar in the wrong place.
+      def closing_body_position(bytes)
+        scanner = StringScanner.new(bytes)
+        position = nil
+
+        while scanner.skip_until(/</)
+          start = scanner.pos - 1
+
+          if scanner.skip(TAG)
+            name = scanner[2]
+            name = name.downcase if name.match?(/[A-Z]/)
+
+            if scanner[1]
+              position = start if name == "body"
+              next
+            end
+            return nil if name == PLAINTEXT
+            next unless (end_tag = RAW_TEXT_ELEMENTS[name])
+
+            text_start = scanner.pos
+            return nil unless scanner.skip_until(end_tag)
+            return nil if name == "script" && double_escaped?(bytes, text_start, scanner.pos - scanner.matched_size)
+            return nil unless scanner.skip(TAG_REST)
+          elsif scanner.match?(%r{/?[a-z]}i)
+            # A tag, or a quoted value in it, that is never closed.
+            return nil
+          elsif scanner.skip(/!--/)
+            # <!--> and <!---> are complete comments.
+            next if scanner.skip(/-?>/) || scanner.skip_until(/-->/)
+
+            return nil
+          elsif scanner.skip(/!\[CDATA\[/)
+            # A bogus comment up to the first > in HTML, a CDATA section up to ]]> in <svg> or
+            # <math>: go on only when both end at the same place.
+            return nil unless scanner.skip_until(/>/) && bytes.byteslice(scanner.pos - 3, 3) == "]]>"
+          elsif scanner.skip(%r{[!?/]})
+            # <!DOCTYPE>, <?xml ?>, </ not followed by a letter: a bogus comment, up to its >.
+            return nil unless scanner.skip_until(/>/)
+          end
+        end
+
+        position
+      end
+
+      # In a script, <!-- followed by <script enters a state where </script> does not close it.
+      # Only the script itself is searched, so that a page of many scripts is read in linear
+      # time.
+      def double_escaped?(bytes, from, to)
+        text = bytes.byteslice(from, to - from)
+        comment = text.index("<!--")
+        comment ? text.match?(%r{<script(?:#{WS}|[/>])}i, comment) : false
+      end
+
       def ajax_interceptor_script
         return "" unless Profiler.configuration.track_ajax
 
         <<~HTML
           <script#{nonce_attr}>
-            window.__PROFILER_PARENT_TOKEN__ = '#{@token}';
+            window.__PROFILER_PARENT_TOKEN__ = #{js_token};
           </script>
           <script#{nonce_attr}>
             #{ajax_interceptor_code}
@@ -63,15 +146,20 @@ module Profiler
         <<~HTML
           #{ajax_interceptor_script}
           <style>#{toolbar_styles}</style>
-          <div id="profiler-toolbar" class="profiler-root" data-token="#{@token}"></div>
+          <div id="profiler-toolbar" class="profiler-root" data-token="#{ERB::Util.html_escape(@token)}"></div>
           <button id="profiler-toolbar-toggle" class="profiler-root" title="Toggle profiler (Alt+P)"><span class="profiler-toggle-icon">&#9654;</span></button>
           <script#{nonce_attr}>(function(){var c=localStorage.getItem('profiler-toolbar-collapsed')==='true',t=localStorage.getItem('profiler-theme'),theme=t==='light'?'light':t==='dark'?'dark':(window.matchMedia('(prefers-color-scheme:light)').matches?'light':'dark'),el=document.getElementById('profiler-toolbar'),tog=document.getElementById('profiler-toolbar-toggle');if(c){el.style.cssText='animation:none!important;transform:translateX(calc(100% + 44px))';tog.dataset.collapsed='true';}el.setAttribute('data-theme',theme);tog.setAttribute('data-theme',theme);})();</script>
           <script src="/_profiler/assets/profiler-toolbar.js" defer#{nonce_attr}></script>
         HTML
       end
 
+      # The token as a JavaScript string literal that cannot close the <script> element.
+      def js_token
+        ERB::Util.json_escape(@token.to_s.to_json)
+      end
+
       def nonce_attr
-        @nonce ? " nonce=\"#{@nonce}\"" : ""
+        @nonce ? " nonce=\"#{ERB::Util.html_escape(@nonce)}\"" : ""
       end
 
       # Thermal design system — self-contained CSS for the injected toolbar.

data/lib/profiler/test_profiler.rb

@@ -52,7 +52,7 @@ module Profiler
       )
 
       collectors = [test_collector] + TEST_COLLECTOR_CLASSES.map { |klass| klass.new(profile) }
-      collectors.each { |c| c.subscribe if c.respond_to?(:subscribe) }
+      return block.call unless Collectors::Lifecycle.subscribe_all(collectors, "TestProfiler")
 
       exception_collector = collectors.find { |c| c.is_a?(Collectors::ExceptionCollector) }
 
@@ -120,6 +120,9 @@ module Profiler
 
         Profiler.storage.save(profile.token, profile)
       end
+    ensure
+      # After collect, and also when collect or the storage failed.
+      Collectors::Lifecycle.release_all(collectors)
     end
 
     private

data/lib/profiler/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Profiler
-  VERSION = "0.30.11"
+  VERSION = "0.30.13"
 end

data/lib/profiler.rb

@@ -77,16 +77,18 @@ module Profiler
     def dump(value, label = nil)
       return unless enabled?
 
+      # The slot exists only while a DumpCollector profiles this thread: outside of one, nobody
+      # would ever read the dump, and the thread would keep it for good.
+      dumps = Thread.current[:profiler_dumps]
+      return value unless dumps
+
       # Get caller location
       caller_location = caller_locations(1, 1).first
       file = caller_location.path
       line = caller_location.lineno
 
-      # Initialize dumps array if needed
-      Thread.current[:profiler_dumps] ||= []
-
       # Store the dump
-      Thread.current[:profiler_dumps] << {
+      dumps << {
         value: value,
         label: label,
         file: file,

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rails-profiler
 version: !ruby/object:Gem::Version
-  version: 0.30.11
+  version: 0.30.13
 platform: ruby
 authors:
 - Sébastien Duplessy
@@ -152,6 +152,7 @@ files:
 - lib/profiler/collectors/http_collector.rb
 - lib/profiler/collectors/i18n_collector.rb
 - lib/profiler/collectors/job_collector.rb
+- lib/profiler/collectors/lifecycle.rb
 - lib/profiler/collectors/log_collector.rb
 - lib/profiler/collectors/mailer_collector.rb
 - lib/profiler/collectors/request_collector.rb