Skip to content

fix(native): Isolate and bound flamegraph attachment processing - #128737

Draft
philprime wants to merge 4 commits into
masterfrom
fix/bound-flamegraph-inline-expansion
Draft

philprime wants to merge 4 commits into
masterfrom
fix/bound-flamegraph-inline-expansion

Conversation

@philprime

@philprime philprime commented Oct 24, 2026 •

Copy link
Copy Markdown
Member

Follow-up to #126459.

Flamegraph attachments are best-effort enrichment and must not prevent a crash's native stacktraces from being symbolicated. Event stacktraces now finish first. Unexpected exceptions from attachment loading, validation, Symbolicator requests, merging, and persistence are reported without marking the event fatal. Missing attachment chunks and files are expected skips, counted without exception reporting. A shared-budget SymbolicationTimeout stops the remaining flamegraphs rather than repeatedly submitting work after the deadline.

The existing 100,000-node budget is enforced before DRF validation and Symbolicator submission, and incrementally before allocating each inline node. Exceeding either guard discards the rewrite and preserves the original attachment. The node ceiling is an allocation-count budget, not a byte-accurate memory limit. The 10 MiB serialized-size check remains in place.

Skipped attachments emit process.native.flamegraph.skipped with bounded reason tags for size, schema, node/expansion limits, load/request/merge/save failures, and timeouts. Payload contents are not included in metric tags or logs. Both flamegraph-only routing and attachment processing run the cheap in-memory attachment scan before checking organizations:flamegraph-attachments. Events without flamegraph attachments avoid the flag lookup entirely, and flag-off organizations avoid a flamegraph-only native task hop. Native crash routing is preserved.

Regression coverage runs through the symbolication task wrapper to verify that attachment timeouts, load/save errors, and unexpected processing failures leave the crash symbolicated without a fatal-processing marker. It also covers stopping later requests after a timeout, pre-validation rejection, routing with the flag on/off, expansion boundaries, original-payload preservation, and skip metrics. Attachment format, size/frame/node limits, and _symbolication.status: "completed" semantics are unchanged. Failed/skipped attachments remain eligible for reprocessing.

Closes getsentry/sentry-cocoa#9445

@github-actions github-actions Bot added the Scope: Backend Automatically applied to PRs that change backend components label Oct 24, 2026
@philprime philprime self-assigned this Oct 24, 2026
@philprime philprime changed the title fix(native): Bound flamegraph inline expansion allocations fix(native): Isolate and bound flamegraph attachment processing Oct 24, 2026

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Scope: Backend Automatically applied to PRs that change backend components

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Add additional processing safeguards for flamegraphs

1 participant