Skip to content

fix(libdd-profiling)!: make unsafe function actually explicitly unsafe - #2741

Merged
gh-worker-dd-mergequeue-cf854d[bot] merged 1 commit into
mainfrom
yannham/fix-unsoundness-3
Oct 29, 2026
Merged

gh-worker-dd-mergequeue-cf854d[bot] merged 1 commit into
mainfrom
yannham/fix-unsoundness-3

Conversation

@yannham

@yannham yannham commented Oct 28, 2026 •

Copy link
Copy Markdown
Contributor

What does this PR do?

Replace From<ThinSlice<'_, u8>> with an explicit unsafe ThinStr::from_utf8_unchecked

Motivation

The safe From<ThinSlice<'_, u8>> instance allowed safe code to wrap arbitrary bytes into a ThinStr and obtain an invalid &str through deref, which is undefined behavior (for non UTF-8 bytes). No callsite has exercised this UB so far, but let's make it future-proof.

Additional Notes

N/A

How to test the change?

N/A

@yannham
yannham requested a review from a team as a code owner October 28, 2026 15:30
@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Oct 28, 2026 •

Copy link
Copy Markdown

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
📝 Code Review ✅ Completed 2026-10-28T15:32:00.397725Z 8bc1faf PR opened
🔒 Security Review ✅ Completed 2026-10-28T15:34:06.653037Z 8bc1faf PR opened
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

@gyuheon0h gyuheon0h left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nice catch

@datadog-official

datadog-official Bot commented Oct 28, 2026 •

Copy link
Copy Markdown

Pipelines  Tests

🎉 All green!

🧪 All tests passed
❄️ No new flaky tests detected

🎯 Code Coverage (details)
• Patch Coverage: 75.00%
• Overall Coverage: 81.73% (-1.32%)

This comment will be updated automatically if new data arrives.
🔗 Commit SHA: 8f0dc15 | Docs | View more details | Give us feedback!

@pr-commenter

pr-commenter Bot commented Oct 28, 2026 •

Copy link
Copy Markdown

Benchmarks

Comparison

Benchmark execution time: 2026-10-29 14:02:01

Comparing candidate commit 8f0dc15 in PR branch yannham/fix-unsoundness-3 with baseline commit 9ca1e4f in branch main.

📊 Benchmarking dashboard

Found 0 performance improvements and 0 performance regressions! Performance is the same for 13 metrics, 0 unstable metrics.

Explanation

This is an A/B test comparing a candidate commit's performance against that of a baseline commit. Performance changes are noted in the tables below as:

  • 🟩 = significantly better candidate vs. baseline
  • 🟥 = significantly worse candidate vs. baseline

We compute a confidence interval (CI) over the relative difference of means between metrics from the candidate and baseline commits, considering the baseline as the reference.

If the CI is entirely outside the configured SIGNIFICANT_IMPACT_THRESHOLD (or the deprecated UNCONFIDENCE_THRESHOLD), the change is considered significant.

Feel free to reach out to #apm-benchmarking-platform on Slack if you have any questions.

More details about the CI and significant changes

You can imagine this CI as a range of values that is likely to contain the true difference of means between the candidate and baseline commits.

CIs of the difference of means are often centered around 0%, because often changes are not that big:

---------------------------------(------|---^--------)-------------------------------->
                              -0.6%    0%  0.3%     +1.2%
                                 |          |        |
         lower bound of the CI --'          |        |
sample mean (center of the CI) -------------'        |
         upper bound of the CI ----------------------'

As described above, a change is considered significant if the CI is entirely outside the configured SIGNIFICANT_IMPACT_THRESHOLD (or the deprecated UNCONFIDENCE_THRESHOLD).

For instance, for an execution time metric, this confidence interval indicates a significantly worse performance:

----------------------------------------|---------|---(---------^---------)---------->
                                       0%        1%  1.3%      2.2%      3.1%
                                                  |   |         |         |
       significant impact threshold --------------'   |         |         |
                      lower bound of CI --------------'         |         |
       sample mean (center of the CI) --------------------------'         |
                      upper bound of CI ----------------------------------'

Candidate

Candidate benchmark details

Group 1

cpu_model git_commit_sha git_commit_date git_branch
Intel(R) Xeon(R) Platinum 8259CL CPU @ 2.50GHz 8f0dc15 1793281885 yannham/fix-unsoundness-3
scenario metric min mean ± sd median ± mad p75 p95 p99 max peak_to_median_ratio skewness kurtosis cv sem runs sample_size
profiles_dictionary/profile_string_inserts/threads/1 execution_time 313.599µs 319.923µs ± 3.005µs 320.314µs ± 1.252µs 321.473µs 323.455µs 324.097µs 324.258µs 1.23% -0.789 0.204 0.89% 0.950µs 1 10
profiles_dictionary/profile_string_inserts/threads/1 throughput 3157981.191op/s 3201021.258op/s ± 30283.633op/s 3196863.815op/s ± 12488.163op/s 3207215.651op/s 3251010.148op/s 3262452.529op/s 3265313.125op/s 2.14% 0.831 0.254 0.90% 9576.526op/s 1 10
profiles_dictionary/profile_string_inserts/threads/16 execution_time 1.913ms 1.926ms ± 0.010ms 1.925ms ± 0.005ms 1.929ms 1.943ms 1.948ms 1.950ms 1.26% 0.973 0.689 0.51% 0.003ms 1 10
profiles_dictionary/profile_string_inserts/threads/16 throughput 8403579.108op/s 8505371.505op/s ± 45510.295op/s 8509827.785op/s ± 21538.040op/s 8531620.892op/s 8558005.082op/s 8564679.186op/s 8566347.712op/s 0.66% -0.946 0.643 0.51% 14391.619op/s 1 10
profiles_dictionary/profile_string_inserts/threads/2 execution_time 561.415µs 564.040µs ± 2.234µs 563.641µs ± 1.696µs 565.477µs 567.405µs 568.297µs 568.520µs 0.87% 0.685 -0.381 0.38% 0.706µs 1 10
profiles_dictionary/profile_string_inserts/threads/2 throughput 3602333.063op/s 3630996.601op/s ± 14344.948op/s 3633519.845op/s ± 10967.363op/s 3640331.133op/s 3647613.612op/s 3647863.773op/s 3647926.313op/s 0.40% -0.672 -0.401 0.37% 4536.271op/s 1 10
profiles_dictionary/profile_string_inserts/threads/4 execution_time 736.614µs 739.332µs ± 2.497µs 738.255µs ± 1.569µs 740.848µs 743.203µs 743.903µs 744.078µs 0.79% 0.659 -0.793 0.32% 0.789µs 1 10
profiles_dictionary/profile_string_inserts/threads/4 throughput 5504797.769op/s 5540191.445op/s ± 18668.394op/s 5548220.915op/s ± 11818.313op/s 5552872.275op/s 5560093.288op/s 5560482.514op/s 5560579.821op/s 0.22% -0.652 -0.806 0.32% 5903.464op/s 1 10
scenario metric 95% CI mean Shapiro-Wilk pvalue Ljung-Box pvalue (lag=1) Dip test pvalue
profiles_dictionary/profile_string_inserts/threads/1 execution_time [318.061µs; 321.786µs] or [-0.582%; +0.582%] None None None
profiles_dictionary/profile_string_inserts/threads/1 throughput [3182251.613op/s; 3219790.903op/s] or [-0.586%; +0.586%] None None None
profiles_dictionary/profile_string_inserts/threads/16 execution_time [1.920ms; 1.933ms] or [-0.333%; +0.333%] None None None
profiles_dictionary/profile_string_inserts/threads/16 throughput [8477164.450op/s; 8533578.559op/s] or [-0.332%; +0.332%] None None None
profiles_dictionary/profile_string_inserts/threads/2 execution_time [562.656µs; 565.425µs] or [-0.245%; +0.245%] None None None
profiles_dictionary/profile_string_inserts/threads/2 throughput [3622105.673op/s; 3639887.528op/s] or [-0.245%; +0.245%] None None None
profiles_dictionary/profile_string_inserts/threads/4 execution_time [737.785µs; 740.880µs] or [-0.209%; +0.209%] None None None
profiles_dictionary/profile_string_inserts/threads/4 throughput [5528620.867op/s; 5551762.023op/s] or [-0.209%; +0.209%] None None None

Group 2

cpu_model git_commit_sha git_commit_date git_branch
Intel(R) Xeon(R) Platinum 8259CL CPU @ 2.50GHz 8f0dc15 1793281885 yannham/fix-unsoundness-3
scenario metric min mean ± sd median ± mad p75 p95 p99 max peak_to_median_ratio skewness kurtosis cv sem runs sample_size
profile_add_sample2_frames_x1000 execution_time 720.102µs 721.558µs ± 0.641µs 721.506µs ± 0.353µs 721.918µs 722.712µs 723.311µs 724.343µs 0.39% 0.794 2.093 0.09% 0.045µs 1 200
scenario metric 95% CI mean Shapiro-Wilk pvalue Ljung-Box pvalue (lag=1) Dip test pvalue
profile_add_sample2_frames_x1000 execution_time [721.469µs; 721.647µs] or [-0.012%; +0.012%] None None None

Group 3

cpu_model git_commit_sha git_commit_date git_branch
Intel(R) Xeon(R) Platinum 8259CL CPU @ 2.50GHz 8f0dc15 1793281885 yannham/fix-unsoundness-3
scenario metric min mean ± sd median ± mad p75 p95 p99 max peak_to_median_ratio skewness kurtosis cv sem runs sample_size
profile_add_sample_timestamped_x1000 execution_time 4.005ms 4.011ms ± 0.008ms 4.011ms ± 0.002ms 4.012ms 4.016ms 4.023ms 4.108ms 2.43% 10.665 132.840 0.19% 0.001ms 1 200
scenario metric 95% CI mean Shapiro-Wilk pvalue Ljung-Box pvalue (lag=1) Dip test pvalue
profile_add_sample_timestamped_x1000 execution_time [4.010ms; 4.013ms] or [-0.026%; +0.026%] None None None

Group 4

cpu_model git_commit_sha git_commit_date git_branch
Intel(R) Xeon(R) Platinum 8259CL CPU @ 2.50GHz 8f0dc15 1793281885 yannham/fix-unsoundness-3
scenario metric min mean ± sd median ± mad p75 p95 p99 max peak_to_median_ratio skewness kurtosis cv sem runs sample_size
benching string interning on wordpress profile execution_time 113.157µs 114.311µs ± 0.740µs 114.204µs ± 0.249µs 114.510µs 114.995µs 115.409µs 122.711µs 7.45% 7.487 81.689 0.65% 0.052µs 1 200
scenario metric 95% CI mean Shapiro-Wilk pvalue Ljung-Box pvalue (lag=1) Dip test pvalue
benching string interning on wordpress profile execution_time [114.208µs; 114.413µs] or [-0.090%; +0.090%] None None None

Group 5

cpu_model git_commit_sha git_commit_date git_branch
Intel(R) Xeon(R) Platinum 8259CL CPU @ 2.50GHz 8f0dc15 1793281885 yannham/fix-unsoundness-3
scenario metric min mean ± sd median ± mad p75 p95 p99 max peak_to_median_ratio skewness kurtosis cv sem runs sample_size
profile_add_sample_frames_x1000 execution_time 3.996ms 4.002ms ± 0.002ms 4.002ms ± 0.001ms 4.003ms 4.005ms 4.007ms 4.016ms 0.36% 2.159 12.240 0.05% 0.000ms 1 200
scenario metric 95% CI mean Shapiro-Wilk pvalue Ljung-Box pvalue (lag=1) Dip test pvalue
profile_add_sample_frames_x1000 execution_time [4.002ms; 4.002ms] or [-0.008%; +0.008%] None None None

Group 6

cpu_model git_commit_sha git_commit_date git_branch
Intel(R) Xeon(R) Platinum 8259CL CPU @ 2.50GHz 8f0dc15 1793281885 yannham/fix-unsoundness-3
scenario metric min mean ± sd median ± mad p75 p95 p99 max peak_to_median_ratio skewness kurtosis cv sem runs sample_size
profile_serialize_compressed_pprof_timestamped_x1000 execution_time 852.418µs 855.109µs ± 2.361µs 854.494µs ± 0.879µs 855.611µs 858.750µs 860.552µs 876.425µs 2.57% 4.160 31.755 0.28% 0.167µs 1 200
scenario metric 95% CI mean Shapiro-Wilk pvalue Ljung-Box pvalue (lag=1) Dip test pvalue
profile_serialize_compressed_pprof_timestamped_x1000 execution_time [854.782µs; 855.436µs] or [-0.038%; +0.038%] None None None

Baseline

Baseline benchmark details

Group 1

cpu_model git_commit_sha git_commit_date git_branch
Intel(R) Xeon(R) Platinum 8259CL CPU @ 2.50GHz 9ca1e4f 1793281602 main
scenario metric min mean ± sd median ± mad p75 p95 p99 max peak_to_median_ratio skewness kurtosis cv sem runs sample_size
profiles_dictionary/profile_string_inserts/threads/1 execution_time 316.874µs 321.290µs ± 2.732µs 322.581µs ± 1.413µs 323.482µs 324.007µs 324.103µs 324.127µs 0.48% -0.471 -1.443 0.81% 0.864µs 1 10
profiles_dictionary/profile_string_inserts/threads/1 throughput 3159257.205op/s 3187359.885op/s ± 27210.132op/s 3174397.634op/s ± 13845.307op/s 3212695.439op/s 3225698.339op/s 3230395.502op/s 3231569.793op/s 1.80% 0.479 -1.432 0.81% 8604.599op/s 1 10
profiles_dictionary/profile_string_inserts/threads/16 execution_time 1.906ms 1.917ms ± 0.009ms 1.915ms ± 0.005ms 1.923ms 1.931ms 1.934ms 1.935ms 1.04% 0.725 -0.614 0.45% 0.003ms 1 10
profiles_dictionary/profile_string_inserts/threads/16 throughput 8469351.283op/s 8546686.575op/s ± 40093.513op/s 8557763.012op/s ± 22892.967op/s 8576152.292op/s 8589054.178op/s 8593883.660op/s 8595091.030op/s 0.44% -0.714 -0.631 0.45% 12678.682op/s 1 10
profiles_dictionary/profile_string_inserts/threads/2 execution_time 553.139µs 558.809µs ± 5.797µs 556.247µs ± 2.356µs 564.009µs 567.394µs 567.419µs 567.425µs 2.01% 0.686 -1.264 0.98% 1.833µs 1 10
profiles_dictionary/profile_string_inserts/threads/2 throughput 3609289.768op/s 3665291.825op/s ± 37767.711op/s 3681826.042op/s ± 15618.938op/s 3691414.196op/s 3701544.001op/s 3702313.799op/s 3702506.249op/s 0.56% -0.678 -1.268 0.98% 11943.199op/s 1 10
profiles_dictionary/profile_string_inserts/threads/4 execution_time 737.650µs 742.763µs ± 2.821µs 742.452µs ± 1.074µs 743.516µs 747.101µs 747.899µs 748.098µs 0.76% 0.200 0.140 0.36% 0.892µs 1 10
profiles_dictionary/profile_string_inserts/threads/4 throughput 5475216.593op/s 5514615.689op/s ± 20926.692op/s 5516857.749op/s ± 7975.362op/s 5522404.565op/s 5542527.461op/s 5550718.806op/s 5552766.642op/s 0.65% -0.177 0.141 0.36% 6617.601op/s 1 10
scenario metric 95% CI mean Shapiro-Wilk pvalue Ljung-Box pvalue (lag=1) Dip test pvalue
profiles_dictionary/profile_string_inserts/threads/1 execution_time [319.597µs; 322.983µs] or [-0.527%; +0.527%] None None None
profiles_dictionary/profile_string_inserts/threads/1 throughput [3170495.181op/s; 3204224.590op/s] or [-0.529%; +0.529%] None None None
profiles_dictionary/profile_string_inserts/threads/16 execution_time [1.911ms; 1.923ms] or [-0.292%; +0.292%] None None None
profiles_dictionary/profile_string_inserts/threads/16 throughput [8521836.815op/s; 8571536.334op/s] or [-0.291%; +0.291%] None None None
profiles_dictionary/profile_string_inserts/threads/2 execution_time [555.216µs; 562.401µs] or [-0.643%; +0.643%] None None None
profiles_dictionary/profile_string_inserts/threads/2 throughput [3641883.585op/s; 3688700.065op/s] or [-0.639%; +0.639%] None None None
profiles_dictionary/profile_string_inserts/threads/4 execution_time [741.015µs; 744.511µs] or [-0.235%; +0.235%] None None None
profiles_dictionary/profile_string_inserts/threads/4 throughput [5501645.430op/s; 5527585.949op/s] or [-0.235%; +0.235%] None None None

Group 2

cpu_model git_commit_sha git_commit_date git_branch
Intel(R) Xeon(R) Platinum 8259CL CPU @ 2.50GHz 9ca1e4f 1793281602 main
scenario metric min mean ± sd median ± mad p75 p95 p99 max peak_to_median_ratio skewness kurtosis cv sem runs sample_size
profile_add_sample2_frames_x1000 execution_time 693.433µs 695.184µs ± 0.596µs 695.153µs ± 0.402µs 695.603µs 696.185µs 696.572µs 696.874µs 0.25% 0.015 0.179 0.09% 0.042µs 1 200
scenario metric 95% CI mean Shapiro-Wilk pvalue Ljung-Box pvalue (lag=1) Dip test pvalue
profile_add_sample2_frames_x1000 execution_time [695.101µs; 695.266µs] or [-0.012%; +0.012%] None None None

Group 3

cpu_model git_commit_sha git_commit_date git_branch
Intel(R) Xeon(R) Platinum 8259CL CPU @ 2.50GHz 9ca1e4f 1793281602 main
scenario metric min mean ± sd median ± mad p75 p95 p99 max peak_to_median_ratio skewness kurtosis cv sem runs sample_size
profile_add_sample_timestamped_x1000 execution_time 4.045ms 4.053ms ± 0.007ms 4.052ms ± 0.002ms 4.054ms 4.057ms 4.060ms 4.145ms 2.29% 10.798 135.955 0.18% 0.001ms 1 200
scenario metric 95% CI mean Shapiro-Wilk pvalue Ljung-Box pvalue (lag=1) Dip test pvalue
profile_add_sample_timestamped_x1000 execution_time [4.052ms; 4.054ms] or [-0.024%; +0.024%] None None None

Group 4

cpu_model git_commit_sha git_commit_date git_branch
Intel(R) Xeon(R) Platinum 8259CL CPU @ 2.50GHz 9ca1e4f 1793281602 main
scenario metric min mean ± sd median ± mad p75 p95 p99 max peak_to_median_ratio skewness kurtosis cv sem runs sample_size
benching string interning on wordpress profile execution_time 115.992µs 118.110µs ± 0.757µs 118.057µs ± 0.192µs 118.280µs 118.767µs 119.887µs 124.257µs 5.25% 4.310 33.353 0.64% 0.054µs 1 200
scenario metric 95% CI mean Shapiro-Wilk pvalue Ljung-Box pvalue (lag=1) Dip test pvalue
benching string interning on wordpress profile execution_time [118.005µs; 118.215µs] or [-0.089%; +0.089%] None None None

Group 5

cpu_model git_commit_sha git_commit_date git_branch
Intel(R) Xeon(R) Platinum 8259CL CPU @ 2.50GHz 9ca1e4f 1793281602 main
scenario metric min mean ± sd median ± mad p75 p95 p99 max peak_to_median_ratio skewness kurtosis cv sem runs sample_size
profile_add_sample_frames_x1000 execution_time 4.026ms 4.034ms ± 0.003ms 4.034ms ± 0.002ms 4.035ms 4.037ms 4.039ms 4.055ms 0.53% 2.222 17.392 0.07% 0.000ms 1 200
scenario metric 95% CI mean Shapiro-Wilk pvalue Ljung-Box pvalue (lag=1) Dip test pvalue
profile_add_sample_frames_x1000 execution_time [4.034ms; 4.034ms] or [-0.009%; +0.009%] None None None

Group 6

cpu_model git_commit_sha git_commit_date git_branch
Intel(R) Xeon(R) Platinum 8259CL CPU @ 2.50GHz 9ca1e4f 1793281602 main
scenario metric min mean ± sd median ± mad p75 p95 p99 max peak_to_median_ratio skewness kurtosis cv sem runs sample_size
profile_serialize_compressed_pprof_timestamped_x1000 execution_time 862.024µs 865.305µs ± 2.689µs 864.865µs ± 1.207µs 866.145µs 869.177µs 870.791µs 892.303µs 3.17% 5.362 49.139 0.31% 0.190µs 1 200
scenario metric 95% CI mean Shapiro-Wilk pvalue Ljung-Box pvalue (lag=1) Dip test pvalue
profile_serialize_compressed_pprof_timestamped_x1000 execution_time [864.932µs; 865.677µs] or [-0.043%; +0.043%] None None None

…om_utf8_unchecked

The safe From<ThinSlice<'_, u8>> for ThinStr impl allowed safe code to
wrap arbitrary bytes into a ThinStr and obtain an invalid &str through
Deref, which is undefined behavior.

Replace it with an explicit unsafe ThinStr::from_utf8_unchecked. All
five callsites live in the collections module and are fed bytes that
originate from &str, so re-validating UTF-8 on every intern would be
redundant work on the profiler's string-interning hot path; marking the
conversion unsafe keeps it zero-cost while moving the UTF-8 obligation
to the caller, where it is discharged with a SAFETY comment at each
site. The reverse From<ThinStr> for ThinSlice<u8> conversion stays
safe, as a ThinStr is always valid UTF-8.
@yannham
yannham force-pushed the yannham/fix-unsoundness-3 branch from e040b91 to 8f0dc15 Compare October 29, 2026 13:51
@yannham

yannham commented Oct 29, 2026

Copy link
Copy Markdown
Contributor Author

/merge

@gh-worker-devflow-routing-ef8351

gh-worker-devflow-routing-ef8351 Bot commented Oct 29, 2026 •

Copy link
Copy Markdown

View all feedbacks in Devflow UI.

2026-10-29 13:52:19 UTC ℹ️ Start processing command /merge


2026-10-29 13:52:25 UTC ℹ️ MergeQueue: Pull request is not mergeable yet

It will be processed automatically as soon as GitHub reports it as mergeable. View in MergeQueue UI.

  • Run /code blockers to see what is blocking it.
  • Run /remove to cancel it.

2026-10-29 14:15:22 UTC ℹ️ MergeQueue: merge request added to the queue

The expected merge time in main is approximately 44m (p90).


2026-10-29 14:45:51 UTC ℹ️ MergeQueue: This merge request was merged

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants