Port native malloc allocation profiling from async-profiler

ddprof-lib/src/main/cpp/arguments.cpp

@@ -374,6 +374,12 @@ Error Arguments::parse(const char *args) {
           }
       }
 
+      CASE("nativemem")
+      _nativemem = value == NULL ? 0 : parseUnits(value, BYTES);
+      if (_nativemem < 0) {
+        msg = "nativemem must be >= 0";
+      }
+
       DEFAULT()
       if (_unknown_arg == NULL)
         _unknown_arg = arg;
@@ -385,7 +391,7 @@ Error Arguments::parse(const char *args) {
     return Error(msg);
   }
 
-  if (_event == NULL && _cpu < 0 && _wall < 0 && _memory < 0) {
+  if (_event == NULL && _cpu < 0 && _wall < 0 && _memory < 0 && _nativemem < 0) {
     _event = EVENT_CPU;
   }
 

ddprof-lib/src/main/cpp/arguments.h

@@ -1,5 +1,6 @@
 /*
  * Copyright 2017 Andrei Pangin
+ * Copyright 2026, Datadog, Inc.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -174,6 +175,7 @@ class Arguments {
   double _live_samples_ratio;
   bool _record_heap_usage;
   bool _gc_generations;
+  long _nativemem;
   int  _jstackdepth;
   int _safe_mode;
   StackWalkFeatures _features;
@@ -209,6 +211,7 @@ class Arguments {
         _live_samples_ratio(0.1), // default to liveness-tracking 10% of the allocation samples
         _record_heap_usage(false),
         _gc_generations(false),
+        _nativemem(-1),
         _jstackdepth(DEFAULT_JSTACKDEPTH),
         _safe_mode(0),
         _features{1, 1, 1, 1, 1, 1},

ddprof-lib/src/main/cpp/codeCache.cpp

@@ -1,5 +1,6 @@
 /*
  * Copyright The async-profiler authors
+ * Copyright 2026, Datadog, Inc.
  * SPDX-License-Identifier: Apache-2.0
  */
 
@@ -308,6 +309,11 @@ void CodeCache::saveImport(ImportId id, void** entry) {
 
 void CodeCache::addImport(void **entry, const char *name) {
     switch (name[0]) {
+      case 'a':
+          if (strcmp(name, "aligned_alloc") == 0) {
+              saveImport(im_aligned_alloc, entry);
+          }
+          break;
       case 'c':
           if (strcmp(name, "calloc") == 0) {
               saveImport(im_calloc, entry);
@@ -337,6 +343,8 @@ void CodeCache::addImport(void **entry, const char *name) {
               saveImport(im_pthread_setspecific, entry);
           } else if (strcmp(name, "poll") == 0) {
               saveImport(im_poll, entry);
+          } else if (strcmp(name, "posix_memalign") == 0) {
+              saveImport(im_posix_memalign, entry);
           }
           break;
       case 'r':

ddprof-lib/src/main/cpp/codeCache.h

@@ -1,5 +1,6 @@
 /*
  * Copyright The async-profiler authors
+ * Copyright 2026, Datadog, Inc.
  * SPDX-License-Identifier: Apache-2.0
  */
 
@@ -34,6 +35,8 @@ enum ImportId {
   im_calloc,
   im_realloc,
   im_free,
+  im_posix_memalign,
+  im_aligned_alloc,
   im_sigaction,
   NUM_IMPORTS
 };

ddprof-lib/src/main/cpp/event.h

@@ -1,5 +1,6 @@
 /*
  * Copyright 2020 Andrei Pangin
+ * Copyright 2026, Datadog, Inc.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -88,6 +89,16 @@ class ObjectLivenessEvent : public Event {
   Context _ctx;
 };
 
+class MallocEvent : public Event {
+public:
+  u64 _start_time;
+  uintptr_t _address;
+  u64 _size;
+  float _weight;
+
+  MallocEvent() : Event(), _start_time(0), _address(0), _size(0), _weight(1.0f) {}
+};
+
 class WallClockEpochEvent {
 public:
   bool _dirty;

ddprof-lib/src/main/cpp/flightRecorder.cpp

@@ -906,6 +906,12 @@ void Recording::writeSettings(Buffer *buf, Arguments &args) {
 
   writeBoolSetting(buf, T_ALLOC, "enabled", args._record_allocations);
   writeBoolSetting(buf, T_HEAP_LIVE_OBJECT, "enabled", args._record_liveness);
+  writeBoolSetting(buf, T_MALLOC, "enabled", args._nativemem >= 0);
+  if (args._nativemem >= 0) {
+    writeIntSetting(buf, T_MALLOC, "nativemem", args._nativemem);
+    // samplingInterval=-1 means every allocation is recorded (nativemem=0).
+    writeIntSetting(buf, T_MALLOC, "samplingInterval", args._nativemem == 0 ? -1 : args._nativemem);
+  }
 
   writeBoolSetting(buf, T_ACTIVE_RECORDING, "debugSymbols",
                    VMStructs::libjvm()->hasDebugSymbols());
@@ -1575,6 +1581,21 @@ void Recording::recordAllocation(RecordingBuffer *buf, int tid,
   flushIfNeeded(buf);
 }
 
+void Recording::recordMallocSample(Buffer *buf, int tid, u64 call_trace_id,
+                                   MallocEvent *event) {
+  int start = buf->skip(1);
+  buf->putVar64(T_MALLOC);
+  buf->putVar64(event->_start_time);
+  buf->putVar64(tid);
+  buf->putVar64(call_trace_id);
+  buf->putVar64(event->_address);
+  buf->putVar64(event->_size);
+  buf->putFloat(event->_weight);
+  writeCurrentContext(buf);
+  writeEventSizePrefix(buf, start);
+  flushIfNeeded(buf);
+}
+
 void Recording::recordHeapLiveObject(Buffer *buf, int tid, u64 call_trace_id,
                                      ObjectLivenessEvent *event) {
   int start = buf->skip(1);
@@ -1817,6 +1838,9 @@ void FlightRecorder::recordEvent(int lock_index, int tid, u64 call_trace_id,
         case BCI_PARK:
           rec->recordThreadPark(buf, tid, call_trace_id, (LockEvent *)event);
           break;
+        case BCI_NATIVE_MALLOC:
+          rec->recordMallocSample(buf, tid, call_trace_id, (MallocEvent *)event);
+          break;
         }
         rec->flushIfNeeded(buf);
         rec->addThread(lock_index, tid);

ddprof-lib/src/main/cpp/flightRecorder.h

@@ -281,6 +281,8 @@ class Recording {
   void recordQueueTime(Buffer *buf, int tid, QueueTimeEvent *event);
   void recordAllocation(RecordingBuffer *buf, int tid, u64 call_trace_id,
                         AllocEvent *event);
+  void recordMallocSample(Buffer *buf, int tid, u64 call_trace_id,
+                          MallocEvent *event);
   void recordHeapLiveObject(Buffer *buf, int tid, u64 call_trace_id,
                             ObjectLivenessEvent *event);
   void recordMonitorBlocked(Buffer *buf, int tid, u64 call_trace_id,

ddprof-lib/src/main/cpp/hotspot/hotspotSupport.cpp

@@ -66,6 +66,8 @@ inline EventType eventTypeFromBCI(jint bci_type) {
             return LOCK_SAMPLE;
         case BCI_PARK:
             return PARK_SAMPLE;
+        case BCI_NATIVE_MALLOC:
+            return MALLOC_SAMPLE;
         default:
             // For unknown or invalid BCI types, default to EXECUTION_SAMPLE
             // This maintains backward compatibility and prevents undefined behavior
@@ -756,7 +758,7 @@ int HotspotSupport::getJavaTraceAsync(void *ucontext, ASGCT_CallFrame *frames,
   }
 
   HotspotStackFrame frame(ucontext);
-  uintptr_t saved_pc, saved_sp, saved_fp;
+  uintptr_t saved_pc = 0, saved_sp = 0, saved_fp = 0;
   if (ucontext != NULL) {
     saved_pc = frame.pc();
     saved_sp = frame.sp();
@@ -780,9 +782,13 @@ int HotspotSupport::getJavaTraceAsync(void *ucontext, ASGCT_CallFrame *frames,
       }
       return 1;
     }
-  } else {
-    return 0;
   }
+  // Ported from upstream async-profiler (Profiler::getJavaTraceAsync in
+  // src/profiler.cpp): when ucontext is NULL — as it is for malloc hooks,
+  // which run outside any signal context — skip the PC-dependent pre-checks
+  // and fall through to ASGCT. ASGCT then resolves the top Java frame from
+  // JavaThread::last_Java_sp / last_Java_pc, which the JVM populates on every
+  // Java → native transition.
 
   JVMJavaThreadState state = vm_thread->state();
   bool in_java = (state == _thread_in_Java || state == _thread_in_Java_trans);
@@ -955,7 +961,7 @@ int HotspotSupport::walkJavaStack(StackWalkRequest& request) {
   int java_frames = 0;
   if (features.mixed) {
     java_frames = walkVM(ucontext, frames, max_depth, features, eventTypeFromBCI(request.event_type), lock_index, truncated);
-  } else if (request.event_type == BCI_CPU || request.event_type == BCI_WALL) {
+  } else if (request.event_type == BCI_CPU || request.event_type == BCI_WALL || request.event_type == BCI_NATIVE_MALLOC) {
     if (cstack >= CSTACK_VM) {
         java_frames = walkVM(ucontext, frames, max_depth, features, eventTypeFromBCI(request.event_type), lock_index, truncated);
     } else {

ddprof-lib/src/main/cpp/jfrMetadata.cpp

@@ -1,5 +1,6 @@
 /*
  * Copyright 2020 Andrei Pangin
+ * Copyright 2026, Datadog, Inc.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -298,6 +299,18 @@ void JfrMetadata::initialize(
               << field("name", T_STRING, "Name")
               << field("count", T_LONG, "Count"))
 
+          << (type("profiler.Malloc", T_MALLOC, "malloc")
+                  << category("Java Virtual Machine", "Native Memory")
+                  << field("startTime", T_LONG, "Start Time", F_TIME_TICKS)
+                  << field("eventThread", T_THREAD, "Event Thread", F_CPOOL)
+                  << field("stackTrace", T_STACK_TRACE, "Stack Trace", F_CPOOL)
+                  << field("address", T_LONG, "Address", F_ADDRESS)
+                  << field("size", T_LONG, "Size", F_BYTES)
+                  << field("weight", T_FLOAT, "Sample weight")
+                  << field("spanId", T_LONG, "Span ID")
+                  << field("localRootSpanId", T_LONG, "Local Root Span ID") ||
+              contextAttributes)
+
           << (type("jdk.OSInformation", T_OS_INFORMATION, "OS Information")
               << category("Operating System")
               << field("startTime", T_LONG, "Start Time", F_TIME_TICKS)

ddprof-lib/src/main/cpp/jfrMetadata.h

@@ -1,5 +1,6 @@
 /*
  * Copyright 2020 Andrei Pangin
+ * Copyright 2026, Datadog, Inc.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -78,6 +79,7 @@ enum JfrType {
   T_DATADOG_CLASSREF_CACHE = 124,
   T_DATADOG_COUNTER = 125,
   T_UNWIND_FAILURE = 126,
+  T_MALLOC = 127,
   T_ANNOTATION = 200,
   T_LABEL = 201,
   T_CATEGORY = 202,

ddprof-lib/src/main/cpp/jvmSupport.cpp

@@ -20,7 +20,9 @@ int JVMSupport::walkJavaStack(StackWalkRequest& request) {
     if (VM::isHotspot()) {
         return HotspotSupport::walkJavaStack(request);
     } else if (VM::isOpenJ9() || VM::isZing()) {
-        assert(request.event_type == BCI_CPU || request.event_type == BCI_WALL);
+        assert(request.event_type == BCI_CPU ||
+               request.event_type == BCI_WALL ||
+               request.event_type == BCI_NATIVE_MALLOC);
         return asyncGetCallTrace(request.frames, request.max_depth, request.ucontext);
     }
     assert(false && "Unsupported JVM");