fix: valgrind on ARM

[not-matthias]

FYI: fde493a is 100% Claude generated and only used for debugging

[codspeed-hq]

Merging this PR will not alter performance

✅ 30 untouched benchmarks
⏩ 100 skipped benchmarks¹

---

_{Comparing cod-2985-arm-flamegraph-failures (0a322a7) with master (ce9d871)}

Footnotes

1. 100 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩

[greptile-apps]

Greptile Summary

This PR fixes Callgrind's call-graph accuracy on AArch64 through a set of coordinated changes across VEX, coregrind, and callgrind, and adds a new callgrind-utils Rust crate for parsing, rendering, and testing Callgrind output.

• VEX fix (root cause): Plain B instructions were emitted as Ijk_Call instead of Ijk_Boring; only BL/BLR write the link register and are real calls. This single-line fix eliminates phantom recursive clones and corrupted call graphs on arm64.
• ARM64 shadow stack (callstack.c + fn.c): push_call_stack now records the live guest X30 register as the return address (instead of statically computing "PC after the call instruction"), and _dl_tlsdesc_* TLS-descriptor trampolines are marked as PLT-skip-equivalent so they never surface as named graph nodes.
• Frame-pointer fallback (m_stacktrace.c): Adds AAPCS64 X29-chain unwinding when CFI is absent (JIT pages, hand-written asm), mirroring the existing amd64 %rbp path; fixes truncated seed stacks at CALLGRIND_START_INSTRUMENTATION on arm64.
• NIX_DEBUG_INFO_DIRS (readelf.c): Resolves separate debug files from Nix store paths before the FHS /usr/lib/debug fallback.

Confidence Score: 4/5

The core arm64 fixes are well-reasoned and backed by targeted snapshot tests; the new Rust crate is comprehensive. The two style-only findings are both in new code and carry no correctness risk.

All findings are style-level. The VEX B/BL reclassification is clearly correct, the X30 return-address tracking is carefully gated on the right conditions, and the frame-pointer fallback mirrors the proven amd64 path with appropriate guards. The only open question is a missing inline explanation for the next_pc == 1 terminator, which the changelog documents but the code does not. Nothing here is likely to cause incorrect behavior at runtime.

coregrind/m_stacktrace.c (unexplained 1 == next_pc guard), callgrind-utils/src/flamegraph.rs and callgrind-utils/src/parser/mod.rs (multi-clause boolean style)

Important Files Changed

Filename	Overview
VEX/priv/guest_arm64_toIR.c	Corrects B vs BL classification: plain B now emits Ijk_Boring instead of Ijk_Call, fixing phantom recursive call graph edges on arm64. Fix is minimal, correct, and well-commented.
callgrind/callstack.c	ARM64-gated change reads the live guest X30 register as the recorded return address for real calls, replacing the static 'PC after call instruction' calculation that breaks across skipped-code splices. Logic is sound; the conditional on skip
callgrind/fn.c	ARM64-gated: marks dl_tlsdesc* resolver trampolines as PLT-skip-equivalent, preventing them from leaking as named nodes when called from obj-skipped code.
coregrind/m_stacktrace.c	Adds AAPCS64 frame-pointer chain fallback (X29/{saved-X29,saved-X30}) when CFI lookup fails, mirroring the amd64 %rbp path. Guards are well-chosen; the 1 == next_pc terminator lacks an inline explanation.
coregrind/m_debuginfo/readelf.c	Adds NIX_DEBUG_INFO_DIRS colon-separated search before /usr/lib/debug fallback. The new try_buildid_dir helper correctly handles empty dirlen, edge-case colons, and memory ownership.
callgrind-utils/src/parser/mod.rs	New Callgrind .out parser handling name compression, three independent ID spaces, inline fi/fe transitions, cfl/cfi alias, part/thread boundaries, and bare-cfn discard. One multi-clause boolean condition should be named per team style rule.
callgrind-utils/src/flamegraph.rs	DFS-based folded-stack generator with cycle detection via on_path guard and proportional budget pruning. Logic is sound; one multi-clause guard should be extracted to a named variable per team style rule.
callgrind-utils/src/model.rs	Clean data model with deduplication, aggregation of call_count and inclusive_cost across duplicate edges, and binary-search node lookup. from_parts is well-structured.
callgrind-utils/build.rs	Build script drives configure+make for in-repo Callgrind, tracking only top-level callgrind/*.c/h to avoid re-triggering on test output files. CAPSTONE_DIR assertion gives a clear error on unconfigured trees.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A["AArch64 BL/B instruction\n(VEX guest_arm64_toIR.c)"] -->|"bLink=1 → Ijk_Call\nbLink=0 → Ijk_Boring"| B["Callgrind dispatch\n(setup_bbcc)"]
    B -->|"jk_Call + real call"| C["push_call_stack\nRecord guest X30 as ret_addr\n(callstack.c ARM64 path)"]
    B -->|"jk_Call + splice or skip"| D["push_call_stack\nRecord ret_addr = 0\n(emulated/spliced frame)"]
    C --> E["Shadow call stack\n(ret_addr = architectural RA)"]
    D --> E
    E -->|"RET detected"| F["Pop matching frames\n(same-SP run, ret_addr match)"]
    G["CFI lookup\n(VG_use_CF_info)"] -->|"succeeds"| H["Emit IP with -1 bias"]
    G -->|"fails (JIT/asm)"| I["AAPCS64 FP chain fallback\nX29 → {saved X29, saved X30}\n(m_stacktrace.c)"]
    I --> H
    H --> J["Stack seed at\nCALLGRIND_START_INSTRUMENTATION"]
    J -->|"IP+1 → exact return targets"| E
    K["_dl_tlsdesc_* resolver\n(fn.c)"] -->|"fn->skip = skip_plt"| L["Transparent trampoline\n(never a named node)"]

Loading

%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%%
flowchart TD
    A["AArch64 BL/B instruction\n(VEX guest_arm64_toIR.c)"] -->|"bLink=1 → Ijk_Call\nbLink=0 → Ijk_Boring"| B["Callgrind dispatch\n(setup_bbcc)"]
    B -->|"jk_Call + real call"| C["push_call_stack\nRecord guest X30 as ret_addr\n(callstack.c ARM64 path)"]
    B -->|"jk_Call + splice or skip"| D["push_call_stack\nRecord ret_addr = 0\n(emulated/spliced frame)"]
    C --> E["Shadow call stack\n(ret_addr = architectural RA)"]
    D --> E
    E -->|"RET detected"| F["Pop matching frames\n(same-SP run, ret_addr match)"]
    G["CFI lookup\n(VG_use_CF_info)"] -->|"succeeds"| H["Emit IP with -1 bias"]
    G -->|"fails (JIT/asm)"| I["AAPCS64 FP chain fallback\nX29 → {saved X29, saved X30}\n(m_stacktrace.c)"]
    I --> H
    H --> J["Stack seed at\nCALLGRIND_START_INSTRUMENTATION"]
    J -->|"IP+1 → exact return targets"| E
    K["_dl_tlsdesc_* resolver\n(fn.c)"] -->|"fn->skip = skip_plt"| L["Transparent trampoline\n(never a named node)"]

Loading

_{Reviews (1): Last reviewed commit: "feat(callgrind-utils): add perf_map symb..." | Re-trigger Greptile}