test(tracing): SpanStack active reference corruption

[morrisonlevi]

Description

This PR is stacked on #3851 so that needs to merge first.

This test demonstrates that the active span can be corrupted by turning it into a reference. This may be the cause of a customer crash identified by a crash report.

Reviewer checklist

• Test coverage seems ok.
• Appropriate labels assigned.

[datadog-official]

✨ Fix all issues with BitsAI or with Cursor

⚠️ Warnings

🧪 2 Tests failed

tmp/build_extension/tests/ext/span_stack/span_stack_active_reference.phpt (SpanStack active references do not corrupt child span opening) from php.tmp.build_extension.tests.ext.span_stack     (Fix with Cursor)

001- bool(true)
002- string(14) "parent-service"
003- ok
001+ =================================================================
002+ ==4784==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x503000099efc at pc 0xfabcf33ab064 bp 0xffffe27723b0 sp 0xffffe27723a8
003+ READ of size 4 at 0x503000099efc thread T0
004+     #0 0xfabcf33ab060 in ddtrace_open_span tmp/build_extension/ext/span.c:300:9
005+     #1 0xfabcf32b125c in dd_start_span tmp/build_extension/ext/ddtrace.c:3325:16
006+     #2 0xfabcf32b100c in zif_DDTrace_start_span tmp/build_extension/ext/ddtrace.c:3343:5
007+     #3 0xbb249f94caf4 in ZEND_DO_ICALL_SPEC_OBSERVER_HANDLER /usr/local/src/php/Zend/zend_vm_execute.h:1400:2
...

tmp/build_extension/tests/ext/span_stack/span_stack_active_reference.phpt (SpanStack active references do not corrupt child span opening) from PHP.tmp.build_extension.tests.ext.span_stack     (Fix with Cursor)

001+ =================================================================
002+ ==4704==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x50300008e6dc at pc 0xf41714da1df8 bp 0xffffed38c850 sp 0xffffed38c848
003+ READ of size 4 at 0x50300008e6dc thread T0
001- bool(true)
002- string(14) "parent-service"
003- ok
004+     #0 0xf41714da1df4 in ddtrace_open_span tmp/build_extension/ext/span.c:300:9
005+     #1 0xf41714ca6d74 in dd_start_span tmp/build_extension/ext/ddtrace.c:3325:16
006+     #2 0xf41714ca6b24 in zif_DDTrace_start_span tmp/build_extension/ext/ddtrace.c:3343:5
007+     #3 0xf41714c0a940 in zai_interceptor_execute_internal_impl tmp/build_extension/zend_abstract_interface/interceptor/php8/interceptor.c:904:13
...

ℹ️ Info

No other issues found (see more)

❄️ No new flaky tests detected

🎯 Code Coverage (details)
• Patch Coverage: 100.00%
• Overall Coverage: 60.64% (-0.05%)

Useful? React with 👍 / 👎

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: ae8cb30 | Docs | Datadog PR Page | Give us feedback!}

[pr-commenter]

Benchmarks [ tracer ]

Benchmark execution time: 2026-05-01 17:05:10

Comparing candidate commit ae8cb30 in PR branch levi/spanstack-active-reference with baseline commit a51ed01 in branch levi/parent-refcount.

Found 0 performance improvements and 4 performance regressions! Performance is the same for 190 metrics, 0 unstable metrics.

scenario:SamplingRuleMatchingBench/benchRegexMatching1

• 🟥 execution_time [+50.086ns; +134.114ns] or [+3.484%; +9.330%]

scenario:SamplingRuleMatchingBench/benchRegexMatching2

• 🟥 execution_time [+66.091ns; +135.309ns] or [+4.612%; +9.442%]

scenario:SamplingRuleMatchingBench/benchRegexMatching3

• 🟥 execution_time [+80.106ns; +165.694ns] or [+5.531%; +11.440%]

scenario:SamplingRuleMatchingBench/benchRegexMatching4

• 🟥 execution_time [+44.296ns; +142.104ns] or [+3.035%; +9.736%]