Close jar entry streams during Symbol Database scan

[tylfin]

What Does This Do

Closes the JAR entry InputStream in SymbolAggregator.parseJarEntry(), and closes the Files.walk() stream in the directory scan path.

Motivation

Symbol Database scans every .class entry of every loaded JAR. The entry stream was never closed, so JarFile could not return its Inflater to the internal cache and allocated a new native zlib context per class file instead. On a large JAR this bursts hundreds of MB of off-heap memory that is invisible to heap metrics and unbounded by MaxDirectMemorySize, which is enough to OOMKill a container with a tight memory limit. parseFileEntry() on the directory path already closed its stream; the JAR path was the outlier.

Reported with a reproduction in #12123.

Additional Notes

Added a regression test that asserts every entry stream handed out during a scan is closed.

Jira ticket: DYNIS-66

[datadog-datadog-prod-us1]

More details

The resource-lifetime changes are behavior-preserving for normal JAR and directory scans: entry streams and the directory walk are now closed without changing filtering or parsing order. No diff-only regression was identified; focused execution was blocked because the wrapper could not download Gradle and the available JDKs do not include the required Java 25 toolchain.

Was this helpful? React 👍 or 👎

_{Open Bits AI session}

_{🤖 Datadog Autotest · Commit 30aeef0 · What is Autotest? · @DataDog review to ask questions · Any feedback? Reach out in #autotest}

[datadog-datadog-prod-us1]

🎯 Code Coverage (details)
• Patch Coverage: 100.00%
• Overall Coverage: 74.37% (+16.47%)

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: 6c397b1 | Docs | Datadog PR Page | Give us feedback!}

[pr-commenter]

Debugger benchmarks

Parameters

	Baseline	Candidate
baseline_or_candidate	baseline	candidate
ci_job_date	1785877357	1785877706
end_time	2026-08-04T21:04:08	2026-08-04T21:09:56
git_branch	master	tyler.finethy/DYNIS-66
git_commit_sha	497ce7b	6c397b1
start_time	2026-08-04T21:02:38	2026-08-04T21:08:27

See matching parameters

	Baseline	Candidate
ci_job_id	1923039203	1923039203
ci_pipeline_id	129004281	129004281
cpu_model	Intel(R) Xeon(R) Platinum 8175M CPU @ 2.50GHz	Intel(R) Xeon(R) Platinum 8175M CPU @ 2.50GHz
git_commit_date	1785876734	1785876734

Summary

Found 1 performance improvements and 0 performance regressions! Performance is the same for 8 metrics, 6 unstable metrics.

scenario	Δ mean agg_http_req_duration_min	Δ mean agg_http_req_duration_p50	Δ mean agg_http_req_duration_p75	Δ mean agg_http_req_duration_p99	Δ mean throughput
scenario:noprobe	unstable [-69.641µs; +2.855µs] or [-20.461%; +0.839%]	unstable [-88.436µs; +7.480µs] or [-22.397%; +1.894%]	unstable [-105.067µs; +16.076µs] or [-25.270%; +3.867%]	unstable [-507.463µs; +187.612µs] or [-35.584%; +13.156%]	better [+21.822op/s; +196.381op/s] or [+1.033%; +9.293%]

See unchanged results

scenario	Δ mean agg_http_req_duration_min	Δ mean agg_http_req_duration_p50	Δ mean agg_http_req_duration_p75	Δ mean agg_http_req_duration_p99	Δ mean throughput
scenario:basic	same	same	same	unstable [-126.476µs; +134.368µs] or [-11.215%; +11.915%]	unstable [-99.054op/s; +209.796op/s] or [-4.259%; +9.021%]
scenario:loop	same	unsure [+6.025µs; +22.209µs] or [+0.067%; +0.247%]	unsure [+4.907µs; +19.648µs] or [+0.053%; +0.214%]	same	same

Request duration reports for reports

gantt
    title reports - request duration [CI 0.99] : candidate=None, baseline=None
    dateFormat X
    axisFormat %s
section baseline
noprobe (394.855 µs) : 337, 452
.   : milestone, 395,
basic (317.42 µs) : 308, 327
.   : milestone, 317,
loop (9.002 ms) : 8994, 9011
.   : milestone, 9002,
section candidate
noprobe (354.377 µs) : 325, 384
.   : milestone, 354,
basic (313.778 µs) : 305, 322
.   : milestone, 314,
loop (9.017 ms) : 9010, 9023
.   : milestone, 9017,

Loading

• baseline results

Scenario	Request median duration [CI 0.99]
noprobe	394.855 µs [337.433 µs, 452.276 µs]
basic	317.42 µs [308.002 µs, 326.839 µs]
loop	9.002 ms [8.994 ms, 9.011 ms]

• candidate results

Scenario	Request median duration [CI 0.99]
noprobe	354.377 µs [325.232 µs, 383.522 µs]
basic	313.778 µs [305.32 µs, 322.235 µs]
loop	9.017 ms [9.01 ms, 9.023 ms]

[dd-octo-sts]

🟢 Java Benchmark SLOs — All performance SLOs passed

Suite	Status
Startup	🟢 pass

SLO thresholds are defined here based on automatically generated metrics. A warning is raised when results are within 5% of the threshold.

PR vs. master results

Scenario	Candidate	master	Δ (95% CI of mean)
startup:insecure-bank:iast:Agent	14.05 s	13.99 s	[-0.4%; +1.2%] (no difference)
startup:insecure-bank:tracing:Agent	12.95 s	13.00 s	[-1.0%; +0.2%] (no difference)
startup:petclinic:appsec:Agent	16.92 s	16.12 s	[+0.6%; +9.2%] (maybe worse)
startup:petclinic:iast:Agent	16.86 s	16.95 s	[-1.4%; +0.3%] (no difference)
startup:petclinic:profiling:Agent	16.71 s	16.29 s	[-1.8%; +7.0%] (no difference)
startup:petclinic:sca:Agent	16.65 s	16.40 s	[+0.6%; +2.5%] (maybe worse)
startup:petclinic:tracing:Agent	16.04 s	16.02 s	[-0.8%; +1.0%] (no difference)

Commit: 6c397b13 · CI Pipeline · Benchmarking Platform UI

---

Load and DaCapo benchmarks can be triggered manually in the GitLab pipeline. Results will appear in the Benchmarking Platform UI after completion.

[dd-octo-sts]

/merge

[gh-worker-devflow-routing-ef8351]

View all feedbacks in Devflow UI.

2026-08-05 08:37:41 UTC ℹ️ Start processing command /merge

---

2026-08-05 08:37:46 UTC ℹ️ MergeQueue: pull request added to the queue

The expected merge time in master is approximately 1h (p90).

---

2026-08-05 09:31:13 UTC ℹ️ MergeQueue: This merge request was merged