[Debugger] Prevent expression member access from invoking getters#8878
Merged
Conversation
P403n1x87
approved these changes
Jul 8, 2026
dudikeleti
enabled auto-merge (squash)
July 8, 2026 14:47
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 7afa2d1fee
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
dudikeleti
disabled auto-merge
July 8, 2026 15:09
Execution-Time Benchmarks Report ⏱️Execution-time results for samples comparing This PR (8878) and master. ✅ No regressions detected - check the details below Full Metrics ComparisonFakeDbCommand
HttpMessageHandler
Comparison explanationExecution-time benchmarks measure the whole time it takes to execute a program, and are intended to measure the one-off costs. Cases where the execution time results for the PR are worse than latest master results are highlighted in **red**. The following thresholds were used for comparing the execution times:
Note that these results are based on a single point-in-time result for each branch. For full results, see the dashboard. Graphs show the p99 interval based on the mean and StdDev of the test run, as well as the mean value of the run (shown as a diamond below the graph). Duration chartsFakeDbCommand (.NET Framework 4.8)gantt
title Execution time (ms) FakeDbCommand (.NET Framework 4.8)
dateFormat x
axisFormat %Q
todayMarker off
section Baseline
This PR (8878) - mean (72ms) : 69, 76
master - mean (72ms) : 67, 76
section Bailout
This PR (8878) - mean (75ms) : 72, 77
master - mean (74ms) : 72, 75
section CallTarget+Inlining+NGEN
This PR (8878) - mean (1,079ms) : 1037, 1121
master - mean (1,086ms) : 1023, 1149
FakeDbCommand (.NET Core 3.1)gantt
title Execution time (ms) FakeDbCommand (.NET Core 3.1)
dateFormat x
axisFormat %Q
todayMarker off
section Baseline
This PR (8878) - mean (113ms) : 106, 119
master - mean (111ms) : 105, 118
section Bailout
This PR (8878) - mean (110ms) : 108, 112
master - mean (110ms) : 108, 112
section CallTarget+Inlining+NGEN
This PR (8878) - mean (782ms) : 757, 807
master - mean (778ms) : 753, 804
FakeDbCommand (.NET 6)gantt
title Execution time (ms) FakeDbCommand (.NET 6)
dateFormat x
axisFormat %Q
todayMarker off
section Baseline
This PR (8878) - mean (97ms) : 93, 101
master - mean (101ms) : 95, 106
section Bailout
This PR (8878) - mean (97ms) : 95, 99
master - mean (99ms) : 95, 103
section CallTarget+Inlining+NGEN
This PR (8878) - mean (938ms) : 901, 974
master - mean (943ms) : 902, 984
FakeDbCommand (.NET 8)gantt
title Execution time (ms) FakeDbCommand (.NET 8)
dateFormat x
axisFormat %Q
todayMarker off
section Baseline
This PR (8878) - mean (98ms) : 92, 103
master - mean (95ms) : 92, 98
section Bailout
This PR (8878) - mean (100ms) : 95, 104
master - mean (99ms) : 94, 105
section CallTarget+Inlining+NGEN
This PR (8878) - mean (815ms) : 773, 856
master - mean (810ms) : 777, 844
HttpMessageHandler (.NET Framework 4.8)gantt
title Execution time (ms) HttpMessageHandler (.NET Framework 4.8)
dateFormat x
axisFormat %Q
todayMarker off
section Baseline
This PR (8878) - mean (202ms) : 197, 207
master - mean (199ms) : 194, 204
section Bailout
This PR (8878) - mean (205ms) : 201, 209
master - mean (202ms) : 197, 207
section CallTarget+Inlining+NGEN
This PR (8878) - mean (1,206ms) : 1171, 1242
master - mean (1,198ms) : 1155, 1241
HttpMessageHandler (.NET Core 3.1)gantt
title Execution time (ms) HttpMessageHandler (.NET Core 3.1)
dateFormat x
axisFormat %Q
todayMarker off
section Baseline
This PR (8878) - mean (287ms) : 283, 292
master - mean (289ms) : 283, 296
section Bailout
This PR (8878) - mean (290ms) : 283, 297
master - mean (290ms) : 286, 295
section CallTarget+Inlining+NGEN
This PR (8878) - mean (970ms) : 942, 997
master - mean (976ms) : 956, 996
HttpMessageHandler (.NET 6)gantt
title Execution time (ms) HttpMessageHandler (.NET 6)
dateFormat x
axisFormat %Q
todayMarker off
section Baseline
This PR (8878) - mean (282ms) : 276, 288
master - mean (283ms) : 278, 289
section Bailout
This PR (8878) - mean (283ms) : 279, 288
master - mean (289ms) : 263, 316
section CallTarget+Inlining+NGEN
This PR (8878) - mean (1,169ms) : 1135, 1204
master - mean (1,165ms) : 1134, 1197
HttpMessageHandler (.NET 8)gantt
title Execution time (ms) HttpMessageHandler (.NET 8)
dateFormat x
axisFormat %Q
todayMarker off
section Baseline
This PR (8878) - mean (281ms) : 274, 289
master - mean (279ms) : 274, 284
section Bailout
This PR (8878) - mean (282ms) : 278, 286
master - mean (280ms) : 275, 286
section CallTarget+Inlining+NGEN
This PR (8878) - mean (1,048ms) : 1008, 1088
master - mean (1,046ms) : 1001, 1091
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
BenchmarksBenchmark execution time: 2026-07-08 17:26:43 Comparing candidate commit 671c4aa in PR branch Found 0 performance improvements and 1 performance regressions! Performance is the same for 71 metrics, 0 unstable metrics, 62 known flaky benchmarks, 64 flaky benchmarks without significant changes.
|
Contributor
There was a problem hiding this comment.
Pull request overview
This PR hardens the Live Debugger probe expression evaluator by ensuring getmember/ref member access does not invoke customer property getters (avoiding side effects), while still allowing safe reads via fields and verified C# auto-property backing fields.
Changes:
- Introduced a fail-closed member resolver that prefers fields and validated compiler-generated auto-property backing fields, and blocks unsafe property getter access (including static getter access that may trigger type initialization).
- Updated collection/dictionary iterator member handling to keep
Key/Valueaccess constrained to expected BCL shapes and preserve dictionary redaction tracking. - Added regression tests and updated approval snapshots to reflect backing-field-based member access and new failure behavior.
Reviewed changes
Copilot reviewed 11 out of 11 changed files in this pull request and generated 7 comments.
Show a summary per file
| File | Description |
|---|---|
| tracer/src/Datadog.Trace/Debugger/Expressions/ProbeExpressionParser.General.cs | Adds safe member resolution logic and replaces prior reflection/LINQ-based member lookup with fail-closed field/backing-field access. |
| tracer/src/Datadog.Trace/Debugger/Expressions/ProbeExpressionParser.Collection.cs | Routes redacted dictionary value member access through the safe resolver and tightens iterator property access. |
| tracer/test/Datadog.Trace.Tests/Debugger/DebuggerExpressionLanguageTests.cs | Adds focused tests covering backing-field access and getter-blocking behavior (including static getter/cctor scenarios). |
| tracer/test/Datadog.Trace.Tests/Debugger/ProbeExpressionsResources/Approvals/DebuggerExpressionLanguageTests.RefGetMemberTwoLevels.verified.txt | Updates snapshot to show nested auto-property backing-field access. |
| tracer/test/Datadog.Trace.Tests/Debugger/ProbeExpressionsResources/Approvals/DebuggerExpressionLanguageTests.RefGetMember.verified.txt | Updates snapshot to show auto-property backing-field access. |
| tracer/test/Datadog.Trace.Tests/Debugger/ProbeExpressionsResources/Approvals/DebuggerExpressionLanguageTests.ParentPrivateMember.verified.txt | Updates snapshot reflecting resolved inherited/private member access behavior. |
| tracer/test/Datadog.Trace.Tests/Debugger/ProbeExpressionsResources/Approvals/DebuggerExpressionLanguageTests.NotEqual.verified.txt | Updates snapshot to show backing-field-based evaluation. |
| tracer/test/Datadog.Trace.Tests/Debugger/ProbeExpressionsResources/Approvals/DebuggerExpressionLanguageTests.NestedFieldAccess.verified.txt | Updates snapshot to show backing-field member access in nested scenarios. |
| tracer/test/Datadog.Trace.Tests/Debugger/ProbeExpressionsResources/Approvals/DebuggerExpressionLanguageTests.IsEmpty.verified.txt | Updates snapshot to show backing-field member access for isEmpty. |
| tracer/test/Datadog.Trace.Tests/Debugger/ProbeExpressionsResources/Approvals/DebuggerExpressionLanguageTests.HasAnyCustomObject.verified.txt | Updates snapshot to show backing-field access within LINQ predicate compilation. |
| tracer/test/Datadog.Trace.Tests/Debugger/ProbeExpressionsResources/Approvals/DebuggerExpressionLanguageTests.AccessNullObject.verified.txt | Updates snapshot to show backing-field access (and associated null-reference evaluation error). |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
jpbempel
approved these changes
Jul 8, 2026
Contributor
Author
|
@codex review |
|
Codex Review: Didn't find any major issues. Keep it up! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
dudikeleti
enabled auto-merge (squash)
July 8, 2026 16:59
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
getmember/refmember access to fields or verified compiler-generated auto-property backing fields, failing closed toUndefinedValuefor unsafe or uncertain property shapes.Key/Valuemembers.Motivation
Probe expressions can run on customer hot paths. Calling arbitrary property getters from
getmembercan trigger side effects such as lazy loading, sync body reads, or customer code execution. This change keeps expression member access side-effect-safe while preserving field and C# auto-property scenarios through direct backing-field reads.Implementation Notes
Type.GetMember(...).FirstOrDefault()/Expression.PropertyOrField()member access with a fail-closed resolver.Count,ToString, and exception dump behavior out of scope.Test Plan
DebuggerExpressionLanguageTestsfor:reffallback blocking