fix: valgrind on ARM

[not-matthias]

FYI: fde493a is 100% Claude generated and only used for debugging

[codspeed-hq]

Merging this PR will degrade performance by 90.69%

❌ 1 regressed benchmark
✅ 29 untouched benchmarks
⏩ 100 skipped benchmarks¹

Warning

Please fix the performance issues or acknowledge them on CodSpeed.

Performance Changes

	Benchmark	BASE	HEAD	Efficiency
❌	test_valgrind[valgrind.codspeed, echo Hello, World!, full-no-inline]	575 ms	6,179.2 ms	-90.69%

Tip

Investigate this regression by commenting @codspeedbot fix this regression on this PR, or directly use the CodSpeed MCP with your agent.

---

_{Comparing cod-2985-arm-flamegraph-failures (aa6643d) with master (ce9d871)}

Footnotes

1. 100 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩

[greptile-apps]

Greptile Summary

This PR fixes ARM64 call-graph correctness in valgrind-codspeed by addressing several interrelated issues: the VEX IR mislabelled every unconditional B instruction as Ijk_Call, corrupting recursive and cyclic call graphs; the frame-pointer fallback unwinder was missing for JIT frames; TLS descriptor resolvers were not being skipped like PLT stubs; and NixOS debug-info directories were not searched. A new callgrind-utils Rust crate is introduced to parse Callgrind output and build call graphs and flamegraphs, with an extensive integration test suite.

• VEX fix (guest_arm64_toIR.c): B (plain branch) now emits Ijk_Boring instead of Ijk_Call, so only BL is treated as a call.
• ARM64 call-stack recording (callstack.c, m_stacktrace.c): guest X30 is read as the architectural return target for real calls; a frame-pointer chain unwinder is added as CFI fallback; the +1 bias fix in reconstruct_call_stack_from_native correctly undoes the symbolization -1 offset.
• callgrind-utils crate (parser, flamegraph, perf_map, redact): full Callgrind output parser with folded-stack flamegraph generation, JIT perf-map symbolisation, and snapshot regression tests for ARM64-specific edge cases.

Confidence Score: 5/5

Safe to merge. All ARM64 logic changes are well-reasoned, thoroughly commented, and covered by integration test snapshots.

The core C changes (VEX IR, callstack, stacktrace, fn, readelf) are correct and well-documented. The new callgrind-utils Rust crate has solid test coverage with snapshot tests for ARM64-specific edge cases. The only issue found is stylistic: eprintln! in test files without a tracing dependency, which does not affect correctness.

No files require special attention. Test files use eprintln! against the team style rule but this is a minor style concern.

Important Files Changed

Filename	Overview
VEX/priv/guest_arm64_toIR.c	Corrects B vs BL classification: plain unconditional branch now emits Ijk_Boring instead of Ijk_Call, fixing corrupted call graphs on ARM64.
callgrind/callstack.c	ARM64-specific return-address recording reads guest X30 directly instead of statically computing the post-call instruction address; reconstruct_call_stack_from_native undoes the -1 symbolization bias with a +1 correction.
coregrind/m_stacktrace.c	Adds AAPCS64 frame-pointer chain fallback (X29/X30) when CFI is missing; guards are aligned with the existing amd64 %rbp fallback pattern.
callgrind/fn.c	ARM64 TLS descriptor resolvers (dl_tlsdesc*) are now treated as skip-on-PLT trampolines, preventing phantom recursion nodes in CPython flamegraphs.
coregrind/m_debuginfo/readelf.c	Adds NIX_DEBUG_INFO_DIRS and extrapath lookup before the FHS /usr/lib/debug fallback for build-id-based debug files; correctly parses colon-separated dir lists.
callgrind-utils/build.rs	Build script that auto-configures and builds the in-repo Callgrind before tests; correctly relies on configure.ac reading CAPSTONE_DIR from the environment when --with-capstone is not passed.
callgrind-utils/src/parser/mod.rs	Full Callgrind output parser handling name-compression ID spaces, cost-line layout, and call edge extraction; rule-compliant multi-clause guard is extracted to has_valid_token_count.
callgrind-utils/src/flamegraph.rs	DFS-based folded-stack flamegraph builder with budget pruning; multi-clause guard correctly extracted to should_prune.
callgrind-utils/tests/rust_callgraph.rs	Integration tests for Rust fixture call graphs; uses eprintln! for tool-not-found skip messages, violating the team's no-eprintln rule.

Sequence Diagram

%%{init: {'theme': 'neutral'}}%%
sequenceDiagram
    participant VEX as "VEX IR (arm64_toIR)"
    participant CG as "Callgrind (callstack/fn)"
    participant ST as "Stacktrace (m_stacktrace)"
    participant ELF as "readelf.c"
    participant CU as "callgrind-utils (Rust)"

    Note over VEX: B gets Ijk_Boring, BL gets Ijk_Call

    VEX->>CG: "jk_Call event (BL only)"
    CG->>ST: "VG_get_StackTrace for seed"
    ST-->>CG: "ips[] with pc-1 bias"
    Note over CG: "+1 correction restores ret_addr"
    Note over CG: "read guest X30 for real calls"

    Note over ST: "CFI unwind attempt"
    ST->>ST: "use_CF_info success: ips[i]=pc-1"
    ST->>ST: "CFI fail: walk AAPCS64 X29 chain"

    Note over CG: "_dl_tlsdesc_* skipped like PLT"

    ELF->>ELF: "NIX_DEBUG_INFO_DIRS then extrapath then /usr/lib/debug"

    CU->>CU: "parse Callgrind .out to CallGraph"
    CU->>CU: "symbolize JIT frames via perf map"
    CU->>CU: "fold stacks to flamegraph SVG"

Loading

%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%%
sequenceDiagram
    participant VEX as "VEX IR (arm64_toIR)"
    participant CG as "Callgrind (callstack/fn)"
    participant ST as "Stacktrace (m_stacktrace)"
    participant ELF as "readelf.c"
    participant CU as "callgrind-utils (Rust)"

    Note over VEX: B gets Ijk_Boring, BL gets Ijk_Call

    VEX->>CG: "jk_Call event (BL only)"
    CG->>ST: "VG_get_StackTrace for seed"
    ST-->>CG: "ips[] with pc-1 bias"
    Note over CG: "+1 correction restores ret_addr"
    Note over CG: "read guest X30 for real calls"

    Note over ST: "CFI unwind attempt"
    ST->>ST: "use_CF_info success: ips[i]=pc-1"
    ST->>ST: "CFI fail: walk AAPCS64 X29 chain"

    Note over CG: "_dl_tlsdesc_* skipped like PLT"

    ELF->>ELF: "NIX_DEBUG_INFO_DIRS then extrapath then /usr/lib/debug"

    CU->>CU: "parse Callgrind .out to CallGraph"
    CU->>CU: "symbolize JIT frames via perf map"
    CU->>CU: "fold stacks to flamegraph SVG"

Loading

_{Reviews (5): Last reviewed commit: "feat(callgrind-utils): add perf_map symb..." | Re-trigger Greptile}

[art049]

Looks basically ok. That's a huge testing infra addition so I hope we can manage and maintain it down the line.

[not-matthias]

@greptile do a final extensive review to ensure that no issues are in the code. ignore the commits for the callgrind-utils test infrastructure.