refactor(vtable_target): defer receiver resolution to dump time via SafeAccess - #527

What does this PR do?:

Redesigns vtable_target receiver-class resolution. Instead of eagerly pre-registering every loaded class into _class_map at profiler start and on ClassPrepare, the signal handler now captures the receiver's raw VMSymbol* in a new BCI_VTABLE_RECEIVER frame, and the Symbol is read at dump time via SafeAccess — crash-safe against concurrent class unloading.

Changes:

• New BCI BCI_VTABLE_RECEIVER = -21 (vmEntry.h): method_id is a VMSymbol*, not a jmethodID. Doc comment cross-referenced from the signal-handler write site (hotspotSupport.cpp) and the dump-time read site (flightRecorder.cpp).
• New SafeAccess::safeCopy primitive (safeAccess.{h,cpp}): bulk byte copy through the safefetch trampoline, with an alignment-aware strategy that keeps every 4-byte load inside a single page so over-reads past src + len never spuriously fault. Replaces a memcpy that would have crashed if the Symbol's page was unmapped between the readability check and the copy.
• Lookup::resolveVTableReceiver + resolveVTableReceiverCached (flightRecorder.{h,cpp}): SafeAccess-protected length + body read, printable-byte filter, synthetic-accessor/LambdaForm normalisation. Per-dump VMSymbol* → class_id cache so distinct Symbol addresses for the same class collapse to one MethodInfo.
• New MethodMap::makeVTableReceiverKey(u32) (flightRecorder.h): adds a fourth key namespace (11 high-bit pattern, VTABLE_RECEIVER_MARK) so BCI_VTABLE_RECEIVER frames key by resolved class_id instead of by VMSymbol* address.
• Deletions: Profiler::preregisterLoadedClasses (~100 lines + 3 call sites + decl), the ClassPrepare JVMTI hook block for vtable_target in vmEntry.cpp, classMapTrySharedGuard(), the shared-lock try-dance in walkVM. Conditional end-of-dump _class_map.clear() is restored to unconditional (was if (!_features.vtable_target || ...) for the previous design's persistence requirement).
• Counter VTABLE_RECEIVER_RESOLVE_FAILED records resolution failures (Symbol page unmapped, length out of range, printable filter rejects).
• Test renamed: VtableTargetPreregistrationTest → VtableReceiverFrameTest; assertion message updated to describe the SafeAccess path.

Motivation:

The prior preregistration design forced unbounded growth of _class_map — every loaded class ever seen by GetLoadedClasses or ClassPrepare was inserted permanently, with no removal path (clearing the map would require a JVMTI-safepoint re-enumeration on every dump). Long-running JVMs with synthetic-class generators (LambdaForm, reflection accessors, Groovy/Kotlin invokedynamic, CGLIB) accumulated millions of entries indefinitely.

The new design bounds _class_map to "classes actually sampled this chunk" (cleared unconditionally at end-of-dump), removes the eager JVMTI enumeration and the ClassPrepare insert path, eliminates the shared/exclusive lock dance in the signal handler, and is robust to concurrent class unloading via SafeAccess-based dump-time reads.

Additional Notes:

• VMSymbol lifetime / class unload between sample and dump. If the receiver class unloads after sample but before dump, three outcomes: (1) page unmapped → safeFetch32 returns sentinel → frame becomes <unresolved_vtable_receiver>, VTABLE_RECEIVER_RESOLVE_FAILED ticks. (2) memory reused for unrelated data → length / printable filter rejects → same as (1). (3) memory reused for another Symbol whose bytes pass the printable filter → wrong class name attached to the trace (silent miscorrelation). Cases (1)+(2) dominate; (3) is rare per-Symbol but non-zero in aggregate on class-unload-heavy workloads. Tracked as follow-up in PROF-14780 — class-unload breakpoint hook + Symbol-bytes shadow cache.
• CallTrace dedup across Symbol address differences. CallTraceHashTable::calcHash mixes the raw bytes of every frame (including method_id). Two samples of the same logical class whose VMSymbol* address differs (class unload + reload within a chunk) produce distinct trace ids. Accepted: normalising at sample time would require an in-signal-handler Symbol read, which the redesign explicitly avoids. The dump-time MethodMap key is class_id-based, so the synthetic <vtable_receiver> MethodInfo does collapse across distinct Symbol addresses; only CallTrace dedup is affected.
• SafeAccess::safeCopy correctness. Pages on supported platforms (x86_64 4 KiB; aarch64 Linux 4 KiB; aarch64 macOS 16 KiB) divide evenly by 4. A 4-byte-aligned 4-byte load therefore never crosses a page boundary, so over-reads beyond src + len are guaranteed safe as long as the start address itself is in a mapped page. For misaligned src, the front fixup fetches at the previous aligned address (same 4-byte word, same page) and discards leading k ∈ {1,2,3} bytes. Buffer is 4096 bytes (stack-allocated); names longer than that are recorded as resolve failures via the sentinel.
• Empty _class_map is fine across chunks. JFR class IDs are per-chunk; clearing at end-of-dump is the correct steady state.
• Adversary review surfaced and addressed: dead BCI_ALLOC branch in resolveMethod deleted (it was the previous receiver path; no other producer remains), normalisation logic consolidated into resolveVTableReceiver (no more duplicated LambdaForm$MH table). Help text in arguments.cpp updated to describe the new design.

How to test the change?:

• Existing C++ gtest: SafeFetchTest — 19/19 passes (9 pre-existing + 7 new safeCopy_* cases covering happy path, zero-length, unmapped source, PROT_NONE source, tail near unmapped boundary now succeeds (regression for the previous design), requested-range-crosses-unmapped still legitimately fails, unaligned source for all k ∈ {1,2,3}, real data equal to a single sentinel).
• Existing Java test: VtableReceiverFrameTest (renamed) compiles cleanly.
• Release build: :ddprof-lib:assembleRelease succeeds on darwin-aarch64.
• CI matrix (delegated to project CI): full gtest + Java test runs across Linux x86_64 / aarch64, musl, OpenJDK 8 / 11 / 17 / 21 / 25 — see CI.

For Datadog employees:

• If this PR touches code that signs or publishes builds or packages, or handles credentials of any kind, I've requested a review from @DataDog/security-design-and-guidance.

• This PR doesn't touch any of that.

• JIRA: PROF-14618

• Follow-up: PROF-14780 — class-unload breakpoint hook for mid-chunk unload preservation