Decouple LeakingCacheScenario from real allocation-sampling timing

Same debug-only seeded-representative short-circuit already used by
ReferenceChainTrackingTest, ported to the external-process scenario:
propagates ddprof_test.config to the child JVM so it can bypass
LivenessTracker's probabilistic slope detection instead of depending
on it to notice CachedPayload within the fixed round/timeout budget.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Author: jbachorik

ddprof-test/src/test/java/com/datadoghq/profiler/referencechains/ExternalProcessReferenceChainTest.java

@@ -12,6 +12,7 @@
 import java.nio.file.Files;
 import java.nio.file.Path;
 import java.util.Collections;
+import java.util.List;
 import java.util.concurrent.atomic.AtomicReference;
 
 import static org.junit.jupiter.api.Assertions.assertEquals;
@@ -83,8 +84,16 @@ void shouldReconstructReferrerChainInSeparateProcess() throws Exception {
       // commands) contract with a 3rd argument every other mode would have to ignore).
       String packedCommand = startCommand + "|||" + scratchDumpPath.toAbsolutePath();
 
+      // Propagates this JVM's own ddprof_test.config (set by ProfilerTestPlugin.kt on the
+      // ddprof-test Test task itself, not inherited by a ProcessBuilder-launched child on its
+      // own) so LeakingCacheScenario can use the same debug-only seeded-representative fallback
+      // ReferenceChainTrackingTest already relies on instead of depending purely on real
+      // allocation-sampling timing.
+      List<String> jvmArgs = Collections.singletonList(
+          "-Dddprof_test.config=" + System.getProperty("ddprof_test.config"));
+
       AtomicReference<String> resultLine = new AtomicReference<>();
-      LaunchResult result = launch("leak-cache", Collections.emptyList(), packedCommand,
+      LaunchResult result = launch("leak-cache", jvmArgs, packedCommand,
           Collections.emptyMap(),
           // Generous: a whole separate JVM's startup/classloading cost, on top of the same
           // up-to-25-round population-growth loop plus grace period that takes ~20s in-process

ddprof-test/src/test/java/com/datadoghq/profiler/referencechains/LeakingCacheScenario.java

@@ -52,6 +52,13 @@
 public final class LeakingCacheScenario {
   private LeakingCacheScenario() {}
 
+  // Arbitrary, scenario-chosen klass id - this process's own LivenessTracker population table
+  // treats it as an opaque key (see KlassPopulationEntry's own comment) and this process never
+  // runs any other reference-chains scenario, so no collision risk with e.g.
+  // ReferenceChainTrackingTest's/ReferenceChainTestSeamsTest's own klass ids in their own,
+  // separate JVMs.
+  private static final int CACHED_PAYLOAD_TEST_KLASS_ID = 987301;
+
   /** Printed to stdout, followed by the matched leaf class's name, on success. */
   public static final String FOUND_MARKER = "[chain-found] ";
 
@@ -89,6 +96,8 @@ public static void run(JavaProfiler profiler, String startCommand, Path scratchD
     }
     System.out.println("[debug] profiler.execute() returned");
 
+    boolean debugBuild = "debug".equals(System.getProperty("ddprof_test.config"));
+    boolean seededTestKlassTrend = false;
     ReferenceChainAssertions.ChainMatch match = null;
     int totalRounds = 25;
     for (int round = 1; round <= totalRounds && match == null; round++) {
@@ -106,6 +115,26 @@ public static void run(JavaProfiler profiler, String startCommand, Path scratchD
       profiler.dump(scratchDumpPath);
       match = findMatch(scratchDumpPath);
 
+      if (match == null && debugBuild) {
+        // Same debug-only, seeded-representative short-circuit as ReferenceChainTrackingTest's
+        // own shouldReconstructReferrerChainThroughUnboundedCacheLeak() (see that method's own
+        // comment): decouples this scenario's assertion from whether the real, probabilistic
+        // allocation-sampling-driven slope detection happens to notice CachedPayload's own
+        // population trend within this scenario's fixed round/timeout budget. "seed-0" (from
+        // seedInitialBatch()) is reachable via cache for the scenario's entire lifetime, so it
+        // is a safe, always-valid representative regardless of which round this fires on.
+        if (!seededTestKlassTrend) {
+          for (int epoch = 1; epoch <= 10; epoch++) {
+            JavaProfiler.seedKlassPopulationSample0(CACHED_PAYLOAD_TEST_KLASS_ID, epoch * 10, epoch);
+          }
+          seededTestKlassTrend = true;
+        }
+        JavaProfiler.setKlassPopulationRepresentativeForTest0(CACHED_PAYLOAD_TEST_KLASS_ID, cache.get("seed-0"));
+        JavaProfiler.pollReferenceChainTargets0();
+        profiler.dump(scratchDumpPath);
+        match = findMatch(scratchDumpPath);
+      }
+
       if (match == null) {
         Thread.sleep(300);
         profiler.dump(scratchDumpPath);