Address review feedback: extract findJITRegion, add tests, fix Detach cleanup

- Extract JIT region detection into standalone findJITRegion() function
  that handles both prctl-labeled mappings (spanning full reserved area
  including holes) and heuristic fallback (first anonymous executable mapping)
- Add comprehensive unit tests for JIT region detection: no mappings,
  file-backed only, labeled single/multiple, heuristic fallback, precedence
- Fix Detach() to clean up PidInterpreterMapping prefixes (previously only
  deleted proc data, leaking eBPF map entries)
- Remove dead code: m.Vaddr < jitMapping.Vaddr branch that could never be
  true since /proc/pid/maps is sorted by address

Author: dalehamel

interpreter/ruby/ruby.go

@@ -455,7 +455,18 @@ type rubyInstance struct {
 }
 
 func (r *rubyInstance) Detach(ebpf interpreter.EbpfHandler, pid libpf.PID) error {
-	return ebpf.DeleteProcData(libpf.Ruby, pid)
+	var err error
+	err = ebpf.DeleteProcData(libpf.Ruby, pid)
+
+	for prefix := range r.prefixes {
+		if err2 := ebpf.DeletePidInterpreterMapping(pid, prefix); err2 != nil {
+			err = errors.Join(err,
+				fmt.Errorf("failed to remove ruby prefix 0x%x/%d: %v",
+					prefix.Key, prefix.Length, err2))
+		}
+	}
+
+	return err
 }
 
 // UpdateLibcInfo is called when libc introspection data becomes available.
@@ -1268,12 +1279,59 @@ func profileFrameFullLabel(classPath, label, baseLabel, methodName libpf.String,
 	return libpf.Intern(profileLabel)
 }
 
+// findJITRegion detects the YJIT JIT code region from process memory mappings.
+// YJIT reserves a large contiguous address range (typically 48-128 MiB) via mmap
+// with PROT_NONE and then mprotects individual 16k codepages to r-x as needed.
+// On systems with CONFIG_ANON_VMA_NAME, Ruby labels the region via prctl(PR_SET_VMA)
+// giving it a path like "[anon:Ruby:rb_yjit_reserve_addr_space]".
+// On systems without that config, we fall back to a heuristic: the first anonymous
+// executable mapping (by address) is assumed to be the JIT region since YJIT
+// initializes before any gems could create anonymous executable mappings.
+// Returns (start, end, found).
+func findJITRegion(mappings []process.RawMapping) (uint64, uint64, bool) {
+	var jitStart, jitEnd uint64
+	labelFound := false
+	var heuristicStart, heuristicEnd uint64
+	heuristicFound := false
+
+	for idx := range mappings {
+		m := &mappings[idx]
+
+		// Check for prctl-labeled JIT region. These mappings may be ---p (PROT_NONE)
+		// or r-xp depending on whether YJIT has activated codepages in this region.
+		if strings.Contains(m.Path, "jit_reserve_addr_space") {
+			if !labelFound || m.Vaddr < jitStart {
+				jitStart = m.Vaddr
+			}
+			if !labelFound || m.Vaddr+m.Length > jitEnd {
+				jitEnd = m.Vaddr + m.Length
+			}
+			labelFound = true
+			continue
+		}
+
+		// Heuristic fallback: first anonymous executable mapping by address.
+		// Mappings from /proc/pid/maps are sorted by address, so the first
+		// match is the lowest address.
+		if !heuristicFound && m.IsExecutable() && m.IsAnonymous() {
+			heuristicStart = m.Vaddr
+			heuristicEnd = m.Vaddr + m.Length
+			heuristicFound = true
+		}
+	}
+
+	if labelFound {
+		return jitStart, jitEnd, true
+	}
+	if heuristicFound {
+		return heuristicStart, heuristicEnd, true
+	}
+	return 0, 0, false
+}
+
 func (r *rubyInstance) SynchronizeMappings(ebpf interpreter.EbpfHandler,
 	_ reporter.ExecutableReporter, pr process.Process, mappings []process.RawMapping) error {
-	var jitMapping *process.RawMapping
-
 	pid := pr.PID()
-	jitFound := false
 	r.mappingGeneration++
 
 	log.Debugf("Synchronizing ruby mappings")
@@ -1283,19 +1341,6 @@ func (r *rubyInstance) SynchronizeMappings(ebpf interpreter.EbpfHandler,
 		if !m.IsExecutable() || !m.IsAnonymous() {
 			continue
 		}
-		// If prctl is allowed, ruby should label the memory region
-		// always prefer that
-		if strings.Contains(m.Path, "jit_reserve_addr_space") {
-			jitMapping = m
-			jitFound = true
-		}
-		// Use the first executable anon region we find if it isn't labeled
-		// If we find more, prefer ones earlier in memory or larger in size
-		if !jitFound && (jitMapping == nil || m.Vaddr < jitMapping.Vaddr || m.Length > jitMapping.Length) {
-			// Don't set jitFound here as it is a heuristic, we aren't sure
-			// could be on a system without linux config flag to allow prctl to label memoy
-			jitMapping = m
-		}
 
 		if _, exists := r.mappings[*m]; exists {
 			*r.mappings[*m] = r.mappingGeneration
@@ -1326,13 +1371,15 @@ func (r *rubyInstance) SynchronizeMappings(ebpf interpreter.EbpfHandler,
 			r.prefixes[prefix] = &mappingGeneration
 		}
 	}
-	if jitMapping != nil && (r.procInfo.Jit_start != jitMapping.Vaddr || r.procInfo.Jit_end != jitMapping.Vaddr+jitMapping.Length) {
-		r.procInfo.Jit_start = jitMapping.Vaddr
-		r.procInfo.Jit_end = jitMapping.Vaddr + jitMapping.Length
+	// Detect JIT region from all mappings and update proc data if changed.
+	jitStart, jitEnd, jitFound := findJITRegion(mappings)
+	if jitFound && (r.procInfo.Jit_start != jitStart || r.procInfo.Jit_end != jitEnd) {
+		r.procInfo.Jit_start = jitStart
+		r.procInfo.Jit_end = jitEnd
 		if err := ebpf.UpdateProcData(libpf.Ruby, pr.PID(), unsafe.Pointer(r.procInfo)); err != nil {
 			return err
 		}
-		log.Debugf("Added jit mapping %08x ruby proc info, %08x", r.procInfo.Jit_start, r.procInfo.Jit_end)
+		log.Debugf("Updated JIT region %#x-%#x in ruby proc info", jitStart, jitEnd)
 	}
 	// Remove prefixes not seen
 	for prefix, generationPtr := range r.prefixes {

interpreter/ruby/ruby_test.go

@@ -4,9 +4,11 @@
 package ruby // import "go.opentelemetry.io/ebpf-profiler/interpreter/ruby"
 
 import (
+	"debug/elf"
 	"testing"
 
 	"go.opentelemetry.io/ebpf-profiler/libpf"
+	"go.opentelemetry.io/ebpf-profiler/process"
 
 	"github.com/stretchr/testify/assert"
 )
@@ -234,3 +236,129 @@ func TestProfileFrameFullLabel(t *testing.T) {
 		})
 	}
 }
+
+func TestFindJITRegion(t *testing.T) {
+	execAnon := func(vaddr, length uint64) process.RawMapping {
+		return process.RawMapping{
+			Vaddr:  vaddr,
+			Length: length,
+			Flags:  elf.PF_R | elf.PF_X,
+			Path:   "",
+		}
+	}
+	labeled := func(vaddr, length uint64) process.RawMapping {
+		return process.RawMapping{
+			Vaddr:  vaddr,
+			Length: length,
+			Flags:  0, // ---p (PROT_NONE)
+			Path:   "[anon:Ruby:rb_yjit_reserve_addr_space]",
+		}
+	}
+	fileBacked := func(vaddr, length uint64, path string) process.RawMapping {
+		return process.RawMapping{
+			Vaddr:  vaddr,
+			Length: length,
+			Flags:  elf.PF_R | elf.PF_X,
+			Path:   path,
+		}
+	}
+
+	tests := []struct {
+		name      string
+		mappings  []process.RawMapping
+		wantStart uint64
+		wantEnd   uint64
+		wantFound bool
+	}{
+		{
+			name:      "no mappings",
+			mappings:  nil,
+			wantFound: false,
+		},
+		{
+			name: "only file-backed mappings",
+			mappings: []process.RawMapping{
+				fileBacked(0x400000, 0x1000, "/usr/bin/ruby"),
+				fileBacked(0x7f0000, 0x2000, "/lib/libc.so.6"),
+			},
+			wantFound: false,
+		},
+		{
+			name: "labeled JIT region (single mapping)",
+			mappings: []process.RawMapping{
+				fileBacked(0x400000, 0x1000, "/usr/bin/ruby"),
+				labeled(0x7f17d99b9000, 0x8000000),
+			},
+			wantStart: 0x7f17d99b9000,
+			wantEnd:   0x7f17d99b9000 + 0x8000000,
+			wantFound: true,
+		},
+		{
+			name: "labeled JIT region with holes (multiple contiguous mappings)",
+			mappings: []process.RawMapping{
+				fileBacked(0x400000, 0x1000, "/usr/bin/ruby"),
+				{
+					Vaddr:  0x7f17d99b9000,
+					Length: 0x15f000,
+					Flags:  elf.PF_R | elf.PF_X,
+					Path:   "[anon:Ruby:rb_yjit_reserve_addr_space]",
+				},
+				{
+					Vaddr:  0x7f17d9b18000,
+					Length: 0x119000,
+					Flags:  elf.PF_R | elf.PF_X,
+					Path:   "[anon:Ruby:rb_yjit_reserve_addr_space]",
+				},
+				{
+					Vaddr:  0x7f17d9c31000,
+					Length: 0x7d88000,
+					Flags:  0, // ---p reserved
+					Path:   "[anon:Ruby:rb_yjit_reserve_addr_space]",
+				},
+			},
+			wantStart: 0x7f17d99b9000,
+			wantEnd:   0x7f17d9c31000 + 0x7d88000,
+			wantFound: true,
+		},
+		{
+			name: "heuristic fallback - first anonymous executable mapping",
+			mappings: []process.RawMapping{
+				fileBacked(0x400000, 0x1000, "/usr/bin/ruby"),
+				execAnon(0x7f0000100000, 0x4000),
+				execAnon(0x7f0000200000, 0x8000),
+			},
+			wantStart: 0x7f0000100000,
+			wantEnd:   0x7f0000100000 + 0x4000,
+			wantFound: true,
+		},
+		{
+			name: "labeled takes precedence over heuristic",
+			mappings: []process.RawMapping{
+				execAnon(0x1000000, 0x4000),
+				labeled(0x7f0000000000, 0x3000000),
+			},
+			wantStart: 0x7f0000000000,
+			wantEnd:   0x7f0000000000 + 0x3000000,
+			wantFound: true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			start, end, found := findJITRegion(tt.mappings)
+			if found != tt.wantFound {
+				t.Errorf("found = %v, want %v", found, tt.wantFound)
+				return
+			}
+			if !found {
+				return
+			}
+			if start != tt.wantStart {
+				t.Errorf("start = %#x, want %#x", start, tt.wantStart)
+			}
+			if end != tt.wantEnd {
+				t.Errorf("end = %#x, want %#x", end, tt.wantEnd)
+			}
+		})
+	}
+}