perf: reduce calls to Path.resolve (#14460)

Calls to `Path.resolve` turn out to be quite expensive. We try to avoid
them by checking whether a Path object actually needs to be resolved. In
many cases, we just need to check whether the path is absolute or a link
and then only resolve when necessary.

## Performance Analysis

We take Symbol DB as a part of the codebase that exercises the code of
interest. The before flame graph shows the CPU cost of calls to
`resolve`. The after flame graph shows how they can be avoided in many
cases.

### Before

<img width="1407" height="460" alt="Screenshot 2025-09-01 at 15 40 16"
src="https://github.com/user-attachments/assets/2b4da82c-140d-4ec7-9954-5734ea65c987"
/>

### After

<img width="1407" height="460" alt="Screenshot 2025-09-01 at 15 39 25"
src="https://github.com/user-attachments/assets/e089e59a-260c-44af-9c51-a953ec62465b"
/>


## Checklist
- [x] PR author has checked that all the criteria below are met
- The PR description includes an overview of the change
- The PR description articulates the motivation for the change
- The change includes tests OR the PR description describes a testing
strategy
- The PR description notes risks associated with the change, if any
- Newly-added code is easy to change
- The change follows the [library release note
guidelines](https://ddtrace.readthedocs.io/en/stable/releasenotes.html)
- The change includes or references documentation updates if necessary
- Backport labels are set (if
[applicable](https://ddtrace.readthedocs.io/en/latest/contributing.html#backporting))

## Reviewer Checklist
- [x] Reviewer has checked that all the criteria below are met 
- Title is accurate
- All changes are related to the pull request's stated goal
- Avoids breaking
[API](https://ddtrace.readthedocs.io/en/stable/versioning.html#interfaces)
changes
- Testing strategy adequately addresses listed risks
- Newly-added code is easy to change
- Release note makes sense to a user of the library
- If necessary, author has acknowledged and discussed the performance
implications of this PR as reported in the benchmarks PR comment
- Backport labels are set in a manner that is consistent with the
[release branch maintenance
policy](https://ddtrace.readthedocs.io/en/latest/contributing.html#backporting)

Author: P403n1x87

ddtrace/debugging/_function/discovery.py

@@ -1,6 +1,5 @@
 from collections import defaultdict
 from collections import deque
-from pathlib import Path
 from types import CodeType
 from types import FunctionType
 from types import ModuleType
@@ -24,6 +23,7 @@
 from ddtrace.internal.utils.inspection import collect_code_objects
 from ddtrace.internal.utils.inspection import functions_for_code
 from ddtrace.internal.utils.inspection import linenos
+from ddtrace.internal.utils.inspection import resolved_code_origin
 from ddtrace.internal.utils.inspection import undecorated
 
 
@@ -209,7 +209,7 @@ def _collect_functions(module: ModuleType) -> Dict[str, _FunctionCodePair]:
 
                 for name in (k, local_name) if isinstance(k, str) and k != local_name else (local_name,):
                     fullname = ".".join((c.__fullname__, name)) if c.__fullname__ else name
-                    if fullname not in functions or Path(code.co_filename).resolve() == path:
+                    if fullname not in functions or resolved_code_origin(code) == path:
                         # Give precedence to code objects from the module and
                         # try to retrieve any potentially decorated function so
                         # that we don't end up returning the decorator function
@@ -285,7 +285,7 @@ def __init__(self, module: ModuleType) -> None:
 
                 if (
                     function not in seen_functions
-                    and Path(cast(FunctionType, function).__code__.co_filename).resolve() == module_path
+                    and resolved_code_origin(cast(FunctionType, function).__code__) == module_path
                 ):
                     # We only map line numbers for functions that actually belong to
                     # the module.
@@ -342,7 +342,7 @@ def _resolve_pair(self, pair: _FunctionCodePair, fullname: str) -> FullyNamedFun
 
             code = pair.code
             assert code is not None  # nosec
-            f = undecorated(cast(FunctionType, target), cast(str, part), Path(code.co_filename).resolve())
+            f = undecorated(cast(FunctionType, target), cast(str, part), resolved_code_origin(code))
             if not (isinstance(f, FunctionType) and f.__code__ is code):
                 raise e
 

ddtrace/debugging/_origin/span.py

@@ -102,7 +102,7 @@ def from_frame(cls, frame: FrameType) -> "ExitSpanProbe":
             ExitSpanProbe,
             cls.build(
                 name=code.co_qualname if sys.version_info >= (3, 11) else code.co_name,  # type: ignore[attr-defined]
-                filename=str(Path(code.co_filename).resolve()),
+                filename=str(Path(code.co_filename)),
                 line=frame.f_lineno,
             ),
         )

ddtrace/internal/coverage/code.py

@@ -20,6 +20,7 @@
 from ddtrace.internal.packages import purelib_path
 from ddtrace.internal.packages import stdlib_path
 from ddtrace.internal.test_visibility.coverage_lines import CoverageLines
+from ddtrace.internal.utils.inspection import resolved_code_origin
 
 
 log = get_logger(__name__)
@@ -317,7 +318,7 @@ def transform(self, code: CodeType, _module: ModuleType) -> CodeType:
         if _module is None:
             return code
 
-        code_path = Path(code.co_filename).resolve()
+        code_path = resolved_code_origin(code)
 
         if not any(code_path.is_relative_to(include_path) for include_path in self._include_paths):
             # Not a code object we want to instrument

ddtrace/internal/module.py

@@ -111,21 +111,34 @@ def unregister_post_run_module_hook(hook: ModuleHookType) -> None:
 def origin(module: ModuleType) -> t.Optional[Path]:
     """Get the origin source file of the module."""
     try:
-        # DEV: Use object.__getattribute__ to avoid potential side-effects.
-        orig = Path(object.__getattribute__(module, "__file__")).resolve()
-    except (AttributeError, TypeError):
-        # Module is probably only partially initialised, so we look at its
-        # spec instead
+        # Do not access __dd_origin__ directly to avoid force-loading lazy
+        # modules.
+        return object.__getattribute__(module, "__dd_origin__")
+    except AttributeError:
         try:
             # DEV: Use object.__getattribute__ to avoid potential side-effects.
-            orig = Path(object.__getattribute__(module, "__spec__").origin).resolve()
-        except (AttributeError, ValueError, TypeError):
-            orig = None
+            orig = Path(object.__getattribute__(module, "__file__")).resolve()
+        except (AttributeError, TypeError):
+            # Module is probably only partially initialised, so we look at its
+            # spec instead
+            try:
+                # DEV: Use object.__getattribute__ to avoid potential side-effects.
+                orig = Path(object.__getattribute__(module, "__spec__").origin).resolve()
+            except (AttributeError, ValueError, TypeError):
+                orig = None
 
-    if orig is not None and orig.is_file():
-        return orig.with_suffix(".py") if orig.suffix == ".pyc" else orig
+        if orig is not None and orig.suffix == "pyc":
+            orig = orig.with_suffix(".py")
 
-    return None
+        if orig is not None:
+            # If we failed to find a valid origin we don't cache the value and
+            # try again the next time.
+            try:
+                module.__dd_origin__ = orig  # type: ignore[attr-defined]
+            except AttributeError:
+                pass
+
+        return orig
 
 
 def _resolve(path: Path) -> t.Optional[Path]:

ddtrace/internal/packages.py

@@ -99,6 +99,21 @@ def _effective_root(rel_path: Path, parent: Path) -> str:
     return base if root.is_dir() and (root / "__init__.py").exists() else "/".join(rel_path.parts[:2])
 
 
+# DEV: Since we can't lock on sys.path, these operations can be racy.
+_SYS_PATH_HASH: t.Optional[int] = None
+_RESOLVED_SYS_PATH: t.List[Path] = []
+
+
+def resolve_sys_path() -> t.List[Path]:
+    global _SYS_PATH_HASH, _RESOLVED_SYS_PATH
+
+    if (h := hash(tuple(sys.path))) != _SYS_PATH_HASH:
+        _SYS_PATH_HASH = h
+        _RESOLVED_SYS_PATH = [Path(_).resolve() for _ in sys.path]
+
+    return _RESOLVED_SYS_PATH
+
+
 def _root_module(path: Path) -> str:
     # Try the most likely prefixes first
     for parent_path in (purelib_path, platlib_path):
@@ -112,7 +127,7 @@ def _root_module(path: Path) -> str:
     # Try to resolve the root module using sys.path. We keep the shortest
     # relative path as the one more likely to give us the root module.
     min_relative_path = max_parent_path = None
-    for parent_path in (Path(_).resolve() for _ in sys.path):
+    for parent_path in resolve_sys_path():
         try:
             relative = path.relative_to(parent_path)
             if min_relative_path is None or len(relative.parents) < len(min_relative_path.parents):
@@ -240,7 +255,9 @@ def module_to_package(module: ModuleType) -> t.Optional[Distribution]:
 
 @cached(maxsize=256)
 def is_stdlib(path: Path) -> bool:
-    rpath = path.resolve()
+    rpath = path
+    if not rpath.is_absolute() or rpath.is_symlink():
+        rpath = rpath.resolve()
 
     return (rpath.is_relative_to(stdlib_path) or rpath.is_relative_to(platstdlib_path)) and not (
         rpath.is_relative_to(purelib_path) or rpath.is_relative_to(platlib_path)

ddtrace/internal/symbol_db/symbols.py

@@ -38,6 +38,7 @@
 from ddtrace.internal.utils.http import connector
 from ddtrace.internal.utils.http import multipart
 from ddtrace.internal.utils.inspection import linenos
+from ddtrace.internal.utils.inspection import resolved_code_origin
 from ddtrace.internal.utils.inspection import undecorated
 from ddtrace.settings._agent import config as agent_config
 from ddtrace.settings.symbol_db import config as symdb_config
@@ -324,7 +325,7 @@ def _(cls, code: CodeType, data: ScopeData, recursive: bool = True):
             return None
         data.seen.add(code_id)
 
-        if Path(code.co_filename).resolve() != data.origin:
+        if (code_origin := resolved_code_origin(code)) != data.origin:
             # Comes from another module.
             return None
 
@@ -338,7 +339,7 @@ def _(cls, code: CodeType, data: ScopeData, recursive: bool = True):
         return Scope(
             scope_type=ScopeType.CLOSURE,  # DEV: Not in the sense of a Python closure.
             name=code.co_name,
-            source_file=str(Path(code.co_filename).resolve()),
+            source_file=str(code_origin),
             start_line=start_line,
             end_line=end_line,
             symbols=Symbol.from_code(code),

ddtrace/internal/utils/inspection.py

@@ -13,6 +13,7 @@
 from typing import cast
 
 from ddtrace.internal.safety import _isinstance
+from ddtrace.internal.utils.cache import cached
 
 
 @singledispatch
@@ -31,14 +32,23 @@ def _(f: FunctionType) -> Set[int]:
     return linenos(f.__code__)
 
 
+@cached(maxsize=4 << 10)
+def _filename_to_resolved_path(filename: str) -> Path:
+    return Path(filename).resolve()
+
+
+def resolved_code_origin(code: CodeType) -> Path:
+    return _filename_to_resolved_path(code.co_filename)
+
+
 def undecorated(f: FunctionType, name: str, path: Path) -> FunctionType:
     # Find the original function object from a decorated function. We use the
     # expected function name to guide the search and pick the correct function.
     # The recursion is needed in case of multiple decorators. We make it BFS
     # to find the function as soon as possible.
 
     def match(g):
-        return g.__code__.co_name == name and Path(g.__code__.co_filename).resolve() == path
+        return g.__code__.co_name == name and resolved_code_origin(g.__code__) == path
 
     if _isinstance(f, FunctionType) and match(f):
         return f

tests/appsec/iast/_ast/test_ast_patching.py

@@ -412,7 +412,7 @@ def test_should_not_iast_patch_if_stdlib(module_name):
 
 
 def test_module_path_none(caplog):
-    with caplog.at_level(logging.DEBUG), mock.patch("ddtrace.internal.module.Path.resolve", side_effect=AttributeError):
+    with caplog.at_level(logging.DEBUG), mock.patch("ddtrace.appsec._iast._ast.ast_patching.origin", return_value=None):
         assert ("", None) == astpatch_module(__import__("tests.appsec.iast.fixtures.ast.str.class_str", fromlist=["*"]))
         assert (
             "iast::instrumentation::ast_patching::compiling::"