Add ability limit amount of jemalloc profile flushes on MEMORY_LIMIT_EXCEEDED per time interval

[azat]

Changelog category (leave one):

• Improvement

Changelog entry (a user-readable short description of the changes that goes into CHANGELOG.md):

Add ability limit amount of jemalloc profile flushes on MEMORY_LIMIT_EXCEEDED per time interval

[clickhouse-gh]

Workflow [PR], commit [f1f37e2]

Summary: ❌

job_name	test_name	status	info	comment
Stateless tests (amd_asan_ubsan, flaky check)		failure
	03668_shard_join_in_reverse_order	FAIL	cidb, issue
	03668_shard_join_in_reverse_order	FAIL	cidb, issue
	03668_shard_join_in_reverse_order	FAIL	cidb, issue
Stateless tests (amd_tsan, flaky check)		failure
	03668_shard_join_in_reverse_order	FAIL	cidb, issue
	03668_shard_join_in_reverse_order	FAIL	cidb, issue
	03668_shard_join_in_reverse_order	FAIL	cidb, issue
Stateless tests (amd_debug, flaky check)		failure
	03668_shard_join_in_reverse_order	FAIL	cidb, issue
Stress test (arm_msan)		failure
	Server died	FAIL	cidb
	MemorySanitizer: use-of-uninitialized-value (STID: 2410-47e0)	FAIL	cidb

---

AI Review

Summary

This PR adds a server setting jemalloc_flush_profile_on_memory_exceeded_interval and wires it through Server into MemoryTracker to rate-limit jemalloc profile dumps during MEMORY_LIMIT_EXCEEDED. The implementation is small and localized, and I did not find new correctness, safety, or performance issues introduced by the current PR head.

Missing context

• ⚠️ CI is still running (several required checks are pending), so runtime validation is not complete yet.

ClickHouse Rules

Item	Status	Notes
Deletion logging	➖
Serialization versioning	➖
Core-area scrutiny	✅
No test removal	✅
Experimental gate	➖
No magic constants	✅
Backward compatibility	✅
SettingsChangesHistory.cpp	➖
PR metadata quality	✅
Safe rollout	✅
Compilation time	✅

Final Verdict

• Status: ✅ Approve

[clickhouse-gh]

flushProfile calls checkProfilingEnabled and can throw when ClickHouse is started without jemalloc profiling (opt.prof=false).

In this MEMORY_LIMIT_EXCEEDED path, that would replace the intended memory-limit exception with BAD_ARGUMENTS, which is misleading and can break callers that rely on MEMORY_LIMIT_EXCEEDED handling.

Please keep the old guard (prof.active / opt.prof) before calling flushProfile, or catch and log profiling-related exceptions here so the original memory-limit flow is preserved.

[azat]

Ok, it is better to keep it, since we do not enable jemalloc for non-Linux, I will do this separately, for now I will get the original check back.

[clickhouse-gh]

LLVM Coverage Report

Metric	Baseline	Current	Δ
Lines	84.00%	84.10%	+0.10%
Functions	90.90%	90.90%	+0.00%
Branches	76.50%	76.60%	+0.10%

Changed lines: 72.41% (42/58) | lost baseline coverage: 13 line(s) · Uncovered code

Full report · Diff report