Fix NullPointerException from activating a null span in scope manager

[dougqh]

What Does This Do

• ContinuableScopeManager.activate now returns the existing INVALID_SCOPE (noop) sentinel when given a null span, instead of silently pushing a ContinuableScope with a null Context onto the scope stack.
• TracingSendHandler.onResult (JSR-356 websocket async send instrumentation) skips activateSpan entirely when the websocket span is null, matching the existing null-check already used in TracingOutputStream.close() for the same HandlerContext.
• Added ScopeManagerForkedTest#activatingNullSpanReturnsNoopScopeAndDoesNotCorruptStack, which reproduces the original bug: activating a null span returns a noop scope, and a subsequent real activation on the same thread no longer NPEs.

Motivation

Fixes a production NullPointerException surfaced via Datadog error tracking (issue 6d4f45fa-b461-11f0-8716-da7ad0900002) in ContinuableScopeManager.activate.

Root cause: HandlerContext.getWebsocketSpan() can race with HandlerContext.reset() clearing that field from another thread, so TracingSendHandler.onResult could call activateSpan with a null span. ContinuableScopeManager.activate had no guard for this — it pushed a ContinuableScope with a null Context. The corruption didn't throw immediately; it only surfaced as an NPE on the next activation on that thread, when top.context.with(span) dereferenced the poisoned null context. The pre-existing assert span != null never caught this in practice, since assertions are never enabled (-ea) in production JVMs.

Additional Notes

• Low customer impact (11 total occurrences, single customer) and not a crash — the exception was already caught by the instrumentation's own exception guard — but it silently corrupted the scope stack for the affected thread, which is worse than the NPE itself.
• ./gradlew :dd-trace-core:forkedTest --tests "datadog.trace.core.scopemanager.ScopeManagerForkedTest" passes.
• ./gradlew spotlessApply produces no additional changes.

Contributor Checklist

• Format the title according to the contribution guidelines
• Assign the type: and (comp: or inst:) labels in addition to any other useful labels
• Avoid using close, fix, or any linking keywords when referencing an issue
• Update the CODEOWNERS file on source file addition, migration, or deletion — not applicable, no files added/removed
• Update public documentation with any new configuration flags or behaviors — not applicable, no config change
• Once approved, use merge queue to merge the PR

Jira ticket: N/A — originated from Datadog Error Tracking issue 6d4f45fa-b461-11f0-8716-da7ad0900002

🤖 Generated with Claude Code

[datadog-prod-us1-5]

🎯 Code Coverage (details)
• Patch Coverage: 100.00%
• Overall Coverage: 59.21% (+0.10%)

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: 9624bfc | Docs | View more details | Give us feedback!}

[dd-octo-sts]

🟢 Java Benchmark SLOs — All performance SLOs passed

Suite	Status
Startup	🟢 pass

SLO thresholds are defined here based on automatically generated metrics. A warning is raised when results are within 5% of the threshold.

PR vs. master results

Scenario	Candidate	master	Δ (95% CI of mean)
startup:insecure-bank:iast:Agent	14.88 s	14.76 s	[-0.2%; +1.7%] (no difference)
startup:insecure-bank:tracing:Agent	13.73 s	13.71 s	[-0.6%; +0.8%] (no difference)
startup:petclinic:appsec:Agent	17.72 s	17.39 s	[+0.9%; +3.0%] (maybe worse)
startup:petclinic:iast:Agent	17.45 s	17.63 s	[-2.0%; -0.0%] (maybe better)
startup:petclinic:profiling:Agent	17.45 s	17.23 s	[+0.1%; +2.4%] (maybe worse)
startup:petclinic:sca:Agent	17.49 s	17.01 s	[-1.7%; +7.3%] (no difference)
startup:petclinic:tracing:Agent	16.52 s	16.67 s	[-1.8%; +0.1%] (no difference)

Commit: 9624bfc3 · CI Pipeline · Benchmarking Platform UI

---

Load and DaCapo benchmarks can be triggered manually in the GitLab pipeline. Results will appear in the Benchmarking Platform UI after completion.