[SDK] Handle instrumentation object construction failures safely

[22elix3r]

Fixes #4361

Changes

Provider construction happens during SDK initialization. Runtime GetTracer / GetLogger / GetMeter calls must not throw. This change follows the post-SIG direction from @dbarker:

• Remove noexcept from the SDK constructors for TracerProvider, LoggerProvider, MeterProvider, Tracer, Logger, and Meter. Allocation or initialization failures during provider construction can now propagate so the caller (often the configuration library) can handle them.
• Keep GetTracer, GetLogger, and GetMeter noexcept. If constructing a previously unseen tracer/logger/meter fails, the provider catches the exception (when exceptions are enabled), logs via OTEL_INTERNAL_LOG_ERROR without letting logging escape, and returns a valid noop API object.
• The noop fallback is allocated during provider construction (new NoopTracer / NoopLogger / NoopMeter stored as a nostd::shared_ptr). Runtime failure handling does not allocate a fresh noop object.
• Failed construction is not inserted into the provider cache. A later Get* call can retry and return a normal SDK object once the failure is gone. Existing cached objects continue to be returned unchanged.
• The complete fallible path is protected: instrumentation-scope construction, configurator evaluation, object allocation, shared_ptr control-block allocation, cache insertion, and metrics AddMeter.
• Public API virtual method exception contracts are unchanged. ABI v1 and ABI v2 Get* signatures are unchanged. Try/catch is compiled only when OPENTELEMETRY_HAVE_EXCEPTIONS is set.

Tests added

• Constructor noexcept static_asserts for each signal.
• Deterministic fault injection through a ScopeConfigurator matcher that throws for a named scope.
• After failure, Get* returns a valid noop-compatible object, using it produces no telemetry, the cache is not poisoned, cached objects are unchanged, and a later call recovers when the injected failure is removed.
• Those tests are skipped when exceptions are disabled.

Validation

cmake -S . -B build -DCMAKE_BUILD_TYPE=Debug \
  -DOTELCPP_WITH_EXAMPLES=OFF -DOTELCPP_BUILD_TESTING=ON \
  -DOTELCPP_WITH_OTLP_GRPC=OFF -DOTELCPP_WITH_OTLP_HTTP=OFF \
  -DOTELCPP_WITH_OTLP_FILE=OFF -DCMAKE_CXX_STANDARD=17

cmake --build build --target tracer_provider_test logger_provider_sdk_test meter_provider_sdk_test
ctest --test-dir build --output-on-failure \
  -R 'trace.(TracerProvider|TracerConfig)|logs.(LoggerProviderSDK|LoggerConfig)|metrics.(MeterProvider|MeterConfig)'
# 63/63 passed, including Get*ReturnsNoopOnConstructionFailure

ctest --test-dir build --output-on-failure -R 'logs.LoggerSDK'
# 12/12 passed

./build/sdk/test/metrics/meter_test
# 20/20 passed

# Exception-disabled compile of changed SDK sources:
g++ -std=c++17 -fno-exceptions -c -DOPENTELEMETRY_HAVE_EXCEPTIONS=0 ...
# tracer_provider.cc, tracer.cc, logger_provider.cc, logger.cc,
# meter_provider.cc, meter.cc: success

# ABI v2 compile of the three provider .cc files:
g++ -std=c++17 -c -DOPENTELEMETRY_ABI_VERSION_NO=2 ...
# tracer_provider.cc, logger_provider.cc, meter_provider.cc: success

git diff --check
# clean

tools/format.sh was not run: clang-format is not installed in this environment.

• CHANGELOG.md updated for non-trivial changes
• Unit tests have been added
• Changes in public API reviewed (SDK constructor exception specs only; API Get* contracts unchanged)

[codecov]

Codecov Report

❌ Patch coverage is 77.65957% with 21 lines in your changes missing coverage. Please review.
✅ Project coverage is 83.08%. Comparing base (6af677c) to head (ff059b9).
⚠️ Report is 2 commits behind head on main.

Files with missing lines	Patch %	Lines
sdk/src/logs/logger_provider.cc	70.00%	9 Missing ⚠️
sdk/src/metrics/meter_provider.cc	80.00%	6 Missing ⚠️
sdk/src/trace/tracer_provider.cc	79.32%	6 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #4469      +/-   ##
==========================================
- Coverage   83.12%   83.08%   -0.03%     
==========================================
  Files         519      519              
  Lines       20256    20312      +56     
==========================================
+ Hits        16835    16875      +40     
- Misses       3421     3437      +16     

Files with missing lines	Coverage Δ
sdk/include/opentelemetry/sdk/metrics/meter.h	57.15% <ø> (ø)
sdk/include/opentelemetry/sdk/trace/tracer.h	100.00% <ø> (ø)
sdk/src/logs/logger.cc	94.12% <100.00%> (ø)
sdk/src/metrics/meter.cc	81.36% <100.00%> (ø)
sdk/src/trace/tracer.cc	80.22% <100.00%> (ø)
sdk/src/metrics/meter_provider.cc	87.18% <80.00%> (-6.15%)	⬇️
sdk/src/trace/tracer_provider.cc	83.96% <79.32%> (-4.75%)	⬇️
sdk/src/logs/logger_provider.cc	84.00% <70.00%> (-7.07%)	⬇️

... and 2 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[22elix3r]

@dbarker Latest commits are up (format/IWYU follow-up + merge from main). CI is waiting on workflow approval again.

[Copilot]

Pull request overview

This PR updates the OpenTelemetry C++ SDK to safely handle failures during instrumentation object construction while preserving noexcept guarantees for runtime GetTracer/GetLogger/GetMeter calls by returning a pre-allocated noop fallback when construction fails (with exception handling compiled in only when exceptions are enabled).

Changes:

• Remove noexcept from SDK provider and instrumentation constructors so initialization failures can propagate to the caller.
• Keep provider Get* methods noexcept, adding guarded try/catch to log construction failures and return a pre-allocated noop object without poisoning caches.
• Add unit tests for constructor exception specs and deterministic fault injection/recovery behavior (skipped when exceptions are disabled).

Reviewed changes

Copilot reviewed 16 out of 16 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
sdk/test/trace/tracer_provider_test.cc	Adds static_asserts for constructor exception specs and tests noop fallback + recovery for GetTracer.
sdk/test/metrics/meter_provider_sdk_test.cc	Adds static_asserts and tests noop fallback + recovery for GetMeter.
sdk/test/logs/logger_provider_sdk_test.cc	Adds static_asserts and tests noop fallback + recovery for GetLogger; introduces a new test processor.
sdk/src/trace/tracer.cc	Removes noexcept from Tracer constructor implementation.
sdk/src/trace/tracer_provider.cc	Adds pre-allocated noop tracer fallback and exception-guarded construction in GetTracer.
sdk/src/metrics/meter.cc	Removes noexcept from Meter constructor implementation.
sdk/src/metrics/meter_provider.cc	Adds pre-allocated noop meter fallback and exception-guarded construction in GetMeter.
sdk/src/logs/logger.cc	Removes noexcept from Logger constructor implementation.
sdk/src/logs/logger_provider.cc	Adds pre-allocated noop logger fallback and exception-guarded construction in GetLogger.
sdk/include/opentelemetry/sdk/trace/tracer.h	Removes noexcept from Tracer constructor declaration.
sdk/include/opentelemetry/sdk/trace/tracer_provider.h	Removes noexcept from TracerProvider constructors; adds stored noop tracer member.
sdk/include/opentelemetry/sdk/metrics/meter.h	Removes noexcept from Meter constructor declaration.
sdk/include/opentelemetry/sdk/metrics/meter_provider.h	Removes noexcept from MeterProvider constructors; adds stored noop meter member.
sdk/include/opentelemetry/sdk/logs/logger.h	Removes noexcept from Logger constructor declaration.
sdk/include/opentelemetry/sdk/logs/logger_provider.h	Removes noexcept from LoggerProvider constructors; adds stored noop logger member.
CHANGELOG.md	Documents the SDK behavior change for constructor exception specs and noop fallback behavior.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[22elix3r]

@dbarker IWYU and clang-tidy should be clean now. CountingProcessor uses std::move again, and the branch is merged onto latest main. Ready for another look when you have a minute.

[dbarker]

Thanks for the PR! Please see some feedback below.

[22elix3r]

@dbarker Addressed the review notes in ff059b9. Logging helpers now catch std::exception, and I added comments on the catch-all around user configurators. Same change in trace, logs, and metrics.

[22elix3r]

@dbarker Follow-up after ff059b9:

• IWYU was red on the three all-options configs. Added the missing includes (<vector> in meter_provider.cc, <functional> plus the span-data headers in the tests, sync_instruments.h for the meter test) and dropped the duplicates IWYU asked to remove.
• Added Get*ReturnsNoopOnNonStdConstructionFailure for trace/logs/metrics so the catch-all around user configurators is covered, not only std::exception.
• Merged latest main.

Locally: tracer_provider_test, logger_provider_sdk_test, and meter_provider_sdk_test all pass, including the new tests (66/66 in that filter). Ready for another look when you have a minute. CI on the fork may need workflow approval again.

[dbarker]

Thanks for the PR! Please see feedback below. I'm requesting a change to ensure that repeated calls to Get<Tracer/Meter/Logger> will not continue exercising the exceptional path after the first occurrence.

[dbarker]

A change in this implementation is needed to ensure that repeated calls to GetTracer with a given instrumentation scope will not continue to exercise the exceptional path.

The rationale is that error handling and immediate recovery isn't possible for callers since the GetTracer method doesn't propagate any usable error signal. We must also expect users to call GetTracer in the hot path for span creation/recording (although this is not recommended if performance is important). We can assume that repeated calls to GetTracer will continue to fail after the first occurrence.

Looking at the examples highlights a common pattern that exercises the worst case where a failure in GetTracer will continue to repeat the exceptional path. This would mean an exception is thrown, caught, and logged in the hot path for span recording.

See: examples/common/foo_library/foo_library.cc#L30

  auto span = trace::Provider::GetTracerProvider()->GetTracer("foo_library")->StartSpan("f1");

There are a few options to consider in addressing this:

1. Do not support a recovery path
   • Once an exception is thrown and handled in GetTracer then the TracerProvider is assumed to be non functional and any later calls to GetTracer should fail immediately and return a noop tracer.
2. Support recovery on configuration change
   • The spec requires that if configuration updates are supported then any configuration update must apply to all previously retrieved tracers.
   • We could take this to mean that if GetTracer ever fails and returns a noop tracer, that tracer should later be recovered and become functional if UpdateTracerConfigurator is called with a configurator that resolves the issue. This could make sense for the throwing configurator case (replace the bad configurator), but does not address the bad_alloc case or others.

Let's consider option 2 out of scope for this PR due to complexity and since it cannot address all cases where GetTracer fails.

Please consider option 1 and not support a recovery path once GetTracer fails.