Page MenuHomePhabricator

User::loadFromSession called before the end of Setup.php
Open, NormalPublic

Description

The session log channel has a bunch of these (about 100/sec). A lot of URLs that are loaded as assets (Special:CentralAutoLogin/*, Special:BannerLoader, Special:HideBanners, gadgets) but some normal pages as well. Mostly seems to come in batches: 5-10 log events with the same content and same uid.

Last 24 hours in Logstash: https://logstash.wikimedia.org/goto/c80940cd1442170eb706598fc54cdd06

As of December 2017: 240+ per day.

Related Objects

Event Timeline

There are a very large number of changes, so older changes are hidden. Show Older Changes
Tgr updated the task description. (Show Details)Jan 21 2016, 11:06 PM
Tgr raised the priority of this task from to Needs Triage.
Tgr added a subscriber: Tgr.
Restricted Application added subscribers: StudiesWorld, Aklapper. · View Herald TranscriptJan 21 2016, 11:06 PM

Change 266268 had a related patch set uploaded (by Anomie):
Log backtrace for "User::loadFromSession called before the end of Setup.php"

https://gerrit.wikimedia.org/r/266268

Change 266268 merged by jenkins-bot:
Log backtrace for "User::loadFromSession called before the end of Setup.php"

https://gerrit.wikimedia.org/r/266268

Change 266435 had a related patch set uploaded (by BryanDavis):
Log backtrace for "User::loadFromSession called before the end of Setup.php"

https://gerrit.wikimedia.org/r/266435

Anomie set Security to None.

Change 266435 merged by jenkins-bot:
Log backtrace for "User::loadFromSession called before the end of Setup.php"

https://gerrit.wikimedia.org/r/266435

Change 267319 had a related patch set uploaded (by Anomie):
MessageCache: Don't get a ParserOptions for $wgUser before the end of Setup.php

https://gerrit.wikimedia.org/r/267319

Anomie added a subscriber: Anomie.Jan 29 2016, 9:18 PM

P2544 is a summary of recent stack traces added in Gerrit change 266435 for people to start poking at.

Gerrit change 267319 is aimed at line 3.

Regarding line 2,

<anomie> tgr: So one culprit is auto-create → AbortAutoAccount → AbuseFilter → trying to see if $wgUser is logged in → needs to load from session → boom
<anomie> Can AbuseFilter just assume "no" if autocreating?
<tgr> why is AbuseFilter even implementing that hook?
<tgr> when it is a good idea to prevent autocreation of a local account for an existing central account?
<csteipp> tgr: Iirc, that was specifically for the case where vandals would create usernames that were blocked in one language on another wiki, then autocreate on the wiki where it was blocked. Those types of rules should all be global now.

Change 267319 merged by jenkins-bot:
MessageCache: Don't get a ParserOptions for $wgUser before the end of Setup.php

https://gerrit.wikimedia.org/r/267319

Change 268174 had a related patch set uploaded (by Anomie):
Avoid unstubbing $wgUser before the end of Setup.php in User::getBlockedStatus()

https://gerrit.wikimedia.org/r/268174

Change 268177 had a related patch set uploaded (by Anomie):
Avoid unstubbing $wgUser during AbortAutoAccount hook

https://gerrit.wikimedia.org/r/268177

Change 268184 had a related patch set uploaded (by Anomie):
Use stub threshold from ParserOptions when parsing

https://gerrit.wikimedia.org/r/268184

Anomie added a comment.Feb 3 2016, 7:57 PM

For the ones that include WikimediaEvents in the trace, I left a comment on https://gerrit.wikimedia.org/r/#/c/247512/. If that doesn't get a response, we should probably file a separate task for people who know what they're trying to do there to answer the question I asked.

Change 268219 had a related patch set uploaded (by Anomie):
Add User::isSafeToLoad() and ParserOptions::newFromAnon()

https://gerrit.wikimedia.org/r/268219

Change 268220 had a related patch set uploaded (by Anomie):
OutputPage: Don't get a ParserOptions for $wgUser before the end of Setup.php

https://gerrit.wikimedia.org/r/268220

Change 268221 had a related patch set uploaded (by Anomie):
Avoid unstubbing $wgUser when unsafe during filter failures

https://gerrit.wikimedia.org/r/268221

Change 268224 had a related patch set uploaded (by Anomie):
Use the user who actually made the revision for onRevisionInsertComplete

https://gerrit.wikimedia.org/r/268224

Change 268219 merged by jenkins-bot:
Add User::isSafeToLoad() and ParserOptions::newFromAnon()

https://gerrit.wikimedia.org/r/268219

Change 268174 merged by jenkins-bot:
Avoid unstubbing $wgUser before the end of Setup.php in User::getBlockedStatus()

https://gerrit.wikimedia.org/r/268174

Change 268224 merged by jenkins-bot:
Use the user who actually made the revision for onRevisionInsertComplete

https://gerrit.wikimedia.org/r/268224

Change 268184 merged by jenkins-bot:
Use stub threshold from ParserOptions when parsing

https://gerrit.wikimedia.org/r/268184

Change 268177 merged by jenkins-bot:
Avoid unstubbing $wgUser during AbortAutoAccount hook

https://gerrit.wikimedia.org/r/268177

Change 268220 merged by jenkins-bot:
OutputPage: Don't get a ParserOptions for $wgUser before the end of Setup.php

https://gerrit.wikimedia.org/r/268220

Change 268221 merged by jenkins-bot:
Avoid unstubbing $wgUser when unsafe during filter failures

https://gerrit.wikimedia.org/r/268221

bd808 triaged this task as Normal priority.Feb 11 2016, 2:08 AM
bd808 added a subscriber: bd808.

Change 294089 had a related patch set uploaded (by Anomie):
Don't try to use the context language when auto-creating

https://gerrit.wikimedia.org/r/294089

Change 294089 merged by jenkins-bot:
Don't try to use the context language when auto-creating

https://gerrit.wikimedia.org/r/294089

Change 297903 had a related patch set uploaded (by Anomie):
AFPUserVisibleException should log in English, not the user's language

https://gerrit.wikimedia.org/r/297903

Anomie added a comment.Jul 7 2016, 9:03 PM

Current culprits:

  • Notifications has EchoHooks::onUserSaveSettingsMWEchoNotifUser::resetNotificationCountMWEchoNotifUser::getForeignCountMWEchoNotifUser::getForeignDataEchoForeignWikiRequest::executeEchoForeignWikiRequest::getRequestParamsEchoForeignNotifications::getApiEndpointsEchoForeignNotifications::getWikiTitle → using a Message object without ensuring a valid language.
  • AbuseFilter has various paths that get to AFPUserVisibleException::__construct which uses a Message object without ensuring a valid language.

I have no idea how to fix the first one. The second seems easy enough.

J5lx added a subscriber: J5lx.Jul 17 2016, 12:29 PM

Change 297903 merged by jenkins-bot:
AFPUserVisibleException should log in English, not the user's language

https://gerrit.wikimedia.org/r/297903

Change 300050 had a related patch set uploaded (by Chad):
AFPUserVisibleException should log in English, not the user's language

https://gerrit.wikimedia.org/r/300050

Change 300051 had a related patch set uploaded (by Chad):
AFPUserVisibleException should log in English, not the user's language

https://gerrit.wikimedia.org/r/300051

Change 300050 merged by jenkins-bot:
AFPUserVisibleException should log in English, not the user's language

https://gerrit.wikimedia.org/r/300050

Change 300051 merged by jenkins-bot:
AFPUserVisibleException should log in English, not the user's language

https://gerrit.wikimedia.org/r/300051

Change 382517 had a related patch set uploaded (by Anomie; owner: Anomie):
[mediawiki/core@master] CheckBlocksSecondaryAuthenticationProvider: Avoid user language during auto-creation

https://gerrit.wikimedia.org/r/382517

Change 382517 merged by jenkins-bot:
[mediawiki/core@master] CheckBlocksSecondaryAuthenticationProvider: Avoid user language during auto-creation

https://gerrit.wikimedia.org/r/382517

Tgr added a comment.Oct 27 2017, 12:38 AM

There are some pretty crazy spikes in the logs.

Tgr added a comment.Oct 27 2017, 12:40 AM

Oh, okay, that was the TwoColConflict revert.

Krinkle updated the task description. (Show Details)Dec 2 2017, 2:19 AM
Krinkle added a subscriber: Krinkle.

As of December 2017: 240+ per day.

Most are triggered during regular page views, via:

WebStart
 > AuthManager->autoCreateUser
 > AbuseFilterPreAuthenticationProvider
 > ...
 > Parser->parse
 > ...
 > StubUserLang->_newObject
 > RequestContext->getLanguage
 > User->getOption
 > ...
 > User->load
Krinkle moved this task from Found during 1.34-wmf.1 to Meta on the Wikimedia-production-error board.

Okay, moving the tracking task to Meta in that case.