Page MenuHomePhabricator
Create Task
Maniphest T124367

User::loadFromSession called before the end of Setup.php
Closed, ResolvedPublicPRODUCTION ERROR
Actions

Description

The session log channel has a bunch of these (about 100/sec). A lot of URLs that are loaded as assets (Special:CentralAutoLogin/*, Special:BannerLoader, Special:HideBanners, gadgets) but some normal pages as well. Mostly seems to come in batches: 5-10 log events with the same content and same uid.

Last 24 hours in Logstash: https://logstash.wikimedia.org/goto/c80940cd1442170eb706598fc54cdd06

As of December 2017: 240+ per day.

Details

SubjectRepoBranchLines +/-
CheckBlocksSecondaryAuthenticationProvider: Avoid user language during auto-creationmediawiki/coremaster+11 -1
AFPUserVisibleException should log in English, not the user's languagemediawiki/extensions/AbuseFilterwmf/1.28.0-wmf.11+19 -10
AFPUserVisibleException should log in English, not the user's languagemediawiki/extensions/AbuseFilterwmf/1.28.0-wmf.10+19 -10
AFPUserVisibleException should log in English, not the user's languagemediawiki/extensions/AbuseFiltermaster+19 -10
Don't try to use the context language when auto-creatingmediawiki/coremaster+1 -1
Avoid unstubbing $wgUser before the end of Setup.php in User::getBlockedStatus()mediawiki/coremaster+10 -4
Avoid unstubbing $wgUser when unsafe during filter failuresmediawiki/extensions/AbuseFiltermaster+7 -3
Avoid unstubbing $wgUser during AbortAutoAccount hookmediawiki/extensions/AbuseFiltermaster+1 -1
Add User::isSafeToLoad() and ParserOptions::newFromAnon()mediawiki/coremaster+22 -4
OutputPage: Don't get a ParserOptions for $wgUser before the end of Setup.phpmediawiki/coremaster+32 -1
Use stub threshold from ParserOptions when parsingmediawiki/coremaster+22 -15
Use the user who actually made the revision for onRevisionInsertCompletemediawiki/extensions/WikimediaEventsmaster+1 -1
MessageCache: Don't get a ParserOptions for $wgUser before the end of Setup.phpmediawiki/coremaster+11 -0
Log backtrace for "User::loadFromSession called before the end of Setup.php"mediawiki/corewmf/1.27.0-wmf.11+3 -1
Log backtrace for "User::loadFromSession called before the end of Setup.php"mediawiki/coremaster+3 -1
Show related patches Customize query in gerrit

Related Objects
Search...

StatusSubtypeAssignedTask
 Resolved• DeskanaT75616 Tracking: API/backend issues blocking Wikipedia app development
 ResolvedAnomieT32788 Allow triggering of user password reset email via the API
 OpenNoneT90925 General authentication improvements for MediaWiki
 ResolvedAnomieT48179 Allow a challenge stage during authentication
 OpenNoneT5709 Refactoring to make external authentication and identity systems easier
 ResolvedTgrT43201 UserLoadFromSession considered evil
 ResolvedAnomieT67493 Session is started by EditAction (problem for extensions using UserLoadFromSession hook)
 OpenFeatureNoneT55156 Provide option to force a login session to end within a certain time
 OpenNoneT89459 Modernize MediaWiki authentication system (AuthManager)
 ResolvedAnomieT123451 Deploy SessionManager and bot passwords
 ResolvedPRODUCTION ERRORNoneT124367 User::loadFromSession called before the end of Setup.php
 ResolvedPRODUCTION ERRORCatropeT139665 "User::loadFromSession called before the end of Setup.php" warning due to Echo
 ResolvedPRODUCTION ERRORNoneT151291 "User::loadFromSession called before the end of Setup.php" warning due to AbuseFilter
 ResolvedPRODUCTION ERRORUmherirrenderT151292 "User::loadFromSession called before the end of Setup.php" warning due to AntiSpoof
 ResolvedPRODUCTION ERRORAddshoreT177524 "User::loadFromSession called before the end of Setup.php" due to a combination of TwoColConflict and BetaFeatures
 ResolvedNoneT177590 New filters for edit review can't be opt-out on some wikis
 ResolvedPRODUCTION ERRORAnomieT240083 "User::loadFromSession called before the end of Setup.php" (violation by Wikibase/ULS) [Story Points 5]
 ResolvedUmherirrenderT267445 UserGetLanguageObjectHook is unsafe: "User::loadFromSession called before the end of Setup.php" [8H investigate]
 ResolvedPRODUCTION ERRORTgrT297855 Session user loaded before session set up in GrowthExperimentsMentorManager service

Event Timeline

There are a very large number of changes, so older changes are hidden. Show Older Changes
gerritbot added a comment.Feb 3 2016, 5:46 PM

Change 268174 had a related patch set uploaded (by Anomie):
Avoid unstubbing $wgUser before the end of Setup.php in User::getBlockedStatus()

https://gerrit.wikimedia.org/r/268174

gerritbot added a project: Patch-For-Review.Feb 3 2016, 5:46 PM
gerritbot added a comment.Feb 3 2016, 5:53 PM

Change 268177 had a related patch set uploaded (by Anomie):
Avoid unstubbing $wgUser during AbortAutoAccount hook

https://gerrit.wikimedia.org/r/268177

gerritbot added a comment.Feb 3 2016, 6:42 PM

Change 268184 had a related patch set uploaded (by Anomie):
Use stub threshold from ParserOptions when parsing

https://gerrit.wikimedia.org/r/268184

Anomie added a comment.Feb 3 2016, 7:57 PM

For the ones that include WikimediaEvents in the trace, I left a comment on https://gerrit.wikimedia.org/r/#/c/247512/. If that doesn't get a response, we should probably file a separate task for people who know what they're trying to do there to answer the question I asked.

gerritbot added a comment.Feb 3 2016, 8:59 PM

Change 268219 had a related patch set uploaded (by Anomie):
Add User::isSafeToLoad() and ParserOptions::newFromAnon()

https://gerrit.wikimedia.org/r/268219

gerritbot added a comment.Feb 3 2016, 9:00 PM

Change 268220 had a related patch set uploaded (by Anomie):
OutputPage: Don't get a ParserOptions for $wgUser before the end of Setup.php

https://gerrit.wikimedia.org/r/268220

gerritbot added a comment.Feb 3 2016, 9:08 PM

Change 268221 had a related patch set uploaded (by Anomie):
Avoid unstubbing $wgUser when unsafe during filter failures

https://gerrit.wikimedia.org/r/268221

gerritbot added a comment.Feb 3 2016, 9:27 PM

Change 268224 had a related patch set uploaded (by Anomie):
Use the user who actually made the revision for onRevisionInsertComplete

https://gerrit.wikimedia.org/r/268224

gerritbot added a comment.Feb 4 2016, 6:08 AM

Change 268219 merged by jenkins-bot:
Add User::isSafeToLoad() and ParserOptions::newFromAnon()

https://gerrit.wikimedia.org/r/268219

ReleaseTaggerBot added a project: MW-1.27-release (WMF-deploy-2016-02-09_(1.27.0-wmf.13)).Feb 4 2016, 8:01 AM
gerritbot added a comment.Feb 4 2016, 4:42 PM

Change 268174 merged by jenkins-bot:
Avoid unstubbing $wgUser before the end of Setup.php in User::getBlockedStatus()

https://gerrit.wikimedia.org/r/268174

gerritbot added a comment.Feb 5 2016, 5:08 PM

Change 268224 merged by jenkins-bot:
Use the user who actually made the revision for onRevisionInsertComplete

https://gerrit.wikimedia.org/r/268224

gerritbot added a comment.Feb 8 2016, 7:52 PM

Change 268184 merged by jenkins-bot:
Use stub threshold from ParserOptions when parsing

https://gerrit.wikimedia.org/r/268184

gerritbot added a comment.Feb 8 2016, 7:52 PM

Change 268177 merged by jenkins-bot:
Avoid unstubbing $wgUser during AbortAutoAccount hook

https://gerrit.wikimedia.org/r/268177

gerritbot added a comment.Feb 9 2016, 12:51 AM

Change 268220 merged by jenkins-bot:
OutputPage: Don't get a ParserOptions for $wgUser before the end of Setup.php

https://gerrit.wikimedia.org/r/268220

gerritbot added a comment.Feb 10 2016, 8:50 PM

Change 268221 merged by jenkins-bot:
Avoid unstubbing $wgUser when unsafe during filter failures

https://gerrit.wikimedia.org/r/268221

Anomie removed a project: Patch-For-Review.Feb 10 2016, 8:55 PM
bd808 triaged this task as Medium priority.Feb 11 2016, 2:08 AM
bd808 subscribed.
ReleaseTaggerBot added a project: MW-1.27-release (WMF-deploy-2016-03-01_(1.27.0-wmf.15)).Feb 16 2016, 4:02 PM
Krinkle mentioned this in T128394: Deprecate and remove User::isSafeToLoad.Feb 29 2016, 6:59 PM
• demon moved this task from Untriaged to Dec2019/1.35.wmf.10+ on the Wikimedia-production-error board.Mar 12 2016, 12:00 AM
Liuxinyu970226 subscribed.May 21 2016, 2:36 AM
gerritbot added a comment.Jun 13 2016, 4:53 PM

Change 294089 had a related patch set uploaded (by Anomie):
Don't try to use the context language when auto-creating

https://gerrit.wikimedia.org/r/294089

gerritbot added a project: Patch-For-Review.Jun 13 2016, 4:53 PM
gerritbot added a comment.Jun 13 2016, 7:19 PM

Change 294089 merged by jenkins-bot:
Don't try to use the context language when auto-creating

https://gerrit.wikimedia.org/r/294089

ReleaseTaggerBot added projects: MW-1.28-release-notes, MW-1.28-release (WMF-deploy-2016-06-14_(1.28.0-wmf.6)).Jun 13 2016, 8:00 PM
Anomie removed a project: Patch-For-Review.Jun 14 2016, 3:20 PM
• mmodell edited projects, added MW-1.28-release (WMF-deploy-2016-07-05_(1.28.0-wmf.9)); removed MW-1.28-release (WMF-deploy-2016-06-14_(1.28.0-wmf.6)), MW-1.27-release (WMF-deploy-2016-03-01_(1.27.0-wmf.15)), MW-1.27-release (WMF-deploy-2016-02-09_(1.27.0-wmf.13)), MW-1.27-release (WMF-deploy-2016-01-19_(1.27.0-wmf.11)), MW-1.27-release (WMF-deploy-2016-02-02_(1.27.0-wmf.12)).Jul 7 2016, 8:31 PM
• mmodell subscribed.

Still seeing this error in MW-1.28-release (WMF-deploy-2016-07-05_(1.28.0-wmf.9))

gerritbot added a comment.Jul 7 2016, 9:03 PM

Change 297903 had a related patch set uploaded (by Anomie):
AFPUserVisibleException should log in English, not the user's language

https://gerrit.wikimedia.org/r/297903

gerritbot added a project: Patch-For-Review.Jul 7 2016, 9:03 PM
Anomie added a comment.Jul 7 2016, 9:03 PM
In T124367#2439058, @mmodell wrote:

Still seeing this error in MW-1.28-release (WMF-deploy-2016-07-05_(1.28.0-wmf.9))

Current culprits:

  • Notifications has EchoHooks::onUserSaveSettings → MWEchoNotifUser::resetNotificationCount → MWEchoNotifUser::getForeignCount → MWEchoNotifUser::getForeignData → EchoForeignWikiRequest::execute → EchoForeignWikiRequest::getRequestParams → EchoForeignNotifications::getApiEndpoints→ EchoForeignNotifications::getWikiTitle → using a Message object without ensuring a valid language.
  • AbuseFilter has various paths that get to AFPUserVisibleException::__construct which uses a Message object without ensuring a valid language.

I have no idea how to fix the first one. The second seems easy enough.

Anomie created subtask T139665: "User::loadFromSession called before the end of Setup.php" warning due to Echo.Jul 7 2016, 9:12 PM
J5lx subscribed.Jul 17 2016, 12:29 PM
gerritbot added a comment.Jul 20 2016, 3:36 PM

Change 297903 merged by jenkins-bot:
AFPUserVisibleException should log in English, not the user's language

https://gerrit.wikimedia.org/r/297903

Anomie removed a project: Patch-For-Review.Jul 20 2016, 3:41 PM
gerritbot added a comment.Jul 20 2016, 3:53 PM

Change 300050 had a related patch set uploaded (by Chad):
AFPUserVisibleException should log in English, not the user's language

https://gerrit.wikimedia.org/r/300050

gerritbot added a project: Patch-For-Review.Jul 20 2016, 3:53 PM

Change 300051 had a related patch set uploaded (by Chad):
AFPUserVisibleException should log in English, not the user's language

https://gerrit.wikimedia.org/r/300051

ReleaseTaggerBot added a project: MW-1.28-release (WMF-deploy-2016-07-26_(1.28.0-wmf.12)).Jul 20 2016, 4:00 PM
gerritbot added a comment.Jul 20 2016, 4:12 PM

Change 300050 merged by jenkins-bot:
AFPUserVisibleException should log in English, not the user's language

https://gerrit.wikimedia.org/r/300050

gerritbot added a comment.Jul 20 2016, 4:13 PM

Change 300051 merged by jenkins-bot:
AFPUserVisibleException should log in English, not the user's language

https://gerrit.wikimedia.org/r/300051

Anomie removed a project: Patch-For-Review.Jul 20 2016, 4:15 PM
ReleaseTaggerBot added projects: MW-1.28-release (WMF-deploy-2016-07-19_(1.28.0-wmf.11)), MW-1.28-release (WMF-deploy-2016-07-12_(1.28.0-wmf.10)).Jul 20 2016, 5:00 PM
• jmatazzoni closed subtask T139665: "User::loadFromSession called before the end of Setup.php" warning due to Echo as Resolved.Jul 20 2016, 8:57 PM
Tgr added a subtask: T151291: "User::loadFromSession called before the end of Setup.php" warning due to AbuseFilter.Nov 22 2016, 5:02 AM
Tgr added a subtask: T151292: "User::loadFromSession called before the end of Setup.php" warning due to AntiSpoof.Nov 22 2016, 5:07 AM
Tgr updated the task description. (Show Details)
• NHarateh_WMF edited projects, added Product-Infrastructure-Team-Backlog-Deprecated; removed MW-1.28-release (WMF-deploy-2016-07-12_(1.28.0-wmf.10)), MW-1.28-release (WMF-deploy-2016-07-19_(1.28.0-wmf.11)), MW-1.28-release (WMF-deploy-2016-07-26_(1.28.0-wmf.12)).Apr 25 2017, 12:42 PM
• NHarateh_WMF moved this task from Needs triage to Backlog on the Product-Infrastructure-Team-Backlog-Deprecated board.Apr 25 2017, 12:45 PM
Tgr edited projects, added User-Tgr; removed Product-Infrastructure-Team-Backlog-Deprecated, Reading-Infrastructure-Team-Old (Don't use).May 2 2017, 2:13 PM
Anomie mentioned this in T177478: Unable to change user settings.Oct 5 2017, 6:02 PM
Anomie created subtask T177524: "User::loadFromSession called before the end of Setup.php" due to a combination of TwoColConflict and BetaFeatures.Oct 5 2017, 6:30 PM
gerritbot added a comment.Oct 5 2017, 7:05 PM

Change 382517 had a related patch set uploaded (by Anomie; owner: Anomie):
[mediawiki/core@master] CheckBlocksSecondaryAuthenticationProvider: Avoid user language during auto-creation

https://gerrit.wikimedia.org/r/382517

gerritbot added a project: Patch-For-Review.Oct 5 2017, 7:05 PM
Addshore closed subtask T177524: "User::loadFromSession called before the end of Setup.php" due to a combination of TwoColConflict and BetaFeatures as Resolved.Oct 9 2017, 3:47 PM
gerritbot added a comment.Oct 26 2017, 10:44 PM

Change 382517 merged by jenkins-bot:
[mediawiki/core@master] CheckBlocksSecondaryAuthenticationProvider: Avoid user language during auto-creation

https://gerrit.wikimedia.org/r/382517

Tgr added a comment.Oct 27 2017, 12:38 AM

There are some pretty crazy spikes in the logs.

spike.png (203×1 px, 31 KB)

Tgr added a comment.Oct 27 2017, 12:40 AM

Oh, okay, that was the TwoColConflict revert.

ReleaseTaggerBot added a project: MW-1.31-release-notes (WMF-deploy-2017-10-31 (1.31.0-wmf.6)).Oct 30 2017, 5:01 PM
Krinkle removed projects: MW-1.31-release-notes (WMF-deploy-2017-10-31 (1.31.0-wmf.6)), Patch-For-Review, MW-1.28-release (WMF-deploy-2016-07-05_(1.28.0-wmf.9)), MW-1.28-release-notes, MW-1.27-release-notes.Dec 2 2017, 1:59 AM
Krinkle updated the task description. (Show Details)Dec 2 2017, 2:19 AM
Krinkle subscribed.

As of December 2017: 240+ per day.

Most are triggered during regular page views, via:

WebStart
 > AuthManager->autoCreateUser
 > AbuseFilterPreAuthenticationProvider
 > ...
 > Parser->parse
 > ...
 > StubUserLang->_newObject
 > RequestContext->getLanguage
 > User->getOption
 > ...
 > User->load
Krinkle added a project: AbuseFilter.Dec 2 2017, 2:21 AM
Anomie removed a project: AbuseFilter.Dec 4 2017, 9:29 PM

A subtask already exists for AbuseFilter: T151291: "User::loadFromSession called before the end of Setup.php" warning due to AbuseFilter

Krinkle moved this task from Dec2019/1.35.wmf.10+ to Apr 2019 / 1.33.wmf.25+ on the Wikimedia-production-error board.Sep 16 2018, 7:53 PM
Krinkle moved this task from Apr 2019 / 1.33.wmf.25+ to Mar 2021 on the Wikimedia-production-error board.

Okay, moving the tracking task to Meta in that case.

• mmodell changed the subtype of this task from "Task" to "Production Error".Aug 28 2019, 11:11 PM
Krinkle removed a project: Wikimedia-production-error.Mar 24 2020, 9:05 PM
Aklapper removed a subscriber: Anomie.Oct 16 2020, 5:02 PM
Krinkle added a subtask: T240083: "User::loadFromSession called before the end of Setup.php" (violation by Wikibase/ULS) [Story Points 5].Nov 6 2020, 9:35 PM
Krinkle added a subtask: T267445: UserGetLanguageObjectHook is unsafe: "User::loadFromSession called before the end of Setup.php" [8H investigate].Nov 6 2020, 9:39 PM
Umherirrender closed subtask T151291: "User::loadFromSession called before the end of Setup.php" warning due to AbuseFilter as Resolved.Feb 18 2021, 9:10 PM
Umherirrender closed subtask T151292: "User::loadFromSession called before the end of Setup.php" warning due to AntiSpoof as Resolved.Feb 27 2021, 9:24 PM
Umherirrender subscribed.Mar 2 2021, 8:07 PM

Is this bug still an issue or just stay open for similar kind of errors?

For the last error was a new task open: T267445
I would suggest to close this and use new tasks if there are still issues to get fresh stack traces to look at.

Umherirrender closed subtask T267445: UserGetLanguageObjectHook is unsafe: "User::loadFromSession called before the end of Setup.php" [8H investigate] as Resolved.Mar 6 2021, 3:16 PM
Aklapper closed this task as Resolved.Jul 18 2021, 1:02 PM
In T124367#6876164, @Umherirrender wrote:

I would suggest to close this and use new tasks if there are still issues to get fresh stack traces to look at.

No reply. Boldly closing.

Tgr reopened this task as Open.Jul 18 2021, 3:39 PM

Still happens a few hundres times an hour.

• Nikerabbit reopened subtask T267445: UserGetLanguageObjectHook is unsafe: "User::loadFromSession called before the end of Setup.php" [8H investigate] as Open.Sep 27 2021, 9:18 AM
Umherirrender closed subtask T267445: UserGetLanguageObjectHook is unsafe: "User::loadFromSession called before the end of Setup.php" [8H investigate] as Resolved.Dec 9 2021, 12:10 PM
Tgr added a subtask: T297855: Session user loaded before session set up in GrowthExperimentsMentorManager service.Dec 16 2021, 3:42 AM
Etonkovidova subscribed.Dec 21 2021, 2:13 AM

I filed T298068: Exception: User::loadFromSession called before the end of Setup.php - it's still happening ~1,000 per hour.

Umherirrender closed this task as Resolved.Dec 28 2021, 11:11 AM
In T124367#7219824, @Tgr wrote:

Still happens a few hundres times an hour.

Please create fresh task with a fresh stacktrace.
The same error message can have different issues and needs to be tracked separated.

Etonkovidova closed subtask T297855: Session user loaded before session set up in GrowthExperimentsMentorManager service as Resolved.Jan 21 2022, 1:59 AM
Content licensed under Creative Commons Attribution-ShareAlike (CC BY-SA) 4.0 unless otherwise noted; code licensed under GNU General Public License (GPL) 2.0 or later and other open source licenses. By using this site, you agree to the Terms of Use, Privacy Policy, and Code of Conduct. · Wikimedia Foundation · Privacy Policy · Code of Conduct · Terms of Use · Disclaimer · CC-BY-SA · GPL · Credits