Page MenuHomePhabricator

Special:Block form throws fatal error when re-loading with an error message
Closed, ResolvedPublic

Description

PHP fatal error thrown when user tried to block themselves on testwiki.

Request ID: XJj4lgpAME0AABZJCikAAABE
Message: PHP Fatal Error: infinite recursion detected

#0 /srv/mediawiki/php-1.33.0-wmf.22/vendor/oojs/oojs-ui/php/Tag.php(186): array_search(OOUI\Tag, array)
#1 /srv/mediawiki/php-1.33.0-wmf.22/vendor/oojs/oojs-ui/php/Tag.php(218): OOUI\Tag->removeContent(array)
#2 /srv/mediawiki/php-1.33.0-wmf.22/vendor/oojs/oojs-ui/php/layouts/FieldLayout.php(154): OOUI\Tag->appendContent(OOUI\Tag)
#3 /srv/mediawiki/php-1.33.0-wmf.22/includes/htmlform/OOUIHTMLForm.php(275): OOUI\FieldLayout->__construct(OOUI\Widget, array)
#4 /srv/mediawiki/php-1.33.0-wmf.22/includes/htmlform/HTMLForm.php(1040): OOUIHTMLForm->getBody()
#5 /srv/mediawiki/php-1.33.0-wmf.22/includes/htmlform/HTMLForm.php(1019): HTMLForm->getHTML(array)
#6 /srv/mediawiki/php-1.33.0-wmf.22/includes/htmlform/HTMLForm.php(573): HTMLForm->displayForm(array)
#7 /srv/mediawiki/php-1.33.0-wmf.22/includes/specialpage/FormSpecialPage.php(184): HTMLForm->show()
#8 /srv/mediawiki/php-1.33.0-wmf.22/includes/specialpage/SpecialPage.php(569): FormSpecialPage->execute(NULL)
#9 /srv/mediawiki/php-1.33.0-wmf.22/includes/specialpage/SpecialPageFactory.php(558): SpecialPage->run(NULL)
#10 /srv/mediawiki/php-1.33.0-wmf.22/includes/MediaWiki.php(288): MediaWiki\Special\SpecialPageFactory->executePath(Title, RequestContext)
#11 /srv/mediawiki/php-1.33.0-wmf.22/includes/MediaWiki.php(867): MediaWiki->performRequest()
#12 /srv/mediawiki/php-1.33.0-wmf.22/includes/MediaWiki.php(517): MediaWiki->main()
#13 /srv/mediawiki/php-1.33.0-wmf.22/index.php(42): MediaWiki->run()
#14 /srv/mediawiki/w/index.php(3): include(string)
#15 {main}

Reported by @dom_walden. After submitting the form on Special:Block, with the blocker's own username as the target, the page attempts to reload with an error message, but fails. Other submissions resulting in error messages did not fail (e.g. blocking an already-blocked user).

Event Timeline

Restricted Application added subscribers: MGChecker, Aklapper. · View Herald TranscriptMar 25 2019, 10:06 PM

Change 498999 had a related patch set uploaded (by Esanders; owner: Esanders):
[oojs/ui@master] Follow-up I2001ab7: Use strict comparison for array_search

https://gerrit.wikimedia.org/r/498999

The "infinite recursion" would suggest a circular reference between the Tag objects, which is possible because OOUI Tags aren't a proper DOM implementation.

My recent change to Tag#appendContent didn't use strict comparisons in array_search (which the patch above fixes), so appending a Tag to a list that already contains strings would try to cast that Tag to a string for a comparison. That seems to be the most likely cause of this exception, and I confirmed locally that appending a tag with a circular reference to another tag with string content causes a crash.

If that is the case then this patch will stop these exceptions, but the root cause is probably someone creating a tag with a circular reference, probably by assuming that OOUI Tags behave sensibly, which sadly they don't (yet).

CC'ing @matmarex to say "I told you so" because he didn't like my original patch...

Change 498999 merged by jenkins-bot:
[oojs/ui@master] Follow-up I2001ab7: Use strict comparison for array_search

https://gerrit.wikimedia.org/r/498999

Volker_E triaged this task as High priority.Mar 26 2019, 10:09 PM

Change 499353 had a related patch set uploaded (by Jforrester; owner: Jforrester):
[mediawiki/core@master] Update OOUI to v0.31.2

https://gerrit.wikimedia.org/r/499353

Tchanders edited projects, added Anti-Harassment (Vav — ו); removed Anti-Harassment.
Tchanders moved this task from Ready to QA/Testing on the Anti-Harassment (Vav — ו) board.

@dom_walden It sounds like nobody else has been able to reproduce this, so would be great to know if this fix works for you once it gets to testwiki.

Change 499353 merged by jenkins-bot:
[mediawiki/core@master] Update OOUI to v0.31.2

https://gerrit.wikimedia.org/r/499353

Tchanders moved this task from Review to QA/Testing on the Anti-Harassment (Zayin - ז) board.
Jdforrester-WMF added a subscriber: Jdforrester-WMF.

This patch landed in MediaWiki master in time for 1.33.0-wmf.24, which will go out to Wikimedia production from 2019-04-02.

I have not seen the original bug on https://en.wikipedia.beta.wmflabs.org, but I have come across another issue (T219737) preventing from successfully submitting blocks.

T219737 is now fixed, so...

On https://en.wikipedia.beta.wmflabs.org, I can successfully block myself, with and without JS.

I can also block myself via Special:Block/$my_user_name.

And I can successfully edit an existing block of my user.

I blocked myself with a variety of different parameters.

I provoked various validation issues (expiry time in past, non-existent page/namespace), in case there are other bugs related to error behaviour.

For regression, I blocked another user. I also attempted to block an already blocked user, and could change the block params after checking "Confirm block".

dbarratt closed this task as Resolved.Apr 2 2019, 4:24 PM
dbarratt claimed this task.
dbarratt removed dbarratt as the assignee of this task.
dbarratt added a subscriber: dbarratt.