Change 517403 had a related patch set uploaded (by Tchanders; owner: Tchanders):
[mediawiki/core@master] Filter out blocks with duplicate IDs when checking for blocks

https://gerrit.wikimedia.org/r/517403

Change 517403 merged by jenkins-bot:
[mediawiki/core@master] Filter out blocks with duplicate IDs when checking for blocks

https://gerrit.wikimedia.org/r/517403

I am in the process of testing this, and so far so good. The issue raised in T225872 (user block cookies) no longer occurs. Nor does its counterpart for IP block cookies.

I haven't seen any regressions so far.

One interesting(?) condition I'd like a second opinion on. @Niharika? @Tchanders?

Say I have: A block on $user which generates an autoblock on $ip.

If I have a cookie corresponding to the block on $user and am editing anonymously from $ip, I will see the "There are multiple blocks..." block message.

Arguably, this is the same (w.r.t. how we apply blocks) as being logged in as $user and editing from $ip, and so the message should be the same (i.e. just refer to the single block).

Perhaps a bit of an edge case. You would have to have been logged in as $user at some point to have the cookie set, and now be logged out trying to do things.

Change 518008 had a related patch set uploaded (by Tchanders; owner: Tchanders):
[mediawiki/core@master] Filter out duplicate autoblocks when checking for blocks

https://gerrit.wikimedia.org/r/518008

It seems worth fixing, since the block message will be more informative. In theory this problem could also arise in other ways; at the moment, autoblocks are only filtered out if they are found in the same database request as their parent block.

The new patch addresses this and chooses the original block over the autoblock.

Steps to trigger the bug (needs $wgCookieSetOnAutoblock = true):

1. set a sitewide block on <username>, with "Automatically block the last IP address used by this user, and any subsequent IP addresses they try to edit from" checked
2. log in as <username>
3. attempt to edit a page (you will see the correct block notice, identifying the block you just set)
4. log out, and attempt to edit the page again

Expected: see the correct block notice, identifying the block you just set
Actual: see the multiple block notice

Change 518008 merged by jenkins-bot:
[mediawiki/core@master] Filter out duplicate autoblocks when checking for blocks

https://gerrit.wikimedia.org/r/518008

Issue in T225919#5272162 no longer reproducible.

Logged in as a user with an autoblock only shows one block in the block message (with $wgCookieSetOnAutoblock on).

On a blocked IP only see one block in the block message (with $wgCookieSetOnIpBlock on).

Tested several other combinations of blocks which included cookie blocks (IP and auto blocks), checking the block messages that are displayed.

Tested that it de-duplicate auto blocks with the same parent and it applies all overlapping autoblocks that have different parents.

Also, for regression purposes, I paid attention to:
+ Are appropriate blocks are applied to user/IP (incl. system, global and cookie blocks)? Are any blocks getting ignored?
+ Are multiple system blocks getting applied at the same time?