Service changes should not result in fatal errors between patch or minor releases

Problem/Motivation

In Drupal 8, if a required argument is added to a service that is commonly used, the new version of the class won't get the parameter passed in until the container is updated.

This generally leads to errors like http://3v4l.org/J152X

Which looks like:

Additional uncaught exception thrown while handling exception.

Original

LogicException: A stray drupal_render() invocation with $is_root_call = TRUE is causing bubbling of attached assets to break. in Drupal\Core\Render\Renderer->doRender() (line 485 of /8.x/core/lib/Drupal/Core/Render/Renderer.php).

Drupal\Core\Render\Renderer->doRender(Array, 1)
Drupal\Core\Render\Renderer->render(Array, 1)
Drupal\Core\Render\BareHtmlPageRenderer->renderBarePage(Array, 'Error', 'maintenance_page', Array)
Drupal\Core\DependencyInjection\Container\prod\Drupal_Core_Render_BareHtmlPageRenderer_Proxy->renderBarePage(Array, 'Error', 'maintenance_page')
_drupal_log_error(Array, 1)
_drupal_error_handler_real(4096, 'Argument 5 passed to Drupal\Core\Asset\AssetResolver::__construct() must implement interface Drupal\Core\Language\LanguageManagerInterface, none given, called in /8.x/sites/default/files/php/service_container/service_container_prod/759a4eaeb2792b2d134b2c734defeaf3080d18246ad32c33fe50b1e88a83aa47.php on line 1117 and defined', '/8.x/core/lib/Drupal/Core/Asset/AssetResolver.php', 79, Array)
_drupal_error_handler(4096, 'Argument 5 passed to Drupal\Core\Asset\AssetResolver::__construct() must implement interface Drupal\Core\Language\LanguageManagerInterface, none given, called in 8.x/sites/default/files/php/service_container/service_container_prod/759a4eaeb2792b2d134b2c734defeaf3080d18246ad32c33fe50b1e88a83aa47.php on line 1117 and defined', '8.x/core/lib/Drupal/Core/Asset/AssetResolver.php', 79, Array)
Drupal\Core\Asset\AssetResolver->__construct(Object, Object, Object, Object)
Drupal\Core\DependencyInjection\Container\prod\service_container_prod->getAsset_ResolverService()
Symfony\Component\DependencyInjection\Container->get('asset.resolver')
Drupal::service('asset.resolver')
template_preprocess_html(Array, 'html', Array)
Drupal\Core\Theme\ThemeManager->theme('html', Array)
Drupal\Core\Theme\ThemeManager->render('html', Array)
Drupal\Core\Render\Renderer->doRender(Array, )
Drupal\Core\Render\Renderer->render(Array)
Drupal\Core\Render\BareHtmlPageRenderer->renderBarePage(Array, 'Error', 'maintenance_page', Array)
Drupal\Core\DependencyInjection\Container\prod\Drupal_Core_Render_BareHtmlPageRenderer_Proxy->renderBarePage(Array, 'Error', 'maintenance_page')
Drupal\Core\EventSubscriber\DefaultExceptionSubscriber->onHtml(Object)
Drupal\Core\EventSubscriber\DefaultExceptionSubscriber->onException(Object, 'kernel.exception', Object)
Drupal\Component\EventDispatcher\ContainerAwareEventDispatcher->dispatch('kernel.exception', Object)
Symfony\Component\HttpKernel\HttpKernel->handleException(Object, Object, 1)
Symfony\Component\HttpKernel\HttpKernel->handle(Object, 1, 1)
Drupal\Core\StackMiddleware\Session->handle(Object, 1, 1)
Drupal\Core\StackMiddleware\KernelPreHandle->handle(Object, 1, 1)
Drupal\Core\StackMiddleware\ReverseProxyMiddleware->handle(Object, 1, 1)
Drupal\Core\StackMiddleware\NegotiationMiddleware->handle(Object, 1, 1)
Stack\StackedHttpKernel->handle(Object, 1, 1)
Drupal\Core\DrupalKernel->handle(Object)
Additional

LogicException: A stray drupal_render() invocation with $is_root_call = TRUE is causing bubbling of attached assets to break. in Drupal\Core\Render\Renderer->doRender() (line 485 of 8.x/core/lib/Drupal/Core/Render/Renderer.php).

Drupal\Core\Render\Renderer->doRender(Array, 1)
Drupal\Core\Render\Renderer->render(Array, 1)
Drupal\Core\Render\BareHtmlPageRenderer->renderBarePage(Array, 'Error', 'maintenance_page', Array)
Drupal\Core\DependencyInjection\Container\prod\Drupal_Core_Render_BareHtmlPageRenderer_Proxy->renderBarePage(Array, 'Error', 'maintenance_page')
_drupal_log_error(Array, 1)
_drupal_error_handler_real(4096, 'Argument 5 passed to Drupal\Core\Asset\AssetResolver::__construct() must implement interface Drupal\Core\Language\LanguageManagerInterface, none given, called in /8.x/sites/default/files/php/service_container/service_container_prod/759a4eaeb2792b2d134b2c734defeaf3080d18246ad32c33fe50b1e88a83aa47.php on line 1117 and defined', '8.x/core/lib/Drupal/Core/Asset/AssetResolver.php', 79, Array)
_drupal_error_handler(4096, 'Argument 5 passed to Drupal\Core\Asset\AssetResolver::__construct() must implement interface Drupal\Core\Language\LanguageManagerInterface, none given, called in /8.x/sites/default/files/php/service_container/service_container_prod/759a4eaeb2792b2d134b2c734defeaf3080d18246ad32c33fe50b1e88a83aa47.php on line 1117 and defined', '8.x/core/lib/Drupal/Core/Asset/AssetResolver.php', 79, Array)
Drupal\Core\Asset\AssetResolver->__construct(Object, Object, Object, Object)
Drupal\Core\DependencyInjection\Container\prod\service_container_prod->getAsset_ResolverService()
Symfony\Component\DependencyInjection\Container->get('asset.resolver')
Drupal::service('asset.resolver')
template_preprocess_html(Array, 'html', Array)
Drupal\Core\Theme\ThemeManager->theme('html', Array)
Drupal\Core\Theme\ThemeManager->render('html', Array)
Drupal\Core\Render\Renderer->doRender(Array, )
Drupal\Core\Render\Renderer->render(Array)
Drupal\Core\Render\BareHtmlPageRenderer->renderBarePage(Array, 'Error', 'maintenance_page', Array)
Drupal\Core\DependencyInjection\Container\prod\Drupal_Core_Render_BareHtmlPageRenderer_Proxy->renderBarePage(Array, 'Error', 'maintenance_page')
_drupal_log_error(Array, 1)
_drupal_exception_handler(Object)
Drupal\Core\DrupalKernel->handleException(Object, Object, 1)
Drupal\Core\DrupalKernel->handle(Object)

This won't be fixed by running update.php - you have to run drush cr or rebuild.php first.

Also we just show a completely unthemed fatal error when this happens "Additional uncaught exception thrown while handling exception" - there is no hint of what goes on, and you can end up in the same situation due to bad code too.

In Drupal 7, certain core changes (changing the schema of the variables or node table, changing the contents of the system_info cache etc.) might result in fatal errors until update.php was run, however these were much rarer/exceptional situations.

Proposed resolution

There are several possible resolutions, we might want to do one or all of them:

1. Once the upgrade path is supported, completely disallow adding required arguments to service constructors. Default to NULL, remove typehints (turns a fatal to a warning), use setter injection, or use \Drupal:service(). This circumvents the problem at the cost of adding technical debt and would be a change people would need to get used to. Also it doesn't help when contrib change their services.

2. Base the container hash on the VERSION constant, so that both minor and patch versions immediately invalidate the container as soon as code is deployed. This immediately helps core (and contrib if updates are done at the same time as a core update). It won't help contrib updates done in isolation though.

3. Since the missing type hint is a catchable fatal error (or a TypeError exception in PHP 7), have a global try/catch for errors of this type, and when we hit one, invalidate the container, show a 503 and either automatically redirect to self (dawehner recommended doing so with a query parameter to prevent recursion) or show a link to reload. This would work for core, contrib, and people running development versions of core, but might be a bit messy.

4. Add an extra hash bit (in addition to VERSION) configurable from settings.php to allow people to do the equivalent of #2 manually for deployments.

Remaining tasks

User interface changes

API changes