Problem/Motivation

The fix in #3576074: Current user is changed unexpectedly wraps doProcessAccessPolicies() in a child Fiber whenever processAccessPolicies() is called from inside an existing Fiber. The purpose of that Fiber is to contain the accountSwitcher->switchTo() call, but that switch only happens when the account being checked differs from the current user. When checking permissions for the current user, no switch occurs, so the Fiber serves no purpose.

The current condition:

if (!\Fiber::getCurrent()) {
  return $this->doProcessAccessPolicies($account, $scope);
}

means every hasPermission() call fired from within a Fiber (e.g. during placeholder/lazy-builder rendering) creates a child Fiber, even for current-user checks. On a typical page render the vast majority of permission checks are for the current user, so this adds up fast.

Adding a second short-circuit fixes it:

if (!\Fiber::getCurrent() || $account->id() === $this->currentUser->id()) {
  return $this->doProcessAccessPolicies($account, $scope);
}

Measured with xhprof on two separate Drupal 11 projects: on a typical page around 1,000 calls to processAccessPolicies() run per request, the vast majority for the current user. The fix eliminated those unnecessary Fibers, reducing Fiber::start count by ~90% per page and saving ~15–25ms per cold render. Not a dramatic number, but the Fibers don't seem justified for this code path.

Steps to reproduce

Proposed resolution

Update AccessPolicyProcessor::processAccessPolicies with the above condition.

Remaining tasks

?

User interface changes

None

Introduced terminology

None

API changes

None

Data model changes

None

Release notes snippet

None

Issue fork drupal-3593008

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

Comments

herved created an issue. See original summary.

herved’s picture

Status: Active » Needs review

I don't think a test is needed since this is already covered by AccessPolicyProcessorInFibersTest.

herved’s picture

Issue summary: View changes

catch made their first commit to this issue’s fork.

catch’s picture

Status: Needs review » Reviewed & tested by the community

Made and applied one comment suggestion on the MR, this good to me otherwise and nice find.

longwave’s picture

Version: main » 11.4.x-dev
Status: Reviewed & tested by the community » Fixed

Committed and pushed 29aa27ad2d2 to main and 10b65a8cc52 to 11.x and ca198966f5c to 11.4.x. Thanks!

Now that this issue is closed, review the contribution record.

As a contributor, attribute any organization that helped you, or if you volunteered your own time.

Maintainers, credit people who helped resolve this issue.

  • longwave committed ca198966 on 11.4.x
    fix: #3593008 AccessPolicyProcessor::processAccessPolicies() creates...

  • longwave committed 10b65a8c on 11.x
    fix: #3593008 AccessPolicyProcessor::processAccessPolicies() creates...

  • longwave committed 29aa27ad on main
    fix: #3593008 AccessPolicyProcessor::processAccessPolicies() creates...

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.