Skip to content

fix(core): [Callback Errors 6] Handle profilesSampler failures - #6164

Merged
adinauer merged 4 commits into
fix/callback-error-handlingfrom
fix/callback-error-handling-profiles-sampler
Oct 8, 2026
Merged

adinauer merged 4 commits into
fix/callback-error-handlingfrom
fix/callback-error-handling-profiles-sampler

Conversation

@adinauer

@adinauer adinauer commented Sep 24, 2026 •

Copy link
Copy Markdown
Member

PR Stack (Callback Errors)


📜 Description

Disable profiling when profilesSampler throws, without changing trace sampling. Skip the configured profilesSampleRate and do not inherit a parent's profiling decision after callback failure.

The parent path preserves the trace sampling decision, trace sample rate, and sample-random value, including backfilling when needed. It does not mutate the original parent decision. A callback deliberately returning null still uses the existing fallback behavior. Error logging and catch types are unchanged.

If tracesSampler also throws, the failure behavior from #6163 disables both tracing and profiling regardless of the parent's decision. Its immediate callback_error reports and accepted duplicate sampling-loss reports remain unchanged.

💡 Motivation and Context

A failed profiling callback must not enable profiling through a static rate or parent inheritance. Returning the parent's entire sampling decision would bypass the local failure result and could re-enable profiling, so the failure path retains only the parent's trace fields.

💚 How did you test it?

  • ./gradlew spotlessApply apiDump
  • Original focused validation passed 395 tests; all four original regression tests failed before the production fix and passed afterward.
  • After merging the updated fix(core): [Callback Errors 5] Handle tracesSampler failures #6163, reran TracesSamplerTest, ScopesTest, OpenTelemetry SentrySamplerTest, and the core API check successfully.
  • Covered absent/zero/full static profile rates with zero sample-random value, a working trace sampler after profiling failure, sampled and unsampled parents, and both samplers failing despite a sampled parent.
  • Updated existing null-result tests to invoke callbacks actually returning null.
  • After merge-forward through fix(integrations): [Callback Errors 9] Guard custom callbacks #6167, 3,814 core/OpenTelemetry tests passed, along with formatting and API checks.

📝 Checklist

  • I added GH Issue ID & Linear ID
  • I added tests to verify the changes.
  • No new PII added or SDK only sends newly added PII if sendDefaultPII is enabled.
  • I updated the docs if needed.
  • I updated the wizard if needed.
  • Review from the native team if needed.
  • No breaking change or entry added to the changelog.
  • No breaking change for hybrid SDKs or communicated to hybrid SDKs.
  • Public API changes reviewed by another Mobile SDK team member or implemented according to the develop docs spec.

🔮 Next steps

Profile discard accounting is handled separately in #6166. Profile/replay artifact cleanup remains a follow-up. The broader callback-boundary catch-type changes remain deferred to the next major.

⚠️ Merge this PR using a merge commit (not squash). Only the collection branch is squash-merged into main.

Disable profiling when profilesSampler throws instead of applying the
static profilesSampleRate or inheriting a parent profiling decision.
Preserve trace sampling metadata and normal null-result fallback.

Cover static-rate bypass, parent inheritance, and failures in both
samplers without changing existing catch types.

Refs #6081

Co-Authored-By: Claude <noreply@anthropic.com>
@sentry

sentry Bot commented Sep 24, 2026 •

Copy link
Copy Markdown

📲 Install Builds

Android

🔗 App Name App ID Version Configuration
SDK Size io.sentry.tests.size 8.59.0 (1) release

⚙️ sentry-android Build Distribution Settings

Link the profilesSampler failure handling entry to #6164 in the callback
error handling stack.
Merge the updated tracesSampler failure behavior from #6163 into #6164.
Preserve profile-sampler isolation and update the combined-failure test to
expect tracing and profiling to be disabled, even with a sampled parent.

Refs #6163
Refs #6164
Co-Authored-By: Claude <noreply@anthropic.com>
adinauer added a commit that referenced this pull request Sep 25, 2026
Merge #6164 forward into #6165 without rewriting stack history.
Retain replay sampling changes and the updated trace-sampler changelog.

Refs #6165
Co-Authored-By: Claude <noreply@anthropic.com>
Propagate the latest main and preceding callback error changes through the stacked pull request.

Co-Authored-By: Claude <noreply@anthropic.com>
Base automatically changed from fix/callback-error-handling-traces-sampler to fix/callback-error-handling October 8, 2026 10:54
@adinauer
adinauer marked this pull request as ready for review October 8, 2026 10:54
@adinauer
adinauer merged commit 5b0d221 into fix/callback-error-handling Oct 8, 2026
65 of 68 checks passed
@adinauer
adinauer deleted the fix/callback-error-handling-profiles-sampler branch October 8, 2026 10:54
@github-actions

github-actions Bot commented Oct 8, 2026

Copy link
Copy Markdown
Contributor
Fails
🚫 Please consider adding a changelog entry for the next release.

Instructions and example for changelog

Please add an entry to CHANGELOG.md to the "Unreleased" section. Make sure the entry includes this PR's number.

Example:

## Unreleased

### Fixes

- [Callback Errors 6] Handle profilesSampler failures ([#6164](https://github.com/getsentry/sentry-java/pull/6164))

If none of the above apply, you can opt out of this check by adding #skip-changelog to the PR description or adding a skip-changelog label.

Generated by 🚫 dangerJS against 97cd7e2

adinauer added a commit that referenced this pull request Oct 13, 2026
* collection: callback error handling

* fix(core): [Callback Errors 1] Report callback failures

Add the callback_error discard reason and use it when a beforeSend callback throws. Preserve before_send for callbacks that intentionally return null and retain item, span, and byte accounting.

Refs #6081
Co-Authored-By: Claude <noreply@anthropic.com>

* fix(core): [Callback Errors 2] Drop failed processor data

Stop processing and drop telemetry when an event processor throws. Record callback_error outcomes for every supported category instead of sending potentially partially processed data.

Refs #6081
Co-Authored-By: Claude <noreply@anthropic.com>

* fix(core): [Callback Errors 3] Drop failed breadcrumbs

Drop breadcrumbs when beforeBreadcrumb throws instead of storing the breadcrumb with exception details. Keep observer state unchanged and release the callback reentrancy guard for later additions.

Refs #6081
Co-Authored-By: Claude <noreply@anthropic.com>

* ref(core): [Callback Errors 2] Mark SDK-owned event processors

Add an internal marker to SDK event processors across core and integrations.
Keep customer processors and the backfilling marker independent so later
callback handling can distinguish ownership regardless of registration path.

Leave exception handling unchanged in this preparatory change.

Refs #6081
Co-Authored-By: Claude <noreply@anthropic.com>

* fix(core): [Callback Errors 3] Preserve SDK processor data

Use the internal processor marker to continue processing after SDK-owned
processor failures without recording callback_error losses. Keep customer
processor failures fail-closed across events, transactions, replays,
feedback, logs, and metrics.

Cover scope and options registration, continued callbacks and delivery,
logging without discard notifications, intentional drops, and span loss
accounting. Clarify the customer-only failure policy in the changelog.

Refs #6081
Co-Authored-By: Claude <noreply@anthropic.com>

* fix(core): [Callback Errors 5] Handle tracesSampler failures

Inherit the parent sampling decision when tracesSampler throws. Without a
parent decision, leave the trace unsampled instead of applying the static
tracesSampleRate, which can override the failed sampling policy.

Keep normal null-result fallback, profiling callbacks, and catch types
unchanged. Cover parent inheritance, backfilling, and static-rate bypass.

Refs #6081

Co-Authored-By: Claude <noreply@anthropic.com>

* changelog

Link the tracesSampler failure fallback entry to #6163 in the callback
error handling stack.

* fix(core): [Callback Errors 6] Handle profilesSampler failures

Disable profiling when profilesSampler throws instead of applying the
static profilesSampleRate or inheriting a parent profiling decision.
Preserve trace sampling metadata and normal null-result fallback.

Cover static-rate bypass, parent inheritance, and failures in both
samplers without changing existing catch types.

Refs #6081

Co-Authored-By: Claude <noreply@anthropic.com>

* changelog

Link the profilesSampler failure handling entry to #6164 in the callback
error handling stack.

* fix(core): [Callback Errors 7] Handle replay sampling failures

Skip replay capture when beforeErrorSampling throws instead of capturing
replay after a failed user filter. Continue sending the error event and
retain existing exception logging and catch types.

Cover handled errors, crashes, and successful replay capture after a
previous callback failure. Verify error delivery and failure logging.

Refs #6081
Co-Authored-By: Claude <noreply@anthropic.com>

* changelog

Link the beforeErrorSampling failure entry to PR #6165.

Co-Authored-By: Claude <noreply@anthropic.com>

* fix(core): [Callback Errors 8] Report dropped profiles

Record callback_error/profile when beforeSendTransaction or a customer
transaction processor throws and an attached profile is dropped. Notify
OnDiscardCallback through the same client-report accounting path.

Cover scope and options processors, absent profiles, and SDK processor
failures that retain profiles. Leave catch types, intentional drops,
and profile-file cleanup unchanged.

Refs #6081
Co-Authored-By: Claude <noreply@anthropic.com>

* changelog

Link the transaction profile loss accounting entry to PR #6166.

Co-Authored-By: Claude <noreply@anthropic.com>

* fix(integrations): [Callback Errors 9] Guard custom callbacks

Skip Android screenshot and view hierarchy capture when their callbacks
throw, while retaining the error event. Drop spans on beforeSpan failures
in OkHttp, OpenFeign, GraphQL, Ktor, and Apollo without disrupting requests
or replacing the original request error.

Preserve normal callback results and existing catch types. Finish failed
spans and retain request cleanup and breadcrumbs.

Add regression coverage for callback failures, partial mutations, original
request errors, asynchronous GraphQL results, and subsequent Android
captures. Correct callback wiring in the Ktor and screenshot test fixtures.

Verify 18 regression cases fail before the fix and pass afterward; all 454
tests in the affected suites pass, along with formatting and API checks.

Refs #6081

Co-Authored-By: Claude <noreply@anthropic.com>

* changelog

Link the Android capture and integration beforeSpan callback fixes to
Callback Errors 9 (#6167).

Co-Authored-By: Claude <noreply@anthropic.com>

* fix(core): Drop transactions when tracesSampler fails

Replace parent-decision fallback after tracesSampler errors with an
unsampled decision and callback_error reports for the transaction and
root span. Preserve deliberate null-result fallback and existing catches.

Report callback errors directly in the sampler and retain existing
sample_rate and backpressure accounting, accepting duplicate loss reports
instead of adding discard-reason propagation. Cover core and OpenTelemetry
paths with regression tests and update the changelog.

Refs #6163
Co-Authored-By: Claude <noreply@anthropic.com>

* fix(integrations): Report beforeSpan callback losses

Record callback_error/span when a throwing beforeSpan callback drops a
sampled span in OkHttp, OpenFeign, GraphQL, Ktor, and Apollo. Use the
pre-callback sampling decision so partial callback mutations do not hide
losses, and leave unsampled spans and intentional null drops uncounted.

Add regression coverage for discard notifications, sampling states, and
intentional drops while preserving request and span completion behavior.

Refs #6167
Co-Authored-By: Claude <noreply@anthropic.com>

* docs(core): Document SDK backfilling processor marker

Clarify that SDK-owned backfilling processors must also use the Sentry
processor marker so callback error handling can identify their ownership.

Refs #6081
Co-Authored-By: Claude <noreply@anthropic.com>

* fix: Report profiles dropped with transactions

Record attached profiles as lost when transaction event processors or
beforeSendTransaction intentionally discard the transaction. Keep client
reports and discard callbacks aligned with dropped profile payloads.

Co-Authored-By: Claude <noreply@anthropic.com>

* fix(core): Report replay sampling callback errors

Record callback_error/replay when beforeErrorSampling throws while the replay
controller has an active replay ID. Do not report a loss when no replay is active.

Refs GH-6081
Co-Authored-By: Claude <noreply@anthropic.com>

* fix(apollo5): Handle beforeSpan callback failures

Drop spans when the Apollo 5 beforeSpan callback throws while preserving the GraphQL response. Report sampled spans as callback errors so client reports and discard callbacks remain accurate.

Co-Authored-By: Claude <noreply@anthropic.com>

* changelog

* fix(android): Handle feedback configurator failures

Keep the feedback form usable when an options configuration callback throws. Apply callback changes transactionally so partially mutated feedback options are discarded.

Co-Authored-By: Claude <noreply@anthropic.com>

* changelog

* fix(spring): Handle user provider failures

Keep requests running when a Spring user provider throws. Continue invoking later providers, but discard all provider-derived identity and install an empty user so inherited identity cannot leak into the event.

Co-Authored-By: Claude <noreply@anthropic.com>

* changelog

* fix(spring): Handle transaction name provider failures

Keep Spring requests and event capture running when a transaction name provider
throws. Use an unlabeled custom transaction as the privacy-safe fallback and
continue to later providers when resolving combined names.

Apply the same behavior across the Spring, Spring Jakarta, and Spring 7
integrations.

Co-Authored-By: Claude <noreply@anthropic.com>

* changelog

* test(apollo): Fix callback test lint violations

Use Kotlin's error helper in callback failure tests so Detekt accepts the
intentional IllegalStateException across Apollo 2, 3, and 4.

Co-Authored-By: Claude <noreply@anthropic.com>

* fix(spring): Include user provider name in error log

Identify which SentryUserProvider failed when multiple providers are configured, making callback failures actionable across all Spring variants.

Refs GH-6240
Co-Authored-By: Claude <noreply@anthropic.com>

* test(android): Verify configurator runs after configuration failure

Ensure a failed legacy configuration does not prevent the configurator
from receiving the original feedback options and applying its changes.

Co-Authored-By: Claude <noreply@anthropic.com>

* test(android): Verify configurator propagates fatal errors

Ensure fatal errors from the feedback options configurator are rethrown
instead of being handled as recoverable callback failures.

Co-Authored-By: Claude <noreply@anthropic.com>

* docs(changelog): Consolidate callback error fixes

Move the callback error handling entry back to Unreleased and group the related changes by impact so the full behavior change is documented in one place.

Co-Authored-By: Claude <noreply@anthropic.com>

* fix(callbacks): Handle nonfatal callback throwables

Catch nonfatal Throwable failures from newly guarded customer callbacks while continuing to propagate fatal JVM errors. This keeps callback isolation consistent without introducing new fatal-error swallowing.

Add regression coverage for nonfatal fallback behavior and fatal error propagation across the affected integrations.

Refs #6081

Co-Authored-By: Claude <noreply@anthropic.com>

* changelog

* fix(callbacks): Preserve Apollo 2 error handling

Keep Apollo 2's existing Exception boundary unchanged so non-Exception errors retain their released behavior. Limit the broader nonfatal Throwable handling to callback guards introduced by the unreleased stack.

Refs #6081

Co-Authored-By: Claude <noreply@anthropic.com>

---------

Co-authored-by: Claude <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants