Skip to content

Cancel pending merges when a key is deleted - #846

Open
sosek108 wants to merge 9 commits into
Expensify:mainfrom
callstack-internal:fix/cancel-pending-merges-on-delete
Open

sosek108 wants to merge 9 commits into
Expensify:mainfrom
callstack-internal:fix/cancel-pending-merges-on-delete

Conversation

@sosek108

@sosek108 sosek108 commented Sep 15, 2026

Copy link
Copy Markdown
Contributor

Details

Onyx.merge could resurrect a key that a concurrent deletion had removed, bringing back its pre-deletion contents.

Onyx.merge applies its delta to a value captured by an async OnyxUtils.get(key). Onyx.set and Onyx.multiSet cancel merges queued before them so the parked callback aborts. setCollection, mergeCollection and partialSetCollection never did, so an in-flight merge wrote its stale snapshot back with the delta on top. After cache.drop() the hasCacheForKey re-read from #817 cannot help, because the key is no longer cached.

Two fixes:

  1. The three collection writers cancel queued merges at their synchronous entry, before any await, so they discard only merges issued before the deleting call. Cancelling in the cache.drop() loop instead would also kill merges issued after the removal, which must win.
  2. The merge abort guard compares queue identity instead of nullishness, so a merge whose queue was cancelled and then repopulated by a later merge no longer applies that merge's deltas to its own stale snapshot.

Related Issues

Expensify/App#98073

Linked E/App PR

Expensify/App#101171

Automated Tests

Five tests in tests/unit/onyxTest.ts, added to the existing merge > concurrency with Onyx.update block. Each one parks OnyxUtils.get with createDeferredTask so the deletion lands first, and checks both the cache and storage.

Test Deletion path
should keep the key deleted when a pending merge read resolves after Onyx.update deleted it partialSetCollection
should keep the key deleted when a pending merge read resolves after mergeCollection deleted it mergeCollectionWithPatches
should keep the key deleted when a pending merge read resolves after setCollection dropped it setCollectionWithRetry
should not resurrect pre-deletion data when a merge is queued after the key was removed abort guard identity
should keep the key deleted when a single-key Onyx.update removal lands during a pending merge set

Manual Tests

The race is not manually reproducible without the instrumentation, so there are no direct reproduction steps to verify if the fix is working - we rely on unit testing. I propose these steps as regression verification:

  1. Go offline.
  2. Open a report with a split expense.
  3. Delete the split expense.
  4. Verify it does not reappear.
  5. Go back online and verify it stays deleted after the queued updates flush.

Author Checklist

  • I linked the correct issue in the ### Related Issues section above
  • I linked the corresponding Expensify/App PR in the ### Linked E/App PR section above, and verified this change against it (E/App CI passed and manual testing completed)
  • I wrote clear testing steps that cover the changes made in this PR
    • I added steps for local testing in the Tests section
    • I tested this PR with a High Traffic account against the staging or production API to ensure there are no regressions (e.g. long loading states that impact usability).
  • I included screenshots or videos for tests on all platforms
  • I ran the tests on all platforms & verified they passed on:
    • Android / native
    • Android / Chrome
    • iOS / native
    • iOS / Safari
    • MacOS / Chrome / Safari
  • I verified there are no console errors (if there's a console error not related to the PR, report it or open an issue for it to be fixed)
  • I followed proper code patterns (see Reviewing the code)
    • I verified that any callback methods that were added or modified are named for what the method does and never what callback they handle (i.e. toggleReport and not onIconClick)
    • I verified that the left part of a conditional rendering a React component is a boolean and NOT a string, e.g. myBool && <MyComponent />.
    • I verified that comments were added to code that is not self explanatory
    • I verified that any new or modified comments were clear, correct English, and explained "why" the code was doing something instead of only explaining "what" the code was doing.
    • I verified proper file naming conventions were followed for any new files or renamed files. All non-platform specific files are named after what they export and are not named "index.js". All platform-specific files are named for the platform the code supports as outlined in the README.
    • I verified the JSDocs style guidelines (in STYLE.md) were followed
  • If a new code pattern is added I verified it was agreed to be used by multiple Expensify engineers
  • I followed the guidelines as stated in the Review Guidelines
  • I tested other components that can be impacted by my changes (i.e. if the PR modifies a shared library or component like Avatar, I verified the components using Avatar are working as expected)
  • I verified all code is DRY (the PR doesn't include any logic written more than once, with the exception of tests)
  • I verified any variables that can be defined as constants (ie. in CONST.js or at the top of the file that uses the constant) are defined as such
  • I verified that if a function's arguments changed that all usages have also been updated correctly
  • If a new component is created I verified that:
    • A similar component doesn't exist in the codebase
    • All props are defined accurately and each prop has a /** comment above it */
    • The file is named correctly
    • The component has a clear name that is non-ambiguous and the purpose of the component can be inferred from the name alone
    • The only data being stored in the state is data necessary for rendering and nothing else
    • If we are not using the full Onyx data that we loaded, I've added the proper selector in order to ensure the component only re-renders when the data it is using changes
    • For Class Components, any internal methods passed to components event handlers are bound to this properly so there are no scoping issues (i.e. for onClick={this.submit} the method this.submit should be bound to this in the constructor)
    • Any internal methods bound to this are necessary to be bound (i.e. avoid this.submit = this.submit.bind(this); if this.submit is never passed to a component event handler like onClick)
    • All JSX used for rendering exists in the render method
    • The component has the minimum amount of code necessary for its purpose, and it is broken down into smaller components in order to separate concerns and functions
  • If any new file was added I verified that:
    • The file has a description of what it does and/or why is needed at the top of the file if the code is not self explanatory
  • If the PR modifies a generic component, I tested and verified that those changes do not break usages of that component in the rest of the App (i.e. if a shared library or component like Avatar is modified, I verified that Avatar is working as expected in all cases)
  • If the main branch was merged into this PR after a review, I tested again and verified the outcome was still expected according to the Test steps.
  • I have checked off every checkbox in the PR author checklist, including those that don't apply to this PR.

Screenshots/Videos

Android: Native
Android: mWeb Chrome
iOS: Native
iOS: mWeb Safari
MacOS: Chrome / Safari

@fabioh8010

Copy link
Copy Markdown
Contributor

@codex review

@sosek108

Copy link
Copy Markdown
Contributor Author

@codex review

@sosek108 sosek108 closed this Sep 18, 2026
@sosek108 sosek108 reopened this Sep 18, 2026
@sosek108

Copy link
Copy Markdown
Contributor Author

@MelvinBot review

@sosek108
sosek108 marked this pull request as ready for review September 18, 2026 17:57
@sosek108
sosek108 requested a review from a team as a code owner September 18, 2026 17:57
@melvin-bot
melvin-bot Bot requested review from grgia and removed request for a team September 18, 2026 17:57

@grgia grgia left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

NAB

Comment thread lib/OnyxUtils.ts
Comment on lines 1527 to 1544
for (const key of keysToRemove) {
const previousValue = cache.get(key);
cache.drop(key);

const collectionKey = OnyxKeys.getCollectionKey(key);
if (collectionKey && OnyxKeys.isCollectionMemberKey(collectionKey, key)) {
let batch = collectionBatches.get(collectionKey);
if (!batch) {
batch = {partial: {}, previous: {}};
collectionBatches.set(collectionKey, batch);
}
batch.partial[key] = undefined;
batch.previous[key] = previousValue;
} else if (!retryAttempt) {
// Skip subscriber notification on retry — already notified on attempt 0.
keyChanged(key, undefined);
}
}

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

NAB. should multiSetWithRetry also call cancelPendingMergesForKey for keysToRemove?

Data removed with Onyx.multiSet could come back if a merge on the same key was still in progress.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good catch, it was. Fixed in 68a9b7e.

@mountiny
mountiny requested a review from mkhutornyi September 21, 2026 16:39
@mountiny

Copy link
Copy Markdown
Contributor

@mkhutornyi can you please test the chnages in App? thanks

grgia
grgia previously approved these changes Sep 22, 2026
@mountiny

Copy link
Copy Markdown
Contributor

@mkhutornyi how is it looking?

@mkhutornyi

Copy link
Copy Markdown

Almost done

@mkhutornyi

Copy link
Copy Markdown

Reviewer Checklist

  • I have verified the author checklist is complete (all boxes are checked off).
  • I verified the correct issue is linked in the ### Fixed Issues section above
  • I verified testing steps are clear and they cover the changes made in this PR
    • I verified the steps for local testing are in the Tests section
    • I verified the steps for Staging and/or Production testing are in the QA steps section
    • I verified the steps cover any possible failure scenarios (i.e. verify an input displays the correct error message if the entered data is not correct)
    • I turned off my network connection and tested it while offline to ensure it matches the expected behavior (i.e. verify the default avatar icon is displayed if app is offline)
  • I checked that screenshots or videos are included for tests on all platforms
  • I included screenshots or videos for tests on all platforms
  • I verified that the composer does not automatically focus or open the keyboard on mobile unless explicitly intended. This includes checking that returning the app from the background does not unexpectedly open the keyboard.
  • I verified tests pass on all platforms & I tested again on:
    • Android: HybridApp
    • Android: mWeb Chrome
    • iOS: HybridApp
    • iOS: mWeb Safari
    • MacOS: Chrome / Safari
  • If there are any errors in the console that are unrelated to this PR, I either fixed them (preferred) or linked to where I reported them in Slack
  • I verified proper code patterns were followed (see Reviewing the code)
    • I verified that any callback methods that were added or modified are named for what the method does and never what callback they handle (i.e. toggleReport and not onIconClick).
    • I verified that comments were added to code that is not self explanatory
    • I verified that any new or modified comments were clear, correct English, and explained "why" the code was doing something instead of only explaining "what" the code was doing.
    • I verified any copy / text that was added to the app is grammatically correct in English. It adheres to proper capitalization guidelines (note: only the first word of header/labels should be capitalized), and is either coming verbatim from figma or has been approved by marketing (in order to get marketing approval, ask the Bug Zero team member to add the Waiting for copy label to the issue)
  • If a new code pattern is added I verified it was agreed to be used by multiple Expensify engineers
  • I verified that this PR follows the guidelines as stated in the Review Guidelines
  • I verified other components that can be impacted by these changes have been tested, and I retested again (i.e. if the PR modifies a shared library or component like Avatar, I verified the components using Avatar have been tested & I retested again)
  • If a new component is created I verified that:
    • A similar component doesn't exist in the codebase
    • All props are defined accurately and each prop has a /** comment above it */
    • The file is named correctly
    • The component has a clear name that is non-ambiguous and the purpose of the component can be inferred from the name alone
    • The only data being stored in the state is data necessary for rendering and nothing else
    • For Class Components, any internal methods passed to components event handlers are bound to this properly so there are no scoping issues (i.e. for onClick={this.submit} the method this.submit should be bound to this in the constructor)
    • Any internal methods bound to this are necessary to be bound (i.e. avoid this.submit = this.submit.bind(this); if this.submit is never passed to a component event handler like onClick)
    • All JSX used for rendering exists in the render method
    • The component has the minimum amount of code necessary for its purpose, and it is broken down into smaller components in order to separate concerns and functions
  • If any new file was added I verified that:
    • The file has a description of what it does and/or why is needed at the top of the file if the code is not self explanatory
  • If a new CSS style is added I verified that:
    • A similar style doesn't already exist
    • The style can't be created with an existing StyleUtils function (i.e. StyleUtils.getBackgroundAndBorderStyle(theme.componentBG)
  • If the PR modifies code that runs when editing or sending messages, I tested and verified there is no unexpected behavior for all supported markdown - URLs, single line code, code blocks, quotes, headings, bold, strikethrough, and italic.
  • If the PR modifies a generic component, I tested and verified that those changes do not break usages of that component in the rest of the App (i.e. if a shared library or component like Avatar is modified, I verified that Avatar is working as expected in all cases)
  • If the PR modifies a component related to any of the existing Storybook stories, I tested and verified all stories for that component are still working as expected.
  • If the PR modifies a component or page that can be accessed by a direct deeplink, I verified that the code functions as expected when the deeplink is used - from a logged in and logged out account.
  • If the PR modifies the UI (e.g. new buttons, new UI components, changing the padding/spacing/sizing, moving components, etc) or modifies the form input styles:
    • I verified that all the inputs inside a form are aligned with each other.
    • I added Design label and/or tagged @Expensify/design so the design team can review the changes.
  • For any bug fix or new feature in this PR, I verified that sufficient unit tests are included to prevent regressions in this flow.
  • If the main branch was merged into this PR after a review, I tested again and verified the outcome was still expected according to the Test steps.
  • I have checked off every checkbox in the PR reviewer checklist, including those that don't apply to this PR.

Screenshots/Videos

Android: HybridApp
Android: mWeb Chrome
iOS: HybridApp
ios.mov
iOS: mWeb Safari
MacOS: Chrome / Safari
web.mov

Comment thread tests/unit/onyxTest.ts
expect(await StorageMock.getItem(member1)).toEqual({itemA: {id: 'a', childID: '1'}});
});

it('should not cancel a merge that was queued after Onyx.clear() was called', async () => {

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

clear() still cancels merges queued after it when a merge for that key is already in flight

cancelPendingMerges guards on array reference identity, but merge() appends to the existing array instead of creating a new one when a merge for that key is already pending:

if (mergeQueue[key]) {
    mergeQueue[key].push(changes);   // same array -> identity still matches
    return mergeQueuePromise[key];
}

So the guard in cancelPendingMerges still matches and the post-clear() delta is dropped, while its promise resolves successfully and nothing is logged.

This is the new test case with the second merge moved before the first one drains:

  1. Park member1's OnyxUtils.get and OnyxUtils.getAllKeys (same mocks as that test).
  2. const firstMergePromise = Onyx.merge(member1, {itemA: {id: 'a'}}); — creates array qc1.
  3. const clearPromise = Onyx.clear(); then await waitForPromisesToResolve() — captures [[member1, qc1]] and parks on getAllKeys().
  4. const secondMergePromise = Onyx.merge(member1, {itemB: {id: 'b'}});without resolving firstGet first, so {itemB} is pushed onto qc1.
  5. deferredGetAllKeys.resolve(); await clearPromise;mergeQueue[member1] === qc1, so the whole array is cancelled.
  6. firstGet.resolve(); await Promise.all([firstMergePromise, secondMergePromise]);

Expected: cache.get(member1){itemB: {id: 'b'}}
Actual: cache.get(member1)undefined, storage null. Both merges dropped, both promises resolved.

The existing test passes only because it does firstGet.resolve(); await firstMergePromise; before issuing the second merge, which drains the queue and hands the second merge a fresh array.


Btw I found no user visible bug for this.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Added new test case and fixed this in 0eed0fd

Fix:

  • lib/OnyxUtils.ts: getPendingMergeEntries now also records each queue's length when clear() captures it. In cancelPendingMerges:
    • If the queue didn't grow, it's cancelled as before.
    • If it grew, only the pre-clear() changes are removed, and the queue is flagged in a WeakSet (hasStaleMergeRead).
  • lib/Onyx.ts: in the merge callback, a flagged queue uses undefined as its base instead of the stale valueFromGet. The cache still takes priority, as before.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants