Fail gracefully when a change has an invalid server id

Do not throw a RunTimeException when there is a server id
mismatch detected in a change. Return null to highlight the fact
that the change cannot be read.

The project reindexing already excludes the null changes and thus
would not abort the indexing operation and will skip the invalid
ref.

Bug: Issue 12374
Change-Id: Ie348d59f1a09841e450ac902790b73b1102632cd

java/com/google/gerrit/server/notedb/ChangeNotes.java

@@ -211,6 +211,7 @@ public class ChangeNotes extends AbstractChangeNotes<ChangeNotes> {
       return sr.all().stream().map(id -> scanOneChange(project, sr, id)).filter(Objects::nonNull);
     }
 
+    @Nullable
     private ChangeNotesResult scanOneChange(Project.NameKey project, ScanResult sr, Change.Id id) {
       if (!sr.fromMetaRefs().contains(id)) {
         // Stray patch set refs can happen due to normal error conditions, e.g. failed
@@ -219,10 +220,15 @@ public class ChangeNotes extends AbstractChangeNotes<ChangeNotes> {
       }
 
       // TODO(dborowitz): See discussion in BatchUpdate#newChangeContext.
-      Change change = ChangeNotes.Factory.newChange(project, id);
-
-      logger.atFine().log("adding change %s found in project %s", id, project);
-      return toResult(change);
+      try {
+        Change change = ChangeNotes.Factory.newChange(project, id);
+        logger.atFine().log("adding change %s found in project %s", id, project);
+        return toResult(change);
+      } catch (InvalidServerIdException ise) {
+        logger.atWarning().withCause(ise).log(
+            "skipping change %d in project %s because of an invalid server id", id.get(), project);
+        return null;
+      }
     }
 
     @Nullable
@@ -531,9 +537,9 @@ public class ChangeNotes extends AbstractChangeNotes<ChangeNotes> {
      * be to bump the cache version, but that would invalidate all persistent cache entries, what we
      * rather try to avoid.
      */
-    checkState(
-        Strings.isNullOrEmpty(stateServerId) || args.serverId.equals(stateServerId),
-        String.format("invalid server id, expected %s: actual: %s", args.serverId, stateServerId));
+    if (!Strings.isNullOrEmpty(stateServerId) && !args.serverId.equals(stateServerId)) {
+      throw new InvalidServerIdException(args.serverId, stateServerId);
+    }
 
     state.copyColumnsTo(change);
     revisionNoteMap = v.revisionNoteMap();

java/com/google/gerrit/server/notedb/InvalidServerIdException.java

@@ -0,0 +1,25 @@
+// Copyright (C) 2020 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package com.google.gerrit.server.notedb;
+
+public class InvalidServerIdException extends IllegalStateException {
+  private static final long serialVersionUID = 5302751510361680907L;
+
+  public InvalidServerIdException(String expectedServerId, String actualServerId) {
+    super(
+        String.format(
+            "invalid server id, expected %s: actual: %s", expectedServerId, actualServerId));
+  }
+}