grpc 1.53.0 → 1.56.0

data/src/core/ext/filters/client_channel/lb_policy/rls/rls.cc

@@ -50,7 +50,7 @@
 #include "absl/strings/string_view.h"
 #include "absl/strings/strip.h"
 #include "absl/types/optional.h"
-#include "upb/upb.h"
+#include "upb/base/string_view.h"
 #include "upb/upb.hpp"
 
 #include <grpc/byte_buffer.h>
@@ -61,6 +61,7 @@
 #include <grpc/impl/propagation_bits.h>
 #include <grpc/slice.h>
 #include <grpc/status.h>
+#include <grpc/support/json.h>
 #include <grpc/support/log.h>
 
 #include "src/core/ext/filters/client_channel/client_channel.h"
@@ -86,6 +87,7 @@
 #include "src/core/lib/json/json.h"
 #include "src/core/lib/json/json_args.h"
 #include "src/core/lib/json/json_object_loader.h"
+#include "src/core/lib/json/json_writer.h"
 #include "src/core/lib/load_balancing/lb_policy.h"
 #include "src/core/lib/load_balancing/lb_policy_factory.h"
 #include "src/core/lib/load_balancing/lb_policy_registry.h"
@@ -116,7 +118,7 @@ constexpr absl::string_view kRls = "rls_experimental";
 const char kGrpc[] = "grpc";
 const char* kRlsRequestPath = "/grpc.lookup.v1.RouteLookupService/RouteLookup";
 const char* kFakeTargetFieldValue = "fake_target_field_value";
-const char* kRlsHeaderKey = "X-Google-RLS-Data";
+const char* kRlsHeaderKey = "x-google-rls-data";
 
 const Duration kDefaultLookupServiceTimeout = Duration::Seconds(10);
 const Duration kMaxMaxAge = Duration::Minutes(5);
@@ -355,7 +357,7 @@ class RlsLb : public LoadBalancingPolicy {
     RefCountedPtr<LoadBalancingPolicy::Config> pending_config_;
 
     grpc_connectivity_state connectivity_state_ ABSL_GUARDED_BY(&RlsLb::mu_) =
-        GRPC_CHANNEL_IDLE;
+        GRPC_CHANNEL_CONNECTING;
     RefCountedPtr<LoadBalancingPolicy::SubchannelPicker> picker_
         ABSL_GUARDED_BY(&RlsLb::mu_);
   };
@@ -365,7 +367,6 @@ class RlsLb : public LoadBalancingPolicy {
   class Picker : public LoadBalancingPolicy::SubchannelPicker {
    public:
     explicit Picker(RefCountedPtr<RlsLb> lb_policy);
-    ~Picker() override;
 
     PickResult Pick(PickArgs args) override;
 
@@ -731,9 +732,9 @@ RlsLb::ChildPolicyWrapper::ChildPolicyWrapper(RefCountedPtr<RlsLb> lb_policy,
     : DualRefCounted<ChildPolicyWrapper>(
           GRPC_TRACE_FLAG_ENABLED(grpc_lb_rls_trace) ? "ChildPolicyWrapper"
                                                      : nullptr),
-      lb_policy_(lb_policy),
+      lb_policy_(std::move(lb_policy)),
       target_(std::move(target)),
-      picker_(MakeRefCounted<QueuePicker>(std::move(lb_policy))) {
+      picker_(MakeRefCounted<QueuePicker>(nullptr)) {
   lb_policy_->child_policy_map_.emplace(target_, this);
 }
 
@@ -752,58 +753,61 @@ void RlsLb::ChildPolicyWrapper::Orphan() {
   picker_.reset();
 }
 
-bool InsertOrUpdateChildPolicyField(const std::string& field,
-                                    const std::string& value, Json* config,
-                                    ValidationErrors* errors) {
-  if (config->type() != Json::Type::ARRAY) {
+absl::optional<Json> InsertOrUpdateChildPolicyField(const std::string& field,
+                                                    const std::string& value,
+                                                    const Json& config,
+                                                    ValidationErrors* errors) {
+  if (config.type() != Json::Type::kArray) {
     errors->AddError("is not an array");
-    return false;
+    return absl::nullopt;
   }
-  bool success = true;
-  for (size_t i = 0; i < config->array_value().size(); ++i) {
-    Json& child_json = (*config->mutable_array())[i];
+  const size_t original_num_errors = errors->size();
+  Json::Array array;
+  for (size_t i = 0; i < config.array().size(); ++i) {
+    const Json& child_json = config.array()[i];
     ValidationErrors::ScopedField json_field(errors, absl::StrCat("[", i, "]"));
-    if (child_json.type() != Json::Type::OBJECT) {
+    if (child_json.type() != Json::Type::kObject) {
       errors->AddError("is not an object");
-      success = false;
     } else {
-      Json::Object& child = *child_json.mutable_object();
+      const Json::Object& child = child_json.object();
       if (child.size() != 1) {
         errors->AddError("child policy object contains more than one field");
-        success = false;
       } else {
+        const std::string& child_name = child.begin()->first;
         ValidationErrors::ScopedField json_field(
-            errors, absl::StrCat("[\"", child.begin()->first, "\"]"));
-        Json& child_config_json = child.begin()->second;
-        if (child_config_json.type() != Json::Type::OBJECT) {
+            errors, absl::StrCat("[\"", child_name, "\"]"));
+        const Json& child_config_json = child.begin()->second;
+        if (child_config_json.type() != Json::Type::kObject) {
           errors->AddError("child policy config is not an object");
-          success = false;
         } else {
-          Json::Object& child_config = *child_config_json.mutable_object();
-          child_config[field] = Json(value);
+          Json::Object child_config = child_config_json.object();
+          child_config[field] = Json::FromString(value);
+          array.emplace_back(Json::FromObject(
+              {{child_name, Json::FromObject(std::move(child_config))}}));
         }
       }
     }
   }
-  return success;
+  if (errors->size() != original_num_errors) return absl::nullopt;
+  return Json::FromArray(std::move(array));
 }
 
 void RlsLb::ChildPolicyWrapper::StartUpdate() {
-  Json child_policy_config = lb_policy_->config_->child_policy_config();
   ValidationErrors errors;
-  GPR_ASSERT(InsertOrUpdateChildPolicyField(
+  auto child_policy_config = InsertOrUpdateChildPolicyField(
       lb_policy_->config_->child_policy_config_target_field_name(), target_,
-      &child_policy_config, &errors));
+      lb_policy_->config_->child_policy_config(), &errors);
+  GPR_ASSERT(child_policy_config.has_value());
   if (GRPC_TRACE_FLAG_ENABLED(grpc_lb_rls_trace)) {
     gpr_log(
         GPR_INFO,
         "[rlslb %p] ChildPolicyWrapper=%p [%s]: validating update, config: %s",
         lb_policy_.get(), this, target_.c_str(),
-        child_policy_config.Dump().c_str());
+        JsonDump(*child_policy_config).c_str());
   }
   auto config =
       CoreConfiguration::Get().lb_policy_registry().ParseLoadBalancingConfig(
-          child_policy_config);
+          *child_policy_config);
   // Returned RLS target fails the validation.
   if (!config.ok()) {
     if (GRPC_TRACE_FLAG_ENABLED(grpc_lb_rls_trace)) {
@@ -891,6 +895,8 @@ void RlsLb::ChildPolicyWrapper::ChildPolicyHelper::UpdateState(
   {
     MutexLock lock(&wrapper_->lb_policy_->mu_);
     if (wrapper_->is_shutdown_) return;
+    // TODO(roth): It looks like this ignores subsequent TF updates that
+    // might change the status used to fail picks, which seems wrong.
     if (wrapper_->connectivity_state_ == GRPC_CHANNEL_TRANSIENT_FAILURE &&
         state != GRPC_CHANNEL_READY) {
       return;
@@ -1008,19 +1014,6 @@ RlsLb::Picker::Picker(RefCountedPtr<RlsLb> lb_policy)
   }
 }
 
-RlsLb::Picker::~Picker() {
-  // It's not safe to unref the default child policy in the picker,
-  // since that needs to be done in the WorkSerializer.
-  if (default_child_policy_ != nullptr) {
-    auto* default_child_policy = default_child_policy_.release();
-    lb_policy_->work_serializer()->Run(
-        [default_child_policy]() {
-          default_child_policy->Unref(DEBUG_LOCATION, "Picker");
-        },
-        DEBUG_LOCATION);
-  }
-}
-
 LoadBalancingPolicy::PickResult RlsLb::Picker::Pick(PickArgs args) {
   // Construct key for request.
   RequestKey key = {BuildKeyMap(config_->key_builder_map(), args.path,
@@ -1645,7 +1638,7 @@ void RlsLb::RlsChannel::Orphan() {
       client_channel->RemoveConnectivityWatcher(watcher_);
       watcher_ = nullptr;
     }
-    grpc_channel_destroy(channel_);
+    grpc_channel_destroy_internal(channel_);
   }
   Unref(DEBUG_LOCATION, "Orphan");
 }
@@ -1937,7 +1930,7 @@ absl::Status RlsLb::UpdateLocked(UpdateArgs args) {
       (old_config == nullptr ||
        old_config->child_policy_config() != config_->child_policy_config())) {
     gpr_log(GPR_INFO, "[rlslb %p] updated child policy config: %s", this,
-            config_->child_policy_config().Dump().c_str());
+            JsonDump(config_->child_policy_config()).c_str());
   }
   // Swap out addresses.
   // If the new address list is an error and we have an existing address list,
@@ -2347,7 +2340,7 @@ void RlsLbConfig::RouteLookupConfig::JsonPostLoad(const Json& json,
                                                   ValidationErrors* errors) {
   // Parse grpcKeybuilders.
   auto grpc_keybuilders = LoadJsonObjectField<std::vector<GrpcKeyBuilder>>(
-      json.object_value(), args, "grpcKeybuilders", errors);
+      json.object(), args, "grpcKeybuilders", errors);
   if (grpc_keybuilders.has_value()) {
     ValidationErrors::ScopedField field(errors, ".grpcKeybuilders");
     for (size_t i = 0; i < grpc_keybuilders->size(); ++i) {
@@ -2392,8 +2385,8 @@ void RlsLbConfig::RouteLookupConfig::JsonPostLoad(const Json& json,
   // Clamp maxAge to the max allowed value.
   if (max_age > kMaxMaxAge) max_age = kMaxMaxAge;
   // If staleAge is set, then maxAge must also be set.
-  if (json.object_value().find("staleAge") != json.object_value().end() &&
-      json.object_value().find("maxAge") == json.object_value().end()) {
+  if (json.object().find("staleAge") != json.object().end() &&
+      json.object().find("maxAge") == json.object().end()) {
     ValidationErrors::ScopedField field(errors, ".maxAge");
     errors->AddError("must be set if staleAge is set");
   }
@@ -2414,8 +2407,7 @@ void RlsLbConfig::RouteLookupConfig::JsonPostLoad(const Json& json,
   {
     ValidationErrors::ScopedField field(errors, ".defaultTarget");
     if (!errors->FieldHasErrors() &&
-        json.object_value().find("defaultTarget") !=
-            json.object_value().end() &&
+        json.object().find("defaultTarget") != json.object().end() &&
         default_target.empty()) {
       errors->AddError("must be non-empty if set");
     }
@@ -2437,8 +2429,8 @@ const JsonLoaderInterface* RlsLbConfig::JsonLoader(const JsonArgs&) {
 void RlsLbConfig::JsonPostLoad(const Json& json, const JsonArgs&,
                                ValidationErrors* errors) {
   // Parse routeLookupChannelServiceConfig.
-  auto it = json.object_value().find("routeLookupChannelServiceConfig");
-  if (it != json.object_value().end()) {
+  auto it = json.object().find("routeLookupChannelServiceConfig");
+  if (it != json.object().end()) {
     ValidationErrors::ScopedField field(errors,
                                         ".routeLookupChannelServiceConfig");
     // Don't need to save the result here, just need the errors (if any).
@@ -2456,18 +2448,18 @@ void RlsLbConfig::JsonPostLoad(const Json& json, const JsonArgs&,
   // Parse childPolicy.
   {
     ValidationErrors::ScopedField field(errors, ".childPolicy");
-    auto it = json.object_value().find("childPolicy");
-    if (it == json.object_value().end()) {
+    auto it = json.object().find("childPolicy");
+    if (it == json.object().end()) {
       errors->AddError("field not present");
     } else {
       // Add target to all child policy configs in the list.
-      child_policy_config_ = it->second;
       std::string target = route_lookup_config_.default_target.empty()
                                ? kFakeTargetFieldValue
                                : route_lookup_config_.default_target;
-      if (InsertOrUpdateChildPolicyField(child_policy_config_target_field_name_,
-                                         target, &child_policy_config_,
-                                         errors)) {
+      auto child_policy_config = InsertOrUpdateChildPolicyField(
+          child_policy_config_target_field_name_, target, it->second, errors);
+      if (child_policy_config.has_value()) {
+        child_policy_config_ = std::move(*child_policy_config);
         // Parse the config.
         auto parsed_config =
             CoreConfiguration::Get()
@@ -2481,13 +2473,9 @@ void RlsLbConfig::JsonPostLoad(const Json& json, const JsonArgs&,
           // we leave the target field in place, set to the default value.
           // This slightly optimizes what we need to do later when we update
           // a child policy for a given target.
-          for (Json& config : *(child_policy_config_.mutable_array())) {
-            if (config.object_value().begin()->first ==
-                (*parsed_config)->name()) {
-              Json save_config = std::move(config);
-              child_policy_config_.mutable_array()->clear();
-              child_policy_config_.mutable_array()->push_back(
-                  std::move(save_config));
+          for (const Json& config : child_policy_config_.array()) {
+            if (config.object().begin()->first == (*parsed_config)->name()) {
+              child_policy_config_ = Json::FromArray({config});
               break;
             }
           }
@@ -2512,7 +2500,7 @@ class RlsLbFactory : public LoadBalancingPolicyFactory {
 
   absl::StatusOr<RefCountedPtr<LoadBalancingPolicy::Config>>
   ParseLoadBalancingConfig(const Json& json) const override {
-    return LoadRefCountedFromJson<RlsLbConfig>(
+    return LoadFromJson<RefCountedPtr<RlsLbConfig>>(
         json, JsonArgs(), "errors validing RLS LB policy config");
   }
 };

data/src/core/ext/filters/client_channel/lb_policy/round_robin/round_robin.cc

@@ -18,13 +18,16 @@
 
 #include <inttypes.h>
 #include <stdlib.h>
+#include <string.h>
 
 #include <algorithm>
+#include <atomic>
 #include <memory>
 #include <string>
 #include <utility>
 #include <vector>
 
+#include "absl/random/random.h"
 #include "absl/status/status.h"
 #include "absl/status/statusor.h"
 #include "absl/strings/str_cat.h"
@@ -41,6 +44,7 @@
 #include "src/core/lib/gprpp/debug_location.h"
 #include "src/core/lib/gprpp/orphanable.h"
 #include "src/core/lib/gprpp/ref_counted_ptr.h"
+#include "src/core/lib/gprpp/work_serializer.h"
 #include "src/core/lib/json/json.h"
 #include "src/core/lib/load_balancing/lb_policy.h"
 #include "src/core/lib/load_balancing/lb_policy_factory.h"
@@ -150,6 +154,10 @@ class RoundRobin : public LoadBalancingPolicy {
         absl::Status status_for_tf);
 
    private:
+    std::shared_ptr<WorkSerializer> work_serializer() const override {
+      return static_cast<RoundRobin*>(policy())->work_serializer();
+    }
+
     std::string CountersString() const {
       return absl::StrCat("num_subchannels=", num_subchannels(),
                           " num_ready=", num_ready_,
@@ -174,7 +182,7 @@ class RoundRobin : public LoadBalancingPolicy {
     // Using pointer value only, no ref held -- do not dereference!
     RoundRobin* parent_;
 
-    size_t last_picked_index_;
+    std::atomic<size_t> last_picked_index_;
     std::vector<RefCountedPtr<SubchannelInterface>> subchannels_;
   };
 
@@ -189,6 +197,8 @@ class RoundRobin : public LoadBalancingPolicy {
   RefCountedPtr<RoundRobinSubchannelList> latest_pending_subchannel_list_;
 
   bool shutdown_ = false;
+
+  absl::BitGen bit_gen_;
 };
 
 //
@@ -207,27 +217,26 @@ RoundRobin::Picker::Picker(RoundRobin* parent,
   }
   // For discussion on why we generate a random starting index for
   // the picker, see https://github.com/grpc/grpc-go/issues/2580.
-  // TODO(roth): rand(3) is not thread-safe.  This should be replaced with
-  // something better as part of https://github.com/grpc/grpc/issues/17891.
-  last_picked_index_ = rand() % subchannels_.size();
+  size_t index =
+      absl::Uniform<size_t>(parent->bit_gen_, 0, subchannels_.size());
+  last_picked_index_.store(index, std::memory_order_relaxed);
   if (GRPC_TRACE_FLAG_ENABLED(grpc_lb_round_robin_trace)) {
     gpr_log(GPR_INFO,
             "[RR %p picker %p] created picker from subchannel_list=%p "
             "with %" PRIuPTR " READY subchannels; last_picked_index_=%" PRIuPTR,
-            parent_, this, subchannel_list, subchannels_.size(),
-            last_picked_index_);
+            parent_, this, subchannel_list, subchannels_.size(), index);
   }
 }
 
 RoundRobin::PickResult RoundRobin::Picker::Pick(PickArgs /*args*/) {
-  last_picked_index_ = (last_picked_index_ + 1) % subchannels_.size();
+  size_t index = last_picked_index_.fetch_add(1, std::memory_order_relaxed) %
+                 subchannels_.size();
   if (GRPC_TRACE_FLAG_ENABLED(grpc_lb_round_robin_trace)) {
     gpr_log(GPR_INFO,
             "[RR %p picker %p] returning index %" PRIuPTR ", subchannel=%p",
-            parent_, this, last_picked_index_,
-            subchannels_[last_picked_index_].get());
+            parent_, this, index, subchannels_[index].get());
   }
-  return PickResult::Complete(subchannels_[last_picked_index_]);
+  return PickResult::Complete(subchannels_[index]);
 }
 
 //
@@ -309,12 +318,9 @@ absl::Status RoundRobin::UpdateLocked(UpdateArgs args) {
     return status;
   }
   // Otherwise, if this is the initial update, immediately promote it to
-  // subchannel_list_ and report CONNECTING.
+  // subchannel_list_.
   if (subchannel_list_.get() == nullptr) {
     subchannel_list_ = std::move(latest_pending_subchannel_list_);
-    channel_control_helper()->UpdateState(
-        GRPC_CHANNEL_CONNECTING, absl::Status(),
-        MakeRefCounted<QueuePicker>(Ref(DEBUG_LOCATION, "QueuePicker")));
   }
   return absl::OkStatus();
 }

data/src/core/ext/filters/client_channel/lb_policy/subchannel_list.h

@@ -30,14 +30,18 @@
 #include "absl/status/status.h"
 #include "absl/types/optional.h"
 
+#include <grpc/grpc.h>
 #include <grpc/impl/connectivity_state.h>
 #include <grpc/support/log.h>
 
+#include "src/core/ext/filters/client_channel/client_channel_internal.h"
+#include "src/core/ext/filters/client_channel/lb_policy/health_check_client.h"
 #include "src/core/lib/channel/channel_args.h"
 #include "src/core/lib/gprpp/debug_location.h"
 #include "src/core/lib/gprpp/dual_ref_counted.h"
 #include "src/core/lib/gprpp/manual_constructor.h"
 #include "src/core/lib/gprpp/ref_counted_ptr.h"
+#include "src/core/lib/gprpp/work_serializer.h"
 #include "src/core/lib/iomgr/iomgr_fwd.h"
 #include "src/core/lib/load_balancing/lb_policy.h"
 #include "src/core/lib/load_balancing/subchannel_interface.h"
@@ -218,11 +222,15 @@ class SubchannelList : public DualRefCounted<SubchannelListType> {
   // For accessing Ref() and Unref().
   friend class SubchannelData<SubchannelListType, SubchannelDataType>;
 
+  virtual std::shared_ptr<WorkSerializer> work_serializer() const = 0;
+
   // Backpointer to owning policy.
   LoadBalancingPolicy* policy_;
 
   const char* tracer_;
 
+  absl::optional<std::string> health_check_service_name_;
+
   // The list of subchannels.
   // We use ManualConstructor here to support SubchannelDataType classes
   // that are not copyable.
@@ -317,20 +325,27 @@ template <typename SubchannelListType, typename SubchannelDataType>
 void SubchannelData<SubchannelListType,
                     SubchannelDataType>::StartConnectivityWatchLocked() {
   if (GPR_UNLIKELY(subchannel_list_->tracer() != nullptr)) {
-    gpr_log(GPR_INFO,
-            "[%s %p] subchannel list %p index %" PRIuPTR " of %" PRIuPTR
-            " (subchannel %p): starting watch",
-            subchannel_list_->tracer(), subchannel_list_->policy(),
-            subchannel_list_, Index(), subchannel_list_->num_subchannels(),
-            subchannel_.get());
+    gpr_log(
+        GPR_INFO,
+        "[%s %p] subchannel list %p index %" PRIuPTR " of %" PRIuPTR
+        " (subchannel %p): starting watch "
+        "(health_check_service_name=\"%s\")",
+        subchannel_list_->tracer(), subchannel_list_->policy(),
+        subchannel_list_, Index(), subchannel_list_->num_subchannels(),
+        subchannel_.get(),
+        subchannel_list()->health_check_service_name_.value_or("N/A").c_str());
   }
   GPR_ASSERT(pending_watcher_ == nullptr);
-  pending_watcher_ =
-      new Watcher(this, subchannel_list()->WeakRef(DEBUG_LOCATION, "Watcher"));
-  subchannel_->WatchConnectivityState(
-      // NOLINTNEXTLINE(google-readability-casting)
-      std::unique_ptr<SubchannelInterface::ConnectivityStateWatcherInterface>(
-          pending_watcher_));
+  auto watcher = std::make_unique<Watcher>(
+      this, subchannel_list()->WeakRef(DEBUG_LOCATION, "Watcher"));
+  pending_watcher_ = watcher.get();
+  if (subchannel_list()->health_check_service_name_.has_value()) {
+    subchannel_->AddDataWatcher(MakeHealthCheckWatcher(
+        subchannel_list_->work_serializer(),
+        *subchannel_list()->health_check_service_name_, std::move(watcher)));
+  } else {
+    subchannel_->WatchConnectivityState(std::move(watcher));
+  }
 }
 
 template <typename SubchannelListType, typename SubchannelDataType>
@@ -345,7 +360,11 @@ void SubchannelData<SubchannelListType, SubchannelDataType>::
               subchannel_list_, Index(), subchannel_list_->num_subchannels(),
               subchannel_.get(), reason);
     }
-    subchannel_->CancelConnectivityStateWatch(pending_watcher_);
+    // No need to cancel if using health checking, because the data
+    // watcher will be destroyed automatically when the subchannel is.
+    if (!subchannel_list()->health_check_service_name_.has_value()) {
+      subchannel_->CancelConnectivityStateWatch(pending_watcher_);
+    }
     pending_watcher_ = nullptr;
   }
 }
@@ -368,6 +387,10 @@ SubchannelList<SubchannelListType, SubchannelDataType>::SubchannelList(
     : DualRefCounted<SubchannelListType>(tracer),
       policy_(policy),
       tracer_(tracer) {
+  if (!args.GetBool(GRPC_ARG_INHIBIT_HEALTH_CHECKING).value_or(false)) {
+    health_check_service_name_ =
+        args.GetOwnedString(GRPC_ARG_HEALTH_CHECK_SERVICE_NAME);
+  }
   if (GPR_UNLIKELY(tracer_ != nullptr)) {
     gpr_log(GPR_INFO,
             "[%s %p] Creating subchannel list %p for %" PRIuPTR " subchannels",

data/src/core/ext/filters/client_channel/lb_policy/weighted_round_robin/static_stride_scheduler.cc

@@ -31,7 +31,50 @@
 namespace grpc_core {
 
 namespace {
+
 constexpr uint16_t kMaxWeight = std::numeric_limits<uint16_t>::max();
+
+// Assuming the mean of all known weights is M, StaticStrideScheduler will cap
+// from above all known weights that are bigger than M*kMaxRatio (to
+// M*kMaxRatio).
+//
+// This is done to limit the number of rounds for picks.
+constexpr double kMaxRatio = 10;
+
+// Assuming the mean of all known weights is M, StaticStrideScheduler will cap
+// from below all known weights to M*kMinRatio.
+//
+// This is done as a performance optimization for edge cases when channels with
+// large weights are non-accepting (and thus WeightedRoundRobin will retry
+// picking them over and over again), and there are also channels with near-zero
+// weights that are possibly accepting. In this case, without kMinRatio, it
+// would potentially require WeightedRoundRobin to perform thousands of picks
+// until it gets a single channel with near-zero weight. This was a part of what
+// hapenned in b/276292666.
+//
+// The current value of 0.01 was chosen without any experimenting. It should
+// ensure that WeightedRoundRobin doesn't do much more than an order of 100
+// picks of non-accepting channels with high weights in such corner cases. But
+// it also makes WeightedRoundRobin to send slightly more requests to
+// potentially very bad tasks (that would have near-zero weights) than zero.
+// This is not necesserily a downside, though. Perhaps this is not a problem at
+// all and we should increase this value (to 0.05 or 0.1) to save CPU cycles.
+//
+// Note that this class treats weights that are exactly equal to zero as unknown
+// and thus needing to be replaced with M. This behavior itself makes sense
+// (fresh channels without feedback information will get an average flow of
+// requests). However, it follows from this that this class will replace weight
+// = 0 with M, but weight = epsilon with M*kMinRatio, and this step function is
+// logically faulty. A demonstration of this is that the function that computes
+// weights in WeightedRoundRobin
+// (http://google3/production/rpc/stubs/core/loadbalancing/weightedroundrobin.cc;l=324-325;rcl=514986476)
+// will cap some epsilon values to zero. There should be a clear distinction
+// between "task is new, weight is unknown" and "task is unhealthy, weight is
+// very low". A better solution would be to not mix "unknown" and "weight" into
+// a single value but represent weights as std::optional<float> or, if memory
+// usage is a concern, use NaN as the indicator of unknown weight.
+constexpr double kMinRatio = 0.01;
+
 }  // namespace
 
 absl::optional<StaticStrideScheduler> StaticStrideScheduler::Make(
@@ -45,10 +88,10 @@ absl::optional<StaticStrideScheduler> StaticStrideScheduler::Make(
   const size_t n = float_weights.size();
   size_t num_zero_weight_channels = 0;
   double sum = 0;
-  float max = 0;
+  float unscaled_max = 0;
   for (const float weight : float_weights) {
     sum += weight;
-    max = std::max(max, weight);
+    unscaled_max = std::max(unscaled_max, weight);
     if (weight == 0) {
       ++num_zero_weight_channels;
     }
@@ -59,6 +102,13 @@ absl::optional<StaticStrideScheduler> StaticStrideScheduler::Make(
   // Mean of non-zero weights before scaling to `kMaxWeight`.
   const double unscaled_mean =
       sum / static_cast<double>(n - num_zero_weight_channels);
+  const double ratio = unscaled_max / unscaled_mean;
+
+  // Adjust max value such that ratio does not exceed kMaxRatio. This should
+  // ensure that we on average do at most kMaxRatio rounds for picks.
+  if (ratio > kMaxRatio) {
+    unscaled_max = kMaxRatio * unscaled_mean;
+  }
 
   // Scale weights such that the largest is equal to `kMaxWeight`. This should
   // be accurate enough once we convert to an integer. Quantisation errors won't
@@ -66,15 +116,35 @@ absl::optional<StaticStrideScheduler> StaticStrideScheduler::Make(
   // TODO(b/190488683): it may be more stable over updates if we try to keep
   // `scaling_factor` consistent, and only change it when we can't accurately
   // represent the new weights.
-  const double scaling_factor = kMaxWeight / max;
+  const double scaling_factor = kMaxWeight / unscaled_max;
+
+  // Note that since we cap the weights to stay within kMaxRatio, `mean` might
+  // not match the actual mean of the values that end up in the scheduler.
   const uint16_t mean = std::lround(scaling_factor * unscaled_mean);
 
+  // We compute weight_lower_bound and cap it to 1 from below so that in the
+  // worst case we represent tiny weights as 1 but not as 0 (which would cause
+  // an infinite loop as in b/276292666). This capping to 1 is probably only
+  // useful in case someone misconfigures kMinRatio to be very small.
+  //
+  // NOMUTANTS -- We have tests for this expression, but they are not precise
+  // enough to catch errors of plus/minus 1, what mutation testing does.
+  const uint16_t weight_lower_bound =
+      std::max(static_cast<uint16_t>(1),
+               static_cast<uint16_t>(std::lround(mean * kMinRatio)));
+
   std::vector<uint16_t> weights;
   weights.reserve(n);
   for (size_t i = 0; i < n; ++i) {
-    weights.push_back(float_weights[i] == 0
-                          ? mean
-                          : std::lround(float_weights[i] * scaling_factor));
+    if (float_weights[i] == 0) {  // Weight is unknown.
+      weights.push_back(mean);
+    } else {
+      const double float_weight_capped_from_above =
+          std::min(float_weights[i], unscaled_max);
+      const uint16_t weight =
+          std::lround(float_weight_capped_from_above * scaling_factor);
+      weights.push_back(std::max(weight, weight_lower_bound));
+    }
   }
 
   GPR_ASSERT(weights.size() == float_weights.size());