fetch: Log net error codes for failed Trust Tokens operations

We're investigating some failed Trust tokens Issuance operations
executed via the Fetch API. We previously landed logging to get a better
understanding of why these fetches fail, but the logging groups together
fetches that fail for a couple of distinct reasons that can make
ResourceError::GetResourceRequestBlockedReason() return
ResourceRequestBlockedReason::kOther:
(1) Explicit ResourceRequestBlockedReason::kOther returns by logic in
Blink
(2) net::ERR_BLOCKED_BY_CLIENT and net::ERR_BLOCKED_BY_RESPONSE errors
from downstream services that do *not* have associated
network::mojom::BlockedByResponseReasons. (If they had associated
BlockedByResponseReasons, these reasons would be mapped to
non-kOther ResourceRequestBlockedReasons.)

This CL adds some additional logging for failed Trust Tokens
operation-bearing fetches' net errors, which will help resolve this
particular ambiguity as well, in general, provide richer information
than just the ResourceRequestBlockedReason.

Bug: 1128174
Change-Id: I84cd9e4f3551a364d1b80179a2c8f6b4085f8a8a
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2451729Reviewed-by: Charlie Harrison <csharrison@chromium.org>
Reviewed-by: Yutaka Hirano <yhirano@chromium.org>
Reviewed-by: Mark Pearson <mpearson@chromium.org>
Commit-Queue: David Van Cleve <davidvc@chromium.org>
Cr-Commit-Position: refs/heads/master@{#815351}

content/test/trust_token_browsertest.cc

@@ -462,6 +462,9 @@ IN_PROC_BROWSER_TEST_F(TrustTokenBrowsertest, RecordsFetchFailureReasons) {
       "Net.TrustTokens.FetchFailedReason.Issuance",
       9 /* fetch_manager.cc::FailedReason::kOtherNonBlockReason */,
       /*expected_count=*/1);
+  histograms.ExpectUniqueSample(
+      "Net.TrustTokens.NetErrorForFetchFailure.Issuance", net::ERR_FAILED,
+      /*expected_count=*/1);
 
   // Since issuance failed, there should be no tokens to redeem, so redemption
   // should fail:
@@ -477,6 +480,10 @@ IN_PROC_BROWSER_TEST_F(TrustTokenBrowsertest, RecordsFetchFailureReasons) {
       "Net.TrustTokens.FetchFailedReason.Redemption",
       8 /* fetch_manager.cc::FailedReason::kTrustTokensError */,
       /*expected_count=*/1);
+  histograms.ExpectUniqueSample(
+      "Net.TrustTokens.NetErrorForFetchFailure.Redemption",
+      net::ERR_TRUST_TOKEN_OPERATION_FAILED,
+      /*expected_count=*/1);
 
   // Execute a cross-site b.test -> a.test issuance that would succeed, were it
   // not for site b requiring CORP headers and none being present on the a.test
@@ -503,6 +510,10 @@ IN_PROC_BROWSER_TEST_F(TrustTokenBrowsertest, RecordsFetchFailureReasons) {
       // kCorpNotSameOriginAfterDefaultedToSameOriginByCoep
       21,
       /*expected_count=*/1);
+  histograms.ExpectBucketCount(
+      "Net.TrustTokens.NetErrorForFetchFailure.Issuance",
+      net::ERR_BLOCKED_BY_RESPONSE,
+      /*expected_count=*/1);
 }
 
 // Trust Tokens should require that their executing contexts be secure.

third_party/blink/renderer/core/fetch/fetch_manager.cc

@@ -174,6 +174,18 @@ FailedReason ResourceRequestBlockedReasonToFailedReason(
   }
 }
 
+const char* SerializeTrustTokenOperationType(
+    network::mojom::TrustTokenOperationType operation_type) {
+  switch (operation_type) {
+    case network::mojom::blink::TrustTokenOperationType::kIssuance:
+      return "Issuance";
+    case network::mojom::blink::TrustTokenOperationType::kRedemption:
+      return "Redemption";
+    case network::mojom::blink::TrustTokenOperationType::kSigning:
+      return "Signing";
+  }
+}
+
 // Logs a more descriptive reason why a fetch with Trust Tokens parameters
 // failed. This is a temporary measure for debugging a surprisingly high
 // incidence of "TypeError: Failed to fetch" when executing Trust Tokens
@@ -181,24 +193,25 @@ FailedReason ResourceRequestBlockedReasonToFailedReason(
 void HistogramFetchFailureReasonForTrustTokensOperation(
     network::mojom::blink::TrustTokenOperationType operation_type,
     FailedReason reason) {
-  const char* operation_type_name = "";
-  switch (operation_type) {
-    case network::mojom::blink::TrustTokenOperationType::kIssuance:
-      operation_type_name = "Issuance";
-      break;
-    case network::mojom::blink::TrustTokenOperationType::kRedemption:
-      operation_type_name = "Redemption";
-      break;
-    case network::mojom::blink::TrustTokenOperationType::kSigning:
-      operation_type_name = "Signing";
-      break;
-  }
   base::UmaHistogramEnumeration(
-      base::StrCat(
-          {"Net.TrustTokens.FetchFailedReason", ".", operation_type_name}),
+      base::StrCat({"Net.TrustTokens.FetchFailedReason", ".",
+                    SerializeTrustTokenOperationType(operation_type)}),
       reason);
 }
 
+// Logs a net error describing why a fetch with Trust Tokens parameters
+// failed. This is a temporary measure for debugging a surprisingly high
+// incidence of "TypeError: Failed to fetch" when executing Trust Tokens
+// issuance operations (crbug.com/1128174).
+void HistogramNetErrorForTrustTokensOperation(
+    network::mojom::blink::TrustTokenOperationType operation_type,
+    int net_error) {
+  base::UmaHistogramSparse(
+      base::StrCat({"Net.TrustTokens.NetErrorForFetchFailure", ".",
+                    SerializeTrustTokenOperationType(operation_type)}),
+      net_error);
+}
+
 }  // namespace
 
 class FetchManager::Loader final
@@ -626,6 +639,11 @@ void FetchManager::Loader::DidFinishLoading(uint64_t) {
 }
 
 void FetchManager::Loader::DidFail(const ResourceError& error) {
+  if (fetch_request_data_ && fetch_request_data_->TrustTokenParams()) {
+    HistogramNetErrorForTrustTokensOperation(
+        fetch_request_data_->TrustTokenParams()->type, error.ErrorCode());
+  }
+
   if (error.TrustTokenOperationError() !=
       network::mojom::blink::TrustTokenOperationStatus::kOk) {
     Failed(String(),

tools/metrics/histograms/histograms_xml/histogram_suffixes_list.xml

@@ -19273,6 +19273,7 @@ reviews. Googlers can read more about this at go/gwsq-gerrit.
   <suffix name="Redemption" label="Trust token redemption"/>
   <suffix name="Signing" label="SRR attachment and outgoing request signing"/>
   <affected-histogram name="Net.TrustTokens.FetchFailedReason"/>
+  <affected-histogram name="Net.TrustTokens.NetErrorForFetchFailure"/>
   <affected-histogram
       name="Net.TrustTokens.NetErrorForTrustTokenOperation.Failure"/>
   <affected-histogram

tools/metrics/histograms/histograms_xml/net/histograms.xml

@@ -4604,6 +4604,20 @@ reviews. Googlers can read more about this at go/gwsq-gerrit.
   </summary>
 </histogram>
 
+<histogram base="true" name="Net.TrustTokens.NetErrorForFetchFailure"
+    enum="NetErrorCodes" expires_after="2021-03-30">
+<!-- Name completed by histogram_suffixes name="TrustTokenOperationType" -->
+
+  <owner>davidvc@chromium.org</owner>
+  <owner>yhirano@chromium.org</owner>
+  <owner>privacy-sandbox-dev@chromium.org</owner>
+  <summary>
+    The net error for a failed Fetch API call with an associated Trust Tokens
+    operation. This might help debug a surfeit of 'TypeError: failed to fetch'
+    observed in live testing.
+  </summary>
+</histogram>
+
 <histogram base="true" name="Net.TrustTokens.NetErrorForTrustTokenOperation"
     enum="NetErrorCodes" expires_after="2021-03-30">
 <!-- Name completed by histogram_suffixes name="TrustTokenOperationType" -->