runtime: throw exception in debug mode that condition is always true when fractionalPercent numerator > denominator

source/common/runtime/runtime_impl.cc

@@ -121,6 +121,19 @@ bool SnapshotImpl::featureEnabled(absl::string_view key,
     percent = default_value;
   }
 
+#ifndef NDEBUG
+  // When numerator > denominator condition is always evaluates to TRUE
+  // It becomes hard to debug why configuration does not work in case of wrong numerator.
+  // Log debug message that numerator is invalid.
+  uint64_t denominator_value =
+      ProtobufPercentHelper::fractionalPercentDenominatorToInt(percent.denominator());
+  if (percent.numerator() > denominator_value) {
+    throw EnvoyException(fmt::format("runtime key '{}': numerator ({}) > denominator ({}), "
+                                     "condition always evaluates to true",
+                                     key, percent.numerator(), denominator_value));
+  }
+#endif
+
   return ProtobufPercentHelper::evaluateFractionalPercent(percent, random_value);
 }
 

test/common/runtime/runtime_impl_test.cc

@@ -678,6 +678,27 @@ TEST_F(StaticLoaderImplTest, ProtoParsing) {
   EXPECT_EQ(2, store_.gauge("runtime.num_layers", Stats::Gauge::ImportMode::NeverImport).value());
 }
 
+TEST_F(StaticLoaderImplTest, InvalidNumerator) {
+  base_ = TestUtility::parseYaml<ProtobufWkt::Struct>(R"EOF(
+    invalid_numerator:
+      numerator: 111
+      denominator: HUNDRED
+  )EOF");
+  setup();
+
+  envoy::type::v3::FractionalPercent fractional_percent;
+
+  // Numerator > denominator -> exception
+  EXPECT_CALL(generator_, random()).WillOnce(Return(500000));
+  // Exception is thrown only on debug mode
+#if !defined(NDEBUG)
+  EXPECT_THROW_WITH_MESSAGE(
+      loader_->snapshot().featureEnabled("invalid_numerator", fractional_percent), EnvoyException,
+      "runtime key 'invalid_numerator': numerator (111) > denominator (100), condition "
+      "always evaluates to true");
+#endif
+}
+
 TEST_F(StaticLoaderImplTest, RuntimeFromNonWorkerThreads) {
   // Force the thread to be considered a non-worker thread.
   tls_.registered_ = false;