API changes causing game crashes and corrupting worlds

The bug

When the game tries to resolve too many player heads at once (12 or more) it can cause a crash. This can corrupt a world, for example when a map with lot of armor stands with player heads are loaded. ⚠️  This is currently breaking a bunch of maps on Java Realms. This can also be used to kick players from servers and corrupt worlds.

1.15.2) [^crash-2020-04-23_18.26.10-client.txt]

Description: Rendering entity in world

java.lang.IllegalArgumentException: Name and ID cannot both be blank
	at com.mojang.authlib.GameProfile.<init>(GameProfile.java:26)
	at com.mojang.authlib.yggdrasil.YggdrasilMinecraftSessionService.fillGameProfile(YggdrasilMinecraftSessionService.java:186)
	at com.mojang.authlib.yggdrasil.YggdrasilMinecraftSessionService.fillProfileProperties(YggdrasilMinecraftSessionService.java:173)
	at bxi.b(SourceFile:132)
	at dqh.a(SourceFile:76)
	at dvz.a(SourceFile:113)
	at dvx.a(SourceFile:102)
	at dvx.a(SourceFile:18)
	at dvf.a(SourceFile:256)
	at dqr.a(SourceFile:1353)
	at dqr.a(SourceFile:1167)
	at dqn.a(SourceFile:718)
	at dqn.a(SourceFile:543)
	at dbn.d(SourceFile:989)
	at dbn.d(SourceFile:619)
	at net.minecraft.client.main.Main.main(SourceFile:204)

Cause

This is caused by the skin api being rate-limited, when you make too many requests you get a response like this. Since the game cannot find the "id" or "name" fields it crashes. This was a recent API change.

{
  "path" : "/session/minecraft/profile/c903ba225fa940f298dd16af12158345",
  "errorType" : "Too Many Requests",
  "developerMessage" : "Too Many Requests",
  "details" : { }
}

How to reproduce

In-game

1. Summon the following entity stack in the world with a command block. ⚠️ This will corrupt your world!

   /summon item ~ ~ ~ {Item:{id:"player_head",Count:1b,tag:{SkullOwner:"aaa"}},Passengers:[{id:"item",Item:{id:"player_head",Count:1b,tag:{SkullOwner:"aab"}},Passengers:[{id:"item",Item:{id:"player_head",Count:1b,tag:{SkullOwner:"aac"}},Passengers:[{id:"item",Item:{id:"player_head",Count:1b,tag:{SkullOwner:"aad"}},Passengers:[{id:"item",Item:{id:"player_head",Count:1b,tag:{SkullOwner:"aae"}},Passengers:[{id:"item",Item:{id:"player_head",Count:1b,tag:{SkullOwner:"aaf"}},Passengers:[{id:"item",Item:{id:"player_head",Count:1b,tag:{SkullOwner:"aag"}},Passengers:[{id:"item",Item:{id:"player_head",Count:1b,tag:{SkullOwner:"aah"}},Passengers:[{id:"item",Item:{id:"player_head",Count:1b,tag:{SkullOwner:"aai"}},Passengers:[{id:"item",Item:{id:"player_head",Count:1b,tag:{SkullOwner:"aaj"}},Passengers:[{id:"item",Item:{id:"player_head",Count:1b,tag:{SkullOwner:"aak"}},Passengers:[{id:"item",Item:{id:"player_head",Count:1b,tag:{SkullOwner:"aal"}}}]}]}]}]}]}]}]}]}]}]}]}

Using the API

1. Open the following page in a browser
   https://sessionserver.mojang.com/session/minecraft/profile/c903ba225fa940f298dd16af12158345

2. Keep refreshing the page rapidly

Fixes

When fixing this keep in mind that older versions won't be able to deal with the rate-limiting. As long as the API has a rate limit, this crash will persist on existing maps for 1.15.2.

A potential fix is to add an invalid "name" in the rate-limiting object so at least older versions don't crash. For future versions, it should actually retry to request the skin after a while. Reverting the rate-limiting until 1.16 is released is also an option.

A better way to fix this is to version the API. Where the existing endpoint will give as response a steve head, or alternatively a black and magenta skin with "RATE LIMIT" as name. Future versions of the game would use a new endpoint that returns the proper rate limit message, allowing the game to handle those (and future) errors.