Segmentation Fault in MediaWiki

[octmoraru]

HHVM Version

Commit c82b66a

Standalone code, or other way to reproduce the problem

Steps to reproduce:

1. Get oss-performance
2. Add this to php.ini (see this issue):

echo "assert.active=0" > conf/php.ini

3. Run MediaWiki

hhvm perf.php --mediawiki --hhvm=/path/to/hhvm

Expected result

A normal siege output such as this one:

{
    "Combined": {
        "Siege requests": xxx,
        "Siege wall sec": xxx,
        "Siege RPS": xxx,
        "Siege successful requests": xxx,
        "Siege failed requests": xxx,
        "Nginx hits": xxx,
        "Nginx avg bytes": xxx,
        "Nginx avg time": xxx,
        "Nginx P50 time": xxx,
        "Nginx P90 time": xxx,
        "Nginx P95 time": xxx,
        "Nginx P99 time": xxx,
        "Nginx 200": xxx,
        "Nginx 499": xxx,
        "Nginx 301": xxx,
        "Nginx 404": xxx,
        "canonical": xx
    }
}

Actual result

******************************************
** 2016-04-26 08:57:41 EEST
** Starting Siege for multi request warmup
** SIEGE 2.78
** Preparing 200 concurrent users for battle.
The server is now under siege...
done.
siege aborted due to excessive socket failure; you
can change the failure threshold in $HOME/.siegerc

***************************
** 2016-04-26 08:57:59 EEST
** Collecting results

***************************
** 2016-04-26 08:57:59 EEST
** Collecting TC/PCRE data

Warning: Failed to open http://localhost:8091/check-health () in oss-performance/base/HHVMDaemon.php on line 343

Under gdb, this is the reported backtrace:

#0  HPHP::jit::(anonymous namespace)::node_skip_over (env=..., pred=pred at entry=0x7ffdd0b5b670, middle=middle at entry=0x7ffdd0b5b570, last=0x0)
    at hphp/runtime/vm/jit/refcount-opts.cpp:2388
#1  0x000000000143cba6 in rule_inc_pass_req (node=0x7ffdd0b5b670, env=...) at hphp/runtime/vm/jit/refcount-opts.cpp:3101
#2  optimize_node (workQ=std::queue wrapping: std::deque with 2 elements = {...}, node=<optimized out>, env=...) at hphp/runtime/vm/jit/refcount-opts.cpp:3280
#3  optimize_graph (head=<optimized out>, env=...) at hphp/runtime/vm/jit/refcount-opts.cpp:3305
#4  optimize_graphs (graphs=std::vector of length 2, capacity 2 = {...}, env=...) at hphp/runtime/vm/jit/refcount-opts.cpp:3314
#5  rcgraph_opts (env=...) at hphp/runtime/vm/jit/refcount-opts.cpp:3337
#6  HPHP::jit::optimizeRefcounts (unit=...) at hphp/runtime/vm/jit/refcount-opts.cpp:3444
#7  0x0000000001408f58 in doPass<void (*)(HPHP::jit::IRUnit&)> (dce=HPHP::jit::(anonymous namespace)::Full, fn=<optimized out>, unit=...)
    at hphp/runtime/vm/jit/opt.cpp:42
#8  HPHP::jit::optimize (unit=..., kind=kind at entry=HPHP::jit::Optimize) at hphp/runtime/vm/jit/opt.cpp:163
#9  0x00000000014af35a in HPHP::jit::irGenInlineRegion (ctx=..., region=...) at hphp/runtime/vm/jit/translate-region.cpp:1007
#10 0x000000000133c42a in computeTranslationCostSlow (region=..., at=...) at hphp/runtime/vm/jit/inlining-decider.cpp:363
#11 HPHP::jit::(anonymous namespace)::computeTranslationCost (at=..., at at entry=..., region=...) at hphp/runtime/vm/jit/inlining-decider.cpp:379
#12 0x000000000133d776 in HPHP::jit::InliningDecider::shouldInline (this=this at entry=0x7ffe153f9660, callerSk=..., callee=callee at entry=0x7fffde66a2e0, region=..., maxTotalCost=400)
    at hphp/runtime/vm/jit/inlining-decider.cpp:511
#13 0x000000000133e0bc in HPHP::jit::selectCalleeRegion (sk=..., callee=callee at entry=0x7fffde66a2e0, irgs=..., inl=..., maxBCInstrs=maxBCInstrs at entry=938)
    at hphp/runtime/vm/jit/inlining-decider.cpp:671
#14 0x00000000014ae0d4 in getInlinableCalleeRegion (maxBCInstrs=938, irgs=..., inl=..., retry=..., callee=0x7fffde66a2e0, psk=...)
    at hphp/runtime/vm/jit/translate-region.cpp:547
#15 HPHP::jit::(anonymous namespace)::irGenRegionImpl (irgs=..., region=..., retry=..., inl=..., budgetBCInstrs=@0x7ffe153f95f0: 938, profFactor=profFactor at entry=23752, 
    annotations=annotations at entry=0x7ffe153f9988) at hphp/runtime/vm/jit/translate-region.cpp:724
#16 0x00000000014ada52 in HPHP::jit::(anonymous namespace)::irGenRegionImpl (irgs=..., region=..., retry=..., inl=..., budgetBCInstrs=@0x7ffe153f95f0: 938, profFactor=profFactor at entry=1, 
    annotations=annotations at entry=0x7ffe153f9988) at hphp/runtime/vm/jit/translate-region.cpp:774
#17 0x00000000014aec95 in HPHP::jit::irGenRegion (region=..., context=..., pConds=..., annotations=std::vector of length 0, capacity 0)
    at hphp/runtime/vm/jit/translate-region.cpp:908
#18 0x00000000013f2294 in HPHP::jit::MCGenerator::translate (this=this at entry=0x7fffe9079000, args=...) at hphp/runtime/vm/jit/mc-generator.cpp:700
#19 0x00000000013f412e in HPHP::jit::MCGenerator::retranslateOpt (this=<optimized out>, transId=<optimized out>, align=align at entry=false)
    at hphp/runtime/vm/jit/mc-generator.cpp:350
#20 0x00000000013f4cd0 in HPHP::jit::MCGenerator::handleServiceRequest (this=0x7fffe9079000, info=...) at hphp/runtime/vm/jit/mc-generator.cpp:1335
#21 0x000000000b200021 in ?? ()
#22 0x0000000000000004 in ?? ()
#23 0x0000000000000000 in ?? ()

[octmoraru]

0837442 solves the issue. It also seems to bring a 5% performance improvement for MediaWiki.