Stop speculate from infinite looping in HHBBC

Summary:
If we optimize a block, HHBBC will then speculate to the next block,
seeing if we can replace the jump to the next block with a further
block. The logic was not taking into account that we might speculate
the same block recursively. If this happens (see attached test case
for simple example), then hhbbc will infinite loop. Prevent this by
keeping a "seen" set during speculating, and bailing out if we hit a
block we already hit.

Reviewed By: jano

Differential Revision: D93157056

fbshipit-source-id: 0888761b31f826e94c803d54f6eec04ca47b9edf

Author: ricklavoie

hphp/hhbbc/interp.cpp

@@ -6406,8 +6406,10 @@ BlockId speculateHelper(ISS& env, BlockId orig, bool updateTaken) {
 
   auto const& func = env.ctx.func;
 
+  hphp_fast_set<BlockId> seen;
+
   State temp{env.state, State::Compact{}};
-  while (true) {
+  do {
     auto const targetBlk = func.blocks()[target].get();
     if (!targetBlk->multiPred) break;
     auto const ok = [&] {
@@ -6439,7 +6441,7 @@ BlockId speculateHelper(ISS& env, BlockId orig, bool updateTaken) {
     pops += delta;
     target = new_target;
     temp.stack.compact();
-  }
+  } while (seen.emplace(target).second);
 
   if (endsInControlFlow && updateTaken) {
     assertx(!pops);

hphp/test/slow/hhbbc/speculate-infinite-loop.php

@@ -0,0 +1,15 @@
+<?hh
+
+function blah() {
+  while (1 !== 0) {}
+}
+
+<<__EntryPoint>>
+function main() {
+  if (__hhvm_intrinsics\launder_value(false)) {
+    blah();
+    echo "not reached\n";
+  } else {
+    echo "DONE\n";
+  }
+}

hphp/test/slow/hhbbc/speculate-infinite-loop.php.expect

@@ -0,0 +1 @@
+DONE