The job isn't run often, so all we know is that it completed successfully on July 3 (logs have been deleted), but failed on August 13. It looks like the image has been updated in that period, but that's for npm stuff that seems unrelated. It would be interesting to see the content of config.log, but I don't know how to add it to the build artifacts.

I've updated the PHP version to 7.4.33 but that didn't help. I then made it output the whole config.log file. There's a lot of stuff in there, but the key point is that it made realize that emscripten depends on node, so changes to node images might have had an effect. On top of that, we're using an old version of emscripten (2.0.21). The documentation says we need to change the install syntax when using an old version. Even better would be just using the latest version, but last time around it didn't go well (T295228). I might test it to see if things have gotten any better, and if not, stick with 2.0.21 but update the command.

I have confirmed locally that updating emscripten to the latest version (3.1.69) fixes the issue. Unfortunately, it then fails with the same error as T295228. Updating the commands as explained above did not help.

I'll re-sync the phan demo fork with upstream and switch it to PHP 8. That should fix the munmap error and let us use latest emscripten.

Change #1080852 had a related patch set uploaded (by Daimona Eaytoy; author: Daimona Eaytoy):

[integration/config@master] Docker: [mediawiki-phan-taint-check-demo] Update emscripten version

https://gerrit.wikimedia.org/r/1080852

The patch above is for the docker side of things. I got the demo to work with newer emscripten, and synced it with upstream; it now uses PHP 8.2.5, which is the newest version that works with upstream code. All of this was done in the github fork. I spent quite a lot of time trying to figure out what I was doing wrong, then eventually realized that there seems to be a bug in emscripten. The current version works locally, so I'm hoping there won't be any surprises in CI.

Change #1080852 merged by jenkins-bot:

[integration/config@master] Docker: [mediawiki-phan-taint-check-demo] Update emscripten version

https://gerrit.wikimedia.org/r/1080852

Change #1081400 had a related patch set uploaded (by Daimona Eaytoy; author: Daimona Eaytoy):

[integration/config@master] jjb: Switch taint-check-demo to latest image

https://gerrit.wikimedia.org/r/1081400

Change #1081400 merged by jenkins-bot:

[integration/config@master] jjb: Switch Phan taint-check-demo to latest image

https://gerrit.wikimedia.org/r/1081400

The job is working now, but the demo is broken. It seems that the new assets have not been copied over to the documentation host. For example, the static HTML page still uses the old version (mentioning PHP 7.4.16 instead of 8.2.5), and php.js also has not been updated. But for example, taint-check.js is no longer there (which is expected), and same for taint-check.data, being replaced by php.data as expected.

Mentioned in SAL (#wikimedia-releng) [2024-10-18T14:33:43Z] <hashar> zuul enqueue --trigger gerrit --pipeline postmerge --change 1080409,5 --project mediawiki/tools/phan/SecurityCheckPlugin # For @Daimona and T372887