Reduce the create_function() memory leak size

Summary: refs facebook/hhvm#4250

I don't think there's a need for a static string here, and it reduces the leak for this from 825 bytes/request to 393 bytes/request

```PHP
<?php
$f = create_function('',
'var_dump(<<<EOF
aaaaaaaaaaaaaaaaa
aaaaaaaaaaaaaaaaa
aaaaaaaaaaaaaaaaa
aaaaaaaaaaaaaaaaa
aaaaaaaaaaaaaaaaa
aaaaaaaaaaaaaaaaa
aaaaaaaaaaaaaaaaa
aaaaaaaaaaaaaaaaa
aaaaaaaaaaaaaaaaa
aaaaaaaaaaaaaaaaa
aaaaaaaaaaaaaaaaa
aaaaaaaaaaaaaaaaa
aaaaaaaaaaaaaaaaa
aaaaaaaaaaaaaaaaa
aaaaaaaaaaaaaaaaa
aaaaaaaaaaaaaaaaa
aaaaaaaaaaaaaaaaa
aaaaaaaaaaaaaaaaa
'.rand().'/'.rand().'/'.rand().'
EOF
);'
);
$f();
```

Reviewed By: @markw65

Differential Revision: D1695800

Signature: t1:1695800:1416531505:d8aa4aa98212453a0fe2a45327734b65bf30763a
Fix hh start --wait

Summary: The `if env.wait ...` statement was never getting executed
because OCaml was grouping it under the error exit code block of the
pattern-match.

Turns out the warning silenced in D1701802 was a legit warning, ha. Not
sure how / why `--wait` was working before, though -- that code doesn't
seem like it's been changed in a while.

Reviewed By: @elgenie

Differential Revision: D1703935

Signature: t1:1703935:1416945865:fa4e0e9bcf47337b83304d4315a07657599637d3
Factor out BigHeap

Summary: This isolates the MemoryManager code that interfaces with malloc,
including the tracking of slabs and big objects. I also added a
MemoryManager::flush() api call for use when threads go idle.

Reviewed By: @mxw

Differential Revision: D1696129

Signature: t1:1696129:1416945407:d41642cdb36e83f6ff2f7f92553070460538477d
Fix race condition with sigalrm.

Summary: Took way too long to debug this... the issue was that if an
exception (like Server_initializing) got thrown before the alarm went
off, the alarm would not get unset. So at some point the signal handler
gets called and raises Server_busy.

Reviewed By: @jwatzman

Differential Revision: D1702848

Signature: t1:1702848:1416962236:1fc138cb08b254da69fb44912ac8149872929a5e
Implement svcreq in llvm backend

Summary: Fairly easy, with a bit of a hack to work around the fact that we
still use ret to invoke service requests.

Reviewed By: @jasone

Differential Revision: D1699108
Handle push/pop instructions in llvm backend

Summary: pushl was unused so it's been deleted. Of the others, only pushm was
used inside a normal tracelet, and only by LdRetAddr. I've replaced it with a
higher level instruction that's lowered to the corresponding pushm for x64
codegen. I also replaced ret with the higher-level retctrl, also lowered back
to ret for x64 codegen. This allows us to generate the same llir we were
before, but with one fewer awkward hack.

Reviewed By: @jasone

Differential Revision: D1699263
Raise psllq and psrlq to absdbl, support in llvm

Summary: We were only using these two instructions to clear the sign bit of a
double to take its absolute value. Use the llvm intrinsic in the llvm backend.

Reviewed By: @jasone

Differential Revision: D1702068
Don't use sbbl in cgIsScalarType

Summary: I replaced it with an instruction sequence that shouldn't be
meaningfully slower (or faster) but is much simpler to implement in the llvm
backend.

Reviewed By: @jasone

Differential Revision: D1702277
use IMPLEMENT_RESOURCE_ALLOCATION for resources

Summary: It's confusing to use IMPLEMENT_OBJECT_ALLOCATION for resources,
and we might want to change how object/resources are swept
independently.

Reviewed By: @markw65

Differential Revision: D1703478

Signature: t1:1703478:1416964853:82feff283db1c7eaf3b5af7e4a76478074c98a51
Allow negative TransIDs in certain contexts

Summary: For the new inlining stuff, we need to be able to convert negative
BlockIds into nontrivial ProfSrcKeys, so that we can correctly track the
set of instructions that need interpreting, but without changing the
behavior of anything else.

We're already using JIT::BlockIds and TransIDs in a very transparent
manner, so let's just give them the same types and logical ranges.

Reviewed By: @ottoni

Differential Revision: D1444737
Check !typeMightRelax in simplifyConvObjToBool()

Reviewed By: @alexmalyshev

Differential Revision: D1635364
Move all inlining work to translateRegion()

Summary: Rather than inlining from the tracelet selector (or, more generally,
making the inlining decision in any particular region selector), let's
instead move the entire process into the translation path.  This gives
us inlining support for all regions, and is just generally nicer:

- We can, and have, turned off inlining for profiling translations.  The
  hottrace selector will still support inlining, since it does its own
  decision-making on the stitched-together region, but profiling
  translations are back to being single-block.

- Part of the inlining decision involves inspecting the callee's region,
  and inspecting a fully-formed region seems cleaner than looking
  through a region-that-has-been-formed-up-until-the-FCall-hopefully.

First-order inlining for hottrace regions may also allows us to inline
more calls in cases where we have more information.

The most prominent change to note is that inlined callees' blocks are no
longer included in the caller's region; instead, we just skip emitting
the FCall in HhbcTranslator and emit the callee region instead.

Because we no longer see the in-callee uses of types for profiling
tracelets, we duplicate the inlining decision-making during profiling
translations, and if a callee is inlinable, we constrain the types of
all of its arguments, to avoid losing out on an inlining opportunity.

Reviewed By: @swtaarrs

Differential Revision: D1428014
Don't attempt to autoload ints from is_a()

Summary: Fixes facebook/hhvm#4337

Reviewed By: @paulbiss, @elgenie

Differential Revision: D1701715

Signature: t1:1701715:1416874204:20c909c2e95a108273c9e2a67f0849f01f72f653
Turn off most of insertPhis

Summary: It's using incorrect values from predecessor blocks because it doesn't
distinguish between states on the taken or next edge.  Also this isn't the
place we want to do this long term (LCM pass or something should do it
instead).  We can't turn off the stacks yet, though.

Reviewed By: @swtaarrs

Differential Revision: D1698939
Move LocalStateHook driving out of FrameStateMgr

Summary: This lets refcount opts talk to it directly.  But it still requires a
FrameStateMgr& for now to be able to call MInstrEffects::get (which wants to
read the old type of a local on the other side of a pointer, and is assuming
FrameStateMgr knows what that type is, although it only kinda does (not really
sound after gen time)).  Also gets rid of forEachFrame (unused) and makes the
forEachLocal callback match how it's used.

walkAllInlinedLocals also only has a single callsite now, which needs it
because of the skipFrame stuff.  (You can't null the locals out more than once
or refcount opts thinks it's consuming things too many times.)

Reviewed By: @swtaarrs

Differential Revision: D1699847
Remove runtime/test/refcount-opts.cpp

Summary: It's the only user of FrameStateMgr's second constructor, which I want
to remove, and you can't pass a dummy marker to the normal constructor instead
as we end up hitting hasFunc assertions (which looks like it's explicitly
testing that it's not a dummy).  I could make it work (or leave the
constructor), but I think this test's days are numbered anyway, since we're
going to need to change how the refcount-opts pass works pretty fundamentally
for it to support arbitrary control flow.  So unless someone really likes it
can I delete it?

Reviewed By: @swtaarrs

Differential Revision: D1699848

Signature: t1:1699848:1416854866:70d6f636671ac0dd6c46773702e296b2d7003bc9
Fix frameSpansCall bugs, remove 'clearing' code and add m_status asserts

Summary: There was no merging at all of the frameSpansCall state, and the way
we handled it at a loop header or with an unprocessed pred was incorrect (it
left it dangling as whatever it used to be).  Rename it to make it clearer that
it's may-information, and refactor the various clear/reset state functions so
they don't exist anymore.  Expanded m_status with some assertions: it's pretty
clear with the status assertions that this class is still doing 3 unrelated
things (finding a fixed point, dag-only-legacy-reoptimize-or-analyze-stuff, and
the building mode), so it should be split up further.

Reviewed By: @swtaarrs

Differential Revision: D1699849

Signature: t1:1699849:1416856507:403366c23fa1471eaa1ded1486725ed93b83ad15
Remove LocalStateHook& from startBlock

Summary: Refcount opts doesn't support loops (or user-level dags), and is the
only user, so we can remove this code.

Reviewed By: @swtaarrs

Differential Revision: D1699850
Remove HhbcTranslator::replace

Summary: Probably dates to when EvalStack was a member of HhbcTranslator.

Reviewed By: @swtaarrs

Differential Revision: D1699851

Signature: t1:1699851:1416854158:f9374084856b9ea46433145241f91ced04479c25
Remove marker from FrameState

Summary: It seemed weird to duplicate spOff and curFunc with the marker, and
then I was a little worried that it isn't handle the same way for merging.  It
turns out it wasn't broken, just not necessary: ir-builder is just storing its
next-to-gen-marker there for presumably historical reasons.

This also changes splitEdge to use the marker from the source jump instead of
the destination, which seems to make more sense to me, but I think we could
choose either.

Reviewed By: @alexmalyshev

Differential Revision: D1699852

Signature: t1:1699852:1416889935:4735fb88a4ec8ed3f24a4d5937275e3fa7d2319b