Allocate Image resources with MemoryManager

Reviewed By: @​bnell

Differential Revision: D1728444
Fix lots of use-after-frees

Summary: asTypedValue was returning a pointer to a temporary Variant, cast
to a TypedValue*.

Reviewed By: @edwinsmith

Differential Revision: D1728889
Color backedges as red in IR printing

Summary: Helps for viewing, but mostly for searching for backedges in IR dumps.

Reviewed By: @ottoni

Differential Revision: D1729806

Signature: t1:1729806:1418176796:12b767c8040e44d8182b818e46308f3cf366a11c
Set relative path root in js version of hack

Reviewed By: @int3

Differential Revision: D1732315

Signature: t1:1732315:1418253837:9bf5b3c803b235877c73db8a4f6e7904c4550499
Make ast destruction less recursive

Summary: ast nodes can have a pointer to a canonical node which
allows a certain amount of cse and constant propagation. These could
chain through the elements of an array, with the result that when the
array is destroyed, the last element keeps all the other elements alive,
and when its finally destroyed, we recursively walk the canonPtrs
destroying the elements.

This just clears all the canonPtrs in the destructor of ExpressionList,
which should prevent most pathalogical cases of this.

Reviewed By: @jdelong

Differential Revision: D1731406
Improve thread hooks

Summary: Also fix a couple of leaks on thread exit.

I don't think we're being bitten by the leaks right now, because
the only threads that are created/destroyed a lot are created using
std::thread, which bind directly to pthread_create etc, bypassing
our wrappers.

But I didn't like the way we had to sleep/retry to get hold of the
thread info from the map. So this passes the PthreadInfo as the
argument to the start function.

Reviewed By: @jasone

Differential Revision: D1731592

Signature: t1:1731592:1418245780:1ef8a7414641474036d0c76d3fc875693ca55ec1
Transform invariant/invariant_violation

Summary: These two toplevel functions need to be given the correct name
when transformed.

Reviewed By: @int3

Differential Revision: D1729613

Signature: t1:1729613:1418213468:23186b9476b00e0fd6ffb11a3055c7499553b7a8
Fix some arm issues

Summary: Missing vasm instructions and a difference between the x64 and arm
versions of emitCallArrayPrologue. They both crept in due to test infra issues.

Reviewed By: @mxw

Differential Revision: D1733394

Signature: t1:1733394:1418280328:317bb65b2e2c2264750c11ccee1e80844c1c2277
Delete interpreter type-profiling code

Summary: This isn't doing anything now that we PGO everything, and it added a
fair bit of complexity to some jit functions. This doesn't touch the "runtime
type profiler" which is something unrelated to type prediction in the jit, and
the non-type warmup profiling for Func hotness and InstanceBits is still
around.

Reviewed By: @alexmalyshev, @jdelong

Differential Revision: D1732733

Signature: t1:1732733:1418259277:acffb558bef3ccc0d1b1ca24bee8918b5e5a9197
Delete unused runtime type profiler

Reviewed By: @bertmaher

Differential Revision: D1732855

Signature: t1:1732855:1418260442:c25585f4ef14958527dd8f8e539b4befcbe88531
Fix another use-after-free

Reviewed By: @edwinsmith

Differential Revision: D1732277

Signature: t1:1732277:1418257892:221f1fb48c2bfb5e00b135dfca5deca57352ebbb
Fix an order of destruction issue

Summary: Noticed while reviewing D1715120. The destructors of any objects
in the old array might be able to access the old array after we started
destroying it.

Reviewed By: @edwinsmith

Differential Revision: D1732598

Signature: t1:1732598:1418258130:233e071d7c069eec826625df1857be78c175bea5
Clobber things in destructors

Summary: Makes it much easier to find use-after-free bugs

Reviewed By: @swtaarrs, @edwinsmith

Differential Revision: D1732294

Signature: t1:1732294:1418254050:874df2302726fb041359577da6640a4a903576e3
Actually upward traverse directories for files

Summary: I believe we have been living with a subtle bug in the test runner for a while.
`find_file_for_dir()` was not actually traversing backwards correctly. This
doesn't manifest itself because we normally run the test runner from the
`hphp` directory and `$dir` has enough information in it to traverse the
appropriate levels back to be ok.

However, if we run the test run from something like `hphp/test/slow`, then
we lose it.

For example, from the `test/slow` directory

`../run sanity/0.php` should have been using the `config.ini` file
in `test/slow`. However, given that `$dir` was `sanity` as we did not
have any full path information,  we always fell out of the `while` loop
on the `$dir = '.'` condition after the first run since we didn't have the
full path to the directory/file in question, we would always just fallback to
the default `config.ini` in `./test` instead.

```
../run --verbose sanity/0.php
Running 1 tests in 1 threads (0 in serial)
sanity/0.php passed

All tests passed.
              |    |    |
             )_)  )_)  )_)
            )___))___))___)\
           )____)____)_____)\
         _____|____|____|____\\__
---------\      SHIP IT      /---------
  ^^^^^ ^^^^^^^^^^^^^^^^^^^^^
    ^^^^      ^^^^     ^^^    ^^
         ^^^^      ^^^

Run these by hand:
../../../_bin/hphp/hhvm/hhvm -c /data/users/joelm/fbcode-baseline/hphp/test/config.ini -vEval.EnableArgsInBacktraces=true -vEval.EnableIntrinsicsExtension=true -vRepo.Local.Mode=-- -vRepo.Central.Path=/data/users/joelm/fbcode-baseline/_bin/verify.hhbc -vEval.Jit=true    -vResourceLimit.CoreFileSize=0    --file 'sanity/0.php'
```

Reviewed By: @paulbiss

Differential Revision: D1729338

Signature: t1:1729338:1418169425:e2124a5b817141a1ac4d62c4b8102c5eea2874c6
Convert ZendCustomElement to smart-allocation

Summary: It was new'd, not Sweepable, not persisted, and has no fields
that need sweeping.

Reviewed By: @paroski

Differential Revision: D1714802
Add an ocaml wrapper for find path1 ... pathN -name pattern

Summary: This is useful for finding all files recursively in a directory. I
started to do this in ocaml before I realized I was just reimplementing find.

Reviewed By: @bhosmer

Differential Revision: D1700338

Signature: t1:1700338:1418324335:119aac82f1323588778f77ab4a8fb9265d1df428
Remove list_classes support

Summary: Removing --list_classes support

Reviewed By: @jcreedcmu

Differential Revision: D1728617

Signature: t1:1728617:1418157029:68916eb05148efaf61be22e9190210b0b0dcf047
Don't allow load-elim to reuse values when they have Type::Bottom

Summary: When we analyze a CheckTypeMem, we intersect its typeParam with the
knownType we're tracking.  If the CheckTypeMem is always going to fail this can
leave the knownType as Bottom.  We could try to eliminate the fallthrough in
this case, but for now let's just make sure we don't break IR rules by
generating an AssertType<Bottom> later.

Reviewed By: @alexmalyshev

Differential Revision: D1732250

Signature: t1:1732250:1418252941:e42d488ff67adf9d8fe011e2e0c2ffe0daddb979
RFC: Native Property Handlers

Summary: Fixes #4100

==Problem==

We have a lot of cases [1] when user-level classes extend some native classes, and after implementing magic methods like `__get`, `__set`, etc in the child classes, some native properties which are implemented in the base classes with the same `__get` become broken. Users have to call `parent::__get` in order to retrieve correct value.

The problem details are described in [2].

This diff stratifies implementation-level and user-level handling of magic properties.

[1] https://github.com/facebook/hhvm/issues/4100#issuecomment-61378662
[2] https://www.prod.facebook.com/groups/hhvm.dev/permalink/306537302868709/

==Design notes==

- Native handling of the magic properties is done via "PropHandler" classes. A prop handler class corresponds to its actual class, and should be registered for the actual class name. Example:

  // Define prop handler for the `Element` class

  class ElementPropHandler {
    static Variant getProp(ObjectData* this_, const StringData* name) {
      // get `name` prop
    }
  }

- The default registering of the handler is done providing the handler and the actual classes. In this case the handler class implements all the accessor hooks:

  // Register the handler.
  Native::registerNativePropHandler<ElemntPropHandler>(s_ElementClass.get());

- It is possible to register the handler with custom handling callbacks.

  Native::registerNativePropHandler(s_ElementClass.get()
                                    &customGetProp,
                                    &customSetProp
                                    ...);

- At property resolution (in `object-data.cpp`) the caller invokes generic `Native::getProp` passing the object data (`this` value), and the prop name:

  Native::getProp(this, propName);

Note: In the `object-data.cpp` I've implemented only for getProp yet. Will add others (set, isset, unset, dim) after initial review.

Reviewed By: @paulbiss

Differential Revision: D1669546
Update mbstring to support latest libmbfl

Summary: I am updating `libmbfl` to the latest code, bringing us from what was used in PHP 5.2 to
what is currently being used in PHP 5.6. We needed to modify `ext_mbstring.cpp` to
support this update.

Reviewed By: @markw65

Differential Revision: D1713697

Signature: t1:1713697:1418140057:42b2779814ce01d45ce5b53c5b17cbb0f7819b31