Delete interpreter type-profiling code

Summary: This isn't doing anything now that we PGO everything, and it added a
fair bit of complexity to some jit functions. This doesn't touch the "runtime
type profiler" which is something unrelated to type prediction in the jit, and
the non-type warmup profiling for Func hotness and InstanceBits is still
around.

Reviewed By: @alexmalyshev, @jdelong

Differential Revision: D1732733

Signature: t1:1732733:1418259277:acffb558bef3ccc0d1b1ca24bee8918b5e5a9197
Delete unused runtime type profiler

Reviewed By: @bertmaher

Differential Revision: D1732855

Signature: t1:1732855:1418260442:c25585f4ef14958527dd8f8e539b4befcbe88531
Fix another use-after-free

Reviewed By: @edwinsmith

Differential Revision: D1732277

Signature: t1:1732277:1418257892:221f1fb48c2bfb5e00b135dfca5deca57352ebbb
Fix an order of destruction issue

Summary: Noticed while reviewing D1715120. The destructors of any objects
in the old array might be able to access the old array after we started
destroying it.

Reviewed By: @edwinsmith

Differential Revision: D1732598

Signature: t1:1732598:1418258130:233e071d7c069eec826625df1857be78c175bea5
Clobber things in destructors

Summary: Makes it much easier to find use-after-free bugs

Reviewed By: @swtaarrs, @edwinsmith

Differential Revision: D1732294

Signature: t1:1732294:1418254050:874df2302726fb041359577da6640a4a903576e3
Actually upward traverse directories for files

Summary: I believe we have been living with a subtle bug in the test runner for a while.
`find_file_for_dir()` was not actually traversing backwards correctly. This
doesn't manifest itself because we normally run the test runner from the
`hphp` directory and `$dir` has enough information in it to traverse the
appropriate levels back to be ok.

However, if we run the test run from something like `hphp/test/slow`, then
we lose it.

For example, from the `test/slow` directory

`../run sanity/0.php` should have been using the `config.ini` file
in `test/slow`. However, given that `$dir` was `sanity` as we did not
have any full path information,  we always fell out of the `while` loop
on the `$dir = '.'` condition after the first run since we didn't have the
full path to the directory/file in question, we would always just fallback to
the default `config.ini` in `./test` instead.

```
../run --verbose sanity/0.php
Running 1 tests in 1 threads (0 in serial)
sanity/0.php passed

All tests passed.
              |    |    |
             )_)  )_)  )_)
            )___))___))___)\
           )____)____)_____)\
         _____|____|____|____\\__
---------\      SHIP IT      /---------
  ^^^^^ ^^^^^^^^^^^^^^^^^^^^^
    ^^^^      ^^^^     ^^^    ^^
         ^^^^      ^^^

Run these by hand:
../../../_bin/hphp/hhvm/hhvm -c /data/users/joelm/fbcode-baseline/hphp/test/config.ini -vEval.EnableArgsInBacktraces=true -vEval.EnableIntrinsicsExtension=true -vRepo.Local.Mode=-- -vRepo.Central.Path=/data/users/joelm/fbcode-baseline/_bin/verify.hhbc -vEval.Jit=true    -vResourceLimit.CoreFileSize=0    --file 'sanity/0.php'
```

Reviewed By: @paulbiss

Differential Revision: D1729338

Signature: t1:1729338:1418169425:e2124a5b817141a1ac4d62c4b8102c5eea2874c6
Convert ZendCustomElement to smart-allocation

Summary: It was new'd, not Sweepable, not persisted, and has no fields
that need sweeping.

Reviewed By: @paroski

Differential Revision: D1714802
Add an ocaml wrapper for find path1 ... pathN -name pattern

Summary: This is useful for finding all files recursively in a directory. I
started to do this in ocaml before I realized I was just reimplementing find.

Reviewed By: @bhosmer

Differential Revision: D1700338

Signature: t1:1700338:1418324335:119aac82f1323588778f77ab4a8fb9265d1df428
Remove list_classes support

Summary: Removing --list_classes support

Reviewed By: @jcreedcmu

Differential Revision: D1728617

Signature: t1:1728617:1418157029:68916eb05148efaf61be22e9190210b0b0dcf047
Don't allow load-elim to reuse values when they have Type::Bottom

Summary: When we analyze a CheckTypeMem, we intersect its typeParam with the
knownType we're tracking.  If the CheckTypeMem is always going to fail this can
leave the knownType as Bottom.  We could try to eliminate the fallthrough in
this case, but for now let's just make sure we don't break IR rules by
generating an AssertType<Bottom> later.

Reviewed By: @alexmalyshev

Differential Revision: D1732250

Signature: t1:1732250:1418252941:e42d488ff67adf9d8fe011e2e0c2ffe0daddb979
RFC: Native Property Handlers

Summary: Fixes #4100

==Problem==

We have a lot of cases [1] when user-level classes extend some native classes, and after implementing magic methods like `__get`, `__set`, etc in the child classes, some native properties which are implemented in the base classes with the same `__get` become broken. Users have to call `parent::__get` in order to retrieve correct value.

The problem details are described in [2].

This diff stratifies implementation-level and user-level handling of magic properties.

[1] https://github.com/facebook/hhvm/issues/4100#issuecomment-61378662
[2] https://www.prod.facebook.com/groups/hhvm.dev/permalink/306537302868709/

==Design notes==

- Native handling of the magic properties is done via "PropHandler" classes. A prop handler class corresponds to its actual class, and should be registered for the actual class name. Example:

  // Define prop handler for the `Element` class

  class ElementPropHandler {
    static Variant getProp(ObjectData* this_, const StringData* name) {
      // get `name` prop
    }
  }

- The default registering of the handler is done providing the handler and the actual classes. In this case the handler class implements all the accessor hooks:

  // Register the handler.
  Native::registerNativePropHandler<ElemntPropHandler>(s_ElementClass.get());

- It is possible to register the handler with custom handling callbacks.

  Native::registerNativePropHandler(s_ElementClass.get()
                                    &customGetProp,
                                    &customSetProp
                                    ...);

- At property resolution (in `object-data.cpp`) the caller invokes generic `Native::getProp` passing the object data (`this` value), and the prop name:

  Native::getProp(this, propName);

Note: In the `object-data.cpp` I've implemented only for getProp yet. Will add others (set, isset, unset, dim) after initial review.

Reviewed By: @paulbiss

Differential Revision: D1669546
Update mbstring to support latest libmbfl

Summary: I am updating `libmbfl` to the latest code, bringing us from what was used in PHP 5.2 to
what is currently being used in PHP 5.6. We needed to modify `ext_mbstring.cpp` to
support this update.

Reviewed By: @markw65

Differential Revision: D1713697

Signature: t1:1713697:1418140057:42b2779814ce01d45ce5b53c5b17cbb0f7819b31
Fix error_get_last() not cleared when error handle function entered

Summary: This also :
  - make get_last_error() not available in error handler like
    PHP, see http://3v4l.org/QKQKY
  - clear last error when request shutdown, prevent errmessage
    leak to the next request

Closes #4407
Closes https://github.com/facebook/hhvm/pull/4414

Reviewed By: @JoelMarcey

Differential Revision: D1727912

Signature: t1:1727912:1418338155:ce9f5e5568231a18c6b45ff6247cf2182471e5eb
Mock date/time functions in Isolation.php

Summary: Mock date/time functions (e.g. time() ) so they never return the same value when calling multiple times.
By doing so, more flakey test cases can be found.

Closes https://github.com/facebook/hhvm/pull/4384

Reviewed By: @JoelMarcey

Differential Revision: D1719095

Signature: t1:1719095:1418338273:e3867d429e3162f1110e96b1c16677da5872d8c0
Disable PGO for pseudo-mains

Summary: JITing pseudo-mains requires extra checks that blow the IR.  PGO can
significantly increase the size of the regions, so disable it for
pseudo-mains (so regions will be just tracelets).

Reviewed By: @swtaarrs

Differential Revision: D1734379
Add PHP_INT_MIN

Summary: `PHP_INT_MIN` constant was added in php-src (https://github.com/php/php-src/pull/755)

Let's add it too.

Had to go through some IDL to code generation hoops because of possible overflow issues
with min int64_t with the `-` unary operator.

Reviewed By: @markw65

Differential Revision: D1724355

Signature: t1:1724355:1418051922:434367e548de2539916b55b3b3510294a2bfe608
Move ParseTimeFatalException to hphp/parser

Summary: Allow the parser to throw this without making it dependent on hphp/runtime

Reviewed By: @markw65

Differential Revision: D1729474

Signature: t1:1729474:1418341460:97a1b0b693ce283c0448149d10dd4033f75aecc1
Fix TransFlags support in makeExit

Summary: I broke this during some refactors.

Reviewed By: @swtaarrs

Differential Revision: D1731904

Signature: t1:1731904:1418248995:fa02fe6fb4b492dd22bbf62358af692414175101
Mark extension test runner as executable

Summary: This is the last change needed for the "make test" command to work for me, hopefully.
Closes https://github.com/facebook/hhvm/pull/4420

Reviewed By: @JoelMarcey

Differential Revision: D1730984

Signature: t1:1730984:1418349868:b18b10b490378553552c99ed001c259794d120c8
Clean up ObjectData::getProp(), remove ObjectData::zGetProp()

Summary: getProp() was taking three bool& parameters: visible, accessible, and
unset. Turns out, only accessible is needed, as visible is the same as checking
propTV != nullptr, and unset is propTV->m_type == KindOfUninit.

This diff makes a struct PropLookup that matches Class::PropLookup, and returns
it by value from getProp().

ObjectData::zGetProp() was breaking my logic for "unset", because we can't box
an uninit typed value, but it only has one callsite. So I just inlined it, which
let me handle the uninit case.

Reviewed By: @bertmaher

Differential Revision: D1711594

Signature: t1:1711594:1417738687:033471c39c5cdc2f1410a138d3c35888cdf90434