Fix the hard-return-type-enforcement crash

Summary: The root cause was a double IterFree. When emitting bytecode for return
statements, we did an IterFree followed by VerifyRetType and Ret.
Trouble is, if the VerifyRetType throws (the usual catchable fatal
doesn't count; you have to throw from the user error handler), we go to
a fault funclet where we do the IterFree again.

The potential for this bug has existed for a long time, I think, but
there's no way it would have bitten us until we turned on hard return
types because there's no other way to throw through this narrow window
where it's incorrect.

Reviewed By: @markw65, @jdelong

Differential Revision: D1752318