Merge pull request #4033 from markw65/HHVM-3.3

Fix a crash in nested file functions
Revert "Custom path to the installed folder"

Summary: I'm torn on this so want to use this for discussion. Should the INSTALL_PATH namespace where we get `/etc/hhvm/php.ini` from? I'm assuming it was added for someone on those other systems, but I do know that on apple things are read from `/etc` without namespacing to `/usr/local` so I'm assuming the rest of that is wrong. Thoughts?

Fixes https://github.com/hhvm/packaging/issues/71

Reviewed By: @paulbiss

Differential Revision: D1560037
Merge pull request #4052 from simonwelsh/cherry-picking

Merge 676a53aec9e14cd53cfe69be09843b551c8fc6a7 into 3.3
Simple curl change

Summary: This is stemming from issue #4002, but I don't think fixes it.

With code like this:

```
<?php

$file = new CurlFile(__DIR__. '/curl_testdata1.txt');
$ch = curl_init();
curl_setopt($ch, CURLOPT_POSTFIELDS, array("file" => $file));
curl_exec($ch);
var_dump($file->name);
var_dump($file->postname);
```

`$postname` is empty in both PHP 5.6 and HHVM.

It will be tested by the issue raiser though on a real request when it lands to GitHub.

At the very least, this is a consistency fix. At the very best, a miracle happens

The claim is that on requests, HHVM is setting filename empty like this:

```
Content-Disposition: form-data; name="file"; filename=""
Content-Type: application/octet-stream
```

while PHP 5.6 it is:

```
Content-Disposition: form-data; name="file"; filename="/home/vagrant/Sites/poshonpennies.com/app/routes.php"
Content-Type: application/octet-stream
```

Reviewed By: @ptarjan

Differential Revision: D1621800
Merge pull request #4058 from JoelMarcey/HHVM-3.3-curl_fix_cherry_pick

Simple curl change
LZ4_uncompress is obsolete, breaks build with out-of-tree LZ4.

Summary: LZ4_uncompress() has been replaced 1:1 with LZ4_decompress_fast().  When
you use an out-of-tree liblz4 r122 or beyond, LZ4_uncompress doesn't exist
anymore.  From bottom of lz4.h:

 [...]
 /*
 Obsolete decompression functions
 These function names are deprecated and should no longer be used.
 They are only provided here for compatibility with older user programs.
 - LZ4_uncompress is the same as LZ4_decompress_fast
 - LZ4_uncompress_unknownOutputSize is the same as LZ4_decompress_safe
 */
 int LZ4_uncompress (const char* source, char* dest, int outputSize);
 [...]

LZ4_decompress_fast() is already present in third-party's copy, so even if this
is not breaking a build with an internal lz4, it is for Debian and any other that
may have the library outside of the HHVM tree detected by CMake.

Closes: https://github.com/facebook/hhvm/issues/3610

Reviewed By: @ptarjan

Differential Revision: D1628566
EZC: clear EG(exception) on return from zend_wrap_func()

Summary: Otherwise, if the exception is caught and then control is returned into
a zend_call_function() call which wrapped the throwing function, then
zend_call_function() will erroneously rethrow the exception, even though
it has already been handled.

https://bugzilla.wikimedia.org/show_bug.cgi?id=71174
Closes https://github.com/facebook/hhvm/pull/3834

Reviewed By: @ptarjan

Differential Revision: D1574411
Fix Memcached::(inc|dec)rement(ByKey)? when ASCII protocol is used

Summary: We weren't correctly dispatching to the right memcached_* function,
causing it to always fail when using the ascii protocol. There's still one
divergence from PHP5: if an initial_value is given but the connection is using
the acsii protocol, PHP will raise a warning and return false, but we'll
silently ignore the initial value and continue on with the increment. Details
are in the comment.

Closes https://github.com/facebook/hhvm/issues/3839

Reviewed By: @ptarjan

Differential Revision: D1579907
Support custom stream wrappers in XMLReader::open()

Summary: This is similar to the treatment that was applied to a few other places in
842d6fb7dcd6d: manually create an IO object and use that to create the
xmlTextReader, rather than just calling xmlReaderForFile. This fixes web
importing of pages in MediaWiki.

Closes https://github.com/facebook/hhvm/pull/3840

Reviewed By: @ptarjan

Differential Revision: D1576426

Pulled By: @swtaarrs
Make RUSAGE_THREAD available to getrusage PHP function

Summary: The signature of the PHP function is getrusage( [ int $who = 0 ] ).
In both HHVM and PHP5, $who can be 1 to request RUSAGE_CHILDREN data. This
change allows $who to be 2 to request RUSAGE_THREAD data. RUSAGE_THREAD
measures resource usage for just the calling thread.

This allows HHVM PHP code to measure resource usage for the current request.
(In PHP5 this can be done with RUSAGE_SELF, by dint of the threading model.)
Closes https://github.com/facebook/hhvm/pull/3632

Reviewed By: @JoelMarcey

Differential Revision: D1530059
EZC: Fix count() and conversion to boolean of ProxyArray

Fix JIT versions of count() and conversion of array to boolean, so
that they work with ProxyArray. In both cases, duplicate the logic in
ArrayData::size() -- if the sign bit of the size field is unset, use
that field, otherwise call vsize().

The resulting generated machine code for conversion to boolean is along
the lines of:

  mov    0x4(%rdi),%eax
  test   %eax,%eax
  js     0xf80049b
  setne  %al

where 0xf80049b is the slow path. This is similar to the machine code I
previously reported for ArrayData::size() in code review of 1717e028f18
(see #3065).

Added test case which previously failed.
Targetting 3.3.2-dev
Silence warning from CMake Policy CMP0026

Summary: get_target_property(... LOCATION) is deprecated and
throws a warning as of CMake 3.0.0.  Switch to using the generator
expression $<TARGET_FILE> instead to silence the warning.

Reviewed By: @JoelMarcey

Differential Revision: D1641895
Support fb_unsafe_openssl_pkcs7_verify_ignore_cert_expiration only for openssl versions >= 1.0

Summary: X509_STORE_set_verify_cb, that this function relies on, works only for openssl versions >= 1.0

Reviewed By: @ptarjan

Differential Revision: D1598395
Backport for 3.3 branch: Fix for phar:// stream wrapper with no stub

Just read an article about 3.3.1
This is exactly the same as pull request #4080 for master branch
Modified patch similar to master
Merge pull request #4101 from nazar-pc/patch-2

Backport for 3.3 branch: Fix for phar:// stream wrapper with no stub
Only try to autoload classes with valid names

Summary: spl_autoload_register(function($class) { require "/my/classpath/$class.php"; });

means

    $class = $_GET['view_module'];
    new $class();

is now an RCE using /?view=../../../../../../../var/log/httpd/access_log%00

It should only allow characters that are valid in class names.

Reviewed By: @markw65

Differential Revision: D1556938

Pulled By: @ptarjan
The next 3.3 will be 3.3.2
Merge pull request #4191 from GrahamCampbell/patch-1

The next 3.3 will be 3.3.2