don't statically link libgcc/libstdc++ by default on OSX

Summary: A previous commit, 552b409dbc71cc9e8a0487fbd6e915f9d7330598, caused us
to always statically link for the sake of portability. However, there
currently exists a bug in (homebrew?) gcc which is causing exceptions
thrown by the application to call abort instead of properly unwinding
and allowing the exception to be caught. An example can be found here:
https://bugs.busybox.net/show_bug.cgi?id=7208

HHVM uses throw/catch in Repo::schemaExists to determine if a table
exists. This caused a runtime crash on OSX.

Ideally we'll be moving to clang on OSX in the near future anyway, but
if, for whatever reason, we want to use gcc *and* statically link at
some point, we can use the recently added cmake option STATIC_CXX_LIB
to do so.
Closes https://github.com/facebook/hhvm/pull/3480

Reviewed By: @JoelMarcey

Differential Revision: D1500299

Pulled By: @sgolemon
Fix information leak in hash_equals() implementation

Summary: Existing code had branches which could potentially be
exploited to determine $known_len.  Stick to always
doing the same work regardless of $known_len.

Note that this depends on the compilation of this:

  if (ki < known_limit) {
    ++ki;
  }

Turning into:

  CMP (ki), (known_limit)
  ADC (ki), 0

Since our BC->IR->ASM loop doesn't do that,
I moved it back to C++ where we get better
compilation.

Reviewed By: @apage43

Differential Revision: D1490528
trim values in json_decode for null, true and false

Summary: JSON RFC says to consider as whitespace: space, tab, LF, CR
Closes https://github.com/facebook/hhvm/pull/3478

Reviewed By: @fredemmott

Differential Revision: D1500291

Pulled By: svcscm
Fix mcrypt_create_iv(..., MCRYPT_RAND) to auto-seed RNG

Summary: Without seeding the random number generator,
we'll always get the same IV, and that reduces the security
of this function.

Fortunately, f_rand() has all of that logic for auto-seeding
and selection of a suitable initial seed built-in.

Realistically, using MCRYPT_RAND should be deprecated.
I'm going to wait on PHP Internals to make a decision on
https://wiki.php.net/rfc/deprecate_mcrypt_rand
before adding that warning however, so that our test suite
remains consistent.

Credit: Theodore R. Smith of PHP Experts, Inc. <theodorephpexperts.pro>

Closes #3496

Reviewed By: @ptarjan

Differential Revision: D1502435
Print inline frames in `walkstk`

Summary: Now I don't have to type `bt` anymore.

Reviewed By: @edwinsmith

Differential Revision: D1502349