Actually upward traverse directories for files

Summary: I believe we have been living with a subtle bug in the test runner for a while.
`find_file_for_dir()` was not actually traversing backwards correctly. This
doesn't manifest itself because we normally run the test runner from the
`hphp` directory and `$dir` has enough information in it to traverse the
appropriate levels back to be ok.

However, if we run the test run from something like `hphp/test/slow`, then
we lose it.

For example, from the `test/slow` directory

`../run sanity/0.php` should have been using the `config.ini` file
in `test/slow`. However, given that `$dir` was `sanity` as we did not
have any full path information,  we always fell out of the `while` loop
on the `$dir = '.'` condition after the first run since we didn't have the
full path to the directory/file in question, we would always just fallback to
the default `config.ini` in `./test` instead.

```
../run --verbose sanity/0.php
Running 1 tests in 1 threads (0 in serial)
sanity/0.php passed

All tests passed.
              |    |    |
             )_)  )_)  )_)
            )___))___))___)\
           )____)____)_____)\
         _____|____|____|____\\__
---------\      SHIP IT      /---------
  ^^^^^ ^^^^^^^^^^^^^^^^^^^^^
    ^^^^      ^^^^     ^^^    ^^
         ^^^^      ^^^

Run these by hand:
../../../_bin/hphp/hhvm/hhvm -c /data/users/joelm/fbcode-baseline/hphp/test/config.ini -vEval.EnableArgsInBacktraces=true -vEval.EnableIntrinsicsExtension=true -vRepo.Local.Mode=-- -vRepo.Central.Path=/data/users/joelm/fbcode-baseline/_bin/verify.hhbc -vEval.Jit=true    -vResourceLimit.CoreFileSize=0    --file 'sanity/0.php'
```

Reviewed By: @paulbiss

Differential Revision: D1729338

Signature: t1:1729338:1418169425:e2124a5b817141a1ac4d62c4b8102c5eea2874c6
Convert ZendCustomElement to smart-allocation

Summary: It was new'd, not Sweepable, not persisted, and has no fields
that need sweeping.

Reviewed By: @paroski

Differential Revision: D1714802