Don't read freed locals in debugBacktrace when leaving a builtin

Summary: debugBacktrace has some logic to avoid reading locals after they've
been freed while returning, by checking for certain bytecodes at m_pc. This
didn't cover the case where we're returning from a builtin since the pc points
to NativeImpl. Just adding a case for NativeImpl seemed like overkill since
that's the case during the entire builtin, so just check the flag on the ActRec
that's conveniently set by the function exit hook.

Reviewed By: @jano

Differential Revision: D1371047
Fix hhir guard relaxation for specialized types

Summary: DataTypeSpecialized by itself isn't a strong enough constraint: we
also need to know which specific class the caller wants or if they want an
ArrayKind. This diff adds support for storing this information in
TypeConstraint and all the associated machinery.

The problem was using DataTypeSpecialized to constraint a CheckType<Packed> on
an array that already had a RepoAuthType::Array in its type: the source type
was already specialized so we thought it was safe to not constrain the
CheckType, leading to a not necessarily Packed array being given to
LdPackedArrayElem. To prevent this from happening undetected in the future, I
added support for array kinds to the IR opcode table.

Reviewed By: @jdelong

Differential Revision: D1369432
Change PostorderSort for slightly better codegen

Summary: If we have something like this (where none of the blocks involved are
cold):

        B12
  (next)|  \(taken)
        v   \
        B13  B14
        |   /
        v  /
        B15

our rpo sort algorithm would return 12, 14, 13, 15. This caused the generated
code to look something like this:

  B12
    Jcc -> B14
    Jmp -> B13
  B14
    Jmp -> B15
  B13
  B15

By flipping the order of next and taken in this situation, it's still a valid
postorder walk, but the resulting code has two jumps instead of three:

  B12
    Jcc -> B14
  B13
    Jmp -> B15
  B14
  B15

Reviewed By: @jdelong

Differential Revision: D1365041
Properly support $php_errormsg in the JIT

Summary: Any instruction that can raise an error can modify this local, even
when we're not in pseudomains. analyze() was mostly handling this but hhir had
no knowledge of it, breaking the tracelet selector and potentially leading to
subtle bugs in PGO mode.

Reviewed By: @bertmaher

Differential Revision: D1370271
Turn on tracelet region selector by default

Summary: It's ready.

Reviewed By: @jdelong

Differential Revision: D1302850
Check fully-resolved rhs of type aliases for compatibility

Summary: Type aliases to other type aliases were fataling in repo mode
because we would cache the fully-computed type on the right hand side,
but on future requests we'd check that against the shallow type.

Reviewed By: @jdelong

Differential Revision: D1371216
Revert "Created uncounted string in APC all the time and uncounted array more often if the InnerUncounted runtime option is on"

Summary: This reverts commit 5988c58ada9b5e0c9f88ff7e1d8d2b03b1a443f5.

Reviewed By: @ptarjan

Differential Revision: D1366638
The method RedisSessionModule::destroy is supposed to return a bool

Summary: Without this change, the following php fails in session_destroy :
```
<?php
ini_set('session.save_handler', 'redis');
ini_set('session.save_path', 'tcp://127.0.0.1:6379?database=5&prefix=PHPREDIS_SESSION:');
session_start();
session_destroy();
?>
```
because $redis->del($key) returns a long and not a boolean
Closes #2889

Reviewed By: @ptarjan

Differential Revision: D1371243

Pulled By: @JoelMarcey
Add support for ParamCoerceModeFalse

Summary: Closes #2885

Reviewed By: @ptarjan

Differential Revision: D1371239

Pulled By: @JoelMarcey
Add branch back to the Travis CI icon.

Summary: It was inadvertently removed in 99d0c79.
Closes #2887

Reviewed By: @ptarjan

Differential Revision: D1371242

Pulled By: @JoelMarcey
Fixed property access to DOM and XMLReader classes (issue #1989)

Summary: Previously properties in the DOM extension and XMLReader class could be
accessed case-insensitively, because the properties were backed by a
case-insensitive map. This fixes that.

isset on DOM classes was broken before, this also fixes that.

The behavior of accessing invalid properties on DOM classes was also
inconsistent, this has been fixed. Before, unlike PHP and unlike other
objects, accessing an invalid property on DOM classes would result in
a fatal error.

Changing the type of map backing the DOM properties results in a different
ordering in var_dump. I've changed the tests to reflect this
(the ordering didn't match php before, so this doesn't break compatibility
there).

Reviewed By: ptarjan, liranuna

Differential Revision: D1362865
check return of nice()

Summary: We compile with some option that emits a notice when you ignore a non-void function. What should happen on -1 here?

Reviewed By: @jwatzman

Differential Revision: D1371387
stop talking about fbmake

Summary: Closes #2895

Reviewed By: @fredemmott

Differential Revision: D1371719
fix typo in usage for IMPLEMENT_STATIC_REQUEST_LOCAL

Summary: Closes #2899

Reviewed By: @ptarjan

Differential Revision: D1373800

Pulled By: @JoelMarcey
Avoid persisting stream filters across requests (stream_filter_register)

Summary: Closes #2900

Reviewed By: @ptarjan

Differential Revision: D1373808

Pulled By: @JoelMarcey
Make it clearer to gcc that open(2) is never called with O_CREAT without mode

Summary: We already ensure that this is never done, but `gcc` isn't smart enough to tell that.
Closes #2898

Reviewed By: @ptarjan

Differential Revision: D1373801

Pulled By: @JoelMarcey
Fix incorrect access to cold() and frozen()

Summary: You can't access cold() unless you own the CodeCache,
because it depends on the CodeCache's m_selection. This is
currently causing asserts to fire if you ask for the tc usage
via the admin port while we're jitting.

Use realCold, and realFrozen instead.

Reviewed By: aravind

Differential Revision: D1372564
don't buffer overrun on bad DNS TXT records

Summary: The TXT record is transmitted as

    ...stuff... [record length] ...stuff... [chunk length] chunk [chunk length] chunk ...

We preallocate a buffer of size `record length` but if any `chunk length` goes longer than that we happily overrun the end of the array. php5 is vulnarable to this as well. I'll send a PR.

Reviewed By: bertrand, joelm

Differential Revision: D1373942
bump tested guzzle4 version

Summary: Should stop raciness between guzzle3 and guzzle4 trying to use the same port.

Reviewed By: @JoelMarcey

Differential Revision: D1374311
Use makePseudoMainExit in more places

Summary: These exits are only used if we're in a pseudomain, so don't
do the work of generating them unless we have to.

Reviewed By: @ottoni

Differential Revision: D1373537