Fix infinite loop in hh --color.

Summary: My previous algorithm assumed an invariant that did not actually
hold. I've made that invariant hold, in addition to describing it explicitly
in a comment.

Reviewed By: @jwatzman

Differential Revision: D1654746
Fix hphpd crash when printing systemlib classes

Summary: fixes facebook/hhvm#4075

Reviewed By: @paulbiss

Differential Revision: D1642223
Convert smart_new to use smart_malloc()

Summary: We need headers on every object to make the heap parseable.

Reviewed By: @jdelong

Differential Revision: D1654899
Add ** operator to the hack typechecker

Summary: Add the exponential operator to the hack type checker

Reviewed By: @elgenie

Differential Revision: D1647793
Move freeInline decision from translateRegion to hhbc-translator

Summary: One less NormalizedInstruction use.

Reviewed By: @alexmalyshev

Differential Revision: D1651076

Signature: t1:1651076:1414994554:e4ef2e98dbaa4bbcfa05f859394815b37d0b47d4
Make sure Type::Bottom is a subtype of everything

Summary: Specialized object types were failing this; possibly other cases.

Reviewed By: @alexmalyshev

Differential Revision: D1653805
Pull out enough of D1629737 to fix an minstr bug (BlockPauser)

Summary: I've run into this while working on getting rid of inner ref types.

I used a different name so I didn't need to rename the other callsites, but it
should be easy to merge.

Reviewed By: @alexmalyshev

Differential Revision: D1653906

Signature: t1:1653906:1414805508:2f03f689a323f69c991c7b69592c3978f04e1c37
Allow various PROGRAMs to decide what updates they want to receive

Summary: Previously all updates were being filtered and split into PHP updates and JS updates. This moves the responsibility to the `PROGRAM` that is receiving the updates

Reviewed By: @bhosmer

Differential Revision: D1650488

Signature: t1:1650488:1414711460:bec8da02074fb5b2e17ce14cf667f224c559b72d
Support GCC/LLVM stack-smashing protection

Summary: Turn it on with `cmake -DENABLE_SSP=1` Protection buffer/stack overflow exploits.

Starting with version GCC 4.9 there is support for more advanced protection from overflows `-fstack-protector-strong` (minor loss of performance), the version below only support `-fstack-protector`.
LLVM 3.6 supports `-fstack-protector-strong` prior to this worked as a stripped-down option `-fstack-protector`.

This option protects the stack from overflowing/exploiting/debug and implementation process for laying.
RHEL, CentOS, Ubuntu uses these options to build all binary deb packages in the delivery.

This optional (default=disabled), need more testing.

More info:
- [RELRO: RELocation Read-Only](https://isisblogs.poly.edu/2011/06/01/relro-relocation-read-only/)
- [Improve your software security with GCC Stack Protector Strong](http://www.simonroses.com/2013/04/appsec-improve-your-software-security-with-gcc-stack-protector-strong/)
- [Hardening overflowing/exploiting/debug](https://wiki.debian.org/Hardening#Stack_
Closes https://github.com/facebook/hhvm/pull/4091

Reviewed By: @sgolemon

Differential Revision: D1646057

Signature: t1:1646057:1415053149:366a56d35c1298db8192bb291c55f183b4c2f95f
Adding check for creating function called __construct

Summary: The typechecker allowed creating a function called `__construct`
outside of class scope. This change disallows creating
a function with name `__construct`.

Reviewed By: @jwatzman

Differential Revision: D1648756
Delete (instead of free) Class::m_extra

Summary: It's allocated by new, so we should probably be symmetric.

Reviewed By: @mxw

Differential Revision: D1655737

Signature: t1:1655737:1415049149:c4ce71784fc9f6aed1a962f026a7d39c75a603ce
More fixes to kernel version pattern

Summary: Restrict the pattern to match the appropriate number of characters,
and assert that an acceptable number of fields are parsed.  Also split up the
test cases so it's easier to see which ones are failing.

Reviewed By: @markw65

Differential Revision: D1655782

Signature: t1:1655782:1415049423:1e1a6f665c1c8f129e48f9df120f7715f69034ca
Fix a use-after-free issue with TimeZone

Summary: I'm trying to debug a double free issue with
TimeZone. I don't think this is it, but in the case
of a race, GetTimeZoneInfoRaw would have returned
a raw pointer, right after freeing it. So there was
certainly a use-after-free issue here.

Reviewed By: @ottoni

Differential Revision: D1651248
More pretty printing fixup

Summary: Vasm code gen can generate blocks in the cold or frozen regions
even if the particular IR block is not hinted at being in either. The
pretty printed disassembly step at the end of code gen did not account
for this, so it would only print the code from the area that the IR
block originally though it was in. This diff fixes this issue by iterating all
of the areas for each IR instruction and dumping all of the code from any asm
range associated with that instruction.

Reviewed By: @jdelong

Differential Revision: D1655171