Fix SpillStack's argument validation

It was asserting that the input to a SpillStack is
a subtype of one of Gen, Cls or None, rather than subtype of
Gen|Cls or None.

Added a new type Type::StackElem, and used it.

hphp/doc/ir.specification

@@ -169,6 +169,11 @@ above PHP-facing types.
   TCA             Machine code address
   Nullptr         Represents a null pointer
 
+There is also one special type which represents all the possible types that
+can be on the stack.
+
+  StackElem       {Gen|Cls}
+
 In the instruction descriptions below, we also use a "Const" prefix on
 several types loosly, which means the operand must be the requested
 type and must be a compile-time constant.  The optimizer relies on

hphp/runtime/vm/jit/test/type.cpp

@@ -190,6 +190,7 @@ TEST(Type, CanRunDtor) {
   expectTrue(Type::Obj | Type::Func);
   expectTrue(Type::Init);
   expectTrue(Type::Top);
+  expectTrue(Type::StackElem);
 
   for (Type t : types) {
     EXPECT_FALSE(t.canRunDtor()) << t.toString() << ".canRunDtor == false";

hphp/runtime/vm/jit/type.cpp

@@ -353,7 +353,7 @@ void assertOperandTypes(const IRInstruction* inst) {
       // SpillStack slots may be stack types or None, if the
       // simplifier removed some.
       auto const valid = inst->src(curSrc)->type()
-        .subtypeOfAny(Type::Gen, Type::Cls, Type::None);
+        .subtypeOfAny(Type::StackElem, Type::None);
       check(valid, "Gen|Cls|None");
     }
   };

hphp/runtime/vm/jit/type.h

@@ -89,6 +89,7 @@ using Transl::RuntimeType;
   IRT(Counted,      kCountedStr|kCountedArr|kObj|kBoxedCell)        \
   IRT(PtrToCounted, kCounted << kPtrShift)                          \
   IRT(Gen,          kCell|kBoxedCell)                               \
+  IRT(StackElem,    kGen|kCls)                                      \
   IRT(Init,         kGen & ~kUninit)                                \
   IRT(PtrToGen,     kGen << kPtrShift)                              \
   IRT(PtrToInit,    kInit << kPtrShift)

hphp/test/slow/array_init/add_elem_c_interp.php

@@ -0,0 +1,15 @@
+<?php ;
+
+class X {
+  public $foo;
+
+  function test() {
+    $a = array(
+      null => $this->foo,
+    );
+    return $a;
+  }
+}
+
+$x = new X;
+var_dump($x->test());

hphp/test/slow/array_init/add_elem_c_interp.php.expect

@@ -0,0 +1,4 @@
+array(1) {
+  [""]=>
+  NULL
+}