Fix assert in CodeGenerator::emitTypeCheck

The vector translator produced a type that was
boxed-array-or-string, which we couldnt guard on.

Since applying a SetM to a string will almost always produce
a string, change it to report string instead (which will still
be guarded on).

hphp/runtime/vm/translator/hopt/vectortranslator.cpp

@@ -118,7 +118,15 @@ void VectorEffects::init(Opcode op, const Type origBase,
     // definitely happen but those cases aren't handled yet. In a perfect world
     // we would remove Type::Null from baseType here but that can produce types
     // that are tricky to guard against and doesn't buy us much right now.
-    baseType = baseType.isNull() ? newBase : (baseType | newBase);
+    if (!baseBoxed || !baseType.isString()) {
+      /*
+       * Uses of boxed types are always guarded, in case the inner
+       * type was modified. If the base type was String, its extremely
+       * likely to still be a String, so leave it as such, and we'll
+       * exit in the rare case that it changed.
+       */
+      baseType = baseType.isNull() ? newBase : (baseType | newBase);
+    }
     baseValChanged = true;
   }
   if (op == SetElem && baseType.maybe(Type::Arr)) {

hphp/test/vm/setmstr.php

@@ -0,0 +1,10 @@
+<?php
+
+function foo(&$str) {
+  $str[3] = '.';
+  $str .= "\n";
+}
+
+$a = "abc";
+foo($a);
+var_dump($a);

hphp/test/vm/setmstr.php.exp

@@ -0,0 +1,2 @@
+string(5) "abc.
+"