Fix bug with boxed type hints

We assumed the inner type remained the same from invocation
to invocation without guarding on it.

hphp/runtime/vm/translator/hopt/hhbctranslator.cpp

@@ -2359,6 +2359,9 @@ void HhbcTranslator::emitVerifyParamType(int32_t paramId) {
   // For non-object guards, we rely on what we know from the tracelet
   // guards and never have to do runtime checks.
   if (!tc.isObjectOrTypedef()) {
+    if (locVal->type().isBoxed()) {
+      locVal = gen(LdRef, locVal->type().innerType(), getExitTrace(), locVal);
+    }
     if (!tc.checkPrimitive(locType.toDataType())) {
       exceptionBarrier();
       gen(VerifyParamFail, cns(paramId));

hphp/test/slow/types/ref_type_fail.php

@@ -0,0 +1,16 @@
+<?php
+
+function handler() { var_dump(__METHOD__); return true; }
+set_error_handler('handler');
+
+function foo(array &$a) { var_dump($a); }
+
+function test($a) {
+  foo($a);
+}
+
+test("hello");
+test(array(1,2,3));
+test(array());
+test("hello");
+

hphp/test/slow/types/ref_type_fail.php.expect

@@ -0,0 +1,14 @@
+string(7) "handler"
+string(5) "hello"
+array(3) {
+  [0]=>
+  int(1)
+  [1]=>
+  int(2)
+  [2]=>
+  int(3)
+}
+array(0) {
+}
+string(7) "handler"
+string(5) "hello"