Fix a type bug in BindS and BindG

They should load as a V not a C.

hphp/runtime/vm/translator/hopt/hhbctranslator.cpp

@@ -2797,7 +2797,7 @@ template<class CheckSupportedFun, class EmitLdAddrFun>
 void HhbcTranslator::emitBind(const StringData* name,
                               CheckSupportedFun checkSupported,
                               EmitLdAddrFun emitLdAddr) {
-  if (!(this->*checkSupported)(name, topC(0)->type(), 1)) return;
+  if (!(this->*checkSupported)(name, topV(0)->type(), 1)) return;
   SSATmp* src = popV();
   emitBindMem((this->*emitLdAddr)(name), src);
 }

hphp/runtime/vm/translator/hopt/hhbctranslator.h

@@ -657,6 +657,7 @@ private:
   SSATmp* popA() { return pop(Type::Cls);       }
   SSATmp* popF() { return pop(Type::Gen);       }
   SSATmp* topC(uint32_t i = 0) { return top(Type::Cell, i); }
+  SSATmp* topV(uint32_t i = 0) { return top(Type::BoxedCell, i); }
   std::vector<SSATmp*> peekSpillValues() const;
   SSATmp* emitSpillStack(Trace* t, SSATmp* sp,
                          const std::vector<SSATmp*>& spillVals);

hphp/test/quick/BindS_twice.php

@@ -0,0 +1,19 @@
+<?php
+
+class C {
+  public static $blar;
+  public static $blor;
+
+  public static function buh(&$thinger = null) {
+    self::$blar = &$thinger;
+    self::$blor = &self::$blar;
+  }
+}
+
+function main() {
+  C::buh();
+  var_dump(C::$blar);
+  var_dump(C::$blor);
+}
+
+main();

hphp/test/quick/BindS_twice.php.expect

@@ -0,0 +1,2 @@
+NULL
+NULL

hphp/test/quick/bindg_weird.hhas

@@ -0,0 +1,33 @@
+.main {
+  FPushFuncD 0 "main"
+  FCall 0
+  PopR
+  Int 1
+  RetC
+}
+
+.function tracelet_breaker() {
+  Int 1
+  RetC
+}
+
+.function main() {
+  String "global_var"
+
+  Null
+  Box
+
+  String "tracelet_breaker"
+  FPushFunc 0
+  FCall 0
+  UnboxR
+  SetL $foo
+  PopC
+
+  BindG
+  PopV
+
+  Int 1
+  RetC
+}
+