Allow JIT-time known boxed types for source operand in cgCheckType

In the region JIT, we may end up with a CheckType on a source with a
known type that is boxed but different from the boxed type parameter
of CheckType.  We still want to keep such CheckType instruction to
communicate the type of its dest to the following code. However, that
instruction doesn't need to generate any code since the inner types
are checked at the uses (via LdRef).

hphp/doc/ir.specification

@@ -328,6 +328,14 @@ Instruction set
 
 1. Checks and Asserts
 
+Note: Instructions that guard or check boxed types only check that the
+operand is boxed, and they ignore the type of the value inside the box
+(the inner type).  The inner type is normally checked when the value
+within the box is loaded by a LdRef instruction (which takes box/ref
+values, and only checks the inner type).  The reasoning for this
+approach is that boxed values may alias.  Therefore, in lack of memory
+alias analysis, the inner types generally need to be rechecked before
+each use.
 
 D:T = CheckType<T> S0:{Gen|Nullptr} -> L
 

hphp/runtime/vm/jit/codegen.cpp

@@ -4247,7 +4247,17 @@ void CodeGenerator::cgCheckType(IRInstruction* inst) {
     m_as.testq (rData, rData);
     doJcc(CC_E);
   } else {
-    emitTypeTest(inst->typeParam(), rType, rData, doJcc);
+    Type typeParam = inst->typeParam();
+    if (rType != InvalidReg) {
+      emitTypeTest(typeParam, rType, rData, doJcc);
+    } else {
+      Type srcType = src->type();
+      if (srcType.isBoxed() && typeParam.isBoxed()) {
+        // Nothing to do here, since we check the inner type at the uses
+      } else {
+        CG_PUNT(CheckType-known-srcType);
+      }
+    }
   }
 
   auto const dstReg = m_regs[inst->dst()].reg();