Fix refCounts for SetM on strings

When we throw an InvalidSetMException, we need to incRef the value we
throw.

hphp/runtime/vm/member_operations.h

@@ -531,7 +531,7 @@ inline TypedValue* NewElem(TypedValue& tvScratch, TypedValue& tvRef,
 }
 
 inline void SetElemEmptyish(TypedValue* base, TypedValue* key,
-                                   Cell* value) {
+                            Cell* value) {
   Array a = Array::Create();
   a.set(tvAsCVarRef(key), tvAsCVarRef(value));
   tvAsVariant(base) = a;
@@ -687,6 +687,7 @@ inline StringData* SetElem(TypedValue* base, TypedValue* key, Cell* value) {
       initScratchKey<keyType>(scratch, key);
       SetElemEmptyish(base, key, value);
       if (!setResult) {
+        tvRefcountedIncRef(value);
         throw InvalidSetMException(*value);
       }
     } else {
@@ -696,8 +697,10 @@ inline StringData* SetElem(TypedValue* base, TypedValue* key, Cell* value) {
         // Can't use PRId64 here because of order of inclusion issues
         raise_warning("Illegal string offset: %lld", (long long)x);
         if (!setResult) {
-          throw InvalidSetMException(*value);
+          throw InvalidSetMException(make_tv<KindOfNull>());
         } else {
+          tvRefcountedDecRef(value);
+          tvWriteNull(value);
           break;
         }
       }

hphp/test/slow/array/promote_string2.php

@@ -0,0 +1,17 @@
+<?php
+
+class X {
+  function __destruct() { var_dump(__METHOD__); }
+  function __toString() { return __METHOD__; }
+}
+
+function test($a) {
+  var_dump($a[-1] = new X);
+  var_dump($a);
+}
+
+test("");
+echo "1\n";
+test("x");
+echo "2\n";
+

hphp/test/slow/array/promote_string2.php.expect

@@ -0,0 +1,13 @@
+object(X)#1 (0) {
+}
+array(1) {
+  [-1]=>
+  object(X)#1 (0) {
+  }
+}
+string(13) "X::__destruct"
+1
+string(13) "X::__destruct"
+NULL
+string(1) "x"
+2