Fix refcounting problems in convToArr.

This set of changes fixes problems pointed out in earlier diffs by Ed and Brett, mostly centered on redundant ref counting. It will be followed up by another diff that does a mechanical refactor to introduce variants of convToArr, specialized on the types of it operand.

hphp/runtime/vm/translator/hopt/codegen.cpp

@@ -1589,14 +1589,6 @@ asm_label(a, out);
 }
 
 ArrayData* new_singleton_array_helper(TypedValue value) {
-  // tvCastToArrayInPlace overwrites value and thus decrements the ref count
-  // of any counted object that value refers to.
-  // The code calling cgConv (emitCastArray) does not expect that ref count
-  // to be decreased and thus emits a dec ref following the call to this helper.
-  // emitCastArray could (and probably should) be modified to not do that
-  // which means that an inc ref dec ref pair can be eliminated. Unfortunately
-  // doing that triggers a test failure. See Task 2160031.
-  tvRefcountedIncRef(&value);
   tvCastToArrayInPlace(&value);
   return value.m_data.parr;
 }

hphp/runtime/vm/translator/hopt/hhbctranslator.cpp

@@ -2092,10 +2092,7 @@ void HhbcTranslator::emitCastString() {
 
 void HhbcTranslator::emitCastArray() {
   SSATmp* src = popC();
-  pushIncRef(m_tb->genConvToArr(src));
-  // TODO: change genConvToArr so that the next line is not needed,
-  // but first do Task 2160031.
-  m_tb->genDecRef(src);
+  push(m_tb->gen(ConvToArr, Type::Arr, src));
 }
 
 void HhbcTranslator::emitCastObject() {

hphp/runtime/vm/translator/hopt/ir.h

@@ -164,7 +164,7 @@ O(OpAnd,                        D(Int), SNumInt SNumInt,                   C) \
 O(OpOr,                         D(Int), SNum SNum,                         C) \
 O(OpXor,                        D(Int), SNumInt SNumInt,                   C) \
 O(OpMul,                        DParam, SNum SNum,                         C) \
-O(ConvToArr,                    DParam, S(Gen),                          C|N) \
+O(ConvToArr,                    DParam, S(Gen),                        N|CRc) \
 O(ConvToBool,                   DParam, S(Gen),                          C|N) \
 O(ConvToDbl,                    DParam, S(Gen),                          C|N) \
 O(ConvToInt,                    DParam, S(Gen),                          C|N) \

hphp/runtime/vm/translator/hopt/simplifier.cpp

@@ -1090,7 +1090,7 @@ SSATmp* Simplifier::simplifyConcat(SSATmp* src1, SSATmp* src2) {
 SSATmp* Simplifier::simplifyConvToArr(IRInstruction* inst) {
   SSATmp* src  = inst->getSrc(0);
   Type srcType = src->getType();
-  if (srcType == Type::Arr) {
+  if (srcType.isArray()) {
     return src;
   }
   if (srcType.isNull()) {
@@ -1103,9 +1103,8 @@ SSATmp* Simplifier::simplifyConvToArr(IRInstruction* inst) {
     case KindOfInt64:
     case KindOfDouble:
     case KindOfStaticString: {
-      auto arr = ArrayData::Create(src->getValVariant());
-      arr->incRefCount();
-      return m_tb->genDefConst(ArrayData::GetScalarArray(arr));
+      Array arr = Array::Create(src->getValVariant());
+      return m_tb->genDefConst(ArrayData::GetScalarArray(arr.get()));
     }
     default:
       assert(!srcType.isArray());

hphp/runtime/vm/translator/hopt/tracebuilder.cpp

@@ -398,10 +398,6 @@ SSATmp* TraceBuilder::genConvToStr(SSATmp* src) {
   }
 }
 
-SSATmp* TraceBuilder::genConvToArr(SSATmp* src) {
-  return gen(ConvToArr, Type::Arr, src);
-}
-
 SSATmp* TraceBuilder::genConvToObj(SSATmp* src) {
   return gen(ConvToObj, Type::Obj, src);
 }