Fix HHIR simplification for missing bool-to-int promotions

The simplifier was not promoting the boolean to integer in some
cases. I hit this for the add-zero case, and code inspection revealed
similar bugs in sub-zero and multiply-one cases.

hphp/runtime/vm/translator/hopt/simplifier.cpp

@@ -566,6 +566,9 @@ SSATmp* Simplifier::simplifyAdd(SSATmp* src1, SSATmp* src2) {
     int64_t src2Val = src2->getValInt();
     // X + 0 --> X
     if (src2Val == 0) {
+      if (src1->getType() == Type::Bool) {
+        return m_tb->genConvToInt(src1);
+      }
       return src1;
     }
     // X + -C --> X - C
@@ -596,6 +599,9 @@ SSATmp* Simplifier::simplifySub(SSATmp* src1, SSATmp* src2) {
     int64_t src2Val = src2->getValInt();
     // X - 0 --> X
     if (src2Val == 0) {
+      if (src1->getType() == Type::Bool) {
+        return m_tb->genConvToInt(src1);
+      }
       return src1;
     }
     // X - -C --> X + C
@@ -633,6 +639,9 @@ SSATmp* Simplifier::simplifyMul(SSATmp* src1, SSATmp* src2) {
     }
     // X * 1 --> X
     if (src2->getValInt() == 1) {
+      if (src1->getType() == Type::Bool) {
+        return m_tb->genConvToInt(src1);
+      }
       return src1;
     }
     // X * 2 --> X + X

hphp/test/vm/simpl-0.php

@@ -0,0 +1,23 @@
+<?php
+
+function plus0($x) {
+  return $x + 0;
+}
+
+function minus0($x) {
+  return $x - 0;
+}
+
+var_dump(plus0(false));
+var_dump(plus0(null));
+var_dump(plus0(1));
+var_dump(plus0(1.5));
+var_dump(plus0(""));
+var_dump(plus0("1"));
+
+var_dump(minus0(false));
+var_dump(minus0(null));
+var_dump(minus0(1));
+var_dump(minus0(1.5));
+var_dump(minus0(""));
+var_dump(minus0("1"));

hphp/test/vm/simpl-0.php.exp

@@ -0,0 +1,12 @@
+int(0)
+int(0)
+int(1)
+float(1.5)
+int(0)
+int(1)
+int(0)
+int(0)
+int(1)
+float(1.5)
+int(0)
+int(1)

hphp/test/vm/simpl-1.php

@@ -0,0 +1,12 @@
+<?php
+
+function mult1($x) {
+  return $x * 1;
+}
+
+var_dump(mult1(false));
+var_dump(mult1(null));
+var_dump(mult1(1));
+var_dump(mult1(1.5));
+var_dump(mult1(""));
+var_dump(mult1("1"));

hphp/test/vm/simpl-1.php.exp

@@ -0,0 +1,6 @@
+int(0)
+int(0)
+int(1)
+float(1.5)
+int(0)
+int(1)