Keep simplifyCall stateless

Read the stack out of the instruction instead of out of
TraceBuilder's current stack pointer.

hphp/runtime/vm/translator/hopt/codegen.cpp

@@ -3225,7 +3225,7 @@ void CodeGenerator::cgCall(IRInstruction* inst) {
   SSATmp* returnBcOffset = inst->getSrc(1);
   SSATmp* func           = inst->getSrc(2);
   SrcRange args          = inst->getSrcs().subpiece(3);
-  int32_t numArgs          = args.size();
+  int32_t numArgs        = args.size();
 
   auto spReg = actRec->getReg();
   // put all outgoing arguments onto the VM stack

hphp/runtime/vm/translator/hopt/simplifier.cpp

@@ -246,7 +246,7 @@ SSATmp* Simplifier::simplifySpillStack(IRInstruction* inst) {
 
 SSATmp* Simplifier::simplifyCall(IRInstruction* inst) {
   auto spillVals  = inst->getSrcs().subpiece(3);
-  IRInstruction* spillStack = m_tb->getSp()->inst();
+  auto const spillStack = inst->getSrc(0)->inst();
   if (spillStack->op() != SpillStack) {
     return nullptr;
   }