Fix refcounting issues with string SetM

The code was assuming that the result of the assignment
would be the value assigned, but its actually a new string
containing the first character of the value assigned. The result
was that the SetM had already decRef'd the rhs, and then the
jitted code decRef'd it again. Since that last decRef was a decRefNZ,
we would often get away with simply leaking both the original rhs and
the value of the SetM. But the new testcase crashes in a DEBUG build
without the fix.

hphp/runtime/vm/translator/hopt/vectortranslator.cpp

@@ -167,6 +167,12 @@ void VectorEffects::init(Opcode op, const Type origBase,
     valType = definitelyFail ? Type::InitNull : (valType | Type::InitNull);
   }
 
+  if (op == SetElem && baseType.maybe(Type::Str)) {
+    // If the base is a String, the result will be different from the value
+    // use valTypeChanged (even though the type may not have)
+    valTypeChanged = true;
+  }
+
   // The final baseType should be a pointer/box iff the input was
   baseType = baseBoxed ? baseType.box() : baseType;
   baseType = basePtr   ? baseType.ptr() : baseType;

hphp/test/vm/setmstr2.php

@@ -0,0 +1,10 @@
+<?php
+function bar($a) {}
+function baz() {
+  $cipher = 'abcdefghij';
+  $pos = 4;
+  $random_byte = chr(25);
+  $cipher[$pos] = $random_byte;
+  var_dump(ord($random_byte));
+}
+baz();

hphp/test/vm/setmstr2.php.exp

@@ -0,0 +1 @@
+int(25)