SpillStack of an ActRec is a use of the old fp

A bug like this was bound to happen.  Thanks to whoever added
the assert for saving me from real debugging (@smith?).

hphp/runtime/vm/translator/hopt/hhbctranslator.cpp

@@ -2444,6 +2444,7 @@ std::vector<SSATmp*> HhbcTranslator::getSpillValues() const {
        */
       auto* inst = elem->getInstruction();
       assert(inst->getNumSrcs() == 5);
+      ret.push_back(inst->getSrc(0)); // fp
       ret.push_back(inst->getSrc(1)); // func
       ret.push_back(inst->getSrc(2)); // objOrCls
       ret.push_back(inst->getSrc(3)); // numArgs

hphp/runtime/vm/translator/hopt/ir.h

@@ -2291,7 +2291,7 @@ int32_t spillValueCells(IRInstruction* spillStack);
  * When SpillStack takes an ActRec, it has this many extra
  * dependencies in the spill vector for the values in the ActRec.
  */
-constexpr int kSpillStackActRecExtraArgs = 4;
+constexpr int kSpillStackActRecExtraArgs = 5;
 
 inline bool isConvIntOrPtrToBool(IRInstruction* instr) {
   if (instr->getOpcode() != ConvToBool) {