uconverter_oop_callback.php segfaults

### HHVM Version

swalk@dellx3:~/play.042619a/hhvm$ hphp/hhvm/hhvm --version
HipHop VM 4.3.0-dev (rel)
Compiler: heads/master-0-gf01d17196d48dda934a5ef3d58cbddc48be9948d
Repo schema: e428a6be6a9e97f100042e627520f447774fe371

### Operating System and Version

Ubuntu 16.04 on x86_64

uname -a
Linux dellx3 4.4.0-57-generic #78-Ubuntu SMP Fri Dec 9 23:50:32 UTC 2016 x86_64 x86_64 x86_64 GNU/Linux

### Standalone code, or other way to reproduce the problem

hphp/test/run -v -m interp
hphp/test/run -v -m interp -r
hphp/test/run -v -m jit -a '-vEval.JitPGO=0'
hphp/test/run -v -m jit -r -a '-vEval.JitPGO=0'
hphp/test/run -v -m jit -a '-vEval.JitPGO=1'
hphp/test/run -v -m jit -r -a '-vEval.JitPGO=1'

### Actual result

Post processed output script, columns line up with option sets above.

hphp/test/zend/good/ext/intl/tests/uconverter_oop_callback.php | . | . | F | F | F | F |

### Expected result

Pass

swalk@dellx3:~/play.042619a/hhvm$ hphp/test/run -v -m jit -a '-vEval.JitPGO=0' hphp/test/zend/good/ext/intl/tests/uconverter_oop_callback.php
You are using the binary located at: ./hphp/hhvm/hhvm
Running 1 tests in 1 threads (0 in serial)
hphp/test/zend/good/ext/intl/tests/uconverter_oop_callback.php FAILED (2.14s)

gdb shows

Starting program: /home/swalk/play.042619a/hhvm/hphp/hhvm/hhvm -c /home/swalk/play.042619a/hhvm/hphp/test/zend/config.ini -vEval.EnableArgsInBacktraces=true -vEval.EnableIntrinsicsExtension=true -vEval.HHIRInliningIgnoreHints=false -vRepo.Local.Mode=-- -vRepo.Central.Path=/home/swalk/play.042619a/hhvm/hphp/hhvm/verify.hhbc -vEval.Jit=true -vEval.ProfileHWEnable=false -vEval.HackCompilerExtractPath='/home/swalk/play.042619a/hhvm/hphp/hhvm/hackc_%{schema}' -vEval.EmbeddedDataExtractPath='/home/swalk/play.042619a/hhvm/hphp/hhvm/hhvm_%{type}_%{buildid}' -vEval.JitPGO=0 -vResourceLimit.CoreFileSize=0 -vHack.Lang.LookForTypechecker=0 -vEval.EnablePHP=1 --file 'hphp/test/zend/good/ext/intl/tests/uconverter_oop_callback.php'
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
[New Thread 0x7fffe59ff700 (LWP 34703)]
[New Thread 0x7fffe1300700 (LWP 34899)]
toUCallback(REASON_RESET, ...)
toUCallback(REASON_RESET, ...)
fromUCallback(REASON_RESET, ...)
fromUCallback(REASON_RESET, ...)
toUCallback(REASON_RESET, ...)
toUCallback(REASON_ILLEGAL, ...)
toUCallback(REASON_RESET, ...)
toUCallback(REASON_ILLEGAL, ...)
fromUCallback(REASON_RESET, ...)
fromUCallback(REASON_UNASSIGNED, ...)
fromUCallback(REASON_RESET, ...)
fromUCallback(REASON_UNASSIGNED, ...)
toUCallback(REASON_RESET, ...)
toUCallback(REASON_RESET, ...)
fromUCallback(REASON_RESET, ...)
fromUCallback(REASON_UNASSIGNED, ...)
fromUCallback(REASON_RESET, ...)
fromUCallback(REASON_UNASSIGNED, ...)
toUCallback(REASON_CLOSE, ...)
fromUCallback(REASON_CLOSE, ...)

Thread 1 "hhvm" received signal SIGSEGV, Segmentation fault.
0x0000000001f67181 in HPHP::jit::detail::syncVMRegsWork() ()
(gdb) thread all apply bt
Invalid thread ID: all apply bt
(gdb) thread apply all bt

Thread 3 (Thread 0x7fffe1300700 (LWP 34899)):
#0 do_sigwait (sig=0x7fffe12fed0c, set=) at ../sysdeps/unix/sysv/linux/sigwait.c:64
#1 __sigwait (set=, sig=0x7fffe12fed0c) at ../sysdeps/unix/sysv/linux/sigwait.c:96
#2 0x00000000041c6dfd in HPHP::(anonymous namespace)::handle_signals(void*) ()
#3 0x00007ffff5f9e6ba in start_thread (arg=0x7fffe1300700) at pthread_create.c:333
#4 0x00007ffff011a82d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:109

Thread 2 (Thread 0x7fffe59ff700 (LWP 34703)):
#0 0x00007ffff010eb5d in poll () at ../sysdeps/unix/syscall-template.S:84
#1 0x0000000001c21676 in std::thread::_Impl >::_M_run() ()
#2 0x00007ffff09b4c80 in ?? () from /usr/lib/x86_64-linux-gnu/libstdc++.so.6
#3 0x00007ffff5f9e6ba in start_thread (arg=0x7fffe59ff700) at pthread_create.c:333
#4 0x00007ffff011a82d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:109

Thread 1 (Thread 0x7ffff7fac840 (LWP 34451)):
#0 0x0000000001f67181 in HPHP::jit::detail::syncVMRegsWork() ()
#1 0x0000000001689284 in HPHP::ExecutionContext::invokeFuncFew(HPHP::Func const*, void*, HPHP::StringData*, int, HPHP::TypedValue const*, bool) ()
#2 0x00000000016cf71f in HPHP::ObjectData::o_invoke_few_args(HPHP::String const&, int, HPHP::Variant const&, HPHP::Variant const&, HPHP::Variant const&, HPHP::Variant const&, HPHP::Variant const&, HPHP::Variant const&)
()
#3 0x0000000003130f60 in HPHP::Intl::ucnvToUCallback(HPHP::ObjectData*, UConverterToUnicodeArgs*, char const*, int, UConverterCallbackReason, UErrorCode*) ()
#4 0x00007ffff6d18f51 in ucnv_close_55 () from /usr/lib/x86_64-linux-gnu/libicuuc.so.55
#5 0x0000000006a01482 in ?? ()
#6 0x0000000006a0006f in ?? ()
#7 0x00007fffe21ff0df in ?? ()
#8 0x00007fffffffb440 in ?? ()
#9 0x00000000023763f4 in HPHP::jit::enterTCImpl(unsigned char*, HPHP::ActRec*) ()
Backtrace stopped: previous frame inner to this frame (corrupt stack?)
(gdb)

Introduced somewhere in these 15 commits.

```
1 * f01d171 Fix type-checking of calls to parent::__construct in the presence of where constraints //<<--- FAIL
2 * b9aadce transform subtype assertions involving Tany into subtype assertions on inner types ("propagate Tany")
3 * ef18aa7 Add FPushClsMethodR* as an optimizations for ReifiedName + FPushClsMethod*
4 * 5a027a0 only set EvalEnableNuma when the machine has NUMA
5 * 467bfc2 Implement Facts SmartConstructors in Rust
6 * f9e5b5d Remove NumArgs
7 * d545fb6 Write multi-file test cases to disk during testing
8 * fefa8cf Kill DisableHphpcOpts
9 * e89d281 Change all functions that uses NumArgs
10 * 3593875 Generalize NodeType framework not to depend on Syntax (too limiting)
11 * 9c3fca5 Log first units loaded by hhvm
12 * 77f7d6f add bser tests to OSS
13 * d4eb09a Fix RepoOption selection for repo builds
14 * 4285fe8 Back out "[hack][oss] simplify hhi dependency"
15 * 5880a5c Invalid memoized param error should point to the param as the primary position //<<--- PASS
16 * 36b134c fix review.sh for dune.sh