Core dump when killing CLI server

### HHVM Version

```
HipHop VM 4.27.1 (rel)
Compiler: remotes/origin/4.27.1-slack-0-gbc71dfa668b9bf8219f75a52b4e57ab6b4448ee4
Repo schema: 31178287100ca2398f2a897f6ad24ad7ebfa6d0c
```

### Operating System and Version

Ubuntu 16.04

### Standalone code, or other way to reproduce the problem

I have not been able to extract a standalone repro for this. We run our unit tests using the CLI server, and we use `trap` to kill the server after the test ends (because Jenkins will not allow a job to finish if subprocesses are still hanging around).

The basic code is:

```
hhvm -v Eval.UnixServerPath=hhvm.sock -m server -p 0 -d hhvm.pid_file="$PID_FILE" &
# kill CLI server whenever this script exits using trap
SERVER_PID=$(cat "$PID_FILE")
trap "kill -9 $SERVER_PID" EXIT

# now run the tests using the cli server
...

exit 0
```

### Actual result

A segfault like this occasionally happens **when killing the server, after tests have successfully run and returned control the shell script**. Note the core dumps have all happened in `FbExpect::AssertTrue` thus far.

```
12:02:30.652 Assertion failure: /build/hhvm/hphp/runtime/vm/hhbc.cpp:571: HPHP::FlavorDesc HPHP::instrInputFlavor(HPHP::PC, uint32_t): assertion `0 && "Opcode has no stack inputs"' failed.
12:02:30.652
12:02:30.652
12:02:30.652
12:02:30.652 -------------------------------Assertion Failure--------------------------------
12:02:30.652 /build/hhvm/hphp/runtime/vm/hhbc.cpp:571: HPHP::FlavorDesc HPHP::instrInputFlavor(HPHP::PC, uint32_t): assertion `0 && "Opcode has no stack inputs"' failed.
12:02:30.656
12:02:30.656 --------------------------------------IRGS--------------------------------------
12:02:30.656 +---------------------------------------- 0 stack element(s): -----------------------------------------+
12:02:30.656 +------------------------------------------------------------------------------------------------------+
12:02:30.656
12:02:30.656 +--------------------------------------------- 2 local(s) ---------------------------------------------+
12:02:30.656 | 0: Bool |
12:02:30.656 | 1: Gen |
12:02:30.656 +------------------------------------------------------------------------------------------------------+
12:02:30.656
12:02:30.662
12:02:30.662 -------------------------------------IRUnit-------------------------------------
12:02:30.662 TransKind: TransOptimize
12:02:30.662 OptIndex : 1
12:02:30.662 digraph G {
12:02:30.662 B0 [shape=box,color=orange,label="B0\ncount=779"]
12:02:30.662 B0 -> B1
12:02:30.662 B1 [shape=box,color=orange,label="B1\ncount=779"]
12:02:30.662 B1 -> B3; B1 -> B2 [color=blue]
12:02:30.662 B3 [shape=box,color=orange,label="B3\ncount=779"]
12:02:30.662 B2 [shape=box,color=blue,label="B2\ncount=779"]
12:02:30.662 }
12:02:30.662
12:02:30.662 B0: [profCount=779]
12:02:30.662 Method public (interceptable) (mayusevv) Facebook\FBExpect\Assert::assertTrue at 845
12:02:30.662 Param: condition (HH\mixed)
12:02:30.662 Param: message string (HH\string) DV at 907 = ""
12:02:30.662 Ret: (HH\void)
12:02:30.662 maxStackCells: 16
12:02:30.662 numLocals: 2
12:02:30.662 numIterators: 0
12:02:30.662 --- bc 847t, fp _, spOff 2 (Facebook\FBExpect\Assert::assertTrue)
12:02:30.662 847: Nop
12:02:30.662 (00) t0:FramePtr = DefFP
12:02:30.662
12:02:30.662 --- bc 847t, fp 0, spOff 2 (Facebook\FBExpect\Assert::assertTrue)
12:02:30.662 847: Nop
12:02:30.662 (01) t1:StkPtr = DefSP t0:FramePtr
12:02:30.662 (02) Jmp -> B1
12:02:30.662 no fallthrough
12:02:30.662
12:02:30.662 B1: [profCount=779] (preds B0)
12:02:30.662 --- bc 847t, fp 0, spOff 2 (Facebook\FBExpect\Assert::assertTrue) [profTrans=30713]
12:02:30.662 847: Nop
12:02:30.662 (04) CheckLoc t0:FramePtr -> B2
12:02:30.662 -> B3
12:02:30.662
12:02:30.662 B3: [profCount=779] (preds B1)
12:02:30.662 (05) EndGuards
12:02:30.662 (06) t2:{Obj<=Facebook\FBExpect\Assert|Cctx} = LdCtx t0:FramePtr
12:02:30.662 (07) t3:Obj<=Facebook\FBExpect\Assert = AssertType t2:{Obj<=Facebook\FBExpect\Assert|Cctx}
12:02:30.662 --- bc 848t, fp 0, spOff 2 (Facebook\FBExpect\Assert::assertTrue) [profTrans=30713]
12:02:30.662 848: DblAsBits
12:02:30.662 (08) AssertStk t1:StkPtr
12:02:30.662 (09) t4:Cell = LdStk t1:StkPtr
12:02:30.662 (11) StStk t1:StkPtr, 0
12:02:30.662 no fallthrough
12:02:30.662
12:02:30.662 ------------------------cold blocks-------------------------
12:02:30.662 B2: [profCount=779] (preds B1)
12:02:30.662 --- bc 847t, fp 0, spOff 2 (Facebook\FBExpect\Assert::assertTrue) [profTrans=30713]
12:02:30.662 847: Nop
12:02:30.662 (03) ReqRetranslate<0,0> t1:StkPtr, t0:FramePtr
12:02:30.662 no fallthrough
12:02:30.662
12:02:30.671
12:02:30.671 -----------------------------------RegionDesc-----------------------------------
12:02:30.671 Region (1 blocks):
12:02:30.671 Block 30713 Facebook\FBExpect\Assert::assertTrue@847 length 4 initSpOff 2 profTransID 30713
12:02:30.671 precondition: Local{0} :: Bool (DataTypeSpecific)
12:02:30.671 847 Nop
12:02:30.671 848 DblAsBits
12:02:30.671 849 Nop
12:02:30.671 850 EmptyL L:46989284
12:02:30.671 changed postcondition: Stack{3} :: Bool
12:02:30.671 changed postcondition: Local{0} :: Bool
12:02:30.671
12:02:30.671 digraph RegionCFG {
12:02:30.671 node[shape=box,style=filled]
12:02:30.671 "B30713" [label="B 30713\np: 779",fillcolor="#ff0000"]
12:02:30.671 }
12:02:30.671
12:02:30.676 Core dumped: Aborted
12:02:30.676 Stack trace in /tmp/stacktrace.7.log
```

These are happening in a Docker container that gets destroyed right away so I haven't grabbed the stacktrace.log file, but let me know if that would be useful and I can try to find a way to do that.

### Expected result

No segfault :-)