Fix a bug in register_variable

The second lvalAt line doesn't necessarily return the same
array offset that the append call created if the nextKI wasn't in sync
with the array size.  I didn't entirely think through why the repro
case hit this, but this version doesn't and is more correct.

Reviewed By: @edwinsmith

Differential Revision: D1249471

Author: jdelong

hphp/runtime/base/program-functions.cpp

@@ -285,9 +285,9 @@ void register_variable(Array& variables, char *name, const Variant& value,
       }
 
       if (!index) {
-        symtable->append(Array::Create());
+        auto& val = symtable->lvalAt();
+        val = Array::Create();
         gpc_elements.push_back(uninit_null());
-        auto& val = symtable->lvalAt((int64_t)symtable->size() - 1);
         gpc_elements.back().assignRef(val);
       } else {
         String key(index, index_len, CopyString);