Use JSON, not PHP serialization, for XHProf profiles.

src/aphront/console/plugin/xhprof/DarkConsoleXHProfPluginAPI.php

@@ -144,7 +144,7 @@ final class DarkConsoleXHProfPluginAPI {
     }
 
     $data = xhprof_disable();
-    $data = serialize($data);
+    $data = @json_encode($data);
     self::$profilerRunning = false;
 
     // Since these happen on GET we can't do guarded writes. These also

src/applications/xhprof/controller/PhabricatorXHProfProfileController.php

@@ -21,7 +21,7 @@ final class PhabricatorXHProfProfileController
     }
 
     $data = $file->loadFileData();
-    $data = unserialize($data);
+    $data = @json_decode($data, true);
     if (!$data) {
       throw new Exception("Failed to unserialize XHProf profile!");
     }