There's also one of these in AphrontDefaultApplicationConfiguration. However, I'm not going to touch it because it's parsing input (which may be in the form x=1&x=2&x=3, even though we flatten them today) and it's entangled with D20046, and it uses urlencode() instead of rawurlencode() which is a bit messy.

The differences between the two functions, per this script:

<?php

foreach (range(0, 255) as $byte) {
  $c = chr($byte);

  $u = urlencode($c);
  $v = rawurlencode($c);
  $w = http_build_query(array($c => $c), '', '&');

  if (($u !== $v) || ("{$u}={$u}" !== $w)) {
    printf(
      "0x%02x\t%s\t%s\t%s\n",
      $byte,
      $u,
      $v,
      $w);
  }
}

...are:

0x20	+	%20	+=+
0x7e	%7E	~	%7E=%7E

...which actually makes me think that we should be passing PHP_QUERY_RFC3986 to http_build_query(), since I think we want the rawurlencode() behavior where space becomes %20.

I'll revisit this and maybe add some test coverage tomorrowish.