Description:
------------
Reported by Christian Holler on mailing list, the example code produces crash on 
engine shutdown.

Test script:
---------------
<?php

class Person {
        public $dad;
        public function __destruct() {
                $this->dad = null; /* no segfault if this is commented out */
        }
}

class Dad extends Person {
        public $son;
        public function __construct() {
                $this->son = new Person;
                $this->son->dad = $this; /* no segfault if this is commented out */
        }
        public function __destruct() {
                $dad = new dad;
                parent::__destruct(); /* segfault here */
        }
}

$o = new Dad;
unset($o);
echo "ok\n";


Actual result:
--------------
Program received signal EXC_BAD_ACCESS, Could not access memory.
Reason: KERN_PROTECTION_FAILURE at address: 0x00000004
0x005310bd in gc_remove_from_buffer [inlined] () at /Users/smalyshev/php-
src/branches/PHP_5_3/Zend/zend_gc.h:265
265		GC_REMOVE_FROM_BUFFER(root_buffer);
(gdb) bt
#0  0x005310bd in gc_remove_from_buffer [inlined] () at /Users/smalyshev/php-
src/branches/PHP_5_3/Zend/zend_gc.h:265
#1  0x005310bd in gc_remove_zval_from_buffer (zv=0x2424dd8) at 
/Users/smalyshev/php-5.3/Zend/zend_gc.c:265
#2  0x004ffe56 in _zval_ptr_dtor (zval_ptr=0x2425154) at /Users/smalyshev/php-
5.3/Zend/zend_execute_API.c:442
#3  0x0051d7b7 in zend_hash_destroy (ht=0x24250f0) at /Users/smalyshev/php-
5.3/Zend/zend_hash.c:529
#4  0x00533700 in zend_object_std_dtor (object=0x24250c0) at 
/Users/smalyshev/php-5.3/Zend/zend_objects.c:45
#5  0x00533af0 in zend_objects_free_object_storage (object=0x24250c0) at 
/Users/smalyshev/php-5.3/Zend/zend_objects.c:126
#6  0x00538002 in zend_objects_store_free_object_storage (objects=0xa97d90) at 
/Users/smalyshev/php-5.3/Zend/zend_objects_API.c:92
#7  0x004ff84b in shutdown_executor () at /Users/smalyshev/php-
5.3/Zend/zend_execute_API.c:302
#8  0x0050fdf9 in zend_deactivate () at /Users/smalyshev/php-5.3/Zend/zend.c:890
#9  0x0049bea7 in php_request_shutdown (dummy=0x0) at /Users/smalyshev/php-
5.3/main/main.c:1635
#10 0x005d359f in main (argc=2, argv=0xbffff864) at /Users/smalyshev/php-
5.3/sapi/cli/php_cli.c:1374