facebook/hhvm — pull request #2114 by lowjoel (2014-03-20 11:49:11+00:00)
Title: Fix destruction order when the user error handler is an object.

The user error handler can be set to an object's instance method. After the
error or exception is handled, and if the execution of the program must be
halted (fatal error), then the last reference to the object is the execution
context.

Following the destruction order of class members (last declared to first
declared), the execution context's object dynamic properties are destroyed
before the reference to the error handler object is destroyed. Thus, when the
object destructor runs, it tries to free the dynamic properties twice, causing
the segfault.

Fixes #2113