facebook/hhvm — pull request #2814 by SiebelsTim (2014-05-31 13:57:16+00:00)
Title: Check in exchangeArray() as in ctor whether to store an array

__construct() checks if it's an instance of ArrayObject or ArrayIterator and then saves an array copy
exchangeArray() is supposed to follow the same behaviour

Resolves #2791

The segfault however might still be there somewhere.