Thank you for this bug report. To properly diagnose the problem, we
need a short but complete example script to be able to reproduce
this bug ourselves. 

A proper reproducing script starts with <?php and ends with ?>,
is max. 10-20 lines long and does not require any external 
resources such as databases, etc. If the script requires a 
database to demonstrate the issue, please make sure it creates 
all necessary tables, stored procedures etc.

Please avoid embedding huge scripts into the report.

Thanks ron for your test script. I've make a minimal reproducible one below:

In Class1:
newFunc was referred to T::func
func was itself (by overriding);

In T
func was referred by T and itself;

--- since class was destroyed by reverse order --
1. Destroy T： will not release the function name defined in trait. since
   the Class1 referred to this function.
2. Destroy Class1：it will destroy the alias name since the aliased
   function name was referred to it.(this leave the original function name
   in trait unreleased). after destroy function table it will destroy
   alias info. but alias was already destroyed in function table releasing 
phrase.
   This cause double free(crash).

Solutions:
1. Copy the whole function will solve the problem. but it was too heavy.
2. Don't change the aliases function's name, since function call are always 
lookup by hash key name.
    but it will make reflection unhappy and can't throw right error message for 
function.
3. Make a reference in function table if trait function was overrided to avoid 
releasing problem.
    This need to change reflection ignore it.get_defined_functions() & 
get_delcared_clesses()
    use this trick to filter special entry. so we need to change 
ReflectionClass::getMethods().

In summary I prefer option 3.  What do you think? 
and I made PR: https://github.com/php/php-src/pull/83

------ Test script ---------------
<?php
class Class1 {
    use T {
        func as newFunc;
    }

    public function func() { // <------------ if this override trait method and 
the method get aliased will lead crash
        echo "From Class1::func\n";
    }
}

class Class2 {
    use T;
}

trait T {  // <------------------------------ declare after the Class1 and it 
will be destroy before Class1
    public function func() {
        echo "From trait T\n";
    }
}

Dmitry,  could you please look at the patch(attached) for this?  thanks

I think my patch is more clear. Please take a look if you see any problems with it.

The malloc -> emalloc part of your patch, that is not directly related to this bug, makes full sense. I think you can commit it.

This bug has been fixed in SVN.

Snapshots of the sources are packaged every three hours; this change
will be in the next snapshot. You can grab the snapshot at
http://snaps.php.net/.

 For Windows:

http://windows.php.net/snapshots/
 
Thank you for the report, and for helping us make PHP better.