Description:
------------
The following code snippet produces a double free error. I don't think my glibc/linux versions matter, anyway I can provide them on request.

An interesting thing is that the bug manifests itself only at the 65536th iteration. Removing any reference to the $index variable doesn't reproduce the bug any longer.


Reproduce code:
---------------
function m($index) {
  is_int($index);

  global $x;
  return $x[$index];
}

$i = 0;
$x = array("x");
while (m($i)) {
  $p[] = m($i);
}


Actual result:
--------------
*** glibc detected *** php: double free or corruption (fasttop): 0x09d89a08 ***