Description:
------------
The attached code shows a serious memory corruption (either crash or abort by glibc). I think I reported a similar testcase before (using filter) but the crash/corruption seemed different and I think it was not user_filter related, so it's not clear if this is a duplicate or not.

Test script:
---------------
<?php
class user_filter extends php_user_filter {
        function filter($in, $out, &$consumed, $closing) {
                while($bucket = stream_bucket_make_writeable($in)) {
                }
                fclose($this->stream);
        }
}
stream_filter_register('user_filter','user_filter');
$fd = fopen('php://memory','w');
$filter = stream_filter_append($fd, 'user_filter');
fwrite($fd, "foo");
?>

Actual result:
--------------
When run on command line, terminated by glibc:

*** glibc detected *** /home/decoder/LangFuzz/php-trunk/sapi/cli/php: munmap_chunk(): invalid pointer: 0x00007fe4b1c7b420 ***

(+ backtraces)


When run in valgrind, the following happens (original testcase also segfaults here):

==10490== Invalid free() / delete / delete[]
==10490==    at 0x4C270BD: free (vg_replace_malloc.c:366)
==10490==    by 0x7C1211: zend_hash_del_key_or_index (zend_hash.c:521)
==10490==    by 0x7E1511: zend_std_unset_property (zend_object_handlers.c:768)
==10490==    by 0x700D8A: userfilter_filter (user_filters.c:262)
==10490==    by 0x742495: _php_stream_write_filtered (streams.c:1072)
==10490==    by 0x742630: _php_stream_write (streams.c:1138)
==10490==    by 0x69F820: zif_fwrite (file.c:1225)
==10490==    by 0x7ED653: zend_do_fcall_common_helper_SPEC (zend_vm_execute.h:638)
==10490==    by 0x7F37D2: ZEND_DO_FCALL_SPEC_CONST_HANDLER (zend_vm_execute.h:1935)
==10490==    by 0x7EC127: execute (zend_vm_execute.h:410)
==10490==    by 0x7B0348: zend_execute_scripts (zend.c:1212)
==10490==    by 0x726A6B: php_execute_script (main.c:2344)
==10490==  Address 0x6af28e8 is 256,808 bytes inside a block of size 262,144 alloc'd
==10490==    at 0x4C274A8: malloc (vg_replace_malloc.c:236)
==10490==    by 0x778CBA: zend_mm_mem_malloc_alloc (zend_alloc.c:287)
==10490==    by 0x77BB55: _zend_mm_alloc_int (zend_alloc.c:1971)
==10490==    by 0x779B92: zend_mm_startup_ex (zend_alloc.c:1122)
==10490==    by 0x779FBA: zend_mm_startup (zend_alloc.c:1217)
==10490==    by 0x77DB2E: alloc_globals_ctor (zend_alloc.c:2640)
==10490==    by 0x77DB45: start_memory_manager (zend_alloc.c:2656)
==10490==    by 0x7AEF4A: zend_startup (zend.c:642)
==10490==    by 0x725D5A: php_module_startup (main.c:1896)
==10490==    by 0x8EAD7B: php_cli_startup (php_cli.c:414)
==10490==    by 0x8EBB8A: main (php_cli.c:790)