Description:
------------
While researching the changes made to output buffering in PHP 7 for a book I am working on with Arne Blankerts and Stefan Priebsch, Arne discovered the segfault shown below.

Of course, the code shown does not make any sense. Yet it should not lead to a segfault in PHP.

Test script:
---------------
<?php
function exception_error_handler($severity, $message, $file, $line)
{
    throw new ErrorException($message, 0, $severity, $file, $line);
}

set_error_handler('exception_error_handler');

function obHandler($buffer, $phase = null)
{
    try {
        ob_start();
    } catch (\Throwable $e) {
        return (string) $e;
    }

    return $buffer;
}

ob_start('obHandler');

print 'test';


Actual result:
--------------
#0  0x0000000000985e06 in zend_fcall_info_args_clear (fci=0x7372656c, free_mem=1) at /usr/local/src/php/src/Zend/zend_API.c:3427
#1  0x0000000000986368 in zend_fcall_info_argv (fci=0x7372656c, argc=0, argv=0x7fffffffbcc0) at /usr/local/src/php/src/Zend/zend_API.c:3534
#2  0x000000000098653d in zend_fcall_info_argn (fci=0x7372656c, argc=0) at /usr/local/src/php/src/Zend/zend_API.c:3556
#3  0x0000000000903731 in php_output_handler_op (handler=0x7fffee46a2a0, context=0x7fffffffbe30)
    at /usr/local/src/php/src/main/output.c:977
#4  0x0000000000903ef7 in php_output_stack_pop (flags=1) at /usr/local/src/php/src/main/output.c:1221
#5  0x0000000000901fd9 in php_output_end_all () at /usr/local/src/php/src/main/output.c:341
#6  0x00000000008e9682 in php_request_shutdown (dummy=0x0) at /usr/local/src/php/src/main/main.c:1777
#7  0x0000000000a37286 in do_cli (argc=2, argv=0x1357390) at /usr/local/src/php/src/sapi/cli/php_cli.c:1142
#8  0x0000000000a3796e in main (argc=2, argv=0x1357390) at /usr/local/src/php/src/sapi/cli/php_cli.c:1345