Description:
------------
This issue is only obvious when freeing of the object store is disabled - otherwise the leaks will be hidden. Here is a patch to disable it: https://gist.github.com/nikic/2ccbc61c407d5e807781

The following script will leak:

<?php

$bar = NULL;
class bad {
	public function __destruct() {
		global $bar;
		$bar = $this;
		$bar->y = new stdClass;
	}
}

$foo = new stdClass;
$foo->foo = $foo;
$foo->bad = new bad;
$foo->bad->x = new stdClass;

unset($foo);
gc_collect_cycles();

The following script will also leak:

<?php
$bar = NULL;
class bad
{
	public $_private = array();

	public function __construct()
	{
		$this->_private[] = 'php';
	}

	public function __destruct()
	{
		global $bar;
		$bar = $this;
	}
}

$foo = new stdclass;
$foo->foo = $foo;
$foo->bad = new bad;

unserialize(serialize($foo));
//unset($foo);

gc_collect_cycles();
var_dump($bar); 

I have not been able to figure out how to stop the leak in both cases. The fundamental issue seems to be that gc_remove_nested_data does not decrement the refcount to compensate the incref that occurs in gc_collect_roots.