Description:
------------
The attached script crashes PHP 5.6.30.

Test script:
---------------
<?php
class bad{function t(){$h[]=0;}function __destruct(){global$bar;$bar=$this;}}$foo->f=$foo=$d=new bad;unserialize(serialize($foo));gc_collect_cycles();

Expected result:
----------------
No crash.

Actual result:
--------------
==12586==ERROR: AddressSanitizer: SEGV on unknown address 0x100139182d88 (pc 0x00000198aad7 sp 0x7fffc2f3a1c0 bp 0x7fe67d2d1840 T0)
    #0 0x198aad6 in gc_zval_possible_root /root/php-5.6.30/Zend/zend_gc.c:143
    #1 0x19019d6 in zend_hash_destroy /root/php-5.6.30/Zend/zend_hash.c:548
    #2 0x19b32da in zend_object_std_dtor /root/php-5.6.30/Zend/zend_objects.c:44
    #3 0x19b3650 in zend_objects_free_object_storage /root/php-5.6.30/Zend/zend_objects.c:137
    #4 0x19e201a in zend_objects_store_del_ref_by_handle_ex /root/php-5.6.30/Zend/zend_objects_API.c:226
    #5 0x19e25b5 in zend_objects_store_del_ref /root/php-5.6.30/Zend/zend_objects_API.c:178
    #6 0x18162c7 in _zval_dtor /root/php-5.6.30/Zend/zend_variables.h:35
    #7 0x18162c7 in i_zval_ptr_dtor /root/php-5.6.30/Zend/zend_execute.h:79
    #8 0x18162c7 in _zval_ptr_dtor /root/php-5.6.30/Zend/zend_execute_API.c:424
    #9 0x1906e8e in i_zend_hash_bucket_delete /root/php-5.6.30/Zend/zend_hash.c:182
    #10 0x1906e8e in zend_hash_bucket_delete /root/php-5.6.30/Zend/zend_hash.c:192
    #11 0x1906e8e in zend_hash_reverse_apply /root/php-5.6.30/Zend/zend_hash.c:733
    #12 0x1817940 in shutdown_destructors /root/php-5.6.30/Zend/zend_execute_API.c:214
    #13 0x1898593 in zend_call_destructors /root/php-5.6.30/Zend/zend.c:944
    #14 0x15d2974 in php_request_shutdown /root/php-5.6.30/main/main.c:1840
    #15 0x1e68480 in do_cli /root/php-5.6.30/sapi/cli/php_cli.c:1181
    #16 0x456468 in main /root/php-5.6.30/sapi/cli/php_cli.c:1382
    #17 0x7fe67ae0cb44 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21b44)
    #18 0x45730e (/root/php-5.6.30/sapi/cli/php+0x45730e)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /root/php-5.6.30/Zend/zend_gc.c:143 gc_zval_possible_root
==12586==ABORTING