Fixed use-after-free introduced by ca49e53670

Zend/tests/exception_026.phpt

@@ -0,0 +1,26 @@
+--TEST--
+Nested exceptions in destructors
+--FILE--
+<?php
+class A {
+    static $max=0;
+    function __destruct() {
+        if (self::$max--<0)
+            X;  
+        $a = new A;
+        Y;      
+    }
+}
+new A;
+?>
+--EXPECTF--
+Fatal error: Uncaught Error: Undefined constant "Y" in %s:8
+Stack trace:
+#0 %s(11): A->__destruct()
+#1 {main}
+
+Next Error: Undefined constant "X" in %s:6
+Stack trace:
+#0 %s(11): A->__destruct()
+#1 {main}
+  thrown in %s on line 6

Zend/zend_objects.c

@@ -156,6 +156,11 @@ ZEND_API void zend_objects_destroy_object(zend_object *object)
 			if (EG(exception) == object) {
 				zend_error_noreturn(E_CORE_ERROR, "Attempt to destruct pending exception");
 			} else {
+				if (EG(current_execute_data)
+				 && EG(current_execute_data)->func
+				 && ZEND_USER_CODE(EG(current_execute_data)->func->common.type)) {
+					zend_rethrow_exception(EG(current_execute_data));
+				}
 				old_exception = EG(exception);
 				old_opline_before_exception = EG(opline_before_exception);
 				EG(exception) = NULL;