Partial fix for bug #77751

This avoids the segfault, but it will not make writing to the
SplFileObject during output shutdown work.

ext/spl/spl_directory.c

@@ -97,6 +97,7 @@ static void spl_filesystem_object_destroy_object(zend_object *object) /* {{{ */
 			} else {
 				php_stream_pclose(intern->u.file.stream);
 			}
+			intern->u.file.stream = NULL;
 		}
 		break;
 	}
@@ -127,13 +128,11 @@ static void spl_filesystem_object_free_storage(zend_object *object) /* {{{ */
 		}
 		break;
 	case SPL_FS_FILE:
-		if (intern->u.file.stream) {
-			if (intern->u.file.open_mode) {
-				efree(intern->u.file.open_mode);
-			}
-			if (intern->orig_path) {
-				efree(intern->orig_path);
-			}
+		if (intern->u.file.open_mode) {
+			efree(intern->u.file.open_mode);
+		}
+		if (intern->orig_path) {
+			efree(intern->orig_path);
 		}
 		spl_filesystem_file_free_line(intern);
 		break;

ext/spl/tests/bug77751.phpt

@@ -0,0 +1,18 @@
+--TEST--
+Bug #77751: Writing to SplFileObject in ob_start gives segfault
+--FILE--
+<?php
+
+echo "No crash.\n";
+
+$logfile = new SplTempFileObject();
+ob_start(function ($buffer) use ($logfile) {
+    $logfile->fwrite($buffer);
+    $logfile->fflush();
+    return "";
+});
+echo "hmm\n";
+
+?>
+--EXPECT--
+No crash.