Don't leak cloned closures/continuations

Instead of appending the new closure to the end of the list,
the list was being cleared, and then the new closure was added.

Most closures only get one clone (since we don't yet support bind)
but occaisionally, closures (or continuations in closures) inside
traits can end up with more than one. In that case, we ping-pong
between the different clones, generating new clones, and new code
as we go.

hphp/runtime/vm/func.cpp

@@ -270,11 +270,11 @@ const Func* Func::cloneAndSetClass(Class* cls) const {
   clonedFunc->setCls(cls);
 
   // Save it so we don't have to keep cloning it and retranslating
-  Func*& nextFunc = this->nextClonedClosure();
-  while (nextFunc) {
-    nextFunc = nextFunc->nextClonedClosure();
+  Func** nextFunc = &this->nextClonedClosure();
+  while (*nextFunc) {
+    nextFunc = &nextFunc[0]->nextClonedClosure();
   }
-  nextFunc = clonedFunc;
+  *nextFunc = clonedFunc;
 
   return clonedFunc;
 }