Closure fails to borrow its upvar, causing memory unsafety

[huonw]

fn main() {
    let mut v = ~[1];
    let f = || v.push(2);
    let _w = v; // should be illegal, `v` is borrowed by `f`

    f(); // boom
}

The above crashes with a segfault.

[huonw]

cc @nikomatsakis

[huonw]

Possibly related to/the same as #10398.

[nikomatsakis]

cc #6801

[alexcrichton]

This has been fixed, flagging as needstest.