public static function decodePhpSerialize( $data ) {
		if ( !is_string( $data ) ) {
			throw new \InvalidArgumentException( '$data must be a string' );
		}

		$error = null;
		set_error_handler( function ( $errno, $errstr ) use ( &$error ) {
			$error = $errstr;
			return true;
		} );
		$ret = unserialize( $data );
		restore_error_handler();

		if ( $error !== null ) {
			self::$logger->error( 'PHP unserialization failed: ' . $error );
			return null;
		}

		// PHP strangely allows non-arrays to session_decode(), even though
		// that breaks $_SESSION. Let's not do that.
		if ( !is_array( $ret ) ) {
			self::$logger->error( 'PHP unserialization failed (value was not an array)' );
			return null;
		}

		return $ret;
	}