separate properties of internal classes in ZTS mode fully,

otherwise multiple threads will modify the zvals' contents
without any synchronisation.

Zend/zend_API.c

@@ -952,7 +952,7 @@ ZEND_API int _object_and_properties_init(zval *arg, zend_class_entry *class_type
 		} else {
 			ALLOC_HASHTABLE_REL(object->properties);
 			zend_hash_init(object->properties, zend_hash_num_elements(&class_type->default_properties), NULL, ZVAL_PTR_DTOR, 0);
-			zend_hash_copy(object->properties, &class_type->default_properties, (copy_ctor_func_t) zval_add_ref, (void *) &tmp, sizeof(zval *));
+			zend_hash_copy(object->properties, &class_type->default_properties, zval_copy_property_ctor(class_type), (void *) &tmp, sizeof(zval *));
 		}
 	} else {
 		Z_OBJVAL_P(arg) = class_type->create_object(class_type TSRMLS_CC);

Zend/zend_compile.c

@@ -2298,24 +2298,8 @@ static int inherit_static_prop(zval **p, int num_args, va_list args, zend_hash_k
 	return ZEND_HASH_APPLY_KEEP;
 }
 
-#ifdef ZTS
-static void zval_internal_ctor(zval **p)
-{
-	zval *orig_ptr = *p;
-
-	ALLOC_ZVAL(*p);
-	**p = *orig_ptr;
-	zval_copy_ctor(*p);
-	(*p)->refcount = 1;
-	(*p)->is_ref = 0;
-}
-
-# define zval_property_ctor(parent_ce, ce) \
-	((void (*)(void *)) (((parent_ce)->type != (ce)->type) ? zval_internal_ctor : zval_add_ref))
-#else
-# define zval_property_ctor(parent_ce, ce) \
-	((void (*)(void *)) zval_add_ref)
-#endif
+#define zval_property_ctor(parent_ce, ce) \
+	((copy_ctor_func_t) (((parent_ce)->type != (ce)->type) ? zval_shared_property_ctor : zval_add_ref))
 
 ZEND_API void zend_do_inheritance(zend_class_entry *ce, zend_class_entry *parent_ce TSRMLS_DC)
 {

Zend/zend_exceptions.c

@@ -84,7 +84,7 @@ static zend_object_value zend_default_exception_new_ex(zend_class_entry *class_t
 
 	ALLOC_HASHTABLE(object->properties);
 	zend_hash_init(object->properties, 0, NULL, ZVAL_PTR_DTOR, 0);
-	zend_hash_copy(object->properties, &class_type->default_properties, (copy_ctor_func_t) zval_add_ref, (void *) &tmp, sizeof(zval *));
+	zend_hash_copy(object->properties, &class_type->default_properties, zval_copy_property_ctor(class_type), (void *) &tmp, sizeof(zval *));
 
 	ALLOC_ZVAL(trace);
 	trace->is_ref = 0;

Zend/zend_objects.c

@@ -156,7 +156,7 @@ static void zval_add_ref_or_clone(zval **p)
 			(*p)->value.obj = Z_OBJ_HT_PP(p)->clone_obj(orig TSRMLS_CC);
 		}
 	} else {
-		(*p)->refcount++;
+		zval_shared_property_ctor(p);
 	}
 }
 
@@ -165,7 +165,7 @@ ZEND_API void zend_objects_clone_members(zend_object *new_object, zend_object_va
 	if (EG(ze1_compatibility_mode)) {
 		zend_hash_copy(new_object->properties, old_object->properties, (copy_ctor_func_t) zval_add_ref_or_clone, (void *) NULL /* Not used anymore */, sizeof(zval *));
 	} else {
-		zend_hash_copy(new_object->properties, old_object->properties, (copy_ctor_func_t) zval_add_ref, (void *) NULL /* Not used anymore */, sizeof(zval *));
+		zend_hash_copy(new_object->properties, old_object->properties, zval_copy_property_ctor(old_object->ce), (void *) NULL /* Not used anymore */, sizeof(zval *));
 	}
 	if (old_object->ce->clone) {
 		zval *new_obj;

Zend/zend_variables.c

@@ -150,6 +150,18 @@ ZEND_API int zend_print_variable(zval *var) /* {{{ */
 }
 /* }}} */
 
+ZEND_API void zval_property_ctor(zval **p) /* {{{ */
+{
+	zval *orig_ptr = *p;
+
+	ALLOC_ZVAL(*p);
+	**p = *orig_ptr;
+	zval_copy_ctor(*p);
+	(*p)->refcount = 1;
+	(*p)->is_ref   = 0;
+}
+/* }}} */
+
 #if ZEND_DEBUG
 ZEND_API void _zval_copy_ctor_wrapper(zval *zvalue) /* {{{ */
 {

Zend/zend_variables.h

@@ -77,6 +77,17 @@ ZEND_API void _zval_internal_ptr_dtor_wrapper(zval **zvalue);
 
 ZEND_API void zval_add_ref(zval **p);
 
+ZEND_API void zval_property_ctor(zval **);
+
+#ifdef ZTS
+# define zval_shared_property_ctor zval_property_ctor
+#else
+# define zval_shared_property_ctor zval_add_ref
+#endif
+
+#define zval_copy_property_ctor(ce) ((copy_ctor_func_t) (((ce)->type == ZEND_INTERNAL_CLASS) ? zval_shared_property_ctor : zval_add_ref))
+
+
 END_EXTERN_C()
 
 #define ZVAL_DESTRUCTOR (void (*)(void *)) zval_dtor_wrapper