[ndossche]

Reproducer: #16727 (comment), only happens when opcache is enabled. Reporter confirmed this fixes the problem for them and I also can't reproduce the issue anymore with this patch. I don't know how to write a test for this.

The root cause is a race condition between two different threads:

1. We allocate a lower cased name for an anonymous class here:
   

   php-src/Zend/zend_compile.c

   Line 8109 in f97353f

   lcname = zend_string_tolower(name);

2. This gets looked up as an interned string here:
   

   php-src/Zend/zend_compile.c

   Line 8112 in f97353f

   lcname = zend_new_interned_string(lcname);

   
   Assuming that there are uppercase symbols in the string and therefore
   lcname != name and that lcname is not yet in the interned string table,
   the pointer value of lcname won't change.
3. Here we add the string into the interned string table:
   

   php-src/Zend/zend_compile.c

   Line 8223 in f97353f

   LITERAL_STR(opline->op1, lcname);

   
   However, in the meantime another thread could've added the string into the interned string table.
   This means that the following code will run, indirectly called via the LITERAL_STR macro,
   freeing lcname:

   php-src/ext/opcache/ZendAccelerator.c

   Lines 572 to 575 in 62e53e6

   	if (ret) {
   	zend_string_release(str);
   	return ret;
   	}

4. In the reproducer we then access the freed lcname string here:
   

   php-src/Zend/zend_compile.c

   Line 8229 in f97353f

   if (!zend_hash_add_ptr(CG(class_table), lcname, ce)) {

This is solved in my patch by retrieving the interned string pointer and putting it in lcname.

[dstogov]

Looks right.