Description:
------------
PDO segfaults on any pdo_stmt_instantiate when using persistent connections.

Reproduce code:
---------------
<?php
$dsn = '...';
$user = '...';
$pass = '...';
$options = array(PDO::ATTR_PERSISTENT => true);
$db = new PDO($dsn, $user, $pass, $options);
$sql = 'SELECT * FROM some_table';
$result = $db->query($sql);
echo "Query OK";
?>

Expected result:
----------------
Query OK

Actual result:
--------------
Segmentation fault

GDB backtrace:
#0  _object_and_properties_init (arg=0x8599b0c, class_type=0x0, properties=0x0,
    tsrm_ls=0x8439018) at /shared/src/php/php5-200511191330/Zend/zend_API.c:818
#1  0x0829ba79 in _object_init_ex (arg=0x8599b0c, class_type=0x0,
    tsrm_ls=0x8439018) at /shared/src/php/php5-200511191330/Zend/zend_API.c:843
#2  0x081316c0 in pdo_stmt_instantiate (dbh=0x8599c08, object=0x8599b0c, dbstmt_ce=Variable "dbstmt_ce" is not available.

) at /shared/src/php/php5-200511191330/ext/pdo/pdo_dbh.c:418
#3  0x08133d11 in zif_PDO_query (ht=1, return_value=0x8599b0c,
    return_value_ptr=0x0, this_ptr=0x8599a84, return_value_used=1,
    tsrm_ls=0x8439018) at /shared/src/php/php5-200511191330/ext/pdo/pdo_dbh.c:971
#4  0x082be00e in zend_do_fcall_common_helper_SPEC (execute_data=0xbfdfd24c,
    tsrm_ls=0x8439018) at zend_vm_execute.h:188
#5  0x082bd5fa in execute (op_array=0x8595184, tsrm_ls=0x8439018)
    at zend_vm_execute.h:88
#6  0x0829893e in zend_execute_scripts (type=8, tsrm_ls=0x8439018, retval=Variable "retval" is not available.
)
    at /shared/src/php/php5-200511191330/Zend/zend.c:1090
#7  0x0825af0a in php_execute_script (primary_file=0xbfdff64c, tsrm_ls=0x8439018)
    at /shared/src/php/php5-200511191330/main/main.c:1704
#8  0x08332867 in main (argc=2, argv=0xbfdff734)
    at /shared/src/php/php5-200511191330/sapi/cli/php_cli.c:1039

It seems that the dbh returned by zend_object_store_get_object(getThis() TSRMLS_CC); does not contain a valid def_stmt_ce when using persistent connections. _object_and_properties_init then segfaults when being passed a null-pointer as the class_type argument.

My guess is an error in the dbh_constructor function, though I'm not sure as I don't know how the inner details of PHP/PDO. If the connection is persistent, dbh_constructor allocates a brand new pdo_dbh_t (pdbh) structure without pointing pdbh->def_stmt_ce to the one pointed to by the old dbh (dbh).

Hope you can figure this out :)