Description:
------------
The opcache extenstion turns off PHP string interning and substitutes its own strategy for collecting interned strings in its own SHM-based interned_strings hash during  in ZendAcclerator.c:zend_accel_init_shm().  It is then turned off in accel_shutdown().

Before and after these points in accel_startup() and accel_shutdown(), all interned strings created and dtored should lie between the original CG(interned_strings_start) and CG(interned_strings_end).  Note that this list of local interned strings is non-trivial (typically some 2,000) comprising interned_string representations of all builtin Zend and extension constants, function names and methods. I call these built-in interned strings.  

Between these same points all interned strings created and dtored should lie between ZCSG(interned_strings_start) and ZCSG(interned_strings_end).  I call these shared interned strings.

However, if a zval refering to a builtin interned string is dtored between accel_startup() and accel_shutdown(), then the !IS_INTERNED() macro will return false as the address of the string lies between original CG(interned_strings_start) and CG(interned_strings_end) and not between   
ZCSG(interned_strings_start) and ZCSG(interned_strings_end).  DTOR will then attempt to efree the string which is invalid as the string wasn't emalloc'ed.

As long as the scope and lifetimes of the two sets of interned strings are disjoint this all works fine.  However, one optimization introduced in PHP-5.6 has been missed and that is with strings and zvals created with the STR_EMPTY_ALLOC(), RETVAL_EMPTY_STRING() and ZVAL_EMPTY_STRING() macros.  These are all based on the CG(interned_empty_string) value and this is a built-in interned string.  If any of these are DTORed then the dtor will fail as described above.  ZendAccelerator should establish its own ZCSG(interned_empty_string) value to prevent this happening.


Test script:
---------------
php56 -r '' 

(with opcache enabled)