bug71129_3.patch

diff --git a/Zend/zend.c b/Zend/zend.c
index 23fb9f2..0c3ca61 100644
--- a/Zend/zend.c
+++ b/Zend/zend.c
@@ -446,13 +446,17 @@ static void zend_init_call_trampoline_op(void) /* {{{ */
 }
 /* }}} */
 
+#ifdef ZTS
 static void auto_global_dtor(zval *zv) /* {{{ */
 {
-	free(Z_PTR_P(zv));
+	zend_auto_global *ag = (zend_auto_global *)Z_PTR_P(zv);
+
+	zend_string_release(ag->name);
+
+	free(ag);
 }
 /* }}} */
 
-#ifdef ZTS
 static void function_copy_ctor(zval *zv) /* {{{ */
 {
 	zend_function *old_func = Z_FUNC_P(zv);
@@ -467,7 +471,9 @@ static void auto_global_copy_ctor(zval *zv) /* {{{ */
 	zend_auto_global *old_ag = (zend_auto_global *) Z_PTR_P(zv);
 	zend_auto_global *new_ag = pemalloc(sizeof(zend_auto_global), 1);
 
-	new_ag->name = old_ag->name;
+	/* The string needs to be copied, simple pointer assigning will cause
+	   race conditions between threads when counting GC. */
+	new_ag->name = zend_string_dup(old_ag->name, 1);
 	new_ag->auto_global_callback = old_ag->auto_global_callback;
 	new_ag->jit = old_ag->jit;
 
@@ -587,6 +593,12 @@ static void zend_new_thread_end_handler(THREAD_T thread_id) /* {{{ */
 	}
 }
 /* }}} */
+#else
+static void auto_global_dtor(zval *zv) /* {{{ */
+{
+	free(Z_PTR_P(zv));
+}
+/* }}} */
 #endif
 
 #if defined(__FreeBSD__) || defined(__DragonFly__)
diff --git a/Zend/zend_compile.c b/Zend/zend_compile.c
index 1c30b98..cd6e79a 100644
--- a/Zend/zend_compile.c
+++ b/Zend/zend_compile.c
@@ -1537,7 +1537,10 @@ int zend_register_auto_global(zend_string *name, zend_bool jit, zend_auto_global
 
 	retval = zend_hash_add_mem(CG(auto_globals), auto_global.name, &auto_global, sizeof(zend_auto_global)) != NULL ? SUCCESS : FAILURE;
 
+#ifndef ZTS
+	/* XXX ZTS currently has no interned strings, thus --GC_REFCOUNT(name) would effectively set name GC ready. */
 	zend_string_release(name);
+#endif
 	return retval;
 }
 /* }}} */