Attempting a better description of the problem:

There are two possible sequences during preloading:

• Forking: (opcache.preload_user is set)
  • In the parent: fork(), waitpid(), preload_load()
  • In the child: php_request_startup(), execute/persist, php_request_shutdown()
• Non-forking:
  • In the same process: php_request_startup(), execute/persist, preload_load(), php_request_shutdown()

preload_load() reads EG(class_table) and updates EG(persistent_classes_count).

EG(class_table) is only initialized by init_executor(), during php_request_startup(). Therefore the forking case may access an uninitialized EG(class_table) in the parent, as php_request_startup() is not called.

I think this has gone unnoticed because EG points to a freshly allocated large block, which is likely all zeros. But after an apache restart cycle, EG is more likely to be allocated from recycled memory.

So we can not update EG(persistent_classes_count) in preload_load(), as EG(class_table) may be uninitialized.

It is not necessary to update it in the forking case, as the next init_executor() call will initialize it, so we can remove that from preload_load().

However it's necessary in the non-forking case, as php_request_shutdown() would remove the preloaded symbols before init_executor(). So I moved the EG(persistent_classes_count) update just after the execute/persist step.