serious bug in PHP 6 ZE

Hi, After quite a while of trying, I've tracked down the problem that is causing occasional segfaults in run-tests.php in PHP 6. Basically, here's what happens: on line 1652, we call system_with_timeout() to run the test, passing in a CV ($cmd) containing the command line to execute to run the test. In the cleanup of the active symbol table when returning from system_with_timeout(), the refcount of $commandline is not correct, and so the $cmd zval is efreed. At some random points, the return value of the run_test() occupies the same space that $cmd once occupied, gets efreed, and we crash. To get a segfault every time, put a simple var_dump($cmd); on line 1653 in run-tests.php and do "make test" So, it seems that either refcounting is not incrementing enough, or decrementing too much in PHP 6. Greg