The reference to the object is the same in the forked process, because the memory location of the object in the child process's memory space is the same.
The hash is calculated as the object address XOR a random mask (which is generated only once) , as you can read in the PHP source code, ext/spl/php_spl.c
:
PHPAPI void php_spl_object_hash(zval *obj, char *result TSRMLS_DC) /* {{{*/
{
intptr_t hash_handle, hash_handlers;
char *hex;
if (!SPL_G(hash_mask_init)) {
if (!BG(mt_rand_is_seeded)) {
php_mt_srand(GENERATE_SEED() TSRMLS_CC);
}
SPL_G(hash_mask_handle) = (intptr_t)(php_mt_rand(TSRMLS_C) >> 1);
SPL_G(hash_mask_handlers) = (intptr_t)(php_mt_rand(TSRMLS_C) >> 1);
SPL_G(hash_mask_init) = 1;
}
hash_handle = SPL_G(hash_mask_handle)^(intptr_t)Z_OBJ_HANDLE_P(obj);
hash_handlers = SPL_G(hash_mask_handlers)^(intptr_t)Z_OBJ_HT_P(obj);
spprintf(&hex, 32, "%016x%016x", hash_handle, hash_handlers);
strlcpy(result, hex, 33);
efree(hex);
}
/* }}} */
If the random number generator was seeded before the function was called you would get the exact same output for both the child and the parent process. But in this case it isn't, and each process calculates it own seed. The code for GENERATE_SEED
goes:
#ifdef PHP_WIN32
#define GENERATE_SEED() (((long) (time(0) * GetCurrentProcessId())) ^ ((long) (1000000.0 * php_combined_lcg(TSRMLS_C))))
#else
#define GENERATE_SEED() (((long) (time(0) * getpid())) ^ ((long) (1000000.0 * php_combined_lcg(TSRMLS_C))))
#endif
As you can see, the seed depends on the process ID, which is of course different for the parent and the child.
So, different random number generator seed, different random mask, different hash.