strange segfaults / valgrind errors / invalid free on string ::_Rep::_S_empty_rep_storage

[Paweł Sikora <pluto@xxxxxxxx>]

Hi,

with gcc-4.7.x configured with --enable-symvers=gnu-versioned-namespace i have strange segfaults with my debug build.
i'm using following switches for compilation:

$ g++ -c -D_GNU_SOURCE -D_GLIBCXX_DEBUG -D_DEBUG -pthread -Wall -Wno-maybe-uninitialized -Winit-self -Wno-deprecated -Wsign-compare \
      -Wtype-limits -Wempty-body -Wnon-virtual-dtor -Wc++11-compat -Woverloaded-virtual  -Werror -mcld -fmax-errors=3 -fdwarf2-cfi-asm \
      -fno-debug-types-section -march=x86-64 -O1 -gdwarf-4 -g2 -fno-strict-aliasing -pipe -fno-schedule-insns -fno-schedule-insns2 -std=gnu++11

valgrind reports invalid free/delete:

==7889== Thread 4:
==7889== Invalid free() / delete / delete[] / realloc()
==7889==    at 0x4A07096: operator delete(void*) (vg_replace_malloc.c:457)
==7889==    by 0x4D88A90: std::__7::basic_string<char, std::__7::char_traits<char>, std::__7::allocator<char> >::_Rep::_M_destroy(std::__7::allocator<char> const&) (in /remote/pawels/dvm/svn-trunk/build-debug-x86_64-gnu-linux/libsce_mi.so)
==7889==    by 0x4D930DD: std::__7::basic_string<char, std::__7::char_traits<char>, std::__7::allocator<char> >::_Rep::_M_dispose(std::__7::allocator<char> const&) (in /remote/pawels/dvm/svn-trunk/build-debug-x86_64-gnu-linux/libsce_mi.so)
==7889==    by 0x4D94A51: au::Path::~Path() (in /remote/pawels/dvm/svn-trunk/build-debug-x86_64-gnu-linux/libsce_mi.so)
==7889==    by 0x4D91E42: scemi::CfgReader::readCfg(char const*) (in /remote/pawels/dvm/svn-trunk/build-debug-x86_64-gnu-linux/libsce_mi.so)
==7889==    by 0x4DBF368: SceMiParameters::SceMiParameters(char const*, SceMiEC*) (in /remote/pawels/dvm/svn-trunk/build-debug-x86_64-gnu-linux/libsce_mi.so)
==7889==    by 0x406141: TestBench::Init() (testbench.cpp:251)
==7889==    by 0x4CAC759: sc_core::sc_thread_cor_fn(void*) (sc_process.h:514)
==7889==    by 0x4C98996: sc_core::sc_cor_pthread::invoke_module_method(void*) (sc_cor_pthread.cpp:142)
==7889==    by 0x3D24C0673C: start_thread (in /lib64/libpthread-2.5.so)
==7889==    by 0x3D240D3D1C: clone (in /lib64/libc-2.5.so)
==7889==  Address 0x40c820 is 0 bytes inside data symbol "_ZNSt3__712basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEE4_Rep20_S_empty_rep_storageE"
==7889==

the au::Path object is a small local object on function stack and contains 'string' and 'vector<string>' members.
i have no idea why the string implementation tries to destroy static _S_empty_rep_storage area?
empty string refcounting problem? destruction race between threads? any hints?

BR,
Paweł.