[sigc] Strange crashes in sigc::trackable on Mac OS X

[Michael Ekstrand <mekstran scl ameslab gov>]

Hello all,

I am experiencing some strange crashes in sigc::trackable on Mac OS X  
10.4, using Apple's GCC 4.0.1 and libsigc++-2.0.17 from Fink.

My program has an object model that uses libsigc++ to monitor object  
state so that other objects, UI elements, etc. can be notified when  
an object's saved state changes.  It can be a fairly twisted network  
of signals sometimes, but it should work and does work on Linux.  If  
it's relevant, the object model also uses a reference counting  
mechanism, using hand-rolled reference counting smartpointers (and  
corresponding weak pointers, using libsigc++ for the callback  
mechanism to notify weak pointers of object destruction).  The memory  
management stuff seems to be working flawlessly.

The problem occurs when the object model representation for a  
document is being destroyed (e.g., the document is closed).  It  
crashes with one of illegal instruction, bus error, or segmentation  
fault (usually illegal instruction) when it's destroying some of the  
objects.

The illegal instruction error (by far the most common, and the one  
I've investigated most thoroughly) happens when destroying a  
slot_base (and its rep_).  It's frequently (usually?) in the rep's  
destroy() method, at the line:

if (destroy_) (destroy_)(this);

If I tell gdb to print *destroy_, it says that it cannot access  
memory.  I don't know if this is because the destroy_ pointer is bad,  
or if gdb can't dereference function pointers.

Any insight into this problem would be most appreciated.

-Michael