Haxe/Neko exceptions when exiting a call to a C++ FFI that iterates over items in an abstract kind

Question

When I return a value of abstract kind containing a vector from one FFI, and iterate over it in another FFI, there's an exception as the second FFI call finishes. I can access the items in the vector one by one without a problem, but iterating over the values seems to cause a problem. It doesn't matter if I use a for each loop, an iterator, or even loop over the indices.

Haxe code:

class VectorExample {
    public static function main() {
        var vec = createVec();
        // dumpForIntIter(vec); // fails on exit
        dumpEach(vec);          // works
    }

    private static var createVec = neko.Lib.load("vectorLib", "createVec", 0);
    private static var dumpForIntIter = neko.Lib.load("vectorLib", "dumpForIntIter", 1);
    private static var dumpEach = neko.Lib.load("vectorLib", "dumpEach", 1);
}

Cpp code:

#include <iostream>
#include <string>
#include <vector>
#include <neko.h>

void free_vec( value handle ) {
    std::cout << "freeing vec" << std::endl;
    std::vector<std::string>* vec = (std::vector<std::string>*) val_data(handle);
    delete vec;
}

DEFINE_KIND(k_vector);

value createVec() {
    auto vec = new std::vector<std::string>();
    vec->push_back(std::string("one"));
    vec->push_back(std::string("two"));
    vec->push_back(std::string("three"));

    value handle = alloc_abstract(k_vector, vec);
    val_gc(handle, free_vec);

    return handle;
}
DEFINE_PRIM(createVec,0);

// fails on exit
void dumpForIntIter( value handle ) {
    auto vec = (std::vector<std::string>*) val_data(handle);
    std::cout << "size: " << vec->size() << std::endl;
    for (int ii=0; ii<vec->size(); ii++)
        std::cout << "  item: " << vec->at(ii) << std::endl;
}
DEFINE_PRIM(dumpForIntIter,1);

// works
void dumpEach( value handle ) {
    int ii = 0;
    auto vec = (std::vector<std::string>*) val_data(handle);
    std::cout << "size: " << vec->size() << std::endl;
    std::cout << "  item: " << vec->at(0) << std::endl;
    ii++;
    std::cout << "  item: " << vec->at(1) << std::endl;
    ii++;
    std::cout << "  item: " << vec->at(2) << std::endl;
    ii++;
}
DEFINE_PRIM(dumpEach,1);

Command to build the Neko module:

g++ -o vectorLib.ndll -shared -fPIC -std=c++11 -I/usr/include/x86_64-linux-gnu \
    -L/usr/lib/x86_64-linux-gnu -lneko -ldl vectorLib.cpp

Output when running with dumpForIntIter:

size: 3
  item: one
  item: two
  item: three
freeing vec
Called from ? line 1
Called from VectorExample.hx line 6
Uncaught exception - vectorLib@dumpForIntIter

Note that although freeing vec is the last thing in the log, the problem happens even if free_vec is empty or non existent.

Since dumpForIntIter and dumpForEach seem basically equivalent to me, I suspect there is a problem in createVec.

Docs: Neko FFI

UPDATE:

I disabled the exception trapping in nekovm and found that the problem is a segfault. This is the output from valgrind:

Jump to the invalid address stated on the next line
   at 0x2A50DA10C1C9AED6: ???
 Address 0x2a50da10c1c9aed6 is not stack'd, malloc'd or (recently) free'd

Can't extend stack to 0x2a50da10c1c99f88 during signal delivery for thread 1:
  no stack segment

Process terminating with default action of signal 11 (SIGSEGV)
 Access not within mapped region at address 0x2A50DA10C1C99F88
   at 0x2A50DA10C1C9AED6: ???

UPDATE 2:

If I change the vector<string> to vector<int> the problem persists. If I change to a char** (using malloc or new)there's no problem. If I change to just a string there's no problem. Seems like alloc_abstract doesn't like vector.