This is the order of *_destroy calls which resulted in the fewest errors/leaks detected by Valgrind. Most of the errors come from the gbm_allocator code - will have to figure out which destroy call is still missing.