I have already written about the problem of InvalidPath [0] appearing. I investigated this and found an error in the add_path() function, when we reject a path, we free up the memory of the path, but do not delete various mentions of it (for example, in the ancestor of relation, as in the example below).
I agree that what you observed is true - add_path() may free a path while it's still referenced from some lower rels. For instance, when creating ordered paths, we may use the input path unchanged without copying if it's already well ordered, and it might be freed afterwards if it fails when competing in add_path().
But this doesn't seem to be a problem in practice. We will not access these references from the lower rels.
I'm not sure if this is an issue that we need to fix, or we need to live with. But I do think it deserves some explanation in the comment of add_path().
