Why do LD_PRELOAD libraries get initialized last?

[Andy Lutomirski <luto at amacapital dot net>]

AFAICT the loader is careful to initialize dependencies before the
libraries that depend on them.  But LD_PRELOAD libraries seem to get
initialized dead last.  This is unfortunate when an LD_PRELOADed
library wants to be initialized before the functions that it
interposes get run.  For example:

$ LD_PRELOAD=/usr/lib64/libtcmalloc.so LD_DEBUG=libs /bin/echo foo
     30482:	find library=libc.so.6 [0]; searching
     30482:	 search cache=/etc/ld.so.cache
     30482:	  trying file=/lib64/libc.so.6
     30482:	
     30482:	find library=libunwind.so.7 [0]; searching
     30482:	 search cache=/etc/ld.so.cache
     30482:	  trying file=/usr/lib64/libunwind.so.7
     30482:	
     30482:	find library=libpthread.so.0 [0]; searching
     30482:	 search cache=/etc/ld.so.cache
     30482:	  trying file=/lib64/libpthread.so.0
     30482:	
     30482:	find library=libstdc++.so.6 [0]; searching
     30482:	 search cache=/etc/ld.so.cache
     30482:	  trying file=/usr/lib64/libstdc++.so.6
     30482:	
     30482:	find library=libm.so.6 [0]; searching
     30482:	 search cache=/etc/ld.so.cache
     30482:	  trying file=/lib64/libm.so.6
     30482:	
     30482:	find library=libgcc_s.so.1 [0]; searching
     30482:	 search cache=/etc/ld.so.cache
     30482:	  trying file=/lib64/libgcc_s.so.1
     30482:	
     30482:	
     30482:	prelink checking: failed
     30482:	
     30482:	calling init: /lib64/libpthread.so.0
     30482:	
     30482:	
     30482:	calling init: /lib64/ld-linux-x86-64.so.2
     30482:	
     30482:	
     30482:	calling init: /lib64/libc.so.6
     30482:	
     30482:	
     30482:	calling init: /lib64/libgcc_s.so.1
     30482:	
     30482:	
     30482:	calling init: /lib64/libm.so.6
     30482:	
     30482:	
     30482:	calling init: /usr/lib64/libstdc++.so.6
     30482:	
     30482:	
     30482:	calling init: /usr/lib64/libtcmalloc.so
     30482:	
     30482:	
     30482:	initialize program: /bin/echo
     30482:	
     30482:	
     30482:	transferring control: /bin/echo
     30482:	
foo

libtcmalloc got initialized after everything else, which means that
malloc is likely to have been called long before the constructor.  Is
this intentional?

So far, the only way I've found to get an LD_PRELOADed library to run
a constructor early is with ifunc.  That seems rather evil.  Unless
I'm doing something wrong, even -zinitfirst doesn't help.

--Andy