diff --git a/src/Val.cc b/src/Val.cc
index 14b3ba5f0d..bc20df4ed7 100644
--- a/src/Val.cc
+++ b/src/Val.cc
@@ -583,9 +583,8 @@ static void BuildJSON(threading::formatter::JSON::NullDoubleWriter& writer, Val*
 						{
 						auto blank = make_intrusive<StringVal>("");
 						auto fn_val = make_intrusive<StringVal>(field_name);
-						auto key_val = fn_val->Substitute(re, blank.get(), false)->AsStringVal();
+						auto key_val = fn_val->Substitute(re, blank.get(), false);
 						key_str = key_val->ToStdString();
-						Unref(key_val);
 						}
 					else
 						key_str = field_name;
@@ -1024,7 +1023,7 @@ unsigned int StringVal::MemoryAllocation() const
 	return padded_sizeof(*this) + val.string_val->MemoryAllocation();
 	}
 
-Val* StringVal::Substitute(RE_Matcher* re, StringVal* repl, bool do_all)
+IntrusivePtr<StringVal> StringVal::Substitute(RE_Matcher* re, StringVal* repl, bool do_all)
 	{
 	const u_char* s = Bytes();
 	int offset = 0;
@@ -1105,7 +1104,7 @@ Val* StringVal::Substitute(RE_Matcher* re, StringVal* repl, bool do_all)
 	// the NUL.
 	r[0] = '\0';
 
-	return new StringVal(new BroString(true, result, r - result));
+	return make_intrusive<StringVal>(new BroString(true, result, r - result));
 	}
 
 IntrusivePtr<Val> StringVal::DoClone(CloneState* state)
diff --git a/src/Val.h b/src/Val.h
index 13dce4c18c..1bcc5cc147 100644
--- a/src/Val.h
+++ b/src/Val.h
@@ -593,7 +593,7 @@ public:
 
 	unsigned int MemoryAllocation() const override;
 
-	Val* Substitute(RE_Matcher* re, StringVal* repl, bool do_all);
+	IntrusivePtr<StringVal> Substitute(RE_Matcher* re, StringVal* repl, bool do_all);
 
 protected:
 	void ValDescribe(ODesc* d) const override;
diff --git a/src/analyzer/analyzer.bif b/src/analyzer/analyzer.bif
index dac146a172..efb52e785f 100644
--- a/src/analyzer/analyzer.bif
+++ b/src/analyzer/analyzer.bif
@@ -23,7 +23,7 @@ function Analyzer::__disable_analyzer%(id: Analyzer::Tag%) : bool
 function Analyzer::__disable_all_analyzers%(%) : any
 	%{
 	analyzer_mgr->DisableAllAnalyzers();
-	return 0;
+	return nullptr;
 	%}
 
 function Analyzer::__register_for_port%(id: Analyzer::Tag, p: port%) : bool
@@ -41,11 +41,11 @@ function Analyzer::__schedule_analyzer%(orig: addr, resp: addr, resp_p: port,
 
 function __name%(atype: Analyzer::Tag%) : string
 	%{
-	return new StringVal(analyzer_mgr->GetComponentName(atype));
+	return make_intrusive<StringVal>(analyzer_mgr->GetComponentName(atype));
 	%}
 
 function __tag%(name: string%) : Analyzer::Tag
 	%{
 	analyzer::Tag t = analyzer_mgr->GetComponentTag(name->CheckString());
-	return t.AsEnumVal()->Ref();
+	return IntrusivePtr{NewRef{}, t.AsEnumVal()};
 	%}
diff --git a/src/analyzer/protocol/conn-size/functions.bif b/src/analyzer/protocol/conn-size/functions.bif
index 05e9f120c9..ef34cdc22a 100644
--- a/src/analyzer/protocol/conn-size/functions.bif
+++ b/src/analyzer/protocol/conn-size/functions.bif
@@ -139,7 +139,7 @@ function get_current_conn_duration_threshold%(cid: conn_id%): interval
 	%{
 	analyzer::Analyzer* a = GetConnsizeAnalyzer(cid);
 	if ( ! a )
-		return new Val(0.0, TYPE_INTERVAL);
+		return make_intrusive<Val>(0.0, TYPE_INTERVAL);
 
-	return new Val(static_cast<analyzer::conn_size::ConnSize_Analyzer*>(a)->GetDurationThreshold(), TYPE_INTERVAL);
+	return make_intrusive<Val>(static_cast<analyzer::conn_size::ConnSize_Analyzer*>(a)->GetDurationThreshold(), TYPE_INTERVAL);
 	%}
diff --git a/src/analyzer/protocol/ftp/functions.bif b/src/analyzer/protocol/ftp/functions.bif
index 1734dd864f..6dff964042 100644
--- a/src/analyzer/protocol/ftp/functions.bif
+++ b/src/analyzer/protocol/ftp/functions.bif
@@ -4,9 +4,9 @@ type ftp_port: record;
 %%{
 #include "Reporter.h"
 
-static Val* parse_port(const char* line)
+static IntrusivePtr<Val> parse_port(const char* line)
 	{
-	RecordVal* r = new RecordVal(BifType::Record::ftp_port);
+	auto r = make_intrusive<RecordVal>(BifType::Record::ftp_port);
 
 	int bytes[6];
 	if ( line && sscanf(line, "%d,%d,%d,%d,%d,%d",
@@ -47,9 +47,9 @@ static Val* parse_port(const char* line)
 	return r;
 	}
 
-static Val* parse_eftp(const char* line)
+static IntrusivePtr<Val> parse_eftp(const char* line)
 	{
-	RecordVal* r = new RecordVal(BifType::Record::ftp_port);
+	auto r = make_intrusive<RecordVal>(BifType::Record::ftp_port);
 
 	int net_proto = 0;	// currently not used
 	IPAddr addr;	// unspecified IPv6 address (all 128 bits zero)
@@ -206,7 +206,7 @@ function fmt_ftp_port%(a: addr, p: port%): string
 		{
 		uint32_t a = ntohl(addr[0]);
 		uint32_t pn = p->Port();
-		return new StringVal(fmt("%d,%d,%d,%d,%d,%d",
+		return make_intrusive<StringVal>(fmt("%d,%d,%d,%d,%d,%d",
 						a >> 24, (a >> 16) & 0xff,
 						(a >> 8) & 0xff, a & 0xff,
 						pn >> 8, pn & 0xff));
diff --git a/src/analyzer/protocol/http/functions.bif b/src/analyzer/protocol/http/functions.bif
index ff4f0015b7..c8c9f2e976 100644
--- a/src/analyzer/protocol/http/functions.bif
+++ b/src/analyzer/protocol/http/functions.bif
@@ -31,7 +31,7 @@ function skip_http_entity_data%(c: connection, is_orig: bool%): any
 	else
 		reporter->Error("no analyzer associated with connection record");
 
-	return 0;
+	return nullptr;
 	%}
 
 ## Unescapes all characters in a URI (decode every ``%xx`` group).
@@ -52,5 +52,5 @@ function unescape_URI%(URI: string%): string
 	const u_char* line = URI->Bytes();
 	const u_char* const line_end = line + URI->Len();
 
-	return new StringVal(analyzer::http::unescape_URI(line, line_end, 0));
+	return make_intrusive<StringVal>(analyzer::http::unescape_URI(line, line_end, 0));
 	%}
diff --git a/src/analyzer/protocol/netbios/functions.bif b/src/analyzer/protocol/netbios/functions.bif
index cd5c23552d..f4c145a9ae 100644
--- a/src/analyzer/protocol/netbios/functions.bif
+++ b/src/analyzer/protocol/netbios/functions.bif
@@ -34,7 +34,7 @@ function decode_netbios_name%(name: string%): string
 			break;
 		}
 
-	return new StringVal(i, result);
+	return make_intrusive<StringVal>(i, result);
 	%}
 
 ## Converts a NetBIOS name type to its corresponding numeric value.
diff --git a/src/analyzer/protocol/smtp/functions.bif b/src/analyzer/protocol/smtp/functions.bif
index a5670c7d64..adbe58a424 100644
--- a/src/analyzer/protocol/smtp/functions.bif
+++ b/src/analyzer/protocol/smtp/functions.bif
@@ -13,5 +13,5 @@ function skip_smtp_data%(c: connection%): any
 	analyzer::Analyzer* sa = c->FindAnalyzer("SMTP");
 	if ( sa )
 		static_cast<analyzer::smtp::SMTP_Analyzer*>(sa)->SkipData();
-	return 0;
+	return nullptr;
 	%}
diff --git a/src/analyzer/protocol/ssl/functions.bif b/src/analyzer/protocol/ssl/functions.bif
index 6ca1a6f9a7..38b2330798 100644
--- a/src/analyzer/protocol/ssl/functions.bif
+++ b/src/analyzer/protocol/ssl/functions.bif
@@ -14,5 +14,5 @@ function set_ssl_established%(c: connection%): any
 	analyzer::Analyzer* sa = c->FindAnalyzer("SSL");
 	if ( sa )
 		static_cast<analyzer::ssl::SSL_Analyzer*>(sa)->StartEncryption();
-	return 0;
+	return nullptr;
 	%}
diff --git a/src/analyzer/protocol/tcp/functions.bif b/src/analyzer/protocol/tcp/functions.bif
index dfe7131a49..a560301b8a 100644
--- a/src/analyzer/protocol/tcp/functions.bif
+++ b/src/analyzer/protocol/tcp/functions.bif
@@ -126,7 +126,7 @@ function get_contents_file%(cid: conn_id, direction: count%): file
 	if ( f )
 		{
 		Ref(f);
-		return new Val(f);
+		return make_intrusive<Val>(f);
 		}
 
 	// Return some sort of error value.
@@ -135,5 +135,5 @@ function get_contents_file%(cid: conn_id, direction: count%): file
 	else
 		builtin_error("no contents file for given direction");
 
-	return new Val(new BroFile(stderr, "-", "w"));
+	return make_intrusive<Val>(new BroFile(stderr, "-", "w"));
 	%}
diff --git a/src/broker/Data.cc b/src/broker/Data.cc
index a8ebc28cfa..ecea94861a 100644
--- a/src/broker/Data.cc
+++ b/src/broker/Data.cc
@@ -790,7 +790,7 @@ static bool data_type_check(const broker::data& d, BroType* t)
 IntrusivePtr<Val> bro_broker::data_to_val(broker::data d, BroType* type)
 	{
 	if ( type->Tag() == TYPE_ANY )
-		return {AdoptRef{}, bro_broker::make_data_val(move(d))};
+		return bro_broker::make_data_val(move(d));
 
 	return {AdoptRef{}, caf::visit(val_converter{type}, std::move(d))};
 	}
@@ -1018,9 +1018,9 @@ broker::expected<broker::data> bro_broker::val_to_data(const Val* v)
 	return broker::ec::invalid_data;
 	}
 
-RecordVal* bro_broker::make_data_val(Val* v)
+IntrusivePtr<RecordVal> bro_broker::make_data_val(Val* v)
 	{
-	auto rval = new RecordVal(BifType::Record::Broker::Data);
+	auto rval = make_intrusive<RecordVal>(BifType::Record::Broker::Data);
 	auto data = val_to_data(v);
 
 	if  ( data )
@@ -1031,84 +1031,84 @@ RecordVal* bro_broker::make_data_val(Val* v)
 	return rval;
 	}
 
-RecordVal* bro_broker::make_data_val(broker::data d)
+IntrusivePtr<RecordVal> bro_broker::make_data_val(broker::data d)
 	{
-	auto rval = new RecordVal(BifType::Record::Broker::Data);
+	auto rval = make_intrusive<RecordVal>(BifType::Record::Broker::Data);
 	rval->Assign(0, make_intrusive<DataVal>(move(d)));
 	return rval;
 	}
 
 struct data_type_getter {
-	using result_type = EnumVal*;
+	using result_type = IntrusivePtr<EnumVal>;
 
 	result_type operator()(broker::none)
 		{
-		return BifType::Enum::Broker::DataType->GetVal(BifEnum::Broker::NONE).release();
+		return BifType::Enum::Broker::DataType->GetVal(BifEnum::Broker::NONE);
 		}
 
 	result_type operator()(bool)
 		{
-		return BifType::Enum::Broker::DataType->GetVal(BifEnum::Broker::BOOL).release();
+		return BifType::Enum::Broker::DataType->GetVal(BifEnum::Broker::BOOL);
 		}
 
 	result_type operator()(uint64_t)
 		{
-		return BifType::Enum::Broker::DataType->GetVal(BifEnum::Broker::COUNT).release();
+		return BifType::Enum::Broker::DataType->GetVal(BifEnum::Broker::COUNT);
 		}
 
 	result_type operator()(int64_t)
 		{
-		return BifType::Enum::Broker::DataType->GetVal(BifEnum::Broker::INT).release();
+		return BifType::Enum::Broker::DataType->GetVal(BifEnum::Broker::INT);
 		}
 
 	result_type operator()(double)
 		{
-		return BifType::Enum::Broker::DataType->GetVal(BifEnum::Broker::DOUBLE).release();
+		return BifType::Enum::Broker::DataType->GetVal(BifEnum::Broker::DOUBLE);
 		}
 
 	result_type operator()(const std::string&)
 		{
-		return BifType::Enum::Broker::DataType->GetVal(BifEnum::Broker::STRING).release();
+		return BifType::Enum::Broker::DataType->GetVal(BifEnum::Broker::STRING);
 		}
 
 	result_type operator()(const broker::address&)
 		{
-		return BifType::Enum::Broker::DataType->GetVal(BifEnum::Broker::ADDR).release();
+		return BifType::Enum::Broker::DataType->GetVal(BifEnum::Broker::ADDR);
 		}
 
 	result_type operator()(const broker::subnet&)
 		{
-		return BifType::Enum::Broker::DataType->GetVal(BifEnum::Broker::SUBNET).release();
+		return BifType::Enum::Broker::DataType->GetVal(BifEnum::Broker::SUBNET);
 		}
 
 	result_type operator()(const broker::port&)
 		{
-		return BifType::Enum::Broker::DataType->GetVal(BifEnum::Broker::PORT).release();
+		return BifType::Enum::Broker::DataType->GetVal(BifEnum::Broker::PORT);
 		}
 
 	result_type operator()(const broker::timestamp&)
 		{
-		return BifType::Enum::Broker::DataType->GetVal(BifEnum::Broker::TIME).release();
+		return BifType::Enum::Broker::DataType->GetVal(BifEnum::Broker::TIME);
 		}
 
 	result_type operator()(const broker::timespan&)
 		{
-		return BifType::Enum::Broker::DataType->GetVal(BifEnum::Broker::INTERVAL).release();
+		return BifType::Enum::Broker::DataType->GetVal(BifEnum::Broker::INTERVAL);
 		}
 
 	result_type operator()(const broker::enum_value&)
 		{
-		return BifType::Enum::Broker::DataType->GetVal(BifEnum::Broker::ENUM).release();
+		return BifType::Enum::Broker::DataType->GetVal(BifEnum::Broker::ENUM);
 		}
 
 	result_type operator()(const broker::set&)
 		{
-		return BifType::Enum::Broker::DataType->GetVal(BifEnum::Broker::SET).release();
+		return BifType::Enum::Broker::DataType->GetVal(BifEnum::Broker::SET);
 		}
 
 	result_type operator()(const broker::table&)
 		{
-		return BifType::Enum::Broker::DataType->GetVal(BifEnum::Broker::TABLE).release();
+		return BifType::Enum::Broker::DataType->GetVal(BifEnum::Broker::TABLE);
 		}
 
 	result_type operator()(const broker::vector&)
@@ -1116,11 +1116,11 @@ struct data_type_getter {
 		// Note that Broker uses vectors to store record data, so there's
 		// no actual way to tell if this data was originally associated
 		// with a Bro record.
-		return BifType::Enum::Broker::DataType->GetVal(BifEnum::Broker::VECTOR).release();
+		return BifType::Enum::Broker::DataType->GetVal(BifEnum::Broker::VECTOR);
 		}
 };
 
-EnumVal* bro_broker::get_data_type(RecordVal* v, Frame* frame)
+IntrusivePtr<EnumVal> bro_broker::get_data_type(RecordVal* v, Frame* frame)
 	{
 	return caf::visit(data_type_getter{}, opaque_field_to_data(v, frame));
 	}
diff --git a/src/broker/Data.h b/src/broker/Data.h
index d15613c852..cf5f06b90d 100644
--- a/src/broker/Data.h
+++ b/src/broker/Data.h
@@ -29,14 +29,14 @@ TransportProto to_bro_port_proto(broker::port::protocol tp);
  * @return a Broker::Data value, where the optional field is set if the conversion
  * was possible, else it is unset.
  */
-RecordVal* make_data_val(Val* v);
+IntrusivePtr<RecordVal> make_data_val(Val* v);
 
 /**
  * Create a Broker::Data value from a Broker data value.
  * @param d the Broker value to wrap in an opaque type.
  * @return a Broker::Data value that wraps the Broker value.
  */
-RecordVal* make_data_val(broker::data d);
+IntrusivePtr<RecordVal> make_data_val(broker::data d);
 
 /**
  * Get the type of Broker data that Broker::Data wraps.
@@ -44,7 +44,7 @@ RecordVal* make_data_val(broker::data d);
  * @param frame used to get location info upon error.
  * @return a Broker::DataType value.
  */
-EnumVal* get_data_type(RecordVal* v, Frame* frame);
+IntrusivePtr<EnumVal> get_data_type(RecordVal* v, Frame* frame);
 
 /**
  * Convert a Bro value to a Broker data value.
diff --git a/src/broker/Manager.cc b/src/broker/Manager.cc
index c9dcdc9457..3e44fef00d 100644
--- a/src/broker/Manager.cc
+++ b/src/broker/Manager.cc
@@ -745,26 +745,22 @@ RecordVal* Manager::MakeEvent(val_list* args, Frame* frame)
 			return rval;
 			}
 
-		RecordVal* data_val;
+		IntrusivePtr<RecordVal> data_val;
 
 		if ( same_type(got_type, bro_broker::DataVal::ScriptDataType()) )
-			{
-			data_val = (*args)[i]->AsRecordVal();
-			Ref(data_val);
-			}
+			data_val = {NewRef{}, (*args)[i]->AsRecordVal()};
 		else
 			data_val = make_data_val((*args)[i]);
 
 		if ( ! data_val->Lookup(0) )
 			{
-			Unref(data_val);
 			rval->Assign(0, nullptr);
 			Error("failed to convert param #%d of type %s to broker data",
 				  i, type_name(got_type->Tag()));
 			return rval;
 			}
 
-		arg_vec->Assign(i - 1, data_val);
+		arg_vec->Assign(i - 1, std::move(data_val));
 		}
 
 	return rval;
diff --git a/src/broker/Store.h b/src/broker/Store.h
index b8a4301c09..09799c8c68 100644
--- a/src/broker/Store.h
+++ b/src/broker/Store.h
@@ -24,9 +24,9 @@ EnumVal* query_status(bool success);
  * @return a Broker::QueryResult value that has a Broker::QueryStatus indicating
  * a failure.
  */
-inline RecordVal* query_result()
+inline IntrusivePtr<RecordVal> query_result()
 	{
-	auto rval = new RecordVal(BifType::Record::Broker::QueryResult);
+	auto rval = make_intrusive<RecordVal>(BifType::Record::Broker::QueryResult);
 	rval->Assign(0, query_status(false));
 	rval->Assign(1, make_intrusive<RecordVal>(BifType::Record::Broker::Data));
 	return rval;
@@ -37,11 +37,11 @@ inline RecordVal* query_result()
  * @return a Broker::QueryResult value that has a Broker::QueryStatus indicating
  * a success.
  */
-inline RecordVal* query_result(RecordVal* data)
+inline IntrusivePtr<RecordVal> query_result(IntrusivePtr<RecordVal> data)
 	{
-	auto rval = new RecordVal(BifType::Record::Broker::QueryResult);
+	auto rval = make_intrusive<RecordVal>(BifType::Record::Broker::QueryResult);
 	rval->Assign(0, query_status(true));
-	rval->Assign(1, data);
+	rval->Assign(1, std::move(data));
 	return rval;
 	}
 
@@ -62,19 +62,17 @@ public:
 		Unref(trigger);
 		}
 
-	void Result(RecordVal* result)
+	void Result(const IntrusivePtr<RecordVal>& result)
 		{
-		trigger->Cache(call, result);
+		trigger->Cache(call, result.get());
 		trigger->Release();
-		Unref(result);
 		}
 
 	void Abort()
 		{
 		auto result = query_result();
-		trigger->Cache(call, result);
+		trigger->Cache(call, result.get());
 		trigger->Release();
-		Unref(result);
 		}
 
 	bool Disabled() const
diff --git a/src/broker/comm.bif b/src/broker/comm.bif
index 22bff1641a..36dcd6e517 100644
--- a/src/broker/comm.bif
+++ b/src/broker/comm.bif
@@ -135,5 +135,5 @@ function Broker::__peers%(%): PeerInfos
 function Broker::__node_id%(%): string
 	%{
 	bro_broker::Manager::ScriptScopeGuard ssg;
-	return new StringVal(broker_mgr->NodeID());
+	return make_intrusive<StringVal>(broker_mgr->NodeID());
 	%}
diff --git a/src/broker/data.bif b/src/broker/data.bif
index ca4e50c40a..d1a9f454fa 100644
--- a/src/broker/data.bif
+++ b/src/broker/data.bif
@@ -52,7 +52,7 @@ function Broker::__opaque_clone_through_serialization%(d: any%): any
         	return val_mgr->False();
 		}
 	
-	return OpaqueVal::Unserialize(std::move(*x)).release();
+	return OpaqueVal::Unserialize(std::move(*x));
 	%}
 
 function Broker::__set_create%(%): Broker::Data
@@ -123,7 +123,7 @@ function Broker::__set_remove%(s: Broker::Data, key: any%): bool
 
 function Broker::__set_iterator%(s: Broker::Data%): opaque of Broker::SetIterator
 	%{
-	return new bro_broker::SetIterator(s->AsRecordVal(), TYPE_TABLE, frame);
+	return make_intrusive<bro_broker::SetIterator>(s->AsRecordVal(), TYPE_TABLE, frame);
 	%}
 
 function Broker::__set_iterator_last%(it: opaque of Broker::SetIterator%): bool
@@ -204,7 +204,7 @@ function Broker::__table_insert%(t: Broker::Data, key: any, val: any%): Broker::
 	if ( ! k )
 		{
 		builtin_error("invalid Broker data conversion for key argument");
-		return new RecordVal(BifType::Record::Broker::Data);
+		return make_intrusive<RecordVal>(BifType::Record::Broker::Data);
 		}
 
 	auto v = bro_broker::val_to_data(val);
@@ -212,7 +212,7 @@ function Broker::__table_insert%(t: Broker::Data, key: any, val: any%): Broker::
 	if ( ! v )
 		{
 		builtin_error("invalid Broker data conversion for value argument");
-		return new RecordVal(BifType::Record::Broker::Data);
+		return make_intrusive<RecordVal>(BifType::Record::Broker::Data);
 		}
 
 	try
@@ -225,7 +225,7 @@ function Broker::__table_insert%(t: Broker::Data, key: any, val: any%): Broker::
 	catch (const std::out_of_range&)
 		{
 		table[std::move(*k)] = std::move(*v);
-		return new RecordVal(BifType::Record::Broker::Data);
+		return make_intrusive<RecordVal>(BifType::Record::Broker::Data);
 		}
 	%}
 
@@ -239,13 +239,13 @@ function Broker::__table_remove%(t: Broker::Data, key: any%): Broker::Data
 	if ( ! k )
 		{
 		builtin_error("invalid Broker data conversion for key argument");
-		return new RecordVal(BifType::Record::Broker::Data);
+		return make_intrusive<RecordVal>(BifType::Record::Broker::Data);
 		}
 
 	auto it = table.find(*k);
 
 	if ( it == table.end() )
-		return new RecordVal(BifType::Record::Broker::Data);
+		return make_intrusive<RecordVal>(BifType::Record::Broker::Data);
 	else
 		{
 		auto rval = bro_broker::make_data_val(move(it->second));
@@ -264,20 +264,20 @@ function Broker::__table_lookup%(t: Broker::Data, key: any%): Broker::Data
 	if ( ! k )
 		{
 		builtin_error("invalid Broker data conversion for key argument");
-		return new RecordVal(BifType::Record::Broker::Data);
+		return make_intrusive<RecordVal>(BifType::Record::Broker::Data);
 		}
 
 	auto it = table.find(*k);
 
 	if ( it == table.end() )
-		return new RecordVal(BifType::Record::Broker::Data);
+		return make_intrusive<RecordVal>(BifType::Record::Broker::Data);
 	else
 		return bro_broker::make_data_val(it->second);
 	%}
 
 function Broker::__table_iterator%(t: Broker::Data%): opaque of Broker::TableIterator
 	%{
-	return new bro_broker::TableIterator(t->AsRecordVal(), TYPE_TABLE, frame);
+	return make_intrusive<bro_broker::TableIterator>(t->AsRecordVal(), TYPE_TABLE, frame);
 	%}
 
 function Broker::__table_iterator_last%(it: opaque of Broker::TableIterator%): bool
@@ -367,7 +367,7 @@ function Broker::__vector_replace%(v: Broker::Data, idx: count, d: any%): Broker
 		}
 
 	if ( idx >= vec.size() )
-		return new RecordVal(BifType::Record::Broker::Data);
+		return make_intrusive<RecordVal>(BifType::Record::Broker::Data);
 
 	auto rval = bro_broker::make_data_val(move(vec[idx]));
 	vec[idx] = std::move(*item);
@@ -380,7 +380,7 @@ function Broker::__vector_remove%(v: Broker::Data, idx: count%): Broker::Data
 	                                                          TYPE_VECTOR, frame);
 
 	if ( idx >= vec.size() )
-		return new RecordVal(BifType::Record::Broker::Data);
+		return make_intrusive<RecordVal>(BifType::Record::Broker::Data);
 
 	auto rval = bro_broker::make_data_val(move(vec[idx]));
 	vec.erase(vec.begin() + idx);
@@ -393,14 +393,14 @@ function Broker::__vector_lookup%(v: Broker::Data, idx: count%): Broker::Data
 	                                                          TYPE_VECTOR, frame);
 
 	if ( idx >= vec.size() )
-		return new RecordVal(BifType::Record::Broker::Data);
+		return make_intrusive<RecordVal>(BifType::Record::Broker::Data);
 
 	return bro_broker::make_data_val(vec[idx]);
 	%}
 
 function Broker::__vector_iterator%(v: Broker::Data%): opaque of Broker::VectorIterator
 	%{
-	return new bro_broker::VectorIterator(v->AsRecordVal(), TYPE_VECTOR, frame);
+	return make_intrusive<bro_broker::VectorIterator>(v->AsRecordVal(), TYPE_VECTOR, frame);
 	%}
 
 function Broker::__vector_iterator_last%(it: opaque of Broker::VectorIterator%): bool
@@ -472,14 +472,14 @@ function Broker::__record_lookup%(r: Broker::Data, idx: count%): Broker::Data
 	                                                        TYPE_RECORD, frame);
 
 	if ( idx >= v.size() || caf::get_if<broker::none>(&v[idx]) )
-		return new RecordVal(BifType::Record::Broker::Data);
+		return make_intrusive<RecordVal>(BifType::Record::Broker::Data);
 
 	return bro_broker::make_data_val(v[idx]);
 	%}
 
 function Broker::__record_iterator%(r: Broker::Data%): opaque of Broker::RecordIterator
 	%{
-	return new bro_broker::RecordIterator(r->AsRecordVal(), TYPE_RECORD, frame);
+	return make_intrusive<bro_broker::RecordIterator>(r->AsRecordVal(), TYPE_RECORD, frame);
 	%}
 
 function Broker::__record_iterator_last%(it: opaque of Broker::RecordIterator%): bool
diff --git a/src/broker/store.bif b/src/broker/store.bif
index 70e35fdae3..9b0ecdd7fa 100644
--- a/src/broker/store.bif
+++ b/src/broker/store.bif
@@ -124,7 +124,7 @@ function Broker::__store_name%(h: opaque of Broker::Store%): string
 		}
 
 	auto handle = static_cast<bro_broker::StoreHandleVal*>(h);
-	return new StringVal(handle->store.name());
+	return make_intrusive<StringVal>(handle->store.name());
 	%}
 
 function Broker::__exists%(h: opaque of Broker::Store,
@@ -169,7 +169,7 @@ function Broker::__exists%(h: opaque of Broker::Store,
 	auto req_id = handle->proxy.exists(std::move(*key));
 	broker_mgr->TrackStoreQuery(handle, req_id, cb);
 
-	return 0;
+	return nullptr;
 	%}
 
 function Broker::__get%(h: opaque of Broker::Store,
@@ -214,7 +214,7 @@ function Broker::__get%(h: opaque of Broker::Store,
 	auto req_id = handle->proxy.get(std::move(*key));
 	broker_mgr->TrackStoreQuery(handle, req_id, cb);
 
-	return 0;
+	return nullptr;
 	%}
 
 function Broker::__put_unique%(h: opaque of Broker::Store,
@@ -268,7 +268,7 @@ function Broker::__put_unique%(h: opaque of Broker::Store,
 	                                       prepare_expiry(e));
 	broker_mgr->TrackStoreQuery(handle, req_id, cb);
 
-	return 0;
+	return nullptr;
 	%}
 
 function Broker::__get_index_from_value%(h: opaque of Broker::Store,
@@ -322,7 +322,7 @@ function Broker::__get_index_from_value%(h: opaque of Broker::Store,
 	                                                 std::move(*index));
 	broker_mgr->TrackStoreQuery(handle, req_id, cb);
 
-	return 0;
+	return nullptr;
 	%}
 
 function Broker::__keys%(h: opaque of Broker::Store%): Broker::QueryResult
@@ -359,7 +359,7 @@ function Broker::__keys%(h: opaque of Broker::Store%): Broker::QueryResult
 	auto req_id = handle->proxy.keys();
 	broker_mgr->TrackStoreQuery(handle, req_id, cb);
 
-	return 0;
+	return nullptr;
 	%}
 
 function Broker::__put%(h: opaque of Broker::Store,
diff --git a/src/file_analysis/Manager.cc b/src/file_analysis/Manager.cc
index a4866f6b5d..14232d0668 100644
--- a/src/file_analysis/Manager.cc
+++ b/src/file_analysis/Manager.cc
@@ -511,14 +511,14 @@ string Manager::DetectMIME(const u_char* data, uint64_t len) const
 	return *(matches.begin()->second.begin());
 	}
 
-VectorVal* file_analysis::GenMIMEMatchesVal(const RuleMatcher::MIME_Matches& m)
+IntrusivePtr<VectorVal> file_analysis::GenMIMEMatchesVal(const RuleMatcher::MIME_Matches& m)
 	{
-	VectorVal* rval = new VectorVal(mime_matches);
+	auto rval = make_intrusive<VectorVal>(mime_matches);
 
 	for ( RuleMatcher::MIME_Matches::const_iterator it = m.begin();
 	      it != m.end(); ++it )
 		{
-		RecordVal* element = new RecordVal(mime_match);
+		auto element = make_intrusive<RecordVal>(mime_match);
 
 		for ( set<string>::const_iterator it2 = it->second.begin();
 		      it2 != it->second.end(); ++it2 )
@@ -527,7 +527,7 @@ VectorVal* file_analysis::GenMIMEMatchesVal(const RuleMatcher::MIME_Matches& m)
 			element->Assign(1, make_intrusive<StringVal>(*it2));
 			}
 
-		rval->Assign(rval->Size(), element);
+		rval->Assign(rval->Size(), std::move(element));
 		}
 
 	return rval;
diff --git a/src/file_analysis/Manager.h b/src/file_analysis/Manager.h
index f01d99d88c..65e7548abc 100644
--- a/src/file_analysis/Manager.h
+++ b/src/file_analysis/Manager.h
@@ -423,7 +423,7 @@ private:
  * Returns a script-layer value corresponding to the \c mime_matches type.
  * @param m The MIME match information with which to populate the value.
  */
-VectorVal* GenMIMEMatchesVal(const RuleMatcher::MIME_Matches& m);
+IntrusivePtr<VectorVal> GenMIMEMatchesVal(const RuleMatcher::MIME_Matches& m);
 
 } // namespace file_analysis
 
diff --git a/src/file_analysis/analyzer/x509/X509.cc b/src/file_analysis/analyzer/x509/X509.cc
index 2ed0407e2b..535dbc27d1 100644
--- a/src/file_analysis/analyzer/x509/X509.cc
+++ b/src/file_analysis/analyzer/x509/X509.cc
@@ -79,14 +79,14 @@ bool file_analysis::X509::EndOfFile()
 	X509Val* cert_val = new X509Val(ssl_cert); // cert_val takes ownership of ssl_cert
 
 	// parse basic information into record.
-	RecordVal* cert_record = ParseCertificate(cert_val, GetFile());
+	auto cert_record = ParseCertificate(cert_val, GetFile());
 
 	// and send the record on to scriptland
 	if ( x509_certificate )
 		mgr.Enqueue(x509_certificate,
 		            IntrusivePtr{NewRef{}, GetFile()->GetVal()},
 		            IntrusivePtr{NewRef{}, cert_val},
-		            IntrusivePtr{NewRef{}, cert_record});
+		            cert_record);
 
 	// after parsing the certificate - parse the extensions...
 
@@ -105,20 +105,19 @@ bool file_analysis::X509::EndOfFile()
 	//
 	// The certificate will be freed when the last X509Val is Unref'd.
 
-	Unref(cert_record); // Unref the RecordVal that we kept around from ParseCertificate
 	Unref(cert_val); // Same for cert_val
 
 	return false;
 	}
 
-RecordVal* file_analysis::X509::ParseCertificate(X509Val* cert_val, File* f)
+IntrusivePtr<RecordVal> file_analysis::X509::ParseCertificate(X509Val* cert_val, File* f)
 	{
 	::X509* ssl_cert = cert_val->GetCertificate();
 
 	char buf[2048]; // we need a buffer for some of the openssl functions
 	memset(buf, 0, sizeof(buf));
 
-	RecordVal* pX509Cert = new RecordVal(BifType::Record::X509::Certificate);
+	auto pX509Cert = make_intrusive<RecordVal>(BifType::Record::X509::Certificate);
 	BIO *bio = BIO_new(BIO_s_mem());
 
 	pX509Cert->Assign(0, val_mgr->Count((uint64_t) X509_get_version(ssl_cert) + 1));
diff --git a/src/file_analysis/analyzer/x509/X509.h b/src/file_analysis/analyzer/x509/X509.h
index fd9934bd80..c299d55270 100644
--- a/src/file_analysis/analyzer/x509/X509.h
+++ b/src/file_analysis/analyzer/x509/X509.h
@@ -86,7 +86,7 @@ public:
 	 * @param Returns the new record value and passes ownership to
 	 * caller.
 	 */
-	static RecordVal* ParseCertificate(X509Val* cert_val, File* file = nullptr);
+	static IntrusivePtr<RecordVal> ParseCertificate(X509Val* cert_val, File* file = nullptr);
 
 	static file_analysis::Analyzer* Instantiate(RecordVal* args, File* file)
 		{ return new X509(args, file); }
diff --git a/src/file_analysis/analyzer/x509/functions.bif b/src/file_analysis/analyzer/x509/functions.bif
index 20e610316d..f45bd422ea 100644
--- a/src/file_analysis/analyzer/x509/functions.bif
+++ b/src/file_analysis/analyzer/x509/functions.bif
@@ -11,9 +11,9 @@
 #include <openssl/err.h>
 
 // construct an error record
-RecordVal* x509_result_record(uint64_t num, const char* reason, Val* chainVector = nullptr)
+IntrusivePtr<RecordVal> x509_result_record(uint64_t num, const char* reason, Val* chainVector = nullptr)
 	{
-	RecordVal* rrecord = new RecordVal(BifType::Record::X509::Result);
+	auto rrecord = make_intrusive<RecordVal>(BifType::Record::X509::Result);
 
 	rrecord->Assign(0, val_mgr->Int(num));
 	rrecord->Assign(1, make_intrusive<StringVal>(reason));
@@ -161,7 +161,7 @@ function x509_parse%(cert: opaque of x509%): X509::Certificate
 function x509_from_der%(der: string%): opaque of x509
     %{
     const u_char* data = der->Bytes();
-    return new file_analysis::X509Val(d2i_X509(nullptr, &data, der->Len()));
+    return make_intrusive<file_analysis::X509Val>(d2i_X509(nullptr, &data, der->Len()));
     %}
 
 ## Returns the string form of a certificate.
@@ -194,7 +194,7 @@ function x509_get_certificate_string%(cert: opaque of x509, pem: bool &default=F
 	if ( ! ext_val )
 		ext_val = val_mgr->EmptyString();
 
-	return ext_val.release();
+	return ext_val;
 	%}
 
 ## Verifies an OCSP reply.
@@ -215,7 +215,7 @@ function x509_get_certificate_string%(cert: opaque of x509, pem: bool &default=F
 ##              x509_get_certificate_string x509_verify
 function x509_ocsp_verify%(certs: x509_opaque_vector, ocsp_reply: string, root_certs: table_string_of_string, verify_time: time &default=network_time()%): X509::Result
 	%{
-	RecordVal* rval = 0;
+	IntrusivePtr<RecordVal> rval;
 	X509_STORE* ctx = ::file_analysis::X509::GetRootStore(root_certs->AsTableVal());
 	if ( ! ctx )
 		return x509_result_record(-1, "Problem initializing root store");
@@ -578,7 +578,7 @@ function x509_verify%(certs: x509_opaque_vector, root_certs: table_string_of_str
 
 x509_verify_chainerror:
 
-	RecordVal* rrecord = x509_result_record(X509_STORE_CTX_get_error(csc), X509_verify_cert_error_string(X509_STORE_CTX_get_error(csc)), chainVector);
+	auto rrecord = x509_result_record(X509_STORE_CTX_get_error(csc), X509_verify_cert_error_string(X509_STORE_CTX_get_error(csc)), chainVector);
 
 	X509_STORE_CTX_cleanup(csc);
 	X509_STORE_CTX_free(csc);
@@ -761,7 +761,7 @@ sct_verify_err:
  * 1 -> issuer name
  * 2 -> pubkey
  */
-StringVal* x509_entity_hash(file_analysis::X509Val *cert_handle, unsigned int hash_alg, unsigned int type)
+IntrusivePtr<StringVal> x509_entity_hash(file_analysis::X509Val *cert_handle, unsigned int hash_alg, unsigned int type)
 	{
 	assert(cert_handle);
 
@@ -824,7 +824,7 @@ StringVal* x509_entity_hash(file_analysis::X509Val *cert_handle, unsigned int ha
 
 	assert( len <= sizeof(md) );
 
-	return new StringVal(len, reinterpret_cast<const char*>(md));
+	return make_intrusive<StringVal>(len, reinterpret_cast<const char*>(md));
 	}
 %%}
 
diff --git a/src/file_analysis/file_analysis.bif b/src/file_analysis/file_analysis.bif
index c9bbdc47f4..876b033fbc 100644
--- a/src/file_analysis/file_analysis.bif
+++ b/src/file_analysis/file_analysis.bif
@@ -68,7 +68,7 @@ function Files::__stop%(file_id: string%): bool
 ## :zeek:see:`Files::analyzer_name`.
 function Files::__analyzer_name%(tag: Files::Tag%) : string
 	%{
-	return new StringVal(file_mgr->GetComponentName(tag));
+	return make_intrusive<StringVal>(file_mgr->GetComponentName(tag));
 	%}
 
 ## :zeek:see:`Files::file_exists`.
@@ -86,11 +86,11 @@ function Files::__lookup_file%(fuid: string%): fa_file
 	auto f = file_mgr->LookupFile(fuid->CheckString());
 	if ( f != nullptr )
 		{
-		return f->GetVal()->Ref();
+		return IntrusivePtr{NewRef{}, f->GetVal()};
 		}
 	
 	reporter->Error("file ID %s not a known file", fuid->CheckString());
-	return 0;
+	return nullptr;
 	%}
 
 module GLOBAL;
@@ -108,7 +108,7 @@ function set_file_handle%(handle: string%): any
 	auto bytes = reinterpret_cast<const char*>(handle->Bytes());
 	auto h = std::string(bytes, handle->Len());
 	file_mgr->SetHandle(h);
-	return 0;
+	return nullptr;
 	%}
 
 const Files::salt: string;
diff --git a/src/iosource/pcap/pcap.bif b/src/iosource/pcap/pcap.bif
index 790e09dd9d..fd4dbd60fe 100644
--- a/src/iosource/pcap/pcap.bif
+++ b/src/iosource/pcap/pcap.bif
@@ -96,8 +96,8 @@ function error%(%): string
 		{
 		const char* err = ps->ErrorMsg();
 		if ( *err )
-			return new StringVal(err);
+			return make_intrusive<StringVal>(err);
 		}
 
-	return new StringVal("no error");
+	return make_intrusive<StringVal>("no error");
 	%}
diff --git a/src/probabilistic/bloom-filter.bif b/src/probabilistic/bloom-filter.bif
index 38a6c74fc5..c35861fd24 100644
--- a/src/probabilistic/bloom-filter.bif
+++ b/src/probabilistic/bloom-filter.bif
@@ -37,7 +37,7 @@ function bloomfilter_basic_init%(fp: double, capacity: count,
 	if ( fp < 0.0 || fp > 1.0 )
 		{
 		reporter->Error("false-positive rate must take value between 0 and 1");
-		return 0;
+		return nullptr;
 		}
 
 	size_t cells = BasicBloomFilter::M(fp, capacity);
@@ -46,7 +46,7 @@ function bloomfilter_basic_init%(fp: double, capacity: count,
                                  name->Len());
 	const Hasher* h = new DoubleHasher(optimal_k, seed);
 
-	return new BloomFilterVal(new BasicBloomFilter(h, cells));
+	return make_intrusive<BloomFilterVal>(new BasicBloomFilter(h, cells));
 	%}
 
 ## Creates a basic Bloom filter. This function serves as a low-level
@@ -74,19 +74,19 @@ function bloomfilter_basic_init2%(k: count, cells: count,
 	if ( k == 0 )
 		{
 		reporter->Error("number of hash functions must be non-negative");
-		return 0;
+		return nullptr;
 		}
 	if ( cells == 0 )
 		{
 		reporter->Error("number of cells must be non-negative");
-		return 0;
+		return nullptr;
 		}
 
 	Hasher::seed_t seed = Hasher::MakeSeed(name->Len() > 0 ? name->Bytes() : 0,
 				       name->Len());
 	const Hasher* h = new DoubleHasher(k, seed);
 
-	return new BloomFilterVal(new BasicBloomFilter(h, cells));
+	return make_intrusive<BloomFilterVal>(new BasicBloomFilter(h, cells));
 	%}
 
 ## Creates a counting Bloom filter.
@@ -118,7 +118,7 @@ function bloomfilter_counting_init%(k: count, cells: count, max: count,
 	if ( max == 0 )
 		{
 		reporter->Error("max counter value must be greater than 0");
-		return 0;
+		return nullptr;
 		}
 
 	Hasher::seed_t seed = Hasher::MakeSeed(name->Len() > 0 ? name->Bytes() : 0,
@@ -130,7 +130,7 @@ function bloomfilter_counting_init%(k: count, cells: count, max: count,
 	while ( max >>= 1 )
 		++width;
 
-	return new BloomFilterVal(new CountingBloomFilter(h, cells, width));
+	return make_intrusive<BloomFilterVal>(new CountingBloomFilter(h, cells, width));
 	%}
 
 ## Adds an element to a Bloom filter.
@@ -155,7 +155,7 @@ function bloomfilter_add%(bf: opaque of bloomfilter, x: any%): any
 	else
 		bfv->Add(x);
 
-	return 0;
+	return nullptr;
 	%}
 
 ## Retrieves the counter for a given element in a Bloom filter.
@@ -201,7 +201,7 @@ function bloomfilter_clear%(bf: opaque of bloomfilter%): any
 	if ( bfv->Type() ) // Untyped Bloom filters are already empty.
 		bfv->Clear();
 
-	return 0;
+	return nullptr;
 	%}
 
 ## Merges two Bloom filters.
@@ -230,10 +230,10 @@ function bloomfilter_merge%(bf1: opaque of bloomfilter,
 	     ! same_type(bfv1->Type(), bfv2->Type()) )
 		{
 		reporter->Error("incompatible Bloom filter types");
-		return 0;
+		return nullptr;
 		}
 
-	return BloomFilterVal::Merge(bfv1, bfv2).release();
+	return BloomFilterVal::Merge(bfv1, bfv2);
 	%}
 
 ## Returns a string with a representation of a Bloom filter's internal
@@ -245,5 +245,5 @@ function bloomfilter_merge%(bf1: opaque of bloomfilter,
 function bloomfilter_internal_state%(bf: opaque of bloomfilter%): string
 	%{
 	BloomFilterVal* bfv = static_cast<BloomFilterVal*>(bf);
-	return new StringVal(bfv->InternalState());
+	return make_intrusive<StringVal>(bfv->InternalState());
 	%}
diff --git a/src/probabilistic/cardinality-counter.bif b/src/probabilistic/cardinality-counter.bif
index 3946b96c8c..25950d2dae 100644
--- a/src/probabilistic/cardinality-counter.bif
+++ b/src/probabilistic/cardinality-counter.bif
@@ -113,7 +113,7 @@ function hll_cardinality_estimate%(handle: opaque of cardinality%): double
 
 	double estimate = h->Size();
 
-	return new Val(estimate, TYPE_DOUBLE);
+	return make_intrusive<Val>(estimate, TYPE_DOUBLE);
 	%}
 
 ## Copy a HLL cardinality counter.
diff --git a/src/probabilistic/top-k.bif b/src/probabilistic/top-k.bif
index 2fabb56ce0..aa3f1b9c29 100644
--- a/src/probabilistic/top-k.bif
+++ b/src/probabilistic/top-k.bif
@@ -36,7 +36,7 @@ function topk_add%(handle: opaque of topk, value: any%): any
 	probabilistic::TopkVal* h = (probabilistic::TopkVal*) handle;
 	h->Encountered(value);
 
-	return 0;
+	return nullptr;
 	%}
 
 ## Get the first *k* elements of the top-k data structure.
@@ -53,7 +53,7 @@ function topk_get_top%(handle: opaque of topk, k: count%): any_vec
 	%{
 	assert(handle);
 	probabilistic::TopkVal* h = (probabilistic::TopkVal*) handle;
-	return h->GetTopK(k);
+	return IntrusivePtr{AdoptRef{}, h->GetTopK(k)};
 	%}
 
 ## Get an overestimated count of how often a value has been encountered.
@@ -157,7 +157,7 @@ function topk_merge%(handle1: opaque of topk, handle2: opaque of topk%): any
 
 	h1->Merge(h2);
 
-	return 0;
+	return nullptr;
 	%}
 
 ## Merge the second top-k data structure into the first and prunes the final
@@ -183,5 +183,5 @@ function topk_merge_prune%(handle1: opaque of topk, handle2: opaque of topk%): a
 
 	h1->Merge(h2, true);
 
-	return 0;
+	return nullptr;
 	%}
diff --git a/src/reporter.bif b/src/reporter.bif
index ea43592246..87ac5f9338 100644
--- a/src/reporter.bif
+++ b/src/reporter.bif
@@ -153,7 +153,7 @@ function Reporter::file_weird%(name: string, f: fa_file, addl: string &default="
 ## Returns: Current weird sampling whitelist
 function Reporter::get_weird_sampling_whitelist%(%): string_set
 	%{
-	TableVal* set = new TableVal({NewRef{}, string_set});
+	auto set = make_intrusive<TableVal>(IntrusivePtr{NewRef{}, string_set});
 	for ( auto el : reporter->GetWeirdSamplingWhitelist() )
 		{
 		auto idx = make_intrusive<StringVal>(el);
@@ -232,7 +232,7 @@ function Reporter::set_weird_sampling_rate%(weird_sampling_rate: count%) : bool
 ## Returns: weird sampling duration.
 function Reporter::get_weird_sampling_duration%(%) : interval
 	%{
-	return new Val(reporter->GetWeirdSamplingDuration(), TYPE_INTERVAL);
+	return make_intrusive<Val>(reporter->GetWeirdSamplingDuration(), TYPE_INTERVAL);
 	%}
 
 ## Sets the current weird sampling duration. Please note that
diff --git a/src/strings.bif b/src/strings.bif
index 3b51439210..2c8255f4b7 100644
--- a/src/strings.bif
+++ b/src/strings.bif
@@ -75,7 +75,7 @@ function string_cat%(...%): string
 		}
 	*b = 0;
 
-	return new StringVal(s);
+	return make_intrusive<StringVal>(s);
 	%}
 
 ## Joins all values in the given vector of strings with a separator placed
@@ -114,7 +114,7 @@ function join_string_vec%(vec: string_vec, sep: string%): string
 	BroString* s = new BroString(1, d.TakeBytes(), d.Len());
 	s->SetUseFreeToDelete(true);
 
-	return new StringVal(s);
+	return make_intrusive<StringVal>(s);
 	%}
 
 ## Returns an edited version of a string that applies a special
@@ -162,7 +162,7 @@ function edit%(arg_s: string, arg_edit_char: string%): string
 
 	new_s[ind] = '\0';
 
-	return new StringVal(new BroString(1, byte_vec(new_s), ind));
+	return make_intrusive<StringVal>(new BroString(1, byte_vec(new_s), ind));
 	%}
 
 ## Get a substring from a string, given a starting position and length.
@@ -185,7 +185,7 @@ function sub_bytes%(s: string, start: count, n: int%): string
 	if ( ! ss )
 		ss = new BroString("");
 
-	return new StringVal(ss);
+	return make_intrusive<StringVal>(ss);
 	%}
 
 %%{
@@ -199,11 +199,12 @@ static int match_prefix(int s_len, const char* s, int t_len, const char* t)
 	return 1;
 	}
 
-VectorVal* do_split_string(StringVal* str_val, RE_Matcher* re, int incl_sep,
-                           int max_num_sep)
+static IntrusivePtr<VectorVal> do_split_string(StringVal* str_val,
+                                               RE_Matcher* re, int incl_sep,
+                                               int max_num_sep)
 	{
 	// string_vec is used early in the version script - do not use the NetVar.
-	VectorVal* rval = new VectorVal(internal_type("string_vec")->AsVectorType());
+	auto rval = make_intrusive<VectorVal>(internal_type("string_vec")->AsVectorType());
 	const u_char* s = str_val->Bytes();
 	int n = str_val->Len();
 	const u_char* end_of_s = s + n;
@@ -476,7 +477,7 @@ function subst_string%(s: string, from: string, to: string%): string
 	%{
 	const int little_len = from->Len();
 	if ( little_len == 0 )
-		return s->Ref();
+		return IntrusivePtr{NewRef{}, s};
 
 	int big_len = s->Len();
 	const u_char* big = s->Bytes();
@@ -511,7 +512,7 @@ function subst_string%(s: string, from: string, to: string%): string
 		vs.push_back(dc);
 		}
 
-	return new StringVal(concatenate(vs));
+	return make_intrusive<StringVal>(concatenate(vs));
 	%}
 
 ## Replaces all uppercase letters in a string with their lowercase counterpart.
@@ -540,7 +541,7 @@ function to_lower%(str: string%): string
 
     *ls++ = '\0';
 
-	return new StringVal(new BroString(1, lower_s, n));
+	return make_intrusive<StringVal>(new BroString(1, lower_s, n));
 	%}
 
 ## Replaces all lowercase letters in a string with their uppercase counterpart.
@@ -569,7 +570,7 @@ function to_upper%(str: string%): string
 
     *us++ = '\0';
 
-	return new StringVal(new BroString(1, upper_s, n));
+	return make_intrusive<StringVal>(new BroString(1, upper_s, n));
 	%}
 
 ## Replaces non-printable characters in a string with escaped sequences. The
@@ -589,7 +590,7 @@ function to_upper%(str: string%): string
 function clean%(str: string%): string
 	%{
 	char* s = str->AsString()->Render();
-	return new StringVal(new BroString(1, byte_vec(s), strlen(s)));
+	return make_intrusive<StringVal>(new BroString(1, byte_vec(s), strlen(s)));
 	%}
 
 ## Replaces non-printable characters in a string with escaped sequences. The
@@ -607,7 +608,7 @@ function clean%(str: string%): string
 function to_string_literal%(str: string%): string
 	%{
 	char* s = str->AsString()->Render(BroString::BRO_STRING_LITERAL);
-	return new StringVal(new BroString(1, byte_vec(s), strlen(s)));
+	return make_intrusive<StringVal>(new BroString(1, byte_vec(s), strlen(s)));
 	%}
 
 ## Determines whether a given string contains only ASCII characters.
@@ -665,7 +666,7 @@ function string_to_ascii_hex%(s: string%): string
 	for ( int i = 0; i < s->Len(); ++i )
 		sprintf(x + i * 2, "%02x", sp[i]);
 
-	return new StringVal(new BroString(1, (u_char*) x, s->Len() * 2));
+	return make_intrusive<StringVal>(new BroString(1, (u_char*) x, s->Len() * 2));
 	%}
 
 ## Uses the Smith-Waterman algorithm to find similar/overlapping substrings.
@@ -744,7 +745,7 @@ function strip%(str: string%): string
 
 	if ( n == 0 )
 		// Empty string.
-		return new StringVal(new BroString(s, n, 1));
+		return make_intrusive<StringVal>(new BroString(s, n, 1));
 
 	const u_char* sp = s;
 
@@ -757,7 +758,7 @@ function strip%(str: string%): string
 	while ( isspace(*sp) && sp <= e )
 		++sp;
 
-	return new StringVal(new BroString(sp, (e - sp + 1), 1));
+	return make_intrusive<StringVal>(new BroString(sp, (e - sp + 1), 1));
 	%}
 
 %%{
@@ -792,7 +793,7 @@ function lstrip%(str: string, chars: string &default=" \t\n\r\v\f"%): string
 
 	// empty input string
 	if ( n == 0 )
-		return new StringVal(new BroString(s, n, 1));
+		return make_intrusive<StringVal>(new BroString(s, n, 1));
 
 	int i;
 	auto bs_chars = chars->AsString();
@@ -801,7 +802,7 @@ function lstrip%(str: string, chars: string &default=" \t\n\r\v\f"%): string
 		if ( ! should_strip(s[i], bs_chars) )
 			break;
 
-	return new StringVal(new BroString(s + i, n - i, 1));
+	return make_intrusive<StringVal>(new BroString(s + i, n - i, 1));
 	%}
 
 ## Removes all combinations of characters in the *chars* argument
@@ -823,7 +824,7 @@ function rstrip%(str: string, chars: string &default=" \t\n\r\v\f"%): string
 
 	// empty input string
 	if ( n == 0 )
-		return new StringVal(new BroString(s, n, 1));
+		return make_intrusive<StringVal>(new BroString(s, n, 1));
 
 	int n_to_remove;
 	auto bs_chars = chars->AsString();
@@ -832,7 +833,7 @@ function rstrip%(str: string, chars: string &default=" \t\n\r\v\f"%): string
 		if ( ! should_strip(s[n - n_to_remove - 1], bs_chars) )
 			break;
 
-	return new StringVal(new BroString(s, n - n_to_remove, 1));
+	return make_intrusive<StringVal>(new BroString(s, n - n_to_remove, 1));
 	%}
 
 ## Generates a string of a given size and fills it with repetitions of a source
@@ -854,7 +855,7 @@ function string_fill%(len: int, source: string%): string
 
 	dst[len - 1] = 0;
 
-	return new StringVal(new BroString(1, byte_vec(dst), len));
+	return make_intrusive<StringVal>(new BroString(1, byte_vec(dst), len));
 	%}
 
 ## Takes a string and escapes characters that would allow execution of
@@ -894,7 +895,7 @@ function safe_shell_quote%(source: string%): string
 
 	dst[j++] = '"';
 	dst[j] = '\0';
-	return new StringVal(new BroString(1, dst, j));
+	return make_intrusive<StringVal>(new BroString(1, dst, j));
 	%}
 
 ## Finds all occurrences of a pattern in a string.
@@ -949,7 +950,7 @@ function find_last%(str: string, re: pattern%) : string
 		{
 		int n = re->MatchPrefix(t, e - t);
 		if ( n >= 0 )
-			return new StringVal(n, (const char*) t);
+			return make_intrusive<StringVal>(n, (const char*) t);
 		}
 
 	return val_mgr->EmptyString();
@@ -1083,5 +1084,5 @@ function reverse%(str: string%) : string
 	%{
 	string s = string((const char*)str->Bytes(), str->Len());
 	reverse(s.begin(), s.end());
-	return new StringVal(s.length(), (const char*)s.c_str());
+	return make_intrusive<StringVal>(s.length(), (const char*)s.c_str());
 	%}
diff --git a/src/supervisor/Supervisor.cc b/src/supervisor/Supervisor.cc
index 48241ec933..28b03434c5 100644
--- a/src/supervisor/Supervisor.cc
+++ b/src/supervisor/Supervisor.cc
@@ -1311,9 +1311,9 @@ void Supervisor::SupervisedNode::Init(zeek::Options* options) const
 		options->scripts_to_load.emplace_back(s);
 	}
 
-RecordVal* Supervisor::Status(std::string_view node_name)
+IntrusivePtr<RecordVal> Supervisor::Status(std::string_view node_name)
 	{
-	auto rval = new RecordVal(BifType::Record::Supervisor::Status);
+	auto rval = make_intrusive<RecordVal>(BifType::Record::Supervisor::Status);
 	auto tt = BifType::Record::Supervisor::Status->FieldType("nodes");
 	auto node_table_val = new TableVal({NewRef{}, tt->AsTableType()});
 	rval->Assign(0, node_table_val);
diff --git a/src/supervisor/Supervisor.h b/src/supervisor/Supervisor.h
index b38c1ad072..b7800a2c83 100644
--- a/src/supervisor/Supervisor.h
+++ b/src/supervisor/Supervisor.h
@@ -311,7 +311,7 @@ public:
 	 * @return  script-layer Supervisor::Status record value describing the
 	 * status of a node or set of nodes.
 	 */
-	RecordVal* Status(std::string_view node_name);
+	IntrusivePtr<RecordVal> Status(std::string_view node_name);
 
 	/**
 	 * Create a new supervised node.
diff --git a/src/supervisor/supervisor.bif b/src/supervisor/supervisor.bif
index 4381412ac8..096fa8d957 100644
--- a/src/supervisor/supervisor.bif
+++ b/src/supervisor/supervisor.bif
@@ -24,7 +24,7 @@ function Supervisor::__status%(node: string%): Supervisor::Status
 	if ( ! zeek::supervisor_mgr )
 		{
 		builtin_error("supervisor mode not enabled");
-		return new RecordVal(BifType::Record::Supervisor::Status);
+		return make_intrusive<RecordVal>(BifType::Record::Supervisor::Status);
 		}
 
 	return zeek::supervisor_mgr->Status(node->CheckString());
@@ -35,11 +35,11 @@ function Supervisor::__create%(node: Supervisor::NodeConfig%): string
 	if ( ! zeek::supervisor_mgr )
 		{
 		builtin_error("supervisor mode not enabled");
-		return new StringVal("supervisor mode not enabled");
+		return make_intrusive<StringVal>("supervisor mode not enabled");
 		}
 
 	auto rval = zeek::supervisor_mgr->Create(node->AsRecordVal());
-	return new StringVal(rval);
+	return make_intrusive<StringVal>(rval);
 	%}
 
 function Supervisor::__destroy%(node: string%): bool
@@ -87,11 +87,11 @@ function Supervisor::__node%(%): Supervisor::NodeConfig
 		auto rt = BifType::Record::Supervisor::NodeConfig;
 		auto rval = make_intrusive<RecordVal>(rt);
 		rval->Assign(rt->FieldOffset("name"), new StringVal("<invalid>"));
-		return rval.release();
+		return rval;
 		}
 
 	auto rval = zeek::Supervisor::ThisNode()->config.ToRecord();
-	return rval.release();
+	return rval;
 	%}
 
 function Supervisor::__is_supervisor%(%): bool
diff --git a/src/zeek.bif b/src/zeek.bif
index cb27b796dd..4e76bec063 100644
--- a/src/zeek.bif
+++ b/src/zeek.bif
@@ -318,7 +318,7 @@ static int next_fmt(const char*& fmt, const zeek::Args* args, ODesc* d, int& n)
 ## .. zeek:see:: network_time
 function current_time%(%): time
 	%{
-	return new Val(current_time(), TYPE_TIME);
+	return make_intrusive<Val>(current_time(), TYPE_TIME);
 	%}
 
 ## Returns the timestamp of the last packet processed. This function returns
@@ -330,7 +330,7 @@ function current_time%(%): time
 ## .. zeek:see:: current_time
 function network_time%(%): time
 	%{
-	return new Val(network_time, TYPE_TIME);
+	return make_intrusive<Val>(network_time, TYPE_TIME);
 	%}
 
 ## Returns a system environment variable.
@@ -346,7 +346,7 @@ function getenv%(var: string%): string
 	const char* env_val = zeekenv(var->CheckString());
 	if ( ! env_val )
 		env_val = "";	// ###
-	return new StringVal(env_val);
+	return make_intrusive<StringVal>(env_val);
 	%}
 
 ## Sets a system environment variable.
@@ -376,7 +376,7 @@ function setenv%(var: string, val: string%): bool
 function exit%(code: int%): any
 	%{
 	exit(code);
-	return 0;
+	return nullptr;
 	%}
 
 ## Gracefully shut down Zeek by terminating outstanding processing.
@@ -560,7 +560,7 @@ function md5_hash%(...%): string
 	%{
 	unsigned char digest[MD5_DIGEST_LENGTH];
 	MD5Val::digest(@ARG@, digest);
-	return new StringVal(md5_digest_print(digest));
+	return make_intrusive<StringVal>(md5_digest_print(digest));
 	%}
 
 ## Computes the SHA1 hash value of the provided list of arguments.
@@ -580,7 +580,7 @@ function sha1_hash%(...%): string
 	%{
 	unsigned char digest[SHA_DIGEST_LENGTH];
 	SHA1Val::digest(@ARG@, digest);
-	return new StringVal(sha1_digest_print(digest));
+	return make_intrusive<StringVal>(sha1_digest_print(digest));
 	%}
 
 ## Computes the SHA256 hash value of the provided list of arguments.
@@ -600,7 +600,7 @@ function sha256_hash%(...%): string
 	%{
 	unsigned char digest[SHA256_DIGEST_LENGTH];
 	SHA256Val::digest(@ARG@, digest);
-	return new StringVal(sha256_digest_print(digest));
+	return make_intrusive<StringVal>(sha256_digest_print(digest));
 	%}
 
 ## Computes an HMAC-MD5 hash value of the provided list of arguments. The HMAC
@@ -616,7 +616,7 @@ function md5_hmac%(...%): string
 	%{
 	unsigned char hmac[MD5_DIGEST_LENGTH];
 	MD5Val::hmac(@ARG@, shared_hmac_md5_key, hmac);
-	return new StringVal(md5_digest_print(hmac));
+	return make_intrusive<StringVal>(md5_digest_print(hmac));
 	%}
 
 ## Constructs an MD5 handle to enable incremental hash computation. You can
@@ -762,7 +762,7 @@ function sha256_hash_update%(handle: opaque of sha256, data: string%): bool
 ##    sha256_hash sha256_hash_init sha256_hash_update sha256_hash_finish
 function md5_hash_finish%(handle: opaque of md5%): string
 	%{
-	return static_cast<HashVal*>(handle)->Get().release();
+	return static_cast<HashVal*>(handle)->Get();
 	%}
 
 ## Returns the final SHA1 digest of an incremental hash computation.
@@ -776,7 +776,7 @@ function md5_hash_finish%(handle: opaque of md5%): string
 ##    sha256_hash sha256_hash_init sha256_hash_update sha256_hash_finish
 function sha1_hash_finish%(handle: opaque of sha1%): string
 	%{
-	return static_cast<HashVal*>(handle)->Get().release();
+	return static_cast<HashVal*>(handle)->Get();
 	%}
 
 ## Returns the final SHA256 digest of an incremental hash computation.
@@ -790,7 +790,7 @@ function sha1_hash_finish%(handle: opaque of sha1%): string
 ##    sha256_hash sha256_hash_init sha256_hash_update
 function sha256_hash_finish%(handle: opaque of sha256%): string
 	%{
-	return static_cast<HashVal*>(handle)->Get().release();
+	return static_cast<HashVal*>(handle)->Get();
 	%}
 
 ## Initializes and returns a new paraglob.
@@ -821,7 +821,7 @@ function paraglob_init%(v: any%) : opaque of paraglob
 	try
 		{
 		std::unique_ptr<paraglob::Paraglob> p (new paraglob::Paraglob(patterns));
-		return new ParaglobVal(std::move(p));
+		return make_intrusive<ParaglobVal>(std::move(p));
 		}
 	// Thrown if paraglob fails to add a pattern.
 	catch (const paraglob::add_error& e)
@@ -842,7 +842,7 @@ function paraglob_init%(v: any%) : opaque of paraglob
 ## ## .. zeek:see::paraglob_add paraglob_equals paraglob_init
 function paraglob_match%(handle: opaque of paraglob, match: string%): string_vec
 	%{
-	return static_cast<ParaglobVal*>(handle)->Get(match).release();
+	return static_cast<ParaglobVal*>(handle)->Get(match);
 	%}
 
 ## Compares two paraglobs for equality.
@@ -946,7 +946,7 @@ function rand%(max: count%): count
 function srand%(seed: count%): any
 	%{
 	bro_srandom(seed);
-	return 0;
+	return nullptr;
 	%}
 
 %%{
@@ -959,7 +959,7 @@ function srand%(seed: count%): any
 function syslog%(s: string%): any
 	%{
 	reporter->Syslog("%s", s->CheckString());
-	return 0;
+	return nullptr;
 	%}
 
 ## Determines the MIME type of a piece of data using Zeek's file magic
@@ -982,9 +982,9 @@ function identify_data%(data: string, return_mime: bool &default=T%): string
 	string strongest_match = file_mgr->DetectMIME(data->Bytes(), data->Len());
 
 	if ( strongest_match.empty() )
-		return new StringVal("<unknown>");
+		return make_intrusive<StringVal>("<unknown>");
 
-	return new StringVal(strongest_match);
+	return make_intrusive<StringVal>(strongest_match);
 	%}
 
 ## Determines the MIME type of a piece of data using Zeek's file magic
@@ -1066,7 +1066,7 @@ function find_entropy%(data: string%): entropy_test_result
 ## .. zeek:see:: find_entropy entropy_test_add entropy_test_finish
 function entropy_test_init%(%): opaque of entropy
 	%{
-	return new EntropyVal();
+	return make_intrusive<EntropyVal>();
 	%}
 
 ## Adds data to an incremental entropy calculation.
@@ -1121,7 +1121,7 @@ function unique_id%(prefix: string%) : string
 	%{
 	char tmp[20];
 	uint64_t uid = calculate_unique_id(UID_POOL_DEFAULT_SCRIPT);
-	return new StringVal(uitoa_n(uid, tmp, sizeof(tmp), 62, prefix->CheckString()));
+	return make_intrusive<StringVal>(uitoa_n(uid, tmp, sizeof(tmp), 62, prefix->CheckString()));
 	%}
 
 ## Creates an identifier that is unique with high probability.
@@ -1139,7 +1139,7 @@ function unique_id_from%(pool: int, prefix: string%) : string
 
 	char tmp[20];
 	uint64_t uid = calculate_unique_id(pool);
-	return new StringVal(uitoa_n(uid, tmp, sizeof(tmp), 62, prefix->CheckString()));
+	return make_intrusive<StringVal>(uitoa_n(uid, tmp, sizeof(tmp), 62, prefix->CheckString()));
 	%}
 
 # ===========================================================================
@@ -1158,7 +1158,7 @@ function clear_table%(v: any%): any
 	else
 		builtin_error("clear_table() requires a table/set argument");
 
-	return 0;
+	return nullptr;
 	%}
 
 ## Gets all subnets that contain a given subnet from a set/table[subnet].
@@ -1176,7 +1176,7 @@ function matching_subnets%(search: subnet, t: any%): subnet_vec
 		return nullptr;
 		}
 
-	return t->AsTableVal()->LookupSubnets(search).release();
+	return t->AsTableVal()->LookupSubnets(search);
 	%}
 
 ## For a set[subnet]/table[subnet], create a new table that contains all entries
@@ -1195,7 +1195,7 @@ function filter_subnet_table%(search: subnet, t: any%): any
 		return nullptr;
 		}
 
-	return t->AsTableVal()->LookupSubnetValues(search).release();
+	return t->AsTableVal()->LookupSubnetValues(search);
 	%}
 
 ## Checks if a specific subnet is a member of a set/table[subnet].
@@ -1263,7 +1263,7 @@ function resize%(aggr: any, newsize: count%) : count
 	if ( aggr->Type()->Tag() != TYPE_VECTOR )
 		{
 		builtin_error("resize() operates on vectors");
-		return 0;
+		return nullptr;
 		}
 
 	return val_mgr->Count(aggr->AsVectorVal()->Resize(newsize));
@@ -1569,7 +1569,7 @@ function cat%(...%): string
 	BroString* s = new BroString(1, d.TakeBytes(), d.Len());
 	s->SetUseFreeToDelete(true);
 
-	return new StringVal(s);
+	return make_intrusive<StringVal>(s);
 	%}
 
 ## Concatenates all arguments, with a separator placed between each one. This
@@ -1611,7 +1611,7 @@ function cat_sep%(sep: string, def: string, ...%): string
 	BroString* s = new BroString(1, d.TakeBytes(), d.Len());
 	s->SetUseFreeToDelete(true);
 
-	return new StringVal(s);
+	return make_intrusive<StringVal>(s);
 	%}
 
 ## Produces a formatted string à la ``printf``. The first argument is the
@@ -1686,7 +1686,7 @@ function fmt%(...%): string
 	BroString* s = new BroString(1, d.TakeBytes(), d.Len());
 	s->SetUseFreeToDelete(true);
 
-	return new StringVal(s);
+	return make_intrusive<StringVal>(s);
 	%}
 
 ## Renders a sequence of values to a string of bytes and outputs them directly
@@ -1722,7 +1722,7 @@ function print_raw%(...%): bool
 ## .. zeek:see:: sqrt exp ln log10
 function floor%(d: double%): double
 	%{
-	return new Val(floor(d), TYPE_DOUBLE);
+	return make_intrusive<Val>(floor(d), TYPE_DOUBLE);
 	%}
 
 ## Computes the square root of a :zeek:type:`double`.
@@ -1737,10 +1737,10 @@ function sqrt%(x: double%): double
 	if ( x < 0 )
 		{
 		reporter->Error("negative sqrt argument");
-		return new Val(-1.0, TYPE_DOUBLE);
+		return make_intrusive<Val>(-1.0, TYPE_DOUBLE);
 		}
 
-	return new Val(sqrt(x), TYPE_DOUBLE);
+	return make_intrusive<Val>(sqrt(x), TYPE_DOUBLE);
 	%}
 
 ## Computes the exponential function.
@@ -1752,7 +1752,7 @@ function sqrt%(x: double%): double
 ## .. zeek:see:: floor sqrt ln log10
 function exp%(d: double%): double
 	%{
-	return new Val(exp(d), TYPE_DOUBLE);
+	return make_intrusive<Val>(exp(d), TYPE_DOUBLE);
 	%}
 
 ## Computes the natural logarithm of a number.
@@ -1764,7 +1764,7 @@ function exp%(d: double%): double
 ## .. zeek:see:: exp floor sqrt log10
 function ln%(d: double%): double
 	%{
-	return new Val(log(d), TYPE_DOUBLE);
+	return make_intrusive<Val>(log(d), TYPE_DOUBLE);
 	%}
 
 ## Computes the common logarithm of a number.
@@ -1776,7 +1776,7 @@ function ln%(d: double%): double
 ## .. zeek:see:: exp floor sqrt ln
 function log10%(d: double%): double
 	%{
-	return new Val(log10(d), TYPE_DOUBLE);
+	return make_intrusive<Val>(log10(d), TYPE_DOUBLE);
 	%}
 
 # ===========================================================================
@@ -1811,7 +1811,7 @@ extern const char* zeek_version();
 ## Returns: Zeek's version, e.g., 2.0-beta-47-debug.
 function zeek_version%(%): string
 	%{
-	return new StringVal(zeek_version());
+	return make_intrusive<StringVal>(zeek_version());
 	%}
 
 ## Converts a record type name to a vector of strings, where each element is
@@ -1849,7 +1849,7 @@ function type_name%(t: any%): string
 	BroString* s = new BroString(1, d.TakeBytes(), d.Len());
 	s->SetUseFreeToDelete(true);
 
-	return new StringVal(s);
+	return make_intrusive<StringVal>(s);
 	%}
 
 ## Returns: list of command-line arguments (``argv``) used to run Zeek.
@@ -1861,7 +1861,7 @@ function zeek_args%(%): string_vec
 	for ( auto i = 0; i < bro_argc; ++i )
 		rval->Assign(rval->Size(), make_intrusive<StringVal>(bro_argv[i]));
 
-	return rval.release();
+	return rval;
 	%}
 
 ## Checks whether Zeek reads traffic from one or more network interfaces (as
@@ -1897,7 +1897,7 @@ function packet_source%(%): PacketSource
 	auto ps = iosource_mgr->GetPktSrc();
 	auto r = make_intrusive<RecordVal>(ps_type);
 
-        if ( ps )
+	if ( ps )
 		{
 		r->Assign(0, val_mgr->Bool(ps->IsLive()));
 		r->Assign(1, make_intrusive<StringVal>(ps->Path()));
@@ -1905,7 +1905,7 @@ function packet_source%(%): PacketSource
 		r->Assign(3, val_mgr->Count(ps->Netmask()));
 		}
 
-	return r.release();
+	return r;
 	%}
 
 ## Generates a table of the size of all global variables. The table index is
@@ -1982,12 +1982,12 @@ function lookup_ID%(id: string%) : any
 	%{
 	ID* i = global_scope()->Lookup(id->CheckString());
 	if ( ! i )
-		return new StringVal("<unknown id>");
+		return make_intrusive<StringVal>("<unknown id>");
 
 	if ( ! i->ID_Val() )
-		return new StringVal("<no ID value>");
+		return make_intrusive<StringVal>("<no ID value>");
 
-	return i->ID_Val()->Ref();
+	return IntrusivePtr{NewRef{}, i->ID_Val()};
 	%}
 
 ## Generates metadata about a record's fields. The returned information
@@ -2006,13 +2006,14 @@ function record_fields%(rec: any%): record_field_table
 		if ( ! id || ! id->AsType() || id->AsType()->Tag() != TYPE_RECORD )
 			{
 			reporter->Error("record_fields string argument does not name a record type");
-			return new TableVal({NewRef{}, internal_type("record_field_table")->AsTableType()});
+			IntrusivePtr<TableType> tt{NewRef{}, internal_type("record_field_table")->AsTableType()};
+			return make_intrusive<TableVal>(std::move(tt));
 			}
 
-		return id->AsType()->AsRecordType()->GetRecordFieldsVal().release();
+		return id->AsType()->AsRecordType()->GetRecordFieldsVal();
 		}
 
-	return rec->GetRecordFields().release();
+	return rec->GetRecordFields();
 	%}
 
 ## Enables detailed collection of profiling statistics. Statistics include
@@ -2036,7 +2037,7 @@ function do_profiling%(%) : any
 	if ( profiling_logger )
 		profiling_logger->Log();
 
-	return 0;
+	return nullptr;
 	%}
 
 ## Checks whether a given IP address belongs to a local interface.
@@ -2121,7 +2122,7 @@ function gethostname%(%) : string
 		strcpy(buffer, "<unknown>");
 
 	buffer[MAXHOSTNAMELEN-1] = '\0';
-	return new StringVal(buffer);
+	return make_intrusive<StringVal>(buffer);
 	%}
 
 ## Returns whether an address is IPv4 or not.
@@ -2245,21 +2246,21 @@ function counts_to_addr%(v: index_vec%): addr
 	%{
 	if ( v->AsVector()->size() == 1 )
 		{
-		return new AddrVal(htonl((*v->AsVector())[0]->AsCount()));
+		return make_intrusive<AddrVal>(htonl((*v->AsVector())[0]->AsCount()));
 		}
 	else if ( v->AsVector()->size() == 4 )
 		{
 		uint32_t bytes[4];
 		for ( int i = 0; i < 4; ++i )
 			bytes[i] = htonl((*v->AsVector())[i]->AsCount());
-		return new AddrVal(bytes);
+		return make_intrusive<AddrVal>(bytes);
 		}
 	else
 		{
 		builtin_error("invalid vector size", @ARG@[0]);
 		uint32_t bytes[4];
 		memset(bytes, 0, sizeof(bytes));
-		return new AddrVal(bytes);
+		return make_intrusive<AddrVal>(bytes);
 		}
 	%}
 
@@ -2367,7 +2368,7 @@ function to_count%(str: string%): count
 ## .. zeek:see:: double_to_interval
 function interval_to_double%(i: interval%): double
 	%{
-	return new Val(i, TYPE_DOUBLE);
+	return make_intrusive<Val>(i, TYPE_DOUBLE);
 	%}
 
 ## Converts a :zeek:type:`time` value to a :zeek:type:`double`.
@@ -2379,7 +2380,7 @@ function interval_to_double%(i: interval%): double
 ## .. zeek:see:: double_to_time
 function time_to_double%(t: time%): double
 	%{
-	return new Val(t, TYPE_DOUBLE);
+	return make_intrusive<Val>(t, TYPE_DOUBLE);
 	%}
 
 ## Converts a :zeek:type:`double` value to a :zeek:type:`time`.
@@ -2391,7 +2392,7 @@ function time_to_double%(t: time%): double
 ## .. zeek:see:: time_to_double double_to_count
 function double_to_time%(d: double%): time
 	%{
-	return new Val(d, TYPE_TIME);
+	return make_intrusive<Val>(d, TYPE_TIME);
 	%}
 
 ## Converts a :zeek:type:`double` to an :zeek:type:`interval`.
@@ -2403,7 +2404,7 @@ function double_to_time%(d: double%): time
 ## .. zeek:see:: interval_to_double
 function double_to_interval%(d: double%): interval
 	%{
-	return new Val(d, TYPE_INTERVAL);
+	return make_intrusive<Val>(d, TYPE_INTERVAL);
 	%}
 
 ## Converts a :zeek:type:`port` to a :zeek:type:`count`.
@@ -2504,7 +2505,7 @@ function to_subnet%(sn: string%): subnet
 function addr_to_subnet%(a: addr%): subnet
 	%{
 	int width = (a->AsAddr().GetFamily() == IPv4 ? 32 : 128);
-	return new SubNetVal(a->AsAddr(), width);
+	return make_intrusive<SubNetVal>(a->AsAddr(), width);
 	%}
 
 ## Converts a :zeek:type:`subnet` to an :zeek:type:`addr` by
@@ -2517,7 +2518,7 @@ function addr_to_subnet%(a: addr%): subnet
 ## .. zeek:see:: to_subnet
 function subnet_to_addr%(sn: subnet%): addr
 	%{
-	return new AddrVal(sn->Prefix());
+	return make_intrusive<AddrVal>(sn->Prefix());
 	%}
 
 ## Returns the width of a :zeek:type:`subnet`.
@@ -2552,7 +2553,7 @@ function to_double%(str: string%): double
 		d = 0;
 		}
 
-	return new Val(d, TYPE_DOUBLE);
+	return make_intrusive<Val>(d, TYPE_DOUBLE);
 	%}
 
 ## Converts a :zeek:type:`count` to an :zeek:type:`addr`.
@@ -2567,10 +2568,10 @@ function count_to_v4_addr%(ip: count%): addr
 	if ( ip > 4294967295LU )
 		{
 		builtin_error("conversion of non-IPv4 count to addr", @ARG@[0]);
-		return new AddrVal(uint32_t(0));
+		return make_intrusive<AddrVal>(uint32_t(0));
 		}
 
-	return new AddrVal(htonl(uint32_t(ip)));
+	return make_intrusive<AddrVal>(htonl(uint32_t(ip)));
 	%}
 
 ## Converts a :zeek:type:`string` of bytes into an IPv4 address. In particular,
@@ -2595,7 +2596,7 @@ function raw_bytes_to_v4_addr%(b: string%): addr
 		a = (bp[0] << 24) | (bp[1] << 16) | (bp[2] << 8) | bp[3];
 		}
 
-	return new AddrVal(htonl(a));
+	return make_intrusive<AddrVal>(htonl(a));
 	%}
 
 ## Converts a :zeek:type:`string` to a :zeek:type:`port`.
@@ -2641,13 +2642,13 @@ function bytestring_to_double%(s: string%): double
 	if ( s->Len() != sizeof(double) )
 		{
 		builtin_error("bad conversion to double");
-		return new Val(0.0, TYPE_DOUBLE);
+		return make_intrusive<Val>(0.0, TYPE_DOUBLE);
 		}
 
 	// See #908 for a discussion of portability.
 	double d;
 	memcpy(&d, s->Bytes(), sizeof(double));
-	return new Val(ntohd(d), TYPE_DOUBLE);
+	return make_intrusive<Val>(ntohd(d), TYPE_DOUBLE);
 	%}
 
 ## Converts a string of bytes to a :zeek:type:`count`.
@@ -2768,7 +2769,7 @@ function ptr_name_to_addr%(s: string%): addr
 		else
 			addr = (a[3] << 24) | (a[2] << 16) | (a[1] << 8) | a[0];
 
-		return new AddrVal(htonl(addr));
+		return make_intrusive<AddrVal>(htonl(addr));
 		}
 	else
 		{
@@ -2801,7 +2802,7 @@ function ptr_name_to_addr%(s: string%): addr
 				}
 			}
 
-		return new AddrVal(addr6);
+		return make_intrusive<AddrVal>(addr6);
 		}
 	%}
 
@@ -2815,7 +2816,7 @@ function ptr_name_to_addr%(s: string%): addr
 ## .. zeek:see:: ptr_name_to_addr to_addr
 function addr_to_ptr_name%(a: addr%): string
 	%{
-	return new StringVal(a->AsAddr().PtrName().c_str());
+	return make_intrusive<StringVal>(a->AsAddr().PtrName().c_str());
 	%}
 
 ## Converts a string of bytes into its hexadecimal representation.
@@ -2837,7 +2838,7 @@ function bytestring_to_hexstr%(bytestring: string%): string
 	for ( bro_uint_t i = 0; i < len; ++i )
 		snprintf(hexstr + (2 * i), 3, "%.2hhx", bytes[i]);
 
-	return new StringVal(hexstr);
+	return make_intrusive<StringVal>(hexstr);
 	%}
 
 ## Converts a hex-string into its binary representation.
@@ -2884,7 +2885,7 @@ function hexstr_to_bytestring%(hexstr: string%): string
 
 		}
 
-	return new StringVal(outlen, bytestring);
+	return make_intrusive<StringVal>(outlen, bytestring);
 	%}
 
 ## Encodes a Base64-encoded string.
@@ -2901,7 +2902,7 @@ function encode_base64%(s: string, a: string &default=""%): string
 	%{
 	BroString* t = encode_base64(s->AsString(), a->AsString());
 	if ( t )
-		return new StringVal(t);
+		return make_intrusive<StringVal>(t);
 	else
 		{
 		reporter->Error("Broker query has an invalid data store");
@@ -2923,7 +2924,7 @@ function decode_base64%(s: string, a: string &default=""%): string
 	%{
 	BroString* t = decode_base64(s->AsString(), a->AsString());
 	if ( t )
-		return new StringVal(t);
+		return make_intrusive<StringVal>(t);
 	else
 		{
 		reporter->Error("error in decoding string %s", s->CheckString());
@@ -2956,7 +2957,7 @@ function decode_base64_conn%(cid: conn_id, s: string, a: string &default=""%): s
 
 	BroString* t = decode_base64(s->AsString(), a->AsString(), conn);
 	if ( t )
-		return new StringVal(t);
+		return make_intrusive<StringVal>(t);
 	else
 		{
 		reporter->Error("error in decoding string %s", s->CheckString());
@@ -2986,7 +2987,7 @@ typedef struct {
 function uuid_to_string%(uuid: string%): string
 	%{
 	if ( uuid->Len() != 16 )
-		return new StringVal("<Invalid UUID>");
+		return make_intrusive<StringVal>("<Invalid UUID>");
 
 	bro_uuid_t* id = (bro_uuid_t*) uuid->Bytes();
 
@@ -3004,7 +3005,7 @@ function uuid_to_string%(uuid: string%): string
 		id->node[4],
 		id->node[5]);
 
-	return new StringVal(s);
+	return make_intrusive<StringVal>(s);
 	%}
 
 %%{
@@ -3078,7 +3079,7 @@ function string_to_pattern%(s: string, convert: bool%): pattern
 	RE_Matcher* re = new RE_Matcher(pat);
 	delete [] pat;
 	re->Compile();
-	return new PatternVal(re);
+	return make_intrusive<PatternVal>(re);
 	%}
 
 ## Formats a given time value according to a format string.
@@ -3097,9 +3098,9 @@ function strftime%(fmt: string, d: time%) : string
 
 	if ( ! localtime_r(&timeval, &t) ||
 	     ! strftime(buffer, 128, fmt->CheckString(), &t) )
-		return new StringVal("<strftime error>");
+		return make_intrusive<StringVal>("<strftime error>");
 
-	return new StringVal(buffer);
+	return make_intrusive<StringVal>(buffer);
 	%}
 
 
@@ -3120,11 +3121,11 @@ function strptime%(fmt: string, d: string%) : time
 	     ! strptime(d->CheckString(), fmt->CheckString(), &t) )
 		{
 		reporter->Warning("strptime conversion failed: fmt:%s d:%s", fmt->CheckString(), d->CheckString());
-		return new Val(0.0, TYPE_TIME);
+		return make_intrusive<Val>(0.0, TYPE_TIME);
 		}
 
 	double ret = mktime(&t);
-	return new Val(ret, TYPE_TIME);
+	return make_intrusive<Val>(ret, TYPE_TIME);
 	%}
 
 
@@ -3147,7 +3148,7 @@ function strptime%(fmt: string, d: string%) : time
 ## .. zeek:see:: remask_addr
 function mask_addr%(a: addr, top_bits_to_keep: count%): subnet
 	%{
-	return new SubNetVal(a->AsAddr(), top_bits_to_keep);
+	return make_intrusive<SubNetVal>(a->AsAddr(), top_bits_to_keep);
 	%}
 
 ## Takes some top bits (such as a subnet address) from one address and the other
@@ -3173,7 +3174,7 @@ function remask_addr%(a1: addr, a2: addr, top_bits_from_a1: count%): addr
 	addr1.Mask(top_bits_from_a1);
 	IPAddr addr2(a2->AsAddr());
 	addr2.ReverseMask(top_bits_from_a1);
-	return new AddrVal(addr1|addr2);
+	return make_intrusive<AddrVal>(addr1|addr2);
 	%}
 
 ## Checks whether a given :zeek:type:`port` has TCP as transport protocol.
@@ -3213,20 +3214,20 @@ function is_icmp_port%(p: port%): bool
 	%}
 
 %%{
-EnumVal* map_conn_type(TransportProto tp)
+static IntrusivePtr<EnumVal> map_conn_type(TransportProto tp)
 	{
 	switch ( tp ) {
 	case TRANSPORT_UNKNOWN:
-		return transport_proto->GetVal(0).release();
+		return transport_proto->GetVal(0);
 
 	case TRANSPORT_TCP:
-		return transport_proto->GetVal(1).release();
+		return transport_proto->GetVal(1);
 
 	case TRANSPORT_UDP:
-		return transport_proto->GetVal(2).release();
+		return transport_proto->GetVal(2);
 
 	case TRANSPORT_ICMP:
-		return transport_proto->GetVal(3).release();
+		return transport_proto->GetVal(3);
 
 	default:
 		reporter->InternalError("bad connection type in map_conn_type()");
@@ -3234,7 +3235,7 @@ EnumVal* map_conn_type(TransportProto tp)
 
 	// Cannot be reached;
 	assert(false);
-	return 0; // Make compiler happy.
+	return nullptr; // Make compiler happy.
 	}
 %%}
 
@@ -3252,7 +3253,7 @@ function get_conn_transport_proto%(cid: conn_id%): transport_proto
 	if ( ! c )
 		{
 		builtin_error("unknown connection id in get_conn_transport_proto()", cid);
-		return transport_proto->GetVal(0).release();
+		return transport_proto->GetVal(0);
 		}
 
 	return map_conn_type(c->ConnTransport());
@@ -3299,19 +3300,19 @@ function lookup_connection%(cid: conn_id%): connection
 	%{
 	Connection* conn = sessions->FindConnection(cid);
 	if ( conn )
-		return conn->BuildConnVal();
+		return IntrusivePtr{AdoptRef{}, conn->BuildConnVal()};
 
 	builtin_error("connection ID not a known connection", cid);
 
 	// Return a dummy connection record.
-	RecordVal* c = new RecordVal(connection_type);
+	auto c = make_intrusive<RecordVal>(connection_type);
 
-	RecordVal* id_val = new RecordVal(conn_id);
+	auto id_val = make_intrusive<RecordVal>(conn_id);
 	id_val->Assign(0, make_intrusive<AddrVal>((unsigned int) 0));
 	id_val->Assign(1, val_mgr->Port(ntohs(0), TRANSPORT_UDP));
 	id_val->Assign(2, make_intrusive<AddrVal>((unsigned int) 0));
 	id_val->Assign(3, val_mgr->Port(ntohs(0), TRANSPORT_UDP));
-	c->Assign(0, id_val);
+	c->Assign(0, std::move(id_val));
 
 	auto orig_endp = make_intrusive<RecordVal>(endpoint);
 	orig_endp->Assign(0, val_mgr->Count(0));
@@ -3426,10 +3427,10 @@ function get_current_packet_header%(%) : raw_pkt_hdr
 	if ( current_pktsrc &&
 	     current_pktsrc->GetCurrentPacket(&p) )
 		{
-		return p->BuildPktHdrVal();
+		return IntrusivePtr{AdoptRef{}, p->BuildPktHdrVal()};
 		}
 
-	RecordVal* hdr = new RecordVal(raw_pkt_hdr_type);
+	auto hdr = make_intrusive<RecordVal>(raw_pkt_hdr_type);
 	return hdr;
 	%}
 
@@ -3558,7 +3559,7 @@ function lookup_addr%(host: addr%) : string
 	if ( ! trigger)
 		{
 		builtin_error("lookup_addr() can only be called inside a when-condition");
-		return new StringVal("<error>");
+		return make_intrusive<StringVal>("<error>");
 		}
 
 	frame->SetDelayed();
@@ -3566,7 +3567,7 @@ function lookup_addr%(host: addr%) : string
 
 	dns_mgr->AsyncLookupAddr(host->AsAddr(),
 			new LookupHostCallback(trigger, frame->GetCall(), true));
-	return 0;
+	return nullptr;
 	%}
 
 ## Issues an asynchronous TEXT DNS lookup and delays the function result.
@@ -3587,7 +3588,7 @@ function lookup_hostname_txt%(host: string%) : string
 	if ( ! trigger)
 		{
 		builtin_error("lookup_hostname_txt() can only be called inside a when-condition");
-		return new StringVal("<error>");
+		return make_intrusive<StringVal>("<error>");
 		}
 
 	frame->SetDelayed();
@@ -3595,7 +3596,7 @@ function lookup_hostname_txt%(host: string%) : string
 
 	dns_mgr->AsyncLookupNameText(host->CheckString(),
 				 new LookupHostCallback(trigger, frame->GetCall(), true));
-	return 0;
+	return nullptr;
 	%}
 
 ## Issues an asynchronous DNS lookup and delays the function result.
@@ -3616,7 +3617,7 @@ function lookup_hostname%(host: string%) : addr_set
 	if ( ! trigger)
 		{
 		builtin_error("lookup_hostname() can only be called inside a when-condition");
-		return new StringVal("<error>");
+		return make_intrusive<StringVal>("<error>");
 		}
 
 	frame->SetDelayed();
@@ -3624,7 +3625,7 @@ function lookup_hostname%(host: string%) : addr_set
 
 	dns_mgr->AsyncLookupName(host->CheckString(),
 			new LookupHostCallback(trigger, frame->GetCall(), false));
-	return 0;
+	return nullptr;
 	%}
 
 %%{
@@ -4132,7 +4133,7 @@ function haversine_distance%(lat1: double, long1: double, lat2: double, long2: d
 	double a = s1 * s1 + cos(lat1 * PI/180) * cos(lat2 * PI/180) * s2 * s2;
 	double distance = 2 * RADIUS * asin(sqrt(a));
 
-	return new Val(distance, TYPE_DOUBLE);
+	return make_intrusive<Val>(distance, TYPE_DOUBLE);
 	%}
 
 ## Converts UNIX file permissions given by a mode to an ASCII string.
@@ -4224,7 +4225,7 @@ function file_mode%(mode: count%): string
 
 	*p = '\0';
 
-	return new StringVal(str);
+	return make_intrusive<StringVal>(str);
 	%}
 
 # ===========================================================================
@@ -4345,12 +4346,12 @@ function set_inactivity_timeout%(cid: conn_id, t: interval%): interval
 	%{
 	Connection* c = sessions->FindConnection(cid);
 	if ( ! c )
-		return new Val(0.0, TYPE_INTERVAL);
+		return make_intrusive<Val>(0.0, TYPE_INTERVAL);
 
 	double old_timeout = c->InactivityTimeout();
 	c->SetInactivityTimeout(t);
 
-	return new Val(old_timeout, TYPE_INTERVAL);
+	return make_intrusive<Val>(old_timeout, TYPE_INTERVAL);
 	%}
 
 # ===========================================================================
@@ -4374,9 +4375,9 @@ function open%(f: string%): file
 	const char* file = f->CheckString();
 
 	if ( streq(file, "-") )
-		return new Val(new BroFile(stdout, "-", "w"));
+		return make_intrusive<Val>(new BroFile(stdout, "-", "w"));
 	else
-		return new Val(new BroFile(file, "w"));
+		return make_intrusive<Val>(new BroFile(file, "w"));
 	%}
 
 ## Opens a file for writing or appending. If a file with the same name already
@@ -4391,7 +4392,7 @@ function open%(f: string%): file
 ##              rmdir unlink rename
 function open_for_append%(f: string%): file
 	%{
-	return new Val(new BroFile(f->CheckString(), "a"));
+	return make_intrusive<Val>(new BroFile(f->CheckString(), "a"));
 	%}
 
 ## Closes an open file and flushes any buffered content.
@@ -4587,7 +4588,7 @@ function get_file_name%(f: file%): string
 	if ( ! f )
 		return val_mgr->EmptyString();
 
-	return new StringVal(f->Name());
+	return make_intrusive<StringVal>(f->Name());
 	%}
 
 ## Rotates a file.
@@ -4682,7 +4683,7 @@ function calc_next_rotate%(i: interval%) : interval
 		log_rotate_base_time->AsString()->CheckString() : 0;
 
 	double base = parse_rotate_base_time(base_time);
-	return new Val(calc_next_rotate(network_time, i, base), TYPE_INTERVAL);
+	return make_intrusive<Val>(calc_next_rotate(network_time, i, base), TYPE_INTERVAL);
 	%}
 
 ## Returns the size of a given file.
@@ -4695,9 +4696,9 @@ function file_size%(f: string%) : double
 	struct stat s;
 
 	if ( stat(f->CheckString(), &s) < 0 )
-		return new Val(-1.0, TYPE_DOUBLE);
+		return make_intrusive<Val>(-1.0, TYPE_DOUBLE);
 
-	return new Val(double(s.st_size), TYPE_DOUBLE);
+	return make_intrusive<Val>(double(s.st_size), TYPE_DOUBLE);
 	%}
 
 ## Prevents escaping of non-ASCII characters when writing to a file.
@@ -4707,7 +4708,7 @@ function file_size%(f: string%) : double
 function enable_raw_output%(f: file%): any
 	%{
 	f->EnableRawOutput();
-	return 0;
+	return nullptr;
 	%}
 
 # ===========================================================================
@@ -4941,7 +4942,7 @@ function is_remote_event%(%) : bool
 function suspend_processing%(%) : any
 	%{
 	net_suspend_processing();
-	return 0;
+	return nullptr;
 	%}
 
 ## Resumes Zeek's packet processing.
@@ -4950,7 +4951,7 @@ function suspend_processing%(%) : any
 function continue_processing%(%) : any
 	%{
 	net_continue_processing();
-	return 0;
+	return nullptr;
 	%}
 
 # ===========================================================================
@@ -5012,7 +5013,7 @@ function preserve_prefix%(a: addr, width: count%): any
 		}
 
 
-	return 0;
+	return nullptr;
 	%}
 
 ## Preserves the prefix of a subnet in anonymization.
@@ -5038,7 +5039,7 @@ function preserve_subnet%(a: subnet%): any
 			}
 		}
 
-	return 0;
+	return nullptr;
 	%}
 
 ## Anonymizes an IP address.
@@ -5067,13 +5068,13 @@ function anonymize_addr%(a: addr, cl: IPAddrAnonymizationClass%): addr
 	if ( a->AsAddr().GetFamily() == IPv6 )
 		{
 		builtin_error("anonymize_addr() not supported for IPv6 addresses");
-		return 0;
+		return nullptr;
 		}
 	else
 		{
 		const uint32_t* bytes;
 		a->AsAddr().GetBytes(&bytes);
-		return new AddrVal(anonymize_ip(*bytes,
+		return make_intrusive<AddrVal>(anonymize_ip(*bytes,
 			(enum ip_addr_anonymization_class_t) anon_class));
 		}
 	%}
@@ -5090,5 +5091,5 @@ function anonymize_addr%(a: addr, cl: IPAddrAnonymizationClass%): addr
 ## .. zeek:see:: fmt cat cat_sep string_cat print_raw
 function to_json%(val: any, only_loggable: bool &default=F, field_escape_pattern: pattern &default=/^_/%): string
 	%{
-	return val->ToJSON(only_loggable, field_escape_pattern).release();
+	return val->ToJSON(only_loggable, field_escape_pattern);
 	%}
diff --git a/src/zeekygen/zeekygen.bif b/src/zeekygen/zeekygen.bif
index 877fa5ba11..beaff682b0 100644
--- a/src/zeekygen/zeekygen.bif
+++ b/src/zeekygen/zeekygen.bif
@@ -9,9 +9,9 @@
 #include "zeekygen/ScriptInfo.h"
 #include "util.h"
 
-static StringVal* comments_to_val(const vector<string>& comments)
+static IntrusivePtr<StringVal> comments_to_val(const vector<string>& comments)
 	{
-	return new StringVal(implode_string_vector(comments));
+	return make_intrusive<StringVal>(implode_string_vector(comments));
 	}
 %%}