Merge branch 'intrusive_ptr' of https://github.com/MaxKellermann/zeek

* 'intrusive_ptr' of https://github.com/MaxKellermann/zeek: (32 commits)
  Scope: store IntrusivePtr in `local`
  Scope: pass IntrusivePtr to AddInit()
  DNS_Mgr: use class IntrusivePtr
  Scope: use class IntrusivePtr
  Attr: use class IntrusivePtr
  Expr: check_and_promote_expr() returns IntrusivePtr
  Frame: use class IntrusivePtr
  Val: RecordVal::LookupWithDefault() returns IntrusivePtr
  Type: RecordType::FieldDefault() returns IntrusivePtr
  Val: TableVal::Delete() returns IntrusivePtr
  Type: base_type() returns IntrusivePtr
  Type: init_type() returns IntrusivePtr
  Type: merge_types() returns IntrusivePtr
  Type: use class IntrusivePtr in VectorType
  Type: use class IntrusivePtr in EnumType
  Type: use class IntrusivePtr in FileType
  Type: use class IntrusivePtr in TypeDecl
  Type: make TypeDecl `final` and the dtor non-`virtual`
  Type: use class IntrusivePtr in TypeType
  Type: use class IntrusivePtr in FuncType
  ...

src/Attr.cc

@@ -23,18 +23,20 @@ const char* attr_name(attr_tag t)
 	return attr_names[int(t)];
 	}
 
-Attr::Attr(attr_tag t, Expr* e)
+Attr::Attr(attr_tag t, IntrusivePtr<Expr> e)
+	: expr(std::move(e))
 	{
 	tag = t;
-	expr = e;
 	SetLocationInfo(&start_location, &end_location);
 	}
 
-Attr::~Attr()
+Attr::Attr(attr_tag t)
+	: Attr(t, nullptr)
 	{
-	Unref(expr);
 	}
 
+Attr::~Attr() = default;
+
 void Attr::Describe(ODesc* d) const
 	{
 	AddTag(d);
@@ -131,10 +133,10 @@ void Attr::AddTag(ODesc* d) const
 		d->Add(attr_name(Tag()));
 	}
 
-Attributes::Attributes(attr_list* a, BroType* t, bool arg_in_record, bool is_global)
+Attributes::Attributes(attr_list* a, IntrusivePtr<BroType> t, bool arg_in_record, bool is_global)
+	: type(std::move(t))
 	{
 	attrs = new attr_list(a->length());
-	type = t->Ref();
 	in_record = arg_in_record;
 	global_var = is_global;
 
@@ -145,7 +147,7 @@ Attributes::Attributes(attr_list* a, BroType* t, bool arg_in_record, bool is_glo
 	// the necessary checking gets done.
 
 	for ( const auto& attr : *a )
-		AddAttr(attr);
+		AddAttr({NewRef{}, attr});
 
 	delete a;
 	}
@@ -156,23 +158,20 @@ Attributes::~Attributes()
 		Unref(attr);
 
 	delete attrs;
-
-	Unref(type);
 	}
 
-void Attributes::AddAttr(Attr* attr)
+void Attributes::AddAttr(IntrusivePtr<Attr> attr)
 	{
 	if ( ! attrs )
 		attrs = new attr_list(1);
 
 	// We overwrite old attributes by deleting them first.
 	RemoveAttr(attr->Tag());
-	attrs->push_back(attr);
+	attrs->push_back(IntrusivePtr{attr}.release());
-	Ref(attr);
 
 	// We only check the attribute after we've added it, to facilitate
 	// generating error messages via Attributes::Describe.
-	CheckAttr(attr);
+	CheckAttr(attr.get());
 
 	// For ADD_FUNC or DEL_FUNC, add in an implicit REDEF, since
 	// those attributes only have meaning for a redefinable value.
@@ -190,7 +189,7 @@ void Attributes::AddAttrs(Attributes* a)
 	{
 	attr_list* as = a->Attrs();
 	for ( const auto& attr : *as )
-		AddAttr(attr);
+		AddAttr({NewRef{}, attr});
 
 	Unref(a);
 	}
@@ -274,7 +273,7 @@ void Attributes::CheckAttr(Attr* a)
 			}
 
 		FuncType* aft = at->AsFuncType();
-		if ( ! same_type(aft->YieldType(), type) )
+		if ( ! same_type(aft->YieldType(), type.get()) )
 			{
 			a->AttrExpr()->Error(
 				is_add ?
@@ -299,7 +298,7 @@ void Attributes::CheckAttr(Attr* a)
 
 		if ( type->Tag() != TYPE_TABLE || (type->IsSet() && ! in_record) )
 			{
-			if ( same_type(atype, type) )
+			if ( same_type(atype, type.get()) )
 				// Ok.
 				break;
 
@@ -315,15 +314,16 @@ void Attributes::CheckAttr(Attr* a)
 				// Ok.
 				break;
 
-			Expr* e = a->AttrExpr();
+			auto e = check_and_promote_expr(a->AttrExpr(), type.get());
-			if ( check_and_promote_expr(e, type) )
+
+			if ( e )
 				{
-				a->SetAttrExpr(e);
+				a->SetAttrExpr(std::move(e));
 				// Ok.
 				break;
 				}
 
-			a->AttrExpr()->Error("&default value has inconsistent type", type);
+			a->AttrExpr()->Error("&default value has inconsistent type", type.get());
 			return;
 			}
 
@@ -354,10 +354,11 @@ void Attributes::CheckAttr(Attr* a)
 					// Ok.
 					break;
 
-				Expr* e = a->AttrExpr();
+				auto e = check_and_promote_expr(a->AttrExpr(), ytype);
-				if ( check_and_promote_expr(e, ytype) )
+
+				if ( e )
 					{
-					a->SetAttrExpr(e);
+					a->SetAttrExpr(std::move(e));
 					// Ok.
 					break;
 					}
@@ -373,17 +374,17 @@ void Attributes::CheckAttr(Attr* a)
 			{
 			// &default applies to record field.
 
-			if ( same_type(atype, type) )
+			if ( same_type(atype, type.get()) )
 				// Ok.
 				break;
 
 			if ( (atype->Tag() == TYPE_TABLE && atype->AsTableType()->IsUnspecifiedTable()) )
 				{
-				Expr* e = a->AttrExpr();
+				auto e = check_and_promote_expr(a->AttrExpr(), type.get());
 
-				if ( check_and_promote_expr(e, type) )
+				if ( e )
 					{
-					a->SetAttrExpr(e);
+					a->SetAttrExpr(std::move(e));
 					break;
 					}
 				}
@@ -574,7 +575,7 @@ void Attributes::CheckAttr(Attr* a)
 		break;
 
 	case ATTR_LOG:
-		if ( ! threading::Value::IsCompatibleType(type) )
+		if ( ! threading::Value::IsCompatibleType(type.get()) )
 			Error("&log applied to a type that cannot be logged");
 		break;
 

src/Attr.h

@@ -4,6 +4,7 @@
 
 #include "Obj.h"
 #include "BroList.h"
+#include "IntrusivePtr.h"
 
 class Expr;
 
@@ -35,18 +36,15 @@ typedef enum {
 
 class Attr : public BroObj {
 public:
-	explicit Attr(attr_tag t, Expr* e = 0);
+	Attr(attr_tag t, IntrusivePtr<Expr> e);
+	explicit Attr(attr_tag t);
 	~Attr() override;
 
 	attr_tag Tag() const	{ return tag; }
-	Expr* AttrExpr() const	{ return expr; }
+	Expr* AttrExpr() const	{ return expr.get(); }
 
-	// Up to the caller to decide if previous expr can be unref'd since it may
+	template<typename E>
-	// not always be safe; e.g. expressions (at time of writing) don't always
+	void SetAttrExpr(E&& e) { expr = std::forward<E>(e); }
-	// keep careful track of referencing their operands, so doing something
-	// like SetAttrExpr(coerce(AttrExpr())) must not completely unref the
-	// previous expr as the new expr depends on it.
-	void SetAttrExpr(Expr* e) { expr = e; }
 
 	void Describe(ODesc* d) const override;
 	void DescribeReST(ODesc* d, bool shorten = false) const;
@@ -69,16 +67,16 @@ protected:
 	void AddTag(ODesc* d) const;
 
 	attr_tag tag;
-	Expr* expr;
+	IntrusivePtr<Expr> expr;
 };
 
 // Manages a collection of attributes.
 class Attributes : public BroObj {
 public:
-	Attributes(attr_list* a, BroType* t, bool in_record, bool is_global);
+	Attributes(attr_list* a, IntrusivePtr<BroType> t, bool in_record, bool is_global);
 	~Attributes() override;
 
-	void AddAttr(Attr* a);
+	void AddAttr(IntrusivePtr<Attr> a);
 	void AddAttrs(Attributes* a);	// Unref's 'a' when done
 
 	Attr* FindAttr(attr_tag t) const;
@@ -93,10 +91,9 @@ public:
 	bool operator==(const Attributes& other) const;
 
 protected:
-	Attributes() : type(), attrs(), in_record()	{ }
 	void CheckAttr(Attr* attr);
 
-	BroType* type;
+	IntrusivePtr<BroType> type;
 	attr_list* attrs;
 	bool in_record;
 	bool global_var;

src/CompHash.cc

@@ -180,9 +180,9 @@ char* CompositeHash::SingleValHash(int type_check, char* kp0,
 
 			for ( int i = 0; i < num_fields; ++i )
 				{
-				Val* rv_i = rv->Lookup(i);
+				auto rv_i = rv->Lookup(i);
 
-				Attributes* a = rt->FieldDecl(i)->attrs;
+				Attributes* a = rt->FieldDecl(i)->attrs.get();
 				bool optional = (a && a->FindAttr(ATTR_OPTIONAL));
 
 				if ( ! (rv_i || optional) )
@@ -249,9 +249,10 @@ char* CompositeHash::SingleValHash(int type_check, char* kp0,
 
 				if ( ! v->Type()->IsSet() )
 					{
-					Val* val = tv->Lookup(key);
+					auto val = tv->Lookup(key);
+
 					if ( ! (kp1 = SingleValHash(type_check, kp1, val->Type(),
-								    val, false)) )
+								    val.get(), false)) )
 						{
 						Unref(lv);
 						return 0;
@@ -519,7 +520,7 @@ int CompositeHash::SingleTypeKeySize(BroType* bt, const Val* v,
 
 			for ( int i = 0; i < num_fields; ++i )
 				{
-				Attributes* a = rt->FieldDecl(i)->attrs;
+				Attributes* a = rt->FieldDecl(i)->attrs.get();
 				bool optional = (a && a->FindAttr(ATTR_OPTIONAL));
 
 				sz = SingleTypeKeySize(rt->FieldType(i),
@@ -554,8 +555,8 @@ int CompositeHash::SingleTypeKeySize(BroType* bt, const Val* v,
 
 				if ( ! bt->IsSet() )
 					{
-					Val* val = tv->Lookup(key);
+					auto val = tv->Lookup(key);
-					sz = SingleTypeKeySize(val->Type(), val, type_check, sz,
+					sz = SingleTypeKeySize(val->Type(), val.get(), type_check, sz,
 					                       false, calc_static_size);
 					if ( ! sz )
 						{
@@ -720,19 +721,19 @@ int CompositeHash::SizeAlign(int offset, unsigned int size) const
 	return offset;
 	}
 
-ListVal* CompositeHash::RecoverVals(const HashKey* k) const
+IntrusivePtr<ListVal> CompositeHash::RecoverVals(const HashKey* k) const
 	{
-	ListVal* l = new ListVal(TYPE_ANY);
+	auto l = make_intrusive<ListVal>(TYPE_ANY);
 	const type_list* tl = type->Types();
 	const char* kp = (const char*) k->Key();
 	const char* const k_end = kp + k->Size();
 
 	for ( const auto& type : *tl )
 		{
-		Val* v = nullptr;
+		IntrusivePtr<Val> v;
-		kp = RecoverOneVal(k, kp, k_end, type, v, false);
+		kp = RecoverOneVal(k, kp, k_end, type, &v, false);
 		ASSERT(v);
-		l->Append(v);
+		l->Append(v.release());
 		}
 
 	if ( kp != k_end )
@@ -743,7 +744,7 @@ ListVal* CompositeHash::RecoverVals(const HashKey* k) const
 
 const char* CompositeHash::RecoverOneVal(const HashKey* k, const char* kp0,
 					 const char* const k_end, BroType* t,
-					 Val*& pval, bool optional) const
+					 IntrusivePtr<Val>* pval, bool optional) const
 	{
 	// k->Size() == 0 for a single empty string.
 	if ( kp0 >= k_end && k->Size() > 0 )
@@ -760,7 +761,7 @@ const char* CompositeHash::RecoverOneVal(const HashKey* k, const char* kp0,
 
 		if ( ! *kp )
 			{
-			pval = 0;
+			*pval = nullptr;
 			return kp0;
 			}
 		}
@@ -772,15 +773,15 @@ const char* CompositeHash::RecoverOneVal(const HashKey* k, const char* kp0,
 		kp1 = reinterpret_cast<const char*>(kp+1);
 
 		if ( tag == TYPE_ENUM )
-			pval = t->AsEnumType()->GetVal(*kp);
+			*pval = t->AsEnumType()->GetVal(*kp);
 		else if ( tag == TYPE_BOOL )
-			pval = val_mgr->GetBool(*kp);
+			*pval = {AdoptRef{}, val_mgr->GetBool(*kp)};
 		else if ( tag == TYPE_INT )
-			pval = val_mgr->GetInt(*kp);
+			*pval = {AdoptRef{}, val_mgr->GetInt(*kp)};
 		else
 			{
 			reporter->InternalError("bad internal unsigned int in CompositeHash::RecoverOneVal()");
-			pval = 0;
+			*pval = nullptr;
 			}
 		}
 		break;
@@ -793,16 +794,16 @@ const char* CompositeHash::RecoverOneVal(const HashKey* k, const char* kp0,
 		switch ( tag ) {
 		case TYPE_COUNT:
 		case TYPE_COUNTER:
-			pval = val_mgr->GetCount(*kp);
+			*pval = {AdoptRef{}, val_mgr->GetCount(*kp)};
 			break;
 
 		case TYPE_PORT:
-			pval = val_mgr->GetPort(*kp);
+			*pval = {AdoptRef{}, val_mgr->GetPort(*kp)};
 			break;
 
 		default:
 			reporter->InternalError("bad internal unsigned int in CompositeHash::RecoverOneVal()");
-			pval = 0;
+			*pval = nullptr;
 			break;
 		}
 		}
@@ -814,9 +815,9 @@ const char* CompositeHash::RecoverOneVal(const HashKey* k, const char* kp0,
 		kp1 = reinterpret_cast<const char*>(kp+1);
 
 		if ( tag == TYPE_INTERVAL )
-			pval = new IntervalVal(*kp, 1.0);
+			*pval = make_intrusive<IntervalVal>(*kp, 1.0);
 		else
-			pval = new Val(*kp, tag);
+			*pval = make_intrusive<Val>(*kp, tag);
 		}
 		break;
 
@@ -829,12 +830,12 @@ const char* CompositeHash::RecoverOneVal(const HashKey* k, const char* kp0,
 
 		switch ( tag ) {
 		case TYPE_ADDR:
-			pval = new AddrVal(addr);
+			*pval = make_intrusive<AddrVal>(addr);
 			break;
 
 		default:
 			reporter->InternalError("bad internal address in CompositeHash::RecoverOneVal()");
-			pval = 0;
+			*pval = nullptr;
 			break;
 		}
 		}
@@ -844,7 +845,7 @@ const char* CompositeHash::RecoverOneVal(const HashKey* k, const char* kp0,
 		{
 		const uint32_t* const kp = AlignType<uint32_t>(kp0);
 		kp1 = reinterpret_cast<const char*>(kp+5);
-		pval = new SubNetVal(kp, kp[4]);
+		*pval = make_intrusive<SubNetVal>(kp, kp[4]);
 		}
 		break;
 
@@ -862,20 +863,19 @@ const char* CompositeHash::RecoverOneVal(const HashKey* k, const char* kp0,
 			if ( ! f )
 				reporter->InternalError("failed to look up unique function id %" PRIu32 " in CompositeHash::RecoverOneVal()", *kp);
 
-			pval = new Val(f);
+			*pval = make_intrusive<Val>(f);
+			auto pvt = (*pval)->Type();
 
-			if ( ! pval->Type() )
+			if ( ! pvt )
 				reporter->InternalError("bad aggregate Val in CompositeHash::RecoverOneVal()");
 
-			else if ( t->Tag() != TYPE_FUNC &&
+			else if ( t->Tag() != TYPE_FUNC && ! same_type(pvt, t) )
-				  ! same_type(pval->Type(), t) )
 				// ### Maybe fix later, but may be fundamentally
 				// un-checkable --US
 				reporter->InternalError("inconsistent aggregate Val in CompositeHash::RecoverOneVal()");
 
 			// ### A crude approximation for now.
-			else if ( t->Tag() == TYPE_FUNC &&
+			else if ( t->Tag() == TYPE_FUNC && pvt->Tag() != TYPE_FUNC )
-				  pval->Type()->Tag() != TYPE_FUNC )
 				reporter->InternalError("inconsistent aggregate Val in CompositeHash::RecoverOneVal()");
 			}
 			break;
@@ -898,7 +898,7 @@ const char* CompositeHash::RecoverOneVal(const HashKey* k, const char* kp0,
 				re = new RE_Matcher(kp1, kp1 + len[0]);
 				kp1 += len[0] + len[1];
 				}
-			pval = new PatternVal(re);
+			*pval = make_intrusive<PatternVal>(re);
 			}
 			break;
 
@@ -912,13 +912,13 @@ const char* CompositeHash::RecoverOneVal(const HashKey* k, const char* kp0,
 			int i;
 			for ( i = 0; i < num_fields; ++i )
 				{
-				Val* v;
+				IntrusivePtr<Val> v;
 
-				Attributes* a = rt->FieldDecl(i)->attrs;
+				Attributes* a = rt->FieldDecl(i)->attrs.get();
 				bool optional = (a && a->FindAttr(ATTR_OPTIONAL));
 
 				kp = RecoverOneVal(k, kp, k_end,
-				                   rt->FieldType(i), v, optional);
+				                   rt->FieldType(i), &v, optional);
 
 				// An earlier call to reporter->InternalError would have called abort() and broken the
 				// call tree that clang-tidy is relying on to get the error described.
@@ -926,21 +926,21 @@ const char* CompositeHash::RecoverOneVal(const HashKey* k, const char* kp0,
 				if ( ! (v || optional) )
 					{
 					reporter->InternalError("didn't recover expected number of fields from HashKey");
-					pval = 0;
+					pval = nullptr;
 					break;
 					}
 
-				values.push_back(v);
+				values.push_back(v.release());
 				}
 
 			ASSERT(int(values.size()) == num_fields);
 
-			RecordVal* rv = new RecordVal(rt);
+			auto rv = make_intrusive<RecordVal>(rt);
 
 			for ( int i = 0; i < num_fields; ++i )
 				rv->Assign(i, values[i]);
 
-			pval = rv;
+			*pval = std::move(rv);
 			kp1 = kp;
 			}
 			break;
@@ -952,29 +952,25 @@ const char* CompositeHash::RecoverOneVal(const HashKey* k, const char* kp0,
 			n = *kp;
 			kp1 = reinterpret_cast<const char*>(kp+1);
 			TableType* tt = t->AsTableType();
-			TableVal* tv = new TableVal(tt);
+			auto tv = make_intrusive<TableVal>(IntrusivePtr{NewRef{}, tt});
-			vector<Val*> keys, values;
+
 			for ( int i = 0; i < n; ++i )
 				{
-				Val* key;
+				IntrusivePtr<Val> key;
-				kp1 = RecoverOneVal(k, kp1, k_end, tt->Indices(), key, false);
+				kp1 = RecoverOneVal(k, kp1, k_end, tt->Indices(), &key, false);
-				keys.push_back(key);
+
-				if ( ! t->IsSet() )
+				if ( t->IsSet() )
+					tv->Assign(key.get(), nullptr);
+				else
 					{
-					Val* value;
+					IntrusivePtr<Val> value;
-					kp1 = RecoverOneVal(k, kp1, k_end, tt->YieldType(), value,
+					kp1 = RecoverOneVal(k, kp1, k_end, tt->YieldType(), &value,
 					                    false);
-					values.push_back(value);
+					tv->Assign(key.get(), std::move(value));
 					}
 				}
 
-			for ( int i = 0; i < n; ++i )
+			*pval = std::move(tv);
-				{
-				tv->Assign(keys[i], t->IsSet() ? 0 : values[i]);
-				Unref(keys[i]);
-				}
-
-			pval = tv;
 			}
 			break;
 
@@ -985,7 +981,8 @@ const char* CompositeHash::RecoverOneVal(const HashKey* k, const char* kp0,
 			n = *kp;
 			kp1 = reinterpret_cast<const char*>(kp+1);
 			VectorType* vt = t->AsVectorType();
-			VectorVal* vv = new VectorVal(vt);
+			auto vv = make_intrusive<VectorVal>(vt);
+
 			for ( unsigned int i = 0; i < n; ++i )
 				{
 				kp = AlignType<unsigned int>(kp1);
@@ -994,14 +991,16 @@ const char* CompositeHash::RecoverOneVal(const HashKey* k, const char* kp0,
 				kp = AlignType<unsigned int>(kp1);
 				unsigned int have_val = *kp;
 				kp1 = reinterpret_cast<const char*>(kp+1);
-				Val* value = 0;
+				IntrusivePtr<Val> value;
+
 				if ( have_val )
-					kp1 = RecoverOneVal(k, kp1, k_end, vt->YieldType(), value,
+					kp1 = RecoverOneVal(k, kp1, k_end, vt->YieldType(), &value,
 					                    false);
-				vv->Assign(index, value);
+
+				vv->Assign(index, std::move(value));
 				}
 
-			pval = vv;
+			*pval = std::move(vv);
 			}
 			break;
 
@@ -1012,16 +1011,17 @@ const char* CompositeHash::RecoverOneVal(const HashKey* k, const char* kp0,
 			n = *kp;
 			kp1 = reinterpret_cast<const char*>(kp+1);
 			TypeList* tl = t->AsTypeList();
-			ListVal* lv = new ListVal(TYPE_ANY);
+			auto lv = make_intrusive<ListVal>(TYPE_ANY);
+
 			for ( int i = 0; i < n; ++i )
 				{
-				Val* v;
+				IntrusivePtr<Val> v;
 				BroType* it = (*tl->Types())[i];
-				kp1 = RecoverOneVal(k, kp1, k_end, it, v, false);
+				kp1 = RecoverOneVal(k, kp1, k_end, it, &v, false);
-				lv->Append(v);
+				lv->Append(v.release());
 				}
 
-			pval = lv;
+			*pval = std::move(lv);
 			}
 			break;
 
@@ -1051,7 +1051,7 @@ const char* CompositeHash::RecoverOneVal(const HashKey* k, const char* kp0,
 			kp1 = reinterpret_cast<const char*>(kp+1);
 			}
 
-		pval = new StringVal(new BroString((const byte_vec) kp1, n, 1));
+		*pval = make_intrusive<StringVal>(new BroString((const byte_vec) kp1, n, 1));
 		kp1 += n;
 		}
 		break;

src/CompHash.h

@@ -18,7 +18,7 @@ public:
 	HashKey* ComputeHash(const Val* v, int type_check) const;
 
 	// Given a hash key, recover the values used to create it.
-	ListVal* RecoverVals(const HashKey* k) const;
+	IntrusivePtr<ListVal> RecoverVals(const HashKey* k) const;
 
 	unsigned int MemoryAllocation() const { return padded_sizeof(*this) + pad_size(size); }
 
@@ -36,7 +36,7 @@ protected:
 	// upon errors, so there is no return value for invalid input.
 	const char* RecoverOneVal(const HashKey* k,
 				  const char* kp, const char* const k_end,
-				  BroType* t, Val*& pval, bool optional) const;
+				  BroType* t, IntrusivePtr<Val>* pval, bool optional) const;
 
 	// Rounds the given pointer up to the nearest multiple of the
 	// given size, if not already a multiple.

src/Conn.cc

@@ -337,13 +337,13 @@ RecordVal* Connection::BuildConnVal()
 
 		TransportProto prot_type = ConnTransport();
 
-		RecordVal* id_val = new RecordVal(conn_id);
+		auto id_val = make_intrusive<RecordVal>(conn_id);
-		id_val->Assign(0, new AddrVal(orig_addr));
+		id_val->Assign(0, make_intrusive<AddrVal>(orig_addr));
 		id_val->Assign(1, val_mgr->GetPort(ntohs(orig_port), prot_type));
-		id_val->Assign(2, new AddrVal(resp_addr));
+		id_val->Assign(2, make_intrusive<AddrVal>(resp_addr));
 		id_val->Assign(3, val_mgr->GetPort(ntohs(resp_port), prot_type));
 
-		RecordVal* orig_endp = new RecordVal(endpoint);
+		auto orig_endp = make_intrusive<RecordVal>(endpoint);
 		orig_endp->Assign(0, val_mgr->GetCount(0));
 		orig_endp->Assign(1, val_mgr->GetCount(0));
 		orig_endp->Assign(4, val_mgr->GetCount(orig_flow_label));
@@ -352,27 +352,27 @@ RecordVal* Connection::BuildConnVal()
 		char null[l2_len]{};
 
 		if ( memcmp(&orig_l2_addr, &null, l2_len) != 0 )
-			orig_endp->Assign(5, new StringVal(fmt_mac(orig_l2_addr, l2_len)));
+			orig_endp->Assign(5, make_intrusive<StringVal>(fmt_mac(orig_l2_addr, l2_len)));
 
-		RecordVal* resp_endp = new RecordVal(endpoint);
+		auto resp_endp = make_intrusive<RecordVal>(endpoint);
 		resp_endp->Assign(0, val_mgr->GetCount(0));
 		resp_endp->Assign(1, val_mgr->GetCount(0));
 		resp_endp->Assign(4, val_mgr->GetCount(resp_flow_label));
 
 		if ( memcmp(&resp_l2_addr, &null, l2_len) != 0 )
-			resp_endp->Assign(5, new StringVal(fmt_mac(resp_l2_addr, l2_len)));
+			resp_endp->Assign(5, make_intrusive<StringVal>(fmt_mac(resp_l2_addr, l2_len)));
 
-		conn_val->Assign(0, id_val);
+		conn_val->Assign(0, std::move(id_val));
-		conn_val->Assign(1, orig_endp);
+		conn_val->Assign(1, std::move(orig_endp));
-		conn_val->Assign(2, resp_endp);
+		conn_val->Assign(2, std::move(resp_endp));
 		// 3 and 4 are set below.
-		conn_val->Assign(5, new TableVal(string_set));	// service
+		conn_val->Assign(5, make_intrusive<TableVal>(IntrusivePtr{NewRef{}, string_set}));	// service
 		conn_val->Assign(6, val_mgr->GetEmptyString());	// history
 
 		if ( ! uid )
 			uid.Set(bits_per_uid);
 
-		conn_val->Assign(7, new StringVal(uid.Base62("C").c_str()));
+		conn_val->Assign(7, make_intrusive<StringVal>(uid.Base62("C").c_str()));
 
 		if ( encapsulation && encapsulation->Depth() > 0 )
 			conn_val->Assign(8, encapsulation->GetVectorVal());
@@ -388,9 +388,9 @@ RecordVal* Connection::BuildConnVal()
 	if ( root_analyzer )
 		root_analyzer->UpdateConnVal(conn_val);
 
-	conn_val->Assign(3, new Val(start_time, TYPE_TIME));	// ###
+	conn_val->Assign(3, make_intrusive<Val>(start_time, TYPE_TIME));	// ###
-	conn_val->Assign(4, new Val(last_time - start_time, TYPE_INTERVAL));
+	conn_val->Assign(4, make_intrusive<Val>(last_time - start_time, TYPE_INTERVAL));
-	conn_val->Assign(6, new StringVal(history.c_str()));
+	conn_val->Assign(6, make_intrusive<StringVal>(history.c_str()));
 	conn_val->Assign(11, val_mgr->GetBool(is_successful));
 
 	conn_val->SetOrigin(this);
@@ -422,7 +422,7 @@ void Connection::AppendAddl(const char* str)
 	const char* old = conn_val->Lookup(6)->AsString()->CheckString();
 	const char* format = *old ? "%s %s" : "%s%s";
 
-	conn_val->Assign(6, new StringVal(fmt(format, old, str)));
+	conn_val->Assign(6, make_intrusive<StringVal>(fmt(format, old, str)));
 	}
 
 // Returns true if the character at s separates a version number.

src/DNS_Mgr.cc

@@ -32,11 +32,13 @@
 #include <algorithm>
 
 #include "BroString.h"
+#include "Expr.h"
 #include "Event.h"
 #include "Net.h"
 #include "Val.h"
 #include "Var.h"
 #include "Reporter.h"
+#include "IntrusivePtr.h"
 #include "iosource/Manager.h"
 #include "digest.h"
 
@@ -118,9 +120,9 @@ public:
 		return req_host ? req_host : req_addr.AsString();
 		}
 
-	ListVal* Addrs();
+	IntrusivePtr<ListVal> Addrs();
-	TableVal* AddrsSet();	// addresses returned as a set
+	IntrusivePtr<TableVal> AddrsSet();	// addresses returned as a set
-	StringVal* Host();
+	IntrusivePtr<StringVal> Host();
 
 	double CreationTime() const	{ return creation_time; }
 
@@ -154,11 +156,11 @@ protected:
 
 	int num_names;
 	char** names;
-	StringVal* host_val;
+	IntrusivePtr<StringVal> host_val;
 
 	int num_addrs;
 	IPAddr* addrs;
-	ListVal* addrs_val;
+	IntrusivePtr<ListVal> addrs_val;
 
 	int failed;
 	double creation_time;
@@ -170,13 +172,13 @@ void DNS_Mgr_mapping_delete_func(void* v)
 	delete (DNS_Mapping*) v;
 	}
 
-static TableVal* empty_addr_set()
+static IntrusivePtr<TableVal> empty_addr_set()
 	{
-	BroType* addr_t = base_type(TYPE_ADDR);
+	auto addr_t = base_type(TYPE_ADDR);
-	TypeList* set_index = new TypeList(addr_t);
+	auto set_index = make_intrusive<TypeList>(addr_t);
-	set_index->Append(addr_t);
+	set_index->Append(std::move(addr_t));
-	SetType* s = new SetType(set_index, 0);
+	auto s = make_intrusive<SetType>(std::move(set_index), nullptr);
-	return new TableVal(s);
+	return make_intrusive<TableVal>(std::move(s));
 	}
 
 DNS_Mapping::DNS_Mapping(const char* host, struct hostent* h, uint32_t ttl)
@@ -268,48 +270,41 @@ DNS_Mapping::~DNS_Mapping()
 		}
 
 	delete [] addrs;
-
-	Unref(host_val);
-	Unref(addrs_val);
 	}
 
-ListVal* DNS_Mapping::Addrs()
+IntrusivePtr<ListVal> DNS_Mapping::Addrs()
 	{
 	if ( failed )
-		return 0;
+		return nullptr;
 
 	if ( ! addrs_val )
 		{
-		ListVal* hv = new ListVal(TYPE_ADDR);
+		auto addrs_val = make_intrusive<ListVal>(TYPE_ADDR);
+
 		for ( int i = 0; i < num_addrs; ++i )
-			hv->Append(new AddrVal(addrs[i]));
+			addrs_val->Append(new AddrVal(addrs[i]));
-		addrs_val = hv;
 		}
 
-	Ref(addrs_val);
 	return addrs_val;
 	}
 
-TableVal* DNS_Mapping::AddrsSet() {
+IntrusivePtr<TableVal> DNS_Mapping::AddrsSet() {
-	ListVal* l = Addrs();
+	auto l = Addrs();
 
 	if ( ! l )
 		return empty_addr_set();
 
-	auto rval = l->ConvertToSet();
+	return {AdoptRef{}, l->ConvertToSet()};
-	Unref(l);
-	return rval;
 	}
 
-StringVal* DNS_Mapping::Host()
+IntrusivePtr<StringVal> DNS_Mapping::Host()
 	{
 	if ( failed || num_names == 0 || ! names[0] )
 		return 0;
 
 	if ( ! host_val )
-		host_val = new StringVal(names[0]);
+		host_val = make_intrusive<StringVal>(names[0]);
 
-	Ref(host_val);
 	return host_val;
 	}
 
@@ -475,16 +470,14 @@ void DNS_Mgr::InitPostScript()
 	LoadCache(fopen(cache_name, "r"));
 	}
 
-static TableVal* fake_name_lookup_result(const char* name)
+static IntrusivePtr<TableVal> fake_name_lookup_result(const char* name)
 	{
 	uint32_t hash[4];
 	internal_md5(reinterpret_cast<const u_char*>(name), strlen(name),
 	    reinterpret_cast<u_char*>(hash));
-	ListVal* hv = new ListVal(TYPE_ADDR);
+	auto hv = make_intrusive<ListVal>(TYPE_ADDR);
 	hv->Append(new AddrVal(hash));
-	TableVal* tv = hv->ConvertToSet();
+	return {AdoptRef{}, hv->ConvertToSet()};
-	Unref(hv);
-	return tv;
 	}
 
 static const char* fake_text_lookup_result(const char* name)
@@ -502,7 +495,7 @@ static const char* fake_addr_lookup_result(const IPAddr& addr)
 	return tmp;
 	}
 
-TableVal* DNS_Mgr::LookupHost(const char* name)
+IntrusivePtr<TableVal> DNS_Mgr::LookupHost(const char* name)
 	{
 	if ( mode == DNS_FAKE )
 		return fake_name_lookup_result(name);
@@ -528,10 +521,9 @@ TableVal* DNS_Mgr::LookupHost(const char* name)
 				}
 			else if ( d4 && d6 )
 				{
-				TableVal* tv4 = d4->AddrsSet();
+				auto tv4 = d4->AddrsSet();
-				TableVal* tv6 = d6->AddrsSet();
+				auto tv6 = d6->AddrsSet();
-				tv4->AddTo(tv6, false);
+				tv4->AddTo(tv6.get(), false);
-				Unref(tv4);
 				return tv6;
 				}
 			}
@@ -560,7 +552,7 @@ TableVal* DNS_Mgr::LookupHost(const char* name)
 	}
 	}
 
-Val* DNS_Mgr::LookupAddr(const IPAddr& addr)
+IntrusivePtr<Val> DNS_Mgr::LookupAddr(const IPAddr& addr)
 	{
 	InitSource();
 
@@ -577,7 +569,7 @@ Val* DNS_Mgr::LookupAddr(const IPAddr& addr)
 				{
 				string s(addr);
 				reporter->Warning("can't resolve IP address: %s", s.c_str());
-				return new StringVal(s.c_str());
+				return make_intrusive<StringVal>(s.c_str());
 				}
 			}
 		}
@@ -586,7 +578,7 @@ Val* DNS_Mgr::LookupAddr(const IPAddr& addr)
 	switch ( mode ) {
 	case DNS_PRIME:
 		requests.push_back(new DNS_Mgr_Request(addr));
-		return new StringVal("<none>");
+		return make_intrusive<StringVal>("<none>");
 
 	case DNS_FORCE:
 		reporter->FatalError("can't find DNS entry for %s in cache",
@@ -712,19 +704,17 @@ void DNS_Mgr::Event(EventHandlerPtr e, DNS_Mapping* dm)
 	if ( ! e )
 		return;
 
-	mgr.QueueEventFast(e, {BuildMappingVal(dm)});
+	mgr.QueueEventFast(e, {BuildMappingVal(dm).release()});
 	}
 
-void DNS_Mgr::Event(EventHandlerPtr e, DNS_Mapping* dm, ListVal* l1, ListVal* l2)
+void DNS_Mgr::Event(EventHandlerPtr e, DNS_Mapping* dm,
+					IntrusivePtr<ListVal> l1, IntrusivePtr<ListVal> l2)
 	{
 	if ( ! e )
 		return;
 
-	Unref(l1);
-	Unref(l2);
-
 	mgr.QueueEventFast(e, {
-		BuildMappingVal(dm),
+		BuildMappingVal(dm).release(),
 		l1->ConvertToSet(),
 		l2->ConvertToSet(),
 	});
@@ -736,22 +726,22 @@ void DNS_Mgr::Event(EventHandlerPtr e, DNS_Mapping* old_dm, DNS_Mapping* new_dm)
 		return;
 
 	mgr.QueueEventFast(e, {
-		BuildMappingVal(old_dm),
+		BuildMappingVal(old_dm).release(),
-		BuildMappingVal(new_dm),
+		BuildMappingVal(new_dm).release(),
 	});
 	}
 
-Val* DNS_Mgr::BuildMappingVal(DNS_Mapping* dm)
+IntrusivePtr<Val> DNS_Mgr::BuildMappingVal(DNS_Mapping* dm)
 	{
-	RecordVal* r = new RecordVal(dm_rec);
+	auto r = make_intrusive<RecordVal>(dm_rec);
 
-	r->Assign(0, new Val(dm->CreationTime(), TYPE_TIME));
+	r->Assign(0, make_intrusive<Val>(dm->CreationTime(), TYPE_TIME));
-	r->Assign(1, new StringVal(dm->ReqHost() ? dm->ReqHost() : ""));
+	r->Assign(1, make_intrusive<StringVal>(dm->ReqHost() ? dm->ReqHost() : ""));
-	r->Assign(2, new AddrVal(dm->ReqAddr()));
+	r->Assign(2, make_intrusive<AddrVal>(dm->ReqAddr()));
 	r->Assign(3, val_mgr->GetBool(dm->Valid()));
 
-	Val* h = dm->Host();
+	auto h = dm->Host();
-	r->Assign(4, h ? h : new StringVal("<none>"));
+	r->Assign(4, h ? h.release() : new StringVal("<none>"));
 	r->Assign(5, dm->AddrsSet());
 
 	return r;
@@ -868,8 +858,8 @@ void DNS_Mgr::CompareMappings(DNS_Mapping* prev_dm, DNS_Mapping* new_dm)
 		return;
 		}
 
-	StringVal* prev_s = prev_dm->Host();
+	auto prev_s = prev_dm->Host();
-	StringVal* new_s = new_dm->Host();
+	auto new_s = new_dm->Host();
 
 	if ( prev_s || new_s )
 		{
@@ -879,13 +869,10 @@ void DNS_Mgr::CompareMappings(DNS_Mapping* prev_dm, DNS_Mapping* new_dm)
 			Event(dns_mapping_lost_name, prev_dm);
 		else if ( ! Bstr_eq(new_s->AsString(), prev_s->AsString()) )
 			Event(dns_mapping_name_changed, prev_dm, new_dm);
-
-		Unref(prev_s);
-		Unref(new_s);
 		}
 
-	ListVal* prev_a = prev_dm->Addrs();
+	auto prev_a = prev_dm->Addrs();
-	ListVal* new_a = new_dm->Addrs();
+	auto new_a = new_dm->Addrs();
 
 	if ( ! prev_a || ! new_a )
 		{
@@ -893,21 +880,16 @@ void DNS_Mgr::CompareMappings(DNS_Mapping* prev_dm, DNS_Mapping* new_dm)
 		return;
 		}
 
-	ListVal* prev_delta = AddrListDelta(prev_a, new_a);
+	auto prev_delta = AddrListDelta(prev_a.get(), new_a.get());
-	ListVal* new_delta = AddrListDelta(new_a, prev_a);
+	auto new_delta = AddrListDelta(new_a.get(), prev_a.get());
 
 	if ( prev_delta->Length() > 0 || new_delta->Length() > 0 )
-		Event(dns_mapping_altered, new_dm, prev_delta, new_delta);
+		Event(dns_mapping_altered, new_dm, std::move(prev_delta), std::move(new_delta));
-	else
-		{
-		Unref(prev_delta);
-		Unref(new_delta);
-		}
 	}
 
-ListVal* DNS_Mgr::AddrListDelta(ListVal* al1, ListVal* al2)
+IntrusivePtr<ListVal> DNS_Mgr::AddrListDelta(ListVal* al1, ListVal* al2)
 	{
-	ListVal* delta = new ListVal(TYPE_ADDR);
+	auto delta = make_intrusive<ListVal>(TYPE_ADDR);
 
 	for ( int i = 0; i < al1->Length(); ++i )
 		{
@@ -1015,7 +997,7 @@ const char* DNS_Mgr::LookupAddrInCache(const IPAddr& addr)
 	return d->names ? d->names[0] : "<\?\?\?>";
 	}
 
-TableVal* DNS_Mgr::LookupNameInCache(const string& name)
+IntrusivePtr<TableVal> DNS_Mgr::LookupNameInCache(const string& name)
 	{
 	HostMap::iterator it = host_mappings.find(name);
 	if ( it == host_mappings.end() )
@@ -1038,10 +1020,9 @@ TableVal* DNS_Mgr::LookupNameInCache(const string& name)
 		return 0;
 		}
 
-	TableVal* tv4 = d4->AddrsSet();
+	auto tv4 = d4->AddrsSet();
-	TableVal* tv6 = d6->AddrsSet();
+	auto tv6 = d6->AddrsSet();
-	tv4->AddTo(tv6, false);
+	tv4->AddTo(tv6.get(), false);
-	Unref(tv4);
 	return tv6;
 	}
 
@@ -1066,10 +1047,9 @@ const char* DNS_Mgr::LookupTextInCache(const string& name)
 	}
 
 static void resolve_lookup_cb(DNS_Mgr::LookupCallback* callback,
-                              TableVal* result)
+                              IntrusivePtr<TableVal> result)
 	{
-	callback->Resolved(result);
+	callback->Resolved(result.get());
-	Unref(result);
 	delete callback;
 	}
 
@@ -1129,10 +1109,10 @@ void DNS_Mgr::AsyncLookupName(const string& name, LookupCallback* callback)
 		}
 
 	// Do we already know the answer?
-	TableVal* addrs = LookupNameInCache(name);
+	auto addrs = LookupNameInCache(name);
 	if ( addrs )
 		{
-		resolve_lookup_cb(callback, addrs);
+		resolve_lookup_cb(callback, std::move(addrs));
 		return;
 		}
 
@@ -1321,13 +1301,12 @@ void DNS_Mgr::CheckAsyncHostRequest(const char* host, bool timeout)
 
 	if ( i != asyncs_names.end() )
 		{
-		TableVal* addrs = LookupNameInCache(host);
+		auto addrs = LookupNameInCache(host);
 
 		if ( addrs )
 			{
 			++successful;
-			i->second->Resolved(addrs);
+			i->second->Resolved(addrs.get());
-			Unref(addrs);
 			}
 
 		else if ( timeout )

src/DNS_Mgr.h

@@ -12,6 +12,7 @@
 #include "iosource/IOSource.h"
 #include "IPAddr.h"
 
+template <class T> class IntrusivePtr;
 class Val;
 class ListVal;
 class TableVal;
@@ -47,9 +48,9 @@ public:
 
 	// Looks up the address or addresses of the given host, and returns
 	// a set of addr.
-	TableVal* LookupHost(const char* host);
+	IntrusivePtr<TableVal> LookupHost(const char* host);
 
-	Val* LookupAddr(const IPAddr& addr);
+	IntrusivePtr<Val> LookupAddr(const IPAddr& addr);
 
 	// Define the directory where to store the data.
 	void SetDir(const char* arg_dir)	{ dir = copy_string(arg_dir); }
@@ -59,7 +60,7 @@ public:
 	int Save();
 
 	const char* LookupAddrInCache(const IPAddr& addr);
-	TableVal* LookupNameInCache(const string& name);
+	IntrusivePtr<TableVal> LookupNameInCache(const string& name);
 	const char* LookupTextInCache(const string& name);
 
 	// Support for async lookups.
@@ -96,14 +97,15 @@ protected:
 	friend class DNS_Mgr_Request;
 
 	void Event(EventHandlerPtr e, DNS_Mapping* dm);
-	void Event(EventHandlerPtr e, DNS_Mapping* dm, ListVal* l1, ListVal* l2);
+	void Event(EventHandlerPtr e, DNS_Mapping* dm,
+	           IntrusivePtr<ListVal> l1, IntrusivePtr<ListVal> l2);
 	void Event(EventHandlerPtr e, DNS_Mapping* old_dm, DNS_Mapping* new_dm);
 
-	Val* BuildMappingVal(DNS_Mapping* dm);
+	IntrusivePtr<Val> BuildMappingVal(DNS_Mapping* dm);
 
 	void AddResult(DNS_Mgr_Request* dr, struct nb_dns_result* r);
 	void CompareMappings(DNS_Mapping* prev_dm, DNS_Mapping* new_dm);
-	ListVal* AddrListDelta(ListVal* al1, ListVal* al2);
+	IntrusivePtr<ListVal> AddrListDelta(ListVal* al1, ListVal* al2);
 	void DumpAddrList(FILE* f, ListVal* al);
 
 	typedef map<string, pair<DNS_Mapping*, DNS_Mapping*> > HostMap;

src/Debug.cc

@@ -234,7 +234,7 @@ static void parse_function_name(vector<ParseLocationRec>& result,
 	Stmt* body = 0;	// the particular body we care about; 0 = all
 
 	if ( bodies.size() == 1 )
-		body = bodies[0].stmts;
+		body = bodies[0].stmts.get();
 	else
 		{
 		while ( 1 )
@@ -245,8 +245,7 @@ static void parse_function_name(vector<ParseLocationRec>& result,
 				{
 				Stmt* first;
 				Location stmt_loc;
-				get_first_statement(bodies[i].stmts, first,
+				get_first_statement(bodies[i].stmts.get(), first, stmt_loc);
-							stmt_loc);
 				debug_msg("[%d] %s:%d\n", i+1, stmt_loc.filename, stmt_loc.first_line);
 				}
 
@@ -278,7 +277,7 @@ static void parse_function_name(vector<ParseLocationRec>& result,
 			int option = atoi(input.c_str());
 			if ( option > 0 && option <= (int) bodies.size() )
 				{
-				body = bodies[option - 1].stmts;
+				body = bodies[option - 1].stmts.get();
 				break;
 				}
 			}
@@ -308,7 +307,7 @@ static void parse_function_name(vector<ParseLocationRec>& result,
 
 		for ( unsigned int i = 0; i < bodies.size(); ++i )
 			{
-			get_first_statement(bodies[i].stmts, first, stmt_loc);
+			get_first_statement(bodies[i].stmts.get(), first, stmt_loc);
 			if ( ! first )
 				continue;
 

src/DebugCmds.cc

@@ -62,7 +62,7 @@ void lookup_global_symbols_regex(const string& orig_regex, vector<ID*>& matches,
 	ID* nextid;
 	for ( const auto& sym : syms )
 		{
-		ID* nextid = sym.second;
+		ID* nextid = sym.second.get();
 		if ( ! func_only || nextid->Type()->Tag() == TYPE_FUNC )
 			if ( ! regexec (&re, nextid->Name(), 0, 0, 0) )
 				matches.push_back(nextid);

src/EventHandler.cc

@@ -114,7 +114,7 @@ void EventHandler::Call(val_list* vl, bool no_remote)
 
 	if ( local )
 		// No try/catch here; we pass exceptions upstream.
-		Unref(local->Call(vl));
+		local->Call(vl);
 	else
 		{
 		for ( auto v : *vl )
@@ -138,21 +138,18 @@ void EventHandler::NewEvent(val_list* vl)
 		{
 		const char* fname = args->FieldName(i);
 		BroType* ftype = args->FieldType(i);
-		Val* fdefault = args->FieldDefault(i);
+		auto fdefault = args->FieldDefault(i);
 
-		RecordVal* rec = new RecordVal(call_argument);
+		auto rec = make_intrusive<RecordVal>(call_argument);
-		rec->Assign(0, new StringVal(fname));
+		rec->Assign(0, make_intrusive<StringVal>(fname));
 
 		ODesc d;
 		d.SetShort();
 		ftype->Describe(&d);
-		rec->Assign(1, new StringVal(d.Description()));
+		rec->Assign(1, make_intrusive<StringVal>(d.Description()));
 
 		if ( fdefault )
-			{
+			rec->Assign(2, std::move(fdefault));
-			Ref(fdefault);
-			rec->Assign(2, fdefault);
-			}
 
 		if ( i < vl->length() && (*vl)[i] )
 			{
@@ -161,7 +158,7 @@ void EventHandler::NewEvent(val_list* vl)
 			rec->Assign(3, val);
 			}
 
-		vargs->Assign(i, rec);
+		vargs->Assign(i, std::move(rec));
 		}
 
 	Event* ev = new Event(new_event, {

src/Expr.h

@@ -8,6 +8,7 @@
 #include "Type.h"
 #include "EventHandler.h"
 #include "TraverseTypes.h"
+#include "Val.h"
 
 #include <memory>
 #include <string>
@@ -924,7 +925,13 @@ IntrusivePtr<Expr> get_assign_expr(IntrusivePtr<Expr> op1,
 // types or a single type.
 //
 // Note, the type is not "const" because it can be ref'd.
-extern int check_and_promote_expr(Expr*& e, BroType* t);
+
+/**
+ * Returns nullptr if the expression cannot match or a promoted
+ * expression.
+ */
+extern IntrusivePtr<Expr> check_and_promote_expr(Expr* e, BroType* t);
+
 extern int check_and_promote_exprs(ListExpr* elements, TypeList* types);
 extern int check_and_promote_args(ListExpr* args, RecordType* types);
 extern int check_and_promote_exprs_to_type(ListExpr* elements, BroType* type);

src/File.cc

@@ -71,13 +71,13 @@ BroFile::BroFile(FILE* arg_f, const char* arg_name, const char* arg_access)
 	is_open = (f != 0);
 	}
 
-BroFile::BroFile(const char* arg_name, const char* arg_access, BroType* arg_t)
+BroFile::BroFile(const char* arg_name, const char* arg_access)
 	{
 	Init();
 	f = 0;
 	name = copy_string(arg_name);
 	access = copy_string(arg_access);
-	t = arg_t ? arg_t : base_type(TYPE_STRING);
+	t = base_type(TYPE_STRING);
 
 	if ( streq(name, "/dev/stdin") )
 		f = stdin;
@@ -154,7 +154,6 @@ bool BroFile::Open(FILE* file, const char* mode)
 BroFile::~BroFile()
 	{
 	Close();
-	Unref(t);
 	Unref(attrs);
 
 	delete [] name;
@@ -171,7 +170,6 @@ void BroFile::Init()
 	attrs = 0;
 	buffered = true;
 	raw_output = false;
-	t = 0;
 
 #ifdef USE_PERFTOOLS_DEBUG
 	heap_checker->IgnoreObject(this);
@@ -286,7 +284,7 @@ RecordVal* BroFile::Rotate()
 		return 0;
 		}
 
-	info->Assign(2, new Val(open_time, TYPE_TIME));
+	info->Assign(2, make_intrusive<Val>(open_time, TYPE_TIME));
 
 	Unlink();
 
@@ -355,6 +353,6 @@ BroFile* BroFile::GetFile(const char* name)
 			}
 		}
 
-	return new BroFile(name, "w", 0);
+	return new BroFile(name, "w");
 	}
 

src/File.h

@@ -3,6 +3,7 @@
 #pragma once
 
 #include "Obj.h"
+#include "IntrusivePtr.h"
 
 #include <list>
 #include <string>
@@ -22,7 +23,7 @@ class BroFile : public BroObj {
 public:
 	explicit BroFile(FILE* arg_f);
 	BroFile(FILE* arg_f, const char* filename, const char* access);
-	BroFile(const char* filename, const char* access, BroType* arg_t = 0);
+	BroFile(const char* filename, const char* access);
 	~BroFile() override;
 
 	const char* Name() const;
@@ -36,7 +37,7 @@ public:
 
 	void SetBuf(bool buffered);	// false=line buffered, true=fully buffered
 
-	BroType* FType() const	{ return t; }
+	BroType* FType() const	{ return t.get(); }
 
 	// Whether the file is open in a general sense; it might
 	// not be open as a Unix file due to our management of
@@ -93,7 +94,7 @@ protected:
 	void RaiseOpenEvent();
 
 	FILE* f;
-	BroType* t;
+	IntrusivePtr<BroType> t;
 	char* name;
 	char* access;
 	int is_open;	// whether the file is open in a general sense

src/Frame.cc

@@ -25,7 +25,6 @@ Frame::Frame(int arg_size, const BroFunc* func, const val_list* fn_args)
 	break_before_next_stmt = false;
 	break_on_return = false;
 
-	trigger = nullptr;
 	call = nullptr;
 	delayed = false;
 
@@ -43,9 +42,6 @@ Frame::~Frame()
 		Unref(func);
 		}
 
-	// Deleting a Frame that is a view is a no-op.
-	Unref(trigger);
-
 	if ( ! weak_closure_ref )
 		Unref(closure);
 
@@ -183,11 +179,9 @@ Frame* Frame::Clone() const
 
 	other->call = call;
 	other->trigger = trigger;
-	if ( trigger )
-		Ref(trigger);
 
 	for (int i = 0; i < size; i++)
-		other->frame[i] = frame[i] ? frame[i]->Clone() : nullptr;
+		other->frame[i] = frame[i] ? frame[i]->Clone().release() : nullptr;
 
 	return other;
 	}
@@ -200,23 +194,22 @@ static bool val_is_func(Val* v, BroFunc* func)
 	return v->AsFunc() == func;
 	}
 
-static Val* clone_if_not_func(Val** frame, int offset, BroFunc* func,
+static void clone_if_not_func(Val** frame, int offset, BroFunc* func,
                               Frame* other)
 	{
 	auto v = frame[offset];
 
 	if ( ! v )
-		return nullptr;
+		return;
 
 	if ( val_is_func(v, func) )
 		{
 		other->SetElement(offset, v, true);
-		return v;
+		return;
 		}
 
 	auto rval = v->Clone();
-	other->SetElement(offset, rval);
+	other->SetElement(offset, rval.release());
-	return rval;
 	}
 
 Frame* Frame::SelectiveClone(const id_list& selection, BroFunc* func) const
@@ -359,14 +352,14 @@ broker::expected<broker::data> Frame::Serialize(const Frame* target, const id_li
 	return {std::move(rval)};
 	}
 
-std::pair<bool, Frame*> Frame::Unserialize(const broker::vector& data)
+std::pair<bool, IntrusivePtr<Frame>> Frame::Unserialize(const broker::vector& data)
 	{
 	if ( data.size() == 0 )
 		return std::make_pair(true, nullptr);
 
 	id_list outer_ids;
 	std::unordered_map<std::string, int> offset_map;
-	Frame* closure = nullptr;
+	IntrusivePtr<Frame> closure;
 
 	auto where = data.begin();
 
@@ -410,7 +403,7 @@ std::pair<bool, Frame*> Frame::Unserialize(const broker::vector& data)
 			return std::make_pair(false, nullptr);
 			}
 
-		closure = closure_pair.second;
+		closure = std::move(closure_pair.second);
 		}
 
 	auto has_vec = broker::get_if<broker::vector>(*where);
@@ -448,11 +441,11 @@ std::pair<bool, Frame*> Frame::Unserialize(const broker::vector& data)
 	int frame_size = body.size();
 
 	// We'll associate this frame with a function later.
-	Frame* rf = new Frame(frame_size, nullptr, nullptr);
+	auto rf = make_intrusive<Frame>(frame_size, nullptr, nullptr);
 	rf->offset_map = std::move(offset_map);
 	// Frame takes ownership of unref'ing elements in outer_ids
 	rf->outer_ids = std::move(outer_ids);
-	rf->closure = closure;
+	rf->closure = closure.release();
 	rf->weak_closure_ref = false;
 
 	for ( int i = 0; i < frame_size; ++i )
@@ -463,32 +456,23 @@ std::pair<bool, Frame*> Frame::Unserialize(const broker::vector& data)
 
 		broker::vector val_tuple = *has_vec;
 		if ( val_tuple.size() != 2 )
-			{
-			Unref(rf);
 			return std::make_pair(false, nullptr);
-			}
 
 		auto has_type = broker::get_if<broker::integer>(val_tuple[1]);
 		if ( ! has_type )
-			{
-			Unref(rf);
 			return std::make_pair(false, nullptr);
-			}
 
 		broker::integer g = *has_type;
 		BroType t( static_cast<TypeTag>(g) );
 
 		auto val = bro_broker::data_to_val(std::move(val_tuple[0]), &t);
 		if ( ! val )
-			{
-			Unref(rf);
 			return std::make_pair(false, nullptr);
-			}
 
 		rf->frame[i] = val.release();
 		}
 
-	return std::make_pair(true, rf);
+	return std::make_pair(true, std::move(rf));
 	}
 
 void Frame::AddKnownOffsets(const id_list& ids)
@@ -521,19 +505,13 @@ void Frame::CaptureClosure(Frame* c, id_list arg_outer_ids)
 	// if (c) closure = c->SelectiveClone(outer_ids);
 	}
 
-void Frame::SetTrigger(trigger::Trigger* arg_trigger)
+void Frame::SetTrigger(IntrusivePtr<trigger::Trigger> arg_trigger)
 	{
-	ClearTrigger();
+	trigger = std::move(arg_trigger);
-
-	if ( arg_trigger )
-		Ref(arg_trigger);
-
-	trigger = arg_trigger;
 	}
 
 void Frame::ClearTrigger()
 	{
-	Unref(trigger);
 	trigger = nullptr;
 	}
 

src/Frame.h

@@ -4,6 +4,7 @@
 
 #include "BroList.h" // for typedef val_list
 #include "Obj.h"
+#include "IntrusivePtr.h"
 
 #include <unordered_map>
 #include <string>
@@ -189,7 +190,7 @@ public:
 	 * and the second is the unserialized frame with reference count +1, or
 	 * null if the serialization wasn't successful.
 	 */
-	static std::pair<bool, Frame*> Unserialize(const broker::vector& data);
+	static std::pair<bool, IntrusivePtr<Frame>> Unserialize(const broker::vector& data);
 
 	/**
 	 * Sets the IDs that the frame knows offsets for. These offsets will
@@ -210,9 +211,9 @@ public:
 
 	// If the frame is run in the context of a trigger condition evaluation,
 	// the trigger needs to be registered.
-	void SetTrigger(trigger::Trigger* arg_trigger);
+	void SetTrigger(IntrusivePtr<trigger::Trigger> arg_trigger);
 	void ClearTrigger();
-	trigger::Trigger* GetTrigger() const		{ return trigger; }
+	trigger::Trigger* GetTrigger() const		{ return trigger.get(); }
 
 	void SetCall(const CallExpr* arg_call)	{ call = arg_call; }
 	void ClearCall()			{ call = 0; }
@@ -290,7 +291,7 @@ private:
 	bool break_before_next_stmt;
 	bool break_on_return;
 
-	trigger::Trigger* trigger;
+	IntrusivePtr<trigger::Trigger> trigger;
 	const CallExpr* call;
 	bool delayed;
 

src/Func.cc

@@ -111,35 +111,36 @@ std::string render_call_stack()
 	return rval;
 	}
 
-Func::Func() : scope(0), type(0)
+Func::Func()
 	{
 	unique_id = unique_ids.size();
 	unique_ids.push_back(this);
 	}
 
-Func::Func(Kind arg_kind) : scope(0), kind(arg_kind), type(0)
+Func::Func(Kind arg_kind) : kind(arg_kind)
 	{
 	unique_id = unique_ids.size();
 	unique_ids.push_back(this);
 	}
 
-Func::~Func()
+Func::~Func() = default;
-	{
-	Unref(type);
-	}
 
-void Func::AddBody(Stmt* /* new_body */, id_list* /* new_inits */,
+void Func::AddBody(IntrusivePtr<Stmt> /* new_body */, id_list* /* new_inits */,
 		   size_t /* new_frame_size */, int /* priority */)
 	{
 	Internal("Func::AddBody called");
 	}
 
-Func* Func::DoClone()
+void Func::SetScope(IntrusivePtr<Scope> newscope)
+	{
+	scope = std::move(newscope);
+	}
+
+IntrusivePtr<Func> Func::DoClone()
 	{
 	// By default, ok just to return a reference. Func does not have any state
 	// that is different across instances.
-	::Ref(this);
+	return {NewRef{}, this};
-	return this;
 	}
 
 void Func::DescribeDebug(ODesc* d, const val_list* args) const
@@ -180,7 +181,7 @@ TraversalCode Func::Traverse(TraversalCallback* cb) const
 	{
 	// FIXME: Make a fake scope for builtins?
 	Scope* old_scope = cb->current_scope;
-	cb->current_scope = scope;
+	cb->current_scope = scope.get();
 
 	TraversalCode tc = cb->PreFunction(this);
 	HANDLE_TC_STMT_PRE(tc);
@@ -206,13 +207,10 @@ TraversalCode Func::Traverse(TraversalCallback* cb) const
 
 void Func::CopyStateInto(Func* other) const
 	{
-	std::for_each(bodies.begin(), bodies.end(), [](const Body& b) { Ref(b.stmts); });
-
 	other->bodies = bodies;
 	other->scope = scope;
 	other->kind = kind;
 
-	Ref(type);
 	other->type = type;
 
 	other->name = name;
@@ -273,17 +271,18 @@ std::pair<bool, Val*> Func::HandlePluginResult(std::pair<bool, Val*> plugin_resu
 	return plugin_result;
 	}
 
-BroFunc::BroFunc(ID* arg_id, Stmt* arg_body, id_list* aggr_inits,
+BroFunc::BroFunc(ID* arg_id, IntrusivePtr<Stmt> arg_body, id_list* aggr_inits,
-		 size_t arg_frame_size, int priority) : Func(BRO_FUNC)
+                 size_t arg_frame_size, int priority)
+	: Func(BRO_FUNC)
 	{
 	name = arg_id->Name();
-	type = arg_id->Type()->Ref();
+	type = {NewRef{}, arg_id->Type()};
 	frame_size = arg_frame_size;
 
 	if ( arg_body )
 		{
 		Body b;
-		b.stmts = AddInits(arg_body, aggr_inits);
+		b.stmts = AddInits(std::move(arg_body), aggr_inits);
 		b.priority = priority;
 		bodies.push_back(b);
 		}
@@ -291,9 +290,6 @@ BroFunc::BroFunc(ID* arg_id, Stmt* arg_body, id_list* aggr_inits,
 
 BroFunc::~BroFunc()
 	{
-	std::for_each(bodies.begin(), bodies.end(),
-		[](Body& b) { Unref(b.stmts); });
-
 	if ( ! weak_closure_ref )
 		Unref(closure);
 	}
@@ -304,7 +300,7 @@ int BroFunc::IsPure() const
 		[](const Body& b) { return b.stmts->IsPure(); });
 	}
 
-Val* BroFunc::Call(val_list* args, Frame* parent) const
+IntrusivePtr<Val> BroFunc::Call(val_list* args, Frame* parent) const
 	{
 #ifdef PROFILE_BRO_FUNCTIONS
 	DEBUG_MSG("Function: %s\n", Name());
@@ -319,10 +315,7 @@ Val* BroFunc::Call(val_list* args, Frame* parent) const
 	plugin_result = HandlePluginResult(plugin_result, args, Flavor());
 
 	if( plugin_result.first )
-		{
+		return {AdoptRef{}, plugin_result.second};
-		Val *result = plugin_result.second;
-		return result;
-		}
 
 	if ( bodies.empty() )
 		{
@@ -331,10 +324,10 @@ Val* BroFunc::Call(val_list* args, Frame* parent) const
 		for ( const auto& arg : *args )
 			Unref(arg);
 
-		return Flavor() == FUNC_FLAVOR_HOOK ? val_mgr->GetTrue() : 0;
+		return Flavor() == FUNC_FLAVOR_HOOK ? IntrusivePtr{AdoptRef{}, val_mgr->GetTrue()} : nullptr;
 		}
 
-	Frame* f = new Frame(frame_size, this, args);
+	auto f = make_intrusive<Frame>(frame_size, this, args);
 
 	if ( closure )
 		f->CaptureClosure(closure, outer_ids);
@@ -342,11 +335,11 @@ Val* BroFunc::Call(val_list* args, Frame* parent) const
 	// Hand down any trigger.
 	if ( parent )
 		{
-		f->SetTrigger(parent->GetTrigger());
+		f->SetTrigger({NewRef{}, parent->GetTrigger()});
 		f->SetCall(parent->GetCall());
 		}
 
-	g_frame_stack.push_back(f);	// used for backtracing
+	g_frame_stack.push_back(f.get());	// used for backtracing
 	const CallExpr* call_expr = parent ? parent->GetCall() : nullptr;
 	call_stack.emplace_back(CallInfo{call_expr, this, args});
 
@@ -360,7 +353,7 @@ Val* BroFunc::Call(val_list* args, Frame* parent) const
 		}
 
 	stmt_flow_type flow = FLOW_NEXT;
-	Val* result = 0;
+	IntrusivePtr<Val> result;
 
 	for ( const auto& body : bodies )
 		{
@@ -368,8 +361,6 @@ Val* BroFunc::Call(val_list* args, Frame* parent) const
 			sample_logger->LocationSeen(
 				body.stmts->GetLocationInfo());
 
-		Unref(result);
-
 		// Fill in the rest of the frame with the function's arguments.
 		loop_over_list(*args, j)
 			{
@@ -387,7 +378,7 @@ Val* BroFunc::Call(val_list* args, Frame* parent) const
 
 		try
 			{
-			result = body.stmts->Exec(f, flow).release();
+			result = body.stmts->Exec(f.get(), flow);
 			}
 
 		catch ( InterpreterException& e )
@@ -397,7 +388,6 @@ Val* BroFunc::Call(val_list* args, Frame* parent) const
 				{
 				g_frame_stack.pop_back();
 				call_stack.pop_back();
-				Unref(f);
 				// Result not set b/c exception was thrown
 				throw;
 				}
@@ -418,13 +408,12 @@ Val* BroFunc::Call(val_list* args, Frame* parent) const
 			{
 			// Ignore any return values of hook bodies, final return value
 			// depends on whether a body returns as a result of break statement.
-			Unref(result);
+			result = nullptr;
-			result = 0;
 
 			if ( flow == FLOW_BREAK )
 				{
 				// Short-circuit execution of remaining hook handler bodies.
-				result = val_mgr->GetFalse();
+				result = {AdoptRef{}, val_mgr->GetFalse()};
 				break;
 				}
 			}
@@ -440,7 +429,7 @@ Val* BroFunc::Call(val_list* args, Frame* parent) const
 	if ( Flavor() == FUNC_FLAVOR_HOOK )
 		{
 		if ( ! result )
-			result = val_mgr->GetTrue();
+			result = {AdoptRef{}, val_mgr->GetTrue()};
 		}
 
 	// Warn if the function returns something, but we returned from
@@ -462,25 +451,21 @@ Val* BroFunc::Call(val_list* args, Frame* parent) const
 
 	g_frame_stack.pop_back();
 
-	Unref(f);
-
 	return result;
 	}
 
-void BroFunc::AddBody(Stmt* new_body, id_list* new_inits,
+void BroFunc::AddBody(IntrusivePtr<Stmt> new_body, id_list* new_inits,
                       size_t new_frame_size, int priority)
 	{
 	if ( new_frame_size > frame_size )
 		frame_size = new_frame_size;
 
-	new_body = AddInits(new_body, new_inits);
+	new_body = AddInits(std::move(new_body), new_inits);
 
 	if ( Flavor() == FUNC_FLAVOR_FUNCTION )
 		{
 		// For functions, we replace the old body with the new one.
 		assert(bodies.size() <= 1);
-		for ( const auto& body : bodies )
-			Unref(body.stmts);
 		bodies.clear();
 		}
 
@@ -535,10 +520,12 @@ void BroFunc::SetClosureFrame(Frame* f)
 bool BroFunc::UpdateClosure(const broker::vector& data)
 	{
 	auto result = Frame::Unserialize(data);
+
 	if ( ! result.first )
 		return false;
 
-	Frame* new_closure = result.second;
+	auto& new_closure = result.second;
+
 	if ( new_closure )
 		new_closure->SetFunction(this);
 
@@ -546,19 +533,19 @@ bool BroFunc::UpdateClosure(const broker::vector& data)
 		Unref(closure);
 
 	weak_closure_ref = false;
-	closure = new_closure;
+	closure = new_closure.release();
 
 	return true;
 	}
 
 
-Func* BroFunc::DoClone()
+IntrusivePtr<Func> BroFunc::DoClone()
 	{
 	// BroFunc could hold a closure. In this case a clone of it must
 	// store a copy of this closure.
-	BroFunc* other = new BroFunc();
+	auto other = IntrusivePtr{AdoptRef{}, new BroFunc()};
 
-	CopyStateInto(other);
+	CopyStateInto(other.get());
 
 	other->frame_size = frame_size;
 	other->closure = closure ? closure->SelectiveClone(outer_ids, this) : nullptr;
@@ -586,14 +573,14 @@ void BroFunc::Describe(ODesc* d) const
 		}
 	}
 
-Stmt* BroFunc::AddInits(Stmt* body, id_list* inits)
+IntrusivePtr<Stmt> BroFunc::AddInits(IntrusivePtr<Stmt> body, id_list* inits)
 	{
 	if ( ! inits || inits->length() == 0 )
 		return body;
 
-	StmtList* stmt_series = new StmtList;
+	auto stmt_series = make_intrusive<StmtList>();
 	stmt_series->Stmts().push_back(new InitStmt(inits));
-	stmt_series->Stmts().push_back(body);
+	stmt_series->Stmts().push_back(body.release());
 
 	return stmt_series;
 	}
@@ -612,7 +599,7 @@ BuiltinFunc::BuiltinFunc(built_in_func arg_func, const char* arg_name,
 	if ( id->HasVal() )
 		reporter->InternalError("built-in function %s multiply defined", Name());
 
-	type = id->Type()->Ref();
+	type = {NewRef{}, id->Type()};
 	id->SetVal(make_intrusive<Val>(this));
 	}
 
@@ -625,7 +612,7 @@ int BuiltinFunc::IsPure() const
 	return is_pure;
 	}
 
-Val* BuiltinFunc::Call(val_list* args, Frame* parent) const
+IntrusivePtr<Val> BuiltinFunc::Call(val_list* args, Frame* parent) const
 	{
 #ifdef PROFILE_BRO_FUNCTIONS
 	DEBUG_MSG("Function: %s\n", Name());
@@ -640,10 +627,7 @@ Val* BuiltinFunc::Call(val_list* args, Frame* parent) const
 	plugin_result = HandlePluginResult(plugin_result, args, FUNC_FLAVOR_FUNCTION);
 
 	if ( plugin_result.first )
-		{
+		return {AdoptRef{}, plugin_result.second};
-		Val *result = plugin_result.second;
-		return result;
-		}
 
 	if ( g_trace_state.DoTrace() )
 		{
@@ -655,7 +639,7 @@ Val* BuiltinFunc::Call(val_list* args, Frame* parent) const
 
 	const CallExpr* call_expr = parent ? parent->GetCall() : nullptr;
 	call_stack.emplace_back(CallInfo{call_expr, this, args});
-	Val* result = func(parent, args);
+	IntrusivePtr<Val> result{AdoptRef{}, func(parent, args)};
 	call_stack.pop_back();
 
 	for ( const auto& arg : *args )
@@ -885,29 +869,22 @@ static int get_func_priority(const attr_list& attrs)
 	return priority;
 	}
 
-function_ingredients::function_ingredients(Scope* scope, Stmt* body)
+function_ingredients::function_ingredients(IntrusivePtr<Scope> scope, IntrusivePtr<Stmt> body)
 	{
 	frame_size = scope->Length();
 	inits = scope->GetInits();
 
-	this->scope = scope;
+	this->scope = std::move(scope);
-	::Ref(this->scope);
+	id = {NewRef{}, this->scope->ScopeID()};
-	id = scope->ScopeID();
-	::Ref(id);
 
-	auto attrs = scope->Attrs();
+	auto attrs = this->scope->Attrs();
 
 	priority = (attrs ? get_func_priority(*attrs) : 0);
-	this->body = body;
+	this->body = std::move(body);
-	::Ref(this->body);
 	}
 
 function_ingredients::~function_ingredients()
 	{
-	Unref(id);
-	Unref(body);
-	Unref(scope);
-
 	for ( const auto& i : *inits )
 		Unref(i);
 

src/Func.h

@@ -4,6 +4,7 @@
 
 #include "BroList.h"
 #include "Obj.h"
+#include "IntrusivePtr.h"
 #include "Type.h" /* for function_flavor */
 #include "TraverseTypes.h"
 
@@ -40,7 +41,7 @@ public:
 	function_flavor Flavor() const	{ return FType()->Flavor(); }
 
 	struct Body {
-		Stmt* stmts;
+		IntrusivePtr<Stmt> stmts;
 		int priority;
 		bool operator<(const Body& other) const
 			{ return priority > other.priority; } // reverse sort
@@ -49,15 +50,14 @@ public:
 	const vector<Body>& GetBodies() const	{ return bodies; }
 	bool HasBodies() const	{ return bodies.size(); }
 
-	// virtual Val* Call(ListExpr* args) const = 0;
+	virtual IntrusivePtr<Val> Call(val_list* args, Frame* parent = 0) const = 0;
-	virtual Val* Call(val_list* args, Frame* parent = 0) const = 0;
 
 	// Add a new event handler to an existing function (event).
-	virtual void AddBody(Stmt* new_body, id_list* new_inits,
+	virtual void AddBody(IntrusivePtr<Stmt> new_body, id_list* new_inits,
 	                     size_t new_frame_size, int priority = 0);
 
-	virtual void SetScope(Scope* newscope)	{ scope = newscope; }
+	virtual void SetScope(IntrusivePtr<Scope> newscope);
-	virtual Scope* GetScope() const		{ return scope; }
+	virtual Scope* GetScope() const		{ return scope.get(); }
 
 	virtual FuncType* FType() const { return type->AsFuncType(); }
 
@@ -69,7 +69,7 @@ public:
 	void Describe(ODesc* d) const override = 0;
 	virtual void DescribeDebug(ODesc* d, const val_list* args) const;
 
-	virtual Func* DoClone();
+	virtual IntrusivePtr<Func> DoClone();
 
 	virtual TraversalCode Traverse(TraversalCallback* cb) const;
 
@@ -87,9 +87,9 @@ protected:
 	std::pair<bool, Val*> HandlePluginResult(std::pair<bool, Val*> plugin_result, val_list* args, function_flavor flavor) const;
 
 	vector<Body> bodies;
-	Scope* scope;
+	IntrusivePtr<Scope> scope;
 	Kind kind;
-	BroType* type;
+	IntrusivePtr<BroType> type;
 	string name;
 	uint32_t unique_id;
 	static vector<Func*> unique_ids;
@@ -98,11 +98,11 @@ protected:
 
 class BroFunc : public Func {
 public:
-	BroFunc(ID* id, Stmt* body, id_list* inits, size_t frame_size, int priority);
+	BroFunc(ID* id, IntrusivePtr<Stmt> body, id_list* inits, size_t frame_size, int priority);
 	~BroFunc() override;
 
 	int IsPure() const override;
-	Val* Call(val_list* args, Frame* parent) const override;
+	IntrusivePtr<Val> Call(val_list* args, Frame* parent) const override;
 
 	/**
 	 * Adds adds a closure to the function. Closures are cloned and
@@ -133,7 +133,7 @@ public:
 	 */
 	broker::expected<broker::data> SerializeClosure() const;
 
-	void AddBody(Stmt* new_body, id_list* new_inits,
+	void AddBody(IntrusivePtr<Stmt> new_body, id_list* new_inits,
 		     size_t new_frame_size, int priority) override;
 
 	/** Sets this function's outer_id list. */
@@ -144,12 +144,12 @@ public:
 
 protected:
 	BroFunc() : Func(BRO_FUNC)	{}
-	Stmt* AddInits(Stmt* body, id_list* inits);
+	IntrusivePtr<Stmt> AddInits(IntrusivePtr<Stmt> body, id_list* inits);
 
 	/**
 	 * Clones this function along with its closures.
 	 */
-	Func* DoClone() override;
+	IntrusivePtr<Func> DoClone() override;
 
 	/**
 	 * Performs a selective clone of *f* using the IDs that were
@@ -177,7 +177,7 @@ public:
 	~BuiltinFunc() override;
 
 	int IsPure() const override;
-	Val* Call(val_list* args, Frame* parent) const override;
+	IntrusivePtr<Val> Call(val_list* args, Frame* parent) const override;
 	built_in_func TheFunc() const	{ return func; }
 
 	void Describe(ODesc* d) const override;
@@ -208,16 +208,16 @@ struct function_ingredients {
 
 	// Gathers all of the information from a scope and a function body needed
 	// to build a function.
-	function_ingredients(Scope* scope, Stmt* body);
+	function_ingredients(IntrusivePtr<Scope> scope, IntrusivePtr<Stmt> body);
 
 	~function_ingredients();
 
-	ID* id;
+	IntrusivePtr<ID> id;
-	Stmt* body;
+	IntrusivePtr<Stmt> body;
 	id_list* inits;
 	int frame_size;
 	int priority;
-	Scope* scope;
+	IntrusivePtr<Scope> scope;
 };
 
 extern vector<CallInfo> call_stack;

src/ID.cc

@@ -163,7 +163,7 @@ void ID::UpdateValAttrs()
 		return;
 
 	if ( val && val->Type()->Tag() == TYPE_TABLE )
-		val->AsTableVal()->SetAttrs(attrs.get());
+		val->AsTableVal()->SetAttrs(attrs);
 
 	if ( val && val->Type()->Tag() == TYPE_FILE )
 		val->AsFile()->SetAttrs(attrs.get());
@@ -188,9 +188,9 @@ void ID::UpdateValAttrs()
 				TypeDecl* fd = rt->FieldDecl(i);
 
 				if ( ! fd->attrs )
-					fd->attrs = new Attributes(new attr_list, rt->FieldType(i), true, IsGlobal());
+					fd->attrs = make_intrusive<Attributes>(new attr_list, IntrusivePtr{NewRef{}, rt->FieldType(i)}, true, IsGlobal());
 
-				fd->attrs->AddAttr(new Attr(ATTR_LOG));
+				fd->attrs->AddAttr(make_intrusive<Attr>(ATTR_LOG));
 				}
 			}
 		}
@@ -206,13 +206,13 @@ bool ID::IsDeprecated() const
 	return FindAttr(ATTR_DEPRECATED) != 0;
 	}
 
-void ID::MakeDeprecated(Expr* deprecation)
+void ID::MakeDeprecated(IntrusivePtr<Expr> deprecation)
 	{
 	if ( IsDeprecated() )
 		return;
 
-	attr_list* attr = new attr_list{new Attr(ATTR_DEPRECATED, deprecation)};
+	attr_list* attr = new attr_list{new Attr(ATTR_DEPRECATED, std::move(deprecation))};
-	AddAttrs(make_intrusive<Attributes>(attr, Type(), false, IsGlobal()));
+	AddAttrs(make_intrusive<Attributes>(attr, IntrusivePtr{NewRef{}, Type()}, false, IsGlobal()));
 	}
 
 string ID::GetDeprecationWarning() const
@@ -262,7 +262,7 @@ void ID::SetOption()
 	if ( ! IsRedefinable() )
 		{
 		attr_list* attr = new attr_list{new Attr(ATTR_REDEF)};
-		AddAttrs(make_intrusive<Attributes>(attr, Type(), false, IsGlobal()));
+		AddAttrs(make_intrusive<Attributes>(attr, IntrusivePtr{NewRef{}, Type()}, false, IsGlobal()));
 		}
 	}
 
@@ -314,7 +314,7 @@ TraversalCode ID::Traverse(TraversalCallback* cb) const
 void ID::Error(const char* msg, const BroObj* o2)
 	{
 	BroObj::Error(msg, o2, 1);
-	SetType({AdoptRef{}, error_type()});
+	SetType(error_type());
 	}
 
 void ID::Describe(ODesc* d) const

src/ID.h

@@ -86,7 +86,7 @@ public:
 
 	bool IsDeprecated() const;
 
-	void MakeDeprecated(Expr* deprecation);
+	void MakeDeprecated(IntrusivePtr<Expr> deprecation);
 
 	std::string GetDeprecationWarning() const;
 

src/IP.cc

@@ -65,7 +65,7 @@ static VectorVal* BuildOptionsVal(const u_char* data, int len)
 			// PadN or other option
 			uint16_t off = 2 * sizeof(uint8_t);
 			rv->Assign(1, val_mgr->GetCount(opt->ip6o_len));
-			rv->Assign(2, new StringVal(
+			rv->Assign(2, make_intrusive<StringVal>(
 			        new BroString(data + off, opt->ip6o_len, 1)));
 			data += opt->ip6o_len + off;
 			len -= opt->ip6o_len + off;
@@ -91,8 +91,8 @@ RecordVal* IPv6_Hdr::BuildRecordVal(VectorVal* chain) const
 		rv->Assign(2, val_mgr->GetCount(ntohs(ip6->ip6_plen)));
 		rv->Assign(3, val_mgr->GetCount(ip6->ip6_nxt));
 		rv->Assign(4, val_mgr->GetCount(ip6->ip6_hlim));
-		rv->Assign(5, new AddrVal(IPAddr(ip6->ip6_src)));
+		rv->Assign(5, make_intrusive<AddrVal>(IPAddr(ip6->ip6_src)));
-		rv->Assign(6, new AddrVal(IPAddr(ip6->ip6_dst)));
+		rv->Assign(6, make_intrusive<AddrVal>(IPAddr(ip6->ip6_dst)));
 		if ( ! chain )
 			chain = new VectorVal(
 			    internal_type("ip6_ext_hdr_chain")->AsVectorType());
@@ -132,7 +132,7 @@ RecordVal* IPv6_Hdr::BuildRecordVal(VectorVal* chain) const
 		rv->Assign(2, val_mgr->GetCount(rt->ip6r_type));
 		rv->Assign(3, val_mgr->GetCount(rt->ip6r_segleft));
 		uint16_t off = 4 * sizeof(uint8_t);
-		rv->Assign(4, new StringVal(new BroString(data + off, Length() - off, 1)));
+		rv->Assign(4, make_intrusive<StringVal>(new BroString(data + off, Length() - off, 1)));
 		}
 		break;
 
@@ -163,7 +163,7 @@ RecordVal* IPv6_Hdr::BuildRecordVal(VectorVal* chain) const
 			// Payload Len was non-zero for this header.
 			rv->Assign(4, val_mgr->GetCount(ntohl(((uint32_t*)data)[2])));
 			uint16_t off = 3 * sizeof(uint32_t);
-			rv->Assign(5, new StringVal(new BroString(data + off, Length() - off, 1)));
+			rv->Assign(5, make_intrusive<StringVal>(new BroString(data + off, Length() - off, 1)));
 			}
 		}
 		break;
@@ -284,7 +284,7 @@ RecordVal* IPv6_Hdr::BuildRecordVal(VectorVal* chain) const
 			RecordVal* m = new RecordVal(hdrType(ip6_mob_brr_type, "ip6_mobility_be"));
 			m->Assign(0, val_mgr->GetCount(*((uint8_t*)msg_data)));
 			const in6_addr* hoa = (const in6_addr*)(msg_data + sizeof(uint16_t));
-			m->Assign(1, new AddrVal(IPAddr(*hoa)));
+			m->Assign(1, make_intrusive<AddrVal>(IPAddr(*hoa)));
 			off += sizeof(uint16_t) + sizeof(in6_addr);
 			m->Assign(2, BuildOptionsVal(data + off, Length() - off));
 			msg->Assign(8, m);
@@ -341,8 +341,8 @@ RecordVal* IP_Hdr::BuildIPHdrVal() const
 		rval->Assign(3, val_mgr->GetCount(ntohs(ip4->ip_id)));
 		rval->Assign(4, val_mgr->GetCount(ip4->ip_ttl));
 		rval->Assign(5, val_mgr->GetCount(ip4->ip_p));
-		rval->Assign(6, new AddrVal(ip4->ip_src.s_addr));
+		rval->Assign(6, make_intrusive<AddrVal>(ip4->ip_src.s_addr));
-		rval->Assign(7, new AddrVal(ip4->ip_dst.s_addr));
+		rval->Assign(7, make_intrusive<AddrVal>(ip4->ip_dst.s_addr));
 		}
 	else
 		{

src/OpaqueVal.cc

@@ -89,9 +89,7 @@ IntrusivePtr<OpaqueVal> OpaqueVal::Unserialize(const broker::data& data)
 		return nullptr;
 
 	if ( ! val->DoUnserialize((*v)[1]) )
-		{
 		return nullptr;
-		}
 
 	return val;
 	}
@@ -143,17 +141,17 @@ BroType* OpaqueVal::UnserializeType(const broker::data& data)
 	if ( ! tag )
 		return nullptr;
 
-	return base_type(static_cast<TypeTag>(*tag));
+	return base_type(static_cast<TypeTag>(*tag)).release();
 	}
 
-Val* OpaqueVal::DoClone(CloneState* state)
+IntrusivePtr<Val> OpaqueVal::DoClone(CloneState* state)
 	{
 	auto d = OpaqueVal::Serialize();
 	if ( ! d )
 		return nullptr;
 
 	auto rval = OpaqueVal::Unserialize(std::move(*d));
-	return state->NewClone(this, rval.release());
+	return state->NewClone(this, std::move(rval));
 	}
 
 bool HashVal::IsValid() const
@@ -223,17 +221,19 @@ MD5Val::~MD5Val()
 		EVP_MD_CTX_free(ctx);
 	}
 
-Val* MD5Val::DoClone(CloneState* state)
+IntrusivePtr<Val> MD5Val::DoClone(CloneState* state)
 	{
-	auto out = new MD5Val();
+	auto out = make_intrusive<MD5Val>();
+
 	if ( IsValid() )
 		{
 		if ( ! out->Init() )
 			return nullptr;
+
 		EVP_MD_CTX_copy_ex(out->ctx, ctx);
 		}
 
-	return state->NewClone(this, out);
+	return state->NewClone(this, std::move(out));
 	}
 
 void MD5Val::digest(val_list& vlist, u_char result[MD5_DIGEST_LENGTH])
@@ -374,17 +374,19 @@ SHA1Val::~SHA1Val()
 		EVP_MD_CTX_free(ctx);
 	}
 
-Val* SHA1Val::DoClone(CloneState* state)
+IntrusivePtr<Val> SHA1Val::DoClone(CloneState* state)
 	{
-	auto out = new SHA1Val();
+	auto out = make_intrusive<SHA1Val>();
+
 	if ( IsValid() )
 		{
 		if ( ! out->Init() )
 			return nullptr;
+
 		EVP_MD_CTX_copy_ex(out->ctx, ctx);
 		}
 
-	return state->NewClone(this, out);
+	return state->NewClone(this, std::move(out));
 	}
 
 void SHA1Val::digest(val_list& vlist, u_char result[SHA_DIGEST_LENGTH])
@@ -518,17 +520,19 @@ SHA256Val::~SHA256Val()
 		EVP_MD_CTX_free(ctx);
 	}
 
-Val* SHA256Val::DoClone(CloneState* state)
+IntrusivePtr<Val> SHA256Val::DoClone(CloneState* state)
 	{
-	auto out = new SHA256Val();
+	auto out = make_intrusive<SHA256Val>();
+
 	if ( IsValid() )
 		{
 		if ( ! out->Init() )
 			return nullptr;
+
 		EVP_MD_CTX_copy_ex(out->ctx, ctx);
 		}
 
-	return state->NewClone(this, out);
+	return state->NewClone(this, std::move(out));
 	}
 
 void SHA256Val::digest(val_list& vlist, u_char result[SHA256_DIGEST_LENGTH])
@@ -773,16 +777,16 @@ BloomFilterVal::BloomFilterVal(probabilistic::BloomFilter* bf)
 	bloom_filter = bf;
 	}
 
-Val* BloomFilterVal::DoClone(CloneState* state)
+IntrusivePtr<Val> BloomFilterVal::DoClone(CloneState* state)
 	{
 	if ( bloom_filter )
 		{
-		auto bf = new BloomFilterVal(bloom_filter->Clone());
+		auto bf = make_intrusive<BloomFilterVal>(bloom_filter->Clone());
 		bf->Typify(type);
-		return state->NewClone(this, bf);
+		return state->NewClone(this, std::move(bf));
 		}
 
-	return state->NewClone(this, new BloomFilterVal());
+	return state->NewClone(this, make_intrusive<BloomFilterVal>());
 	}
 
 bool BloomFilterVal::Typify(BroType* arg_type)
@@ -793,8 +797,8 @@ bool BloomFilterVal::Typify(BroType* arg_type)
 	type = arg_type;
 	type->Ref();
 
-	auto tl = make_intrusive<TypeList>(type);
+	auto tl = make_intrusive<TypeList>(IntrusivePtr{NewRef{}, type});
-	tl->Append(type->Ref());
+	tl->Append({NewRef{}, type});
 	hash = new CompositeHash(std::move(tl));
 
 	return true;
@@ -949,10 +953,10 @@ CardinalityVal::~CardinalityVal()
 	delete hash;
 	}
 
-Val* CardinalityVal::DoClone(CloneState* state)
+IntrusivePtr<Val> CardinalityVal::DoClone(CloneState* state)
 	{
 	return state->NewClone(this,
-			       new CardinalityVal(new probabilistic::CardinalityCounter(*c)));
+			       make_intrusive<CardinalityVal>(new probabilistic::CardinalityCounter(*c)));
 	}
 
 bool CardinalityVal::Typify(BroType* arg_type)
@@ -963,8 +967,8 @@ bool CardinalityVal::Typify(BroType* arg_type)
 	type = arg_type;
 	type->Ref();
 
-	auto tl = make_intrusive<TypeList>(type);
+	auto tl = make_intrusive<TypeList>(IntrusivePtr{NewRef{}, type});
-	tl->Append(type->Ref());
+	tl->Append({NewRef{}, type});
 	hash = new CompositeHash(std::move(tl));
 
 	return true;
@@ -1043,7 +1047,7 @@ IntrusivePtr<VectorVal> ParaglobVal::Get(StringVal* &pattern)
 
 	std::vector<std::string> matches = this->internal_paraglob->get(string_pattern);
 	for (unsigned int i = 0; i < matches.size(); i++)
-		rval->Assign(i, new StringVal(matches.at(i)));
+		rval->Assign(i, make_intrusive<StringVal>(matches.at(i)));
 
 	return rval;
 	}
@@ -1097,10 +1101,10 @@ bool ParaglobVal::DoUnserialize(const broker::data& data)
 	return true;
 	}
 
-Val* ParaglobVal::DoClone(CloneState* state)
+IntrusivePtr<Val> ParaglobVal::DoClone(CloneState* state)
 	{
 	try {
-		return new ParaglobVal
+		return make_intrusive<ParaglobVal>
 			(std::make_unique<paraglob::Paraglob>(this->internal_paraglob->serialize()));
 		}
 	catch (const paraglob::underflow_error& e)

src/OpaqueVal.h

@@ -140,7 +140,7 @@ protected:
 	 * may also override this with a more efficient custom clone
 	 * implementation of their own.
 	 */
-	Val* DoClone(CloneState* state) override;
+	IntrusivePtr<Val> DoClone(CloneState* state) override;
 
 	/**
 	 * Helper function for derived class that need to record a type
@@ -191,7 +191,7 @@ public:
 	MD5Val();
 	~MD5Val();
 
-	Val* DoClone(CloneState* state) override;
+	IntrusivePtr<Val> DoClone(CloneState* state) override;
 
 protected:
 	friend class Val;
@@ -212,7 +212,7 @@ public:
 	SHA1Val();
 	~SHA1Val();
 
-	Val* DoClone(CloneState* state) override;
+	IntrusivePtr<Val> DoClone(CloneState* state) override;
 
 protected:
 	friend class Val;
@@ -233,7 +233,7 @@ public:
 	SHA256Val();
 	~SHA256Val();
 
-	Val* DoClone(CloneState* state) override;
+	IntrusivePtr<Val> DoClone(CloneState* state) override;
 
 protected:
 	friend class Val;
@@ -268,7 +268,7 @@ public:
 	explicit BloomFilterVal(probabilistic::BloomFilter* bf);
 	~BloomFilterVal() override;
 
-	Val* DoClone(CloneState* state) override;
+	IntrusivePtr<Val> DoClone(CloneState* state) override;
 
 	BroType* Type() const;
 	bool Typify(BroType* type);
@@ -304,7 +304,7 @@ public:
 	explicit CardinalityVal(probabilistic::CardinalityCounter*);
 	~CardinalityVal() override;
 
-	Val* DoClone(CloneState* state) override;
+	IntrusivePtr<Val> DoClone(CloneState* state) override;
 
 	void Add(const Val* val);
 
@@ -327,7 +327,7 @@ class ParaglobVal : public OpaqueVal {
 public:
 	explicit ParaglobVal(std::unique_ptr<paraglob::Paraglob> p);
 	IntrusivePtr<VectorVal> Get(StringVal* &pattern);
-	Val* DoClone(CloneState* state) override;
+	IntrusivePtr<Val> DoClone(CloneState* state) override;
 	bool operator==(const ParaglobVal& other) const;
 
 protected:

src/RuleCondition.cc

@@ -145,7 +145,7 @@ RuleConditionEval::RuleConditionEval(const char* func)
 			rules_error("eval function type must yield a 'bool'", func);
 
 		TypeList tl;
-		tl.Append(internal_type("signature_state")->Ref());
+		tl.Append({NewRef{}, internal_type("signature_state")});
 		tl.Append(base_type(TYPE_STRING));
 
 		if ( ! f->CheckArgs(tl.Types()) )
@@ -175,24 +175,16 @@ bool RuleConditionEval::DoMatch(Rule* rule, RuleEndpointState* state,
 	else
 		args.push_back(val_mgr->GetEmptyString());
 
-	bool result = 0;
+	bool result = false;
 
 	try
 		{
-		Val* val = id->ID_Val()->AsFunc()->Call(&args);
+		auto val = id->ID_Val()->AsFunc()->Call(&args);
-
+		result = val && val->AsBool();
-		if ( val )
-			{
-			result = val->AsBool();
-			Unref(val);
-			}
-		else
-			result = false;
 		}
 
 	catch ( InterpreterException& e )
 		{
-		result = false;
 		}
 
 	return result;

src/RuleMatcher.cc

@@ -78,7 +78,7 @@ Val* RuleMatcher::BuildRuleStateValue(const Rule* rule,
 					const RuleEndpointState* state) const
 	{
 	RecordVal* val = new RecordVal(signature_state);
-	val->Assign(0, new StringVal(rule->ID()));
+	val->Assign(0, make_intrusive<StringVal>(rule->ID()));
 	val->Assign(1, state->GetAnalyzer()->BuildConnVal());
 	val->Assign(2, val_mgr->GetBool(state->is_orig));
 	val->Assign(3, val_mgr->GetCount(state->payload_size));

src/Scope.cc

@@ -16,9 +16,9 @@ static scope_list scopes;
 static Scope* top_scope;
 
 
-Scope::Scope(ID* id, attr_list* al)
+Scope::Scope(IntrusivePtr<ID> id, attr_list* al)
+	: scope_id(std::move(id))
 	{
-	scope_id = id;
 	attrs = al;
 	return_type = 0;
 
@@ -26,27 +26,20 @@ Scope::Scope(ID* id, attr_list* al)
 
 	if ( id )
 		{
-		BroType* id_type = id->Type();
+		BroType* id_type = scope_id->Type();
 
 		if ( id_type->Tag() == TYPE_ERROR )
 			return;
 		else if ( id_type->Tag() != TYPE_FUNC )
 			reporter->InternalError("bad scope id");
 
-		Ref(id);
-
 		FuncType* ft = id->Type()->AsFuncType();
-		return_type = ft->YieldType();
+		return_type = {NewRef{}, ft->YieldType()};
-		if ( return_type )
-			Ref(return_type);
 		}
 	}
 
 Scope::~Scope()
 	{
-	for ( const auto& entry : local )
-		Unref(entry.second);
-
 	if ( attrs )
 		{
 		for ( const auto& attr : *attrs )
@@ -55,9 +48,6 @@ Scope::~Scope()
 		delete attrs;
 		}
 
-	Unref(scope_id);
-	Unref(return_type);
-
 	if ( inits )
 		{
 		for ( const auto& i : *inits )
@@ -108,7 +98,7 @@ void Scope::Describe(ODesc* d) const
 
 	for ( const auto& entry : local )
 		{
-		ID* id = entry.second;
+		ID* id = entry.second.get();
 		id->Describe(d);
 		d->NL();
 		}
@@ -118,7 +108,7 @@ TraversalCode Scope::Traverse(TraversalCallback* cb) const
 	{
 	for ( const auto& entry : local )
 		{
-		ID* id = entry.second;
+		ID* id = entry.second.get();
 		TraversalCode tc = id->Traverse(cb);
 		HANDLE_TC_STMT_PRE(tc);
 		}
@@ -183,11 +173,11 @@ IntrusivePtr<ID> install_ID(const char* name, const char* module_name,
 	auto id = make_intrusive<ID>(full_name.data(), scope, is_export);
 
 	if ( SCOPE_FUNCTION != scope )
-		global_scope()->Insert(std::move(full_name), IntrusivePtr{id}.release());
+		global_scope()->Insert(std::move(full_name), id);
 	else
 		{
 		id->SetOffset(top_scope->Length());
-		top_scope->Insert(std::move(full_name), IntrusivePtr{id}.release());
+		top_scope->Insert(std::move(full_name), id);
 		}
 
 	return id;
@@ -198,9 +188,9 @@ void push_existing_scope(Scope* scope)
 	scopes.push_back(scope);
 	}
 
-void push_scope(ID* id, attr_list* attrs)
+void push_scope(IntrusivePtr<ID> id, attr_list* attrs)
 	{
-	top_scope = new Scope(id, attrs);
+	top_scope = new Scope(std::move(id), attrs);
 	scopes.push_back(top_scope);
 	}
 

src/Scope.h

@@ -8,6 +8,7 @@
 
 #include "Obj.h"
 #include "BroList.h"
+#include "IntrusivePtr.h"
 #include "TraverseTypes.h"
 
 template <class T> class IntrusivePtr;
@@ -17,7 +18,7 @@ class ListVal;
 
 class Scope : public BroObj {
 public:
-	explicit Scope(ID* id, attr_list* al);
+	explicit Scope(IntrusivePtr<ID> id, attr_list* al);
 	~Scope() override;
 
 	template<typename N>
@@ -26,31 +27,22 @@ public:
 		const auto& entry = local.find(std::forward<N>(name));
 
 		if ( entry != local.end() )
-			return entry->second;
+			return entry->second.get();
 
 		return nullptr;
 		}
 
-	template<typename N>
+	template<typename N, typename I>
-	void Insert(N&& name, ID* id)
+	void Insert(N&& name, I&& id) { local[std::forward<N>(name)] = std::forward<I>(id); }
-		{
-		auto [it, inserted] = local.emplace(std::forward<N>(name), id);
-
-		if ( ! inserted )
-			{
-			Unref(it->second);
-			it->second = id;
-			}
-		}
 
 	template<typename N>
-	ID* Remove(N&& name)
+	IntrusivePtr<ID> Remove(N&& name)
 		{
 		const auto& entry = local.find(std::forward<N>(name));
 
 		if ( entry != local.end() )
 			{
-			ID* id = entry->second;
+			auto id = std::move(entry->second);
 			local.erase(entry);
 			return id;
 			}
@@ -58,12 +50,12 @@ public:
 		return nullptr;
 		}
 
-	ID* ScopeID() const		{ return scope_id; }
+	ID* ScopeID() const		{ return scope_id.get(); }
 	attr_list* Attrs() const	{ return attrs; }
-	BroType* ReturnType() const	{ return return_type; }
+	BroType* ReturnType() const	{ return return_type.get(); }
 
 	size_t Length() const		{ return local.size(); }
-	const std::map<std::string, ID*>& Vars()	{ return local; }
+	const auto& Vars()	{ return local; }
 
 	ID* GenerateTemporary(const char* name);
 
@@ -72,17 +64,17 @@ public:
 	id_list* GetInits();
 
 	// Adds a variable to the list.
-	void AddInit(ID* id)		{ inits->push_back(id); }
+	void AddInit(IntrusivePtr<ID> id)		{ inits->push_back(id.release()); }
 
 	void Describe(ODesc* d) const override;
 
 	TraversalCode Traverse(TraversalCallback* cb) const;
 
 protected:
-	ID* scope_id;
+	IntrusivePtr<ID> scope_id;
 	attr_list* attrs;
-	BroType* return_type;
+	IntrusivePtr<BroType> return_type;
-	std::map<std::string, ID*> local;
+	std::map<std::string, IntrusivePtr<ID>> local;
 	id_list* inits;
 };
 
@@ -98,7 +90,7 @@ extern IntrusivePtr<ID> lookup_ID(const char* name, const char* module,
 extern IntrusivePtr<ID> install_ID(const char* name, const char* module_name,
                                    bool is_global, bool is_export);
 
-extern void push_scope(ID* id, attr_list* attrs);
+extern void push_scope(IntrusivePtr<ID> id, attr_list* attrs);
 extern void push_existing_scope(Scope* scope);
 
 // Returns the one popped off.

src/SmithWaterman.cc

@@ -84,25 +84,25 @@ VectorVal* BroSubstring::VecToPolicy(Vec* vec)
 			{
 			BroSubstring* bst = (*vec)[i];
 
-			RecordVal* st_val = new RecordVal(sw_substring_type);
+			auto st_val = make_intrusive<RecordVal>(sw_substring_type);
-			st_val->Assign(0, new StringVal(new BroString(*bst)));
+			st_val->Assign(0, make_intrusive<StringVal>(new BroString(*bst)));
 
-			VectorVal* aligns = new VectorVal(sw_align_vec_type);
+			auto aligns = make_intrusive<VectorVal>(sw_align_vec_type);
 
 			for ( unsigned int j = 0; j < bst->GetNumAlignments(); ++j )
 				{
 				const BSSAlign& align = (bst->GetAlignments())[j];
 
-				RecordVal* align_val = new RecordVal(sw_align_type);
+				auto align_val = make_intrusive<RecordVal>(sw_align_type);
-				align_val->Assign(0, new StringVal(new BroString(*align.string)));
+				align_val->Assign(0, make_intrusive<StringVal>(new BroString(*align.string)));
 				align_val->Assign(1, val_mgr->GetCount(align.index));
 
-				aligns->Assign(j+1, align_val);
+				aligns->Assign(j + 1, std::move(align_val));
 				}
 
-			st_val->Assign(1, aligns);
+			st_val->Assign(1, std::move(aligns));
 			st_val->Assign(2, val_mgr->GetBool(bst->IsNewAlignment()));
-			result->Assign(i+1, st_val);
+			result->Assign(i + 1, std::move(st_val));
 			}
 		}
 

src/Stats.cc

@@ -252,7 +252,7 @@ void ProfileLogger::Log()
 
 		for ( const auto& global : globals )
 			{
-			ID* id = global.second;
+			ID* id = global.second.get();
 
 			// We don't show/count internal globals as they are always
 			// contained in some other global user-visible container.
@@ -345,7 +345,7 @@ SampleLogger::SampleLogger()
 	if ( ! load_sample_info )
 		load_sample_info = internal_type("load_sample_info")->AsTableType();
 
-	load_samples = new TableVal(load_sample_info);
+	load_samples = new TableVal({NewRef{}, load_sample_info});
 	}
 
 SampleLogger::~SampleLogger()

src/Stmt.cc

@@ -202,9 +202,8 @@ static IntrusivePtr<EnumVal> lookup_enum_val(const char* module_name, const char
 
 	int index = et->Lookup(module_name, name);
 	assert(index >= 0);
-	IntrusivePtr<EnumVal> rval{AdoptRef{}, et->GetVal(index)};
 
-	return rval;
+	return et->GetVal(index);
 	}
 
 static void print_log(val_list* vals)
@@ -217,11 +216,11 @@ static void print_log(val_list* vals)
 		{
 		ODesc d(DESC_READABLE);
 		val->Describe(&d);
-		vec->Assign(vec->Size(), new StringVal(d.Description()));
+		vec->Assign(vec->Size(), make_intrusive<StringVal>(d.Description()));
 		}
 
-	record->Assign(0, new Val(current_time(), TYPE_TIME));
+	record->Assign(0, make_intrusive<Val>(current_time(), TYPE_TIME));
-	record->Assign(1, vec.release());
+	record->Assign(1, std::move(vec));
 	log_mgr->Write(plval.get(), record.get());
 	}
 
@@ -588,7 +587,7 @@ static void int_del_func(void* v)
 void SwitchStmt::Init()
 	{
 	auto t = make_intrusive<TypeList>();
-	t->Append(e->Type()->Ref());
+	t->Append({NewRef{}, e->Type()});
 	comp_hash = new CompositeHash(std::move(t));
 
 	case_label_value_map.SetDeleteFunc(int_del_func);
@@ -1115,7 +1114,7 @@ ForStmt::ForStmt(id_list* arg_loop_vars, IntrusivePtr<Expr> loop_expr)
 
 		BroType* t = (*loop_vars)[0]->Type();
 		if ( ! t )
-			add_local({NewRef{}, (*loop_vars)[0]}, {AdoptRef{}, base_type(TYPE_COUNT)},
+			add_local({NewRef{}, (*loop_vars)[0]}, base_type(TYPE_COUNT),
 						INIT_NONE, 0, 0, VAR_REGULAR);
 
 		else if ( ! IsIntegral(t->Tag()) )
@@ -1136,7 +1135,7 @@ ForStmt::ForStmt(id_list* arg_loop_vars, IntrusivePtr<Expr> loop_expr)
 		BroType* t = (*loop_vars)[0]->Type();
 		if ( ! t )
 			add_local({NewRef{}, (*loop_vars)[0]},
-					{AdoptRef{}, base_type(TYPE_STRING)},
+					base_type(TYPE_STRING),
 					INIT_NONE, 0, 0, VAR_REGULAR);
 
 		else if ( t->Tag() != TYPE_STRING )
@@ -1432,7 +1431,7 @@ ReturnStmt::ReturnStmt(IntrusivePtr<Expr> arg_e)
 		{
 		if ( e )
 			{
-			ft->SetYieldType(e->Type());
+			ft->SetYieldType({NewRef{}, e->Type()});
 			s->ScopeID()->SetInferReturnType(false);
 			}
 		}
@@ -1451,9 +1450,10 @@ ReturnStmt::ReturnStmt(IntrusivePtr<Expr> arg_e)
 
 	else
 		{
-		Expr* e_ = e.release();
+		auto promoted_e = check_and_promote_expr(e.get(), yt);
-		(void) check_and_promote_expr(e_, yt);
+
-		e = {AdoptRef{}, e_};
+		if ( promoted_e )
+			e = std::move(promoted_e);
 		}
 	}
 
@@ -1667,7 +1667,7 @@ IntrusivePtr<Val> InitStmt::Exec(Frame* f, stmt_flow_type& flow) const
 			v = new VectorVal(t->AsVectorType());
 			break;
 		case TYPE_TABLE:
-			v = new TableVal(t->AsTableType(), aggr->Attrs());
+			v = new TableVal({NewRef{}, t->AsTableType()}, {NewRef{}, aggr->Attrs()});
 			break;
 		default:
 			break;

src/Tag.cc

@@ -2,6 +2,7 @@
 
 #include "Tag.h"
 #include "Val.h"
+#include "IntrusivePtr.h"
 
 Tag::Tag(EnumType* etype, type_t arg_type, subtype_t arg_subtype)
 	{
@@ -11,7 +12,7 @@ Tag::Tag(EnumType* etype, type_t arg_type, subtype_t arg_subtype)
 	subtype = arg_subtype;
 	int64_t i = (int64_t)(type) | ((int64_t)subtype << 31);
 	Ref(etype);
-	val = etype->GetVal(i);
+	val = etype->GetVal(i).release();
 	}
 
 Tag::Tag(EnumVal* arg_val)
@@ -85,7 +86,7 @@ EnumVal* Tag::AsEnumVal(EnumType* etype) const
 		{
 		assert(type == 0 && subtype == 0);
 		Ref(etype);
-		val = etype->GetVal(0);
+		val = etype->GetVal(0).release();
 		}
 
 	return val;

src/Trigger.cc

@@ -265,7 +265,7 @@ bool Trigger::Eval()
 		return false;
 		}
 
-	f->SetTrigger(this);
+	f->SetTrigger({NewRef{}, this});
 
 	IntrusivePtr<Val> v;
 

src/TunnelEncapsulation.cc

@@ -20,15 +20,15 @@ RecordVal* EncapsulatingConn::GetRecordVal() const
 	{
 	RecordVal *rv = new RecordVal(BifType::Record::Tunnel::EncapsulatingConn);
 
-	RecordVal* id_val = new RecordVal(conn_id);
+	auto id_val = make_intrusive<RecordVal>(conn_id);
-	id_val->Assign(0, new AddrVal(src_addr));
+	id_val->Assign(0, make_intrusive<AddrVal>(src_addr));
 	id_val->Assign(1, val_mgr->GetPort(ntohs(src_port), proto));
-	id_val->Assign(2, new AddrVal(dst_addr));
+	id_val->Assign(2, make_intrusive<AddrVal>(dst_addr));
 	id_val->Assign(3, val_mgr->GetPort(ntohs(dst_port), proto));
-	rv->Assign(0, id_val);
+	rv->Assign(0, std::move(id_val));
 	rv->Assign(1, BifType::Enum::Tunnel::Type->GetVal(type));
 
-	rv->Assign(2, new StringVal(uid.Base62("C").c_str()));
+	rv->Assign(2, make_intrusive<StringVal>(uid.Base62("C").c_str()));
 
 	return rv;
 	}

src/Type.cc

@@ -100,7 +100,7 @@ int BroType::MatchesIndex(ListExpr* const index) const
 		if ( index->Exprs().length() != 1 && index->Exprs().length() != 2 )
 			return DOES_NOT_MATCH_INDEX;
 
-		if ( check_and_promote_exprs_to_type(index, ::base_type(TYPE_INT)) )
+		if ( check_and_promote_exprs_to_type(index, ::base_type(TYPE_INT).get()) )
 			return MATCHES_INDEX_SCALAR;
 		}
 
@@ -109,7 +109,7 @@ int BroType::MatchesIndex(ListExpr* const index) const
 
 BroType* BroType::YieldType()
 	{
-	return 0;
+	return nullptr;
 	}
 
 int BroType::HasField(const char* /* field */) const
@@ -119,7 +119,7 @@ int BroType::HasField(const char* /* field */) const
 
 BroType* BroType::FieldType(const char* /* field */) const
 	{
-	return 0;
+	return nullptr;
 	}
 
 void BroType::Describe(ODesc* d) const
@@ -155,8 +155,6 @@ TypeList::~TypeList()
 	{
 	for ( const auto& type : types )
 		Unref(type);
-
-	Unref(pure_type);
 	}
 
 int TypeList::AllMatch(const BroType* t, int is_init) const
@@ -167,23 +165,20 @@ int TypeList::AllMatch(const BroType* t, int is_init) const
 	return 1;
 	}
 
-void TypeList::Append(BroType* t)
+void TypeList::Append(IntrusivePtr<BroType> t)
 	{
-	if ( pure_type && ! same_type(t, pure_type) )
+	if ( pure_type && ! same_type(t.get(), pure_type.get()) )
 		reporter->InternalError("pure type-list violation");
 
-	types.push_back(t);
+	types.push_back(t.release());
 	}
 
-void TypeList::AppendEvenIfNotPure(BroType* t)
+void TypeList::AppendEvenIfNotPure(IntrusivePtr<BroType> t)
 	{
-	if ( pure_type && ! same_type(t, pure_type) )
+	if ( pure_type && ! same_type(t.get(), pure_type.get()) )
-		{
+		pure_type = nullptr;
-		Unref(pure_type);
-		pure_type = 0;
-		}
 
-	types.push_back(t);
+	types.push_back(t.release());
 	}
 
 void TypeList::Describe(ODesc* d) const
@@ -220,11 +215,7 @@ unsigned int TypeList::MemoryAllocation() const
 		+ types.MemoryAllocation() - padded_sizeof(types);
 	}
 
-IndexType::~IndexType()
+IndexType::~IndexType() = default;
-	{
-	Unref(indices);
-	Unref(yield_type);
-	}
 
 int IndexType::MatchesIndex(ListExpr* const index) const
 	{
@@ -242,12 +233,12 @@ int IndexType::MatchesIndex(ListExpr* const index) const
 
 BroType* IndexType::YieldType()
 	{
-	return yield_type;
+	return yield_type.get();
 	}
 
 const BroType* IndexType::YieldType() const
 	{
-	return yield_type;
+	return yield_type.get();
 	}
 
 void IndexType::Describe(ODesc* d) const
@@ -326,8 +317,8 @@ bool IndexType::IsSubNetIndex() const
 	return false;
 	}
 
-TableType::TableType(TypeList* ind, BroType* yield)
+TableType::TableType(IntrusivePtr<TypeList> ind, IntrusivePtr<BroType> yield)
-: IndexType(TYPE_TABLE, ind, yield)
+	: IndexType(TYPE_TABLE, std::move(ind), std::move(yield))
 	{
 	if ( ! indices )
 		return;
@@ -355,11 +346,6 @@ TableType::TableType(TypeList* ind, BroType* yield)
 
 TableType* TableType::ShallowClone()
 	{
-	if ( indices )
-		indices->Ref();
-	if ( yield_type )
-		yield_type->Ref();
-
 	return new TableType(indices, yield_type);
 	}
 
@@ -377,20 +363,20 @@ TypeList* TableType::ExpandRecordIndex(RecordType* rt) const
 	for ( int i = 0; i < n; ++i )
 		{
 		TypeDecl* td = rt->FieldDecl(i);
-		tl->Append(td->type->Ref());
+		tl->Append(td->type);
 		}
 
 	return tl;
 	}
 
-SetType::SetType(TypeList* ind, ListExpr* arg_elements) : TableType(ind, 0)
+SetType::SetType(IntrusivePtr<TypeList> ind, IntrusivePtr<ListExpr> arg_elements)
+	: TableType(std::move(ind), nullptr), elements(std::move(arg_elements))
 	{
-	elements = arg_elements;
 	if ( elements )
 		{
 		if ( indices )
 			{ // We already have a type.
-			if ( ! check_and_promote_exprs(elements, indices) )
+			if ( ! check_and_promote_exprs(elements.get(), indices.get()) )
 				SetError();
 			}
 		else
@@ -406,21 +392,17 @@ SetType::SetType(TypeList* ind, ListExpr* arg_elements) : TableType(ind, 0)
 
 			else if ( tl->length() == 1 )
 				{
-				BroType* t = flatten_type((*tl)[0]->Ref());
+				IntrusivePtr<BroType> ft{NewRef{}, flatten_type((*tl)[0])};
-				indices = new TypeList(t);
+				indices = make_intrusive<TypeList>(ft);
-				indices->Append(t->Ref());
+				indices->Append(std::move(ft));
 				}
 
 			else
 				{
-				BroType* t = merge_types((*tl)[0], (*tl)[1]);
+				auto t = merge_types((*tl)[0], (*tl)[1]);
 
 				for ( int i = 2; t && i < tl->length(); ++i )
-					{
+					t = merge_types(t.get(), (*tl)[i]);
-					BroType* t_new = merge_types(t, (*tl)[i]);
-					Unref(t);
-					t = t_new;
-					}
 
 				if ( ! t )
 					{
@@ -428,8 +410,8 @@ SetType::SetType(TypeList* ind, ListExpr* arg_elements) : TableType(ind, 0)
 					return;
 					}
 
-				indices = new TypeList(t);
+				indices = make_intrusive<TypeList>(t);
-				indices->Append(t);
+				indices->Append(std::move(t));
 				}
 			}
 		}
@@ -437,29 +419,18 @@ SetType::SetType(TypeList* ind, ListExpr* arg_elements) : TableType(ind, 0)
 
 SetType* SetType::ShallowClone()
 	{
-	if ( elements )
-		elements->Ref();
-
-	if ( indices )
-		indices->Ref();
-
 	return new SetType(indices, elements);
 	}
 
-SetType::~SetType()
+SetType::~SetType() = default;
-	{
-	Unref(elements);
-	}
 
-FuncType::FuncType(RecordType* arg_args, BroType* arg_yield, function_flavor arg_flavor)
+FuncType::FuncType(IntrusivePtr<RecordType> arg_args,
-: BroType(TYPE_FUNC)
+                   IntrusivePtr<BroType> arg_yield, function_flavor arg_flavor)
+	: BroType(TYPE_FUNC), args(std::move(arg_args)),
+	  arg_types(make_intrusive<TypeList>()), yield(std::move(arg_yield))
 	{
-	args = arg_args;
-	yield = arg_yield;
 	flavor = arg_flavor;
 
-	arg_types = new TypeList();
-
 	bool has_default_arg = false;
 
 	for ( int i = 0; i < args->NumFields(); ++i )
@@ -476,16 +447,16 @@ FuncType::FuncType(RecordType* arg_args, BroType* arg_yield, function_flavor arg
 			args->Error(err_str);
 			}
 
-		arg_types->Append(args->FieldType(i)->Ref());
+		arg_types->Append({NewRef{}, args->FieldType(i)});
 		}
 	}
 
 FuncType* FuncType::ShallowClone()
 	{
 	auto f = new FuncType();
-	f->args = args->Ref()->AsRecordType();
+	f->args = {NewRef{}, args->AsRecordType()};
-	f->arg_types = arg_types->Ref()->AsTypeList();
+	f->arg_types = {NewRef{}, arg_types->AsTypeList()};
-	f->yield = yield->Ref();
+	f->yield = yield;
 	f->flavor = flavor;
 	return f;
 	}
@@ -509,26 +480,21 @@ string FuncType::FlavorString() const
 	}
 	}
 
-FuncType::~FuncType()
+FuncType::~FuncType() = default;
-	{
-	Unref(args);
-	Unref(arg_types);
-	Unref(yield);
-	}
 
 BroType* FuncType::YieldType()
 	{
-	return yield;
+	return yield.get();
 	}
 
 const BroType* FuncType::YieldType() const
 	{
-	return yield;
+	return yield.get();
 	}
 
 int FuncType::MatchesIndex(ListExpr* const index) const
 	{
-	return check_and_promote_args(index, args) ?
+	return check_and_promote_args(index, args.get()) ?
 			MATCHES_INDEX_SCALAR : DOES_NOT_MATCH_INDEX;
 	}
 
@@ -606,28 +572,23 @@ void FuncType::DescribeReST(ODesc* d, bool roles_only) const
 		}
 	}
 
-TypeDecl::TypeDecl(BroType* t, const char* i, attr_list* arg_attrs, bool in_record)
+TypeDecl::TypeDecl(IntrusivePtr<BroType> t, const char* i, attr_list* arg_attrs, bool in_record)
+	: type(std::move(t)),
+	  attrs(arg_attrs ? make_intrusive<Attributes>(arg_attrs, type, in_record, false) : nullptr),
+	  id(i)
 	{
-	type = t;
-	attrs = arg_attrs ? new Attributes(arg_attrs, t, in_record, false) : 0;
-	id = i;
 	}
 
 TypeDecl::TypeDecl(const TypeDecl& other)
 	{
-	type = other.type->Ref();
+	type = other.type;
 	attrs = other.attrs;
 
-	if ( attrs )
-		::Ref(attrs);
-
 	id = copy_string(other.id);
 	}
 
 TypeDecl::~TypeDecl()
 	{
-	Unref(type);
-	Unref(attrs);
 	delete [] id;
 	}
 
@@ -692,19 +653,19 @@ BroType* RecordType::FieldType(const char* field) const
 
 BroType* RecordType::FieldType(int field) const
 	{
-	return (*types)[field]->type;
+	return (*types)[field]->type.get();
 	}
 
-Val* RecordType::FieldDefault(int field) const
+IntrusivePtr<Val> RecordType::FieldDefault(int field) const
 	{
 	const TypeDecl* td = FieldDecl(field);
 
 	if ( ! td->attrs )
-		return 0;
+		return nullptr;
 
 	const Attr* def_attr = td->attrs->FindAttr(ATTR_DEFAULT);
 
-	return def_attr ? def_attr->AttrExpr()->Eval(nullptr).release() : nullptr;
+	return def_attr ? def_attr->AttrExpr()->Eval(nullptr) : nullptr;
 	}
 
 int RecordType::FieldOffset(const char* field) const
@@ -806,9 +767,9 @@ static string container_type_name(const BroType* ft)
 	return s;
 	}
 
-TableVal* RecordType::GetRecordFieldsVal(const RecordVal* rv) const
+IntrusivePtr<TableVal> RecordType::GetRecordFieldsVal(const RecordVal* rv) const
 	{
-	auto rval = new TableVal(internal_type("record_field_table")->AsTableType());
+	auto rval = make_intrusive<TableVal>(IntrusivePtr{NewRef{}, internal_type("record_field_table")->AsTableType()});
 
 	for ( int i = 0; i < NumFields(); ++i )
 		{
@@ -824,15 +785,15 @@ TableVal* RecordType::GetRecordFieldsVal(const RecordVal* rv) const
 
 		bool logged = (fd->attrs && fd->FindAttr(ATTR_LOG) != 0);
 
-		RecordVal* nr = new RecordVal(internal_type("record_field")->AsRecordType());
+		auto nr = make_intrusive<RecordVal>(internal_type("record_field")->AsRecordType());
 
 		string s = container_type_name(ft);
-		nr->Assign(0, new StringVal(s));
+		nr->Assign(0, make_intrusive<StringVal>(s));
 		nr->Assign(1, val_mgr->GetBool(logged));
 		nr->Assign(2, fv);
 		nr->Assign(3, FieldDefault(i));
 		Val* field_name = new StringVal(FieldName(i));
-		rval->Assign(field_name, nr);
+		rval->Assign(field_name, std::move(nr));
 		Unref(field_name);
 		}
 
@@ -863,9 +824,9 @@ const char* RecordType::AddFields(type_decl_list* others, attr_list* attr)
 		if ( log )
 			{
 			if ( ! td->attrs )
-				td->attrs = new Attributes(new attr_list, td->type, true, false);
+				td->attrs = make_intrusive<Attributes>(new attr_list, td->type, true, false);
 
-			td->attrs->AddAttr(new Attr(ATTR_LOG));
+			td->attrs->AddAttr(make_intrusive<Attr>(ATTR_LOG));
 			}
 
 		types->push_back(td);
@@ -874,7 +835,7 @@ const char* RecordType::AddFields(type_decl_list* others, attr_list* attr)
 	delete others;
 
 	num_fields = types->length();
-	return 0;
+	return nullptr;
 	}
 
 void RecordType::DescribeFields(ODesc* d) const
@@ -890,7 +851,7 @@ void RecordType::DescribeFields(ODesc* d) const
 			d->Add(td->id);
 			d->Add(":");
 
-			if ( d->FindType(td->type) )
+			if ( d->FindType(td->type.get()) )
 				d->Add("<recursion>");
 			else
 				td->type->Describe(d);
@@ -936,7 +897,7 @@ void RecordType::DescribeFieldsReST(ODesc* d, bool func_args) const
 
 		const TypeDecl* td = FieldDecl(i);
 
-		if ( d->FindType(td->type) )
+		if ( d->FindType(td->type.get()) )
 			d->Add("<recursion>");
 		else
 			{
@@ -1046,20 +1007,16 @@ void SubNetType::Describe(ODesc* d) const
 		d->Add(int(Tag()));
 	}
 
-FileType::FileType(BroType* yield_type)
+FileType::FileType(IntrusivePtr<BroType> yield_type)
-: BroType(TYPE_FILE)
+	: BroType(TYPE_FILE), yield(std::move(yield_type))
 	{
-	yield = yield_type;
 	}
 
-FileType::~FileType()
+FileType::~FileType() = default;
-	{
-	Unref(yield);
-	}
 
 BroType* FileType::YieldType()
 	{
-	return yield;
+	return yield.get();
 	}
 
 void FileType::Describe(ODesc* d) const
@@ -1104,18 +1061,10 @@ EnumType::EnumType(const string& name)
 	}
 
 EnumType::EnumType(const EnumType* e)
-	: BroType(TYPE_ENUM)
+	: BroType(TYPE_ENUM), names(e->names), vals(e->vals)
 	{
 	counter = e->counter;
 	SetName(e->GetName());
-
-	for ( auto it = e->names.begin(); it != e->names.end(); ++it )
-		names[it->first] = it->second;
-
-	vals = e->vals;
-
-	for ( auto& kv : vals )
-		::Ref(kv.second);
 	}
 
 EnumType* EnumType::ShallowClone()
@@ -1126,11 +1075,7 @@ EnumType* EnumType::ShallowClone()
 	return new EnumType(this);
 	}
 
-EnumType::~EnumType()
+EnumType::~EnumType() = default;
-	{
-	for ( auto& kv : vals )
-		Unref(kv.second);
-	}
 
 // Note, we use reporter->Error() here (not Error()) to include the current script
 // location in the error message, rather than the one where the type was
@@ -1180,7 +1125,7 @@ void EnumType::CheckAndAddName(const string& module_name, const char* name,
 		id->SetEnumConst();
 
 		if ( deprecation )
-			id->MakeDeprecated(deprecation);
+			id->MakeDeprecated({NewRef{}, deprecation});
 
 		zeekygen_mgr->Identifier(std::move(id));
 		}
@@ -1203,7 +1148,7 @@ void EnumType::CheckAndAddName(const string& module_name, const char* name,
 	AddNameInternal(module_name, name, val, is_export);
 
 	if ( vals.find(val) == vals.end() )
-		vals[val] = new EnumVal(this, val);
+		vals[val] = IntrusivePtr{AdoptRef{}, new EnumVal(this, val)};
 
 	set<BroType*> types = BroType::GetAliases(GetName());
 	set<BroType*>::const_iterator it;
@@ -1239,7 +1184,7 @@ const char* EnumType::Lookup(bro_int_t value) const
 		if ( iter->second == value )
 			return iter->first.c_str();
 
-	return 0;
+	return nullptr;
 	}
 
 EnumType::enum_name_list EnumType::Names() const
@@ -1252,20 +1197,19 @@ EnumType::enum_name_list EnumType::Names() const
 	return n;
 	}
 
-EnumVal* EnumType::GetVal(bro_int_t i)
+IntrusivePtr<EnumVal> EnumType::GetVal(bro_int_t i)
 	{
 	auto it = vals.find(i);
-	EnumVal* rval;
+	IntrusivePtr<EnumVal> rval;
 
 	if ( it == vals.end() )
 		{
-		rval = new EnumVal(this, i);
+		rval = IntrusivePtr{AdoptRef{}, new EnumVal(this, i)};
 		vals[i] = rval;
 		}
 	else
 		rval = it->second;
 
-	::Ref(rval);
 	return rval;
 	}
 
@@ -1346,23 +1290,17 @@ void EnumType::DescribeReST(ODesc* d, bool roles_only) const
 		}
 	}
 
-VectorType::VectorType(BroType* element_type)
+VectorType::VectorType(IntrusivePtr<BroType> element_type)
-    : BroType(TYPE_VECTOR), yield_type(element_type)
+	: BroType(TYPE_VECTOR), yield_type(std::move(element_type))
 	{
 	}
 
 VectorType* VectorType::ShallowClone()
 	{
-	if ( yield_type )
-		yield_type->Ref();
-
 	return new VectorType(yield_type);
 	}
 
-VectorType::~VectorType()
+VectorType::~VectorType() = default;
-	{
-	Unref(yield_type);
-	}
 
 BroType* VectorType::YieldType()
 	{
@@ -1371,14 +1309,9 @@ BroType* VectorType::YieldType()
 	// return any as that's what other code historically expects for type
 	// comparisions.
 	if ( IsUnspecifiedVector() )
-		{
+		return base_type_no_ref(TYPE_ANY);
-		BroType* ret = ::base_type(TYPE_ANY);
-		Unref(ret); // unref, because this won't be held by anyone.
-		assert(ret);
-		return ret;
-		}
 
-	return yield_type;
+	return yield_type.get();
 	}
 
 const BroType* VectorType::YieldType() const
@@ -1389,13 +1322,13 @@ const BroType* VectorType::YieldType() const
 	// comparisions.
 	if ( IsUnspecifiedVector() )
 		{
-		BroType* ret = ::base_type(TYPE_ANY);
+		auto ret = ::base_type(TYPE_ANY);
-		Unref(ret); // unref, because this won't be held by anyone.
 		assert(ret);
-		return ret;
+		// release, because this won't be held by anyone.
+		return ret.release();
 		}
 
-	return yield_type;
+	return yield_type.get();
 	}
 
 int VectorType::MatchesIndex(ListExpr* const index) const
@@ -1587,7 +1520,7 @@ int same_type(const BroType* t1, const BroType* t2, int is_init, bool match_reco
 			const TypeDecl* td2 = rt2->FieldDecl(i);
 
 			if ( (match_record_field_names && ! streq(td1->id, td2->id)) ||
-			     ! same_type(td1->type, td2->type, is_init, match_record_field_names) )
+			     ! same_type(td1->type.get(), td2->type.get(), is_init, match_record_field_names) )
 				return 0;
 			}
 
@@ -1767,7 +1700,7 @@ TypeTag max_type(TypeTag t1, TypeTag t2)
 		}
 	}
 
-BroType* merge_types(const BroType* t1, const BroType* t2)
+IntrusivePtr<BroType> merge_types(const BroType* t1, const BroType* t2)
 	{
 	t1 = flatten_type(t1);
 	t2 = flatten_type(t2);
@@ -1781,7 +1714,7 @@ BroType* merge_types(const BroType* t1, const BroType* t2)
 	if ( tg1 != tg2 )
 		{
 		t1->Error("incompatible types", t2);
-		return 0;
+		return nullptr;
 		}
 
 	switch ( tg1 ) {
@@ -1808,7 +1741,7 @@ BroType* merge_types(const BroType* t1, const BroType* t2)
 			                      t1->GetName().data(), t2->GetName().data());
 
 			t1->Error(msg.data(), t2);
-			return 0;
+			return nullptr;
 			}
 
 		// Doing a lookup here as a roundabout way of ref-ing t1, without
@@ -1821,14 +1754,14 @@ BroType* merge_types(const BroType* t1, const BroType* t2)
 			// than a copy since it may be redef'd later in parsing.  If we
 			// return a copy, then whoever is using this return value won't
 			// actually see those changes from the redef.
-			return id->AsType()->Ref();
+			return {NewRef{}, id->AsType()};
 
 		std::string msg = fmt("incompatible enum types: '%s' and '%s'"
 		                      " ('%s' enum type ID is invalid)",
 		                      t1->GetName().data(), t2->GetName().data(),
 		                      t1->GetName().data());
 		t1->Error(msg.data(), t2);
-		return 0;
+		return nullptr;
 		}
 
 	case TYPE_TABLE:
@@ -1838,56 +1771,49 @@ BroType* merge_types(const BroType* t1, const BroType* t2)
 
 		const type_list* tl1 = it1->IndexTypes();
 		const type_list* tl2 = it2->IndexTypes();
-		TypeList* tl3 = 0;
+		IntrusivePtr<TypeList> tl3;
 
 		if ( tl1 || tl2 )
 			{
 			if ( ! tl1 || ! tl2 || tl1->length() != tl2->length() )
 				{
 				t1->Error("incompatible types", t2);
-				return 0;
+				return nullptr;
 				}
 
-			tl3 = new TypeList();
+			tl3 = make_intrusive<TypeList>();
 
 			loop_over_list(*tl1, i)
 				{
-				BroType* tl3_i = merge_types((*tl1)[i], (*tl2)[i]);
+				auto tl3_i = merge_types((*tl1)[i], (*tl2)[i]);
 				if ( ! tl3_i )
-					{
+					return nullptr;
-					Unref(tl3);
-					return 0;
-					}
 
-				tl3->Append(tl3_i);
+				tl3->Append(std::move(tl3_i));
 				}
 			}
 
 		const BroType* y1 = t1->YieldType();
 		const BroType* y2 = t2->YieldType();
-		BroType* y3 = 0;
+		IntrusivePtr<BroType> y3;
 
 		if ( y1 || y2 )
 			{
 			if ( ! y1 || ! y2 )
 				{
 				t1->Error("incompatible types", t2);
-				Unref(tl3);
+				return nullptr;
-				return 0;
 				}
 
 			y3 = merge_types(y1, y2);
 			if ( ! y3 )
-				{
+				return nullptr;
-				Unref(tl3);
-				return 0;
-				}
 			}
 
 		if ( t1->IsSet() )
-			return new SetType(tl3, 0);
+			return make_intrusive<SetType>(std::move(tl3), nullptr);
 		else
-			return new TableType(tl3, y3);
+			return make_intrusive<TableType>(std::move(tl3), std::move(y3));
 		}
 
 	case TYPE_FUNC:
@@ -1895,16 +1821,17 @@ BroType* merge_types(const BroType* t1, const BroType* t2)
 		if ( ! same_type(t1, t2) )
 			{
 			t1->Error("incompatible types", t2);
-			return 0;
+			return nullptr;
 			}
 
 		const FuncType* ft1 = (const FuncType*) t1;
 		const FuncType* ft2 = (const FuncType*) t1;
-		BroType* args = merge_types(ft1->Args(), ft2->Args());
+		auto args = merge_types(ft1->Args(), ft2->Args());
-		BroType* yield = t1->YieldType() ?
+		auto yield = t1->YieldType() ?
-			merge_types(t1->YieldType(), t2->YieldType()) : 0;
+			merge_types(t1->YieldType(), t2->YieldType()) : nullptr;
 
-		return new FuncType(args->AsRecordType(), yield, ft1->Flavor());
+		return make_intrusive<FuncType>(IntrusivePtr{AdoptRef{}, args.release()->AsRecordType()},
+		                                std::move(yield), ft1->Flavor());
 		}
 
 	case TYPE_RECORD:
@@ -1913,7 +1840,7 @@ BroType* merge_types(const BroType* t1, const BroType* t2)
 		const RecordType* rt2 = (const RecordType*) t2;
 
 		if ( rt1->NumFields() != rt2->NumFields() )
-			return 0;
+			return nullptr;
 
 		type_decl_list* tdl3 = new type_decl_list(rt1->NumFields());
 
@@ -1921,20 +1848,19 @@ BroType* merge_types(const BroType* t1, const BroType* t2)
 			{
 			const TypeDecl* td1 = rt1->FieldDecl(i);
 			const TypeDecl* td2 = rt2->FieldDecl(i);
-			BroType* tdl3_i = merge_types(td1->type, td2->type);
+			auto tdl3_i = merge_types(td1->type.get(), td2->type.get());
 
 			if ( ! streq(td1->id, td2->id) || ! tdl3_i )
 				{
 				t1->Error("incompatible record fields", t2);
 				delete tdl3;
-				Unref(tdl3_i);
+				return nullptr;
-				return 0;
 				}
 
-			tdl3->push_back(new TypeDecl(tdl3_i, copy_string(td1->id)));
+			tdl3->push_back(new TypeDecl(std::move(tdl3_i), copy_string(td1->id)));
 			}
 
-		return new RecordType(tdl3);
+		return make_intrusive<RecordType>(tdl3);
 		}
 
 	case TYPE_LIST:
@@ -1945,7 +1871,7 @@ BroType* merge_types(const BroType* t1, const BroType* t2)
 		if ( tl1->IsPure() != tl2->IsPure() )
 			{
 			tl1->Error("incompatible lists", tl2);
-			return 0;
+			return nullptr;
 			}
 
 		const type_list* l1 = tl1->Types();
@@ -1957,7 +1883,7 @@ BroType* merge_types(const BroType* t1, const BroType* t2)
 				tl1->Error("empty list");
 			else
 				tl2->Error("empty list");
-			return 0;
+			return nullptr;
 			}
 
 		if ( tl1->IsPure() )
@@ -1974,10 +1900,10 @@ BroType* merge_types(const BroType* t1, const BroType* t2)
 		if ( l1->length() != l2->length() )
 			{
 			tl1->Error("different number of indices", tl2);
-			return 0;
+			return nullptr;
 			}
 
-		TypeList* tl3 = new TypeList();
+		auto tl3 = make_intrusive<TypeList>();
 		loop_over_list(*l1, i)
 			tl3->Append(merge_types((*l1)[i], (*l2)[i]));
 
@@ -1988,31 +1914,31 @@ BroType* merge_types(const BroType* t1, const BroType* t2)
 		if ( ! same_type(t1->YieldType(), t2->YieldType()) )
 			{
 			t1->Error("incompatible types", t2);
-			return 0;
+			return nullptr;
 			}
 
-		return new VectorType(merge_types(t1->YieldType(), t2->YieldType()));
+		return make_intrusive<VectorType>(merge_types(t1->YieldType(), t2->YieldType()));
 
 	case TYPE_FILE:
 		if ( ! same_type(t1->YieldType(), t2->YieldType()) )
 			{
 			t1->Error("incompatible types", t2);
-			return 0;
+			return nullptr;
 			}
 
-		return new FileType(merge_types(t1->YieldType(), t2->YieldType()));
+		return make_intrusive<FileType>(merge_types(t1->YieldType(), t2->YieldType()));
 
 	case TYPE_UNION:
 		reporter->InternalError("union type in merge_types()");
-		return 0;
+		return nullptr;
 
 	default:
 		reporter->InternalError("bad type in merge_types()");
-		return 0;
+		return nullptr;
 	}
 	}
 
-BroType* merge_type_list(ListExpr* elements)
+IntrusivePtr<BroType> merge_type_list(ListExpr* elements)
 	{
 	TypeList* tl_type = elements->Type()->AsTypeList();
 	type_list* tl = tl_type->Types();
@@ -2020,20 +1946,16 @@ BroType* merge_type_list(ListExpr* elements)
 	if ( tl->length() < 1 )
 		{
 		reporter->Error("no type can be inferred for empty list");
-		return 0;
+		return nullptr;
 		}
 
-	BroType* t = (*tl)[0]->Ref();
+	IntrusivePtr<BroType> t{NewRef{}, (*tl)[0]};
 
 	if ( tl->length() == 1 )
 		return t;
 
 	for ( int i = 1; t && i < tl->length(); ++i )
-		{
+		t = merge_types(t.get(), (*tl)[i]);
-		BroType* t_new = merge_types(t, (*tl)[i]);
-		Unref(t);
-		t = t_new;
-		}
 
 	if ( ! t )
 		reporter->Error("inconsistent types in list");
@@ -2060,7 +1982,7 @@ static BroType* reduce_type(BroType* t)
 		return t;
 	}
 
-BroType* init_type(Expr* init)
+IntrusivePtr<BroType> init_type(Expr* init)
 	{
 	if ( init->Tag() != EXPR_LIST )
 		{
@@ -2076,7 +1998,7 @@ BroType* init_type(Expr* init)
 			return nullptr;
 			}
 
-		return t.release();
+		return t;
 		}
 
 	ListExpr* init_list = init->AsListExpr();
@@ -2094,7 +2016,7 @@ BroType* init_type(Expr* init)
 	if ( e0->IsRecordElement(0) )
 		// ListExpr's know how to build a record from their
 		// components.
-		return init_list->InitType().release();
+		return init_list->InitType();
 
 	auto t = e0->InitType();
 
@@ -2115,7 +2037,7 @@ BroType* init_type(Expr* init)
 		if ( same_type(t.get(), ti) )
 			continue;
 
-		t = IntrusivePtr<BroType>{AdoptRef{}, merge_types(t.get(), ti)};
+		t = merge_types(t.get(), ti);
 		}
 
 	if ( ! t )
@@ -2126,18 +2048,18 @@ BroType* init_type(Expr* init)
 
 	if ( t->Tag() == TYPE_TABLE && ! t->AsTableType()->IsSet() )
 		// A list of table elements.
-		return t.release();
+		return t;
 
 	// A set.  If the index type isn't yet a type list, make
 	// it one, as that's what's required for creating a set type.
 	if ( t->Tag() != TYPE_LIST )
 		{
-		auto tl = make_intrusive<TypeList>(t.get()->Ref());
+		auto tl = make_intrusive<TypeList>(t);
-		tl->Append(t.release());
+		tl->Append(std::move(t));
 		t = std::move(tl);
 		}
 
-	return new SetType(t.release()->AsTypeList(), 0);
+	return make_intrusive<SetType>(IntrusivePtr{AdoptRef{}, t.release()->AsTypeList()}, nullptr);
 	}
 
 bool is_atomic_type(const BroType* t)

src/Type.h

@@ -5,6 +5,7 @@
 #include "Obj.h"
 #include "Attr.h"
 #include "BroList.h"
+#include "IntrusivePtr.h"
 
 #include <string>
 #include <set>
@@ -346,12 +347,11 @@ private:
 
 class TypeList : public BroType {
 public:
-	explicit TypeList(BroType* arg_pure_type = 0) : BroType(TYPE_LIST)
+	explicit TypeList(IntrusivePtr<BroType> arg_pure_type = nullptr)
+		: BroType(TYPE_LIST), pure_type(std::move(arg_pure_type))
 		{
-		pure_type = arg_pure_type;
-		if ( pure_type )
-			pure_type->Ref();
 		}
+
 	~TypeList() override;
 
 	const type_list* Types() const	{ return &types; }
@@ -361,23 +361,23 @@ public:
 
 	// Returns the underlying pure type, or nil if the list
 	// is not pure or is empty.
-	BroType* PureType()		{ return pure_type; }
+	BroType* PureType()		{ return pure_type.get(); }
-	const BroType* PureType() const	{ return pure_type; }
+	const BroType* PureType() const	{ return pure_type.get(); }
 
 	// True if all of the types match t, false otherwise.  If
 	// is_init is true, then the matching is done in the context
 	// of an initialization.
 	int AllMatch(const BroType* t, int is_init) const;
 
-	void Append(BroType* t);
+	void Append(IntrusivePtr<BroType> t);
-	void AppendEvenIfNotPure(BroType* t);
+	void AppendEvenIfNotPure(IntrusivePtr<BroType> t);
 
 	void Describe(ODesc* d) const override;
 
 	unsigned int MemoryAllocation() const override;
 
 protected:
-	BroType* pure_type;
+	IntrusivePtr<BroType> pure_type;
 	type_list types;
 };
 
@@ -385,7 +385,7 @@ class IndexType : public BroType {
 public:
 	int MatchesIndex(ListExpr* index) const override;
 
-	TypeList* Indices() const		{ return indices; }
+	TypeList* Indices() const		{ return indices.get(); }
 	const type_list* IndexTypes() const	{ return indices->Types(); }
 	BroType* YieldType() override;
 	const BroType* YieldType() const override;
@@ -397,22 +397,22 @@ public:
 	bool IsSubNetIndex() const;
 
 protected:
-	IndexType(){ indices = 0; yield_type = 0; }
+	IndexType(TypeTag t, IntrusivePtr<TypeList> arg_indices,
-	IndexType(TypeTag t, TypeList* arg_indices, BroType* arg_yield_type) :
+	          IntrusivePtr<BroType> arg_yield_type)
-		BroType(t)
+		: BroType(t), indices(std::move(arg_indices)),
+		  yield_type(std::move(arg_yield_type))
 		{
-		indices = arg_indices;
-		yield_type = arg_yield_type;
 		}
+
 	~IndexType() override;
 
-	TypeList* indices;
+	IntrusivePtr<TypeList> indices;
-	BroType* yield_type;
+	IntrusivePtr<BroType> yield_type;
 };
 
 class TableType : public IndexType {
 public:
-	TableType(TypeList* ind, BroType* yield);
+	TableType(IntrusivePtr<TypeList> ind, IntrusivePtr<BroType> yield);
 
 	TableType* ShallowClone() override;
 
@@ -421,87 +421,81 @@ public:
 	bool IsUnspecifiedTable() const;
 
 protected:
-	TableType()	{}
-
 	TypeList* ExpandRecordIndex(RecordType* rt) const;
 };
 
 class SetType : public TableType {
 public:
-	SetType(TypeList* ind, ListExpr* arg_elements);
+	SetType(IntrusivePtr<TypeList> ind, IntrusivePtr<ListExpr> arg_elements);
 	~SetType() override;
 
 	SetType* ShallowClone() override;
 
-	ListExpr* SetElements() const	{ return elements; }
+	ListExpr* SetElements() const	{ return elements.get(); }
 
 protected:
-	SetType()	{}
+	IntrusivePtr<ListExpr> elements;
-
-	ListExpr* elements;
 };
 
 class FuncType : public BroType {
 public:
-	FuncType(RecordType* args, BroType* yield, function_flavor f);
+	FuncType(IntrusivePtr<RecordType> args, IntrusivePtr<BroType> yield,
+	         function_flavor f);
 	FuncType* ShallowClone() override;
 
 	~FuncType() override;
 
-	RecordType* Args() const	{ return args; }
+	RecordType* Args() const	{ return args.get(); }
 	BroType* YieldType() override;
 	const BroType* YieldType() const override;
-	void SetYieldType(BroType* arg_yield)	{ yield = arg_yield; }
+	void SetYieldType(IntrusivePtr<BroType> arg_yield)	{ yield = std::move(arg_yield); }
 	function_flavor Flavor() const { return flavor; }
 	std::string FlavorString() const;
 
 	// Used to convert a function type to an event or hook type.
 	void ClearYieldType(function_flavor arg_flav)
-		{ Unref(yield); yield = 0; flavor = arg_flav; }
+		{ yield = nullptr; flavor = arg_flav; }
 
 	int MatchesIndex(ListExpr* index) const override;
 	int CheckArgs(const type_list* args, bool is_init = false) const;
 
-	TypeList* ArgTypes() const	{ return arg_types; }
+	TypeList* ArgTypes() const	{ return arg_types.get(); }
 
 	void Describe(ODesc* d) const override;
 	void DescribeReST(ODesc* d, bool roles_only = false) const override;
 
 protected:
-	FuncType() : BroType(TYPE_FUNC) { args = 0; arg_types = 0; yield = 0; flavor = FUNC_FLAVOR_FUNCTION; }
+	FuncType() : BroType(TYPE_FUNC) { flavor = FUNC_FLAVOR_FUNCTION; }
-	RecordType* args;
+	IntrusivePtr<RecordType> args;
-	TypeList* arg_types;
+	IntrusivePtr<TypeList> arg_types;
-	BroType* yield;
+	IntrusivePtr<BroType> yield;
 	function_flavor flavor;
 };
 
 class TypeType : public BroType {
 public:
-	explicit TypeType(BroType* t) : BroType(TYPE_TYPE)	{ type = t->Ref(); }
+	explicit TypeType(IntrusivePtr<BroType> t) : BroType(TYPE_TYPE), type(std::move(t)) {}
 	TypeType* ShallowClone() override { return new TypeType(type); }
-	~TypeType() override { Unref(type); }
 
-	BroType* Type()	{ return type; }
+	BroType* Type()	{ return type.get(); }
 
 protected:
-	TypeType()	{}
+	IntrusivePtr<BroType> type;
-
-	BroType* type;
 };
 
-class TypeDecl {
+class TypeDecl final {
 public:
-	TypeDecl(BroType* t, const char* i, attr_list* attrs = 0, bool in_record = false);
+	TypeDecl(IntrusivePtr<BroType> t, const char* i, attr_list* attrs = 0, bool in_record = false);
 	TypeDecl(const TypeDecl& other);
-	virtual ~TypeDecl();
+	~TypeDecl();
 
 	const Attr* FindAttr(attr_tag a) const
 		{ return attrs ? attrs->FindAttr(a) : 0; }
 
-	virtual void DescribeReST(ODesc* d, bool roles_only = false) const;
+	void DescribeReST(ODesc* d, bool roles_only = false) const;
 
-	BroType* type;
+	IntrusivePtr<BroType> type;
-	Attributes* attrs;
+	IntrusivePtr<Attributes> attrs;
 	const char* id;
 };
 
@@ -517,7 +511,7 @@ public:
 	int HasField(const char* field) const override;
 	BroType* FieldType(const char* field) const override;
 	BroType* FieldType(int field) const;
-	Val* FieldDefault(int field) const; // Ref's the returned value; 0 if none.
+	IntrusivePtr<Val> FieldDefault(int field) const;
 
 	// A field's offset is its position in the type_decl_list,
 	// starting at 0.  Returns negative if the field doesn't exist.
@@ -539,7 +533,7 @@ public:
 	 * @param rv  an optional record value, if given the values of
 	 * all fields will be provided in the returned table.
 	 */
-	TableVal* GetRecordFieldsVal(const RecordVal* rv = nullptr) const;
+	IntrusivePtr<TableVal> GetRecordFieldsVal(const RecordVal* rv = nullptr) const;
 
 	// Returns 0 if all is ok, otherwise a pointer to an error message.
 	// Takes ownership of list.
@@ -579,8 +573,8 @@ public:
 
 class FileType : public BroType {
 public:
-	explicit FileType(BroType* yield_type);
+	explicit FileType(IntrusivePtr<BroType> yield_type);
-	FileType* ShallowClone() override { return new FileType(yield->Ref()); }
+	FileType* ShallowClone() override { return new FileType(yield); }
 	~FileType() override;
 
 	BroType* YieldType() override;
@@ -588,9 +582,7 @@ public:
 	void Describe(ODesc* d) const override;
 
 protected:
-	FileType()	{ yield = 0; }
+	IntrusivePtr<BroType> yield;
-
-	BroType* yield;
 };
 
 class OpaqueType : public BroType {
@@ -638,11 +630,9 @@ public:
 
 	void DescribeReST(ODesc* d, bool roles_only = false) const override;
 
-	EnumVal* GetVal(bro_int_t i);
+	IntrusivePtr<EnumVal> GetVal(bro_int_t i);
 
 protected:
-	EnumType() { counter = 0; }
-
 	void AddNameInternal(const std::string& module_name,
 			const char* name, bro_int_t val, bool is_export);
 
@@ -653,7 +643,7 @@ protected:
 	typedef std::map<std::string, bro_int_t> NameMap;
 	NameMap names;
 
-	using ValMap = std::unordered_map<bro_int_t, EnumVal*>;
+	using ValMap = std::unordered_map<bro_int_t, IntrusivePtr<EnumVal>>;
 	ValMap vals;
 
 	// The counter is initialized to 0 and incremented on every implicit
@@ -667,7 +657,7 @@ protected:
 
 class VectorType : public BroType {
 public:
-	explicit VectorType(BroType* t);
+	explicit VectorType(IntrusivePtr<BroType> t);
 	VectorType* ShallowClone() override;
 	~VectorType() override;
 	BroType* YieldType() override;
@@ -683,9 +673,7 @@ public:
 	void DescribeReST(ODesc* d, bool roles_only = false) const override;
 
 protected:
-	VectorType()	{ yield_type = 0; }
+	IntrusivePtr<BroType> yield_type;
-
-	BroType* yield_type;
 };
 
 extern OpaqueType* md5_type;
@@ -705,11 +693,11 @@ BroType* base_type_no_ref(TypeTag tag);
 
 // Returns the basic (non-parameterized) type with the given type.
 // The caller assumes responsibility for a reference to the type.
-inline BroType* base_type(TypeTag tag)
+inline IntrusivePtr<BroType> base_type(TypeTag tag)
-	{ return base_type_no_ref(tag)->Ref(); }
+	{ return {NewRef{}, base_type_no_ref(tag)}; }
 
 // Returns the basic error type.
-inline BroType* error_type()	{ return base_type(TYPE_ERROR); }
+inline IntrusivePtr<BroType> error_type()	{ return base_type(TYPE_ERROR); }
 
 // True if the two types are equivalent.  If is_init is true then the test is
 // done in the context of an initialization. If match_record_field_names is
@@ -735,15 +723,15 @@ extern TypeTag max_type(TypeTag t1, TypeTag t2);
 // Given two types, returns the "merge", in which promotable types
 // are promoted to the maximum of the two.  Returns nil (and generates
 // an error message) if the types are incompatible.
-extern BroType* merge_types(const BroType* t1, const BroType* t2);
+IntrusivePtr<BroType> merge_types(const BroType* t1, const BroType* t2);
 
 // Given a list of expressions, returns a (ref'd) type reflecting
 // a merged type consistent across all of them, or nil if this
 // cannot be done.
-BroType* merge_type_list(ListExpr* elements);
+IntrusivePtr<BroType> merge_type_list(ListExpr* elements);
 
 // Given an expression, infer its type when used for an initialization.
-extern BroType* init_type(Expr* init);
+IntrusivePtr<BroType> init_type(Expr* init);
 
 // Returns true if argument is an atomic type.
 bool is_atomic_type(const BroType* t);

src/Val.h

@@ -2,6 +2,7 @@
 
 #pragma once
 
+#include "IntrusivePtr.h"
 #include "Type.h"
 #include "Timer.h"
 #include "Notifier.h"
@@ -27,9 +28,7 @@ using std::string;
 #define UDP_PORT_MASK	0x20000
 #define ICMP_PORT_MASK	0x30000
 
-template <class T> class IntrusivePtr;
 template<typename T> class PDict;
-template <class T> class IntrusivePtr;
 class IterCookie;
 
 class Val;
@@ -130,7 +129,7 @@ union BroValUnion {
 class Val : public BroObj {
 public:
 	Val(double d, TypeTag t)
-		: val(d), type(base_type(t))
+		: val(d), type(base_type(t).release())
 		{
 		}
 
@@ -142,19 +141,19 @@ public:
 
 	// Extra arg to differentiate from protected version.
 	Val(BroType* t, bool type_type)
-		: type(new TypeType(t->Ref()))
+		: type(new TypeType({NewRef{}, t}))
 		{
 		}
 
 	Val()
-		: val(bro_int_t(0)), type(base_type(TYPE_ERROR))
+		: val(bro_int_t(0)), type(base_type(TYPE_ERROR).release())
 		{
 		}
 
 	~Val() override;
 
 	Val* Ref()			{ ::Ref(this); return this; }
-	Val* Clone();
+	IntrusivePtr<Val> Clone();
 
 	int IsZero() const;
 	int IsOne() const;
@@ -169,7 +168,7 @@ public:
 
 	// Returns a new Val with the "size" of this Val.  What constitutes
 	// size depends on the Val's type.
-	virtual Val* SizeVal() const;
+	virtual IntrusivePtr<Val> SizeVal() const;
 
 	// Bytes in total value object.
 	virtual unsigned int MemoryAllocation() const;
@@ -323,9 +322,9 @@ public:
 
 	static bool WouldOverflow(const BroType* from_type, const BroType* to_type, const Val* val);
 
-	TableVal* GetRecordFields();
+	IntrusivePtr<TableVal> GetRecordFields();
 
-	StringVal* ToJSON(bool only_loggable=false, RE_Matcher* re=nullptr);
+	IntrusivePtr<StringVal> ToJSON(bool only_loggable=false, RE_Matcher* re=nullptr);
 
 protected:
 
@@ -356,7 +355,7 @@ protected:
 
 	template<typename V>
 	Val(V &&v, TypeTag t) noexcept
-		: val(std::forward<V>(v)), type(base_type(t))
+		: val(std::forward<V>(v)), type(base_type(t).release())
 		{
 		}
 
@@ -379,17 +378,13 @@ protected:
 		// Caches a cloned value for later reuse during the same
 		// cloning operation. For recursive types, call this *before*
 		// descending down.
-		Val* NewClone(Val *src, Val* dst)
+		IntrusivePtr<Val> NewClone(Val* src, IntrusivePtr<Val> dst);
-			{
-			clones.insert(std::make_pair(src, dst));
-			return dst;
-			}
 
 		std::unordered_map<Val*, Val*> clones;
 	};
 
-	Val* Clone(CloneState* state);
+	IntrusivePtr<Val> Clone(CloneState* state);
-	virtual Val* DoClone(CloneState* state);
+	virtual IntrusivePtr<Val> DoClone(CloneState* state);
 
 	BroValUnion val;
 	BroType* type;
@@ -476,7 +471,7 @@ protected:
 
 class PortVal : public Val {
 public:
-	Val* SizeVal() const override	{ return val_mgr->GetInt(val.uint_val); }
+	IntrusivePtr<Val> SizeVal() const override;
 
 	// Returns the port number in host order (not including the mask).
 	uint32_t Port() const;
@@ -507,7 +502,7 @@ protected:
 	PortVal(uint32_t p);
 
 	void ValDescribe(ODesc* d) const override;
-	Val* DoClone(CloneState* state) override;
+	IntrusivePtr<Val> DoClone(CloneState* state) override;
 };
 
 class AddrVal : public Val {
@@ -516,7 +511,7 @@ public:
 	explicit AddrVal(const std::string& text);
 	~AddrVal() override;
 
-	Val* SizeVal() const override;
+	IntrusivePtr<Val> SizeVal() const override;
 
 	// Constructor for address already in network order.
 	explicit AddrVal(uint32_t addr);          // IPv4.
@@ -526,7 +521,7 @@ public:
 	unsigned int MemoryAllocation() const override;
 
 protected:
-	Val* DoClone(CloneState* state) override;
+	IntrusivePtr<Val> DoClone(CloneState* state) override;
 };
 
 class SubNetVal : public Val {
@@ -539,7 +534,7 @@ public:
 	explicit SubNetVal(const IPPrefix& prefix);
 	~SubNetVal() override;
 
-	Val* SizeVal() const override;
+	IntrusivePtr<Val> SizeVal() const override;
 
 	const IPAddr& Prefix() const;
 	int Width() const;
@@ -551,7 +546,7 @@ public:
 
 protected:
 	void ValDescribe(ODesc* d) const override;
-	Val* DoClone(CloneState* state) override;
+	IntrusivePtr<Val> DoClone(CloneState* state) override;
 };
 
 class StringVal : public Val {
@@ -561,7 +556,7 @@ public:
 	explicit StringVal(const string& s);
 	StringVal(int length, const char* s);
 
-	Val* SizeVal() const override;
+	IntrusivePtr<Val> SizeVal() const override;
 
 	int Len();
 	const u_char* Bytes();
@@ -581,7 +576,7 @@ public:
 
 protected:
 	void ValDescribe(ODesc* d) const override;
-	Val* DoClone(CloneState* state) override;
+	IntrusivePtr<Val> DoClone(CloneState* state) override;
 };
 
 class PatternVal : public Val {
@@ -597,7 +592,7 @@ public:
 
 protected:
 	void ValDescribe(ODesc* d) const override;
-	Val* DoClone(CloneState* state) override;
+	IntrusivePtr<Val> DoClone(CloneState* state) override;
 };
 
 // ListVals are mainly used to index tables that have more than one
@@ -609,7 +604,7 @@ public:
 
 	TypeTag BaseTag() const		{ return tag; }
 
-	Val* SizeVal() const override	{ return val_mgr->GetCount(vals.length()); }
+	IntrusivePtr<Val> SizeVal() const override;
 
 	int Length() const		{ return vals.length(); }
 	Val* Index(const int n)		{ return vals[n]; }
@@ -638,7 +633,7 @@ public:
 	unsigned int MemoryAllocation() const override;
 
 protected:
-	Val* DoClone(CloneState* state) override;
+	IntrusivePtr<Val> DoClone(CloneState* state) override;
 
 	val_list vals;
 	TypeTag tag;
@@ -648,27 +643,18 @@ extern double bro_start_network_time;
 
 class TableEntryVal {
 public:
-	explicit TableEntryVal(Val* v)
+	template<typename V>
+	explicit TableEntryVal(V&& v)
+		: val(std::forward<V>(v))
 		{
-		val = v;
 		last_access_time = network_time;
 		expire_access_time =
 			int(network_time - bro_start_network_time);
 		}
 
-	TableEntryVal* Clone(Val::CloneState* state)
+	TableEntryVal* Clone(Val::CloneState* state);
-		{
-		auto rval = new TableEntryVal(val ? val->Clone(state) : nullptr);
-		rval->last_access_time = last_access_time;
-		rval->expire_access_time = expire_access_time;
-		return rval;
-		}
 
-	~TableEntryVal()	{ }
+	Val* Value()	{ return val.get(); }
-
-	Val* Value()	{ return val; }
-	void Ref()	{ val->Ref(); }
-	void Unref()	{ ::Unref(val); }
 
 	// Returns/sets time of last expiration relevant access to this value.
 	double ExpireAccessTime() const
@@ -679,7 +665,7 @@ public:
 protected:
 	friend class TableVal;
 
-	Val* val;
+	IntrusivePtr<Val> val;
 	double last_access_time;
 
 	// The next entry stores seconds since Bro's start.  We use ints here
@@ -707,7 +693,7 @@ class Frame;
 
 class TableVal : public Val, public notifier::Modifiable {
 public:
-	explicit TableVal(TableType* t, Attributes* attrs = 0);
+	explicit TableVal(IntrusivePtr<TableType> t, IntrusivePtr<Attributes> attrs = nullptr);
 	~TableVal() override;
 
 	// Returns true if the assignment typechecked, false if not. The
@@ -715,10 +701,12 @@ public:
 	// version takes a HashKey and Unref()'s it when done. If we're a
 	// set, new_val has to be nil. If we aren't a set, index may be nil
 	// in the second version.
+	int Assign(Val* index, IntrusivePtr<Val> new_val);
 	int Assign(Val* index, Val* new_val);
+	int Assign(Val* index, HashKey* k, IntrusivePtr<Val> new_val);
 	int Assign(Val* index, HashKey* k, Val* new_val);
 
-	Val* SizeVal() const override	{ return val_mgr->GetCount(Size()); }
+	IntrusivePtr<Val> SizeVal() const override;
 
 	// Add the entire contents of the table to the given value,
 	// which must also be a TableVal.
@@ -761,17 +749,17 @@ public:
 	// Returns the element's value if it exists in the table,
 	// nil otherwise.  Note, "index" is not const because we
 	// need to Ref/Unref it when calling the default function.
-	Val* Lookup(Val* index, bool use_default_val = true);
+	IntrusivePtr<Val> Lookup(Val* index, bool use_default_val = true);
 
 	// For a table[subnet]/set[subnet], return all subnets that cover
 	// the given subnet.
 	// Causes an internal error if called for any other kind of table.
-	VectorVal* LookupSubnets(const SubNetVal* s);
+	IntrusivePtr<VectorVal> LookupSubnets(const SubNetVal* s);
 
 	// For a set[subnet]/table[subnet], return a new table that only contains
 	// entries that cover the given subnet.
 	// Causes an internal error if called for any other kind of table.
-	TableVal* LookupSubnetValues(const SubNetVal* s);
+	IntrusivePtr<TableVal> LookupSubnetValues(const SubNetVal* s);
 
 	// Sets the timestamp for the given index to network time.
 	// Returns false if index does not exist.
@@ -781,16 +769,16 @@ public:
 	ListVal* RecoverIndex(const HashKey* k) const;
 
 	// Returns the element if it was in the table, false otherwise.
-	Val* Delete(const Val* index);
+	IntrusivePtr<Val> Delete(const Val* index);
-	Val* Delete(const HashKey* k);
+	IntrusivePtr<Val> Delete(const HashKey* k);
 
 	// Returns a ListVal representation of the table (which must be a set).
 	ListVal* ConvertToList(TypeTag t=TYPE_ANY) const;
 	ListVal* ConvertToPureList() const;	// must be single index type
 
-	void SetAttrs(Attributes* attrs);
+	void SetAttrs(IntrusivePtr<Attributes> attrs);
 	Attr* FindAttr(attr_tag t) const;
-	Attributes* Attrs()	{ return attrs; }
+	Attributes* Attrs()	{ return attrs.get(); }
 
 	// Returns the size of the table.
 	int Size() const;
@@ -824,14 +812,14 @@ public:
 	notifier::Modifiable* Modifiable() override	{ return this; }
 
 protected:
-	void Init(TableType* t);
+	void Init(IntrusivePtr<TableType> t);
 
 	void CheckExpireAttr(attr_tag at);
 	int ExpandCompoundAndInit(val_list* vl, int k, IntrusivePtr<Val> new_val);
 	int CheckAndAssign(Val* index, IntrusivePtr<Val> new_val);
 
 	// Calculates default value for index.  Returns 0 if none.
-	Val* Default(Val* index);
+	IntrusivePtr<Val> Default(Val* index);
 
 	// Returns true if item expiration is enabled.
 	bool ExpirationEnabled()	{ return expire_time != 0; }
@@ -851,18 +839,18 @@ protected:
 	// Calls &change_func. Does not take ownership of values. (Refs if needed).
 	void CallChangeFunc(const Val* index, Val* old_value, OnChangeType tpe);
 
-	Val* DoClone(CloneState* state) override;
+	IntrusivePtr<Val> DoClone(CloneState* state) override;
 
-	TableType* table_type;
+	IntrusivePtr<TableType> table_type;
 	CompositeHash* table_hash;
-	Attributes* attrs;
+	IntrusivePtr<Attributes> attrs;
-	Expr* expire_time;
+	IntrusivePtr<Expr> expire_time;
-	Expr* expire_func;
+	IntrusivePtr<Expr> expire_func;
 	TableValTimer* timer;
 	IterCookie* expire_cookie;
 	PrefixTable* subnets;
-	Val* def_val;
+	IntrusivePtr<Val> def_val;
-	Expr* change_func = nullptr;
+	IntrusivePtr<Expr> change_func;
 	// prevent recursion of change functions
 	bool in_change_func = false;
 };
@@ -872,12 +860,12 @@ public:
 	explicit RecordVal(RecordType* t, bool init_fields = true);
 	~RecordVal() override;
 
-	Val* SizeVal() const override
+	IntrusivePtr<Val> SizeVal() const override;
-		{ return val_mgr->GetCount(Type()->AsRecordType()->NumFields()); }
 
+	void Assign(int field, IntrusivePtr<Val> new_val);
 	void Assign(int field, Val* new_val);
 	Val* Lookup(int field) const;	// Does not Ref() value.
-	Val* LookupWithDefault(int field) const;	// Does Ref() value.
+	IntrusivePtr<Val> LookupWithDefault(int field) const;
 
 	/**
 	 * Looks up the value of a field by field name.  If the field doesn't
@@ -885,17 +873,16 @@ public:
 	 * @param field name of field to lookup.
 	 * @param with_default whether to rely on field's &default attribute when
 	 * the field has yet to be initialized.
-	 * @return the value in field \a field.  It is Ref()'d only if
+	 * @return the value in field \a field.
-	 * \a with_default is true.
 	 */
-	Val* Lookup(const char* field, bool with_default = false) const;
+	IntrusivePtr<Val> Lookup(const char* field, bool with_default = false) const;
 
 	void Describe(ODesc* d) const override;
 
 	/**
 	 * Returns a "record_field_table" value for introspection purposes.
 	 */
-	TableVal* GetRecordFieldsVal() const;
+	IntrusivePtr<TableVal> GetRecordFieldsVal() const;
 
 	// This is an experiment to associate a BroObj within the
 	// event engine to a record value in bro script.
@@ -913,8 +900,8 @@ public:
 	//
 	// The *allow_orphaning* parameter allows for a record to be demoted
 	// down to a record type that contains less fields.
-	RecordVal* CoerceTo(const RecordType* other, Val* aggr, bool allow_orphaning = false) const;
+	IntrusivePtr<RecordVal> CoerceTo(const RecordType* other, Val* aggr, bool allow_orphaning = false) const;
-	RecordVal* CoerceTo(RecordType* other, bool allow_orphaning = false);
+	IntrusivePtr<RecordVal> CoerceTo(RecordType* other, bool allow_orphaning = false);
 
 	unsigned int MemoryAllocation() const override;
 	void DescribeReST(ODesc* d) const override;
@@ -927,7 +914,7 @@ public:
 	static void ResizeParseTimeRecords();
 
 protected:
-	Val* DoClone(CloneState* state) override;
+	IntrusivePtr<Val> DoClone(CloneState* state) override;
 
 	BroObj* origin;
 
@@ -936,7 +923,7 @@ protected:
 
 class EnumVal : public Val {
 public:
-	Val* SizeVal() const override	{ return val_mgr->GetInt(val.int_val); }
+	IntrusivePtr<Val> SizeVal() const override;
 
 protected:
 	friend class Val;
@@ -947,7 +934,7 @@ protected:
 		}
 
 	void ValDescribe(ODesc* d) const override;
-	Val* DoClone(CloneState* state) override;
+	IntrusivePtr<Val> DoClone(CloneState* state) override;
 };
 
 
@@ -956,8 +943,7 @@ public:
 	explicit VectorVal(VectorType* t);
 	~VectorVal() override;
 
-	Val* SizeVal() const override
+	IntrusivePtr<Val> SizeVal() const override;
-		{ return val_mgr->GetCount(uint32_t(val.vector_val->size())); }
 
 	// Returns false if the type of the argument was wrong.
 	// The vector will automatically grow to accomodate the index.
@@ -965,11 +951,14 @@ public:
 	// Note: does NOT Ref() the element! Remember to do so unless
 	//       the element was just created and thus has refcount 1.
 	//
+	bool Assign(unsigned int index, IntrusivePtr<Val> element);
 	bool Assign(unsigned int index, Val* element);
-	bool Assign(Val* index, Val* element)
+
+	template<typename E>
+	bool Assign(Val* index, E&& element)
 		{
 		return Assign(index->AsListVal()->Index(0)->CoerceToUnsigned(),
-				element);
+		              std::forward<E>(element));
 		}
 
 	// Assigns the value to how_many locations starting at index.
@@ -1009,7 +998,7 @@ public:
 
 protected:
 	void ValDescribe(ODesc* d) const override;
-	Val* DoClone(CloneState* state) override;
+	IntrusivePtr<Val> DoClone(CloneState* state) override;
 
 	VectorType* vector_type;
 };

src/Var.cc

@@ -64,7 +64,7 @@ static void make_var(ID* id, IntrusivePtr<BroType> t, init_class c,
 	if ( id->Type() && id->Type()->Tag() != TYPE_ERROR )
 		{
 		if ( dt != VAR_REDEF &&
-		     (! init || ! do_init || (! t && ! (t = {AdoptRef{}, init_type(init.get())}))) )
+		     (! init || ! do_init || (! t && ! (t = init_type(init.get())))) )
 			{
 			id->Error("already defined", init.get());
 			return;
@@ -103,10 +103,10 @@ static void make_var(ID* id, IntrusivePtr<BroType> t, init_class c,
 			return;
 			}
 
-		t = {AdoptRef{}, init_type(init.get())};
+		t = init_type(init.get());
 		if ( ! t )
 			{
-			id->SetType({AdoptRef{}, error_type()});
+			id->SetType(error_type());
 			return;
 			}
 		}
@@ -114,7 +114,7 @@ static void make_var(ID* id, IntrusivePtr<BroType> t, init_class c,
 	id->SetType(t);
 
 	if ( attr )
-		id->AddAttrs(make_intrusive<Attributes>(attr, t.get(), false, id->IsGlobal()));
+		id->AddAttrs(make_intrusive<Attributes>(attr, t, false, id->IsGlobal()));
 
 	if ( init )
 		{
@@ -168,7 +168,8 @@ static void make_var(ID* id, IntrusivePtr<BroType> t, init_class c,
 				}
 
 			else if ( t->Tag() == TYPE_TABLE )
-				aggr = make_intrusive<TableVal>(t->AsTableType(), id->Attrs());
+				aggr = make_intrusive<TableVal>(IntrusivePtr{NewRef{}, t->AsTableType()},
+				                                IntrusivePtr{NewRef{}, id->Attrs()});
 
 			else if ( t->Tag() == TYPE_VECTOR )
 				aggr = make_intrusive<VectorVal>(t->AsVectorType());
@@ -254,7 +255,7 @@ IntrusivePtr<Stmt> add_local(IntrusivePtr<ID> id, IntrusivePtr<BroType> t,
 
 	else
 		{
-		current_scope()->AddInit(id.release());
+		current_scope()->AddInit(std::move(id));
 		return make_intrusive<NullStmt>();
 		}
 	}
@@ -294,7 +295,7 @@ void add_type(ID* id, IntrusivePtr<BroType> t, attr_list* attr)
 	id->MakeType();
 
 	if ( attr )
-		id->SetAttrs(make_intrusive<Attributes>(attr, tnew.get(), false, false));
+		id->SetAttrs(make_intrusive<Attributes>(attr, tnew, false, false));
 	}
 
 static void transfer_arg_defaults(RecordType* args, RecordType* recv)
@@ -312,11 +313,11 @@ static void transfer_arg_defaults(RecordType* args, RecordType* recv)
 		if ( ! recv_i->attrs )
 			{
 			attr_list* a = new attr_list{def};
-			recv_i->attrs = new Attributes(a, recv_i->type, true, false);
+			recv_i->attrs = make_intrusive<Attributes>(a, recv_i->type, true, false);
 			}
 
 		else if ( ! recv_i->attrs->FindAttr(ATTR_DEFAULT) )
-			recv_i->attrs->AddAttr(def);
+			recv_i->attrs->AddAttr({NewRef{}, def});
 		}
 	}
 
@@ -394,7 +395,7 @@ void begin_func(ID* id, const char* module_name, function_flavor flavor,
 	else
 		id->SetType(t);
 
-	push_scope(id, attrs);
+	push_scope({NewRef{}, id}, attrs);
 
 	RecordType* args = t->Args();
 	int num_args = args->NumFields();
@@ -408,11 +409,11 @@ void begin_func(ID* id, const char* module_name, function_flavor flavor,
 			arg_id->Error("argument name used twice");
 
 		arg_id = install_ID(arg_i->id, module_name, false, false);
-		arg_id->SetType({NewRef{}, arg_i->type});
+		arg_id->SetType(arg_i->type);
 		}
 
 	if ( Attr* depr_attr = find_attr(attrs, ATTR_DEPRECATED) )
-		id->MakeDeprecated(depr_attr->AttrExpr());
+		id->MakeDeprecated({NewRef{}, depr_attr->AttrExpr()});
 	}
 
 class OuterIDBindingFinder : public TraversalCallback {
@@ -473,12 +474,11 @@ TraversalCode OuterIDBindingFinder::PostExpr(const Expr* expr)
 
 void end_func(IntrusivePtr<Stmt> body)
 	{
-	auto ingredients = std::make_unique<function_ingredients>(
+	auto ingredients = std::make_unique<function_ingredients>(pop_scope(), std::move(body));
-	        pop_scope().release(), body.release());
 
 	if ( streq(ingredients->id->Name(), "anonymous-function") )
 		{
-		OuterIDBindingFinder cb(ingredients->scope);
+		OuterIDBindingFinder cb(ingredients->scope.get());
 		ingredients->body->Traverse(&cb);
 
 		for ( size_t i = 0; i < cb.outer_id_references.size(); ++i )
@@ -495,7 +495,7 @@ void end_func(IntrusivePtr<Stmt> body)
 	else
 		{
 		Func* f = new BroFunc(
-			ingredients->id,
+			ingredients->id.get(),
 			ingredients->body,
 			ingredients->inits,
 			ingredients->frame_size,

src/analyzer/Manager.cc

@@ -4,6 +4,7 @@
 
 #include "Hash.h"
 #include "Val.h"
+#include "IntrusivePtr.h"
 
 #include "protocol/conn-size/ConnSize.h"
 #include "protocol/icmp/ICMP.h"
@@ -440,13 +441,12 @@ bool Manager::BuildInitialAnalyzerTree(Connection* conn)
 		if ( tcp_contents && ! reass )
 			{
 			auto dport = val_mgr->GetPort(ntohs(conn->RespPort()), TRANSPORT_TCP);
-			Val* result;
 
 			if ( ! reass )
-				reass = tcp_content_delivery_ports_orig->Lookup(dport);
+				reass = (bool)tcp_content_delivery_ports_orig->Lookup(dport);
 
 			if ( ! reass )
-				reass = tcp_content_delivery_ports_resp->Lookup(dport);
+				reass = (bool)tcp_content_delivery_ports_resp->Lookup(dport);
 
 			Unref(dport);
 			}

src/analyzer/protocol/bittorrent/BitTorrentTracker.cc

@@ -45,7 +45,7 @@ BitTorrentTracker_Analyzer::BitTorrentTracker_Analyzer(Connection* c)
 	req_buf_pos = req_buf;
 	req_buf_len = 0;
 	req_val_uri = 0;
-	req_val_headers = new TableVal(bt_tracker_headers);
+	req_val_headers = new TableVal({NewRef{}, bt_tracker_headers});
 
 	res_state = BTT_RES_STATUS;
 	res_allow_blank_line = false;
@@ -53,9 +53,9 @@ BitTorrentTracker_Analyzer::BitTorrentTracker_Analyzer(Connection* c)
 	res_buf_pos = res_buf;
 	res_buf_len = 0;
 	res_status = 0;
-	res_val_headers = new TableVal(bt_tracker_headers);
+	res_val_headers = new TableVal({NewRef{}, bt_tracker_headers});
-	res_val_peers = new TableVal(bittorrent_peer_set);
+	res_val_peers = new TableVal({NewRef{}, bittorrent_peer_set});
-	res_val_benc = new TableVal(bittorrent_benc_dir);
+	res_val_benc = new TableVal({NewRef{}, bittorrent_benc_dir});
 
 	InitBencParser();
 
@@ -137,7 +137,7 @@ void BitTorrentTracker_Analyzer::ClientRequest(int len, const u_char* data)
 			memmove(req_buf, req_buf_pos, req_buf_len);
 			req_buf_pos = req_buf;
 			req_val_headers =
-				new TableVal(bt_tracker_headers);
+				new TableVal({NewRef{}, bt_tracker_headers});
 			}
 		}
 	}
@@ -199,9 +199,9 @@ void BitTorrentTracker_Analyzer::ServerReply(int len, const u_char* data)
 		res_buf_pos = res_buf;
 		res_status = 0;
 
-		res_val_headers = new TableVal(bt_tracker_headers);
+		res_val_headers = new TableVal({NewRef{}, bt_tracker_headers});
-		res_val_peers = new TableVal(bittorrent_peer_set);
+		res_val_peers = new TableVal({NewRef{}, bittorrent_peer_set});
-		res_val_benc = new TableVal(bittorrent_benc_dir);
+		res_val_benc = new TableVal({NewRef{}, bittorrent_benc_dir});
 
 		InitBencParser();
 		}
@@ -481,7 +481,7 @@ void BitTorrentTracker_Analyzer::ResponseBenc(int name_len, char* name,
 			uint16_t pt = ntohs((value[4] << 8) | value[5]);
 
 			RecordVal* peer = new RecordVal(bittorrent_peer);
-			peer->Assign(0, new AddrVal(ad));
+			peer->Assign(0, make_intrusive<AddrVal>(ad));
 			peer->Assign(1, val_mgr->GetPort(pt, TRANSPORT_TCP));
 			res_val_peers->Assign(peer, 0);
 
@@ -491,9 +491,9 @@ void BitTorrentTracker_Analyzer::ResponseBenc(int name_len, char* name,
 	else
 		{
 		StringVal* name_ = new StringVal(name_len, name);
-		RecordVal* benc_value = new RecordVal(bittorrent_benc_value);
+		auto benc_value = make_intrusive<RecordVal>(bittorrent_benc_value);
-		benc_value->Assign(type, new StringVal(value_len, value));
+		benc_value->Assign(type, make_intrusive<StringVal>(value_len, value));
-		res_val_benc->Assign(name_, benc_value);
+		res_val_benc->Assign(name_, std::move(benc_value));
 
 		Unref(name_);
 		}

src/analyzer/protocol/dce-rpc/dce_rpc-analyzer.pac

@@ -42,7 +42,7 @@ refine connection DCE_RPC_Conn += {
 			                                   ${header.is_orig},
 			                                   fid,
 			                                   ${header.PTYPE},
-			                                   BifType::Enum::DCE_RPC::PType->GetVal(${header.PTYPE}));
+			                                   BifType::Enum::DCE_RPC::PType->GetVal(${header.PTYPE}).release());
 			}
 		return true;
 		%}

src/analyzer/protocol/dhcp/dhcp-analyzer.pac

@@ -61,13 +61,13 @@ refine flow DHCP_Flow += {
 			dhcp_msg_val->Assign(0, val_mgr->GetCount(${msg.op}));
 			dhcp_msg_val->Assign(1, val_mgr->GetCount(${msg.type}));
 			dhcp_msg_val->Assign(2, val_mgr->GetCount(${msg.xid}));
-			dhcp_msg_val->Assign(3, new Val(secs, TYPE_INTERVAL));
+			dhcp_msg_val->Assign(3, make_intrusive<Val>(secs, TYPE_INTERVAL));
 			dhcp_msg_val->Assign(4, val_mgr->GetCount(${msg.flags}));
-			dhcp_msg_val->Assign(5, new AddrVal(htonl(${msg.ciaddr})));
+			dhcp_msg_val->Assign(5, make_intrusive<AddrVal>(htonl(${msg.ciaddr})));
-			dhcp_msg_val->Assign(6, new AddrVal(htonl(${msg.yiaddr})));
+			dhcp_msg_val->Assign(6, make_intrusive<AddrVal>(htonl(${msg.yiaddr})));
-			dhcp_msg_val->Assign(7, new AddrVal(htonl(${msg.siaddr})));
+			dhcp_msg_val->Assign(7, make_intrusive<AddrVal>(htonl(${msg.siaddr})));
-			dhcp_msg_val->Assign(8, new AddrVal(htonl(${msg.giaddr})));
+			dhcp_msg_val->Assign(8, make_intrusive<AddrVal>(htonl(${msg.giaddr})));
-			dhcp_msg_val->Assign(9, new StringVal(mac_str));
+			dhcp_msg_val->Assign(9, make_intrusive<StringVal>(mac_str));
 
 			int last_non_null = 0;
 
@@ -78,7 +78,7 @@ refine flow DHCP_Flow += {
 				}
 
 			if ( last_non_null > 0 )
-				dhcp_msg_val->Assign(10, new StringVal(last_non_null + 1,
+				dhcp_msg_val->Assign(10, make_intrusive<StringVal>(last_non_null + 1,
 				                                                   reinterpret_cast<const char*>(${msg.sname}.begin())));
 
 			last_non_null = 0;
@@ -90,7 +90,7 @@ refine flow DHCP_Flow += {
 				}
 
 			if ( last_non_null > 0 )
-				dhcp_msg_val->Assign(11, new StringVal(last_non_null + 1,
+				dhcp_msg_val->Assign(11, make_intrusive<StringVal>(last_non_null + 1,
 				                                                   reinterpret_cast<const char*>(${msg.file_n}.begin())));
 
 			init_options();

src/analyzer/protocol/dhcp/dhcp-options.pac

@@ -11,7 +11,7 @@ refine casetype OptionValue += {
 refine flow DHCP_Flow += {
 	function process_subnet_option(v: OptionValue): bool
 		%{
-		${context.flow}->options->Assign(1, new AddrVal(htonl(${v.subnet})));
+		${context.flow}->options->Assign(1, make_intrusive<AddrVal>(htonl(${v.subnet})));
 		return true;
 		%}
 };
@@ -64,7 +64,7 @@ refine flow DHCP_Flow += {
 		for ( int i = 0; i < num_routers; ++i )
 			{
 			uint32 raddr = (*rlist)[i];
-			router_list->Assign(i, new AddrVal(htonl(raddr)));
+			router_list->Assign(i, make_intrusive<AddrVal>(htonl(raddr)));
 			}
 
 		${context.flow}->options->Assign(2, router_list);
@@ -98,7 +98,7 @@ refine flow DHCP_Flow += {
 		for ( int i = 0; i < num_servers; ++i )
 			{
 			uint32 raddr = (*rlist)[i];
-			timeserver_list->Assign(i, new AddrVal(htonl(raddr)));
+			timeserver_list->Assign(i, make_intrusive<AddrVal>(htonl(raddr)));
 			}
 
 		${context.flow}->options->Assign(26, timeserver_list);
@@ -132,7 +132,7 @@ refine flow DHCP_Flow += {
 		for ( int i = 0; i < num_servers; ++i )
 			{
 			uint32 raddr = (*rlist)[i];
-			nameserver_list->Assign(i, new AddrVal(htonl(raddr)));
+			nameserver_list->Assign(i, make_intrusive<AddrVal>(htonl(raddr)));
 			}
 
 		${context.flow}->options->Assign(27, nameserver_list);
@@ -166,7 +166,7 @@ refine flow DHCP_Flow += {
 		for ( int i = 0; i < num_servers; ++i )
 			{
 			uint32 raddr = (*rlist)[i];
-			server_list->Assign(i, new AddrVal(htonl(raddr)));
+			server_list->Assign(i, make_intrusive<AddrVal>(htonl(raddr)));
 			}
 
 		${context.flow}->options->Assign(3, server_list);
@@ -192,7 +192,7 @@ refine casetype OptionValue += {
 refine flow DHCP_Flow += {
 	function process_host_name_option(v: OptionValue): bool
 		%{
-		${context.flow}->options->Assign(4, new StringVal(${v.host_name}.length(),
+		${context.flow}->options->Assign(4, make_intrusive<StringVal>(${v.host_name}.length(),
 		                                                  reinterpret_cast<const char*>(${v.host_name}.begin())));
 
 		return true;
@@ -225,7 +225,7 @@ refine flow DHCP_Flow += {
 				last_non_null = i;
 			}
 
-		${context.flow}->options->Assign(5, new StringVal(last_non_null == 0 ? 0 : last_non_null + 1,
+		${context.flow}->options->Assign(5, make_intrusive<StringVal>(last_non_null == 0 ? 0 : last_non_null + 1,
 		                                                  reinterpret_cast<const char*>(${v.domain_name}.begin())));
 
 		return true;
@@ -274,7 +274,7 @@ refine casetype OptionValue += {
 refine flow DHCP_Flow += {
 	function process_broadcast_address_option(v: OptionValue): bool
 		%{
-		${context.flow}->options->Assign(7, new AddrVal(htonl(${v.broadcast_address})));
+		${context.flow}->options->Assign(7, make_intrusive<AddrVal>(htonl(${v.broadcast_address})));
 
 		return true;
 		%}
@@ -305,7 +305,7 @@ refine flow DHCP_Flow += {
 		for ( int i = 0; i < num_servers; ++i )
 			{
 			uint32 raddr = (*rlist)[i];
-			ntpserver_list->Assign(i, new AddrVal(htonl(raddr)));
+			ntpserver_list->Assign(i, make_intrusive<AddrVal>(htonl(raddr)));
 			}
 
 		${context.flow}->options->Assign(28, ntpserver_list);
@@ -331,7 +331,7 @@ refine casetype OptionValue += {
 refine flow DHCP_Flow += {
 	function process_vendor_specific_option(v: OptionValue): bool
 		%{
-		${context.flow}->options->Assign(8, new StringVal(${v.vendor_specific}.length(),
+		${context.flow}->options->Assign(8, make_intrusive<StringVal>(${v.vendor_specific}.length(),
 		                                                  reinterpret_cast<const char*>(${v.vendor_specific}.begin())));
 
 		return true;
@@ -363,7 +363,7 @@ refine flow DHCP_Flow += {
 		for ( int i = 0; i < num_servers; ++i )
 			{
 			uint32 raddr = (*rlist)[i];
-			server_list->Assign(i, new AddrVal(htonl(raddr)));
+			server_list->Assign(i, make_intrusive<AddrVal>(htonl(raddr)));
 			}
 
 		${context.flow}->options->Assign(9, server_list);
@@ -389,7 +389,7 @@ refine casetype OptionValue += {
 refine flow DHCP_Flow += {
 	function process_addr_request_option(v: OptionValue): bool
 		%{
-		${context.flow}->options->Assign(10, new AddrVal(htonl(${v.addr_request})));
+		${context.flow}->options->Assign(10, make_intrusive<AddrVal>(htonl(${v.addr_request})));
 
 		return true;
 		%}
@@ -414,7 +414,7 @@ refine flow DHCP_Flow += {
 	function process_lease_option(v: OptionValue): bool
 		%{
 		double lease = static_cast<double>(${v.lease});
-		${context.flow}->options->Assign(11, new Val(lease, TYPE_INTERVAL));
+		${context.flow}->options->Assign(11, make_intrusive<Val>(lease, TYPE_INTERVAL));
 
 		return true;
 		%}
@@ -438,7 +438,7 @@ refine casetype OptionValue += {
 refine flow DHCP_Flow += {
 	function process_serv_id_option(v: OptionValue): bool
 		%{
-		${context.flow}->options->Assign(12, new AddrVal(htonl(${v.serv_addr})));
+		${context.flow}->options->Assign(12, make_intrusive<AddrVal>(htonl(${v.serv_addr})));
 
 		return true;
 		%}
@@ -496,7 +496,7 @@ refine casetype OptionValue += {
 refine flow DHCP_Flow += {
 	function process_message_option(v: OptionValue): bool
 		%{
-		${context.flow}->options->Assign(14, new StringVal(${v.message}.length(), 
+		${context.flow}->options->Assign(14, make_intrusive<StringVal>(${v.message}.length(), 
 		                                                   reinterpret_cast<const char*>(${v.message}.begin())));
 
 		return true;
@@ -546,7 +546,7 @@ refine flow DHCP_Flow += {
 	function process_renewal_time_option(v: OptionValue): bool
 		%{
 		double renewal_time = static_cast<double>(${v.renewal_time});
-		${context.flow}->options->Assign(16, new Val(renewal_time, TYPE_INTERVAL));
+		${context.flow}->options->Assign(16, make_intrusive<Val>(renewal_time, TYPE_INTERVAL));
 
 		return true;
 		%}
@@ -571,7 +571,7 @@ refine flow DHCP_Flow += {
 	function process_rebinding_time_option(v: OptionValue): bool
 		%{
 		double rebinding_time = static_cast<double>(${v.rebinding_time});
-		${context.flow}->options->Assign(17, new Val(rebinding_time, TYPE_INTERVAL));
+		${context.flow}->options->Assign(17, make_intrusive<Val>(rebinding_time, TYPE_INTERVAL));
 
 		return true;
 		%}
@@ -595,7 +595,7 @@ refine casetype OptionValue += {
 refine flow DHCP_Flow += {
 	function process_vendor_class_option(v: OptionValue): bool
 		%{
-		${context.flow}->options->Assign(18, new StringVal(${v.vendor_class}.length(),
+		${context.flow}->options->Assign(18, make_intrusive<StringVal>(${v.vendor_class}.length(),
 		                                                   reinterpret_cast<const char*>(${v.vendor_class}.begin())));
 
 		return true;
@@ -627,7 +627,7 @@ refine flow DHCP_Flow += {
 		%{
 		RecordVal* client_id = new RecordVal(BifType::Record::DHCP::ClientID);
 		client_id->Assign(0, val_mgr->GetCount(${v.client_id.hwtype}));
-		client_id->Assign(1, new StringVal(fmt_mac(${v.client_id.hwaddr}.begin(), ${v.client_id.hwaddr}.length())));
+		client_id->Assign(1, make_intrusive<StringVal>(fmt_mac(${v.client_id.hwaddr}.begin(), ${v.client_id.hwaddr}.length())));
 
 		${context.flow}->options->Assign(19, client_id);
 
@@ -653,7 +653,7 @@ refine casetype OptionValue += {
 refine flow DHCP_Flow += {
 	function process_user_class_option(v: OptionValue): bool
 		%{
-		${context.flow}->options->Assign(20, new StringVal(${v.user_class}.length(),
+		${context.flow}->options->Assign(20, make_intrusive<StringVal>(${v.user_class}.length(),
 		                                                   reinterpret_cast<const char*>(${v.user_class}.begin())));
 
 		return true;
@@ -690,7 +690,7 @@ refine flow DHCP_Flow += {
 		client_fqdn->Assign(1, val_mgr->GetCount(${v.client_fqdn.rcode1}));
 		client_fqdn->Assign(2, val_mgr->GetCount(${v.client_fqdn.rcode2}));
 		const char* domain_name = reinterpret_cast<const char*>(${v.client_fqdn.domain_name}.begin());
-		client_fqdn->Assign(3, new StringVal(${v.client_fqdn.domain_name}.length(), domain_name));
+		client_fqdn->Assign(3, make_intrusive<StringVal>(${v.client_fqdn.domain_name}.length(), domain_name));
 
 		${context.flow}->options->Assign(21, client_fqdn);
 
@@ -809,7 +809,7 @@ refine flow DHCP_Flow += {
 
 		if ( string_len == 0 )
 			{
-			${context.flow}->options->Assign(24, new StringVal(0, ""));
+			${context.flow}->options->Assign(24, make_intrusive<StringVal>(0, ""));
 			return true;
 			}
 
@@ -821,7 +821,7 @@ refine flow DHCP_Flow += {
 		if ( has_newline )
 			--string_len;
 
-		${context.flow}->options->Assign(24, new StringVal(string_len,
+		${context.flow}->options->Assign(24, make_intrusive<StringVal>(string_len,
 		                                                   reinterpret_cast<const char*>(${v.auto_proxy_config}.begin())));
 
 		return true;

src/analyzer/protocol/dns/DNS.cc

@@ -603,13 +603,13 @@ int DNS_Interpreter::ParseRR_SOA(DNS_MsgInfo* msg,
 	if ( dns_SOA_reply && ! msg->skip_event )
 		{
 		RecordVal* r = new RecordVal(dns_soa);
-		r->Assign(0, new StringVal(new BroString(mname, mname_end - mname, 1)));
+		r->Assign(0, make_intrusive<StringVal>(new BroString(mname, mname_end - mname, 1)));
-		r->Assign(1, new StringVal(new BroString(rname, rname_end - rname, 1)));
+		r->Assign(1, make_intrusive<StringVal>(new BroString(rname, rname_end - rname, 1)));
 		r->Assign(2, val_mgr->GetCount(serial));
-		r->Assign(3, new IntervalVal(double(refresh), Seconds));
+		r->Assign(3, make_intrusive<IntervalVal>(double(refresh), Seconds));
-		r->Assign(4, new IntervalVal(double(retry), Seconds));
+		r->Assign(4, make_intrusive<IntervalVal>(double(retry), Seconds));
-		r->Assign(5, new IntervalVal(double(expire), Seconds));
+		r->Assign(5, make_intrusive<IntervalVal>(double(expire), Seconds));
-		r->Assign(6, new IntervalVal(double(minimum), Seconds));
+		r->Assign(6, make_intrusive<IntervalVal>(double(minimum), Seconds));
 
 		analyzer->ConnectionEventFast(dns_SOA_reply, {
 			analyzer->BuildConnVal(),
@@ -1029,7 +1029,7 @@ int DNS_Interpreter::ParseRR_NSEC(DNS_MsgInfo* msg,
 			}
 
 		BroString* bitmap = ExtractStream(data, len, bmlen);
-		char_strings->Assign(char_strings->Size(), new StringVal(bitmap));
+		char_strings->Assign(char_strings->Size(), make_intrusive<StringVal>(bitmap));
 		typebitmaps_len = typebitmaps_len - (2 + bmlen);
 		}
 
@@ -1106,7 +1106,7 @@ int DNS_Interpreter::ParseRR_NSEC3(DNS_MsgInfo* msg,
 			}
 
 		BroString* bitmap = ExtractStream(data, len, bmlen);
-		char_strings->Assign(char_strings->Size(), new StringVal(bitmap));
+		char_strings->Assign(char_strings->Size(), make_intrusive<StringVal>(bitmap));
 		typebitmaps_len = typebitmaps_len - (2 + bmlen);
 		}
 
@@ -1496,7 +1496,7 @@ Val* DNS_MsgInfo::BuildAnswerVal()
 	r->Assign(1, query_name);
 	r->Assign(2, val_mgr->GetCount(atype));
 	r->Assign(3, val_mgr->GetCount(aclass));
-	r->Assign(4, new IntervalVal(double(ttl), Seconds));
+	r->Assign(4, make_intrusive<IntervalVal>(double(ttl), Seconds));
 
 	return r;
 	}
@@ -1531,7 +1531,7 @@ Val* DNS_MsgInfo::BuildEDNS_Val()
 	r->Assign(4, val_mgr->GetCount(return_error));
 	r->Assign(5, val_mgr->GetCount(version));
 	r->Assign(6, val_mgr->GetCount(z));
-	r->Assign(7, new IntervalVal(double(ttl), Seconds));
+	r->Assign(7, make_intrusive<IntervalVal>(double(ttl), Seconds));
 	r->Assign(8, val_mgr->GetCount(is_query));
 
 	return r;
@@ -1546,10 +1546,10 @@ Val* DNS_MsgInfo::BuildTSIG_Val(struct TSIG_DATA* tsig)
 	// r->Assign(0, val_mgr->GetCount(int(answer_type)));
 	r->Assign(0, query_name);
 	r->Assign(1, val_mgr->GetCount(int(answer_type)));
-	r->Assign(2, new StringVal(tsig->alg_name));
+	r->Assign(2, make_intrusive<StringVal>(tsig->alg_name));
-	r->Assign(3, new StringVal(tsig->sig));
+	r->Assign(3, make_intrusive<StringVal>(tsig->sig));
-	r->Assign(4, new Val(rtime, TYPE_TIME));
+	r->Assign(4, make_intrusive<Val>(rtime, TYPE_TIME));
-	r->Assign(5, new Val(double(tsig->fudge), TYPE_TIME));
+	r->Assign(5, make_intrusive<Val>(double(tsig->fudge), TYPE_TIME));
 	r->Assign(6, val_mgr->GetCount(tsig->orig_id));
 	r->Assign(7, val_mgr->GetCount(tsig->rr_error));
 	r->Assign(8, val_mgr->GetCount(is_query));
@@ -1567,12 +1567,12 @@ Val* DNS_MsgInfo::BuildRRSIG_Val(RRSIG_DATA* rrsig)
 	r->Assign(2, val_mgr->GetCount(rrsig->type_covered));
 	r->Assign(3, val_mgr->GetCount(rrsig->algorithm));
 	r->Assign(4, val_mgr->GetCount(rrsig->labels));
-	r->Assign(5, new IntervalVal(double(rrsig->orig_ttl), Seconds));
+	r->Assign(5, make_intrusive<IntervalVal>(double(rrsig->orig_ttl), Seconds));
-	r->Assign(6, new Val(double(rrsig->sig_exp), TYPE_TIME));
+	r->Assign(6, make_intrusive<Val>(double(rrsig->sig_exp), TYPE_TIME));
-	r->Assign(7, new Val(double(rrsig->sig_incep), TYPE_TIME));
+	r->Assign(7, make_intrusive<Val>(double(rrsig->sig_incep), TYPE_TIME));
 	r->Assign(8, val_mgr->GetCount(rrsig->key_tag));
-	r->Assign(9, new StringVal(rrsig->signer_name));
+	r->Assign(9, make_intrusive<StringVal>(rrsig->signer_name));
-	r->Assign(10, new StringVal(rrsig->signature));
+	r->Assign(10, make_intrusive<StringVal>(rrsig->signature));
 	r->Assign(11, val_mgr->GetCount(is_query));
 
 	return r;
@@ -1588,7 +1588,7 @@ Val* DNS_MsgInfo::BuildDNSKEY_Val(DNSKEY_DATA* dnskey)
 	r->Assign(2, val_mgr->GetCount(dnskey->dflags));
 	r->Assign(3, val_mgr->GetCount(dnskey->dprotocol));
 	r->Assign(4, val_mgr->GetCount(dnskey->dalgorithm));
-	r->Assign(5, new StringVal(dnskey->public_key));
+	r->Assign(5, make_intrusive<StringVal>(dnskey->public_key));
 	r->Assign(6, val_mgr->GetCount(is_query));
 
 	return r;
@@ -1605,9 +1605,9 @@ Val* DNS_MsgInfo::BuildNSEC3_Val(NSEC3_DATA* nsec3)
 	r->Assign(3, val_mgr->GetCount(nsec3->nsec_hash_algo));
 	r->Assign(4, val_mgr->GetCount(nsec3->nsec_iter));
 	r->Assign(5, val_mgr->GetCount(nsec3->nsec_salt_len));
-	r->Assign(6, new StringVal(nsec3->nsec_salt));
+	r->Assign(6, make_intrusive<StringVal>(nsec3->nsec_salt));
 	r->Assign(7, val_mgr->GetCount(nsec3->nsec_hlen));
-	r->Assign(8, new StringVal(nsec3->nsec_hash));
+	r->Assign(8, make_intrusive<StringVal>(nsec3->nsec_hash));
 	r->Assign(9, nsec3->bitmaps);
 	r->Assign(10, val_mgr->GetCount(is_query));
 
@@ -1624,7 +1624,7 @@ Val* DNS_MsgInfo::BuildDS_Val(DS_DATA* ds)
 	r->Assign(2, val_mgr->GetCount(ds->key_tag));
 	r->Assign(3, val_mgr->GetCount(ds->algorithm));
 	r->Assign(4, val_mgr->GetCount(ds->digest_type));
-	r->Assign(5, new StringVal(ds->digest_val));
+	r->Assign(5, make_intrusive<StringVal>(ds->digest_val));
 	r->Assign(6, val_mgr->GetCount(is_query));
 
 	return r;

src/analyzer/protocol/ftp/functions.bif

@@ -33,13 +33,13 @@ static Val* parse_port(const char* line)
 			good = 0;
 			}
 
-		r->Assign(0, new AddrVal(htonl(addr)));
+		r->Assign(0, make_intrusive<AddrVal>(htonl(addr)));
 		r->Assign(1, val_mgr->GetPort(port, TRANSPORT_TCP));
 		r->Assign(2, val_mgr->GetBool(good));
 		}
 	else
 		{
-		r->Assign(0, new AddrVal(uint32_t(0)));
+		r->Assign(0, make_intrusive<AddrVal>(uint32_t(0)));
 		r->Assign(1, val_mgr->GetPort(0, TRANSPORT_TCP));
 		r->Assign(2, val_mgr->GetBool(0));
 		}
@@ -109,7 +109,7 @@ static Val* parse_eftp(const char* line)
 
 		}
 
-	r->Assign(0, new AddrVal(addr));
+	r->Assign(0, make_intrusive<AddrVal>(addr));
 	r->Assign(1, val_mgr->GetPort(port, TRANSPORT_TCP));
 	r->Assign(2, val_mgr->GetBool(good));
 

src/analyzer/protocol/gtpv1/gtpv1-analyzer.pac

@@ -97,15 +97,15 @@ Val* BuildEndUserAddr(const InformationElement* ie)
 
 		switch ( ie->end_user_addr()->pdp_type_num() ) {
 		case 0x21:
-			ev->Assign(2, new AddrVal(
+			ev->Assign(2, make_intrusive<AddrVal>(
 			  IPAddr(IPv4, (const uint32*) d, IPAddr::Network)));
 			break;
 		case 0x57:
-			ev->Assign(2, new AddrVal(
+			ev->Assign(2, make_intrusive<AddrVal>(
 			  IPAddr(IPv6, (const uint32*) d, IPAddr::Network)));
 			break;
 		default:
-			ev->Assign(3, new StringVal(
+			ev->Assign(3, make_intrusive<StringVal>(
 			  new BroString((const u_char*) d, len, 0)));
 			break;
 		}
@@ -136,13 +136,13 @@ Val* BuildGSN_Addr(const InformationElement* ie)
 	const uint8* d = ie->gsn_addr()->value().data();
 
 	if ( len == 4 )
-		ev->Assign(0, new AddrVal(
+		ev->Assign(0, make_intrusive<AddrVal>(
 		  IPAddr(IPv4, (const uint32*) d, IPAddr::Network)));
 	else if ( len == 16 )
-		ev->Assign(0, new AddrVal(
+		ev->Assign(0, make_intrusive<AddrVal>(
 		  IPAddr(IPv6, (const uint32*) d, IPAddr::Network)));
 	else
-		ev->Assign(1, new StringVal(new BroString((const u_char*) d, len, 0)));
+		ev->Assign(1, make_intrusive<StringVal>(new BroString((const u_char*) d, len, 0)));
 
 	return ev;
 	}
@@ -162,7 +162,7 @@ Val* BuildQoS_Profile(const InformationElement* ie)
 	int len = ie->qos_profile()->data().length();
 
 	ev->Assign(0, val_mgr->GetCount(ie->qos_profile()->alloc_retention_priority()));
-	ev->Assign(1, new StringVal(new BroString(d, len, 0)));
+	ev->Assign(1, make_intrusive<StringVal>(new BroString(d, len, 0)));
 
 	return ev;
 	}
@@ -196,7 +196,7 @@ Val* BuildPrivateExt(const InformationElement* ie)
 	int len = ie->private_ext()->value().length();
 
 	ev->Assign(0, val_mgr->GetCount(ie->private_ext()->id()));
-	ev->Assign(1, new StringVal(new BroString((const u_char*) d, len, 0)));
+	ev->Assign(1, make_intrusive<StringVal>(new BroString((const u_char*) d, len, 0)));
 
 	return ev;
 	}

src/analyzer/protocol/http/HTTP.cc

@@ -617,9 +617,9 @@ Val* HTTP_Message::BuildMessageStat(const int interrupted, const char* msg)
 	{
 	RecordVal* stat = new RecordVal(http_message_stat);
 	int field = 0;
-	stat->Assign(field++, new Val(start_time, TYPE_TIME));
+	stat->Assign(field++, make_intrusive<Val>(start_time, TYPE_TIME));
 	stat->Assign(field++, val_mgr->GetBool(interrupted));
-	stat->Assign(field++, new StringVal(msg));
+	stat->Assign(field++, make_intrusive<StringVal>(msg));
 	stat->Assign(field++, val_mgr->GetCount(body_length));
 	stat->Assign(field++, val_mgr->GetCount(content_gap_length));
 	stat->Assign(field++, val_mgr->GetCount(header_length));
@@ -1185,8 +1185,8 @@ void HTTP_Analyzer::GenStats()
 		RecordVal* r = new RecordVal(http_stats_rec);
 		r->Assign(0, val_mgr->GetCount(num_requests));
 		r->Assign(1, val_mgr->GetCount(num_replies));
-		r->Assign(2, new Val(request_version.ToDouble(), TYPE_DOUBLE));
+		r->Assign(2, make_intrusive<Val>(request_version.ToDouble(), TYPE_DOUBLE));
-		r->Assign(3, new Val(reply_version.ToDouble(), TYPE_DOUBLE));
+		r->Assign(3, make_intrusive<Val>(reply_version.ToDouble(), TYPE_DOUBLE));
 
 		// DEBUG_MSG("%.6f http_stats\n", network_time);
 		ConnectionEventFast(http_stats, {BuildConnVal(), r});

src/analyzer/protocol/icmp/ICMP.cc

@@ -228,8 +228,8 @@ RecordVal* ICMP_Analyzer::BuildICMPVal(const struct icmp* icmpp, int len,
 		{
 		icmp_conn_val = new RecordVal(icmp_conn);
 
-		icmp_conn_val->Assign(0, new AddrVal(Conn()->OrigAddr()));
+		icmp_conn_val->Assign(0, make_intrusive<AddrVal>(Conn()->OrigAddr()));
-		icmp_conn_val->Assign(1, new AddrVal(Conn()->RespAddr()));
+		icmp_conn_val->Assign(1, make_intrusive<AddrVal>(Conn()->RespAddr()));
 		icmp_conn_val->Assign(2, val_mgr->GetCount(icmpp->icmp_type));
 		icmp_conn_val->Assign(3, val_mgr->GetCount(icmpp->icmp_code));
 		icmp_conn_val->Assign(4, val_mgr->GetCount(len));
@@ -356,9 +356,9 @@ RecordVal* ICMP_Analyzer::ExtractICMP4Context(int len, const u_char*& data)
 	RecordVal* iprec = new RecordVal(icmp_context);
 	RecordVal* id_val = new RecordVal(conn_id);
 
-	id_val->Assign(0, new AddrVal(src_addr));
+	id_val->Assign(0, make_intrusive<AddrVal>(src_addr));
 	id_val->Assign(1, val_mgr->GetPort(src_port, proto));
-	id_val->Assign(2, new AddrVal(dst_addr));
+	id_val->Assign(2, make_intrusive<AddrVal>(dst_addr));
 	id_val->Assign(3, val_mgr->GetPort(dst_port, proto));
 
 	iprec->Assign(0, id_val);
@@ -415,9 +415,9 @@ RecordVal* ICMP_Analyzer::ExtractICMP6Context(int len, const u_char*& data)
 	RecordVal* iprec = new RecordVal(icmp_context);
 	RecordVal* id_val = new RecordVal(conn_id);
 
-	id_val->Assign(0, new AddrVal(src_addr));
+	id_val->Assign(0, make_intrusive<AddrVal>(src_addr));
 	id_val->Assign(1, val_mgr->GetPort(src_port, proto));
-	id_val->Assign(2, new AddrVal(dst_addr));
+	id_val->Assign(2, make_intrusive<AddrVal>(dst_addr));
 	id_val->Assign(3, val_mgr->GetPort(dst_port, proto));
 
 	iprec->Assign(0, id_val);
@@ -778,7 +778,7 @@ VectorVal* ICMP_Analyzer::BuildNDOptionsVal(int caplen, const u_char* data)
 			if ( caplen >= length )
 				{
 				BroString* link_addr = new BroString(data, length, 0);
-				rv->Assign(2, new StringVal(link_addr));
+				rv->Assign(2, make_intrusive<StringVal>(link_addr));
 				}
 			else
 				set_payload_field = true;
@@ -801,9 +801,9 @@ VectorVal* ICMP_Analyzer::BuildNDOptionsVal(int caplen, const u_char* data)
 				info->Assign(0, val_mgr->GetCount(prefix_len));
 				info->Assign(1, val_mgr->GetBool(L_flag));
 				info->Assign(2, val_mgr->GetBool(A_flag));
-				info->Assign(3, new IntervalVal((double)ntohl(valid_life), Seconds));
+				info->Assign(3, make_intrusive<IntervalVal>((double)ntohl(valid_life), Seconds));
-				info->Assign(4, new IntervalVal((double)ntohl(prefer_life), Seconds));
+				info->Assign(4, make_intrusive<IntervalVal>((double)ntohl(prefer_life), Seconds));
-				info->Assign(5, new AddrVal(IPAddr(prefix)));
+				info->Assign(5, make_intrusive<AddrVal>(IPAddr(prefix)));
 				rv->Assign(3, info);
 				}
 
@@ -849,7 +849,7 @@ VectorVal* ICMP_Analyzer::BuildNDOptionsVal(int caplen, const u_char* data)
 			{
 			BroString* payload =
 			        new BroString(data, min((int)length, caplen), 0);
-			rv->Assign(6, new StringVal(payload));
+			rv->Assign(6, make_intrusive<StringVal>(payload));
 			}
 
 		data += length;

src/analyzer/protocol/imap/imap-analyzer.pac

@@ -63,7 +63,7 @@ refine connection IMAP_Conn += {
 		for ( unsigned int i = 0; i< capabilities->size(); i++ )
 			{
 			const bytestring& capability = (*capabilities)[i]->cap();
-			capv->Assign(i, new StringVal(capability.length(), (const char*)capability.data()));
+			capv->Assign(i, make_intrusive<StringVal>(capability.length(), (const char*)capability.data()));
 			}
 
 		BifEvent::generate_imap_capabilities(bro_analyzer(), bro_analyzer()->Conn(), capv);

src/analyzer/protocol/irc/IRC.cc

@@ -270,7 +270,7 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
 			if ( parts.size() > 0 && parts[0][0] == ':' )
 				parts[0] = parts[0].substr(1);
 
-			TableVal* set = new TableVal(string_set);
+			TableVal* set = new TableVal({NewRef{}, string_set});
 
 			for ( unsigned int i = 0; i < parts.size(); ++i )
 				{
@@ -463,7 +463,7 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
 			if ( parts.size() > 0 && parts[0][0] == ':' )
 				parts[0] = parts[0].substr(1);
 
-			TableVal* set = new TableVal(string_set);
+			TableVal* set = new TableVal({NewRef{}, string_set});
 
 			for ( unsigned int i = 0; i < parts.size(); ++i )
 				{
@@ -841,7 +841,7 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
 				nickname = prefix.substr(0, pos);
 			}
 
-		TableVal* list = new TableVal(irc_join_list);
+		TableVal* list = new TableVal({NewRef{}, irc_join_list});
 
 		vector<string> channels = SplitWords(parts[0], ',');
 		vector<string> passwords;
@@ -853,14 +853,14 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
 		for ( unsigned int i = 0; i < channels.size(); ++i )
 			{
 			RecordVal* info = new RecordVal(irc_join_info);
-			info->Assign(0, new StringVal(nickname.c_str()));
+			info->Assign(0, make_intrusive<StringVal>(nickname.c_str()));
-			info->Assign(1, new StringVal(channels[i].c_str()));
+			info->Assign(1, make_intrusive<StringVal>(channels[i].c_str()));
 			if ( i < passwords.size() )
-				info->Assign(2, new StringVal(passwords[i].c_str()));
+				info->Assign(2, make_intrusive<StringVal>(passwords[i].c_str()));
 			else
-				info->Assign(2, new StringVal(empty_string.c_str()));
+				info->Assign(2, make_intrusive<StringVal>(empty_string.c_str()));
 			// User mode.
-			info->Assign(3, new StringVal(empty_string.c_str()));
+			info->Assign(3, make_intrusive<StringVal>(empty_string.c_str()));
 			list->Assign(info, 0);
 			Unref(info);
 			}
@@ -886,7 +886,7 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
 			parts[1] = parts[1].substr(1);
 
 		vector<string> users = SplitWords(parts[1], ',');
-		TableVal* list = new TableVal(irc_join_list);
+		TableVal* list = new TableVal({NewRef{}, irc_join_list});
 
 		string empty_string = "";
 
@@ -916,12 +916,12 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
 				mode = "voice";
 				}
 
-			info->Assign(0, new StringVal(nick.c_str()));
+			info->Assign(0, make_intrusive<StringVal>(nick.c_str()));
-			info->Assign(1, new StringVal(channel.c_str()));
+			info->Assign(1, make_intrusive<StringVal>(channel.c_str()));
 			// Password:
-			info->Assign(2, new StringVal(empty_string.c_str()));
+			info->Assign(2, make_intrusive<StringVal>(empty_string.c_str()));
 			// User mode:
-			info->Assign(3, new StringVal(mode.c_str()));
+			info->Assign(3, make_intrusive<StringVal>(mode.c_str()));
 			list->Assign(info, 0);
 			Unref(info);
 			}
@@ -957,7 +957,7 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
 			nick = nick.substr(0, pos);
 
 		vector<string> channelList = SplitWords(channels, ',');
-		TableVal* set = new TableVal(string_set);
+		TableVal* set = new TableVal({NewRef{}, string_set});
 
 		for ( unsigned int i = 0; i < channelList.size(); ++i )
 			{

src/analyzer/protocol/krb/krb-types.pac

@@ -61,7 +61,7 @@ RecordVal* proc_host_address(const BroAnalyzer a, const KRB_Host_Address* addr)
 				}
 
 			auto bytes = reinterpret_cast<const uint32_t*>(addr_bytes.data());
-			rv->Assign(0, new AddrVal(IPAddr(IPv4, bytes, IPAddr::Network)));
+			rv->Assign(0, make_intrusive<AddrVal>(IPAddr(IPv4, bytes, IPAddr::Network)));
 			return rv;
 			}
 		case 24:
@@ -73,7 +73,7 @@ RecordVal* proc_host_address(const BroAnalyzer a, const KRB_Host_Address* addr)
 				}
 
 			auto bytes = reinterpret_cast<const uint32_t*>(addr_bytes.data());
-			rv->Assign(0, new AddrVal(IPAddr(IPv6, bytes, IPAddr::Network)));
+			rv->Assign(0, make_intrusive<AddrVal>(IPAddr(IPv6, bytes, IPAddr::Network)));
 			return rv;
 			}
 		case 20:

src/analyzer/protocol/mime/MIME.cc

@@ -1299,7 +1299,7 @@ RecordVal* MIME_Message::BuildHeaderVal(MIME_Header* h)
 
 TableVal* MIME_Message::BuildHeaderTable(MIME_HeaderList& hlist)
 	{
-	TableVal* t = new TableVal(mime_header_list);
+	TableVal* t = new TableVal({NewRef{}, mime_header_list});
 
 	for ( unsigned int i = 0; i < hlist.size(); ++i )
 		{

src/analyzer/protocol/mqtt/commands/connect.pac

@@ -45,12 +45,12 @@ refine flow MQTT_Flow += {
 		if ( mqtt_connect )
 			{
 			auto m = new RecordVal(BifType::Record::MQTT::ConnectMsg);
-			m->Assign(0, new StringVal(${msg.protocol_name.str}.length(),
+			m->Assign(0, make_intrusive<StringVal>(${msg.protocol_name.str}.length(),
 			                           reinterpret_cast<const char*>(${msg.protocol_name.str}.begin())));
 			m->Assign(1, val_mgr->GetCount(${msg.protocol_version}));
-			m->Assign(2, new StringVal(${msg.client_id.str}.length(),
+			m->Assign(2, make_intrusive<StringVal>(${msg.client_id.str}.length(),
 			                           reinterpret_cast<const char*>(${msg.client_id.str}.begin())));
-			m->Assign(3, new IntervalVal(double(${msg.keep_alive}), Seconds));
+			m->Assign(3, make_intrusive<IntervalVal>(double(${msg.keep_alive}), Seconds));
 
 			m->Assign(4, val_mgr->GetBool(${msg.clean_session}));
 			m->Assign(5, val_mgr->GetBool(${msg.will_retain}));
@@ -58,20 +58,20 @@ refine flow MQTT_Flow += {
 
 			if ( ${msg.will_flag} )
 				{
-				m->Assign(7, new StringVal(${msg.will.topic.str}.length(),
+				m->Assign(7, make_intrusive<StringVal>(${msg.will.topic.str}.length(),
 				                           reinterpret_cast<const char*>(${msg.will.topic.str}.begin())));
-				m->Assign(8, new StringVal(${msg.will.msg.str}.length(),
+				m->Assign(8, make_intrusive<StringVal>(${msg.will.msg.str}.length(),
 				                           reinterpret_cast<const char*>(${msg.will.msg.str}.begin())));
 				}
 
 			if ( ${msg.username} )
 				{
-				m->Assign(9, new StringVal(${msg.uname.str}.length(),
+				m->Assign(9, make_intrusive<StringVal>(${msg.uname.str}.length(),
 				                           reinterpret_cast<const char*>(${msg.uname.str}.begin())));
 				}
 			if ( ${msg.password} )
 				{
-				m->Assign(10, new StringVal(${msg.pass.str}.length(),
+				m->Assign(10, make_intrusive<StringVal>(${msg.pass.str}.length(),
 				                            reinterpret_cast<const char*>(${msg.pass.str}.begin())));
 				}
 

src/analyzer/protocol/mysql/mysql-analyzer.pac

@@ -87,7 +87,7 @@ refine flow MySQL_Flow += {
 
 		auto& bstring = ${msg.row.first_field.val};
 		auto ptr = reinterpret_cast<const char*>(bstring.data());
-		vv->Assign(vv->Size(), new StringVal(bstring.length(), ptr));
+		vv->Assign(vv->Size(), make_intrusive<StringVal>(bstring.length(), ptr));
 
 		auto& fields = *${msg.row.fields};
 
@@ -95,7 +95,7 @@ refine flow MySQL_Flow += {
 			{
 			auto& bstring = f->val();
 			auto ptr = reinterpret_cast<const char*>(bstring.data());
-			vv->Assign(vv->Size(), new StringVal(bstring.length(), ptr));
+			vv->Assign(vv->Size(), make_intrusive<StringVal>(bstring.length(), ptr));
 			}
 
 		BifEvent::generate_mysql_result_row(connection()->bro_analyzer(),

src/analyzer/protocol/ntp/ntp-analyzer.pac

@@ -38,8 +38,8 @@ refine flow NTP_Flow += {
 		RecordVal* rv = new RecordVal(BifType::Record::NTP::StandardMessage);
 
 		rv->Assign(0, val_mgr->GetCount(${nsm.stratum}));
-		rv->Assign(1, new Val(pow(2, ${nsm.poll}), TYPE_INTERVAL));
+		rv->Assign(1, make_intrusive<Val>(pow(2, ${nsm.poll}), TYPE_INTERVAL));
-		rv->Assign(2, new Val(pow(2, ${nsm.precision}), TYPE_INTERVAL));
+		rv->Assign(2, make_intrusive<Val>(pow(2, ${nsm.precision}), TYPE_INTERVAL));
 		rv->Assign(3, proc_ntp_short(${nsm.root_delay}));
 		rv->Assign(4, proc_ntp_short(${nsm.root_dispersion}));
 
@@ -55,7 +55,7 @@ refine flow NTP_Flow += {
 		default:
 			{
 			const uint8* d = ${nsm.reference_id}.data();
-			rv->Assign(7, new AddrVal(IPAddr(IPv4, (const uint32*) d, IPAddr::Network)));
+			rv->Assign(7, make_intrusive<AddrVal>(IPAddr(IPv4, (const uint32*) d, IPAddr::Network)));
 			}
 			break;
 		}

src/analyzer/protocol/radius/radius-analyzer.pac

@@ -14,13 +14,13 @@ refine flow RADIUS_Flow += {
 
 		if ( ${msg.attributes}->size() )
 			{
-			TableVal* attributes = new TableVal(BifType::Table::RADIUS::Attributes);
+			TableVal* attributes = new TableVal({NewRef{}, BifType::Table::RADIUS::Attributes});
 
 			for ( uint i = 0; i < ${msg.attributes}->size(); ++i ) {
 				Val* index = val_mgr->GetCount(${msg.attributes[i].code});
 
 				// Do we already have a vector of attributes for this type?
-                Val* current = attributes->Lookup(index);
+				auto current = attributes->Lookup(index);
 				Val* val = bytestring_to_val(${msg.attributes[i].value});
 
 				if ( current )

src/analyzer/protocol/rpc/MOUNT.cc

@@ -139,7 +139,7 @@ int MOUNT_Interp::RPC_BuildReply(RPC_CallInfo* c, BifEnum::rpc_status rpc_status
 			// Otherwise DeliverRPC would complain about
 			// excess_RPC.
 			n = 0;
-			reply = BifType::Enum::MOUNT3::proc_t->GetVal(c->Proc());
+			reply = BifType::Enum::MOUNT3::proc_t->GetVal(c->Proc()).release();
 			event = mount_proc_not_implemented;
 			}
 		else
@@ -201,16 +201,16 @@ val_list MOUNT_Interp::event_common_vl(RPC_CallInfo *c,
 	RecordVal* info = new RecordVal(BifType::Record::MOUNT3::info_t);
 	info->Assign(0, BifType::Enum::rpc_status->GetVal(rpc_status));
 	info->Assign(1, BifType::Enum::MOUNT3::status_t->GetVal(mount_status));
-	info->Assign(2, new Val(c->StartTime(), TYPE_TIME));
+	info->Assign(2, make_intrusive<Val>(c->StartTime(), TYPE_TIME));
-	info->Assign(3, new Val(c->LastTime() - c->StartTime(), TYPE_INTERVAL));
+	info->Assign(3, make_intrusive<Val>(c->LastTime() - c->StartTime(), TYPE_INTERVAL));
 	info->Assign(4, val_mgr->GetCount(c->RPCLen()));
-	info->Assign(5, new Val(rep_start_time, TYPE_TIME));
+	info->Assign(5, make_intrusive<Val>(rep_start_time, TYPE_TIME));
-	info->Assign(6, new Val(rep_last_time - rep_start_time, TYPE_INTERVAL));
+	info->Assign(6, make_intrusive<Val>(rep_last_time - rep_start_time, TYPE_INTERVAL));
 	info->Assign(7, val_mgr->GetCount(reply_len));
 	info->Assign(8, val_mgr->GetCount(c->Uid()));
 	info->Assign(9, val_mgr->GetCount(c->Gid()));
 	info->Assign(10, val_mgr->GetCount(c->Stamp()));
-	info->Assign(11, new StringVal(c->MachineName()));
+	info->Assign(11, make_intrusive<StringVal>(c->MachineName()));
 	info->Assign(12, auxgids);
 
 	vl.push_back(info);
@@ -220,7 +220,7 @@ val_list MOUNT_Interp::event_common_vl(RPC_CallInfo *c,
 EnumVal* MOUNT_Interp::mount3_auth_flavor(const u_char*& buf, int& n)
     {
 	BifEnum::MOUNT3::auth_flavor_t t = (BifEnum::MOUNT3::auth_flavor_t)extract_XDR_uint32(buf, n);
-	return BifType::Enum::MOUNT3::auth_flavor_t->GetVal(t);
+	return BifType::Enum::MOUNT3::auth_flavor_t->GetVal(t).release();
     }
 
 StringVal* MOUNT_Interp::mount3_fh(const u_char*& buf, int& n)

src/analyzer/protocol/rpc/NFS.cc

@@ -251,7 +251,7 @@ int NFS_Interp::RPC_BuildReply(RPC_CallInfo* c, BifEnum::rpc_status rpc_status,
 			// Otherwise DeliverRPC would complain about
 			// excess_RPC.
 			n = 0;
-			reply = BifType::Enum::NFS3::proc_t->GetVal(c->Proc());
+			reply = BifType::Enum::NFS3::proc_t->GetVal(c->Proc()).release();
 			event = nfs_proc_not_implemented;
 			}
 		else
@@ -335,16 +335,16 @@ val_list NFS_Interp::event_common_vl(RPC_CallInfo *c, BifEnum::rpc_status rpc_st
 	RecordVal *info = new RecordVal(BifType::Record::NFS3::info_t);
 	info->Assign(0, BifType::Enum::rpc_status->GetVal(rpc_status));
 	info->Assign(1, BifType::Enum::NFS3::status_t->GetVal(nfs_status));
-	info->Assign(2, new Val(c->StartTime(), TYPE_TIME));
+	info->Assign(2, make_intrusive<Val>(c->StartTime(), TYPE_TIME));
-	info->Assign(3, new Val(c->LastTime()-c->StartTime(), TYPE_INTERVAL));
+	info->Assign(3, make_intrusive<Val>(c->LastTime()-c->StartTime(), TYPE_INTERVAL));
 	info->Assign(4, val_mgr->GetCount(c->RPCLen()));
-	info->Assign(5, new Val(rep_start_time, TYPE_TIME));
+	info->Assign(5, make_intrusive<Val>(rep_start_time, TYPE_TIME));
-	info->Assign(6, new Val(rep_last_time-rep_start_time, TYPE_INTERVAL));
+	info->Assign(6, make_intrusive<Val>(rep_last_time-rep_start_time, TYPE_INTERVAL));
 	info->Assign(7, val_mgr->GetCount(reply_len));
 	info->Assign(8, val_mgr->GetCount(c->Uid()));
 	info->Assign(9, val_mgr->GetCount(c->Gid()));
 	info->Assign(10, val_mgr->GetCount(c->Stamp()));
-	info->Assign(11, new StringVal(c->MachineName()));
+	info->Assign(11, make_intrusive<StringVal>(c->MachineName()));
 	info->Assign(12, auxgids);
 
 	vl.push_back(info);
@@ -437,13 +437,13 @@ RecordVal* NFS_Interp::nfs3_fattr(const u_char*& buf, int& n)
 EnumVal* NFS_Interp::nfs3_time_how(const u_char*& buf, int& n)
 	{
 	BifEnum::NFS3::time_how_t t = (BifEnum::NFS3::time_how_t)extract_XDR_uint32(buf, n);
-	return BifType::Enum::NFS3::time_how_t->GetVal(t);
+	return BifType::Enum::NFS3::time_how_t->GetVal(t).release();
 	}
 
 EnumVal* NFS_Interp::nfs3_ftype(const u_char*& buf, int& n)
 	{
 	BifEnum::NFS3::file_type_t t = (BifEnum::NFS3::file_type_t)extract_XDR_uint32(buf, n);
-	return BifType::Enum::NFS3::file_type_t->GetVal(t);
+	return BifType::Enum::NFS3::file_type_t->GetVal(t).release();
 	}
 
 RecordVal* NFS_Interp::nfs3_wcc_attr(const u_char*& buf, int& n)
@@ -532,7 +532,7 @@ RecordVal* NFS_Interp::nfs3_pre_op_attr(const u_char*& buf, int& n)
 EnumVal *NFS_Interp::nfs3_stable_how(const u_char*& buf, int& n)
 	{
 	BifEnum::NFS3::stable_how_t stable = (BifEnum::NFS3::stable_how_t)extract_XDR_uint32(buf, n);
-	return BifType::Enum::NFS3::stable_how_t->GetVal(stable);
+	return BifType::Enum::NFS3::stable_how_t->GetVal(stable).release();
 	}
 
 RecordVal* NFS_Interp::nfs3_lookup_reply(const u_char*& buf, int& n, BifEnum::NFS3::status_t status)

src/analyzer/protocol/rpc/Portmap.cc

@@ -139,7 +139,7 @@ int PortmapperInterp::RPC_BuildReply(RPC_CallInfo* c, BifEnum::rpc_status status
 		event = success ? pm_request_dump : pm_attempt_dump;
 		if ( success )
 			{
-			TableVal* mappings = new TableVal(pm_mappings);
+			TableVal* mappings = new TableVal({NewRef{}, pm_mappings});
 			uint32_t nmap = 0;
 
 			// Each call in the loop test pulls the next "opted"
@@ -295,7 +295,7 @@ void PortmapperInterp::Event(EventHandlerPtr f, Val* request, BifEnum::rpc_statu
 		}
 	else
 		{
-		vl.push_back(BifType::Enum::rpc_status->GetVal(status));
+		vl.push_back(BifType::Enum::rpc_status->GetVal(status).release());
 		if ( request )
 			vl.push_back(request);
 		}

src/analyzer/protocol/rpc/RPC.cc

@@ -344,7 +344,7 @@ void RPC_Interpreter::Event_RPC_Dialogue(RPC_CallInfo* c, BifEnum::rpc_status st
 			val_mgr->GetCount(c->Program()),
 			val_mgr->GetCount(c->Version()),
 			val_mgr->GetCount(c->Proc()),
-			BifType::Enum::rpc_status->GetVal(status),
+			BifType::Enum::rpc_status->GetVal(status).release(),
 			new Val(c->StartTime(), TYPE_TIME),
 			val_mgr->GetCount(c->CallLen()),
 			val_mgr->GetCount(reply_len),
@@ -374,7 +374,7 @@ void RPC_Interpreter::Event_RPC_Reply(uint32_t xid, BifEnum::rpc_status status,
 		analyzer->ConnectionEventFast(rpc_reply, {
 			analyzer->BuildConnVal(),
 			val_mgr->GetCount(xid),
-			BifType::Enum::rpc_status->GetVal(status),
+			BifType::Enum::rpc_status->GetVal(status).release(),
 			val_mgr->GetCount(reply_len),
 		});
 		}

src/analyzer/protocol/sip/sip-analyzer.pac

@@ -65,7 +65,7 @@ refine flow SIP_Flow += {
 
 	function build_sip_headers_val(): BroVal
 		%{
-		TableVal* t = new TableVal(mime_header_list);
+		TableVal* t = new TableVal({NewRef{}, mime_header_list});
 
 		for ( unsigned int i = 0; i < headers.size(); ++i )
 			{ // index starting from 1

src/analyzer/protocol/socks/socks-analyzer.pac

@@ -25,7 +25,7 @@ refine connection SOCKS_Conn += {
 		if ( socks_request )
 			{
 			RecordVal* sa = new RecordVal(socks_address);
-			sa->Assign(0, new AddrVal(htonl(${request.addr})));
+			sa->Assign(0, make_intrusive<AddrVal>(htonl(${request.addr})));
 
 			if ( ${request.v4a} )
 				sa->Assign(1, array_to_string(${request.name}));
@@ -49,7 +49,7 @@ refine connection SOCKS_Conn += {
 		if ( socks_reply )
 			{
 			RecordVal* sa = new RecordVal(socks_address);
-			sa->Assign(0, new AddrVal(htonl(${reply.addr})));
+			sa->Assign(0, make_intrusive<AddrVal>(htonl(${reply.addr})));
 
 			BifEvent::generate_socks_reply(bro_analyzer(),
 			                               bro_analyzer()->Conn(),
@@ -86,16 +86,16 @@ refine connection SOCKS_Conn += {
 		switch ( ${request.remote_name.addr_type} )
 			{
 			case 1:
-				sa->Assign(0, new AddrVal(htonl(${request.remote_name.ipv4})));
+				sa->Assign(0, make_intrusive<AddrVal>(htonl(${request.remote_name.ipv4})));
 				break;
 
 			case 3:
-				sa->Assign(1, new StringVal(${request.remote_name.domain_name.name}.length(),
+				sa->Assign(1, make_intrusive<StringVal>(${request.remote_name.domain_name.name}.length(),
 				                         (const char*) ${request.remote_name.domain_name.name}.data()));
 				break;
 
 			case 4:
-				sa->Assign(0, new AddrVal(IPAddr(IPv6, (const uint32_t*) ${request.remote_name.ipv6}, IPAddr::Network)));
+				sa->Assign(0, make_intrusive<AddrVal>(IPAddr(IPv6, (const uint32_t*) ${request.remote_name.ipv6}, IPAddr::Network)));
 				break;
 
 			default:
@@ -128,16 +128,16 @@ refine connection SOCKS_Conn += {
 		switch ( ${reply.bound.addr_type} )
 			{
 			case 1:
-				sa->Assign(0, new AddrVal(htonl(${reply.bound.ipv4})));
+				sa->Assign(0, make_intrusive<AddrVal>(htonl(${reply.bound.ipv4})));
 				break;
 
 			case 3:
-				sa->Assign(1, new StringVal(${reply.bound.domain_name.name}.length(),
+				sa->Assign(1, make_intrusive<StringVal>(${reply.bound.domain_name.name}.length(),
 				                         (const char*) ${reply.bound.domain_name.name}.data()));
 				break;
 
 			case 4:
-				sa->Assign(0, new AddrVal(IPAddr(IPv6, (const uint32_t*) ${reply.bound.ipv6}, IPAddr::Network)));
+				sa->Assign(0, make_intrusive<AddrVal>(IPAddr(IPv6, (const uint32_t*) ${reply.bound.ipv6}, IPAddr::Network)));
 				break;
 
 			default:

src/analyzer/protocol/ssh/ssh-analyzer.pac

@@ -32,7 +32,7 @@ VectorVal* name_list_to_vector(const bytestring& nl)
 		{
 		word = name_list.substr(start, split_pos - start);
 		if ( word.size() > 0 && word[0] != ',' )
-			vv->Assign(vv->Size(), new StringVal(word));
+			vv->Assign(vv->Size(), make_intrusive<StringVal>(word));
 
 		start = split_pos + 1;
 		}
@@ -41,7 +41,7 @@ VectorVal* name_list_to_vector(const bytestring& nl)
 	if ( start < name_list.size() )
 		{
 		word = name_list.substr(start, name_list.size() - start);
-		vv->Assign(vv->Size(), new StringVal(word));
+		vv->Assign(vv->Size(), make_intrusive<StringVal>(word));
 		}
 	return vv;
 	}

src/analyzer/protocol/ssl/tls-handshake-analyzer.pac

@@ -183,7 +183,7 @@ refine connection Handshake_Conn += {
 		if ( protocols )
 			{
 			for ( unsigned int i = 0; i < protocols->size(); ++i )
-				plist->Assign(i, new StringVal((*protocols)[i]->name().length(), (const char*) (*protocols)[i]->name().data()));
+				plist->Assign(i, make_intrusive<StringVal>((*protocols)[i]->name().length(), (const char*) (*protocols)[i]->name().data()));
 			}
 
 		BifEvent::generate_ssl_extension_application_layer_protocol_negotiation(bro_analyzer(), bro_analyzer()->Conn(),
@@ -208,7 +208,7 @@ refine connection Handshake_Conn += {
 					}
 
 				if ( servername->host_name() )
-					servers->Assign(j++, new StringVal(servername->host_name()->host_name().length(), (const char*) servername->host_name()->host_name().data()));
+					servers->Assign(j++, make_intrusive<StringVal>(servername->host_name()->host_name().length(), (const char*) servername->host_name()->host_name().data()));
 				else
 					bro_analyzer()->Weird("Empty server_name extension in ssl connection");
 				}
@@ -487,7 +487,7 @@ refine connection Handshake_Conn += {
 			for ( auto&& identity : *(identities->identities()) )
 				{
 				RecordVal* el = new RecordVal(BifType::Record::SSL::PSKIdentity);
-				el->Assign(0, new StringVal(identity->identity().length(), (const char*) identity->identity().data()));
+				el->Assign(0, make_intrusive<StringVal>(identity->identity().length(), (const char*) identity->identity().data()));
 				el->Assign(1, val_mgr->GetCount(identity->obfuscated_ticket_age()));
 				slist->Assign(slist->Size(), el);
 				}
@@ -497,7 +497,7 @@ refine connection Handshake_Conn += {
 		if ( binders && binders->binders() )
 			{
 			for ( auto&& binder : *(binders->binders()) )
-				blist->Assign(blist->Size(), new StringVal(binder->binder().length(), (const char*) binder->binder().data()));
+				blist->Assign(blist->Size(), make_intrusive<StringVal>(binder->binder().length(), (const char*) binder->binder().data()));
 			}
 
 		BifEvent::generate_ssl_extension_pre_shared_key_client_hello(bro_analyzer(), bro_analyzer()->Conn(),

src/analyzer/protocol/tcp/TCP.cc

@@ -1366,7 +1366,7 @@ int TCP_Analyzer::ParseTCPOptions(const struct tcphdr* tcp, bool is_orig)
 
 			auto data_len = olen - 2;
 			auto data = reinterpret_cast<const char*>(odata + 2);
-			rv->Assign(2, new StringVal(data_len, data));
+			rv->Assign(2, make_intrusive<StringVal>(data_len, data));
 			};
 
 		for ( const auto& o : opts )

src/analyzer/protocol/tcp/TCP_Reassembler.cc

@@ -47,7 +47,7 @@ TCP_Reassembler::TCP_Reassembler(analyzer::Analyzer* arg_dst_analyzer,
 		TableVal* ports = IsOrig() ?
 			tcp_content_delivery_ports_orig :
 			tcp_content_delivery_ports_resp;
-		Val* result = ports->Lookup(dst_port_val);
+		auto result = ports->Lookup(dst_port_val);
 
 		if ( (IsOrig() && tcp_content_deliver_all_orig) ||
 		     (! IsOrig() && tcp_content_deliver_all_resp) ||

src/analyzer/protocol/teredo/Teredo.cc

@@ -118,9 +118,9 @@ RecordVal* TeredoEncapsulation::BuildVal(const IP_Hdr* inner) const
 		uint8_t au_len = *((uint8_t*)(auth + 3));
 		uint64_t nonce = ntohll(*((uint64_t*)(auth + 4 + id_len + au_len)));
 		uint8_t conf = *((uint8_t*)(auth + 4 + id_len + au_len + 8));
-		teredo_auth->Assign(0, new StringVal(
+		teredo_auth->Assign(0, make_intrusive<StringVal>(
 		    new BroString(auth + 4, id_len, 1)));
-		teredo_auth->Assign(1, new StringVal(
+		teredo_auth->Assign(1, make_intrusive<StringVal>(
 		    new BroString(auth + 4 + id_len, au_len, 1)));
 		teredo_auth->Assign(2, val_mgr->GetCount(nonce));
 		teredo_auth->Assign(3, val_mgr->GetCount(conf));
@@ -133,7 +133,7 @@ RecordVal* TeredoEncapsulation::BuildVal(const IP_Hdr* inner) const
 		uint16_t port = ntohs(*((uint16_t*)(origin_indication + 2))) ^ 0xFFFF;
 		uint32_t addr = ntohl(*((uint32_t*)(origin_indication + 4))) ^ 0xFFFFFFFF;
 		teredo_origin->Assign(0, val_mgr->GetPort(port, TRANSPORT_UDP));
-		teredo_origin->Assign(1, new AddrVal(htonl(addr)));
+		teredo_origin->Assign(1, make_intrusive<AddrVal>(htonl(addr)));
 		teredo_hdr->Assign(1, teredo_origin);
 		}
 

src/analyzer/protocol/udp/UDP.cc

@@ -135,23 +135,20 @@ void UDP_Analyzer::DeliverPacket(int len, const u_char* data, bool is_orig,
 	if ( udp_contents )
 		{
 		auto port_val = val_mgr->GetPort(ntohs(up->uh_dport), TRANSPORT_UDP);
-		Val* result = 0;
 		bool do_udp_contents = false;
 
 		if ( is_orig )
 			{
-			result = udp_content_delivery_ports_orig->Lookup(
+			auto result = udp_content_delivery_ports_orig->Lookup(port_val);
-								port_val);
+
-			if ( udp_content_deliver_all_orig ||
+			if ( udp_content_deliver_all_orig || (result && result->AsBool()) )
-			     (result && result->AsBool()) )
 				do_udp_contents = true;
 			}
 		else
 			{
-			result = udp_content_delivery_ports_resp->Lookup(
+			auto result = udp_content_delivery_ports_resp->Lookup(port_val);
-								port_val);
+
-			if ( udp_content_deliver_all_resp ||
+			if ( udp_content_deliver_all_resp || (result && result->AsBool()) )
-			     (result && result->AsBool()) )
 				do_udp_contents = true;
 			}
 

src/broker/Data.cc

@@ -196,7 +196,7 @@ struct val_converter {
 			if ( i == -1 )
 				return nullptr;
 
-			return etype->GetVal(i);
+			return etype->GetVal(i).release();
 			}
 
 		return nullptr;
@@ -208,7 +208,7 @@ struct val_converter {
 			return nullptr;
 
 		auto tt = type->AsTableType();
-		auto rval = make_intrusive<TableVal>(tt);
+		auto rval = make_intrusive<TableVal>(IntrusivePtr{NewRef{}, tt});
 
 		for ( auto& item : a )
 			{
@@ -268,7 +268,7 @@ struct val_converter {
 			return nullptr;
 
 		auto tt = type->AsTableType();
-		auto rval = make_intrusive<TableVal>(tt);
+		auto rval = make_intrusive<TableVal>(IntrusivePtr{NewRef{}, tt});
 
 		for ( auto& item : a )
 			{
@@ -321,7 +321,7 @@ struct val_converter {
 			if ( ! value_val )
 				return nullptr;
 
-			rval->Assign(list_val.get(), value_val.release());
+			rval->Assign(list_val.get(), std::move(value_val));
 			}
 
 		return rval.release();
@@ -341,7 +341,7 @@ struct val_converter {
 				if ( ! item_val )
 					return nullptr;
 
-				rval->Assign(rval->Size(), item_val.release());
+				rval->Assign(rval->Size(), std::move(item_val));
 				}
 
 			return rval.release();
@@ -410,7 +410,7 @@ struct val_converter {
 				if ( ! item_val )
 					return nullptr;
 
-				rval->Assign(i, item_val.release());
+				rval->Assign(i, std::move(item_val));
 				++idx;
 				}
 
@@ -997,8 +997,7 @@ broker::expected<broker::data> bro_broker::val_to_data(const Val* v)
 				continue;
 				}
 
-			auto item = val_to_data(item_val);
+			auto item = val_to_data(item_val.get());
-			Unref(item_val);
 
 			if ( ! item )
 				return broker::ec::invalid_data;
@@ -1040,7 +1039,7 @@ RecordVal* bro_broker::make_data_val(Val* v)
 	auto data = val_to_data(v);
 
 	if  ( data )
-		rval->Assign(0, new DataVal(move(*data)));
+		rval->Assign(0, make_intrusive<DataVal>(move(*data)));
 	else
 		reporter->Warning("did not get a value from val_to_data");
 
@@ -1050,7 +1049,7 @@ RecordVal* bro_broker::make_data_val(Val* v)
 RecordVal* bro_broker::make_data_val(broker::data d)
 	{
 	auto rval = new RecordVal(BifType::Record::Broker::Data);
-	rval->Assign(0, new DataVal(move(d)));
+	rval->Assign(0, make_intrusive<DataVal>(move(d)));
 	return rval;
 	}
 
@@ -1059,72 +1058,72 @@ struct data_type_getter {
 
 	result_type operator()(broker::none)
 		{
-		return BifType::Enum::Broker::DataType->GetVal(BifEnum::Broker::NONE);
+		return BifType::Enum::Broker::DataType->GetVal(BifEnum::Broker::NONE).release();
 		}
 
 	result_type operator()(bool)
 		{
-		return BifType::Enum::Broker::DataType->GetVal(BifEnum::Broker::BOOL);
+		return BifType::Enum::Broker::DataType->GetVal(BifEnum::Broker::BOOL).release();
 		}
 
 	result_type operator()(uint64_t)
 		{
-		return BifType::Enum::Broker::DataType->GetVal(BifEnum::Broker::COUNT);
+		return BifType::Enum::Broker::DataType->GetVal(BifEnum::Broker::COUNT).release();
 		}
 
 	result_type operator()(int64_t)
 		{
-		return BifType::Enum::Broker::DataType->GetVal(BifEnum::Broker::INT);
+		return BifType::Enum::Broker::DataType->GetVal(BifEnum::Broker::INT).release();
 		}
 
 	result_type operator()(double)
 		{
-		return BifType::Enum::Broker::DataType->GetVal(BifEnum::Broker::DOUBLE);
+		return BifType::Enum::Broker::DataType->GetVal(BifEnum::Broker::DOUBLE).release();
 		}
 
 	result_type operator()(const std::string&)
 		{
-		return BifType::Enum::Broker::DataType->GetVal(BifEnum::Broker::STRING);
+		return BifType::Enum::Broker::DataType->GetVal(BifEnum::Broker::STRING).release();
 		}
 
 	result_type operator()(const broker::address&)
 		{
-		return BifType::Enum::Broker::DataType->GetVal(BifEnum::Broker::ADDR);
+		return BifType::Enum::Broker::DataType->GetVal(BifEnum::Broker::ADDR).release();
 		}
 
 	result_type operator()(const broker::subnet&)
 		{
-		return BifType::Enum::Broker::DataType->GetVal(BifEnum::Broker::SUBNET);
+		return BifType::Enum::Broker::DataType->GetVal(BifEnum::Broker::SUBNET).release();
 		}
 
 	result_type operator()(const broker::port&)
 		{
-		return BifType::Enum::Broker::DataType->GetVal(BifEnum::Broker::PORT);
+		return BifType::Enum::Broker::DataType->GetVal(BifEnum::Broker::PORT).release();
 		}
 
 	result_type operator()(const broker::timestamp&)
 		{
-		return BifType::Enum::Broker::DataType->GetVal(BifEnum::Broker::TIME);
+		return BifType::Enum::Broker::DataType->GetVal(BifEnum::Broker::TIME).release();
 		}
 
 	result_type operator()(const broker::timespan&)
 		{
-		return BifType::Enum::Broker::DataType->GetVal(BifEnum::Broker::INTERVAL);
+		return BifType::Enum::Broker::DataType->GetVal(BifEnum::Broker::INTERVAL).release();
 		}
 
 	result_type operator()(const broker::enum_value&)
 		{
-		return BifType::Enum::Broker::DataType->GetVal(BifEnum::Broker::ENUM);
+		return BifType::Enum::Broker::DataType->GetVal(BifEnum::Broker::ENUM).release();
 		}
 
 	result_type operator()(const broker::set&)
 		{
-		return BifType::Enum::Broker::DataType->GetVal(BifEnum::Broker::SET);
+		return BifType::Enum::Broker::DataType->GetVal(BifEnum::Broker::SET).release();
 		}
 
 	result_type operator()(const broker::table&)
 		{
-		return BifType::Enum::Broker::DataType->GetVal(BifEnum::Broker::TABLE);
+		return BifType::Enum::Broker::DataType->GetVal(BifEnum::Broker::TABLE).release();
 		}
 
 	result_type operator()(const broker::vector&)
@@ -1132,7 +1131,7 @@ struct data_type_getter {
 		// Note that Broker uses vectors to store record data, so there's
 		// no actual way to tell if this data was originally associated
 		// with a Bro record.
-		return BifType::Enum::Broker::DataType->GetVal(BifEnum::Broker::VECTOR);
+		return BifType::Enum::Broker::DataType->GetVal(BifEnum::Broker::VECTOR).release();
 		}
 };
 

src/broker/Manager.cc

@@ -158,7 +158,7 @@ void Manager::InitPostScript()
 	opaque_of_vector_iterator = new OpaqueType("Broker::VectorIterator");
 	opaque_of_record_iterator = new OpaqueType("Broker::RecordIterator");
 	opaque_of_store_handle = new OpaqueType("Broker::Store");
-	vector_of_data_type = new VectorType(internal_type("Broker::Data")->Ref());
+	vector_of_data_type = new VectorType({NewRef{}, internal_type("Broker::Data")});
 
 	// Register as a "dont-count" source first, we may change that later.
 	iosource_mgr->Register(this, true);
@@ -550,7 +550,7 @@ bool Manager::PublishLogWrite(EnumVal* stream, EnumVal* writer, string path, int
 		new StringVal(path),
 	};
 
-	Val* v = log_topic_func->Call(&vl);
+	auto v = log_topic_func->Call(&vl);
 
 	if ( ! v )
 		{
@@ -561,7 +561,6 @@ bool Manager::PublishLogWrite(EnumVal* stream, EnumVal* writer, string path, int
 		}
 
 	std::string topic = v->AsString()->CheckString();
-	Unref(v);
 
 	auto bstream_id = broker::enum_value(move(stream_id));
 	auto bwriter_id = broker::enum_value(move(writer_id));
@@ -734,7 +733,7 @@ RecordVal* Manager::MakeEvent(val_list* args, Frame* frame)
 				return rval;
 				}
 
-			rval->Assign(0, new StringVal(func->Name()));
+			rval->Assign(0, make_intrusive<StringVal>(func->Name()));
 			continue;
 			}
 
@@ -1252,24 +1251,24 @@ void Manager::ProcessStatus(broker::status stat)
 
 	if ( ctx )
 		{
-		endpoint_info->Assign(0, new StringVal(to_string(ctx->node)));
+		endpoint_info->Assign(0, make_intrusive<StringVal>(to_string(ctx->node)));
 		auto ni = internal_type("Broker::NetworkInfo")->AsRecordType();
-		auto network_info = new RecordVal(ni);
+		auto network_info = make_intrusive<RecordVal>(ni);
 
 		if ( ctx->network )
 			{
-			network_info->Assign(0, new StringVal(ctx->network->address.data()));
+			network_info->Assign(0, make_intrusive<StringVal>(ctx->network->address.data()));
 			network_info->Assign(1, val_mgr->GetPort(ctx->network->port, TRANSPORT_TCP));
 			}
 		else
 			{
 			// TODO: are there any status messages where the ctx->network
 			// is not set and actually could be?
-			network_info->Assign(0, new StringVal("<unknown>"));
+			network_info->Assign(0, make_intrusive<StringVal>("<unknown>"));
 			network_info->Assign(1, val_mgr->GetPort(0, TRANSPORT_TCP));
 			}
 
-		endpoint_info->Assign(1, network_info);
+		endpoint_info->Assign(1, std::move(network_info));
 		}
 
 	auto str = stat.message();
@@ -1353,7 +1352,7 @@ void Manager::ProcessError(broker::error err)
 		}
 
 	mgr.QueueEventFast(Broker::error, {
-		BifType::Enum::Broker::ErrorCode->GetVal(ec),
+		BifType::Enum::Broker::ErrorCode->GetVal(ec).release(),
 		new StringVal(msg),
 	});
 	}

src/broker/Store.cc

@@ -20,7 +20,7 @@ EnumVal* query_status(bool success)
 		failure_val = store_query_status->Lookup("Broker", "FAILURE");
 		}
 
-	return store_query_status->GetVal(success ? success_val : failure_val);
+	return store_query_status->GetVal(success ? success_val : failure_val).release();
 	}
 
 void StoreHandleVal::ValDescribe(ODesc* d) const

src/broker/Store.h

@@ -28,7 +28,7 @@ inline RecordVal* query_result()
 	{
 	auto rval = new RecordVal(BifType::Record::Broker::QueryResult);
 	rval->Assign(0, query_status(false));
-	rval->Assign(1, new RecordVal(BifType::Record::Broker::Data));
+	rval->Assign(1, make_intrusive<RecordVal>(BifType::Record::Broker::Data));
 	return rval;
 	}
 

src/broker/comm.bif

@@ -109,16 +109,16 @@ function Broker::__peers%(%): PeerInfos
 
 		if ( n )
 			{
-			network_info->Assign(0, new AddrVal(IPAddr(n->address)));
+			network_info->Assign(0, make_intrusive<AddrVal>(IPAddr(n->address)));
 			network_info->Assign(1, val_mgr->GetPort(n->port, TRANSPORT_TCP));
 			}
 		else
 			{
-			network_info->Assign(0, new AddrVal("0.0.0.0"));
+			network_info->Assign(0, make_intrusive<AddrVal>("0.0.0.0"));
 			network_info->Assign(1, val_mgr->GetPort(0, TRANSPORT_TCP));
 			}
 
-		endpoint_info->Assign(0, new StringVal(to_string(p.peer.node)));
+		endpoint_info->Assign(0, make_intrusive<StringVal>(to_string(p.peer.node)));
 		endpoint_info->Assign(1, network_info);
 
 		auto ps = (BifEnum::Broker::PeerStatus)p.status;

src/broker/data.bif

@@ -154,7 +154,7 @@ function Broker::__set_iterator_value%(it: opaque of Broker::SetIterator%): Brok
 		return rval;
 		}
 
-	rval->Assign(0, new bro_broker::DataVal(*set_it->it));
+	rval->Assign(0, make_intrusive<bro_broker::DataVal>(*set_it->it));
 	return rval;
 	%}
 
@@ -312,8 +312,8 @@ function Broker::__table_iterator_value%(it: opaque of Broker::TableIterator%):
 		return rval;
 		}
 
-	key_val->Assign(0, new bro_broker::DataVal(ti->it->first));
+	key_val->Assign(0, make_intrusive<bro_broker::DataVal>(ti->it->first));
-	val_val->Assign(0, new bro_broker::DataVal(ti->it->second));
+	val_val->Assign(0, make_intrusive<bro_broker::DataVal>(ti->it->second));
 	return rval;
 	%}
 
@@ -431,7 +431,7 @@ function Broker::__vector_iterator_value%(it: opaque of Broker::VectorIterator%)
 		return rval;
 		}
 
-	rval->Assign(0, new bro_broker::DataVal(*vi->it));
+	rval->Assign(0, make_intrusive<bro_broker::DataVal>(*vi->it));
 	return rval;
 	%}
 
@@ -513,6 +513,6 @@ function Broker::__record_iterator_value%(it: opaque of Broker::RecordIterator%)
 	if ( caf::get_if<broker::none>(&(*ri->it)) )
 		return rval; // field isn't set
 
-	rval->Assign(0, new bro_broker::DataVal(*ri->it));
+	rval->Assign(0, make_intrusive<bro_broker::DataVal>(*ri->it));
 	return rval;
 	%}

src/broker/messaging.bif

@@ -187,10 +187,7 @@ function Cluster::publish_rr%(pool: Pool, key: string, ...%): bool
 	auto topic = topic_func->Call(&vl);
 
 	if ( ! topic->AsString()->Len() )
-		{
-		Unref(topic);
 		return val_mgr->GetFalse();
-		}
 
 	val_list* bif_args = @ARGS@;
 	val_list args(bif_args->length() - 2);
@@ -199,7 +196,6 @@ function Cluster::publish_rr%(pool: Pool, key: string, ...%): bool
 		args.push_back((*bif_args)[i]);
 
 	auto rval = publish_event_args(args, topic->AsString(), frame);
-	Unref(topic);
 	return val_mgr->GetBool(rval);
 	%}
 
@@ -228,10 +224,7 @@ function Cluster::publish_hrw%(pool: Pool, key: any, ...%): bool
 	auto topic = topic_func->Call(&vl);
 
 	if ( ! topic->AsString()->Len() )
-		{
-		Unref(topic);
 		return val_mgr->GetFalse();
-		}
 
 	val_list* bif_args = @ARGS@;
 	val_list args(bif_args->length() - 2);
@@ -240,6 +233,5 @@ function Cluster::publish_hrw%(pool: Pool, key: any, ...%): bool
 		args.push_back((*bif_args)[i]);
 
 	auto rval = publish_event_args(args, topic->AsString(), frame);
-	Unref(topic);
 	return val_mgr->GetBool(rval);
 	%}

src/file_analysis/AnalyzerSet.cc

@@ -21,8 +21,8 @@ static void analyzer_del_func(void* v)
 AnalyzerSet::AnalyzerSet(File* arg_file) : file(arg_file)
 	{
 	auto t = make_intrusive<TypeList>();
-	t->Append(file_mgr->GetTagEnumType()->Ref());
+	t->Append({NewRef{}, file_mgr->GetTagEnumType()});
-	t->Append(BifType::Record::Files::AnalyzerArgs->Ref());
+	t->Append({NewRef{}, BifType::Record::Files::AnalyzerArgs});
 	analyzer_hash = new CompositeHash(std::move(t));
 	analyzer_map.SetDeleteFunc(analyzer_del_func);
 	}

src/file_analysis/File.cc

@@ -23,20 +23,19 @@ using namespace file_analysis;
 
 static Val* empty_connection_table()
 	{
-	TypeList* tbl_index = new TypeList(conn_id);
+	auto tbl_index = make_intrusive<TypeList>(IntrusivePtr{NewRef{}, conn_id});
-	tbl_index->Append(conn_id->Ref());
+	tbl_index->Append({NewRef{}, conn_id});
-	TableType* tbl_type = new TableType(tbl_index, connection_type->Ref());
+	auto tbl_type = make_intrusive<TableType>(std::move(tbl_index),
-	Val* rval = new TableVal(tbl_type);
+	                                          IntrusivePtr{NewRef{}, connection_type});
-	Unref(tbl_type);
+	return new TableVal(std::move(tbl_type));
-	return rval;
 	}
 
 static RecordVal* get_conn_id_val(const Connection* conn)
 	{
 	RecordVal* v = new RecordVal(conn_id);
-	v->Assign(0, new AddrVal(conn->OrigAddr()));
+	v->Assign(0, make_intrusive<AddrVal>(conn->OrigAddr()));
 	v->Assign(1, val_mgr->GetPort(ntohs(conn->OrigPort()), conn->ConnTransport()));
-	v->Assign(2, new AddrVal(conn->RespAddr()));
+	v->Assign(2, make_intrusive<AddrVal>(conn->RespAddr()));
 	v->Assign(3, val_mgr->GetPort(ntohs(conn->RespPort()), conn->ConnTransport()));
 	return v;
 	}
@@ -93,7 +92,7 @@ File::File(const string& file_id, const string& source_name, Connection* conn,
 	DBG_LOG(DBG_FILE_ANALYSIS, "[%s] Creating new File object", file_id.c_str());
 
 	val = new RecordVal(fa_file_type);
-	val->Assign(id_idx, new StringVal(file_id.c_str()));
+	val->Assign(id_idx, make_intrusive<StringVal>(file_id.c_str()));
 	SetSource(source_name);
 
 	if ( conn )
@@ -117,7 +116,7 @@ File::~File()
 
 void File::UpdateLastActivityTime()
 	{
-	val->Assign(last_active_idx, new Val(network_time, TYPE_TIME));
+	val->Assign(last_active_idx, make_intrusive<Val>(network_time, TYPE_TIME));
 	}
 
 double File::GetLastActivityTime() const
@@ -165,18 +164,14 @@ void File::RaiseFileOverNewConnection(Connection* conn, bool is_orig)
 
 uint64_t File::LookupFieldDefaultCount(int idx) const
 	{
-	Val* v = val->LookupWithDefault(idx);
+	auto v = val->LookupWithDefault(idx);
-	uint64_t rval = v->AsCount();
+	return v->AsCount();
-	Unref(v);
-	return rval;
 	}
 
 double File::LookupFieldDefaultInterval(int idx) const
 	{
-	Val* v = val->LookupWithDefault(idx);
+	auto v = val->LookupWithDefault(idx);
-	double rval = v->AsInterval();
+	return v->AsInterval();
-	Unref(v);
-	return rval;
 	}
 
 int File::Idx(const string& field, const RecordType* type)
@@ -199,7 +194,7 @@ string File::GetSource() const
 
 void File::SetSource(const string& source)
 	{
-	val->Assign(source_idx, new StringVal(source.c_str()));
+	val->Assign(source_idx, make_intrusive<StringVal>(source.c_str()));
 	}
 
 double File::GetTimeoutInterval() const
@@ -209,7 +204,7 @@ double File::GetTimeoutInterval() const
 
 void File::SetTimeoutInterval(double interval)
 	{
-	val->Assign(timeout_interval_idx, new Val(interval, TYPE_INTERVAL));
+	val->Assign(timeout_interval_idx, make_intrusive<Val>(interval, TYPE_INTERVAL));
 	}
 
 bool File::SetExtractionLimit(RecordVal* args, uint64_t bytes)
@@ -305,7 +300,7 @@ bool File::SetMime(const string& mime_type)
 		return false;
 
 	RecordVal* meta = new RecordVal(fa_metadata_type);
-	meta->Assign(meta_mime_type_idx, new StringVal(mime_type));
+	meta->Assign(meta_mime_type_idx, make_intrusive<StringVal>(mime_type));
 	meta->Assign(meta_inferred_idx, val_mgr->GetBool(0));
 
 	FileEvent(file_sniff, {val->Ref(), meta});
@@ -369,7 +364,7 @@ bool File::BufferBOF(const u_char* data, uint64_t len)
 	if ( bof_buffer.size > 0 )
 		{
 		BroString* bs = concatenate(bof_buffer.chunks);
-		val->Assign(bof_buffer_idx, new StringVal(bs));
+		val->Assign(bof_buffer_idx, make_intrusive<StringVal>(bs));
 		}
 
 	return false;

src/file_analysis/Manager.cc

@@ -449,16 +449,13 @@ bool Manager::IsDisabled(const analyzer::Tag& tag)
 		disabled = internal_const_val("Files::disable")->AsTableVal();
 
 	Val* index = val_mgr->GetCount(bool(tag));
-	Val* yield = disabled->Lookup(index);
+	auto yield = disabled->Lookup(index);
 	Unref(index);
 
 	if ( ! yield )
 		return false;
 
-	bool rval = yield->AsBool();
+	return yield->AsBool();
-	Unref(yield);
-
-	return rval;
 	}
 
 Analyzer* Manager::InstantiateAnalyzer(const Tag& tag, RecordVal* args, File* f) const
@@ -528,7 +525,7 @@ VectorVal* file_analysis::GenMIMEMatchesVal(const RuleMatcher::MIME_Matches& m)
 		      it2 != it->second.end(); ++it2 )
 			{
 			element->Assign(0, val_mgr->GetInt(it->first));
-			element->Assign(1, new StringVal(*it2));
+			element->Assign(1, make_intrusive<StringVal>(*it2));
 			}
 
 		rval->Assign(rval->Size(), element);

src/file_analysis/analyzer/data_event/DataEvent.cc

@@ -21,8 +21,8 @@ DataEvent::DataEvent(RecordVal* args, File* file,
 
 file_analysis::Analyzer* DataEvent::Instantiate(RecordVal* args, File* file)
 	{
-	Val* chunk_val = args->Lookup("chunk_event");
+	auto chunk_val = args->Lookup("chunk_event");
-	Val* stream_val = args->Lookup("stream_event");
+	auto stream_val = args->Lookup("stream_event");
 
 	if ( ! chunk_val && ! stream_val ) return 0;
 

src/file_analysis/analyzer/entropy/Entropy.cc

@@ -61,11 +61,11 @@ void Entropy::Finalize()
 	entropy->Get(&ent, &chisq, &mean, &montepi, &scc);
 
 	RecordVal* ent_result = new RecordVal(entropy_test_result);
-	ent_result->Assign(0, new Val(ent,     TYPE_DOUBLE));
+	ent_result->Assign(0, make_intrusive<Val>(ent,     TYPE_DOUBLE));
-	ent_result->Assign(1, new Val(chisq,   TYPE_DOUBLE));
+	ent_result->Assign(1, make_intrusive<Val>(chisq,   TYPE_DOUBLE));
-	ent_result->Assign(2, new Val(mean,    TYPE_DOUBLE));
+	ent_result->Assign(2, make_intrusive<Val>(mean,    TYPE_DOUBLE));
-	ent_result->Assign(3, new Val(montepi, TYPE_DOUBLE));
+	ent_result->Assign(3, make_intrusive<Val>(montepi, TYPE_DOUBLE));
-	ent_result->Assign(4, new Val(scc,     TYPE_DOUBLE));
+	ent_result->Assign(4, make_intrusive<Val>(scc,     TYPE_DOUBLE));
 
 	mgr.QueueEventFast(file_entropy, {
 		GetFile()->GetVal()->Ref(),

src/file_analysis/analyzer/extract/Extract.cc

@@ -32,9 +32,9 @@ Extract::~Extract()
 		safe_close(fd);
 	}
 
-static Val* get_extract_field_val(RecordVal* args, const char* name)
+static IntrusivePtr<Val> get_extract_field_val(RecordVal* args, const char* name)
 	{
-	Val* rval = args->Lookup(name);
+	auto rval = args->Lookup(name);
 
 	if ( ! rval )
 		reporter->Error("File extraction analyzer missing arg field: %s", name);
@@ -44,8 +44,8 @@ static Val* get_extract_field_val(RecordVal* args, const char* name)
 
 file_analysis::Analyzer* Extract::Instantiate(RecordVal* args, File* file)
 	{
-	Val* fname = get_extract_field_val(args, "extract_filename");
+	auto fname = get_extract_field_val(args, "extract_filename");
-	Val* limit = get_extract_field_val(args, "extract_limit");
+	auto limit = get_extract_field_val(args, "extract_limit");
 
 	if ( ! fname || ! limit )
 		return 0;

src/file_analysis/analyzer/extract/functions.bif

@@ -11,9 +11,8 @@ module FileExtract;
 function FileExtract::__set_limit%(file_id: string, args: any, n: count%): bool
 	%{
 	using BifType::Record::Files::AnalyzerArgs;
-	RecordVal* rv = args->AsRecordVal()->CoerceTo(AnalyzerArgs);
+	auto rv = args->AsRecordVal()->CoerceTo(AnalyzerArgs);
-    bool result = file_mgr->SetExtractionLimit(file_id->CheckString(), rv, n);
+	bool result = file_mgr->SetExtractionLimit(file_id->CheckString(), rv.get(), n);
-	Unref(rv);
 	return val_mgr->GetBool(result);
 	%}
 

src/file_analysis/analyzer/pe/pe-analyzer.pac

@@ -25,7 +25,7 @@ refine flow File += {
 	function characteristics_to_bro(c: uint32, len: uint8): TableVal
 		%{
 		uint64 mask = (len==16) ? 0xFFFF : 0xFFFFFFFF;
-		TableVal* char_set = new TableVal(internal_type("count_set")->AsTableType());
+		TableVal* char_set = new TableVal({NewRef{}, internal_type("count_set")->AsTableType()});
 		for ( uint16 i=0; i < len; ++i )
 			{
 			if ( ((c >> i) & 0x1) == 1 )
@@ -43,7 +43,7 @@ refine flow File += {
 		if ( pe_dos_header )
 			{
 			RecordVal* dh = new RecordVal(BifType::Record::PE::DOSHeader);
-			dh->Assign(0, new StringVal(${h.signature}.length(), (const char*) ${h.signature}.data()));
+			dh->Assign(0, make_intrusive<StringVal>(${h.signature}.length(), (const char*) ${h.signature}.data()));
 			dh->Assign(1, val_mgr->GetCount(${h.UsedBytesInTheLastPage}));
 			dh->Assign(2, val_mgr->GetCount(${h.FileSizeInPages}));
 			dh->Assign(3, val_mgr->GetCount(${h.NumberOfRelocationItems}));
@@ -97,7 +97,7 @@ refine flow File += {
 			{
 			RecordVal* fh = new RecordVal(BifType::Record::PE::FileHeader);
 			fh->Assign(0, val_mgr->GetCount(${h.Machine}));
-			fh->Assign(1, new Val(static_cast<double>(${h.TimeDateStamp}), TYPE_TIME));
+			fh->Assign(1, make_intrusive<Val>(static_cast<double>(${h.TimeDateStamp}), TYPE_TIME));
 			fh->Assign(2, val_mgr->GetCount(${h.PointerToSymbolTable}));
 			fh->Assign(3, val_mgr->GetCount(${h.NumberOfSymbols}));
 			fh->Assign(4, val_mgr->GetCount(${h.SizeOfOptionalHeader}));
@@ -176,7 +176,7 @@ refine flow File += {
 				name_len = ${h.name}.length();
 			else
 				name_len = first_null - ${h.name}.data();
-			section_header->Assign(0, new StringVal(name_len, (const char*) ${h.name}.data()));
+			section_header->Assign(0, make_intrusive<StringVal>(name_len, (const char*) ${h.name}.data()));
 
 			section_header->Assign(1, val_mgr->GetCount(${h.virtual_size}));
 			section_header->Assign(2, val_mgr->GetCount(${h.virtual_addr}));

src/file_analysis/analyzer/unified2/unified2-analyzer.pac

@@ -69,7 +69,7 @@ refine flow Flow += {
 			RecordVal* ids_event = new RecordVal(BifType::Record::Unified2::IDSEvent);
 			ids_event->Assign(0, val_mgr->GetCount(${ev.sensor_id}));
 			ids_event->Assign(1, val_mgr->GetCount(${ev.event_id}));
-			ids_event->Assign(2, new Val(ts_to_double(${ev.ts}), TYPE_TIME));
+			ids_event->Assign(2, make_intrusive<Val>(ts_to_double(${ev.ts}), TYPE_TIME));
 			ids_event->Assign(3, val_mgr->GetCount(${ev.signature_id}));
 			ids_event->Assign(4, val_mgr->GetCount(${ev.generator_id}));
 			ids_event->Assign(5, val_mgr->GetCount(${ev.signature_revision}));
@@ -97,7 +97,7 @@ refine flow Flow += {
 			RecordVal* ids_event = new RecordVal(BifType::Record::Unified2::IDSEvent);
 			ids_event->Assign(0, val_mgr->GetCount(${ev.sensor_id}));
 			ids_event->Assign(1, val_mgr->GetCount(${ev.event_id}));
-			ids_event->Assign(2, new Val(ts_to_double(${ev.ts}), TYPE_TIME));
+			ids_event->Assign(2, make_intrusive<Val>(ts_to_double(${ev.ts}), TYPE_TIME));
 			ids_event->Assign(3, val_mgr->GetCount(${ev.signature_id}));
 			ids_event->Assign(4, val_mgr->GetCount(${ev.generator_id}));
 			ids_event->Assign(5, val_mgr->GetCount(${ev.signature_revision}));
@@ -131,7 +131,7 @@ refine flow Flow += {
 			packet->Assign(0, val_mgr->GetCount(${pkt.sensor_id}));
 			packet->Assign(1, val_mgr->GetCount(${pkt.event_id}));
 			packet->Assign(2, val_mgr->GetCount(${pkt.event_second}));
-			packet->Assign(3, new Val(ts_to_double(${pkt.packet_ts}), TYPE_TIME));
+			packet->Assign(3, make_intrusive<Val>(ts_to_double(${pkt.packet_ts}), TYPE_TIME));
 			packet->Assign(4, val_mgr->GetCount(${pkt.link_type}));
 			packet->Assign(5, bytestring_to_val(${pkt.packet_data}));
 

src/file_analysis/analyzer/x509/OCSP.cc

@@ -32,9 +32,9 @@ using namespace file_analysis;
 
 #define OCSP_STRING_BUF_SIZE 2048
 
-static Val* get_ocsp_type(RecordVal* args, const char* name)
+static IntrusivePtr<Val> get_ocsp_type(RecordVal* args, const char* name)
 	{
-	Val* rval = args->Lookup(name);
+	auto rval = args->Lookup(name);
 
 	if ( ! rval )
 		reporter->Error("File extraction analyzer missing arg field: %s", name);
@@ -624,7 +624,7 @@ void file_analysis::OCSP::ParseResponse(OCSP_RESPONSE *resp)
 
 	//i2a_ASN1_OBJECT(bio, basic_resp->signature);
 	//len = BIO_read(bio, buf, sizeof(buf));
-	//ocsp_resp_record->Assign(7, new StringVal(len, buf));
+	//ocsp_resp_record->Assign(7, make_intrusive<StringVal>(len, buf));
 	//BIO_reset(bio);
 
 	certs_vector = new VectorVal(internal_type("x509_opaque_vector")->AsVectorType());
@@ -644,7 +644,7 @@ void file_analysis::OCSP::ParseResponse(OCSP_RESPONSE *resp)
 			::X509 *this_cert = X509_dup(helper_sk_X509_value(certs, i));
 			//::X509 *this_cert = X509_dup(sk_X509_value(certs, i));
 			if (this_cert)
-				certs_vector->Assign(i, new file_analysis::X509Val(this_cert));
+				certs_vector->Assign(i, make_intrusive<file_analysis::X509Val>(this_cert));
 			else
 				reporter->Weird("OpenSSL returned null certificate");
 			}

src/file_analysis/analyzer/x509/X509.cc

@@ -51,7 +51,7 @@ bool file_analysis::X509::EndOfFile()
 		hash_final(ctx, buf);
 		std::string cert_sha256 = sha256_digest_print(buf);
 		auto index = make_intrusive<StringVal>(cert_sha256);
-		auto* entry = certificate_cache->Lookup(index.get(), false);
+		auto entry = certificate_cache->Lookup(index.get(), false);
 		if ( entry )
 			// in this case, the certificate is in the cache and we do not
 			// do any further processing here. However, if there is a callback, we execute it.
@@ -62,9 +62,9 @@ bool file_analysis::X509::EndOfFile()
 
 			val_list vl(3);
 			vl.push_back(GetFile()->GetVal()->Ref());
-			vl.push_back(entry->Ref());
+			vl.push_back(entry.release());
 			vl.push_back(new StringVal(cert_sha256));
-			IntrusivePtr<Val> v{AdoptRef{}, cache_hit_callback->Call(&vl)};
+			cache_hit_callback->Call(&vl);
 			return false;
 			}
 		}
@@ -126,12 +126,12 @@ RecordVal* file_analysis::X509::ParseCertificate(X509Val* cert_val, File* f)
 	pX509Cert->Assign(0, val_mgr->GetCount((uint64_t) X509_get_version(ssl_cert) + 1));
 	i2a_ASN1_INTEGER(bio, X509_get_serialNumber(ssl_cert));
 	int len = BIO_read(bio, buf, sizeof(buf));
-	pX509Cert->Assign(1, new StringVal(len, buf));
+	pX509Cert->Assign(1, make_intrusive<StringVal>(len, buf));
 	BIO_reset(bio);
 
 	X509_NAME_print_ex(bio, X509_get_subject_name(ssl_cert), 0, XN_FLAG_RFC2253);
 	len = BIO_gets(bio, buf, sizeof(buf));
-	pX509Cert->Assign(2, new StringVal(len, buf));
+	pX509Cert->Assign(2, make_intrusive<StringVal>(len, buf));
 	BIO_reset(bio);
 
 	X509_NAME *subject_name = X509_get_subject_name(ssl_cert);
@@ -151,17 +151,17 @@ RecordVal* file_analysis::X509::ParseCertificate(X509Val* cert_val, File* f)
 		// we found a common name
 		ASN1_STRING_print(bio, X509_NAME_ENTRY_get_data(X509_NAME_get_entry(subject_name, namepos)));
 		len = BIO_gets(bio, buf, sizeof(buf));
-		pX509Cert->Assign(4, new StringVal(len, buf));
+		pX509Cert->Assign(4, make_intrusive<StringVal>(len, buf));
 		BIO_reset(bio);
 		}
 
 	X509_NAME_print_ex(bio, X509_get_issuer_name(ssl_cert), 0, XN_FLAG_RFC2253);
 	len = BIO_gets(bio, buf, sizeof(buf));
-	pX509Cert->Assign(3, new StringVal(len, buf));
+	pX509Cert->Assign(3, make_intrusive<StringVal>(len, buf));
 	BIO_free(bio);
 
-	pX509Cert->Assign(5, new Val(GetTimeFromAsn1(X509_get_notBefore(ssl_cert), f, reporter), TYPE_TIME));
+	pX509Cert->Assign(5, make_intrusive<Val>(GetTimeFromAsn1(X509_get_notBefore(ssl_cert), f, reporter), TYPE_TIME));
-	pX509Cert->Assign(6, new Val(GetTimeFromAsn1(X509_get_notAfter(ssl_cert), f, reporter), TYPE_TIME));
+	pX509Cert->Assign(6, make_intrusive<Val>(GetTimeFromAsn1(X509_get_notAfter(ssl_cert), f, reporter), TYPE_TIME));
 
 	// we only read 255 bytes because byte 256 is always 0.
 	// if the string is longer than 255, that will be our null-termination,
@@ -171,7 +171,7 @@ RecordVal* file_analysis::X509::ParseCertificate(X509Val* cert_val, File* f)
 	if ( ! i2t_ASN1_OBJECT(buf, 255, algorithm) )
 		buf[0] = 0;
 
-	pX509Cert->Assign(7, new StringVal(buf));
+	pX509Cert->Assign(7, make_intrusive<StringVal>(buf));
 
 	// Special case for RDP server certificates. For some reason some (all?) RDP server
 	// certificates like to specify their key algorithm as md5WithRSAEncryption, which
@@ -193,25 +193,25 @@ RecordVal* file_analysis::X509::ParseCertificate(X509Val* cert_val, File* f)
 	if ( ! i2t_ASN1_OBJECT(buf, 255, OBJ_nid2obj(X509_get_signature_nid(ssl_cert))) )
 		buf[0] = 0;
 
-	pX509Cert->Assign(8, new StringVal(buf));
+	pX509Cert->Assign(8, make_intrusive<StringVal>(buf));
 
 	// Things we can do when we have the key...
 	EVP_PKEY *pkey = X509_extract_key(ssl_cert);
 	if ( pkey != NULL )
 		{
 		if ( EVP_PKEY_base_id(pkey) == EVP_PKEY_DSA )
-			pX509Cert->Assign(9, new StringVal("dsa"));
+			pX509Cert->Assign(9, make_intrusive<StringVal>("dsa"));
 
 		else if ( EVP_PKEY_base_id(pkey) == EVP_PKEY_RSA )
 			{
-			pX509Cert->Assign(9, new StringVal("rsa"));
+			pX509Cert->Assign(9, make_intrusive<StringVal>("rsa"));
 
 			const BIGNUM *e;
 			RSA_get0_key(EVP_PKEY_get0_RSA(pkey), NULL, &e, NULL);
 			char *exponent = BN_bn2dec(e);
 			if ( exponent != NULL )
 				{
-				pX509Cert->Assign(11, new StringVal(exponent));
+				pX509Cert->Assign(11, make_intrusive<StringVal>(exponent));
 				OPENSSL_free(exponent);
 				exponent = NULL;
 				}
@@ -219,7 +219,7 @@ RecordVal* file_analysis::X509::ParseCertificate(X509Val* cert_val, File* f)
 #ifndef OPENSSL_NO_EC
 		else if ( EVP_PKEY_base_id(pkey) == EVP_PKEY_EC )
 			{
-			pX509Cert->Assign(9, new StringVal("ecdsa"));
+			pX509Cert->Assign(9, make_intrusive<StringVal>("ecdsa"));
 			pX509Cert->Assign(12, KeyCurve(pkey));
 			}
 #endif
@@ -401,10 +401,10 @@ void file_analysis::X509::ParseSAN(X509_EXTENSION* ext)
 				uint32_t* addr = (uint32_t*) gen->d.ip->data;
 
 				if( gen->d.ip->length == 4 )
-					ips->Assign(ips->Size(), new AddrVal(*addr));
+					ips->Assign(ips->Size(), make_intrusive<AddrVal>(*addr));
 
 				else if ( gen->d.ip->length == 16 )
-					ips->Assign(ips->Size(), new AddrVal(addr));
+					ips->Assign(ips->Size(), make_intrusive<AddrVal>(addr));
 
 				else
 					{
@@ -545,9 +545,9 @@ X509Val::~X509Val()
 		X509_free(certificate);
 	}
 
-Val* X509Val::DoClone(CloneState* state)
+IntrusivePtr<Val> X509Val::DoClone(CloneState* state)
 	{
-	auto copy = new X509Val();
+	auto copy = make_intrusive<X509Val>();
 	if ( certificate )
 		copy->certificate = X509_dup(certificate);
 

src/file_analysis/analyzer/x509/X509.h

@@ -169,7 +169,7 @@ public:
 	 *
 	 * @return A cloned X509Val.
 	 */
-	Val* DoClone(CloneState* state) override;
+	IntrusivePtr<Val> DoClone(CloneState* state) override;
 
 	/**
 	 * Destructor.

src/file_analysis/analyzer/x509/X509Common.cc

@@ -263,12 +263,12 @@ void file_analysis::X509Common::ParseExtension(X509_EXTENSION* ex, const EventHa
 		ext_val = new StringVal(0, "");
 
 	RecordVal* pX509Ext = new RecordVal(BifType::Record::X509::Extension);
-	pX509Ext->Assign(0, new StringVal(name));
+	pX509Ext->Assign(0, make_intrusive<StringVal>(name));
 
 	if ( short_name and strlen(short_name) > 0 )
-		pX509Ext->Assign(1, new StringVal(short_name));
+		pX509Ext->Assign(1, make_intrusive<StringVal>(short_name));
 
-	pX509Ext->Assign(2, new StringVal(oid));
+	pX509Ext->Assign(2, make_intrusive<StringVal>(oid));
 	pX509Ext->Assign(3, val_mgr->GetBool(critical));
 	pX509Ext->Assign(4, ext_val);
 

src/file_analysis/analyzer/x509/functions.bif

@@ -16,7 +16,7 @@ RecordVal* x509_result_record(uint64_t num, const char* reason, Val* chainVector
 	RecordVal* rrecord = new RecordVal(BifType::Record::X509::Result);
 
 	rrecord->Assign(0, val_mgr->GetInt(num));
-	rrecord->Assign(1, new StringVal(reason));
+	rrecord->Assign(1, make_intrusive<StringVal>(reason));
 	if ( chainVector )
 		rrecord->Assign(2, chainVector);
 
@@ -564,7 +564,7 @@ function x509_verify%(certs: x509_opaque_vector, root_certs: table_string_of_str
 
 			if ( currcert )
 				// X509Val takes ownership of currcert.
-				chainVector->Assign(i, new file_analysis::X509Val(currcert));
+				chainVector->Assign(i, make_intrusive<file_analysis::X509Val>(currcert));
 			else
 				{
 				reporter->InternalWarning("OpenSSL returned null certificate");

src/file_analysis/file_analysis.bif

@@ -42,10 +42,9 @@ function Files::__set_reassembly_buffer%(file_id: string, max: count%): bool
 function Files::__add_analyzer%(file_id: string, tag: Files::Tag, args: any%): bool
 	%{
 	using BifType::Record::Files::AnalyzerArgs;
-	RecordVal* rv = args->AsRecordVal()->CoerceTo(AnalyzerArgs);
+	auto rv = args->AsRecordVal()->CoerceTo(AnalyzerArgs);
 	bool result = file_mgr->AddAnalyzer(file_id->CheckString(),
-	                                    file_mgr->GetComponentTag(tag), rv);
+	                                    file_mgr->GetComponentTag(tag), rv.get());
-	Unref(rv);
 	return val_mgr->GetBool(result);
 	%}
 
@@ -53,10 +52,9 @@ function Files::__add_analyzer%(file_id: string, tag: Files::Tag, args: any%): b
 function Files::__remove_analyzer%(file_id: string, tag: Files::Tag, args: any%): bool
 	%{
 	using BifType::Record::Files::AnalyzerArgs;
-	RecordVal* rv = args->AsRecordVal()->CoerceTo(AnalyzerArgs);
+	auto rv = args->AsRecordVal()->CoerceTo(AnalyzerArgs);
 	bool result = file_mgr->RemoveAnalyzer(file_id->CheckString(),
-	                                       file_mgr->GetComponentTag(tag) , rv);
+	                                       file_mgr->GetComponentTag(tag) , rv.get());
-	Unref(rv);
 	return val_mgr->GetBool(result);
 	%}
 

src/input/Manager.cc

@@ -88,17 +88,10 @@ Manager::Stream::Stream(StreamType t)
 
 Manager::Stream::~Stream()
 	{
-	if ( type )
 	Unref(type);
-
-	if ( description )
 	Unref(description);
-
-	if ( config )
 	Unref(config);
-
+	delete reader;
-	if ( reader )
-	        delete(reader);
 	}
 
 class Manager::TableStream: public Manager::Stream {
@@ -239,9 +232,7 @@ bool Manager::CreateStream(Stream* info, RecordVal* description)
 		return false;
 		}
 
-	Val* name_val = description->Lookup("name", true);
+	string name = description->Lookup("name", true)->AsString()->CheckString();
-	string name = name_val->AsString()->CheckString();
-	Unref(name_val);
 
 	Stream *i = FindStream(name);
 	if ( i != 0 )
@@ -251,20 +242,17 @@ bool Manager::CreateStream(Stream* info, RecordVal* description)
 		return false;
 		}
 
-	EnumVal* reader = description->Lookup("reader", true)->AsEnumVal();
+	auto reader = description->Lookup("reader", true);
 
 	// get the source ...
-	Val* sourceval = description->Lookup("source", true);
+	const BroString* bsource = description->Lookup("source", true)->AsString();
-	assert ( sourceval != 0 );
-	const BroString* bsource = sourceval->AsString();
 	string source((const char*) bsource->Bytes(), bsource->Len());
-	Unref(sourceval);
 
 	ReaderBackend::ReaderInfo rinfo;
 	rinfo.source = copy_string(source.c_str());
 	rinfo.name = copy_string(name.c_str());
 
-	EnumVal* mode = description->Lookup("mode", true)->AsEnumVal();
+	auto mode = description->Lookup("mode", true)->AsEnumVal();
 	switch ( mode->InternalInt() )
 		{
 		case 0:
@@ -281,14 +269,11 @@ bool Manager::CreateStream(Stream* info, RecordVal* description)
 
 		default:
 			reporter->InternalWarning("unknown input reader mode");
-			Unref(mode);
 			return false;
 		}
 
-	Unref(mode);
+	auto config = description->Lookup("config", true);
-
+	info->config = config.release()->AsTableVal();
-	Val* config = description->Lookup("config", true);
-	info->config = config->AsTableVal(); // ref'd by LookupWithDefault
 
 		{
 		// create config mapping in ReaderInfo. Has to be done before the construction of reader_obj.
@@ -305,15 +290,13 @@ bool Manager::CreateStream(Stream* info, RecordVal* description)
 			Unref(index);
 			delete k;
 			}
-
 		}
 
-
+	ReaderFrontend* reader_obj = new ReaderFrontend(rinfo, reader->AsEnumVal());
-	ReaderFrontend* reader_obj = new ReaderFrontend(rinfo, reader);
 	assert(reader_obj);
 
 	info->reader = reader_obj;
-	info->type = reader->AsEnumVal(); // ref'd by lookupwithdefault
+	info->type = reader.release()->AsEnumVal();
 	info->name = name;
 
 	Ref(description);
@@ -335,19 +318,14 @@ bool Manager::CreateEventStream(RecordVal* fval)
 		return false;
 		}
 
-	Val* name_val = fval->Lookup("name", true);
+	string stream_name = fval->Lookup("name", true)->AsString()->CheckString();
-	string stream_name = name_val->AsString()->CheckString();
-	Unref(name_val);
 
-	Val* fields_val = fval->Lookup("fields", true);
+	auto fields_val = fval->Lookup("fields", true);
 	RecordType* fields = fields_val->AsType()->AsTypeType()->Type()->AsRecordType();
-	Unref(fields_val);
 
-	Val *want_record = fval->Lookup("want_record", true);
+	auto want_record = fval->Lookup("want_record", true);
 
-	Val* event_val = fval->Lookup("ev", true);
+	Func* event = fval->Lookup("ev", true)->AsFunc();
-	Func* event = event_val->AsFunc();
-	Unref(event_val);
 
 	FuncType* etype = event->FType()->AsFuncType();
 
@@ -435,9 +413,8 @@ bool Manager::CreateEventStream(RecordVal* fval)
 	else
 		assert(false);
 
-	Val* error_event_val = fval->Lookup("error_ev", true);
+	auto error_event_val = fval->Lookup("error_ev", true);
 	Func* error_event = error_event_val ? error_event_val->AsFunc() : nullptr;
-	Unref(error_event_val);
 
 	if ( ! CheckErrorEventTypes(stream_name, error_event, false) )
 		return false;
@@ -467,13 +444,11 @@ bool Manager::CreateEventStream(RecordVal* fval)
 	for ( unsigned int i = 0; i < fieldsV.size(); i++ )
 		logf[i] = fieldsV[i];
 
-	Unref(fields); // ref'd by lookupwithdefault
 	stream->num_fields = fieldsV.size();
 	stream->fields = fields->Ref()->AsRecordType();
 	stream->event = event_registry->Lookup(event->Name());
 	stream->error_event = error_event ? event_registry->Lookup(error_event->Name()) : nullptr;
 	stream->want_record = ( want_record->InternalInt() == 1 );
-	Unref(want_record); // ref'd by lookupwithdefault
 
 	assert(stream->reader);
 
@@ -496,26 +471,19 @@ bool Manager::CreateTableStream(RecordVal* fval)
 		return false;
 		}
 
-	Val* name_val = fval->Lookup("name", true);
+	string stream_name = fval->Lookup("name", true)->AsString()->CheckString();
-	string stream_name = name_val->AsString()->CheckString();
-	Unref(name_val);
 
-	Val* pred = fval->Lookup("pred", true);
+	auto pred = fval->Lookup("pred", true);
-
+	auto idx_val = fval->Lookup("idx", true);
-	Val* idx_val = fval->Lookup("idx", true);
 	RecordType* idx = idx_val->AsType()->AsTypeType()->Type()->AsRecordType();
-	Unref(idx_val);
 
-	RecordType *val = 0;
+	IntrusivePtr<RecordType> val;
+	auto val_val = fval->Lookup("val", true);
 
-	Val* val_val = fval->Lookup("val", true);
 	if ( val_val )
-		{
+		val = {NewRef{}, val_val->AsType()->AsTypeType()->Type()->AsRecordType()};
-		val = val_val->AsType()->AsTypeType()->Type()->AsRecordType();
-		Unref(val_val);
-		}
 
-	TableVal *dst = fval->Lookup("destination", true)->AsTableVal();
+	auto dst = fval->Lookup("destination", true);
 
 	// check if index fields match table description
 	int num = idx->NumFields();
@@ -550,12 +518,12 @@ bool Manager::CreateTableStream(RecordVal* fval)
 		return false;
 		}
 
-	Val *want_record = fval->Lookup("want_record", true);
+	auto want_record = fval->Lookup("want_record", true);
 
 	if ( val )
 		{
 		const BroType* table_yield = dst->Type()->AsTableType()->YieldType();
-		const BroType* compare_type = val;
+		const BroType* compare_type = val.get();
 
 		if ( want_record->InternalInt() == 0 )
 			compare_type = val->FieldType(0);
@@ -583,9 +551,8 @@ bool Manager::CreateTableStream(RecordVal* fval)
 			}
 		}
 
-	Val* event_val = fval->Lookup("ev", true);
+	auto event_val = fval->Lookup("ev", true);
 	Func* event = event_val ? event_val->AsFunc() : 0;
-	Unref(event_val);
 
 	if ( event )
 		{
@@ -628,7 +595,7 @@ bool Manager::CreateTableStream(RecordVal* fval)
 			return false;
 			}
 
-		if ( want_record->InternalInt() == 1 && val && ! same_type((*args)[3], val) )
+		if ( want_record->InternalInt() == 1 && val && ! same_type((*args)[3], val.get()) )
 			{
 			ODesc desc1;
 			ODesc desc2;
@@ -657,9 +624,8 @@ bool Manager::CreateTableStream(RecordVal* fval)
 		assert(want_record->InternalInt() == 1 || want_record->InternalInt() == 0);
 		}
 
-	Val* error_event_val = fval->Lookup("error_ev", true);
+	auto error_event_val = fval->Lookup("error_ev", true);
 	Func* error_event = error_event_val ? error_event_val->AsFunc() : nullptr;
-	Unref(error_event_val);
 
 	if ( ! CheckErrorEventTypes(stream_name, error_event, true) )
 		return false;
@@ -671,7 +637,7 @@ bool Manager::CreateTableStream(RecordVal* fval)
 	int idxfields = fieldsV.size();
 
 	if ( val ) // if we are not a set
-		status = status || ! UnrollRecordType(&fieldsV, val, "", BifConst::Input::accept_unsupported_types);
+		status = status || ! UnrollRecordType(&fieldsV, val.get(), "", BifConst::Input::accept_unsupported_types);
 
 	int valfields = fieldsV.size() - idxfields;
 
@@ -710,9 +676,9 @@ bool Manager::CreateTableStream(RecordVal* fval)
 	stream->pred = pred ? pred->AsFunc() : 0;
 	stream->num_idx_fields = idxfields;
 	stream->num_val_fields = valfields;
-	stream->tab = dst->AsTableVal(); // ref'd by lookupwithdefault
+	stream->tab = dst.release()->AsTableVal();
-	stream->rtype = val ? val->AsRecordType() : 0;
+	stream->rtype = val.release();
-	stream->itype = idx->AsRecordType();
+	stream->itype = idx->Ref()->AsRecordType();
 	stream->event = event ? event_registry->Lookup(event->Name()) : 0;
 	stream->error_event = error_event ? event_registry->Lookup(error_event->Name()) : nullptr;
 	stream->currDict = new PDict<InputHash>;
@@ -721,9 +687,6 @@ bool Manager::CreateTableStream(RecordVal* fval)
 	stream->lastDict->SetDeleteFunc(input_hash_delete_func);
 	stream->want_record = ( want_record->InternalInt() == 1 );
 
-	Unref(want_record); // ref'd by lookupwithdefault
-	Unref(pred);
-
 	assert(stream->reader);
 	stream->reader->Init(fieldsV.size(), fields );
 
@@ -1035,7 +998,7 @@ bool Manager::ForceUpdate(const string &name)
 
 Val* Manager::RecordValToIndexVal(RecordVal *r) const
 	{
-	Val* idxval;
+	IntrusivePtr<Val> idxval;
 
 	RecordType *type = r->Type()->AsRecordType();
 
@@ -1046,15 +1009,15 @@ Val* Manager::RecordValToIndexVal(RecordVal *r) const
 
 	else
 		{
-		ListVal *l = new ListVal(TYPE_ANY);
+		auto l = make_intrusive<ListVal>(TYPE_ANY);
 		for ( int j = 0 ; j < num_fields; j++ )
-			l->Append(r->LookupWithDefault(j));
+			l->Append(r->LookupWithDefault(j).release());
 
-		idxval = l;
+		idxval = std::move(l);
 		}
 
 
-	return idxval;
+	return idxval.release();
 	}
 
 
@@ -1109,7 +1072,7 @@ void Manager::SendEntry(ReaderFrontend* reader, Value* *vals)
 
 	else if ( i->stream_type == EVENT_STREAM )
 		{
-		EnumVal *type = BifType::Enum::Input::Event->GetVal(BifEnum::Input::EVENT_NEW);
+		EnumVal* type = BifType::Enum::Input::Event->GetVal(BifEnum::Input::EVENT_NEW).release();
 		readFields = SendEventStreamEvent(i, type, vals);
 		}
 
@@ -1215,9 +1178,9 @@ int Manager::SendEntryTable(Stream* i, const Value* const *vals)
 		if ( ! pred_convert_error )
 			{
 			if ( updated )
-				ev = BifType::Enum::Input::Event->GetVal(BifEnum::Input::EVENT_CHANGED);
+				ev = BifType::Enum::Input::Event->GetVal(BifEnum::Input::EVENT_CHANGED).release();
 			else
-				ev = BifType::Enum::Input::Event->GetVal(BifEnum::Input::EVENT_NEW);
+				ev = BifType::Enum::Input::Event->GetVal(BifEnum::Input::EVENT_NEW).release();
 
 			bool result;
 			if ( stream->num_val_fields > 0 ) // we have values
@@ -1275,7 +1238,7 @@ int Manager::SendEntryTable(Stream* i, const Value* const *vals)
 
 	assert(idxval);
 
-	Val* oldval = 0;
+	IntrusivePtr<Val> oldval;
 	if ( updated == true )
 		{
 		assert(stream->num_val_fields > 0);
@@ -1291,9 +1254,6 @@ int Manager::SendEntryTable(Stream* i, const Value* const *vals)
 	ih->idxkey = new HashKey(k->Key(), k->Size(), k->Hash());
 	ih->valhash = valhash;
 
-	if ( oldval && stream->event && updated )
-		Ref(oldval); // otherwise it is no longer accessible after the assignment
-
 	stream->tab->Assign(idxval, k, valval);
 	Unref(idxval); // asssign does not consume idxval.
 
@@ -1319,13 +1279,13 @@ int Manager::SendEntryTable(Stream* i, const Value* const *vals)
 		else if ( updated )
 			{ // in case of update send back the old value.
 			assert ( stream->num_val_fields > 0 );
-			ev = BifType::Enum::Input::Event->GetVal(BifEnum::Input::EVENT_CHANGED);
+			ev = BifType::Enum::Input::Event->GetVal(BifEnum::Input::EVENT_CHANGED).release();
 			assert ( oldval != 0 );
-			SendEvent(stream->event, 4, stream->description->Ref(), ev, predidx, oldval);
+			SendEvent(stream->event, 4, stream->description->Ref(), ev, predidx, oldval.release());
 			}
 		else
 			{
-			ev = BifType::Enum::Input::Event->GetVal(BifEnum::Input::EVENT_NEW);
+			ev = BifType::Enum::Input::Event->GetVal(BifEnum::Input::EVENT_NEW).release();
 			if ( stream->num_val_fields == 0 )
 				{
 				Ref(stream->description);
@@ -1376,7 +1336,7 @@ void Manager::EndCurrentSend(ReaderFrontend* reader)
 	while ( ( ih = stream->lastDict->NextEntry(lastDictIdxKey, c) ) )
 		{
 		ListVal * idx = 0;
-		Val *val = 0;
+		IntrusivePtr<Val> val;
 
 		Val* predidx = 0;
 		EnumVal* ev = 0;
@@ -1390,7 +1350,7 @@ void Manager::EndCurrentSend(ReaderFrontend* reader)
 			assert(val != 0);
 			predidx = ListValToRecordVal(idx, stream->itype, &startpos);
 			Unref(idx);
-			ev = BifType::Enum::Input::Event->GetVal(BifEnum::Input::EVENT_REMOVED);
+			ev = BifType::Enum::Input::Event->GetVal(BifEnum::Input::EVENT_REMOVED).release();
 			}
 
 		if ( stream->pred )
@@ -1399,9 +1359,8 @@ void Manager::EndCurrentSend(ReaderFrontend* reader)
 
 			Ref(ev);
 			Ref(predidx);
-			Ref(val);
 
-			bool result = CallPred(stream->pred, 3, ev, predidx, val);
+			bool result = CallPred(stream->pred, 3, ev, predidx, IntrusivePtr{val}.release());
 
 			if ( result == false )
 				{
@@ -1418,9 +1377,8 @@ void Manager::EndCurrentSend(ReaderFrontend* reader)
 		if ( stream->event )
 			{
 			Ref(predidx);
-			Ref(val);
 			Ref(ev);
-			SendEvent(stream->event, 4, stream->description->Ref(), ev, predidx, val);
+			SendEvent(stream->event, 4, stream->description->Ref(), ev, predidx, IntrusivePtr{val}.release());
 			}
 
 		if ( predidx )  // if we have a stream or an event...
@@ -1429,7 +1387,7 @@ void Manager::EndCurrentSend(ReaderFrontend* reader)
 		if ( ev )
 			Unref(ev);
 
-		Unref(stream->tab->Delete(ih->idxkey));
+		stream->tab->Delete(ih->idxkey);
 		stream->lastDict->Remove(lastDictIdxKey); // delete in next line
 		delete lastDictIdxKey;
 		delete(ih);
@@ -1499,7 +1457,7 @@ void Manager::Put(ReaderFrontend* reader, Value* *vals)
 
 	else if ( i->stream_type == EVENT_STREAM )
 		{
-		EnumVal *type = BifType::Enum::Input::Event->GetVal(BifEnum::Input::EVENT_NEW);
+		EnumVal* type = BifType::Enum::Input::Event->GetVal(BifEnum::Input::EVENT_NEW).release();
 		readFields = SendEventStreamEvent(i, type, vals);
 		}
 
@@ -1608,7 +1566,7 @@ int Manager::PutTable(Stream* i, const Value* const *vals)
 	if ( stream->pred || stream->event )
 		{
 		bool updated = false;
-		Val* oldval = 0;
+		IntrusivePtr<Val> oldval;
 
 		if ( stream->num_val_fields > 0 )
 			{
@@ -1620,7 +1578,6 @@ int Manager::PutTable(Stream* i, const Value* const *vals)
 			{
 			// it is an update
 			updated = true;
-			Ref(oldval); // have to do that, otherwise it may disappear in assign
 			}
 
 
@@ -1637,9 +1594,9 @@ int Manager::PutTable(Stream* i, const Value* const *vals)
 			else
 				{
 				if ( updated )
-					ev = BifType::Enum::Input::Event->GetVal(BifEnum::Input::EVENT_CHANGED);
+					ev = BifType::Enum::Input::Event->GetVal(BifEnum::Input::EVENT_CHANGED).release();
 				else
-					ev = BifType::Enum::Input::Event->GetVal(BifEnum::Input::EVENT_NEW);
+					ev = BifType::Enum::Input::Event->GetVal(BifEnum::Input::EVENT_NEW).release();
 
 				bool result;
 				if ( stream->num_val_fields > 0 ) // we have values
@@ -1655,7 +1612,6 @@ int Manager::PutTable(Stream* i, const Value* const *vals)
 					// do nothing
 					Unref(idxval);
 					Unref(valval);
-					Unref(oldval);
 					return stream->num_val_fields + stream->num_idx_fields;
 					}
 				}
@@ -1679,14 +1635,14 @@ int Manager::PutTable(Stream* i, const Value* const *vals)
 					{
 					// in case of update send back the old value.
 					assert ( stream->num_val_fields > 0 );
-					ev = BifType::Enum::Input::Event->GetVal(BifEnum::Input::EVENT_CHANGED);
+					ev = BifType::Enum::Input::Event->GetVal(BifEnum::Input::EVENT_CHANGED).release();
 					assert ( oldval != 0 );
 					SendEvent(stream->event, 4, stream->description->Ref(),
-							ev, predidx, oldval);
+					          ev, predidx, oldval.release());
 					}
 				else
 					{
-					ev = BifType::Enum::Input::Event->GetVal(BifEnum::Input::EVENT_NEW);
+					ev = BifType::Enum::Input::Event->GetVal(BifEnum::Input::EVENT_NEW).release();
 					if ( stream->num_val_fields == 0 )
 						SendEvent(stream->event, 4, stream->description->Ref(),
 								ev, predidx);
@@ -1760,7 +1716,7 @@ bool Manager::Delete(ReaderFrontend* reader, Value* *vals)
 
 		if ( stream->pred || stream->event )
 			{
-			Val *val = stream->tab->Lookup(idxval);
+			auto val = stream->tab->Lookup(idxval);
 
 			if ( stream->pred )
 				{
@@ -1771,10 +1727,9 @@ bool Manager::Delete(ReaderFrontend* reader, Value* *vals)
 					Unref(predidx);
 				else
 					{
-					Ref(val);
+					EnumVal* ev = BifType::Enum::Input::Event->GetVal(BifEnum::Input::EVENT_REMOVED).release();
-					EnumVal *ev = BifType::Enum::Input::Event->GetVal(BifEnum::Input::EVENT_REMOVED);
 
-					streamresult = CallPred(stream->pred, 3, ev, predidx, val);
+					streamresult = CallPred(stream->pred, 3, ev, predidx, IntrusivePtr{val}.release());
 
 					if ( streamresult == false )
 						{
@@ -1791,28 +1746,22 @@ bool Manager::Delete(ReaderFrontend* reader, Value* *vals)
 				{
 				Ref(idxval);
 				assert(val != 0);
-				Ref(val);
+				EnumVal* ev = BifType::Enum::Input::Event->GetVal(BifEnum::Input::EVENT_REMOVED).release();
-				EnumVal *ev = BifType::Enum::Input::Event->GetVal(BifEnum::Input::EVENT_REMOVED);
+				SendEvent(stream->event, 4, stream->description->Ref(), ev, idxval, IntrusivePtr{val}.release());
-				SendEvent(stream->event, 4, stream->description->Ref(), ev, idxval, val);
 				}
 			}
 
 		// only if stream = true -> no streaming
 		if ( streamresult )
 			{
-			Val* retptr = stream->tab->Delete(idxval);
+			if ( ! stream->tab->Delete(idxval) )
-			success = ( retptr != 0 );
-			if ( ! success )
 				Warning(i, "Internal error while deleting values from input table");
-			else
-				Unref(retptr);
 			}
-
 		}
 
 	else if ( i->stream_type == EVENT_STREAM  )
 		{
-		EnumVal *type = BifType::Enum::Input::Event->GetVal(BifEnum::Input::EVENT_REMOVED);
+		EnumVal* type = BifType::Enum::Input::Event->GetVal(BifEnum::Input::EVENT_REMOVED).release();
 		readVals = SendEventStreamEvent(i, type, vals);
 		success = true;
 		}
@@ -1845,12 +1794,9 @@ bool Manager::CallPred(Func* pred_func, const int numvals, ...) const
 
 	va_end(lP);
 
-	Val* v = pred_func->Call(&vl);
+	auto v = pred_func->Call(&vl);
 	if ( v )
-		{
 		result = v->AsBool();
-		Unref(v);
-		}
 
 	return result;
 	}
@@ -2390,10 +2336,10 @@ Val* Manager::ValueToVal(const Stream* i, const Value* val, BroType* request_typ
 		{
 		// all entries have to have the same type...
 		BroType* type = request_type->AsTableType()->Indices()->PureType();
-		TypeList* set_index = new TypeList(type->Ref());
+		auto set_index = make_intrusive<TypeList>(IntrusivePtr{NewRef{}, type});
-		set_index->Append(type->Ref());
+		set_index->Append({NewRef{}, type});
-		SetType* s = new SetType(set_index, 0);
+		auto s = make_intrusive<SetType>(std::move(set_index), nullptr);
-		TableVal* t = new TableVal(s);
+		TableVal* t = new TableVal(std::move(s));
 		for ( int j = 0; j < val->val.set_val.size; j++ )
 			{
 			Val* assignval = ValueToVal(i, val->val.set_val.vals[j], type, have_error);
@@ -2402,7 +2348,6 @@ Val* Manager::ValueToVal(const Stream* i, const Value* val, BroType* request_typ
 			Unref(assignval); // index is not consumed by assign.
 			}
 
-		Unref(s);
 		return t;
 		}
 
@@ -2410,7 +2355,7 @@ Val* Manager::ValueToVal(const Stream* i, const Value* val, BroType* request_typ
 		{
 		// all entries have to have the same type...
 		BroType* type = request_type->AsVectorType()->YieldType();
-		VectorType* vt = new VectorType(type->Ref());
+		VectorType* vt = new VectorType({NewRef{}, type});
 		VectorVal* v = new VectorVal(vt);
 		for ( int j = 0; j < val->val.vector_val.size; j++ )
 			{
@@ -2442,7 +2387,7 @@ Val* Manager::ValueToVal(const Stream* i, const Value* val, BroType* request_typ
 			return nullptr;
 			}
 
-		return request_type->Ref()->AsEnumType()->GetVal(index);
+		return request_type->AsEnumType()->GetVal(index).release();
 		}
 
 	default:
@@ -2537,10 +2482,10 @@ Val* Manager::ValueToVal(const Stream* i, const Value* val, bool& have_error) co
 
 	case TYPE_TABLE:
 		{
-		TypeList* set_index;
+		IntrusivePtr<TypeList> set_index;
 		if ( val->val.set_val.size == 0 && val->subtype == TYPE_VOID )
 			// don't know type - unspecified table.
-			set_index = new TypeList();
+			set_index = make_intrusive<TypeList>();
 		else
 			{
 			// all entries have to have the same type...
@@ -2548,7 +2493,7 @@ Val* Manager::ValueToVal(const Stream* i, const Value* val, bool& have_error) co
 			if ( stag == TYPE_VOID )
 				TypeTag stag = val->val.set_val.vals[0]->type;
 
-			BroType* index_type;
+			IntrusivePtr<BroType> index_type;
 
 			if ( stag == TYPE_ENUM )
 				{
@@ -2566,17 +2511,17 @@ Val* Manager::ValueToVal(const Stream* i, const Value* val, bool& have_error) co
 					return nullptr;
 					}
 
-				index_type = enum_id->Type()->AsEnumType();
+				index_type = {NewRef{}, enum_id->Type()->AsEnumType()};
 				}
 			else
-				index_type = base_type_no_ref(stag);
+				index_type = base_type(stag);
 
-			set_index = new TypeList(index_type);
+			set_index = make_intrusive<TypeList>(index_type);
-			set_index->Append(index_type->Ref());
+			set_index->Append(std::move(index_type));
 			}
 
-		SetType* s = new SetType(set_index, 0);
+		auto s = make_intrusive<SetType>(std::move(set_index), nullptr);
-		TableVal* t = new TableVal(s);
+		TableVal* t = new TableVal(std::move(s));
 		for ( int j = 0; j < val->val.set_val.size; j++ )
 			{
 			Val* assignval = ValueToVal(i, val->val.set_val.vals[j], have_error);
@@ -2585,13 +2530,13 @@ Val* Manager::ValueToVal(const Stream* i, const Value* val, bool& have_error) co
 			Unref(assignval); // index is not consumed by assign.
 			}
 
-		Unref(s);
 		return t;
 		}
 
 	case TYPE_VECTOR:
 		{
-		BroType* type;
+		IntrusivePtr<BroType> type;
+
 		if ( val->val.vector_val.size == 0  && val->subtype == TYPE_VOID )
 			// don't know type - unspecified table.
 			type = base_type(TYPE_ANY);
@@ -2604,14 +2549,12 @@ Val* Manager::ValueToVal(const Stream* i, const Value* val, bool& have_error) co
 				type = base_type(val->subtype);
 			}
 
-		VectorType* vt = new VectorType(type->Ref());
+		auto vt = make_intrusive<VectorType>(std::move(type));
-		VectorVal* v = new VectorVal(vt);
+		VectorVal* v = new VectorVal(vt.get());
-		for ( int j = 0; j < val->val.vector_val.size; j++ )
+
-			{
+		for ( int j = 0; j < val->val.vector_val.size; j++ )
-			v->Assign(j, ValueToVal(i, val->val.vector_val.vals[j], have_error));
+			v->Assign(j, ValueToVal(i, val->val.vector_val.vals[j], have_error));
-			}
 
-		Unref(vt);
 		return v;
 		}
 
@@ -2642,7 +2585,7 @@ Val* Manager::ValueToVal(const Stream* i, const Value* val, bool& have_error) co
 			return nullptr;
 			}
 
-		return t->GetVal(intval);
+		return t->GetVal(intval).release();
 		}
 
 	default:
@@ -2774,15 +2717,15 @@ void Manager::ErrorHandler(const Stream* i, ErrorType et, bool reporter_send, co
 		switch (et)
 			{
 			case ErrorType::INFO:
-				ev = BifType::Enum::Reporter::Level->GetVal(BifEnum::Reporter::INFO);
+				ev = BifType::Enum::Reporter::Level->GetVal(BifEnum::Reporter::INFO).release();
 				break;
 
 			case ErrorType::WARNING:
-				ev = BifType::Enum::Reporter::Level->GetVal(BifEnum::Reporter::WARNING);
+				ev = BifType::Enum::Reporter::Level->GetVal(BifEnum::Reporter::WARNING).release();
 				break;
 
 			case ErrorType::ERROR:
-				ev = BifType::Enum::Reporter::Level->GetVal(BifEnum::Reporter::ERROR);
+				ev = BifType::Enum::Reporter::Level->GetVal(BifEnum::Reporter::ERROR).release();
 				break;
 
 			default:

src/input/readers/config/Config.cc

@@ -31,7 +31,7 @@ Config::Config(ReaderFrontend *frontend) : ReaderBackend(frontend)
 
 	for ( const auto& entry : globals )
 		{
-		ID* id = entry.second;
+		ID* id = entry.second.get();
 		if ( ! id->IsOption() )
 			continue;
 

src/logging/Manager.cc

@@ -11,6 +11,7 @@
 #include "Type.h"
 #include "File.h"
 #include "input.h"
+#include "IntrusivePtr.h"
 
 #include "broker/Manager.h"
 #include "threading/Manager.h"
@@ -262,7 +263,7 @@ bool Manager::CreateStream(EnumVal* id, RecordVal* sval)
 		return false;
 		}
 
-	Val* event_val = sval->Lookup("ev");
+	auto event_val = sval->Lookup("ev");
 	Func* event = event_val ? event_val->AsFunc() : 0;
 
 	if ( event )
@@ -476,7 +477,7 @@ bool Manager::TraverseRecord(Stream* stream, Filter* filter, RecordType* rt,
 		if ( include )
 			{
 			StringVal* new_path_val = new StringVal(new_path.c_str());
-			bool result = include->Lookup(new_path_val);
+			bool result = (bool)include->Lookup(new_path_val);
 
 			Unref(new_path_val);
 
@@ -488,7 +489,7 @@ bool Manager::TraverseRecord(Stream* stream, Filter* filter, RecordType* rt,
 		if ( exclude )
 			{
 			StringVal* new_path_val = new StringVal(new_path.c_str());
-			bool result = exclude->Lookup(new_path_val);
+			bool result = (bool)exclude->Lookup(new_path_val);
 
 			Unref(new_path_val);
 
@@ -547,18 +548,18 @@ bool Manager::AddFilter(EnumVal* id, RecordVal* fval)
 
 	// Create a new Filter instance.
 
-	Val* name = fval->Lookup("name", true);
+	auto name = fval->Lookup("name", true);
-	Val* pred = fval->Lookup("pred", true);
+	auto pred = fval->Lookup("pred", true);
-	Val* path_func = fval->Lookup("path_func", true);
+	auto path_func = fval->Lookup("path_func", true);
-	Val* log_local = fval->Lookup("log_local", true);
+	auto log_local = fval->Lookup("log_local", true);
-	Val* log_remote = fval->Lookup("log_remote", true);
+	auto log_remote = fval->Lookup("log_remote", true);
-	Val* interv = fval->Lookup("interv", true);
+	auto interv = fval->Lookup("interv", true);
-	Val* postprocessor = fval->Lookup("postprocessor", true);
+	auto postprocessor = fval->Lookup("postprocessor", true);
-	Val* config = fval->Lookup("config", true);
+	auto config = fval->Lookup("config", true);
-	Val* field_name_map = fval->Lookup("field_name_map", true);
+	auto field_name_map = fval->Lookup("field_name_map", true);
-	Val* scope_sep = fval->Lookup("scope_sep", true);
+	auto scope_sep = fval->Lookup("scope_sep", true);
-	Val* ext_prefix = fval->Lookup("ext_prefix", true);
+	auto ext_prefix = fval->Lookup("ext_prefix", true);
-	Val* ext_func = fval->Lookup("ext_func", true);
+	auto ext_func = fval->Lookup("ext_func", true);
 
 	Filter* filter = new Filter;
 	filter->fval = fval->Ref();
@@ -577,23 +578,10 @@ bool Manager::AddFilter(EnumVal* id, RecordVal* fval)
 	filter->ext_prefix = ext_prefix->AsString()->CheckString();
 	filter->ext_func = ext_func ? ext_func->AsFunc() : 0;
 
-	Unref(name);
-	Unref(pred);
-	Unref(path_func);
-	Unref(log_local);
-	Unref(log_remote);
-	Unref(interv);
-	Unref(postprocessor);
-	Unref(config);
-	Unref(field_name_map);
-	Unref(scope_sep);
-	Unref(ext_prefix);
-	Unref(ext_func);
-
 	// Build the list of fields that the filter wants included, including
 	// potentially rolling out fields.
-	Val* include = fval->Lookup("include");
+	auto include = fval->Lookup("include");
-	Val* exclude = fval->Lookup("exclude");
+	auto exclude = fval->Lookup("exclude");
 
 	filter->num_ext_fields = 0;
 	if ( filter->ext_func )
@@ -618,8 +606,8 @@ bool Manager::AddFilter(EnumVal* id, RecordVal* fval)
 	filter->num_fields = 0;
 	filter->fields = 0;
 	if ( ! TraverseRecord(stream, filter, stream->columns,
-			      include ? include->AsTableVal() : 0,
+			      include ? include->AsTableVal() : nullptr,
-			      exclude ? exclude->AsTableVal() : 0,
+			      exclude ? exclude->AsTableVal() : nullptr,
 			      "", list<int>()) )
 		{
 		delete filter;
@@ -627,12 +615,12 @@ bool Manager::AddFilter(EnumVal* id, RecordVal* fval)
 		}
 
 	// Get the path for the filter.
-	Val* path_val = fval->Lookup("path");
+	auto path_val = fval->Lookup("path");
 
 	if ( path_val )
 		{
 		filter->path = path_val->AsString()->CheckString();
-		filter->path_val = path_val->Ref();
+		filter->path_val = path_val.release();
 		}
 
 	else
@@ -703,7 +691,7 @@ bool Manager::RemoveFilter(EnumVal* id, const string& name)
 	return true;
 	}
 
-bool Manager::Write(EnumVal* id, RecordVal* columns)
+bool Manager::Write(EnumVal* id, RecordVal* columns_arg)
 	{
 	Stream* stream = FindStream(id);
 	if ( ! stream )
@@ -712,7 +700,7 @@ bool Manager::Write(EnumVal* id, RecordVal* columns)
 	if ( ! stream->enabled )
 		return true;
 
-	columns = columns->CoerceTo(stream->columns);
+	auto columns = columns_arg->CoerceTo(stream->columns);
 
 	if ( ! columns )
 		{
@@ -739,12 +727,9 @@ bool Manager::Write(EnumVal* id, RecordVal* columns)
 
 			int result = 1;
 
-			Val* v = filter->pred->Call(&vl);
+			auto v = filter->pred->Call(&vl);
 			if ( v )
-				{
 				result = v->AsBool();
-				Unref(v);
-				}
 
 			if ( ! result )
 				continue;
@@ -762,20 +747,13 @@ bool Manager::Write(EnumVal* id, RecordVal* columns)
 			BroType* rt = filter->path_func->FType()->Args()->FieldType("rec");
 
 			if ( rt->Tag() == TYPE_RECORD )
-				rec_arg = columns->CoerceTo(rt->AsRecordType(), true);
+				rec_arg = columns->CoerceTo(rt->AsRecordType(), true).release();
 			else
 				// Can be TYPE_ANY here.
 				rec_arg = columns->Ref();
 
-			val_list vl{
+			val_list vl{id->Ref(), path_arg, rec_arg};
-				id->Ref(),
+			auto v = filter->path_func->Call(&vl);
-				path_arg,
-				rec_arg,
-			};
-
-			Val* v = 0;
-
-			v = filter->path_func->Call(&vl);
 
 			if ( ! v )
 				return false;
@@ -783,7 +761,6 @@ bool Manager::Write(EnumVal* id, RecordVal* columns)
 			if ( v->Type()->Tag() != TYPE_STRING )
 				{
 				reporter->Error("path_func did not return string");
-				Unref(v);
 				return false;
 				}
 
@@ -794,7 +771,6 @@ bool Manager::Write(EnumVal* id, RecordVal* columns)
 				}
 
 			path = v->AsString()->CheckString();
-			Unref(v);
 
 #ifdef DEBUG
 			DBG_LOG(DBG_LOGGING, "Path function for filter '%s' on stream '%s' return '%s'",
@@ -872,8 +848,7 @@ bool Manager::Write(EnumVal* id, RecordVal* columns)
 					{
 					const char* name = filter->fields[j]->name;
 					StringVal *fn = new StringVal(name);
-					Val *val = 0;
+					if ( auto val = filter->field_name_map->Lookup(fn, false) )
-					if ( (val = filter->field_name_map->Lookup(fn, false)) != 0 )
 						{
 						delete [] filter->fields[j]->name;
 						filter->fields[j]->name = copy_string(val->AsStringVal()->CheckString());
@@ -908,15 +883,12 @@ bool Manager::Write(EnumVal* id, RecordVal* columns)
 					      filter->remote, false, filter->name);
 
 			if ( ! writer )
-				{
-				Unref(columns);
 				return false;
 			}
-			}
 
 		// Alright, can do the write now.
 
-		threading::Value** vals = RecordToFilterVals(stream, filter, columns);
+		threading::Value** vals = RecordToFilterVals(stream, filter, columns.get());
 
 		if ( ! PLUGIN_HOOK_WITH_RESULT(HOOK_LOG_WRITE,
 		                               HookLogWrite(filter->writer->Type()->AsEnumType()->Lookup(filter->writer->InternalInt()),
@@ -925,7 +897,6 @@ bool Manager::Write(EnumVal* id, RecordVal* columns)
 		                                            filter->fields, vals),
 		                               true) )
 			{
-			Unref(columns);
 			DeleteVals(filter->num_fields, vals);
 
 #ifdef DEBUG
@@ -945,8 +916,6 @@ bool Manager::Write(EnumVal* id, RecordVal* columns)
 #endif
 		}
 
-	Unref(columns);
-
 	return true;
 	}
 
@@ -1086,13 +1055,15 @@ threading::Value* Manager::ValToLogVal(Val* val, BroType* ty)
 threading::Value** Manager::RecordToFilterVals(Stream* stream, Filter* filter,
                                                RecordVal* columns)
 	{
-	RecordVal* ext_rec = nullptr;
+	IntrusivePtr<RecordVal> ext_rec;
+
 	if ( filter->num_ext_fields > 0 )
 		{
 		val_list vl{filter->path_val->Ref()};
-		Val* res = filter->ext_func->Call(&vl);
+		auto res = filter->ext_func->Call(&vl);
+
 		if ( res )
-			ext_rec = res->AsRecordVal();
+			ext_rec = {AdoptRef{}, res.release()->AsRecordVal()};
 		}
 
 	threading::Value** vals = new threading::Value*[filter->num_fields];
@@ -1109,7 +1080,7 @@ threading::Value** Manager::RecordToFilterVals(Stream* stream, Filter* filter,
 				continue;
 				}
 
-			val = ext_rec;
+			val = ext_rec.get();
 			}
 		else
 			val = columns;
@@ -1134,9 +1105,6 @@ threading::Value** Manager::RecordToFilterVals(Stream* stream, Filter* filter,
 			vals[i] = ValToLogVal(val);
 		}
 
-	if ( ext_rec )
-		Unref(ext_rec);
-
 	return vals;
 	}
 
@@ -1326,12 +1294,11 @@ void Manager::SendAllWritersTo(const broker::endpoint_info& ei)
 			WriterFrontend* writer = i->second->writer;
 			auto writer_val = et->GetVal(i->first.first);
 			broker_mgr->PublishLogCreate((*s)->id,
-						     writer_val,
+						     writer_val.get(),
 						     *i->second->info,
 						     writer->NumFields(),
 						     writer->Fields(),
 						     ei);
-			Unref(writer_val);
 			}
 		}
 	}
@@ -1551,10 +1518,10 @@ bool Manager::FinishedRotation(WriterFrontend* writer, const char* new_name, con
 	// Create the RotationInfo record.
 	RecordVal* info = new RecordVal(BifType::Record::Log::RotationInfo);
 	info->Assign(0, winfo->type->Ref());
-	info->Assign(1, new StringVal(new_name));
+	info->Assign(1, make_intrusive<StringVal>(new_name));
-	info->Assign(2, new StringVal(winfo->writer->Info().path));
+	info->Assign(2, make_intrusive<StringVal>(winfo->writer->Info().path));
-	info->Assign(3, new Val(open, TYPE_TIME));
+	info->Assign(3, make_intrusive<Val>(open, TYPE_TIME));
-	info->Assign(4, new Val(close, TYPE_TIME));
+	info->Assign(4, make_intrusive<Val>(close, TYPE_TIME));
 	info->Assign(5, val_mgr->GetBool(terminating));
 
 	Func* func = winfo->postprocessor;
@@ -1572,12 +1539,9 @@ bool Manager::FinishedRotation(WriterFrontend* writer, const char* new_name, con
 
 	int result = 0;
 
-	Val* v = func->Call(&vl);
+	auto v = func->Call(&vl);
 	if ( v )
-		{
 		result = v->AsBool();
-		Unref(v);
-		}
 
 	return result;
 	}

src/option.bif

@@ -7,10 +7,10 @@ module Option;
 #include "NetVar.h"
 #include "broker/Data.h"
 
-static bool call_option_handlers_and_set_value(StringVal* name, ID* i, Val* val,
+static bool call_option_handlers_and_set_value(StringVal* name, ID* i,
+                                               IntrusivePtr<Val> val,
                                                StringVal* location)
 	{
-	val->Ref();
 	if ( i->HasOptionHandlers() )
 		{
 		for ( auto handler_function : i->GetOptionHandlers() )
@@ -18,12 +18,13 @@ static bool call_option_handlers_and_set_value(StringVal* name, ID* i, Val* val,
 			bool add_loc = handler_function->FType()->AsFuncType()->ArgTypes()->Types()->length() == 3;
 			val_list vl(2 + add_loc);
 			vl.push_back(name->Ref());
-			vl.push_back(val);
+			vl.push_back(val->Ref());
 
 			if ( add_loc )
 				vl.push_back(location->Ref());
 
 			val = handler_function->Call(&vl); // consumed by next call.
+
 			if ( ! val )
 				{
 				// Someone messed up, don't change value and just return
@@ -33,8 +34,7 @@ static bool call_option_handlers_and_set_value(StringVal* name, ID* i, Val* val,
 		}
 
 	// clone to prevent changes
-	i->SetVal({AdoptRef{}, val->Clone()});
+	i->SetVal(val->Clone());
-	Unref(val); // Either ref'd once or function call result.
 	return true;
 	}
 %%}
@@ -90,7 +90,7 @@ function Option::set%(ID: string, val: any, location: string &default=""%): bool
 			return val_mgr->GetBool(0);
 			}
 
-		auto rval = call_option_handlers_and_set_value(ID, i, val_from_data.get(), location);
+		auto rval = call_option_handlers_and_set_value(ID, i, std::move(val_from_data), location);
 		return val_mgr->GetBool(rval);
 		}
 
@@ -101,10 +101,10 @@ function Option::set%(ID: string, val: any, location: string &default=""%): bool
 		     val->Type()->AsTableType()->IsUnspecifiedTable() )
 			{
 			// Just coerce an empty/unspecified table to the right type.
-			auto tv = new TableVal(i->Type()->AsTableType(),
+			auto tv = make_intrusive<TableVal>(
-			                       i->ID_Val()->AsTableVal()->Attrs());
+			        IntrusivePtr{NewRef{}, i->Type()->AsTableType()},
-			auto rval = call_option_handlers_and_set_value(ID, i, tv, location);
+			        IntrusivePtr{NewRef{}, i->ID_Val()->AsTableVal()->Attrs()});
-			Unref(tv);
+			auto rval = call_option_handlers_and_set_value(ID, i, std::move(tv), location);
 			return val_mgr->GetBool(rval);
 			}
 
@@ -113,7 +113,7 @@ function Option::set%(ID: string, val: any, location: string &default=""%): bool
 		return val_mgr->GetBool(0);
 		}
 
-	auto rval = call_option_handlers_and_set_value(ID, i, val, location);
+	auto rval = call_option_handlers_and_set_value(ID, i, {NewRef{}, val}, location);
 	return val_mgr->GetBool(rval);
 	%}
 

src/parse.y

@@ -702,7 +702,7 @@ expr:
 				if ( ! id->Type() )
 					{
 					id->Error("undeclared variable");
-					id->SetType({AdoptRef{}, error_type()});
+					id->SetType(error_type());
 					$$ = new NameExpr(std::move(id));
 					}
 
@@ -713,7 +713,7 @@ expr:
 							       id->Name());
 					if ( intval < 0 )
 						reporter->InternalError("enum value not found for %s", id->Name());
-					$$ = new ConstExpr({AdoptRef{}, t->GetVal(intval)});
+					$$ = new ConstExpr(t->GetVal(intval));
 					}
 				else
 					{
@@ -844,84 +844,84 @@ enum_body_elem:
 type:
 		TOK_BOOL	{
 				set_location(@1);
-				$$ = base_type(TYPE_BOOL);
+				$$ = base_type(TYPE_BOOL).release();
 				}
 
 	|	TOK_INT		{
 				set_location(@1);
-				$$ = base_type(TYPE_INT);
+				$$ = base_type(TYPE_INT).release();
 				}
 
 	|	TOK_COUNT	{
 				set_location(@1);
-				$$ = base_type(TYPE_COUNT);
+				$$ = base_type(TYPE_COUNT).release();
 				}
 
 	|	TOK_COUNTER	{
 				set_location(@1);
-				$$ = base_type(TYPE_COUNTER);
+				$$ = base_type(TYPE_COUNTER).release();
 				}
 
 	|	TOK_DOUBLE	{
 				set_location(@1);
-				$$ = base_type(TYPE_DOUBLE);
+				$$ = base_type(TYPE_DOUBLE).release();
 				}
 
 	|	TOK_TIME	{
 				set_location(@1);
-				$$ = base_type(TYPE_TIME);
+				$$ = base_type(TYPE_TIME).release();
 				}
 
 	|	TOK_INTERVAL	{
 				set_location(@1);
-				$$ = base_type(TYPE_INTERVAL);
+				$$ = base_type(TYPE_INTERVAL).release();
 				}
 
 	|	TOK_STRING	{
 				set_location(@1);
-				$$ = base_type(TYPE_STRING);
+				$$ = base_type(TYPE_STRING).release();
 				}
 
 	|	TOK_PATTERN	{
 				set_location(@1);
-				$$ = base_type(TYPE_PATTERN);
+				$$ = base_type(TYPE_PATTERN).release();
 				}
 
 	|	TOK_TIMER	{
 				set_location(@1);
-				$$ = base_type(TYPE_TIMER);
+				$$ = base_type(TYPE_TIMER).release();
 				}
 
 	|	TOK_PORT	{
 				set_location(@1);
-				$$ = base_type(TYPE_PORT);
+				$$ = base_type(TYPE_PORT).release();
 				}
 
 	|	TOK_ADDR	{
 				set_location(@1);
-				$$ = base_type(TYPE_ADDR);
+				$$ = base_type(TYPE_ADDR).release();
 				}
 
 	|	TOK_SUBNET	{
 				set_location(@1);
-				$$ = base_type(TYPE_SUBNET);
+				$$ = base_type(TYPE_SUBNET).release();
 				}
 
 	|	TOK_ANY		{
 				set_location(@1);
-				$$ = base_type(TYPE_ANY);
+				$$ = base_type(TYPE_ANY).release();
 				}
 
 	|	TOK_TABLE '[' type_list ']' TOK_OF type
 				{
 				set_location(@1, @6);
-				$$ = new TableType($3, $6);
+				$$ = new TableType({AdoptRef{}, $3}, {AdoptRef{}, $6});
 				}
 
 	|	TOK_SET '[' type_list ']'
 				{
 				set_location(@1, @4);
-				$$ = new SetType($3, 0);
+				$$ = new SetType({AdoptRef{}, $3}, nullptr);
 				}
 
 	|	TOK_RECORD '{'
@@ -967,7 +967,7 @@ type:
 	|	TOK_VECTOR TOK_OF type
 				{
 				set_location(@1, @3);
-				$$ = new VectorType($3);
+				$$ = new VectorType({AdoptRef{}, $3});
 				}
 
 	|	TOK_FUNCTION func_params
@@ -979,19 +979,19 @@ type:
 	|	TOK_EVENT '(' formal_args ')'
 				{
 				set_location(@1, @3);
-				$$ = new FuncType($3, 0, FUNC_FLAVOR_EVENT);
+				$$ = new FuncType({AdoptRef{}, $3}, nullptr, FUNC_FLAVOR_EVENT);
 				}
 
 	|	TOK_HOOK '(' formal_args ')'
 				{
 				set_location(@1, @3);
-				$$ = new FuncType($3, base_type(TYPE_BOOL), FUNC_FLAVOR_HOOK);
+				$$ = new FuncType({AdoptRef{}, $3}, base_type(TYPE_BOOL), FUNC_FLAVOR_HOOK);
 				}
 
 	|	TOK_FILE TOK_OF type
 				{
 				set_location(@1, @3);
-				$$ = new FileType($3);
+				$$ = new FileType({AdoptRef{}, $3});
 				}
 
 	|	TOK_FILE
@@ -1013,7 +1013,7 @@ type:
 				NullStmt here;
 				if ( $1 )
 					$1->Error("not a Zeek type", &here);
-				$$ = error_type();
+				$$ = error_type().release();
 				}
 			else
 				{
@@ -1027,11 +1027,11 @@ type:
 
 type_list:
 		type_list ',' type
-			{ $1->AppendEvenIfNotPure($3); }
+			{ $1->AppendEvenIfNotPure({AdoptRef{}, $3}); }
 	|	type
 			{
-			$$ = new TypeList($1);
+			$$ = new TypeList({NewRef{}, $1});
-			$$->Append($1);
+			$$->Append({AdoptRef{}, $1});
 			}
 	;
 
@@ -1050,7 +1050,7 @@ type_decl:
 		TOK_ID ':' type opt_attr ';'
 			{
 			set_location(@1, @4);
-			$$ = new TypeDecl($3, $1, $4, (in_record > 0));
+			$$ = new TypeDecl({AdoptRef{}, $3}, $1, $4, (in_record > 0));
 
 			if ( in_record > 0 && cur_decl_type_id )
 				zeekygen_mgr->RecordField(cur_decl_type_id, $$, ::filename);
@@ -1079,7 +1079,7 @@ formal_args_decl:
 		TOK_ID ':' type opt_attr
 			{
 			set_location(@1, @4);
-			$$ = new TypeDecl($3, $1, $4, true);
+			$$ = new TypeDecl({AdoptRef{}, $3}, $1, $4, true);
 			}
 	;
 
@@ -1119,7 +1119,7 @@ decl:
 			IntrusivePtr id{AdoptRef{}, $2};
 			IntrusivePtr<Expr> init{AdoptRef{}, $5};
 			add_global(id.get(), {AdoptRef{}, $3}, $4, init, $6, VAR_REDEF);
-			zeekygen_mgr->Redef(id.get(), ::filename, $4, init.release());
+			zeekygen_mgr->Redef(id.get(), ::filename, $4, std::move(init));
 			}
 
 	|	TOK_REDEF TOK_ENUM global_id TOK_ADD_TO '{'
@@ -1261,8 +1261,8 @@ anonymous_function:
 			// a lambda expression.
 
 			// Gather the ingredients for a BroFunc from the current scope
-			auto ingredients = std::make_unique<function_ingredients>(current_scope(), $5);
+			auto ingredients = std::make_unique<function_ingredients>(IntrusivePtr{NewRef{}, current_scope()}, IntrusivePtr{AdoptRef{}, $5});
-			id_list outer_ids = gather_outer_ids(pop_scope().get(), $5);
+			id_list outer_ids = gather_outer_ids(pop_scope().get(), ingredients->body.get());
 
 			$$ = new LambdaExpr(std::move(ingredients), std::move(outer_ids));
 			}
@@ -1278,9 +1278,9 @@ begin_func:
 
 func_params:
 		'(' formal_args ')' ':' type
-			{ $$ = new FuncType($2, $5, FUNC_FLAVOR_FUNCTION); }
+			{ $$ = new FuncType({AdoptRef{}, $2}, {AdoptRef{}, $5}, FUNC_FLAVOR_FUNCTION); }
 	|	'(' formal_args ')'
-			{ $$ = new FuncType($2, base_type(TYPE_VOID), FUNC_FLAVOR_FUNCTION); }
+			{ $$ = new FuncType({AdoptRef{}, $2}, base_type(TYPE_VOID), FUNC_FLAVOR_FUNCTION); }
 	;
 
 opt_type:
@@ -1351,31 +1351,31 @@ attr_list:
 
 attr:
 		TOK_ATTR_DEFAULT '=' expr
-		        { $$ = new Attr(ATTR_DEFAULT, $3); }
+		        { $$ = new Attr(ATTR_DEFAULT, {AdoptRef{}, $3}); }
 	|	TOK_ATTR_OPTIONAL
 			{ $$ = new Attr(ATTR_OPTIONAL); }
 	|	TOK_ATTR_REDEF
 			{ $$ = new Attr(ATTR_REDEF); }
 	|	TOK_ATTR_ADD_FUNC '=' expr
-			{ $$ = new Attr(ATTR_ADD_FUNC, $3); }
+			{ $$ = new Attr(ATTR_ADD_FUNC, {AdoptRef{}, $3}); }
 	|	TOK_ATTR_DEL_FUNC '=' expr
-			{ $$ = new Attr(ATTR_DEL_FUNC, $3); }
+			{ $$ = new Attr(ATTR_DEL_FUNC, {AdoptRef{}, $3}); }
 	|	TOK_ATTR_ON_CHANGE '=' expr
-			{ $$ = new Attr(ATTR_ON_CHANGE, $3); }
+			{ $$ = new Attr(ATTR_ON_CHANGE, {AdoptRef{}, $3}); }
 	|	TOK_ATTR_EXPIRE_FUNC '=' expr
-			{ $$ = new Attr(ATTR_EXPIRE_FUNC, $3); }
+			{ $$ = new Attr(ATTR_EXPIRE_FUNC, {AdoptRef{}, $3}); }
 	|	TOK_ATTR_EXPIRE_CREATE '=' expr
-			{ $$ = new Attr(ATTR_EXPIRE_CREATE, $3); }
+			{ $$ = new Attr(ATTR_EXPIRE_CREATE, {AdoptRef{}, $3}); }
 	|	TOK_ATTR_EXPIRE_READ '=' expr
-			{ $$ = new Attr(ATTR_EXPIRE_READ, $3); }
+			{ $$ = new Attr(ATTR_EXPIRE_READ, {AdoptRef{}, $3}); }
 	|	TOK_ATTR_EXPIRE_WRITE '=' expr
-			{ $$ = new Attr(ATTR_EXPIRE_WRITE, $3); }
+			{ $$ = new Attr(ATTR_EXPIRE_WRITE, {AdoptRef{}, $3}); }
 	|	TOK_ATTR_RAW_OUTPUT
 			{ $$ = new Attr(ATTR_RAW_OUTPUT); }
 	|	TOK_ATTR_PRIORITY '=' expr
-			{ $$ = new Attr(ATTR_PRIORITY, $3); }
+			{ $$ = new Attr(ATTR_PRIORITY, {AdoptRef{}, $3}); }
 	|	TOK_ATTR_TYPE_COLUMN '=' expr
-			{ $$ = new Attr(ATTR_TYPE_COLUMN, $3); }
+			{ $$ = new Attr(ATTR_TYPE_COLUMN, {AdoptRef{}, $3}); }
 	|	TOK_ATTR_LOG
 			{ $$ = new Attr(ATTR_LOG); }
 	|	TOK_ATTR_ERROR_HANDLER
@@ -1385,7 +1385,7 @@ attr:
 	|	TOK_ATTR_DEPRECATED '=' TOK_CONSTANT
 			{
 			if ( IsString($3->Type()->Tag()) )
-				$$ = new Attr(ATTR_DEPRECATED, new ConstExpr({AdoptRef{}, $3}));
+				$$ = new Attr(ATTR_DEPRECATED, make_intrusive<ConstExpr>(IntrusivePtr{AdoptRef{}, $3}));
 			else
 				{
 				ODesc d;

src/probabilistic/Topk.cc

@@ -27,8 +27,8 @@ void TopkVal::Typify(BroType* t)
 	{
 	assert(!hash && !type);
 	type = t->Ref();
-	auto tl = make_intrusive<TypeList>(t);
+	auto tl = make_intrusive<TypeList>(IntrusivePtr{NewRef{}, t});
-	tl->Append(t->Ref());
+	tl->Append({NewRef{}, t});
 	hash = new CompositeHash(std::move(tl));
 	}
 
@@ -184,11 +184,11 @@ void TopkVal::Merge(const TopkVal* value, bool doPrune)
 		}
 	}
 
-Val* TopkVal::DoClone(CloneState* state)
+IntrusivePtr<Val> TopkVal::DoClone(CloneState* state)
 	{
-	auto clone = new TopkVal(size);
+	auto clone = make_intrusive<TopkVal>(size);
 	clone->Merge(this);
-	return state->NewClone(this, clone);
+	return state->NewClone(this, std::move(clone));
 	}
 
 VectorVal* TopkVal::GetTopK(int k) const // returns vector
@@ -199,9 +199,9 @@ VectorVal* TopkVal::GetTopK(int k) const // returns vector
 		return 0;
 		}
 
-	TypeList* vector_index = new TypeList(type);
+	auto vector_index = make_intrusive<TypeList>(IntrusivePtr{NewRef{}, type});
-	vector_index->Append(type->Ref());
+	vector_index->Append({NewRef{}, type});
-	VectorType* v = new VectorType(vector_index);
+	VectorType* v = new VectorType(std::move(vector_index));
 	VectorVal* t = new VectorVal(v);
 
 	// this does no estimation if the results is correct!

src/probabilistic/Topk.h

@@ -127,7 +127,7 @@ public:
 	 *
 	 * @returns cloned TopkVal
 	 */
-	Val* DoClone(CloneState* state) override;
+	IntrusivePtr<Val> DoClone(CloneState* state) override;
 
 	DECLARE_OPAQUE_VALUE(TopkVal)
 

src/reporter.bif

@@ -153,7 +153,7 @@ function Reporter::file_weird%(name: string, f: fa_file, addl: string &default="
 ## Returns: Current weird sampling whitelist
 function Reporter::get_weird_sampling_whitelist%(%): string_set
 	%{
-	TableVal* set = new TableVal(string_set);
+	TableVal* set = new TableVal({NewRef{}, string_set});
 	for ( auto el : reporter->GetWeirdSamplingWhitelist() )
 		{
 		auto idx = make_intrusive<StringVal>(el);

src/scan.l

@@ -526,7 +526,7 @@ F	RET_CONST(val_mgr->GetFalse())
 
 "0x"{HEX}+	RET_CONST(val_mgr->GetCount(static_cast<bro_uint_t>(strtoull(yytext, 0, 16))))
 
-{H}("."{H})+		RET_CONST(dns_mgr->LookupHost(yytext))
+{H}("."{H})+		RET_CONST(dns_mgr->LookupHost(yytext).release())
 
 \"([^\\\n\"]|{ESCSEQ})*\"	{
 	const char* text = yytext;

src/stats.bif

@@ -152,11 +152,11 @@ function get_proc_stats%(%): ProcStats
 	r->Assign(n++, val_mgr->GetCount(0));
 #endif
 
-	r->Assign(n++, new Val(bro_start_time, TYPE_TIME));
+	r->Assign(n++, make_intrusive<Val>(bro_start_time, TYPE_TIME));
 
-	r->Assign(n++, new IntervalVal(elapsed_time, Seconds));
+	r->Assign(n++, make_intrusive<IntervalVal>(elapsed_time, Seconds));
-	r->Assign(n++, new IntervalVal(user_time, Seconds));
+	r->Assign(n++, make_intrusive<IntervalVal>(user_time, Seconds));
-	r->Assign(n++, new IntervalVal(system_time, Seconds));
+	r->Assign(n++, make_intrusive<IntervalVal>(system_time, Seconds));
 
 	uint64_t total_mem;
 	get_memory_usage(&total_mem, NULL);
@@ -470,7 +470,7 @@ function get_reporter_stats%(%): ReporterStats
 	RecordVal* r = new RecordVal(ReporterStats);
 	int n = 0;
 
-	TableVal* weirds_by_type = new TableVal(internal_type("table_string_of_count")->AsTableType());
+	TableVal* weirds_by_type = new TableVal({NewRef{}, internal_type("table_string_of_count")->AsTableType()});
 
 	for ( auto& kv : reporter->GetWeirdsByType() )
 		{