When a global handle to an object is being returned from a function that returns a primitive type the script crashes. The byte code appears to dereference the handle twice. If the handle is explicitly cast to the return type there is no crash.

The byte code that crashes looks like this:

PGA (address of the handle)
PopPtr
RDSPtr
CALLSYS (implicit value cast function)

The byte code that does not crash looks like this:

PshGPtr (address of the handle)
CALLSYS (implicit value cast function)

This example demonstrates the crash.

Application class definition:

class RefClass
{
public:
    RefClass(double x)                 { m_Value = x; m_nRefs = 1; }
    static RefClass* Factory(double x) { return new RefClass(x); }
    double toDouble() const            { return m_Value; }
    void AddRef() const                { m_nRefs++; }
    void Release() const               { if (--m_nRefs == 0) delete this; }

private:
    double m_Value;
    mutable int m_nRefs;
};

Registration:

r = engine->RegisterObjectType("RefClass", 0, asOBJ_REF);
r = engine->RegisterObjectBehaviour("RefClass", asBEHAVE_ADDREF,
    "void f()", asMETHOD(RefClass, AddRef), asCALL_THISCALL);
r = engine->RegisterObjectBehaviour("RefClass", asBEHAVE_RELEASE,
    "void f()", asMETHOD(RefClass, Release), asCALL_THISCALL);
r = engine->RegisterObjectBehaviour("RefClass", asBEHAVE_FACTORY,
    "RefClass@ f(double x)", asFUNCTION(RefClass::Factory), asCALL_CDECL);
r = engine->RegisterObjectBehaviour("RefClass", asBEHAVE_IMPLICIT_VALUE_CAST,
    "double f() const", asMETHOD(RefClass, toDouble), asCALL_THISCALL);

The script that crashes:

RefClass@ h;
double test()
{
    RefClass x(3.5);
    @h = @x;
    return h;
}

The script that doesn't crash:

RefClass@ h;
double test()
{
    RefClass x(3.5);
    @h = @x;
    return double(h);
}

Another script that doesn't crash:

RefClass@ h;
double test()
{
    RefClass x(3.5);
    @h = @x;
    return x;
}