When two or more arguments in one argument list are calls whose return type is a Managed
class, one of the returned objects is destroyed BEFORE the callee returns — even though the
callee stores it in a ref field and therefore owns it.

The ref field is left pointing at a block that is already back in the free list, so the block
is live and free at the same time. The allocator hands it out again while it is still
referenced, and the heap is corrupted from there on.

The trigger is a CALL: inlining new in the same position is handled correctly, and a single
Managed-returning call in an argument list is fine too — it takes two.

Measured with a destructor that counts objects dying between the start and the end of the call
under test (local = an ARC_Leaf assigned on a previous line):

new ARC_Pair(local, local)                             -> 0   ok
new ARC_Pair(new ARC_Leaf(), new ARC_Leaf())           -> 0   ok, inline new unaffected
new ARC_Pair(local, ARC_Leaf.Make())                   -> 0   ok, one call
new ARC_Pair(ARC_Leaf.Make(), local)                   -> 0   ok, one call
ARC_Box.Of(ARC_Leaf.Make())      // single parameter   -> 0   ok
new ARC_Pair(ARC_Leaf.Make(), ARC_Leaf.Make())         -> 1   BUG
Skin(ARC_Leaf.Make(), ARC_Leaf.Make())  -> 1   BUG
array<ref ARC_Leaf> x = { ARC_Leaf.Make(), ARC_Leaf.Make() };   -> 1   BUG

1. Build a mod with one mission-module script (no dependencies beyond DZ_Data, DZ_Scripts):

class ARC_Leaf : Managed
{

static bool in_call = false;   // true only while the call under test is running
static int  died    = 0;       // destructors that fired during it

void ~ARC_Leaf() { if (in_call) { died++; } }

static ARC_Leaf Make() { return new ARC_Leaf(); }

}

// The callee OWNS both arguments — neither may be released.
class ARC_Pair : Managed
{

ref ARC_Leaf a;
ref ARC_Leaf b;

void ARC_Pair(ARC_Leaf _a, ARC_Leaf _b) { a = _a; b = _b; }

}

modded class MissionServer
{
    override void OnInit()
    {
        super.OnInit();

        ARC_Leaf.in_call = true;
        ARC_Pair p = new ARC_Pair(ARC_Leaf.Make(), ARC_Leaf.Make());   // <-- the bug
        ARC_Leaf.in_call = false;

        Print("[ARC] released mid-call: " + ARC_Leaf.died.ToString() + "   (expected 0)");

        array<ref ARC_Pair> kept = new array<ref ARC_Pair>();
        for (int i = 0; i < 20000; i++)
        {
            kept.Insert(new ARC_Pair(ARC_Leaf.Make(), ARC_Leaf.Make()));
        }

        Print("[ARC] survived " + kept.Count().ToString() + " iterations");
    }
};

2. Run the game

3. Check profiles\ArcRepro\script_*.log and the process exit code.

EXPECTED

[ARC] released mid-call: 0   (expected 0)
[ARC] survived 20000 iterations
server stays up

ACTUAL — DayZDiag_x64 1.29.163451, Windows

[ARC] released mid-call: 1   (expected 0)
[ARC] survived 20000 iterations
process exits with 3221226356 = 0xC0000374 STATUS_HEAP_CORRUPTION

Class:      'CustomMission'
Function: 'OnInit'
Stack trace:
ARC_REPRO/scripts/5_Mission/arc_repro.c:46 Function OnInit
Fault address:  32D12165 00:32D12165 Unknown module

Line 46 is the last Print; the corruption happened at line 32.

[ARC] released mid-call: 0   (expected 0)
[ARC] survived 20000 iterations
server stays up