Side effects on record fields when triggering events

Okay Chema and I tracked it down to the reference counting that is going
on in the core

Exactly. Aggregates in Bro are passed as shallow copiess, not deep copies.
There are times when it would be handy to have an operator to specify
deep-copy semantics. I share your concern at the counter-intuitive behavior
that shallow-copy semantics can provide, but blanket deep-copy can be very
expensive, and needlessly so in many cases.


Yeah I agree. It's also not too big a big deal if you have the way it
works in mind while writing policy code. I think I'll grow your patch
queue with some documentation. :slight_smile: