the following codes: uint8 search_no(uint8[]@ cmd, uint16 len, uint8[] @rcv) //mbno is nx5 array, static { if (@rcv == null) print("null pointer"); return(255); } void main() { uint8[] cmd = { 0x02, 0x95, 0x45, 0x42, 0x32 }; uint8[] rcv; uint16 len = 8; search_no(cmd, cmd.length(), rcv); //This is OK! @rcv won't be null search_no(cmd, GET_LEN2(cmd), rcv); //This is OK! uint16 len = GET_LEN(cmd); search_no(cmd, len, rcv); //This is OK! //but search_no(cmd, GET_LEN(cmd), rcv); //@rcv is null } uint16 GET_LEN(uint8[]@ cmd) { return cmd[0]+3; } uint16 GET_LEN2(uint8[] cmd) { return cmd[0]+3; } it seems that, the reference release operation or the calling stack has bug.

Thanks for the bug report. I'll look into this a.s.a.p. It looks like it could be a problem with a temporary variable being reused too soon while evaluating the arguments.

The bug fix is now available in the SVN (rev 279)