Bug

structures are not being copied and only their pointer being marshalled (same as in case of @ByRef). This causes number of bugs:

• expected the copy but struct points to source struct/value. as result changes of "copy" causes changes in the source
• struct might be located in R/O segment and any try to modify it cause GPF gitter.

The fix

make a copy of structure on heap as its required by @byval

Side effect of the fix

The fix breaks existing code that is built around this bug. An example is CGRect constructor that stops working:

public CGRect(double x, double y, double width, double height) {
    getOrigin().setX(x).setY(y);
    getSize().setWidth(width).setHeight(height);
}

After the fix getOrigin()/getSize() return a copy (byValue) structures. And changes to them doesn't affect CGRect struct itself anymore.