NPAPI: need to RetainObject() a handler twice, otherwise SIGBUS

In my NPAPI plugin, some of the objects have an "onEvent" property that is readable and writeable, and which is called on certain events.

What I have in my Javascript code will look like this:

myObject.onEvent = function( event ) {
    console.log("Event: " + event );
}

// if I put this next line, the next call to the 'onEvent' handler will SIGBUS
// when there's no RetainObject() in the getter.
console.log("Event handler : " + myObject.onEvent);

And on the C++ side of the plugin, I have that kind of code:

bool MyPluginObject::getOnEvent(NPIdentifier id, NPVariant *result)
{
    if( _onEvent )
    {
        OBJECT_TO_NPVARIANT( _onEvent, *result);
        NPN_RetainObject( _onEvent ); // needed ???? why??
    }
    else
        VOID_TO_NPVARIANT(*result);

    return true;
}

bool MyPluginObject::setOnEvent( NPIdentifier id, const NPVariant *value )
{
    if ( value && NPVARIANT_IS_OBJECT( *value ) )
    {
        if( _onEvent != NULL )
        {
            // release any previous function retained
            NPN_ReleaseObject( _onEvent );
        }

        _onEvent = NPVARIANT_TO_OBJECT( *value );
        NPN_RetainObject( _onEvent ); // normal retain

        return true;
    }
    return false;
}

void MyPluginObject::onEvent(void)
{
    NPVariant event = [...];

    if ( _onEvent!= NULL )
    {
        NPVariant retVal;
        bool success = NPN_InvokeDefault( _Npp, _onEvent, &event, 1, &retVal );
        if( success )
        {
            NPN_ReleaseVariantValue(&retVal);
        }
    }
}

What's strange is that I've been struggling with a SIGBUS problem for a while, and once I added the NPN_RetainObject() in the getter, as you can see above, everything went fine.

I didn't find in the statement that it is needed in the Mozilla doc, neither in Taxilian's awesome doc about NPAPI.

I don't get it: when the browser requests a property that I've retained, why do I have to retain it a second time?

Should I maybe retain the function when calling InvokeDefault() on it instead? But then, why?? I already stated that I wanted to retain it.

Does getProperty() or InvokeDefault() actually does an NPN_ReleaseObject() without telling me?

You always have to retain object out-parameters with NPAPI, this is not specific to property getters.

In your specific case the object may stay alive anyway, but not in the general case:
Consider returning an object to the caller that you don't plan on keeping alive from your plugin. You have to transfer ownership to the caller and you can't return objects with a retain count of 0.