ref is unsafe

[jerro]

> Here the compiler already knows that foo returns its input 
> reference. So it checks whether foo is being passed a local - 
> no; but it also has to check if foo is passed any ref 
> parameters of quux, which it is. The compiler now has to mark 
> quux as a function that returns its input reference.
>
> Works?

If functions's source isn't available, the compiler can't know 
what the function does.

This could only work if this property of a function (whether it 
returns a reference to its ref parameter) would be part of its 
type. The compiler could still infer it for function literals and 
templates, similar to how pure works now.