Understanding DIP 1000 semantics -- Where's the bug?

[Sebastiaan Koppe]

On Monday, 23 September 2019 at 08:46:18 UTC, Olivier FAURE wrote:
> Whoops. The following code compiles with -dip1000.
>
>     @safe:
>
>     int* foo(ref int x)
>     {
>         int* a = &x;
>         return a;
>     }
>
>     void main() {
>         int* p;
>         {
>             int x;
>             p = foo(x);
>         }
>         *p = 1;			// Memory corruption
>     }
>
> That's a bug.

Well, dip1000 doesn't do data-flow analyses. Which means the 
compiler doesn't see that `x` escapes through `a`.