Understanding DIP 1000 semantics -- Where's the bug?

[Sebastiaan Koppe]

On Monday, 23 September 2019 at 18:46:40 UTC, Meta wrote:
> On Monday, 23 September 2019 at 18:39:03 UTC, Sebastiaan Koppe
>> Well, dip1000 doesn't do data-flow analyses. Which means the 
>> compiler doesn't see that `x` escapes through `a`.
>
> AFAICT, according to dip1000 this code should not allow the 
> result of `foo(x)` to be assigned to p, as it has a longer 
> lifetime. Likewise, it should not allow foo to return &x 
> without the parameter being annotated with `return`.

It does all those things when you replace the body of foo with 
just `return &x;`.