Understanding DIP 1000 semantics -- Where's the bug?

[Olivier FAURE]

On Sunday, 22 September 2019 at 17:54:48 UTC, ag0aep6g wrote:
> There is a bug for sure, though. If `ref` implies `scope`, 
> there should be a new error ("cannot take address of scope 
> parameter"). If `scope` is not implied, it's ok that the 
> function compiles, but then it shouldn't be possible to call it 
> on a local.

It's allowed as long as you don't escape... wait, no, it's always 
allowed. Whoops. The following code compiles with -dip1000.

     @safe:

     int* foo(ref int x)
     {
         int* a = &x;
         return a;
     }

     void main() {
         int* p;
         {
             int x;
             p = foo(x);
         }
         *p = 1;			// Memory corruption
     }

That's a bug.