• via Digitalmars-d-bugs (38/38) Mar 02 2015 https://issues.dlang.org/show_bug.cgi?id=14238

via Digitalmars-d-bugs <digitalmars-d-bugs puremagic.com> writes:

https://issues.dlang.org/show_bug.cgi?id=14238

          Issue ID: 14238
           Summary: DIP25: escape checks can be circumvented with delegate
           Product: D
           Version: D2
          Hardware: x86_64
                OS: Linux
            Status: NEW
          Keywords: accepts-invalid
          Severity: normal
          Priority: P1
         Component: DMD
          Assignee: nobody puremagic.com
          Reporter: schuetzm gmx.net

The following code compiles with the -dip25 switch:

    alias Fn = ref int delegate();

    ref int foo(scope Fn fn) {
        return fn();
    }

    ref int bar() {
        int x;
        ref int baz() {
                return x;
        }
        return foo(&baz);
    }

    void main(string[] args) {
        import std.stdio;
        int x;
        writefln("&x = %s", &x);
        int* p = &bar();
        writefln("p  = %s", p);
    }

Output:
&x = 7FFFF64F0728
p  = 7FFFF64F0708

As can be seen, `p` points to a location further down the stack.

--