Today: hole in @safe

int[] escape() @safe
{
    int[3] buf;
    int[] slice = buf[];
    return slice; // Bug in safe: this is allowed
}

With -preview=dip1000: scope checks

int[] escape() @safe
{
    int[3] buf;
    int[] slice = buf[]; // Allowed, `scope` is inferred
    return slice; // Error: scope variable `slice` may not be returned
}

Robert's Simple @safe D (proposal)

int[] escape() @safe
{
    int[3] buf;
    int[] slice = buf[]; // Error: can't take address
    return slice;
}

Editions

• Default: simple safe / dip1000?
• Explicit scope opt in?

DIP1000 issues

Code duplication got reduced

• I refactored dmd/escape.d this year
• Number of if statements 310 ⇒ 240
• In better shape to fix / improve
• Still more complex than necessary

Ref locals are initialized once

auto f(int* p)
{
    ref p2 = p;
    return new int;
}

Bugzilla 23300 is fixed

std.array : array wrongly propagates scopeness of source

int[] fun() @safe
{ 
    import std : array, map;
    scope r = [1,2,3].map!"a+3";
    return r.array;
}

Want inference by default

Or at least opt-in?

auto:

int[] identity(int[] x) => x;
int* addrOf(ref int x) => &x;

// Error: function `onlineapp.identity` 
// storage class `auto` has no effect if return type is not inferred

Want partial / transitive scope

struct CtodContext
{
    string source;
    HashMap!(string, Declaration) symbolTable;
    // ...
}

• Better inference can be done transparently
• But how much scope[...] syntax do we want?

Rikki's new syntax proposal

int** intRefOutPtr(@escape(return&) ref int* input) => &input;

Share your opinion