Bug 22802 – [dip1000] First ref parameter seen as `return` destination even with `this`

In escape.d, the `bool isFirstRef()` function incorrectly accepts the first ref parameter as a `return scope` destination, even when there is a `this` parameter that should be the only return destination. This allows you to escape a stack pointer: ``` @safe: struct S { int* ptr; void assign(ref int* refPtr, return scope int* z) scope { this.ptr = z; // allowed, first ref refPtr = z; // should not be allowed } } int* escape() { int local; S escapeThis; int* escapeRef; escapeThis.assign(escapeRef, &local); return escapeRef; // Accepts invalid return escapeThis.ptr; // Error, correct } ```

@dkorpel created dlang/dmd pull request #13748 "Fix issue 22802 - First ref parameter seen as `return` destination ev…" fixing this issue: - Fix issue 22802 - First ref parameter seen as `return` destination even with `this` https://github.com/dlang/dmd/pull/13748

dlang/dmd pull request #13748 "Fix issue 22802 - First ref parameter seen as `return` destination ev…" was merged into master: - 8553e1e02da58e5f6d3c9818693b3af9d18e2b01 by Dennis Korpel: Fix issue 22802 - First ref parameter seen as `return` destination even with `this` https://github.com/dlang/dmd/pull/13748