7239

3 files changed, 170 insertions, 63 deletions

diff --git a/400.mu b/400.mu
index d3442cdf..4f95c226 100644
--- a/400.mu
+++ b/400.mu
@@ -27,10 +27,10 @@ sig syscall_clock_gettime  # clock/ebx: int, out/ecx: (addr timespec)
 # Many functions here may not be usable yet because of missing features
 # (global variable support, etc.)
 sig check-ints-equal a: int, b: int, msg: (addr array byte)
-sig kernel-string-equal? s: (addr kernel-string), benchmark: (addr array byte) -> result/eax: boolean
+sig kernel-string-equal? s: (addr kernel-string), benchmark: (addr array byte) -> _/eax: boolean
 sig new-segment len: int, ad: (addr allocation-descriptor)
-sig string-equal? s: (addr array byte), benchmark: (addr array byte) -> result/eax: boolean
-sig string-starts-with? s: (addr array byte), benchmark: (addr array byte) -> result/eax: boolean
+sig string-equal? s: (addr array byte), benchmark: (addr array byte) -> _/eax: boolean
+sig string-starts-with? s: (addr array byte), benchmark: (addr array byte) -> _/eax: boolean
 sig check-strings-equal s: (addr array byte), expected: (addr array byte), msg: (addr array byte)
 sig clear-stream f: (addr stream _)
 sig rewind-stream f: (addr stream _)
@@ -38,20 +38,20 @@ sig initialize-trace-stream n: int
 sig trace line: (addr array byte)
 sig check-trace-contains line: (addr string), msg: (addr string)
 sig check-trace-scans-to line: (addr string), msg: (addr string)
-sig trace-scan line: (addr array byte) -> result/eax: boolean
-sig next-line-matches? t: (addr stream byte), line: (addr array byte) -> result/eax: boolean
+sig trace-scan line: (addr array byte) -> _/eax: boolean
+sig next-line-matches? t: (addr stream byte), line: (addr array byte) -> _/eax: boolean
 sig skip-next-line t: (addr stream byte)
 sig clear-trace-stream
 sig write f: (addr stream byte), s: (addr array byte)  # writing to file descriptor not supported; use buffered-file
-sig stream-data-equal? f: (addr stream byte), s: (addr array byte) -> result/eax: boolean
+sig stream-data-equal? f: (addr stream byte), s: (addr array byte) -> _/eax: boolean
 sig check-stream-equal f: (addr stream byte), s: (addr array byte), msg: (addr array byte)
-sig next-stream-line-equal? f: (addr stream byte), s: (addr array byte) -> result/eax: boolean
+sig next-stream-line-equal? f: (addr stream byte), s: (addr array byte) -> _/eax: boolean
 sig check-next-stream-line-equal f: (addr stream byte), s: (addr array byte), msg: (addr array byte)
 sig tailor-exit-descriptor ed: (addr exit-descriptor), nbytes: int
 sig stop ed: (addr exit-descriptor), value: int
-#sig read f: fd or (addr stream byte), s: (addr stream byte) -> num-bytes-read/eax: int
-sig read-byte-buffered f: (addr buffered-file) -> byte-or-Eof/eax: byte
-sig read-byte s: (addr stream byte) -> result/eax: byte
+#sig read f: fd or (addr stream byte), s: (addr stream byte) -> _/eax: int
+sig read-byte-buffered f: (addr buffered-file) -> _/eax: byte
+sig read-byte s: (addr stream byte) -> _/eax: byte
 #sig write-stream f: fd or (addr stream byte), s: (addr stream byte)
 #sig error ed: (addr exit-descriptor), out: fd or (addr stream byte), msg: (addr array byte)
 sig write-byte-buffered f: (addr buffered-file), n: int
@@ -65,22 +65,22 @@ sig write-int32-hex f: (addr stream byte), n: int
 sig write-int32-hex-bits f: (addr stream byte), n: int, bits: int
 sig write-int32-hex-buffered f: (addr buffered-file), n: int
 sig write-int32-hex-bits-buffered f: (addr buffered-file), n: int, bits: int
-sig is-hex-int? in: (addr slice) -> result/eax: boolean
-sig parse-hex-int in: (addr array byte) -> result/eax: int
-sig parse-hex-int-from-slice in: (addr slice) -> result/eax: int
-#sig parse-hex-int-helper start: (addr byte), end: (addr byte) -> result/eax: int
-sig is-hex-digit? c: byte -> result/eax: boolean
+sig is-hex-int? in: (addr slice) -> _/eax: boolean
+sig parse-hex-int in: (addr array byte) -> _/eax: int
+sig parse-hex-int-from-slice in: (addr slice) -> _/eax: int
+#sig parse-hex-int-helper start: (addr byte), end: (addr byte) -> _/eax: int
+sig is-hex-digit? c: byte -> _/eax: boolean
 #sig from-hex-char in/eax: byte -> out/eax: nibble
-sig parse-decimal-int in: (addr array byte) -> result/eax: int
-sig parse-decimal-int-from-slice in: (addr slice) -> result/eax: int
-sig parse-decimal-int-from-stream in: (addr stream byte) -> result/eax: int
-#sig parse-decimal-int-helper start: (addr byte), end: (addr byte) -> result/eax: int
-sig decimal-size n: int -> result/eax: int
+sig parse-decimal-int in: (addr array byte) -> _/eax: int
+sig parse-decimal-int-from-slice in: (addr slice) -> _/eax: int
+sig parse-decimal-int-from-stream in: (addr stream byte) -> _/eax: int
+#sig parse-decimal-int-helper start: (addr byte), end: (addr byte) -> _/eax: int
+sig decimal-size n: int -> _/eax: int
 sig error-byte ed: (addr exit-descriptor), out: (addr buffered-file), msg: (addr array byte), n: byte
 #sig allocate ad: (addr allocation-descriptor), n: int, out: (addr handle _)
 #sig allocate-raw ad: (addr allocation-descriptor), n: int, out: (addr handle _)
-sig lookup h: (handle _T) -> result/eax: (addr _T)
-sig handle-equal? a: (handle _T), b: (handle _T) -> result/eax: boolean
+sig lookup h: (handle _T) -> _/eax: (addr _T)
+sig handle-equal? a: (handle _T), b: (handle _T) -> _/eax: boolean
 sig copy-handle src: (handle _T), dest: (addr handle _T)
 #sig allocate-region ad: (addr allocation-descriptor), n: int, out: (addr handle allocation-descriptor)
 #sig allocate-array ad: (addr allocation-descriptor), n: int, out: (addr handle _)
@@ -89,9 +89,9 @@ sig copy-array ad: (addr allocation-descriptor), src: (addr array _T), out: (add
 #sig new-stream ad: (addr allocation-descriptor), length: int, elemsize: int, out: (addr handle stream _)
 sig read-line-buffered f: (addr buffered-file), s: (addr stream byte)
 sig read-line f: (addr stream byte), s: (addr stream byte)
-sig slice-empty? s: (addr slice) -> result/eax: boolean
-sig slice-equal? s: (addr slice), p: (addr array byte) -> result/eax: boolean
-sig slice-starts-with? s: (addr slice), head: (addr array byte) -> result/eax: boolean
+sig slice-empty? s: (addr slice) -> _/eax: boolean
+sig slice-equal? s: (addr slice), p: (addr array byte) -> _/eax: boolean
+sig slice-starts-with? s: (addr slice), head: (addr array byte) -> _/eax: boolean
 sig write-slice out: (addr stream byte), s: (addr slice)
 sig write-slice-buffered out: (addr buffered-file), s: (addr slice)
 sig slice-to-string ad: (addr allocation-descriptor), in: (addr slice), out: (addr handle array byte)
@@ -101,53 +101,53 @@ sig skip-chars-matching in: (addr stream byte), delimiter: byte
 sig skip-chars-matching-whitespace in: (addr stream byte)
 sig skip-chars-not-matching in: (addr stream byte), delimiter: byte
 sig skip-chars-not-matching-whitespace in: (addr stream byte)
-#sig skip-chars-matching-in-slice curr: (addr byte), end: (addr byte), delimiter: byte -> curr/eax: (addr byte)
-#sig skip-chars-matching-whitespace-in-slice curr: (addr byte), end: (addr byte) -> curr/eax: (addr byte)
-#sig skip-chars-not-matching-in-slice curr: (addr byte), end: (addr byte), delimiter: byte -> curr/eax: (addr byte)
-#sig skip-chars-not-matching-whitespace-in-slice curr: (addr byte), end: (addr byte) -> curr/eax: (addr byte)
+#sig skip-chars-matching-in-slice curr: (addr byte), end: (addr byte), delimiter: byte -> _/eax: (addr byte)
+#sig skip-chars-matching-whitespace-in-slice curr: (addr byte), end: (addr byte) -> _/eax: (addr byte)
+#sig skip-chars-not-matching-in-slice curr: (addr byte), end: (addr byte), delimiter: byte -> _/eax: (addr byte)
+#sig skip-chars-not-matching-whitespace-in-slice curr: (addr byte), end: (addr byte) -> _/eax: (addr byte)
 sig skip-string line: (addr stream byte)
-#sig skip-string-in-slice curr: (addr byte), end: (addr byte) -> curr/eax: (addr byte)
+#sig skip-string-in-slice curr: (addr byte), end: (addr byte) -> _/eax: (addr byte)
 sig skip-until-close-paren line: (addr stream byte)
-#sig skip-until-close-paren-in-slice curr: (addr byte), end: (addr byte) -> curr/eax: (addr byte)
+#sig skip-until-close-paren-in-slice curr: (addr byte), end: (addr byte) -> _/eax: (addr byte)
 sig write-stream-data f: (addr buffered-file), s: (addr stream byte)
 sig write-int32-decimal out: (addr stream byte), n: int
-sig is-decimal-digit? c: grapheme -> result/eax: boolean
-sig to-decimal-digit in: grapheme -> out/eax: int
+sig is-decimal-digit? c: grapheme -> _/eax: boolean
+sig to-decimal-digit in: grapheme -> _/eax: int
 sig next-word line: (addr stream byte), out: (addr slice)
-sig has-metadata? word: (addr slice), s: (addr string) -> result/eax: boolean
-sig is-valid-name? in: (addr slice) -> result/eax: boolean
-sig is-label? word: (addr slice) -> result/eax: boolean
+sig has-metadata? word: (addr slice), s: (addr string) -> _/eax: boolean
+sig is-valid-name? in: (addr slice) -> _/eax: boolean
+sig is-label? word: (addr slice) -> _/eax: boolean
 sig emit-hex out: (addr buffered-file), n: int, width: int
 sig emit out: (addr buffered-file), word: (addr slice), width: int
-#sig get table: (addr stream {(handle array byte), T}), key: (addr array byte), row-size: int, abort-message-prefix: (addr array byte) -> result/eax: (addr T)
-#sig get-slice table: (addr stream {(handle array byte), T}), key: (addr slice), row-size: int, abort-message-prefix: (addr array byte) -> result/eax: (addr T)
-#sig get-or-insert table: (addr stream {(handle array byte), T}), key: (addr array byte), row-size: int, ad: (addr allocation-descriptor) -> result/eax: (addr T)
-#sig get-or-insert-handle table: (addr stream {(handle array byte), T}), key: (handle array byte), row-size: int -> result/eax: (addr T)
-#sig get-or-insert-slice table: (addr stream {(handle array byte), T}), key: (addr slice), row-size: int, ad: (addr allocation-descriptor) -> result/eax: (addr T)
+#sig get table: (addr stream {(handle array byte), T}), key: (addr array byte), row-size: int, abort-message-prefix: (addr array byte) -> _/eax: (addr T)
+#sig get-slice table: (addr stream {(handle array byte), T}), key: (addr slice), row-size: int, abort-message-prefix: (addr array byte) -> _/eax: (addr T)
+#sig get-or-insert table: (addr stream {(handle array byte), T}), key: (addr array byte), row-size: int, ad: (addr allocation-descriptor) -> _/eax: (addr T)
+#sig get-or-insert-handle table: (addr stream {(handle array byte), T}), key: (handle array byte), row-size: int -> _/eax: (addr T)
+#sig get-or-insert-slice table: (addr stream {(handle array byte), T}), key: (addr slice), row-size: int, ad: (addr allocation-descriptor) -> _/eax: (addr T)
 #sig get-or-stop table: (addr stream {(handle array byte), T}), key: (addr array byte), row-size: int
 #sig get-slice-or-stop table: (addr stream {(handle array byte), _}), key: (addr slice), row-size: int
-#sig maybe-get table: (addr stream {(handle array byte), T}), key: (addr array byte), row-size: int -> result/eax: (addr T)
-#sig maybe-get-slice table: (addr stream {(handle array byte), T}), key: (addr slice), row-size: int -> result/eax: (addr T)
+#sig maybe-get table: (addr stream {(handle array byte), T}), key: (addr array byte), row-size: int -> _/eax: (addr T)
+#sig maybe-get-slice table: (addr stream {(handle array byte), T}), key: (addr slice), row-size: int -> _/eax: (addr T)
 sig slurp f: (addr buffered-file), s: (addr stream byte)
-sig compute-width word: (addr array byte) -> result/eax: int
-sig compute-width-of-slice s: (addr slice) -> result/eax: int
+sig compute-width word: (addr array byte) -> _/eax: int
+sig compute-width-of-slice s: (addr slice) -> _/eax: int
 sig emit-hex-array out: (addr buffered-file), arr: (addr array byte)
 sig next-word-or-string line: (addr stream byte), out: (addr slice)
 sig write-int out: (addr stream byte), n: int
 #sig clear-stack s: (addr stack)
 #sig push s: (addr stack), n: int
-#sig pop s: (addr stack) -> n/eax: int
-#sig top s: (addr stack) -> n/eax: int
-sig array-equal? a: (addr array int), b: (addr array int) -> result/eax: boolean
+#sig pop s: (addr stack) -> _/eax: int
+#sig top s: (addr stack) -> _/eax: int
+sig array-equal? a: (addr array int), b: (addr array int) -> _/eax: boolean
 sig parse-array-of-ints s: (addr array byte), out: (addr handle array int)
 sig parse-array-of-decimal-ints s: (addr array byte), out: (addr handle array int)
 sig check-array-equal a: (addr array int), expected: (addr string), msg: (addr string)
 #sig push-n-zero-bytes n: int
 sig kernel-string-to-string ad: (addr allocation-descriptor), in: (addr kernel-string), out: (addr handle array byte)
-sig kernel-string-length in: (addr kernel-string) -> result/eax: int
+sig kernel-string-length in: (addr kernel-string) -> _/eax: int
 sig enable-screen-grid-mode
 sig enable-screen-type-mode
-sig real-screen-size -> nrows/eax: int, ncols/ecx: int
+sig real-screen-size -> _/eax: int, _/ecx: int
 sig clear-real-screen
 sig move-cursor-on-real-screen row: int, column: int
 sig print-string-to-real-screen s: (addr array byte)
@@ -168,19 +168,19 @@ sig hide-cursor-on-real-screen
 sig show-cursor-on-real-screen
 sig enable-keyboard-immediate-mode
 sig enable-keyboard-type-mode
-sig read-key-from-real-keyboard -> result/eax: grapheme
+sig read-key-from-real-keyboard -> _/eax: grapheme
 sig read-line-from-real-keyboard out: (addr stream byte)
 sig open filename: (addr array byte), write?: boolean, out: (addr handle buffered-file)
 sig populate-buffered-file-containing contents: (addr array byte), out: (addr handle buffered-file)
 sig new-buffered-file out: (addr handle buffered-file)
-#sig size in: (addr array _) -> result/eax: int
+#sig size in: (addr array _) -> _/eax: int
 
-sig stream-empty? s: (addr stream _) -> result/eax: boolean
-sig stream-full? s: (addr stream _) -> result/eax: boolean
+sig stream-empty? s: (addr stream _) -> _/eax: boolean
+sig stream-full? s: (addr stream _) -> _/eax: boolean
 sig stream-to-array in: (addr stream _), out: (addr handle array _)
 sig unquote-stream-to-array in: (addr stream _), out: (addr handle array _)
-sig stream-first s: (addr stream byte) -> result/eax: byte
-sig stream-final s: (addr stream byte) -> result/eax: byte
+sig stream-first s: (addr stream byte) -> _/eax: byte
+sig stream-final s: (addr stream byte) -> _/eax: byte
 
 #sig copy-bytes src: (addr byte), dest: (addr byte), n: int
 sig copy-array-object src: (addr array _), dest-ah: (addr handle array _)
diff --git a/apps/mu b/apps/mu
index 89e061ff..b188bdd6 100755
--- a/apps/mu
+++ b/apps/mu
Binary files differdiff --git a/apps/mu.subx b/apps/mu.subx
index 4301a5fc..234f36da 100644
--- a/apps/mu.subx
+++ b/apps/mu.subx
@@ -1082,6 +1082,27 @@ test-function-main-with-addr-inout:
     5d/pop-to-ebp
     c3/return
 
+# 'lookup' is an exception, but only in signatures
+test-signature-lookup-with-addr-inout:
+    # . prologue
+    55/push-ebp
+    89/<- %ebp 4/r32/esp
+    # setup
+    (clear-stream _test-input-stream)
+    (clear-stream $_test-input-buffered-file->buffer)
+    (clear-stream _test-output-stream)
+    (clear-stream $_test-output-buffered-file->buffer)
+    #
+    (write _test-input-stream "sig lookup h: (handle _T) -> _/eax: (addr _T)\n")
+    # convert
+    (convert-mu _test-input-buffered-file _test-output-buffered-file Stderr 0)
+    (flush _test-output-buffered-file)
+    # no errors
+    # . epilogue
+    89/<- %esp 5/r32/ebp
+    5d/pop-to-ebp
+    c3/return
+
 test-convert-function-with-arg-and-body:
     # . prologue
     55/push-ebp
@@ -14391,6 +14412,9 @@ populate-mu-function-header:  # first-line: (addr stream byte), out: (addr funct
     (slice-starts-with? %ecx "loop")  # => eax
     3d/compare-eax-and 0/imm32/false
     0f 85/jump-if-!= $populate-mu-function-header:error-loop/disp32
+    (slice-equal? %ecx "lookup")  # => eax
+    3d/compare-eax-and 0/imm32/false
+    0f 85/jump-if-!= $populate-mu-function-header:error-lookup/disp32
     # save function name
     (slice-to-string Heap %ecx %edi)  # Function-name
     # save function inouts
@@ -14420,7 +14444,7 @@ $populate-mu-function-header:check-for-inout:
       (lookup *ebx *(ebx+4))  # => eax
       81 7/subop/compare *(eax+0x18) 0/imm32  # Var-register
       0f 85/jump-if-!= $populate-mu-function-header:error2/disp32
-      # if function name is "main"
+      # if function name is not "main"
       #    and v->type contains an 'addr' anywhere except the start, abort
       {
         (lookup *edi *(edi+4))  # Function-name Function-name => eax
@@ -14585,6 +14609,12 @@ $populate-mu-function-header:error-loop:
     (stop *(ebp+0x18) 1)
     # never gets here
 
+$populate-mu-function-header:error-lookup:
+    (write-buffered *(ebp+0x14) "cannot define a function called 'lookup'\n")
+    (flush *(ebp+0x14))
+    (stop *(ebp+0x18) 1)
+    # never gets here
+
 $populate-mu-function-header:error-addr-output:
     # error("fn " fn ": output cannot have an addr type; that could allow unsafe addresses to escape the function")
     (write-buffered *(ebp+0x14) "fn ")
@@ -14713,6 +14743,23 @@ $populate-mu-function-signature:check-for-inout:
       0f 85/jump-if-!= $populate-mu-function-signature:error1/disp32
       # v = parse-var-with-type(word-slice, first-line)
       (parse-var-with-type %ecx *(ebp+8) %ebx *(ebp+0x10) *(ebp+0x14))
+      # if (v->register != null) abort
+      # . eax: (addr var) = lookup(v)
+      (lookup *ebx *(ebx+4))  # => eax
+      81 7/subop/compare *(eax+0x18) 0/imm32  # Var-register
+      0f 85/jump-if-!= $populate-mu-function-signature:error2/disp32
+      # if function name is not "main"
+      #    and v->type contains an 'addr' anywhere except the start, abort
+      {
+        (lookup *edi *(edi+4))  # Function-name Function-name => eax
+        (string-equal? %eax "main")  # => eax
+        3d/compare-eax-and 0/imm32/false
+        75/jump-if-!= break/disp8
+        (lookup *ebx *(ebx+4))  # => eax
+        (addr-payload-contains-addr? %eax)  # => eax
+        3d/compare-eax-and 0/imm32/false
+        0f 85/jump-if-!= $populate-mu-function-signature:error-nested-addr-inout/disp32
+      }
       # assert(v->register == null)
       # . eax: (addr var) = lookup(v)
       (lookup *ebx *(ebx+4))  # => eax
@@ -14752,6 +14799,24 @@ $populate-mu-function-signature:check-for-out:
       (lookup *ebx *(ebx+4))  # => eax
       81 7/subop/compare *(eax+0x18) 0/imm32  # Var-register
       0f 84/jump-if-= $populate-mu-function-signature:error3/disp32
+      # if (var->name != "_") abort
+      (lookup *eax *(eax+4))  # Var-name Var-name => eax
+      (string-equal? %eax "_")  # => eax
+      3d/compare-eax-and 0/imm32/false
+      0f 84/jump-if-= $populate-mu-function-signature:error4/disp32
+      # if function name is not "lookup"
+      #    and v->type is an addr, abort
+      {
+        (lookup *edi *(edi+4))  # Function-name Function-name => eax
+        (string-equal? %eax "lookup")  # => eax
+        3d/compare-eax-and 0/imm32/false
+        75/jump-if-!= break/disp8
+        (lookup *ebx *(ebx+4))  # => eax
+        (lookup *(eax+8) *(eax+0xc))  # Var-type Var-type => eax
+        (is-mu-addr-type? %eax)  # => eax
+        3d/compare-eax-and 0/imm32/false
+        0f 85/jump-if-!= $populate-mu-function-signature:error-addr-output/disp32
+      }
       # out->outputs = append(v, out->outputs)
       8d/copy-address *(edi+0x10) 0/r32/eax  # Function-outputs
       (append-list Heap  *ebx *(ebx+4)  *(edi+0x10) *(edi+0x14)  %eax)  # Function-outputs, Function-outputs
@@ -14819,6 +14884,22 @@ $populate-mu-function-signature:error3:
     (stop *(ebp+0x14) 1)
     # never gets here
 
+$populate-mu-function-signature:error4:
+    # error("fn " fn ": function outputs cannot be named; rename '" var "' in the header to '_'")
+    (write-buffered *(ebp+0x10) "fn ")
+    50/push-eax
+    (lookup *edi *(edi+4))  # Function-name Function-name => eax
+    (write-buffered *(ebp+0x10) %eax)
+    58/pop-to-eax
+    (write-buffered *(ebp+0x10) ": function outputs cannot be named; rename '")
+    (lookup *ebx *(ebx+4))  # => eax
+    (lookup *eax *(eax+4))  # Var-name Var-name => eax
+    (write-buffered *(ebp+0x10) %eax)
+    (write-buffered *(ebp+0x10) "' in the header to '_'\n")
+    (flush *(ebp+0x10))
+    (stop *(ebp+0x14) 1)
+    # never gets here
+
 $populate-mu-function-signature:error-duplicate:
     (write-buffered *(ebp+0x10) "fn ")
     (write-slice-buffered *(ebp+0x10) %ecx)
@@ -14828,15 +14909,41 @@ $populate-mu-function-signature:error-duplicate:
     # never gets here
 
 $populate-mu-function-signature:error-break:
-    (write-buffered *(ebp+0x14) "Sorry, I've reserved all function names starting with 'break' for now. Please contact mu@akkartik.com.\n")
-    (flush *(ebp+0x14))
-    (stop *(ebp+0x18) 1)
+    (write-buffered *(ebp+0x10) "Sorry, I've reserved all function names starting with 'break' for now. Please contact mu@akkartik.com.\n")
+    (flush *(ebp+0x10))
+    (stop *(ebp+0x14) 1)
     # never gets here
 
 $populate-mu-function-signature:error-loop:
-    (write-buffered *(ebp+0x14) "Sorry, I've reserved all function names starting with 'loop' for now. Please contact mu@akkartik.com.\n")
-    (flush *(ebp+0x14))
-    (stop *(ebp+0x18) 1)
+    (write-buffered *(ebp+0x10) "Sorry, I've reserved all function names starting with 'loop' for now. Please contact mu@akkartik.com.\n")
+    (flush *(ebp+0x10))
+    (stop *(ebp+0x14) 1)
+    # never gets here
+
+$populate-mu-function-signature:error-addr-output:
+    # error("fn " fn ": output cannot have an addr type; that could allow unsafe addresses to escape the function")
+    (write-buffered *(ebp+0x10) "fn ")
+    50/push-eax
+    (lookup *edi *(edi+4))  # Function-name Function-name => eax
+    (write-buffered *(ebp+0x10) %eax)
+    58/pop-to-eax
+    (write-buffered *(ebp+0x10) ": output cannot have an addr type; that could allow unsafe addresses to escape the function\n")
+    (flush *(ebp+0x10))
+    (stop *(ebp+0x14) 1)
+    # never gets here
+
+$populate-mu-function-signature:error-nested-addr-inout:
+    # error("fn " fn ": inout '" var "' cannot contain 'addr' anywhere in the type except the first word; that could allow unsafe addresses to escape the function")
+    (write-buffered *(ebp+0x10) "fn ")
+    (lookup *edi *(edi+4))  # Function-name Function-name => eax
+    (write-buffered *(ebp+0x10) %eax)
+    (write-buffered *(ebp+0x10) ": inout '")
+    (lookup *ebx *(ebx+4))  # => eax
+    (lookup *eax *(eax+4))  # Var-name Var-name => eax
+    (write-buffered *(ebp+0x10) %eax)
+    (write-buffered *(ebp+0x10) "' cannot contain 'addr' anywhere in the type except the first word; that could allow unsafe addresses to escape the function\n")
+    (flush *(ebp+0x10))
+    (stop *(ebp+0x14) 1)
     # never gets here
 
 addr-payload-contains-addr?:  # v: (addr var) -> result/eax: boolean