6529 - don't let `addr`s escape functions

I've gone back and forth on this. I initially disallowed this, then allowed
it because I forgot why I disallowed it. The reason to disallow it: if
you return an `addr` to a variable allocated on the stack, the space might
be reused for a different type, which violates type-safety. And once you
can reinterpret bits of one type as another you lose memory-safety as well.

This has some interesting implications for Mu programs; certain kinds of
helper functions become impossible to write. Now I find myself relying a
lot more on scopes (and editor folding support) for abstracting details.
And they won't help manage duplication. We'll see how this goes.

While I'm being draconian about `addr`s on the stack, I'm still abusing
`addr`s on the heap, with the expectation that future checks on reclamation
will protect me. The boon and bane of stack space is that it's constantly
reclaimed.

1 files changed, 3 insertions, 0 deletions

diff --git a/apps/mu.subx b/apps/mu.subx
index 70ad482d..cd08466e 100644
--- a/apps/mu.subx
+++ b/apps/mu.subx
@@ -4638,6 +4638,9 @@ $parse-mu:error2:
 # ✓ fn foo x: int {
 # ✓ fn foo x: int {
 # ✓ fn foo x: int -> y/eax: int {
+# TODO:
+#   disallow outputs of type `(... addr ...)`
+#   disallow inputs of type `(... addr ... addr ...)`
 populate-mu-function-header:  # first-line: (addr stream byte), out: (addr function), vars: (addr stack live-var), err: (addr buffered-file), ed: (addr exit-descriptor)
     # pseudocode:
     #   var name: slice