https://issues.dlang.org/show_bug.cgi?id=20881
--- Comment #6 from ag0aep6g <ag0ae...@gmail.com> --- The method is being inferred as `return scope`. Oddly enough, that doesn't show up when printing with `pragma(msg, ...)`. With this information, we can construct a test case that shows memory corruption even without malloc/free and @trusted: ---- struct Faulty { private int x; private int* unused; int* get1() @safe return scope { return &x; } } int* f(int x) @safe { auto f = Faulty(x); return f.get1(); /* Returns a pointer to the stack. */ } void main() @safe { int* p1 = f(42); int* p2 = f(13); import std.stdio; writeln(*p1); /* Prints "13". Whoopsie. */ } ---- --