https://issues.dlang.org/show_bug.cgi?id=24514

          Issue ID: 24514
           Summary: _d_newarraymTX can be with more dimensions than in the
                    type
           Product: D
           Version: D2
          Hardware: x86_64
                OS: Linux
            Status: NEW
          Severity: normal
          Priority: P1
         Component: druntime
          Assignee: nobody@puremagic.com
          Reporter: tim.dlang@t-online.de

Function _d_newarraymTX is internally used for expressions like `new int[][](2, 3)`. The function is @trusted, but it can be called with more dimensions at runtime than the type has:

```
import std.stdio;
void main() @safe
{
    auto a = _d_newarraymTX!(int*[][], int)([1, 1, 42]);
    writeln(a); // prints [[42]]
}
```

The function internally allocates an array with the dimensions `[1][1][42]`, but then returns it as type `int*[][]`. The length of the inner array is now interpreted as a pointer.

See also the discussion in https://github.com/dlang/dmd/pull/16400

A solution could be to change the function signature to this:
```
Tarr _d_newarraymTX(Tarr : U[], size_t N, U)(size_t[N] dims, bool
isShared=false) @trusted
```

--