https://issues.dlang.org/show_bug.cgi?id=14299

          Issue ID: 14299
           Summary: [REG2.067.0-rc1] "ref" parameter in CTFE handled
                    incorrectly for recursive calls
           Product: D
           Version: D2
          Hardware: All
                OS: All
            Status: NEW
          Keywords: ice-on-valid-code, wrong-code
          Severity: regression
          Priority: P1
         Component: DMD
          Assignee: nobody@puremagic.com
          Reporter: sludwig@outerproduct.org

The following code works correctly in DMD 2.066.1:

```
string test2() {
    string n;
    return test(0, n);
}

string test(int idx, ref string name) {
    string ret;
    name = [cast(char)(idx + '0')];
    ret ~= name;
    if (idx < 2) {
        string subname;
        ret ~= test(idx+1, subname);
    }
    ret ~= name;
    return ret;
}

static assert(test2() == "012210");
```

On DMD 2.067-rc1 it fails with:
Assertion failure: 'v->ctfeAdrOnStack >= 0 && v->ctfeAdrOnStack <
stackPointer()
' on line 182 in file 'interpret.c'

In the original, more complex, scenario instead of an ICE, the "name" variable was silently corrupted instead and contained the contents of "subname" after the recursive call to test().

--