Rule 8.8

A parameter an author writes must be passed by value; there must be no pointers and no reference parameters. Whole-value assignment, compound assignment and integer updates of a value parameter must rebind a mutable local initialized from the input, leaving the caller’s value unchanged. Only a parameter whose declaration a whole write resolves to gets this local; a shadowing declaration does not count. Within that body’s scope the local may be written through its fields or elements. A parameter with no whole write retains its existing read-only place semantics. Resource handles and the reference-backed arrays of Rule 8.23 are not local-copy values. The object of a method that changes its object, and a variable of the function around it that a local function writes, are not parameters an author writes: Rules 8.10 and 8.17 govern them, and each is passed by reference. The one exception an author writes is a kernel function’s parameter of an array with no size, which is the caller’s storage and passed by reference (Rule 8.23).