crash on explicit return from s///e

RT #130188

In

    sub f {
        my $x = 'a';
        $x =~ s/./return;/e;
    }

the 'return' triggers popping any contexts above the subroutine context:
in this case, a CXt_SUBST context. In this case, Perl_dounwind() calls
cx_popblock() for the bottom-most popped context, to restore any saved
vars. However, CXt_SUBST is the one context type which *doesn't* use
'struct block' as part of its context struct union, so you can't
cx_popblock() a CXt_SUBST context.

This commit makes it skip the cx_popblock() in this case.

Bug was introduced by me with v5.23.7-235-gfc6e609.

1 files changed, 6 insertions, 0 deletions

diff --git a/pp_ctl.c b/pp_ctl.c
index 89a7521f60..ec0ad7d317 100644
--- a/pp_ctl.c
+++ b/pp_ctl.c
@@ -1530,6 +1530,12 @@ Perl_dounwind(pTHX_ I32 cxix)
 	switch (CxTYPE(cx)) {
 	case CXt_SUBST:
 	    CX_POPSUBST(cx);
+            /* CXt_SUBST is not a block context type, so skip the
+             * cx_popblock(cx) below */
+            if (cxstack_ix == cxix + 1) {
+                cxstack_ix--;
+                return;
+            }
 	    break;
 	case CXt_SUB:
 	    cx_popsub(cx);