[perl #92290, #92406] Returning a pad var from lv sub

This fixes a recent (post-5.14.0) regression.

Commit bf8fb5e (the fix for #62498) introduced it for lvalue subs with
no return statement [perl #92406].
Commit fa1e92c (the fix for #72724) introduced it for lvalue subs that
do have an explicit return [perl #92290].

Simply returning a scalar itself from an lvalue sub does not work if
it is a pad variable with a reference count of 1.  In that circum-
stance, the sub-popping code sees that the SV can be re-used the next
time the sub is called, so it undefines it and hangs on to it.  So
the scalar returned gets emptied before the calling code can see it.

The reference count has to be increased temporarily, which sv_2mortal
and SvREFCNT_inc combined accomplish.

1 files changed, 10 insertions, 2 deletions

diff --git a/pp_hot.c b/pp_hot.c
index cd556f3f2a..8d02826249 100644
--- a/pp_hot.c
+++ b/pp_hot.c
@@ -2802,7 +2802,9 @@ PP(pp_leavesublv)
 			sv_2mortal(*MARK);
 		}
 		else
-		    *MARK = TOPs;
+		    *MARK = SvTEMP(TOPs)
+		              ? TOPs
+		              : sv_2mortal(SvREFCNT_inc_simple_NN(TOPs));
 	    }
 	    else {
 		MEXTEND(MARK, 0);
@@ -2810,6 +2812,13 @@ PP(pp_leavesublv)
 	    }
 	    SP = MARK;
 	}
+	else if (gimme == G_ARRAY) {
+	  rvalue_array:
+	    for (MARK = newsp + 1; MARK <= SP; MARK++) {
+		if (!SvTEMP(*MARK))
+		    *MARK = sv_2mortal(SvREFCNT_inc_simple_NN(*MARK));
+	    }
+	}
     }
 
     if (CxLVAL(cx) & OPpENTERSUB_DEREF) {
@@ -2829,7 +2838,6 @@ PP(pp_leavesublv)
 	}
     }
 
-  rvalue_array:
     PUTBACK;
 
     LEAVE;