make POPSUB and POPFORMAT re-entrant safe

In code like

    sub DESTROY { exit }
    sub f { push @_, bless [] }
    f()

While leaving f, POPSUB will attempt to clear @_. This triggers the
destructor, which calls exit, which unwinds the context stack, calling
POPSUB again on thr same context stack entry.

Thus we need to to be careful that POPSUB can be called multiple times
on the same CX stack entry.

The general way of doing this is to NULL or update pointers *before*
calling SvREFCNT_dec() on the old value.

This commit also removes the old CxPOPSUB_DONE mechanism which was a poor
bandaid added at the last minute to 5.22 to try and achieve the basics
of what this commit does comprehensively (hopefully). Also, CxPOPSUB_DONE
was mainly a protection against re-entrantly calling LEAVE_SCOPE(). Since
that's now done before POPSUB rather than in the middle of it, it has
become reentrant-safe by default.

1 files changed, 4 insertions, 1 deletions

diff --git a/pp_sys.c b/pp_sys.c
index 0792727ed6..99f718e522 100644
--- a/pp_sys.c
+++ b/pp_sys.c
@@ -1292,10 +1292,13 @@ of the typeglob that C<PL_defoutgv> points to is decreased by one.
 void
 Perl_setdefout(pTHX_ GV *gv)
 {
+    GV *oldgv = PL_defoutgv;
+
     PERL_ARGS_ASSERT_SETDEFOUT;
+
     SvREFCNT_inc_simple_void_NN(gv);
-    SvREFCNT_dec(PL_defoutgv);
     PL_defoutgv = gv;
+    SvREFCNT_dec(oldgv);
 }
 
 PP(pp_select)