patch 8.2.2810: Vim9: crash when calling a function in a substitute expression

Problem:    Vim9: crash when calling a function in a substitute expression.
Solution:   Set the instructions back to the substitute expression
            instrunctions. (closes #8148)

src/testdir/test_vim9_cmd.vim

@@ -1194,10 +1194,31 @@ def Test_substitute_expr()
   endfor
   assert_equal('yes no abc', getline(1))
 
+  bwipe!
+
   CheckDefFailure(['s/from/\="x")/'], 'E488:')
   CheckDefFailure(['s/from/\="x"/9'], 'E488:')
 
-  bwipe!
+  # When calling a function the right instruction list needs to be restored.
+  var lines =<< trim END
+      vim9script
+      def Foo()
+          Bar([])
+      enddef
+      def Bar(l: list<number>)
+          s/^/\=Rep()/
+          for n in l[:]
+          endfor
+      enddef
+      def Rep(): string
+          return 'rep'
+      enddef
+      new
+      Foo()
+      assert_equal('rep', getline(1))
+      bwipe!
+  END
+  CheckScriptSuccess(lines)
 enddef
 
 def Test_redir_to_var()

src/version.c

@@ -750,6 +750,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    2810,
 /**/
     2809,
 /**/

src/vim9execute.c

@@ -601,6 +601,12 @@ func_return(ectx_T *ectx)
 				       + STACK_FRAME_IDX_OFF)->vval.v_number;
     ectx->ec_instr = INSTRUCTIONS(prev_dfunc);
 
+    // If the call was inside an ISN_SUBSTITUTE instruction need to use its
+    // list of instructions.
+    if (ectx->ec_instr[ectx->ec_iidx - 1].isn_type == ISN_SUBSTITUTE)
+	ectx->ec_instr = ectx->ec_instr[ectx->ec_iidx - 1]
+						      .isn_arg.subs.subs_instr;
+
     if (floc == NULL)
 	ectx->ec_funclocal.floc_restore_cmdmod = FALSE;
     else