This can be seen as a follow-up on my previous differential D33411.
We received a bug report where this error was triggered. I have tried my best to recreate the issue in a minimal lit testcase which is also part of this differential.
I only handle return instructions as predecessors to a virtual TLR-exit right now. From inspecting the codebase, it seems unreachable instructions may also be of interest here. If requested, I can extend my patches to consider them as well. I would also apply this on ScopHelper.cpp::isErrorBlock (see D33411), of course.