FFI: Fix dangling reference to CType. Improve checks.

Reported by elmknot.

1 files changed, 4 insertions, 0 deletions

diff --git a/src/lj_crecord.c b/src/lj_crecord.c
index 3f3552a6..2fcc6d1c 100644
--- a/src/lj_crecord.c
+++ b/src/lj_crecord.c
@@ -1396,9 +1396,13 @@ void LJ_FASTCALL recff_cdata_arith(jit_State *J, RecordFFData *rd)
         if (ctype_isenum(ct->info)) ct = ctype_child(cts, ct);
         goto ok;
       } else if (ctype_isfunc(ct->info)) {
+        CTypeID id0 = i ? ctype_typeid(cts, s[0]) : 0;
         tr = emitir(IRT(IR_FLOAD, IRT_PTR), tr, IRFL_CDATA_PTR);
         ct = ctype_get(cts,
           lj_ctype_intern(cts, CTINFO(CT_PTR, CTALIGN_PTR|id), CTSIZE_PTR));
+        if (i) {
+          s[0] = ctype_get(cts, id0);  /* cts->tab may have been reallocated. */
+        }
         goto ok;
       } else {
         tr = emitir(IRT(IR_ADD, IRT_PTR), tr, lj_ir_kintp(J, sizeof(GCcdata)));