From 71797fa75ffa1ddbd9b41bbd55d6c2d4236164b0 Mon Sep 17 00:00:00 2001
From: Mike Pall <mike>
Date: Tue, 18 Aug 2026 15:01:31 +0200
Subject: [PATCH] FFI: Mark cts->L in atomic phase.

Reported by zyxwvu Shi. #1506
---
 src/lj_ccallback.c | 1 +
 src/lj_gc.c        | 4 ++++
 2 files changed, 5 insertions(+)

diff --git a/src/lj_ccallback.c b/src/lj_ccallback.c
index 2fa8e7ce..802aa7c4 100644
--- a/src/lj_ccallback.c
+++ b/src/lj_ccallback.c
@@ -533,6 +533,7 @@ lua_State * LJ_FASTCALL lj_ccallback_enter(CTState *cts, void *cf)
   lua_State *L = cts->L;
   global_State *g = cts->g;
   lua_assert(L != NULL);
+  lua_assert(!isdead(g, obj2gco(L)));
   if (gcref(g->jit_L)) {
     setstrV(L, L->top++, lj_err_str(L, LJ_ERR_FFI_BADCBACK));
     if (g->panic) g->panic(L);
diff --git a/src/lj_gc.c b/src/lj_gc.c
index c79dbdee..944916df 100644
--- a/src/lj_gc.c
+++ b/src/lj_gc.c
@@ -586,6 +586,10 @@ static void atomic(global_State *g, lua_State *L)
   setgcrefnull(g->gc.weak);
   lua_assert(!iswhite(obj2gco(mainthread(g))));
   gc_markobj(g, L);  /* Mark running thread. */
+#if LJ_HASFFI
+  if (ctype_ctsG(g) && ctype_ctsG(g)->L)  /* Mark cts->L thread. */
+    gc_markobj(g, ctype_ctsG(g)->L);
+#endif
   gc_traverse_curtrace(g);  /* Traverse current trace. */
   gc_mark_gcroot(g);  /* Mark GC roots (again). */
   gc_propagate_gray(g);  /* Propagate all of the above. */