diff --git a/src/lj_dispatch.c b/src/lj_dispatch.c
index b1d17add..38fd1709 100644
--- a/src/lj_dispatch.c
+++ b/src/lj_dispatch.c
@@ -431,8 +431,12 @@ ASMFunction LJ_FASTCALL lj_dispatch_call(lua_State *L, const BCIns *pc)
     goto out;
   } else if (J->state != LJ_TRACE_IDLE &&
 	     !(g->hookmask & (HOOK_GC|HOOK_VMEVENT))) {
+#ifdef LUA_USE_ASSERT
+    ptrdiff_t delta = L->top - L->base;
+#endif
     /* Record the FUNC* bytecodes, too. */
     lj_trace_ins(J, pc-1);  /* The interpreter bytecode PC is offset by 1. */
+    lua_assert(L->top - L->base == delta);
   }
 #endif
   if ((g->hookmask & LUA_MASKCALL)) {
diff --git a/src/lj_trace.c b/src/lj_trace.c
index 33cc98f7..afaeb300 100644
--- a/src/lj_trace.c
+++ b/src/lj_trace.c
@@ -497,6 +497,7 @@ static int trace_abort(jit_State *J)
   if (tvisnumber(L->top-1))
     e = (TraceError)numberVint(L->top-1);
   if (e == LJ_TRERR_MCODELM) {
+    L->top--;  /* Remove error object */
     J->state = LJ_TRACE_ASM;
     return 1;  /* Retry ASM with new MCode area. */
   }