Index: src/lua/ldo.c
===================================================================
--- src/lua/ldo.c	(revision 524)
+++ src/lua/ldo.c	(working copy)
@@ -51,11 +51,13 @@
 void luaD_seterrorobj (lua_State *L, int errcode, StkId oldtop) {
   switch (errcode) {
     case LUA_ERRMEM: {
-      setsvalue2s(L, oldtop, luaS_newliteral(L, MEMERRMSG));
+      ptrdiff_t oldtopr = savestack(L, oldtop);
+      setsvalue2s(L, restorestack(L, oldtopr), luaS_newliteral(L, MEMERRMSG));
       break;
     }
     case LUA_ERRERR: {
-      setsvalue2s(L, oldtop, luaS_newliteral(L, "error in error handling"));
+      ptrdiff_t oldtopr = savestack(L, oldtop);
+      setsvalue2s(L, restorestack(L, oldtopr), luaS_newliteral(L, "error in error handling"));
       break;
     }
     case LUA_ERRSYNTAX:
@@ -224,8 +226,10 @@
     htab = luaH_new(L, nvar, 1);  /* create `arg' table */
     sethvalue2s(L, L->top, htab); /* put table on stack */
     incr_top(L);
+    fixedstack(L);
     for (i=0; i<nvar; i++)  /* put extra arguments into `arg' table */
       setobj2n(L, luaH_setnum(L, htab, i+1), L->top - 1 - nvar + i);
+    unfixedstack(L);
     /* store counter in field `n' */
     setnvalue(luaH_setstr(L, htab, luaS_newliteral(L, "n")), cast_num(nvar));
     L->top--; /* remove table from stack */
Index: src/lua/lvm.c
===================================================================
--- src/lua/lvm.c	(revision 524)
+++ src/lua/lvm.c	(working copy)
@@ -68,9 +68,10 @@
     return 0;
   else {
     char s[LUAI_MAXNUMBER2STR];
+    ptrdiff_t objr = savestack(L, obj);
     lua_Number n = nvalue(obj);
     lua_number2str(s, n);
-    setsvalue2s(L, obj, luaS_new(L, s));
+    setsvalue2s(L, restorestack(L, objr), luaS_new(L, s));
     return 1;
   }
 }
@@ -317,8 +318,11 @@
     StkId top = L->base + last + 1;
     int n = 2;  /* number of elements handled in this pass (at least 2) */
     if (!(ttisstring(top-2) || ttisnumber(top-2)) || !tostring(L, top-1)) {
-      if (!call_binTM(L, top-2, top-1, top-2, TM_CONCAT))
+      if (!call_binTM(L, top-2, top-1, top-2, TM_CONCAT)) {
+        /* restore 'top' pointer, since stack might have been reallocted */
+        top = L->base + last + 1;
         luaG_concaterror(L, top-2, top-1);
+      }
     } else if (tsvalue(top-1)->len == 0)  /* second op is empty? */
       (void)tostring(L, top - 2);  /* result is first op (as string) */
     else {
@@ -369,8 +373,13 @@
       default: lua_assert(0); break;
     }
   }
-  else if (!call_binTM(L, rb, rc, ra, op))
-    luaG_aritherror(L, rb, rc);
+  else {
+    ptrdiff_t br = savestack(L, rb);
+    ptrdiff_t cr = savestack(L, rc);
+    if (!call_binTM(L, rb, rc, ra, op)) {
+      luaG_aritherror(L, restorestack(L, br), restorestack(L, cr));
+    }
+  }
 }
 
 
@@ -563,9 +572,10 @@
             break;
           }
           default: {  /* try metamethod */
+            ptrdiff_t br = savestack(L, rb);
             Protect(
               if (!call_binTM(L, rb, luaO_nilobject, ra, TM_LEN))
-                luaG_typeerror(L, rb, "get length of");
+                luaG_typeerror(L, restorestack(L, br), "get length of");
             )
           }
         }
@@ -739,6 +749,7 @@
         int c = GETARG_C(i);
         int last;
         Table *h;
+        fixedstack(L);
         if (n == 0) {
           n = cast_int(L->top - ra) - 1;
           L->top = L->ci->top;
@@ -754,6 +765,7 @@
           setobj2t(L, luaH_setnum(L, h, last--), val);
           luaC_barriert(L, h, val);
         }
+        unfixedstack(L);
         continue;
       }
       case OP_CLOSE: {
@@ -766,6 +778,7 @@
         int nup, j;
         p = cl->p->p[GETARG_Bx(i)];
         nup = p->nups;
+        fixedstack(L);
         ncl = luaF_newLclosure(L, nup, cl->env);
         setclvalue(L, ra, ncl);
         ncl->l.p = p;
@@ -777,6 +790,7 @@
             ncl->l.upvals[j] = luaF_findupval(L, base + GETARG_B(*pc));
           }
         }
+        unfixedstack(L);
         Protect(luaC_checkGC(L));
         continue;
       }
Index: src/lua/lapi.c
===================================================================
--- src/lua/lapi.c	(revision 524)
+++ src/lua/lapi.c	(working copy)
@@ -570,7 +570,9 @@
   lua_lock(L);
   t = index2adr(L, idx);
   api_checkvalidindex(L, t);
+  fixedstack(L);
   setsvalue(L, &key, luaS_new(L, k));
+  unfixedstack(L);
   luaV_gettable(L, t, &key, L->top);
   api_incr_top(L);
   lua_unlock(L);
@@ -705,7 +707,9 @@
   api_checknelems(L, 2);
   t = index2adr(L, idx);
   api_check(L, ttistable(t));
+  fixedstack(L);
   setobj2t(L, luaH_set(L, hvalue(t), L->top-2), L->top-1);
+  unfixedstack(L);
   luaC_barriert(L, hvalue(t), L->top-1);
   L->top -= 2;
   lua_unlock(L);
@@ -718,7 +722,9 @@
   api_checknelems(L, 1);
   o = index2adr(L, idx);
   api_check(L, ttistable(o));
+  fixedstack(L);
   setobj2t(L, luaH_setnum(L, hvalue(o), n), L->top-1);
+  unfixedstack(L);
   luaC_barriert(L, hvalue(o), L->top-1);
   L->top--;
   lua_unlock(L);
