check.patch

diff --git a/src/core/frame.c b/src/core/frame.c
index 1bf38a6..2812fb6 100644
--- a/src/core/frame.c
+++ b/src/core/frame.c
@@ -883,9 +883,16 @@ static MVMuint64 remove_one_frame(MVMThreadContext *tc, MVMuint8 unwind) {
 
     /* Switch back to the caller frame if there is one. */
     if (caller && returner != tc->thread_entry_frame) {
+if (!caller->spesh_cand) {
+    MVMuint8 *eb = caller->static_info->body.bytecode;
+    if (caller->return_address < eb)
+        MVM_panic(1, "Caller return address before bytecode");
+   if (caller->return_address > eb + caller->static_info->body.bytecode_size)
+       MVM_panic(1, "Caller return address %d bytes after end of bytecode",
+               (int)(caller->return_address - eb + caller->static_info->body.bytecode_size));
+}
         tc->cur_frame = caller;
         tc->current_frame_nr = caller->sequence_nr;
-
         *(tc->interp_cur_op) = caller->return_address;
         *(tc->interp_bytecode_start) = MVM_frame_effective_bytecode(caller);
         *(tc->interp_reg_base) = caller->work;