diff --git a/src/gl/scene/gl_sprite.cpp b/src/gl/scene/gl_sprite.cpp
index ab88f2f9c..e9748fba6 100644
--- a/src/gl/scene/gl_sprite.cpp
+++ b/src/gl/scene/gl_sprite.cpp
@@ -138,10 +138,10 @@ void GLSprite::CalculateVertices(FVector3 *v)
 			mat.Rotate(0, 1, 0, - actor->Angles.Roll.Degrees);
 			mat.Translate(-x, -z, -y);
 		}
-		v[0] = mat * FVector3(x1, z, y2);
-		v[1] = mat * FVector3(x2, z, y2);
-		v[2] = mat * FVector3(x1, z, y1);
-		v[3] = mat * FVector3(x2, z, y1);
+		v[0] = mat * FVector3(x2, z, y2);
+		v[1] = mat * FVector3(x1, z, y2);
+		v[2] = mat * FVector3(x2, z, y1);
+		v[3] = mat * FVector3(x1, z, y1);
 		return;
 	}
 	
diff --git a/src/thingdef/thingdef_expression.cpp b/src/thingdef/thingdef_expression.cpp
index 700ac94bb..c2b2d25e6 100644
--- a/src/thingdef/thingdef_expression.cpp
+++ b/src/thingdef/thingdef_expression.cpp
@@ -4956,6 +4956,25 @@ FxExpression *FxRuntimeStateIndex::Resolve(FCompileContext &ctx)
 	return this;
 }
 
+static bool VerifyJumpTarget(AActor *stateowner, FStateParamInfo *stateinfo, int index)
+{
+	PClassActor *cls = stateowner->GetClass();
+
+	while (cls != RUNTIME_CLASS(AActor))
+	{
+		// both calling and target state need to belong to the same class.
+		if (cls->OwnsState(stateinfo->mCallingState))
+		{
+			return cls->OwnsState(stateinfo->mCallingState + index);
+		}
+
+		// We can safely assume the ParentClass is of type PClassActor
+		// since we stop when we see the Actor base class.
+		cls = static_cast<PClassActor *>(cls->ParentClass);
+	}
+	return false;
+}
+
 static int DecoHandleRuntimeState(VMFrameStack *stack, VMValue *param, int numparam, VMReturn *ret, int numret)
 {
 	PARAM_PROLOGUE;
@@ -4963,7 +4982,7 @@ static int DecoHandleRuntimeState(VMFrameStack *stack, VMValue *param, int numpa
 	PARAM_POINTER(stateinfo, FStateParamInfo);
 	PARAM_INT(index);
 
-	if (index == 0 || !stateowner->GetClass()->OwnsState(stateinfo->mCallingState + index))
+	if (index == 0 || !VerifyJumpTarget(stateowner, stateinfo, index))
 	{
 		// Null is returned if the location was invalid which means that no jump will be performed
 		// if used as return value