diff options
Diffstat (limited to 'deps/v8/src/objects/js-array-buffer.cc')
| -rw-r--r-- | deps/v8/src/objects/js-array-buffer.cc | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/deps/v8/src/objects/js-array-buffer.cc b/deps/v8/src/objects/js-array-buffer.cc index dac3c8b563..cd760b9e67 100644 --- a/deps/v8/src/objects/js-array-buffer.cc +++ b/deps/v8/src/objects/js-array-buffer.cc @@ -76,7 +76,6 @@ void JSArrayBuffer::Attach(std::shared_ptr<BackingStore> backing_store) { !backing_store->is_wasm_memory() && !backing_store->is_resizable(), backing_store->byte_length() == backing_store->max_byte_length()); DCHECK(!was_detached()); - DCHECK(IsValidBackingStorePointer(backing_store->buffer_start())); Isolate* isolate = GetIsolate(); if (backing_store->IsEmpty()) { @@ -91,6 +90,7 @@ void JSArrayBuffer::Attach(std::shared_ptr<BackingStore> backing_store) { // invariant that their byte_length field is always 0. set_byte_length(0); } else { + CHECK_LE(backing_store->byte_length(), kMaxByteLength); set_byte_length(backing_store->byte_length()); } set_max_byte_length(backing_store->max_byte_length()); |