diff --git a/src/parsing/literal-buffer.cc b/src/parsing/literal-buffer.cc index c7e5560b960..d272fe760d0 100644 --- a/src/parsing/literal-buffer.cc +++ b/src/parsing/literal-buffer.cc @@ -45,6 +45,10 @@ void LiteralBuffer::ExpandBuffer() { void LiteralBuffer::ConvertToTwoByte() { DCHECK(is_one_byte()); + // Bandaid for integer overflow: position_ * kUC16Size must not wrap. The + // streaming-compile path can drive position_ past String::kMaxLength, so + // this must be a release CHECK rather than a DCHECK. + CHECK_LE(position_, std::numeric_limits::max() / base::kUC16Size); base::Vector new_store; int new_content_size = position_ * base::kUC16Size; if (new_content_size >= backing_store_.length()) {