| Index: third_party/WebKit/Source/bindings/core/v8/ScriptValueSerializer.cpp
 | 
| diff --git a/third_party/WebKit/Source/bindings/core/v8/ScriptValueSerializer.cpp b/third_party/WebKit/Source/bindings/core/v8/ScriptValueSerializer.cpp
 | 
| index 5a4771201475d190c3aee72441442f944edba109..3bd0390146d9043f971387b6fb751005509455e8 100644
 | 
| --- a/third_party/WebKit/Source/bindings/core/v8/ScriptValueSerializer.cpp
 | 
| +++ b/third_party/WebKit/Source/bindings/core/v8/ScriptValueSerializer.cpp
 | 
| @@ -360,9 +360,8 @@ String SerializedScriptValueWriter::takeWireString()
 | 
|  {
 | 
|      static_assert(sizeof(BufferValueType) == 2, "BufferValueType should be 2 bytes");
 | 
|      fillHole();
 | 
| -    String data = String(m_buffer.data(), m_buffer.size());
 | 
| -    data.impl()->truncateAssumingIsolated((m_position + 1) / sizeof(BufferValueType));
 | 
| -    return data;
 | 
| +    ASSERT((m_position + 1) / sizeof(BufferValueType) <= m_buffer.size());
 | 
| +    return String(m_buffer.data(), (m_position + 1) / sizeof(BufferValueType));
 | 
|  }
 | 
|  
 | 
|  void SerializedScriptValueWriter::writeReferenceCount(uint32_t numberOfReferences)
 | 
| 
 |