diff --git a/src/regexp/regexp-code-generator.cc b/src/regexp/regexp-code-generator.cc
index f07df6f11db..4efa5c4584d 100644
--- a/src/regexp/regexp-code-generator.cc
+++ b/src/regexp/regexp-code-generator.cc
@@ -515,11 +515,17 @@ void CodeGenerator::Visit() {
 
 void CodeGenerator::PreVisitBytecodes() {
   DisallowGarbageCollection no_gc;
+  const uint32_t length = bytecode_->ulength().value();
   iter_.ForEachBytecode([&]<Bytecode bc>() {
     using Operands = BytecodeOperands<bc>;
     auto ensure_label = [&]<auto operand>() {
       const uint8_t* pc = iter_.current_address();
       uint32_t offset = Operands::template Get<operand>(pc, no_gc);
+      // Jump target offsets index labels_[] and the jump_targets_ BitVector,
+      // both sized to the bytecode length. A stale or malformed offset (e.g.
+      // an unmapped kOffsetAfterSequence operand carried through a later
+      // shrinking peephole pass) would otherwise be an OOB write.
+      CHECK_LT(offset, length);
       if (!jump_targets_.Contains(offset)) {
         jump_targets_.Add(offset);
         if constexpr (bc == Bytecode::kPushBacktrack) {