diff --git a/sailfish/src/runtime/buffer.rs b/sailfish/src/runtime/buffer.rs
index 3111abd..348e9f8 100644
--- a/sailfish/src/runtime/buffer.rs
+++ b/sailfish/src/runtime/buffer.rs
@@ -69,6 +69,7 @@ impl Buffer {
     #[inline]
     #[doc(hidden)]
     pub unsafe fn _set_len(&mut self, new_len: usize) {
+        debug_assert!(new_len <= self.capacity);
         self.len = new_len;
     }