At a minimum you'd also need to enable runtime bound checking for span/vector accesses (I think chrome did that).