diff --git a/src/gpu/ganesh/ops/AtlasTextOp.cpp b/src/gpu/ganesh/ops/AtlasTextOp.cpp index 27e919e2600..8ba42a0eb5d 100644 --- a/src/gpu/ganesh/ops/AtlasTextOp.cpp +++ b/src/gpu/ganesh/ops/AtlasTextOp.cpp @@ -565,11 +565,17 @@ void AtlasTextOp::onPrepareDraws(GrMeshDrawTarget* target) { auto& glyphData = subRun.glyphVector().accessBackendData(); - SkDEBUGCODE(int strideCheck = SkToInt(glyphData.vertexStride(subRun.maskFormat(), - geo->fDrawMatrix))); - SkASSERTF(strideCheck == vertexStride, - "subRun stride: %d vertex buffer stride: %d\n", - strideCheck, vertexStride); + // The CPU vertex-fill struct (GlyphData::fillVertexData) is selected + // from positionMatrix.hasPerspective(), but the SDF GeometryProcessor + // stride is selected from viewDifference.hasPerspective(). A + // serialized SDFTSubRun with a forged perspective creationMatrix can + // decouple these and cause fill3D to overrun the vertex allocation. + // Drop the op if the strides disagree. + const int strideCheck = + SkToInt(glyphData.vertexStride(subRun.maskFormat(), geo->fDrawMatrix)); + if (strideCheck != vertexStride) { + return; + } const int subRunEnd = subRun.glyphCount();