| Index: src/effects/SkMergeImageFilter.cpp
 | 
| diff --git a/src/effects/SkMergeImageFilter.cpp b/src/effects/SkMergeImageFilter.cpp
 | 
| index 7d12ebe06efecf2ef8d390a86fbf793053d34b1a..a5c32acaf77b973aa729998a7d8c47f5dbbb17ea 100755
 | 
| --- a/src/effects/SkMergeImageFilter.cpp
 | 
| +++ b/src/effects/SkMergeImageFilter.cpp
 | 
| @@ -9,6 +9,7 @@
 | 
|  #include "SkCanvas.h"
 | 
|  #include "SkDevice.h"
 | 
|  #include "SkFlattenableBuffers.h"
 | 
| +#include "SkValidationUtils.h"
 | 
|  
 | 
|  ///////////////////////////////////////////////////////////////////////////////
 | 
|  
 | 
| @@ -159,8 +160,12 @@ SkMergeImageFilter::SkMergeImageFilter(SkFlattenableReadBuffer& buffer) : INHERI
 | 
|      bool hasModes = buffer.readBool();
 | 
|      if (hasModes) {
 | 
|          this->initAllocModes();
 | 
| -        SkASSERT(buffer.getArrayCount() == countInputs() * sizeof(fModes[0]));
 | 
| +        int nbInputs = countInputs();
 | 
| +        SkASSERT(buffer.getArrayCount() == nbInputs * sizeof(fModes[0]));
 | 
|          buffer.readByteArray(fModes);
 | 
| +        for (int i = 0; i < nbInputs; ++i) {
 | 
| +            buffer.validate(SkIsValidMode((SkXfermode::Mode)fModes[i]));
 | 
| +        }
 | 
|      } else {
 | 
|          fModes = 0;
 | 
|      }
 | 
| 
 |