--- src/compiler/translator/IntermNode.cpp 2026-06-05 08:03:27.000000000 +0800 +++ src/compiler/translator/IntermNode.cpp 2026-06-15 04:47:04.000000000 +0800 @@ -876,11 +876,7 @@ if (isArray()) { size_t elementSize = mArguments.front()->getAsTyped()->getType().getObjectSize(); - // Overflow should never happen due to parser validation, but hardened here just in case. - // http://crbug.com/498400132 - angle::base::CheckedNumeric checkedArraySize = elementSize; - checkedArraySize *= getOutermostArraySize(); - constArray = new TConstantUnion[checkedArraySize.ValueOrDie()]; + constArray = new TConstantUnion[elementSize * getOutermostArraySize()]; size_t elementOffset = 0u; for (TIntermNode *constructorArg : mArguments)