diff --git a/third_party/angle/src/compiler/translator/IntermNode.cpp b/third_party/angle/src/compiler/translator/IntermNode.cpp
index 44594019ad..e50084ca9a 100644
--- a/third_party/angle/src/compiler/translator/IntermNode.cpp
+++ b/third_party/angle/src/compiler/translator/IntermNode.cpp
@@ -837,6 +837,14 @@ bool TIntermAggregate::hasConstantValue() const
     {
         return false;
     }
+    // TType::getObjectSize() / TFieldListCollection::calculateObjectSize() saturate at INT_MAX, so
+    // for pathological types getConstantValue() would allocate fewer TConstantUnion slots than the
+    // un-saturated per-field offsets that consumers (e.g. TIntermBinary::getConstantValue() for
+    // EOpIndexDirectStruct) compute, leading to OOB reads.  Refuse to fold such aggregates.
+    if (getType().getObjectSize() >= static_cast<size_t>(INT_MAX))
+    {
+        return false;
+    }
     for (TIntermNode *constructorArg : mArguments)
     {
         if (!constructorArg->getAsTyped()->hasConstantValue())