diff --git a/third_party/angle/src/libANGLE/renderer/d3d/d3d11/Buffer11.cpp b/third_party/angle/src/libANGLE/renderer/d3d/d3d11/Buffer11.cpp
--- a/third_party/angle/src/libANGLE/renderer/d3d/d3d11/Buffer11.cpp
+++ b/third_party/angle/src/libANGLE/renderer/d3d/d3d11/Buffer11.cpp
@@ -878,7 +878,14 @@ angle::Result Buffer11::getConstantBufferRangeStorage(const gl::Context *context
                     return a.second.lruCount < b.second.lruCount;
                 });

-            ASSERT(iter->second.storage != newStorage);
+            // An oversized glBindBufferRange (size > 2*mSize) reaches here with
+            // the raw un-clamped size and can select newStorage's own cache
+            // entry for eviction, freeing the object we are about to resize().
+            // ASSERT is compiled out in release; bail out unconditionally.
+            if (iter->second.storage == newStorage)
+            {
+                break;
+            }
             ASSERT(mConstantBufferStorageAdditionalSize >= iter->second.storage->getSize());

             mConstantBufferStorageAdditionalSize -= iter->second.storage->getSize();