diff --git a/include/core/SkPicture.h b/include/core/SkPicture.h
index edbe748..30e410c 100644
--- a/include/core/SkPicture.h
+++ b/include/core/SkPicture.h
@@ -170,10 +170,11 @@
     // V39: Added FilterLevel option to SkPictureImageFilter
     // V40: Remove UniqueID serialization from SkImageFilter.
     // V41: Added serialization of SkBitmapSource's filterQuality parameter
+    // V42: Added a bool to SkPictureShader serialization to indicate did-we-serialize-a-picture?
 
     // Only SKPs within the min/current picture version range (inclusive) can be read.
     static const uint32_t     MIN_PICTURE_VERSION = 35;     // Produced by Chrome M39.
-    static const uint32_t CURRENT_PICTURE_VERSION = 41;
+    static const uint32_t CURRENT_PICTURE_VERSION = 42;
 
     static_assert(MIN_PICTURE_VERSION <= 41,
                   "Remove kFontFileName and related code from SkFontDescriptor.cpp.");
diff --git a/src/core/SkPictureShader.cpp b/src/core/SkPictureShader.cpp
index cb508d4..501d515 100644
--- a/src/core/SkPictureShader.cpp
+++ b/src/core/SkPictureShader.cpp
@@ -122,6 +122,8 @@
     return SkNEW_ARGS(SkPictureShader, (picture, tmx, tmy, localMatrix, tile));
 }
 
+// TODO: rename SK_DISALLOW_CROSSPROCESS_PICTUREIMAGEFILTERS to SK_DISALLOW_CROSSPROCESS_PICTURES
+
 SkFlattenable* SkPictureShader::CreateProc(SkReadBuffer& buffer) {
     SkMatrix lm;
     buffer.readMatrix(&lm);
@@ -129,7 +131,27 @@
     TileMode my = (TileMode)buffer.read32();
     SkRect tile;
     buffer.readRect(&tile);
-    SkAutoTUnref<SkPicture> picture(SkPicture::CreateFromBuffer(buffer));
+
+    SkAutoTUnref<SkPicture> picture;
+#ifdef SK_DISALLOW_CROSSPROCESS_PICTUREIMAGEFILTERS
+    if (buffer.isCrossProcess()) {
+        if (buffer.isVersionLT(SkReadBuffer::kPictureShaderHasPictureBool_Version)) {
+            // Older code blindly serialized pictures.  We don't trust them.
+            buffer.validate(false);
+            return NULL;
+        }
+        // Newer code won't serialize pictures in disallow-cross-process-picture mode.
+        // Assert that they didn't serialize anything except a false here.
+        buffer.validate(!buffer.readBool());
+    } else
+#endif
+    {
+        // Old code always serialized the picture.  New code writes a 'true' first if it did.
+        if (buffer.isVersionLT(SkReadBuffer::kPictureShaderHasPictureBool_Version) ||
+            buffer.readBool()) {
+            picture.reset(SkPicture::CreateFromBuffer(buffer));
+        }
+    }
     return SkPictureShader::Create(picture, mx, my, &lm, &tile);
 }
 
@@ -138,7 +160,18 @@
     buffer.write32(fTmx);
     buffer.write32(fTmy);
     buffer.writeRect(fTile);
-    fPicture->flatten(buffer);
+
+#ifdef SK_DISALLOW_CROSSPROCESS_PICTUREIMAGEFILTERS
+    // The deserialization code won't trust that our serialized picture is safe to deserialize.
+    // So write a 'false' telling it that we're not serializing a picture.
+    if (buffer.isCrossProcess()) {
+        buffer.writeBool(false);
+    } else
+#endif
+    {
+        buffer.writeBool(true);
+        fPicture->flatten(buffer);
+    }
 }
 
 SkShader* SkPictureShader::refBitmapShader(const SkMatrix& matrix, const SkMatrix* localM,
diff --git a/src/core/SkReadBuffer.h b/src/core/SkReadBuffer.h
index 1299eda..ba47835 100644
--- a/src/core/SkReadBuffer.h
+++ b/src/core/SkReadBuffer.h
@@ -56,7 +56,8 @@
         kPictureImageFilterResolution_Version = 38,
         kPictureImageFilterLevel_Version   = 39,
         kImageFilterNoUniqueID_Version     = 40,
-        kBitmapSourceFilterQuality_Version = 41
+        kBitmapSourceFilterQuality_Version = 41,
+        kPictureShaderHasPictureBool_Version = 42,
     };
 
     /**