dawn.node: Check for OOB in setBindGroup's typed array variant.

Bug: dawn:1123
Change-Id: I9ded6c76d50183ff14158e573b2c1a36a1becb3a
Reviewed-on: https://dawn-review.googlesource.com/c/dawn/+/85641
Commit-Queue: Corentin Wallez <cwallez@chromium.org>
Reviewed-by: Ben Clayton <bclayton@google.com>

src/dawn/node/binding/GPUComputePassEncoder.cpp

@@ -84,6 +84,22 @@ namespace wgpu::binding {
             return;
         }
 
+        if (dynamicOffsetsDataStart > dynamicOffsetsData.ElementLength()) {
+            Napi::RangeError::New(env,
+                                  "dynamicOffsetsDataStart is out of bound of dynamicOffsetData")
+                .ThrowAsJavaScriptException();
+            return;
+        }
+
+        if (dynamicOffsetsDataLength >
+            dynamicOffsetsData.ElementLength() - dynamicOffsetsDataStart) {
+            Napi::RangeError::New(env,
+                                  "dynamicOffsetsDataLength + dynamicOffsetsDataStart is out of "
+                                  "bound of dynamicOffsetData")
+                .ThrowAsJavaScriptException();
+            return;
+        }
+
         enc_.SetBindGroup(index, bg, dynamicOffsetsDataLength,
                           dynamicOffsetsData.Data() + dynamicOffsetsDataStart);
     }

src/dawn/node/binding/GPURenderPassEncoder.cpp

@@ -119,6 +119,22 @@ namespace wgpu::binding {
             return;
         }
 
+        if (dynamicOffsetsDataStart > dynamicOffsetsData.ElementLength()) {
+            Napi::RangeError::New(env,
+                                  "dynamicOffsetsDataStart is out of bound of dynamicOffsetData")
+                .ThrowAsJavaScriptException();
+            return;
+        }
+
+        if (dynamicOffsetsDataLength >
+            dynamicOffsetsData.ElementLength() - dynamicOffsetsDataStart) {
+            Napi::RangeError::New(env,
+                                  "dynamicOffsetsDataLength + dynamicOffsetsDataStart is out of "
+                                  "bound of dynamicOffsetData")
+                .ThrowAsJavaScriptException();
+            return;
+        }
+
         enc_.SetBindGroup(index, bg, dynamicOffsetsDataLength,
                           dynamicOffsetsData.Data() + dynamicOffsetsDataStart);
     }