[hlsl][fuzz] Fix check for array length additions

* HLSL writer fuzzer should only check for runtime-sized arrays in
  variables in storage address space

Fix: 518107729
Change-Id: I1d8ef45b6546aec9fd93a226fd9b47bd5e4da636
Reviewed-on: https://dawn-review.googlesource.com/c/dawn/+/313955
Auto-Submit: Alan Baker <alanbaker@google.com>
Commit-Queue: Alan Baker <alanbaker@google.com>
Reviewed-by: Ryan Harrison <rharrison@chromium.org>
Commit-Queue: Ryan Harrison <rharrison@chromium.org>

src/tint/lang/hlsl/writer/writer_fuzz.cc

diff --git a/src/tint/lang/hlsl/writer/writer_fuzz.cc b/src/tint/lang/hlsl/writer/writer_fuzz.cc
index 853b53e..e48a5ef 100644
--- a/src/tint/lang/hlsl/writer/writer_fuzz.cc
+++ b/src/tint/lang/hlsl/writer/writer_fuzz.cc
@@ -31,6 +31,7 @@
 #include "src/tint/cmd/fuzz/common/ir_fuzzer.h"
 #include "src/tint/lang/core/ir/module.h"
 #include "src/tint/lang/core/ir/var.h"
+#include "src/tint/lang/core/type/pointer.h"
 #include "src/tint/lang/hlsl/validate/validate.h"
 #include "src/tint/lang/hlsl/writer/printer/printer.h"
 #include "src/tint/lang/hlsl/writer/writer.h"
@@ -150,6 +151,14 @@
     std::unordered_set<tint::BindingPoint> storage_bindings;
     for (auto* inst : *module.root_block) {
         auto* var = inst->As<core::ir::Var>();
+        if (!var) {
+            continue;
+        }
+        if (auto* ptr_ty = var->Result()->Type()->As<core::type::Pointer>()) {
+            if (ptr_ty->AddressSpace() != core::AddressSpace::kStorage) {
+                continue;
+            }
+        }
         if (!var->Result()->Type()->UnwrapPtr()->HasFixedFootprint()) {
             if (auto bp = var->BindingPoint()) {
                 if (storage_bindings.insert(bp.value()).second) {