commit 472a67876dde2cee0316fe74bc14cf77dfe03b53
author Ryan Harrison <rharrison@chromium.org> Thu Sep 25 13:42:27 2025 -0700
committer Dawn LUCI CQ <dawn-scoped@luci-project-accounts.iam.gserviceaccount.com> Thu Sep 25 13:42:27 2025 -0700
tree aedb547e28281795aeebf1e4c51935021fbf45d2
parent 5adfb7ad88d0b36157e660454b34b28d32642739

[tint][ir] Check that BindingArray element type exists in decode

Fixes: 446511576
Change-Id: I81d0f48c0f43be46101aad67bece2dd23546c0b7
Reviewed-on: https://dawn-review.googlesource.com/c/dawn/+/263634
Commit-Queue: Ryan Harrison <rharrison@chromium.org>
Auto-Submit: Ryan Harrison <rharrison@chromium.org>
Reviewed-by: dan sinclair <dsinclair@chromium.org>
Commit-Queue: dan sinclair <dsinclair@chromium.org>

src/tint/lang/core/ir/binary/decode.cc

diff --git a/src/tint/lang/core/ir/binary/decode.cc b/src/tint/lang/core/ir/binary/decode.cc
index d0abed8..de06841 100644
--- a/src/tint/lang/core/ir/binary/decode.cc
+++ b/src/tint/lang/core/ir/binary/decode.cc
@@ -909,6 +909,10 @@
                  << internal_limits::kMaxArrayElementCount << "\n";
             return mod_out_.Types().invalid();
         }
+        if (element == nullptr) {
+            err_ << "binding array element type is invalid\n";
+            return mod_out_.Types().invalid();
+        }
 
         return mod_out_.Types().binding_array(element, count);
     }