[tint] Skip override expression in BuiltinPolyfill

These will never occur here in production flows (due to
SubstituteOverrides), but this keeps the fuzzers happy and simplifies
the logic.

Bug: 348796222
Change-Id: I4a4e8e666029c11e3a1ba1b1ebea7b8f25cfe25f
Reviewed-on: https://dawn-review.googlesource.com/c/dawn/+/195734
Reviewed-by: dan sinclair <dsinclair@chromium.org>
Commit-Queue: James Price <jrprice@google.com>
diff --git a/src/tint/lang/wgsl/ast/transform/builtin_polyfill.cc b/src/tint/lang/wgsl/ast/transform/builtin_polyfill.cc
index 3bb5320..6bfe939 100644
--- a/src/tint/lang/wgsl/ast/transform/builtin_polyfill.cc
+++ b/src/tint/lang/wgsl/ast/transform/builtin_polyfill.cc
@@ -71,10 +71,9 @@
                 node,  //
                 [&](const CallExpression* expr) { Call(expr); },
                 [&](const BinaryExpression* bin_op) {
-                    if (auto* s = src.Sem().Get(bin_op);
-                        !s || s->Stage() == core::EvaluationStage::kConstant ||
-                        s->Stage() == core::EvaluationStage::kNotEvaluated) {
-                        return;  // Don't polyfill @const expressions
+                    auto* s = src.Sem().Get(bin_op);
+                    if (!s || s->Stage() != core::EvaluationStage::kRuntime) {
+                        return;  // Only polyfill runtime expressions
                     }
                     switch (bin_op->op) {
                         case core::BinaryOp::kShiftLeft:
@@ -1301,9 +1300,8 @@
     /// Examines the call expression @p expr, applying any necessary polyfill transforms
     void Call(const CallExpression* expr) {
         auto* call = src.Sem().Get(expr)->UnwrapMaterialize()->As<sem::Call>();
-        if (!call || call->Stage() == core::EvaluationStage::kConstant ||
-            call->Stage() == core::EvaluationStage::kNotEvaluated) {
-            return;  // Don't polyfill @const expressions
+        if (!call || call->Stage() != core::EvaluationStage::kRuntime) {
+            return;  // Only polyfill runtime expressions
         }
         Symbol fn = Switch(
             call->Target(),  //
diff --git a/src/tint/lang/wgsl/ast/transform/builtin_polyfill_test.cc b/src/tint/lang/wgsl/ast/transform/builtin_polyfill_test.cc
index 53a9fc4..2d7cd41 100644
--- a/src/tint/lang/wgsl/ast/transform/builtin_polyfill_test.cc
+++ b/src/tint/lang/wgsl/ast/transform/builtin_polyfill_test.cc
@@ -45,10 +45,32 @@
     EXPECT_FALSE(ShouldRun<BuiltinPolyfill>(src));
 }
 
-TEST_F(BuiltinPolyfillTest, EmptyModule) {
-    auto* src = R"()";
+TEST_F(BuiltinPolyfillTest, ShouldRun_OverrideCall) {
+    auto* src = R"(
+override x = 42.123;
+override y = saturate(x);
+)";
 
-    EXPECT_FALSE(ShouldRun<BuiltinPolyfill>(src));
+    DataMap data;
+    BuiltinPolyfill::Builtins builtins;
+    builtins.saturate = true;
+    data.Add<BuiltinPolyfill::Config>(builtins);
+
+    EXPECT_FALSE(ShouldRun<BuiltinPolyfill>(src, data));
+}
+
+TEST_F(BuiltinPolyfillTest, ShouldRun_OverrideBinary) {
+    auto* src = R"(
+override v = 10i;
+override x = 20i / v;
+)";
+
+    DataMap data;
+    BuiltinPolyfill::Builtins builtins;
+    builtins.int_div_mod = true;
+    data.Add<BuiltinPolyfill::Config>(builtins);
+
+    EXPECT_FALSE(ShouldRun<BuiltinPolyfill>(src, data));
 }
 
 ////////////////////////////////////////////////////////////////////////////////