[wire] Reject mappedAtCreation in CreateErrorBuffer

The wire client already blocks mappedAtCreation in CreateErrorBuffer,
because it's complicated to implement but has no existing use case.

Thus, block it in the wire server too (with a WireResult::FatalError) to
prevent fuzzers from finding crashes due to the native CreateErrorBuffer
returning nullptr (because it OOMed during map-at-creation).

This fixes all three fuzzer cases associated with the bugs below.

No tests added because (AFAICT) there are no tests that can provide
custom input to the wire server (without using the wire client).

Fixed: 406043685, 415199303, 406804858
Change-Id: If4dd76d49283be9d28924a95e81c85c770fae293
Reviewed-on: https://dawn-review.googlesource.com/c/dawn/+/241935
Commit-Queue: Kai Ninomiya <kainino@chromium.org>
Reviewed-by: Loko Kung <lokokung@google.com>

src/dawn/dawn_wire.json

diff --git a/src/dawn/dawn_wire.json b/src/dawn/dawn_wire.json
index aeceb9b..1706cb2 100644
--- a/src/dawn/dawn_wire.json
+++ b/src/dawn/dawn_wire.json
@@ -315,6 +315,7 @@
             "ComputePassEncoder"
         ],
         "server_custom_pre_handler_commands": [
+            "DeviceCreateErrorBuffer",
             "BufferDestroy",
             "BufferUnmap"
         ]

src/dawn/wire/server/ServerBuffer.cpp

diff --git a/src/dawn/wire/server/ServerBuffer.cpp b/src/dawn/wire/server/ServerBuffer.cpp
index c802221..0e61d4c 100644
--- a/src/dawn/wire/server/ServerBuffer.cpp
+++ b/src/dawn/wire/server/ServerBuffer.cpp
@@ -37,6 +37,16 @@
 
 namespace dawn::wire::server {
 
+WireResult Server::PreHandleDeviceCreateErrorBuffer(const DeviceCreateErrorBufferCmd& cmd) {
+    // mappedAtCreation isn't implemented in CreateErrorBuffer.
+    // The client blocks this, so we can treat it as a fatal wire error (for fuzzers).
+    if (cmd.descriptor->mappedAtCreation) {
+        return WireResult::FatalError;
+    }
+
+    return WireResult::Success;
+}
+
 WireResult Server::PreHandleBufferUnmap(const BufferUnmapCmd& cmd) {
     Known<WGPUBuffer> buffer;
     WIRE_TRY(Objects<WGPUBuffer>().Get(cmd.selfId, &buffer));