dawn_native: Use correct integer width for SetSubData.

SetSubData's count is a uint64_t while Queue::WriteBuffer's is a size_t
so we add a small validation check that no narrowing will occur.

No test is added because SetSubData will be removed soon, and it will be
hard to test because of the Null backend's artificial OOM.

This was found while debugging an unrelated fuzzer issue.

Bug: chromium:1099621
Change-Id: I27a9da2b94f51e889c5573f88d4a0a73fea5985c
Reviewed-on: https://dawn-review.googlesource.com/c/dawn/+/23961
Reviewed-by: Stephen White <senorblanco@chromium.org>
Reviewed-by: Austin Eng <enga@chromium.org>
Commit-Queue: Corentin Wallez <cwallez@chromium.org>
diff --git a/src/dawn_native/Buffer.cpp b/src/dawn_native/Buffer.cpp
index f4dc904..0e4c384 100644
--- a/src/dawn_native/Buffer.cpp
+++ b/src/dawn_native/Buffer.cpp
@@ -249,11 +249,15 @@
-    void BufferBase::SetSubData(uint32_t start, uint32_t count, const void* data) {
+    void BufferBase::SetSubData(uint64_t start, uint64_t count, const void* data) {
+        if (count > uint64_t(std::numeric_limits<size_t>::max())) {
+            GetDevice()->HandleError(InternalErrorType::Validation, "count too big");
+        }
         Ref<QueueBase> queue = AcquireRef(GetDevice()->GetDefaultQueue());
             "Buffer::SetSubData is deprecated, use Queue::WriteBuffer instead");
-        queue->WriteBuffer(this, start, data, count);
+        queue->WriteBuffer(this, start, data, static_cast<size_t>(count));
     void BufferBase::MapReadAsync(WGPUBufferMapReadCallback callback, void* userdata) {
diff --git a/src/dawn_native/Buffer.h b/src/dawn_native/Buffer.h
index ef9224a..c4f1d32 100644
--- a/src/dawn_native/Buffer.h
+++ b/src/dawn_native/Buffer.h
@@ -58,7 +58,7 @@
         MaybeError ValidateCanUseOnQueueNow() const;
         // Dawn API
-        void SetSubData(uint32_t start, uint32_t count, const void* data);
+        void SetSubData(uint64_t start, uint64_t count, const void* data);
         void MapReadAsync(WGPUBufferMapReadCallback callback, void* userdata);
         void MapWriteAsync(WGPUBufferMapWriteCallback callback, void* userdata);
         void* GetMappedRange();