This fixes two memory-safety bugs in the WebGPU (Metal) backend: a use-after-free of buffer storage in Queue::writeTexture’s no-copy path, and an integer-overflow in auto-generated pipeline-layout binding indices.

1. writeTexture no-copy: for a large upload it creates an MTLBuffer with newBufferWithBytesNoCopy that ALIASES the caller’s newData storage rather than copying it; the GPU reads that storage asynchronously. Pre-patch, newData was allowed to be destroyed when writeTexture returned, so the aliased storage could be freed while the GPU was still consuming it — a use-after-free of GPU-visible memory. The fix moves newData into a __block Vector<uint8_t> and releases it only in the command buffer’s addCompletedHandler, keeping the storage alive until the GPU has finished.
2. addPipelineLayouts array-length bindings: auto-generated ‘_ArrayLength’ bindings are placed at webBinding + limits().maxBindingsPerBindGroup to sit in a reserved range above user bindings; pre-patch this uint32 addition was unchecked, so a large webBinding could overflow and wrap the array-length binding index back down to ALIAS a real user binding, defeating the bounds check that separates array-length metadata from user bindings. The fix computes the bumped index with checkedSum<uint32_t> and rejects the layout (‘Binding index overflow in auto-generated layouts’) on overflow. The restored invariants are that no-copy GPU buffers keep their backing storage alive until the GPU is done, and that array-length binding indices cannot wrap to collide with user bindings.

Two memory-corruption bugs in the WebGPU (GPU-process) path reachable from WebGPU content: a use-after-free of GPU-visible buffer storage, and an integer-overflow that aliases an array-length binding onto a user binding. The advisory rates it memory corruption; both are controllable primitives in the graphics path.