[Backport] Security bug 378541479

Cherry-pick of patch originally reviewed on
https://dawn-review.googlesource.com/c/dawn/+/214514:
IR: Fix robustness transform on textureLoad of sampled and depth textures

For sampled and depth textures, which contain a 'level' argument, the
robustness transform is supposed to clamp 'coords' using the dimensions
at the clamped level, but it was looking up dimensions at level 0
instead.

Bug: 42250751
Bug: 42251045
Bug: 378541479
Change-Id: I0e7fd6148417b248a9b584ae19818e9027306b63
Reviewed-on: https://dawn-review.googlesource.com/c/dawn/+/214514
Reviewed-by: James Price <jrprice@google.com>
Commit-Queue: dan sinclair <dsinclair@chromium.org>
Commit-Queue: James Price <jrprice@google.com>
Auto-Submit: Antonio Maiorano <amaiorano@google.com>
Reviewed-by: dan sinclair <dsinclair@chromium.org>
Reviewed-on: https://dawn-review.googlesource.com/c/dawn/+/215154
Commit-Queue: David Neto <dneto@google.com>
Reviewed-by: David Neto <dneto@google.com>
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/611745
Reviewed-by: Anu Aliyas <anu.aliyas@qt.io>

Author: amaiorano

chromium/third_party/dawn/src/tint/lang/core/ir/transform/robustness.cc

@@ -309,14 +309,14 @@ struct State {
                 break;
             }
             case core::BuiltinFn::kTextureLoad: {
-                clamp_coords(1u);
                 uint32_t next_arg = 2u;
                 if (type::IsTextureArray(texture->Dim())) {
                     clamp_array_index(next_arg++);
                 }
                 if (texture->IsAnyOf<type::SampledTexture, type::DepthTexture>()) {
                     clamp_level(next_arg++);
                 }
+                clamp_coords(1u);  // Must run after clamp_level
                 break;
             }
             case core::BuiltinFn::kTextureStore: {