chore: cherry-pick 4 changes from Release-0-M115

[VerteDinde]

electron/security#374 - 933b9fad3a53 from chromium

Reland "ipcz: Refactor FragmentDescriptor decode"

This is a reland of commit 17dd18d1f2194089b8433e0ca334c81343b591e2

Original change's description:

ipcz: Refactor FragmentDescriptor decode

Funnels untrusted FragmentDescriptor mapping through a new
Fragment::MappedFromDescriptor helper. See the linked bug
for more details.

Fixed: 1450899
Change-Id: I4c7751b9f4299da4a13c0becc1b889160a0c6e66
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4599218
Reviewed-by: Daniel Cheng dcheng@chromium.org
Commit-Queue: Ken Rockot rockot@google.com
Cr-Commit-Position: refs/heads/main@{#1155133}

Change-Id: I86ee9118a30dea59d837c377a1f751b20a85a3c3
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4602794
Reviewed-by: Daniel Cheng dcheng@chromium.org
Commit-Queue: Ken Rockot rockot@google.com
Cr-Commit-Position: refs/heads/main@{#1155397}

electron/security#372 - b03973561862 from chromium

[M116] Make RTCDataChannel's channel and observer pointers const.

This allows channel properties to be queried while the RTCDataChannel
instance exists and avoids potential null deref after entering the
kClosed state.

(cherry picked from commit 08d5ad011f53a1995bfccef6728bfa62541f7608)

Bug: 1456567, 1457421
Change-Id: I4747f9c00804b35711667d7320ec6188f20910c4
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4663082
Commit-Queue: Tomas Gunnarsson tommi@chromium.org
Reviewed-by: Elad Alon eladalon@chromium.org
Cr-Original-Commit-Position: refs/heads/main@{#1165406}
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4665530
Cr-Commit-Position: refs/branch-heads/5845@{#300}
Cr-Branched-From: 5a5dff63a4a4c63b9b18589819bebb2566c85443-refs/heads/main@{#1160321}

electron/security#373 - c60a1ab717c7 from chromium

Fix UAF when exiting a nested run loop in TabDragContextImpl::OnGestureEvent.

OnGestureEvent may call ContinueDrag, which may run a nested run loop. After the nested run loop returns, multiple seconds of time may have passed, and the world may be in a very different state; in particular, the window that contains this TabDragContext may have closed.

This CL checks if this has happened, and returns early in that case.

(cherry picked from commit 63d6b8ba8126b16215d33670df8c67dcbc6c9bef)

Bug: 1453465
Change-Id: I6095c0afeb5aa5f422717f1bbd93b96175e52afa
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4657527
Reviewed-by: Darryl James dljames@chromium.org
Commit-Queue: Taylor Bergquist tbergquist@chromium.org
Code-Coverage: Findit findit-for-me@appspot.gserviceaccount.com
Cr-Original-Commit-Position: refs/heads/main@{#1164449}
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4676126
Reviewed-by: Shibalik Mohapatra shibalik@chromium.org
Cr-Commit-Position: refs/branch-heads/5845@{#410}
Cr-Branched-From: 5a5dff63a4a4c63b9b18589819bebb2566c85443-refs/heads/main@{#1160321}

Notes:

• Security: backported fix for CVE-2023-3732.
• Security: backported fix for CVE-2023-3728.
• Security: backported fix for CVE-2023-3730.

[release-clerk]

Release Notes Persisted

• Security: backported fix for CVE-2023-3732.
• Security: backported fix for CVE-2023-3728.
• Security: backported fix for CVE-2023-3730.