chore: cherry-pick 2 changes from Release-0-M121

[ppontes]

electron/security#453 - cc07a95bc309 from chromium

Update rendering state of automatic pull nodes before graph rendering

In rare cases, the rendering fan out count of automatic pull node
does not match the main thread fan out count after recreating
a platform destination followed by disconnection.

This CL forces the update of the rendering state of automatic
pull nodes before graph rendering to make sure that fan out counts
are synchronized before executing the audio processing function call.

NOTE: This change makes 2 WPTs fail. The follow-up work is planned
to address them once this patch is merged.

(cherry picked from commit f4bffa09b46c21147431179e1e6dd2b27bc35fbc)

Bug: 1505080
Test: Locally confirmed that ASAN doesn't crash on all repro cases.
Change-Id: I6768cd8bc64525ea9d56a19b9c58439e9cdab9a8
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5131958
Reviewed-by: Michael Wilson mjwilson@chromium.org
Commit-Queue: Hongchan Choi hongchan@chromium.org
Cr-Original-Commit-Position: refs/heads/main@{#1246718}
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5214669
Auto-Submit: Hongchan Choi hongchan@chromium.org
Cr-Commit-Position: refs/branch-heads/6099@{#1833}
Cr-Branched-From: e6ee4500f7d6549a9ac1354f8d056da49ef406be-refs/heads/main@{#1217362}

Notes:

• Security: backported fix for CVE-2024-0807.
• Security: backported fix for 1407197.

[ckerr]

This has failed three times in the same spot:

not ok 567 security warnings "after each" hook for "should warn about Node.js integration with remote content"

Sample log: https://app.circleci.com/pipelines/github/electron/electron/77907/workflows/5ce2f81e-7d38-4796-9529-9e2cc861bd90/jobs/1663626?utm_campaign=vcs-integration-link&utm_medium=referral&utm_source=github-checks-link&utm_content=summary

@ppontes any idea whether this is a CI flake or if it could be caused by this backport?

[codebytere]

@ckerr this has flaked in other PRs to 26 - I wonder if #41045 was actually related to an issue in CircleCI and not that Chrome roll and should potentially be backported here 🤔

[release-clerk]

Release Notes Persisted

• Security: backported fix for CVE-2024-0807.
• Security: backported fix for 1407197.