chore: cherry-pick 902f0d144a5b from chromium (#35097)

* chore: cherry-pick 902f0d144a5b from chromium

* chore: update patches

* Trigger Build

Co-authored-by: PatchUp <73610968+patchup[bot]@users.noreply.github.com>
Co-authored-by: Electron Bot <electron@github.com>
Co-authored-by: John Kleinschmidt <jkleinsc@electronjs.org>

patches/chromium/.patches

@@ -136,4 +136,5 @@ remove_default_window_title.patch
 cherry-pick-d7a5d6b38ea8.patch
 cherry-pick-22abbad430b6.patch
 cherry-pick-3cbd5973d704.patch
+cherry-pick-902f0d144a5b.patch
 cherry-pick-664e0d8b4cfb.patch

patches/chromium/cherry-pick-902f0d144a5b.patch

@@ -0,0 +1,41 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Justin Novosad <junov@chromium.org>
+Date: Fri, 15 Jul 2022 23:12:50 +0000
+Subject: Mitigate bad cast in OffscreenCanvas::GetFontSelector
+
+This change will cause the browser to crash if the execution context
+is not a Window or WorkerGlobalScope.  This is a temporary solution
+to handle the case where the execution context is an
+AudioWorkletGlobalScope.  The longer term solution, which will be
+implemented in a follow-up CL, is to block OffscreenCanvas objects from
+being transferred to AudioWorklets, as required by the postMessage spec.
+
+BUG=1334864
+
+(cherry picked from commit 028c11e59fd41bc22eff06dbec10fe9b0e82bd04)
+
+Change-Id: Ief5e37eca6dff14098b12cdbe6fc362c3dd87d1d
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3722117
+Auto-Submit: Justin Novosad <junov@chromium.org>
+Reviewed-by: Juanmi Huertas <juanmihd@chromium.org>
+Commit-Queue: Juanmi Huertas <juanmihd@chromium.org>
+Cr-Original-Commit-Position: refs/heads/main@{#1017357}
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3752921
+Commit-Queue: Srinivas Sista <srinivassista@chromium.org>
+Cr-Commit-Position: refs/branch-heads/5005@{#1254}
+Cr-Branched-From: 5b4d9450fee01f821b6400e947b3839727643a71-refs/heads/main@{#992738}
+
+diff --git a/third_party/blink/renderer/core/offscreencanvas/offscreen_canvas.cc b/third_party/blink/renderer/core/offscreencanvas/offscreen_canvas.cc
+index 584920aad8a3bfd9f00bf0db99fdf1891b13176b..4625aec940a349e94f591e2b96801c99dcb3ef05 100644
+--- a/third_party/blink/renderer/core/offscreencanvas/offscreen_canvas.cc
++++ b/third_party/blink/renderer/core/offscreencanvas/offscreen_canvas.cc
+@@ -548,6 +548,9 @@ FontSelector* OffscreenCanvas::GetFontSelector() {
+   if (auto* window = DynamicTo<LocalDOMWindow>(GetExecutionContext())) {
+     return window->document()->GetStyleEngine().GetFontSelector();
+   }
++  // TODO(crbug.com/1334864): Temporary mitigation.  Remove the following
++  // CHECK once a more comprehensive solution has been implemented.
++  CHECK(GetExecutionContext()->IsWorkerGlobalScope());
+   return To<WorkerGlobalScope>(GetExecutionContext())->GetFontSelector();
+ }
+