[Backport] CVE-2023-2134: Out of bounds memory access in Service Worker API

Cherry-pick of patch originally reviewed on
https://chromium-review.googlesource.com/c/chromium/src/+/4406580:
Stop supporting { handleEvent }.

M108 merge issues:
  content_unittests_bundle_data.filelist:
    Not present in 108, skipped; Only used in iOS tests on main

Make the code aligned with the following specification update:
w3c/ServiceWorker#1676

With the previous specification and code, event listener vector
can be modified during the GetEffectiveFunction execution, which may
bring unexpected vector state.

(cherry picked from commit 5105ce37a6853d52ec97894bf6969b3c29a23afd)

Change-Id: I732c4c9ab2caebc49a7f4ef52640df7b8476d838
Bug: 1429201
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4394402
Commit-Queue: Yoshisato Yanagisawa <[email protected]>
Cr-Original-Commit-Position: refs/heads/main@{#1126483}
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4406580
Commit-Queue: Roger Felipe Zanoni da Silva <[email protected]>
Reviewed-by: Yoshisato Yanagisawa <[email protected]>
Cr-Commit-Position: refs/branch-heads/5359@{#1449}
Cr-Branched-From: 27d3765d341b09369006d030f83f582a29eb57ae-refs/heads/main@{#1058933}
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/474621
Reviewed-by: Allan Sandfeld Jensen <[email protected]>

Author: yoshisatoyanagisawa

chromium/third_party/blink/renderer/modules/service_worker/service_worker_global_scope.cc

@@ -2604,16 +2604,16 @@ ServiceWorkerGlobalScope::FetchHandlerType() {
   }
 
   ScriptState* script_state = ScriptController()->GetScriptState();
-  // Do not remove this, |scope| is needed by `GetEffectiveFunction`.
+  // Do not remove this, |scope| is needed by `GetListenerObject`.
   ScriptState::Scope scope(script_state);
 
   // TODO(crbug.com/1349613): revisit the way to implement this.
   // The following code returns kEmptyFetchHandler if all handlers are nop.
   for (RegisteredEventListener& e : *elv) {
     EventTarget* et = EventTarget::Create(script_state);
     v8::Local<v8::Value> v =
-        To<JSBasedEventListener>(e.Callback())->GetEffectiveFunction(*et);
-    if (!v->IsFunction() ||
+        To<JSBasedEventListener>(e.Callback())->GetListenerObject(*et);
+    if (v.IsEmpty() || !v->IsFunction() ||
         !v.As<v8::Function>()->Experimental_IsNopFunction()) {
       return mojom::blink::ServiceWorkerFetchHandlerType::kNotSkippable;
     }