[Live Caption] Fix data race bug in ChromeSpeechRecognitionClient.

Ensure that the disconnect handler which calls the caption host is
bound to the same thread. This fixes a data race bug found by
Clusterfuzz.

Bug: 1055150, 1116338
Change-Id: Idfaab83da0b918181bb1296c5e753a06bad388cc
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2359405Reviewed-by: Avi Drissman <avi@chromium.org>
Commit-Queue: Abigail Klein <abigailbklein@google.com>
Cr-Commit-Position: refs/heads/master@{#799350}

chrome/renderer/media/chrome_speech_recognition_client.cc

@@ -53,12 +53,9 @@ ChromeSpeechRecognitionClient::ChromeSpeechRecognitionClient(
       &ChromeSpeechRecognitionClient::SendAudioToSpeechRecognitionService,
       weak_factory_.GetWeakPtr()));
 
-  speech_recognition_context_.set_disconnect_handler(
+  speech_recognition_context_.set_disconnect_handler(media::BindToCurrentLoop(
       base::BindOnce(&ChromeSpeechRecognitionClient::OnRecognizerDisconnected,
-                     base::Unretained(this)));
-  speech_recognition_recognizer_.set_disconnect_handler(
-      base::BindOnce(&ChromeSpeechRecognitionClient::OnRecognizerDisconnected,
-                     base::Unretained(this)));
+                     weak_factory_.GetWeakPtr())));
   caption_host_.set_disconnect_handler(
       base::BindOnce(&ChromeSpeechRecognitionClient::OnCaptionHostDisconnected,
                      base::Unretained(this)));