Use a per-frame task runner at PhishingDOMFeatureExtractorTest

This CL switches task runners at several places from per-thread to
per-frame. The purpose of this change is to make it possible to freeze
tasks for bfcache.

We found an actual case that JavaScript is executed:
browser_tests --gtest_filter=PhishingDOMFeatureExtractorTest.SubframeRemoval

Bug: 870606
Change-Id: I6135cb74f9a3aac7d6584c85dc7cb6734f0c69c4
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1529507Reviewed-by: Alexander Timin <altimin@chromium.org>
Reviewed-by: Varun Khaneja <vakh@chromium.org>
Commit-Queue: Hajime Hoshi <hajimehoshi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#644186}

chrome/renderer/safe_browsing/phishing_dom_feature_extractor_browsertest.cc

@@ -10,7 +10,6 @@
 #include "base/bind.h"
 #include "base/callback.h"
 #include "base/memory/weak_ptr.h"
-#include "base/threading/thread_task_runner_handle.h"
 #include "base/time/time.h"
 #include "chrome/renderer/chrome_content_renderer_client.h"
 #include "chrome/renderer/safe_browsing/features.h"
@@ -181,10 +180,12 @@ class PhishingDOMFeatureExtractorTest : public ChromeRenderViewTest {
   // Helper for the SubframeRemoval test that posts a message to remove
   // the iframe "frame1" from the document.
   void ScheduleRemoveIframe() {
-    base::ThreadTaskRunnerHandle::Get()->PostTask(
-        FROM_HERE,
-        base::BindOnce(&PhishingDOMFeatureExtractorTest::RemoveIframe,
-                       weak_factory_.GetWeakPtr()));
+    GetMainFrame()
+        ->GetTaskRunner(blink::TaskType::kInternalTest)
+        ->PostTask(
+            FROM_HERE,
+            base::BindOnce(&PhishingDOMFeatureExtractorTest::RemoveIframe,
+                           weak_factory_.GetWeakPtr()));
   }
 
  protected: