Migrate TextSuggestionController to use GC mojo wrappers.

No behavior change. This CL reduces potential risks of use-after-free bugs.

Bug: 1049056
Change-Id: I65ca59280e0c913bdb18eef57c9aeaa621f6adc4
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2147480Reviewed-by: Kouhei Ueno <kouhei@chromium.org>
Commit-Queue: Minoru Chikamune <chikamune@chromium.org>
Cr-Commit-Position: refs/heads/master@{#758729}

third_party/blink/renderer/core/editing/suggestion/text_suggestion_controller.cc

@@ -20,6 +20,7 @@
 #include "third_party/blink/renderer/core/editing/spellcheck/spell_checker.h"
 #include "third_party/blink/renderer/core/editing/suggestion/text_suggestion_info.h"
 #include "third_party/blink/renderer/core/frame/frame_view.h"
+#include "third_party/blink/renderer/core/frame/local_dom_window.h"
 #include "third_party/blink/renderer/core/frame/local_frame.h"
 #include "third_party/blink/renderer/core/frame/settings.h"
 #include "third_party/blink/renderer/core/layout/layout_theme.h"
@@ -193,7 +194,9 @@ SuggestionInfosWithNodeAndHighlightColor ComputeSuggestionInfos(
 }  // namespace
 
 TextSuggestionController::TextSuggestionController(LocalFrame& frame)
-    : is_suggestion_menu_open_(false), frame_(&frame) {}
+    : is_suggestion_menu_open_(false),
+      frame_(&frame),
+      text_suggestion_host_(frame.DomWindow()) {}
 
 void TextSuggestionController::DidAttachDocument(Document* document) {
   DCHECK(document);
@@ -243,9 +246,10 @@ void TextSuggestionController::HandlePotentialSuggestionTap(
   if (marker && marker->Suggestions().IsEmpty())
     return;
 
-  if (!text_suggestion_host_) {
+  if (!text_suggestion_host_.is_bound()) {
     GetFrame().GetBrowserInterfaceBroker().GetInterface(
-        text_suggestion_host_.BindNewPipeAndPassReceiver());
+        text_suggestion_host_.BindNewPipeAndPassReceiver(
+            GetFrame().GetTaskRunner(TaskType::kMiscPlatformAPI)));
   }
 
   text_suggestion_host_->StartSuggestionMenuTimer();
@@ -253,6 +257,7 @@ void TextSuggestionController::HandlePotentialSuggestionTap(
 
 void TextSuggestionController::Trace(Visitor* visitor) {
   visitor->Trace(frame_);
+  visitor->Trace(text_suggestion_host_);
   ExecutionContextLifecycleObserver::Trace(visitor);
 }
 

third_party/blink/renderer/core/editing/suggestion/text_suggestion_controller.h

@@ -6,7 +6,6 @@
 #define THIRD_PARTY_BLINK_RENDERER_CORE_EDITING_SUGGESTION_TEXT_SUGGESTION_CONTROLLER_H_
 
 #include <utility>
-#include "mojo/public/cpp/bindings/remote.h"
 #include "third_party/blink/public/mojom/input/input_host.mojom-blink.h"
 #include "third_party/blink/renderer/core/core_export.h"
 #include "third_party/blink/renderer/core/dom/document.h"
@@ -14,6 +13,8 @@
 #include "third_party/blink/renderer/core/editing/markers/document_marker.h"
 #include "third_party/blink/renderer/core/execution_context/execution_context_lifecycle_observer.h"
 #include "third_party/blink/renderer/platform/heap/handle.h"
+#include "third_party/blink/renderer/platform/mojo/heap_mojo_remote.h"
+#include "third_party/blink/renderer/platform/mojo/heap_mojo_wrapper_mode.h"
 
 namespace blink {
 
@@ -78,7 +79,9 @@ class CORE_EXPORT TextSuggestionController final
 
   bool is_suggestion_menu_open_;
   const Member<LocalFrame> frame_;
-  mojo::Remote<mojom::blink::TextSuggestionHost> text_suggestion_host_;
+  HeapMojoRemote<mojom::blink::TextSuggestionHost,
+                 HeapMojoWrapperMode::kWithoutContextObserver>
+      text_suggestion_host_;
 
   DISALLOW_COPY_AND_ASSIGN(TextSuggestionController);
 };

third_party/blink/renderer/core/editing/suggestion/text_suggestion_controller_test.cc

@@ -25,7 +25,7 @@ class TextSuggestionControllerTest : public EditingTestBase {
     return bool(GetDocument()
                     .GetFrame()
                     ->GetTextSuggestionController()
-                    .text_suggestion_host_);
+                    .text_suggestion_host_.is_bound());
   }
 
   void ShowSuggestionMenu(