Fix a raw pointer use-after-free in test runner

This patch clears the |last_requested_text_checking_completion_| raw
pointer in test runner's mock spellchecker after calling
DidCancelCheckingText() (which deletes itself), so that it won't be
reused after free via the RequestResolved() callback.

Bug: 749949
Change-Id: Id4f62ad4be7f94e65259fae0125223d7599e7257
Reviewed-on: https://chromium-review.googlesource.com/594837Reviewed-by: Kent Tamura <tkent@chromium.org>
Commit-Queue: Xiaocheng Hu <xiaochengh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#490839}

content/shell/test_runner/spell_check_client.cc

@@ -71,6 +71,7 @@ void SpellCheckClient::RequestCheckingOfText(
 
   if (last_requested_text_checking_completion_) {
     last_requested_text_checking_completion_->DidCancelCheckingText();
+    last_requested_text_checking_completion_ = nullptr;
     RequestResolved();
   }