[Mac Text Subs] Ignore out-of-order text substitutions

This cl forces the web contents to ignore any incoming text
correction that appies to an older version of the web contents's
text, avoiding a crash.

Bug: 372217922
Change-Id: Iaf502a04af58fba395cadc12652ddd6ccaed520c
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/6299632
Commit-Queue: Jayson Adams <shrike@chromium.org>
Reviewed-by: Leonard Grey <lgrey@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1427904}

content/app_shim_remote_cocoa/render_widget_host_view_cocoa.mm

@@ -290,7 +290,7 @@ void ExtractUnderlines(NSAttributedString* string,
   // full string in the renderer.
   std::u16string _availableText;
   size_t _availableTextOffset;
-  NSUInteger _availableTextChangeCounter;
+  NSUInteger _availableTextChangeNumber;
   gfx::Range _textSelectionRange;
 
   // The composition range, cached from the RenderWidgetHostView. This is only
@@ -480,7 +480,7 @@ void ExtractUnderlines(NSAttributedString* string,
   NSRect textRectInViewCoordinates =
       [self convertRect:textRectInWindowCoordinates fromView:nil];
 
-  NSUInteger capturedChangeCounter = _availableTextChangeCounter;
+  NSUInteger capturedChangeNumber = _availableTextChangeNumber;
 
   [self.spellChecker
       showCorrectionIndicatorOfType:NSCorrectionIndicatorTypeDefault
@@ -491,7 +491,7 @@ void ExtractUnderlines(NSAttributedString* string,
                   completionHandler:^(NSString* acceptedString) {
                     [self didAcceptReplacementString:acceptedString
                                forTextCheckingResult:candidateResult
-                                    withChangeNumber:capturedChangeCounter];
+                                    withChangeNumber:capturedChangeNumber];
                   }];
 }
 
@@ -503,8 +503,11 @@ void ExtractUnderlines(NSAttributedString* string,
   // Call it to report whether they initially accepted or rejected the
   // suggestion, but also if they edit, revert, etc. later.
 
-  if (acceptedString == nil)
+  // Exit if there's no replacement string, or if the web contents changed
+  // in between our spell checker request and this response.
+  if (acceptedString == nil || _availableTextChangeNumber != changeNumber) {
     return;
+  }
 
   NSRange availableTextRange =
       NSMakeRange(_availableTextOffset, _availableText.length());
@@ -528,18 +531,6 @@ void ExtractUnderlines(NSAttributedString* string,
                                                      language:nil])
       return;
 
-    // Gather some info in case -doubleClickAtIndex: throws an exception.
-    // This change will eventually be reverted.
-    NSString* info = [NSString
-        stringWithFormat:@"%lu == %lu %lu %@ %@ %@ %@", changeNumber,
-                         _availableTextChangeCounter, attString.string.length,
-                         NSStringFromRange(availableTextRange),
-                         NSStringFromRange(correction.range),
-                         NSStringFromRange(trailingRange),
-                         NSStringFromRange(trailingRangeInAvailableText)];
-    SCOPED_CRASH_KEY_STRING256("RenderWidgetHostViewCocoa", "didAcceptTR",
-                               base::SysNSStringToUTF8(info));
-
     if ([attString doubleClickAtIndex:trailingRangeInAvailableText.location]
             .location < trailingRangeInAvailableText.location)
       return;
@@ -660,7 +651,7 @@ void ExtractUnderlines(NSAttributedString* string,
                        range:(gfx::Range)range {
   _availableText = text;
   _availableTextOffset = offset;
-  _availableTextChangeCounter++;
+  _availableTextChangeNumber++;
   _textSelectionRange = range;
   _substitutionWasApplied = NO;
   [NSSpellChecker.sharedSpellChecker dismissCorrectionIndicatorForView:self];