Bug 259253

To reproduce, run these 3 tests back to back:

1. editing/input/cocoa/autocorrect-on.html
2. editing/pasteboard/paste-blockquote-1.html
3. editing/pasteboard/paste-does-not-fire-promises-while-sanitizing-web-content.html

Or more generally,

1. Run a test that installs the fake text checker on iOS.
2. Run any other layout test.
3. Run a layout test that shows an edit menu by tapping or selecting text.

...the test in (3) will crash with an overelease under something like:

```
Thread 0 Crashed::  Dispatch queue: com.apple.main-thread
0   libobjc.A.dylib                        0x1044e2280 objc_release + 16
1   WebKit                                 0x10d12abac WTF::RetainPtr<UITextChecker>::~RetainPtr() + 8 (RetainPtr.h:198) [inlined]
2   WebKit                                 0x10d12abac WTF::RetainPtr<UITextChecker>::~RetainPtr() + 8 (RetainPtr.h:196) [inlined]
…
10  WebKit                                 0x10d1226f8 WTF::HashMap<long long, WTF::RetainPtr<UITextChecker>, WTF::DefaultHash<long long>, WTF::HashTraits<long long>, WTF::HashTraits<WTF::RetainPtr<UITextChecker>>, WTF::HashTableTraits>::remove(long long const&) + 80 (HashMap.h:502) [inlined]
11  WebKit                                 0x10d1226f8 WebKit::TextChecker::closeSpellDocumentWithTag(long long) + 112 (TextCheckerIOS.mm:189)
12  WebKit                                 0x10d207594 WebKit::WebPageProxy::~WebPageProxy() + 264 (WebPageProxy.cpp:726)
13  WebKit                                 0x10ce7680c -[WKObject dealloc] + 64 (WKObject.mm:58)
```