Fix use-after-free of m_currentSpeechUtterance.

Fix use-after-free of m_currentSpeechUtterance.

SpeechSynthesis.cpp incorrectly assumed that calling
m_platformSpeechSynthesizer->cancel() would immediately call
didFinishSpeaking or speakingErrorOccurred, which would null out
m_currentSpeechUtterance. This assumption was true in WebKit/Mac, but
Chromium's platform implementation is asynchronous, so that call may
come later.

Fix the issue and simplify the logic by getting rid of the raw pointer
to the current utterance altogether. Now the RefPtr at the front of the
utterance queue is the current utterance, and the platform implementation
is allowed to fire events on utterances that are no longer in the queue.

BUG=344881
R=abarth@chromium.org

Committed: https://src.chromium.org/viewvc/blink?view=rev&revision=168092

Committed: https://src.chromium.org/viewvc/blink?view=rev&revision=168169

Committed: https://src.chromium.org/viewvc/blink?view=rev&revision=168171

[abarth-chromium, 2014-02-26 06:27:28]

Please include a test, even if it only triggers under ASAN or only fails
occasionally.  Those sorts of tests are useful seeds for fuzzers.

[dmazzoni, 2014-02-26 08:06:46]

On 2014/02/26 06:27:28, abarth wrote:
> Please include a test, even if it only triggers under ASAN or only fails
> occasionally.  Those sorts of tests are useful seeds for fuzzers.

No problem. In order to get a layout test to crash, I modified the mock to
cancel an utterance asynchronously, the way Chromium does.

[abarth-chromium, 2014-02-26 18:57:33]

LGTM

Thanks for making the mock more like the real thing.

[dmazzoni, 2014-02-28 08:20:11]

Committed patchset #2 manually as r168092 (presubmit successful).

[apavlov, 2014-02-28 09:26:46]

A revert of this CL has been created in
https://codereview.chromium.org/184263003/ by apavlov@chromium.org.

The reason for reverting is: Linux build broken:

../../third_party/WebKit/Source/modules/speech/SpeechSynthesis.cpp:228:12:
error: cannot convert 'std::nullptr_t' to 'WebCore::SpeechSynthesisUtterance*'
in return.

[dmazzoni, 2014-02-28 23:42:13]

Committed patchset #4 manually as r168169 (presubmit successful).

[dmazzoni, 2014-02-28 23:51:05]

Committed patchset #4 manually as r168171 (tree was closed).