Fix use-after-free of m_currentSpeechUtterance.

Source/modules/speech/testing/PlatformSpeechSynthesizerMock.cpp

 /*
  * Copyright (C) 2013 Apple Computer, Inc.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 24 matching lines @@
 {
     OwnPtr<PlatformSpeechSynthesizerMock> synthesizer = adoptPtr(new PlatformSpeechSynthesizerMock(client));
     synthesizer->initializeVoiceList();
     client->voicesDidChange();
     return synthesizer.release();
 }
 
 PlatformSpeechSynthesizerMock::PlatformSpeechSynthesizerMock(PlatformSpeechSynthesizerClient* client)
     : PlatformSpeechSynthesizer(client)
     , m_speakingFinishedTimer(this, &PlatformSpeechSynthesizerMock::speakingFinished)
+    , m_speakingErrorOccurredTimer(this, &PlatformSpeechSynthesizerMock::speakingErrorOccurred)
 {
 }
 
 PlatformSpeechSynthesizerMock::~PlatformSpeechSynthesizerMock()
 {
     m_speakingFinishedTimer.stop();
+    m_speakingErrorOccurredTimer.stop();
 }
 
 void PlatformSpeechSynthesizerMock::speakingFinished(Timer<PlatformSpeechSynthesizerMock>*)
 {
     ASSERT(m_utterance.get());
     client()->didFinishSpeaking(m_utterance);
     m_utterance = nullptr;
 }
 
+void PlatformSpeechSynthesizerMock::speakingErrorOccurred(Timer<PlatformSpeechSynthesizerMock>*)
+{
+    ASSERT(m_utterance.get());
+    client()->speakingErrorOccurred(m_utterance);
+    m_utterance = nullptr;
+}
+
 void PlatformSpeechSynthesizerMock::initializeVoiceList()
 {
     m_voiceList.clear();
     m_voiceList.append(PlatformSpeechSynthesisVoice::create(String("mock.voice.bruce"), String("bruce"), String("en-US"), true, true));
     m_voiceList.append(PlatformSpeechSynthesisVoice::create(String("mock.voice.clark"), String("clark"), String("en-US"), true, false));
     m_voiceList.append(PlatformSpeechSynthesisVoice::create(String("mock.voice.logan"), String("logan"), String("fr-CA"), true, true));
 }
 
 void PlatformSpeechSynthesizerMock::speak(PassRefPtr<PlatformSpeechSynthesisUtterance> utterance)
 {
     ASSERT(!m_utterance);
     m_utterance = utterance;
     client()->didStartSpeaking(m_utterance);
 
     // Fire a fake word and then sentence boundary event.
     client()->boundaryEventOccurred(m_utterance, SpeechWordBoundary, 0);
     client()->boundaryEventOccurred(m_utterance, SpeechSentenceBoundary, m_utterance->text().length());
 
     // Give the fake speech job some time so that pause and other functions have time to be called.
     m_speakingFinishedTimer.startOneShot(.1);
 }
 
 void PlatformSpeechSynthesizerMock::cancel()
 {
     if (!m_utterance)
         return;
 
     m_speakingFinishedTimer.stop();
-    client()->speakingErrorOccurred(m_utterance);
-    m_utterance = nullptr;
+    m_speakingErrorOccurredTimer.startOneShot(.1);
 }
 
 void PlatformSpeechSynthesizerMock::pause()
 {
     client()->didPauseSpeaking(m_utterance);
 }
 
 void PlatformSpeechSynthesizerMock::resume()
 {
     client()->didResumeSpeaking(m_utterance);
 }
 
 
 } // namespace WebCore