Fix crash if utterance is garbage-collected before speech ends.

Source/modules/speech/SpeechSynthesis.cpp

 /*
  * Copyright (C) 2013 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 136 matching lines @@
 {
     if (!executionContext()->activeDOMObjectsAreStopped())
         utterance->dispatchEvent(SpeechSynthesisEvent::create(type, charIndex, (currentTime() - utterance->startTime()), name));
 }
 
 void SpeechSynthesis::handleSpeakingCompleted(SpeechSynthesisUtterance* utterance, bool errorOccurred)
 {
     ASSERT(utterance);
 
     bool didJustFinishCurrentUtterance = false;
+    RefPtr<SpeechSynthesisUtterance> saveFirstUtterance;

[sof, 2014/04/08 08:16:04]

Wouldn't

   RefPtrWillBeRawPtr<SpeechSynthesisUtterance> protect(utterance);

be equivalent? i.e., protect the utterance across the event dispatch.

     // If the utterance that completed was the one we're currently speaking,
     // remove it from the queue and start speaking the next one.
     if (utterance == currentSpeechUtterance()) {
+        saveFirstUtterance = m_utteranceQueue.first();
         m_utteranceQueue.removeFirst();
         didJustFinishCurrentUtterance = true;
     }
 
     // Always fire the event, because the platform may have asynchronously
     // sent an event on an utterance before it got the message that we
     // canceled it, and we should always report to the user what actually
     // happened.
     fireEvent(errorOccurred ? EventTypeNames::error : EventTypeNames::end, utterance, 0, String());
 
@@ skipping 63 matching lines @@
     return EventTargetNames::SpeechSynthesisUtterance;
 }
 
 void SpeechSynthesis::trace(Visitor* visitor)
 {
     visitor->trace(m_voiceList);
     visitor->trace(m_utteranceQueue);
 }
 
 } // namespace WebCore