Fix crash if utterance is garbage-collected before speech ends.

Source/modules/speech/SpeechSynthesis.cpp

 /*
  * Copyright (C) 2013 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 134 matching lines @@
 
 void SpeechSynthesis::fireEvent(const AtomicString& type, SpeechSynthesisUtterance* utterance, unsigned long charIndex, const String& name)
 {
     if (!executionContext()->activeDOMObjectsAreStopped())
         utterance->dispatchEvent(SpeechSynthesisEvent::create(type, charIndex, (currentTime() - utterance->startTime()), name));
 }
 
 void SpeechSynthesis::handleSpeakingCompleted(SpeechSynthesisUtterance* utterance, bool errorOccurred)
 {
     ASSERT(utterance);
+    RefPtrWillBeRawPtr<SpeechSynthesisUtterance> protect(utterance);
 
     bool didJustFinishCurrentUtterance = false;
     // If the utterance that completed was the one we're currently speaking,
     // remove it from the queue and start speaking the next one.
     if (utterance == currentSpeechUtterance()) {
         m_utteranceQueue.removeFirst();

[eseidel, 2014/04/08 17:56:33]

How did this work before if "utterance" can be deleted here?

Seems like a fine fix, but the previous code looks obviously wrong?  I wonder if
we shouldn't name "protect" somehow differnetly to be explicit that "utterance"
could be the first in the queue.

         didJustFinishCurrentUtterance = true;
     }
 
     // Always fire the event, because the platform may have asynchronously
     // sent an event on an utterance before it got the message that we
     // canceled it, and we should always report to the user what actually
     // happened.
     fireEvent(errorOccurred ? EventTypeNames::error : EventTypeNames::end, utterance, 0, String());
 
     // Start the next utterance if we just finished one and one was pending.
@@ skipping 62 matching lines @@
     return EventTargetNames::SpeechSynthesisUtterance;
 }
 
 void SpeechSynthesis::trace(Visitor* visitor)
 {
     visitor->trace(m_voiceList);
     visitor->trace(m_utteranceQueue);
 }
 
 } // namespace WebCore