Fix crash if utterance is garbage-collected before speech ends.

Source/modules/speech/SpeechSynthesis.cpp

Index: Source/modules/speech/SpeechSynthesis.cpp
diff --git a/Source/modules/speech/SpeechSynthesis.cpp b/Source/modules/speech/SpeechSynthesis.cpp
index 00b60091d8d97ef02dbd8da2764236da39ca1907..817811cdf8d653fe50495aed381826fc8ff80575 100644
--- a/Source/modules/speech/SpeechSynthesis.cpp
+++ b/Source/modules/speech/SpeechSynthesis.cpp
@@ -154,9 +154,11 @@ void SpeechSynthesis::handleSpeakingCompleted(SpeechSynthesisUtterance* utteranc
     ASSERT(utterance);
 
     bool didJustFinishCurrentUtterance = false;
+    RefPtr<SpeechSynthesisUtterance> saveFirstUtterance;

[sof, 2014/04/08 08:16:04]

Wouldn't

   RefPtrWillBeRawPtr<SpeechSynthesisUtterance> protect(utterance);

be equivalent? i.e., protect the utterance across the event dispatch.

     // If the utterance that completed was the one we're currently speaking,
     // remove it from the queue and start speaking the next one.
     if (utterance == currentSpeechUtterance()) {
+        saveFirstUtterance = m_utteranceQueue.first();
         m_utteranceQueue.removeFirst();
         didJustFinishCurrentUtterance = true;
     }