Closed Bug 864858 Opened 7 years ago Closed 7 years ago
Speech Task gets destroyed prematurely causing a segmentation fault
In nsSpeechTask::DispatchEndImpl we call mSpeechSynthesis->OnEnd(this) which removes a reference to the nsSpeechTask object. If that is the only reference, then the next few lines that access members cause a segmentation fault.
Attachment #740894 - Flags: review?(bugs)
Comment on attachment 740894 [details] [diff] [review] Put SpeechSynthesis::OnEnd() at end of DispatchEndImpl so that nsSpeechTask is not destroyed mid-method. I'd prefer if you did nsRefPtr<SpeechSynthesisUtterance> utterance = mUtterance; and then just set mState and DispatchSpeechSynthesisEvent on that one. (Better to have event dispatching happening as late as possible. It may have odd side effects, if event listeners do something unexpected) With that, r=me
Attachment #740894 - Flags: review?(bugs) → review+
Status: NEW → RESOLVED
Closed: 7 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla23
You need to log in before you can comment on or make changes to this bug.