Closed
Bug 864858
Opened 8 years ago
Closed 8 years ago
nsSpeechTask gets destroyed prematurely causing a segmentation fault
Categories
(Core :: DOM: Core & HTML, defect)
Tracking
()
RESOLVED
FIXED
mozilla23
People
(Reporter: eeejay, Assigned: eeejay)
References
Details
Attachments
(1 file, 1 obsolete file)
In nsSpeechTask::DispatchEndImpl we call mSpeechSynthesis->OnEnd(this) which removes a reference to the nsSpeechTask object. If that is the only reference, then the next few lines that access members cause a segmentation fault.
Comment 2•8 years ago
|
||
Comment on attachment 740894 [details] [diff] [review] Put SpeechSynthesis::OnEnd() at end of DispatchEndImpl so that nsSpeechTask is not destroyed mid-method. I'd prefer if you did nsRefPtr<SpeechSynthesisUtterance> utterance = mUtterance; and then just set mState and DispatchSpeechSynthesisEvent on that one. (Better to have event dispatching happening as late as possible. It may have odd side effects, if event listeners do something unexpected) With that, r=me
Attachment #740894 -
Flags: review?(bugs) → review+
Assignee | ||
Comment 3•8 years ago
|
||
Attachment #740894 -
Attachment is obsolete: true
Assignee | ||
Comment 4•8 years ago
|
||
https://hg.mozilla.org/integration/mozilla-inbound/rev/f87f14e8949f
Comment 5•8 years ago
|
||
https://hg.mozilla.org/mozilla-central/rev/f87f14e8949f
Status: NEW → RESOLVED
Closed: 8 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla23
Updated•2 years ago
|
Component: DOM → DOM: Core & HTML
You need to log in
before you can comment on or make changes to this bug.
Description
•