864858 - nsSpeechTask gets destroyed prematurely causing a segmentation fault

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect)

Description

[Eitan Isaacson [:eeejay]]

In nsSpeechTask::DispatchEndImpl we call mSpeechSynthesis->OnEnd(this) which removes a reference to the nsSpeechTask object. If that is the only reference, then the next few lines that access members cause a segmentation fault.

Comment 1

[Eitan Isaacson [:eeejay]]

Attachment: Put SpeechSynthesis::OnEnd() at end of DispatchEndImpl so that nsSpeechTask is not destroyed mid-method.

Tests pass.

Comment 2

[Olli Pettay [:smaug][[e-mail]]]

Comment on attachment 740894 [details] [diff] [review]
Put SpeechSynthesis::OnEnd() at end of DispatchEndImpl so that nsSpeechTask is not destroyed mid-method.

I'd prefer if you did
nsRefPtr<SpeechSynthesisUtterance> utterance = mUtterance; and then
just set mState and DispatchSpeechSynthesisEvent on that one.
(Better to have event dispatching happening as late as possible. It
may have odd side effects, if event listeners do something unexpected)

With that, r=me

Comment 3

[Eitan Isaacson [:eeejay]]

Attachment: Bug 864858 - Hold a reference to utterance before nsSpeechTask goes away in DispatchEndImpl() r=smaug

Comment 4

[Eitan Isaacson [:eeejay]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/f87f14e8949f

Comment 5

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/f87f14e8949f