angler-fishThe Vulnerability History Project

Revert of Fix use-after-free of m_currentSpeechUtterance. (https://codereview.chromium.org/180553004/)

      Reason for revert:
Linux build broken:

../../third_party/WebKit/Source/modules/speech/SpeechSynthesis.cpp:228:12: error: cannot convert 'std::nullptr_t' to 'WebCore::SpeechSynthesisUtterance*' in return

Original issue's description:
> Fix use-after-free of m_currentSpeechUtterance.
> 
> SpeechSynthesis.cpp incorrectly assumed that calling
> m_platformSpeechSynthesizer->cancel() would immediately call
> didFinishSpeaking or speakingErrorOccurred, which would null out
> m_currentSpeechUtterance. This assumption was true in WebKit/Mac, but
> Chromium's platform implementation is asynchronous, so that call may
> come later.
> 
> Fix the issue and simplify the logic by getting rid of the raw pointer
> to the current utterance altogether. Now the RefPtr at the front of the
> utterance queue is the current utterance, and the platform implementation
> is allowed to fire events on utterances that are no longer in the queue.
> 
> BUG=344881
> R=abarth@chromium.org
> 
> Committed: https://src.chromium.org/viewvc/blink?view=rev&revision=168092

TBR=abarth@chromium.org,dmazzoni@chromium.org
NOTREECHECKS=true
NOTRY=true
BUG=344881

Review URL: https://codereview.chromium.org/184263003

git-svn-id: svn://svn.chromium.org/blink/trunk@168111 bbb929c8-8fbe-4397-9dbb-9b2b20218538
    
commit 32b9ab614955db0399634301094e13cdc1910da5
+9
+25
+33 -28
+4 -2
+10 -2
+2
expand_less