Fix use-after-free of m_currentSpeechUtterance.

SpeechSynthesis.cpp incorrectly assumed that calling
m_platformSpeechSynthesizer->cancel() would immediately call
didFinishSpeaking or speakingErrorOccurred, which would null out
m_currentSpeechUtterance. This assumption was true in WebKit/Mac, but
Chromium's platform implementation is asynchronous, so that call may
come later.

Fix the issue and simplify the logic by getting rid of the raw pointer
to the current utterance altogether. Now the RefPtr at the front of the
utterance queue is the current utterance, and the platform implementation
is allowed to fire events on utterances that are no longer in the queue.

BUG=344881
R=abarth@chromium.org

Committed: https://src.chromium.org/viewvc/blink?view=rev&revision=168092

Review URL: https://codereview.chromium.org/180553004

git-svn-id: svn://svn.chromium.org/blink/trunk@168169 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Revert 168169 "Fix use-after-free of m_currentSpeechUtterance."

Wrong merge base when committing!

> Fix use-after-free of m_currentSpeechUtterance.
> 
> SpeechSynthesis.cpp incorrectly assumed that calling
> m_platformSpeechSynthesizer->cancel() would immediately call
> didFinishSpeaking or speakingErrorOccurred, which would null out
> m_currentSpeechUtterance. This assumption was true in WebKit/Mac, but
> Chromium's platform implementation is asynchronous, so that call may
> come later.
> 
> Fix the issue and simplify the logic by getting rid of the raw pointer
> to the current utterance altogether. Now the RefPtr at the front of the
> utterance queue is the current utterance, and the platform implementation
> is allowed to fire events on utterances that are no longer in the queue.
> 
> BUG=344881
> R=abarth@chromium.org
> 
> Committed: https://src.chromium.org/viewvc/blink?view=rev&revision=168092
> 
> Review URL: https://codereview.chromium.org/180553004

TBR=dmazzoni@google.com

Review URL: https://codereview.chromium.org/185093002

git-svn-id: svn://svn.chromium.org/blink/trunk@168170 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Fix use-after-free of m_currentSpeechUtterance.

SpeechSynthesis.cpp incorrectly assumed that calling
m_platformSpeechSynthesizer->cancel() would immediately call
didFinishSpeaking or speakingErrorOccurred, which would null out
m_currentSpeechUtterance. This assumption was true in WebKit/Mac, but
Chromium's platform implementation is asynchronous, so that call may
come later.

Fix the issue and simplify the logic by getting rid of the raw pointer
to the current utterance altogether. Now the RefPtr at the front of the
utterance queue is the current utterance, and the platform implementation
is allowed to fire events on utterances that are no longer in the queue.

BUG=344881
R=abarth@chromium.org

Committed: https://src.chromium.org/viewvc/blink?view=rev&revision=168092

Committed: https://src.chromium.org/viewvc/blink?view=rev&revision=168169

Review URL: https://codereview.chromium.org/180553004

git-svn-id: svn://svn.chromium.org/blink/trunk@168171 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Fix generic font family issue on Android

- standard font family should go Android path on Android;
- for non-generic font families, familyNameFromSettings should return
  an empty AtomicString.

BUG=347121
TEST=platform/android/fast/text/international/non-generic-font-fallback.html
R=dglazkov@chromium.org

Review URL: https://codereview.chromium.org/184703003

git-svn-id: svn://svn.chromium.org/blink/trunk@168173 bbb929c8-8fbe-4397-9dbb-9b2b20218538