Open Radar

 
Application can trigger a crash using NSSpeechSynthesizer with a high speech rate and a Nuance voice.

Steps to Reproduce:

You can trigger this in the current stable version of Google Chrome by installing TTS Demo from this link: https://chrome.google.com/webstore/detail/tts-demo/chhkejkkcghanjclmhhpncachhgejoel?utm_source=chrome-ntp-launcher - set the system default voice to Samantha, set the speech rate to about 50%, and press Speak a couple of times until it crashes.

These factors trigger it:

* A NSSpeechSynthesizerDelegate is used that listens to willSpeakWord
* The speech rate is high (try 900)
* The voice used is from Nuance (try Samantha)
* The NSString passed to startSpeakingString is not retained.

The problem seems to be that the speech synthesizer should be retaining the string in order to pass it to willSpeakWord, but it's not - so when the string is deleted, it triggers a crash.

Retaining the NSString passed to startSpeakingString for the duration of the utterance fixes the problem.

The high speech rate may be a red herring. It probably affects the timing of when the word callbacks are generated relative to when the NSString is released from Chrome's release pool.