Brave crashes during text-to-speech when `speak selection` is activated

Description

Brave crashes during text-to-speech when speak selection is activated

Steps to Reproduce

1. navigate to Apple menu -> System Preferences -> Accessibility -> Spoken Content
2. select Speak selection
3. click on Options...
4. change the Keyboard shortcut to something easy, like Control+=
5. open Gmail
6. compose a new message
7. enter enough text that you get a scrollbar (not sure it’s necessary, but can’t hurt)
8. select a bunch of text
9. now press control + +
10. interrupt the read audio by pressing control + + again

Actual result:

Crashes, in:

[ 00 ] content::BrowserAccessibility::AccessibilityPerformAction(ui::AXActionData const&)
[ 01 ] -[AXPlatformNodeCocoa setAccessibilitySelectedTextRange:]
[ 02 ] 0x7fff2325e232
[ 03 ] 0x7fff2325f5cf
[ 04 ] 0x7fff2325f3fd
[ 05 ] 0x7fff2325bfd0
[ 06 ] 0x7fff23052568
[ 07 ] 0x7fff256c6254
[ 08 ] 0x7fff256e7001
[ 09 ] 0x7fff256a593c
[ 10 ] 0x7fff20412a44
[ 11 ] 0x7fff20412925
[ 12 ] 0x7fff20410faf
[ 13 ] 0x7fff2040ff8c
[ 14 ] 0x7fff28657a83
[ 15 ] 0x7fff286577e5
[ 16 ] 0x7fff28657583
[ 17 ] 0x7fff22c19172
[ 18 ] 0x7fff22c17945
[ 19 ] __71-[BrowserCrApplication nextEventMatchingMask:untilDate:inMode:dequeue:]_block_invoke
[ 20 ] base::mac::CallWithEHFrame(void () block_pointer)
[ 21 ] -[BrowserCrApplication nextEventMatchingMask:untilDate:inMode:dequeue:]
[ 22 ] 0x7fff22c09c69
[ 23 ] base::MessagePumpNSApplication::DoRun(base::MessagePump::Delegate*)
[ 24 ] base::MessagePumpCFRunLoopBase::Run(base::MessagePump::Delegate*)
[ 25 ] base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta)
[ 26 ] <name omitted>
[ 27 ] content::BrowserMainLoop::RunMainMessageLoop()
[ 28 ] content::BrowserMainRunnerImpl::Run()
[ 29 ] content::BrowserMain(content::MainFunctionParams const&)
[ 30 ] content::ContentMainRunnerImpl::RunBrowser(content::MainFunctionParams&, bool)
[ 31 ] content::ContentMainRunnerImpl::Run(bool)
[ 32 ] content::RunContentProcess(content::ContentMainParams const&, content::ContentMainRunner*)
[ 33 ] content::ContentMain(content::ContentMainParams const&)
[ 34 ] ChromeMain
[ 35 ] main
[ 36 ] 0x7fff20335f3d

Expected result:

Text-to-speech is read out, no crash

Reproduces how often:

90%-ish?

Brave version (brave://version info)

Brave	1.31.88 Chromium: 95.0.4638.69 (Official Build) (x86_64)
Revision	6a1600ed572fedecd573b6c2b90a22fe6392a410-refs/branch-heads/4638@{#984}
OS	macOS Version 11.6.1 (Build 20G224)

[iefremov]

there is a slightly easier repro: instead of gmail any textarea could be used. E.g., load the following link data:text/html,<textarea>SELECT ME</textarea>, select all and hit the voice shortcut

[LaurenWags]

Brave | 1.31.88 Chromium: 95.0.4638.69 (Official Build) (x86_64)
-- | --
Revision | 6a1600ed572fedecd573b6c2b90a22fe6392a410-refs/branch-heads/4638@{#984}
OS | macOS Version 11.6.1 (Build 20G224)

Reproduced on 1.31.x, but not consistently. Did not reproduce with 1.30.x or latest Chrome (95.0.4638.69).

Note, I used the steps from https://community.brave.com/t/brave-crashing-when-using-mac-osx-text-to-speech/296486 (including changing the keyboard shortcut) to set up “Spoken selection”.

1. Clean profile 1.31.88.
2. Open gmail, login.
3. Begin an email. In the email body I wrote something like:

Hello,

I hope this email finds you well.

I am trying to reproduce an issue.

1. Then I highlighted/selected the body text (either with my mouse or via Cmd+a) and selected Ctrl+` .
2. Sometimes the browser crashed, sometimes it did not and would start to be read to me.
3. For the times where the browser did not crash and began to read the text to me, I clicked the “x” on the little box that pops up when text to speech is being read.
4. Sometimes (usually) that crashed the browser for me.

Crash report IDs:

4d940100-b3da-3807-0000-000000000000
c3940100-b3da-3807-0000-000000000000
73950100-b3da-3807-0000-000000000000
75950100-b3da-3807-0000-000000000000
72950100-b3da-3807-0000-000000000000
78950100-b3da-3807-0000-000000000000
76950100-b3da-3807-0000-000000000000