Don't create an AXScrollView for a FrameView that's about to be deleted.

Don't create an AXScrollView for a FrameView that's about to be deleted.

BUG=490505, 481730
Committed: https://src.chromium.org/viewvc/blink?view=rev&revision=196462

[dmazzoni, 2015-06-03 21:45:24]

dmazzoni@chromium.org changed reviewers:
+ je_julie.kim@samsung.com

[je_julie(Not used), 2015-06-04 01:48:43]

lgtm!

https://codereview.chromium.org/1153723008/diff/1/LayoutTests/accessibility/e...
File LayoutTests/accessibility/event-on-deleted-iframe-causes-crash.html
(right):

https://codereview.chromium.org/1153723008/diff/1/LayoutTests/accessibility/e...
LayoutTests/accessibility/event-on-deleted-iframe-causes-crash.html:23: <script>
nit; In the beginning, I didn't understand how it works.
Now I realized that the JS below is not working in the second cycle, I mean
iframe, because frame is unloaded by frame.remove().
What do you think about adding some comment for people like me?

I can see it has same behavior without additional script tag.
Do you need additional <script>?

[dmazzoni, 2015-06-04 03:29:40]

https://codereview.chromium.org/1153723008/diff/1/LayoutTests/accessibility/e...
File LayoutTests/accessibility/event-on-deleted-iframe-causes-crash.html
(right):

https://codereview.chromium.org/1153723008/diff/1/LayoutTests/accessibility/e...
LayoutTests/accessibility/event-on-deleted-iframe-causes-crash.html:23: <script>
On 2015/06/04 01:48:43, je_julie wrote:
> nit; In the beginning, I didn't understand how it works.
> Now I realized that the JS below is not working in the second cycle, I mean
> iframe, because frame is unloaded by frame.remove().
> What do you think about adding some comment for people like me?

Yes, I'll add a comment!

The test is very weird. It's just modified a little bit from a test clusterfuzz
came up with that triggers this particular crash. I tried and couldn't come up
with an easier way to trigger the same crash, it's very tricky.

> I can see it has same behavior without additional script tag.
> Do you need additional <script>?

Strangely without this patch it doesn't crash without the second script tag. I
tried simulating the same thing by putting the first bit in a block or calling
gc() but it doesn't work. I'm not sure what's special about the last bit of code
being in a new script tag.

[dmazzoni, 2015-06-04 03:30:31]

The CQ bit was checked by dmazzoni@chromium.org

[dmazzoni, 2015-06-04 03:30:32]

The patchset sent to the CQ was uploaded after l-g-t-m from
je_julie.kim@samsung.com
Link to the patchset: https://codereview.chromium.org/1153723008/#ps20001
(title: "Add more comments based on review")

[commit-bot: I haz the power, 2015-06-04 03:30:36]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/1153723008/20001

[commit-bot: I haz the power, 2015-06-04 06:09:26]

Committed patchset #2 (id:20001) as
https://src.chromium.org/viewvc/blink?view=rev&revision=196462