Don't create an AXScrollView for a FrameView that's about to be deleted.

LayoutTests/accessibility/event-on-deleted-iframe-causes-crash.html

+<div contenteditable="true">
+   <span id="item1">Lorem
+   <br/>
+   more Lorem!
+   <blockquote>
+      ipsum
+   <span id="item2">
+</div>
+
+<script>
+    if (window.testRunner)
+        testRunner.dumpAsText();
+
+    var s = window.getSelection();
+    var p1 = document.getElementById("item1");
+    var p2 = document.getElementById("item2");
+    s.setBaseAndExtent(p1, 0, p2);
+    document.execCommand("Indent");
+    var frame = window.parent.document.querySelector('iframe');
+    if (frame)
+        frame.remove();
+</script>
+<script>

[je_julie(Not used), 2015/06/04 01:48:43]

nit; In the beginning, I didn't understand how it works.
Now I realized that the JS below is not working in the second cycle, I mean
iframe, because frame is unloaded by frame.remove().
What do you think about adding some comment for people like me?

I can see it has same behavior without additional script tag.
Do you need additional <script>?

[dmazzoni, 2015/06/04 03:29:40]

Yes, I'll add a comment!

The test is very weird. It's just modified a little bit from a test clusterfuzz
came up with that triggers this particular crash. I tried and couldn't come up
with an easier way to trigger the same crash, it's very tricky.
Strangely without this patch it doesn't crash without the second script tag. I
tried simulating the same thing by putting the first bit in a block or calling
gc() but it doesn't work. I'm not sure what's special about the last bit of code
being in a new script tag.

+    var iframe = document.createElement('iframe');
+    iframe.src = window.location;
+    document.body.appendChild(iframe);
+</script>