Don't create an AXScrollView for a FrameView that's about to be deleted.

Source/modules/accessibility/AXObjectCacheImpl.cpp

 /*
  * Copyright (C) 2014, Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  *
  * 1.  Redistributions of source code must retain the above copyright
  *     notice, this list of conditions and the following disclaimer.
  * 2.  Redistributions in binary form must reproduce the above copyright
@@ skipping 327 matching lines @@
 
 AXObject* AXObjectCacheImpl::getOrCreate(Widget* widget)
 {
     if (!widget)
         return 0;
 
     if (AXObject* obj = get(widget))
         return obj;
 
     RefPtr<AXObject> newObj = nullptr;
-    if (widget->isFrameView())
+    if (widget->isFrameView()) {
+        FrameView* frameView = toFrameView(widget);
+
+        // Don't create an AXScrollView for a FrameView that isn't attached to a frame,
+        // for example if it's in the process of being disposed.
+        if (frameView->frame().view() != frameView || !frameView->layoutView())
+            return 0;
+
         newObj = AXScrollView::create(toFrameView(widget), this);
-    else if (widget->isScrollbar())
+    } else if (widget->isScrollbar())
         newObj = AXScrollbar::create(toScrollbar(widget), this);
 
     // Will crash later if we have two objects for the same widget.
     ASSERT(!get(widget));
 
     // Catch the case if an (unsupported) widget type is used. Only FrameView and ScrollBar are supported now.
     ASSERT(newObj);
     if (!newObj)
         return 0;
 
@@ skipping 782 matching lines @@
 void AXObjectCacheImpl::setCanvasObjectBounds(Element* element, const LayoutRect& rect)
 {
     AXObject* obj = getOrCreate(element);
     if (!obj)
         return;
 
     obj->setElementRect(rect);
 }
 
 } // namespace blink