Don't create an AXScrollView for a FrameView that's about to be deleted.

LayoutTests/accessibility/event-on-deleted-iframe-causes-crash.html

Index: LayoutTests/accessibility/event-on-deleted-iframe-causes-crash.html
diff --git a/LayoutTests/accessibility/event-on-deleted-iframe-causes-crash.html b/LayoutTests/accessibility/event-on-deleted-iframe-causes-crash.html
new file mode 100644
index 0000000000000000000000000000000000000000..e70a968e164b29a0a64c5b25b78b75ca55b78466
--- /dev/null
+++ b/LayoutTests/accessibility/event-on-deleted-iframe-causes-crash.html
@@ -0,0 +1,35 @@
+<div contenteditable="true">
+   <span id="item1">Lorem
+   <br/>
+   more Lorem!
+   <blockquote>
+      ipsum
+   <span id="item2">
+</div>
+
+<script>
+    if (window.testRunner)
+        testRunner.dumpAsText();
+
+    var s = window.getSelection();
+    var p1 = document.getElementById("item1");
+    var p2 = document.getElementById("item2");
+    s.setBaseAndExtent(p1, 0, p2);
+    document.execCommand("Indent");
+
+    // This code doesn't do anything initially, but the code below creates an iframe
+    // with the same url as this one, and that time it will delete itself.
+    var frame = window.parent.document.querySelector('iframe');
+    if (frame)
+        frame.remove();
+</script>
+<script>
+    // This creates an iframe with the same url as this one, which triggers
+    // the code above that deletes this iframe, and then triggers a possible crash
+    // when the execCommand fires accessibility notifications that trigger creation
+    // of the AXScrollArea corresponding to the frame that's in the process of
+    // being deleted.
+    var iframe = document.createElement('iframe');
+    iframe.src = window.location;
+    document.body.appendChild(iframe);
+</script>