Accessibility events should be sent to the axObjectCacheOwner's frame.

Source/core/accessibility/AXObjectCache.cpp

 /*
  * Copyright (C) 2008, 2009, 2010 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  *
  * 1.  Redistributions of source code must retain the above copyright
  *     notice, this list of conditions and the following disclaimer.
  * 2.  Redistributions in binary form must reproduce the above copyright
@@ skipping 950 matching lines @@
             return;
         Document* document = toFrameView(scrollBar->parent())->frame().document();
         if (document != document->topDocument())
             return;
         obj = get(document->renderView());
     }
 
     if (!obj || !obj->document() || !obj->documentFrameView() || !obj->documentFrameView()->frame().page())
         return;
 
-    ChromeClient& client = obj->documentFrameView()->frame().page()->chrome().client();
+    ChromeClient& client = obj->document()->axObjectCacheOwner().page()->chrome().client();
 
     if (notification == AXActiveDescendantChanged
         && obj->document()->focusedElement()
         && obj->node() == obj->document()->focusedElement()) {
         // Calling handleFocusedUIElementChanged will focus the new active
         // descendant and send the AXFocusedUIElementChanged notification.
         handleFocusedUIElementChanged(0, obj->document()->focusedElement());
     }
 
     client.postAccessibilityNotification(obj, notification);
@@ skipping 35 matching lines @@
 void AXObjectCache::setCanvasObjectBounds(Element* element, const LayoutRect& rect)
 {
     AXObject* obj = getOrCreate(element);
     if (!obj)
         return;
 
     obj->setElementRect(rect);
 }
 
 } // namespace blink