Sometimes they can be destroyed in the a11y thread, since we keep a reference when unregistering the objects.
Created attachment 448216 [details] Patch
Created attachment 448220 [details] Patch
Created attachment 448226 [details] Patch
Committed r287565 (245700@trunk): <https://commits.webkit.org/245700@trunk>