Fix null pointer dereference in ChromeClientImpl::openBeforeUnloadConfirmPanelDelegate.

LayoutTests/fast/events/before-unload-crash.html

Index: LayoutTests/fast/events/before-unload-crash.html
diff --git a/LayoutTests/fast/events/before-unload-crash.html b/LayoutTests/fast/events/before-unload-crash.html
new file mode 100644
index 0000000000000000000000000000000000000000..d9a47930b3189dd2b2125aeb9e0351176e5b945b
--- /dev/null
+++ b/LayoutTests/fast/events/before-unload-crash.html
@@ -0,0 +1,16 @@
+<script src="../../resources/js-test.js"></script>
+<script>
+function test(iframe) {
+    iframe.contentWindow.location.href = "resources/does-not-exist.html";
+    testPassed('if no crash');
+}
+</script>
+<iframe id=testIframe onload="test(this)"></iframe>
+<script>
+description('Detaching a frame in beforeunload event handler should not crash.');
+var testIframe = document.getElementById('testIframe');
+testIframe.contentWindow.onbeforeunload = function(event) {
+    testIframe.parentNode.removeChild(testIframe);
+    event.returnValue = 'beforeunload';
+}
+</script>