DOMWindow::navigator should return navigator w/o frame when detached.

Source/core/frame/LocalDOMWindow.cpp

 /*
  * Copyright (C) 2006, 2007, 2008, 2010 Apple Inc. All rights reserved.
  * Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies)
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
@@ skipping 643 matching lines @@
 {
     if (!isCurrentlyDisplayedInFrame())
         return nullptr;
     if (!m_applicationCache)
         m_applicationCache = ApplicationCache::create(frame());
     return m_applicationCache.get();
 }
 
 Navigator* LocalDOMWindow::navigator() const
 {
+    if (frame() && frame()->domWindow() != this) {

[haraken, 2015/08/24 02:22:15]

It would be better to use:

  if (!isCurrentlyDisplayedInFrame())
    return nullptr;

[yhirano, 2015/08/24 03:27:11]

Done.

+        // This window is already detached.
+        ASSERT(!m_navigator);
+        return nullptr;
+    }
+
     if (!m_navigator)
         m_navigator = Navigator::create(frame());
     return m_navigator.get();
 }
 
 void LocalDOMWindow::schedulePostMessage(PassRefPtrWillBeRawPtr<MessageEvent> event, LocalDOMWindow* source, SecurityOrigin* target, PassRefPtrWillBeRawPtr<ScriptCallStack> stackTrace)
 {
     // Schedule the message.
     OwnPtrWillBeRawPtr<PostMessageTimer> timer = adoptPtrWillBeNoop(new PostMessageTimer(*this, event, source, target, stackTrace, UserGestureIndicator::currentToken()));
     timer->startOneShot(0, FROM_HERE);
@@ skipping 813 matching lines @@
     DOMWindow::trace(visitor);
     DOMWindowLifecycleNotifier::trace(visitor);
 }
 
 LocalFrame* LocalDOMWindow::frame() const
 {
     return m_frameObserver->frame();
 }
 
 } // namespace blink