binding: Window-returning attributes return null if a Window is detached.

third_party/WebKit/Source/bindings/core/v8/ToV8.cpp

Index: third_party/WebKit/Source/bindings/core/v8/ToV8.cpp
diff --git a/third_party/WebKit/Source/bindings/core/v8/ToV8.cpp b/third_party/WebKit/Source/bindings/core/v8/ToV8.cpp
index c499b7c9ab9e39341598849bfa127e98d83133a0..f09ab370ab8b9a4c6e9a31d3d3ee3050172ce3a1 100644
--- a/third_party/WebKit/Source/bindings/core/v8/ToV8.cpp
+++ b/third_party/WebKit/Source/bindings/core/v8/ToV8.cpp
@@ -20,12 +20,17 @@ v8::Local<v8::Value> toV8(DOMWindow* window, v8::Local<v8::Object> creationConte
 
     if (UNLIKELY(!window))
         return v8::Null(isolate);
-    // Initializes environment of a frame, and return the global object
-    // of the frame.
-    Frame * frame = window->frame();
-    if (!frame)
+
+    // TODO(yukishiino): There must be no case to return undefined.
+    // 'window', 'frames' and 'self' attributes in Window interface return
+    // the WindowProxy object of the browsing context, which never be undefined.
+    // 'top' and 'parent' attributes return the same when detached.  Therefore,
+    // there must be no case to return undefined.
+    // See http://crbug.com/621730 and http://crbug.com/621577 .
+    if (!window->isCurrentlyDisplayedInFrame())
         return v8Undefined();
 
+    Frame* frame = window->frame();
     return frame->windowProxy(DOMWrapperWorld::current(isolate))->globalIfNotDetached();
 }