Fix reentrancy crash in createWindowHelper

third_party/WebKit/Source/core/page/CreateWindow.cpp

 /*
  * Copyright (C) 2006, 2007, 2008, 2010 Apple Inc. All rights reserved.
  * Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies)
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
@@ skipping 142 matching lines @@
               "frame whose 'allow-popups' permission is not set."));
       return nullptr;
     }
 
     if (openerFrame.settings() &&
         !openerFrame.settings()->supportsMultipleWindows())
       window = openerFrame.tree().top();
   }
 
   if (window) {
+    // JS can run inside reuseExistingWindow (via onblur), which can detach
+    // the target window.
+    if (!window->client())
+      return nullptr;
     if (request.getShouldSetOpener() == MaybeSetOpener)
       window->client()->setOpener(&openerFrame);
     return window;
   }
 
   return createNewWindow(openerFrame, request, features, policy, created);
 }
 
 DOMWindow* createWindow(const String& urlString,
                         const AtomicString& frameName,
@@ skipping 104 matching lines @@
   }
 
   // TODO(japhet): Form submissions on RemoteFrames don't work yet.
   FrameLoadRequest newRequest(0, request.resourceRequest());
   newRequest.setForm(request.form());
   if (newFrame->isLocalFrame())
     toLocalFrame(newFrame)->loader().load(newRequest);
 }
 
 }  // namespace blink