Fix reentrancy crash in createWindowHelper

third_party/WebKit/Source/core/page/CreateWindow.cpp

Index: third_party/WebKit/Source/core/page/CreateWindow.cpp
diff --git a/third_party/WebKit/Source/core/page/CreateWindow.cpp b/third_party/WebKit/Source/core/page/CreateWindow.cpp
index bb5c76e42caeba34757ae0a856d11443b51bc7d0..4630de9a12e355ef22d3bf092ca6192681f2ee22 100644
--- a/third_party/WebKit/Source/core/page/CreateWindow.cpp
+++ b/third_party/WebKit/Source/core/page/CreateWindow.cpp
@@ -160,6 +160,10 @@ static Frame* createWindowHelper(LocalFrame& openerFrame,
   }
 
   if (window) {
+    // JS can run inside reuseExistingWindow (via onblur), which can detach
+    // the target window.
+    if (!window->client())
+      return nullptr;
     if (request.getShouldSetOpener() == MaybeSetOpener)
       window->client()->setOpener(&openerFrame);
     return window;