[turbofan] Fix ReduceNamedAccess for detached global proxies

src/compiler/js-native-context-specialization.cc

Index: src/compiler/js-native-context-specialization.cc
diff --git a/src/compiler/js-native-context-specialization.cc b/src/compiler/js-native-context-specialization.cc
index 0b7b2913b85d502983da331fafb0de8059e96f93..fb8e53b034878cc5ec9d203f2832ad98ae3b9db8 100644
--- a/src/compiler/js-native-context-specialization.cc
+++ b/src/compiler/js-native-context-specialization.cc
@@ -570,9 +570,11 @@ Reduction JSNativeContextSpecialization::ReduceNamedAccess(
   if (receiver_maps.length() == 1) {
     Handle<Map> receiver_map = receiver_maps.first();
     if (receiver_map->IsJSGlobalProxyMap()) {
-      Context* receiver_context =
-          JSFunction::cast(receiver_map->GetConstructor())->native_context();
-      if (receiver_context == *native_context()) {
+      Object* maybe_constructor = receiver_map->GetConstructor();
+      // Detached global proxies have |null| as their constructor.
+      if (maybe_constructor->IsJSFunction() &&
+          JSFunction::cast(maybe_constructor)->native_context() ==
+              *native_context()) {
         return ReduceGlobalAccess(node, receiver, value, name, access_mode,
                                   index);
       }