Reload frame in V8Window::namedPropertyGetterCustom after js call

Source/bindings/core/v8/custom/V8WindowCustom.cpp

Index: Source/bindings/core/v8/custom/V8WindowCustom.cpp
diff --git a/Source/bindings/core/v8/custom/V8WindowCustom.cpp b/Source/bindings/core/v8/custom/V8WindowCustom.cpp
index fcf0f20b0388d045d26837541f1ee1c81a874a62..6ccaab659e6237c301c7cb0f36793892d1029c88 100644
--- a/Source/bindings/core/v8/custom/V8WindowCustom.cpp
+++ b/Source/bindings/core/v8/custom/V8WindowCustom.cpp
@@ -342,6 +342,12 @@ void V8Window::namedPropertyGetterCustom(v8::Local<v8::Name> name, const v8::Pro
     if (!info.Holder()->GetRealNamedProperty(nameString).IsEmpty())
         return;
 
+    // Frame could have been detached in call to GetRealNamedProperty.
+    frame = window->frame();
+    // window is detached.
+    if (!frame)
+        return;
+
     // Search named items in the document.
     Document* doc = frame->document();