Protect Frame object against destruction during DOMWindow::find()

This patch changes DOMWindow::find(), JavaScript exposed function, to keep associated Frame object to DOMWindow, hold in |m_frame|, during |Editor::findString()| call. |Editor::findString()| can update render tree by calling Document::updateLayout() and it can run user scripts which destruct Frame object, via event handler, e.g. focus, blur, and so on.

BUG=331232
TEST=LayoutTests/fast/dom/Window/window-find-crash.html

Review URL: https://codereview.chromium.org/103553007

git-svn-id: svn://svn.chromium.org/blink/trunk@164495 bbb929c8-8fbe-4397-9dbb-9b2b20218538