diff --git a/core/java/android/webkit/BrowserFrame.java b/core/java/android/webkit/BrowserFrame.java
index e0501463b8556..7bdefd08f585c 100644
--- a/core/java/android/webkit/BrowserFrame.java
+++ b/core/java/android/webkit/BrowserFrame.java
@@ -800,11 +800,7 @@ class BrowserFrame extends Handler {
      * @return The BrowserFrame object stored in the new WebView.
      */
     private BrowserFrame createWindow(boolean dialog, boolean userGesture) {
-        WebView w = mCallbackProxy.createWindow(dialog, userGesture);
-        if (w != null) {
-            return w.getWebViewCore().getBrowserFrame();
-        }
-        return null;
+        return mCallbackProxy.createWindow(dialog, userGesture);
     }
 
     /**
diff --git a/core/java/android/webkit/CallbackProxy.java b/core/java/android/webkit/CallbackProxy.java
index 635767134121d..4273bc374b63c 100644
--- a/core/java/android/webkit/CallbackProxy.java
+++ b/core/java/android/webkit/CallbackProxy.java
@@ -1144,7 +1144,7 @@ class CallbackProxy extends Handler {
         }
     }
 
-    public WebView createWindow(boolean dialog, boolean userGesture) {
+    public BrowserFrame createWindow(boolean dialog, boolean userGesture) {
         // Do an unsynchronized quick check to avoid posting if no callback has
         // been set.
         if (mWebChromeClient == null) {
@@ -1168,9 +1168,15 @@ class CallbackProxy extends Handler {
 
         WebView w = transport.getWebView();
         if (w != null) {
-            w.getWebViewCore().initializeSubwindow();
+            WebViewCore core = w.getWebViewCore();
+            // If WebView.destroy() has been called, core may be null.  Skip
+            // initialization in that case and return null.
+            if (core != null) {
+                core.initializeSubwindow();
+                return core.getBrowserFrame();
+            }
         }
-        return w;
+        return null;
     }
 
     public void onRequestFocus() {