Handle frame openers in the same FrameTree when navigating subframes.

content/browser/frame_host/render_frame_proxy_host.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/frame_host/render_frame_proxy_host.h"
 
 #include "base/lazy_instance.h"
 #include "content/browser/bad_message.h"
 #include "content/browser/frame_host/cross_process_frame_connector.h"
 #include "content/browser/frame_host/frame_tree.h"
@@ skipping 185 matching lines @@
   render_frame_proxy_created_ = true;
   return true;
 }
 
 void RenderFrameProxyHost::UpdateOpener() {
   // Another frame in this proxy's SiteInstance may reach the new opener by
   // first reaching this proxy and then referencing its window.opener.  Ensure
   // the new opener's proxy exists in this case.
   if (frame_tree_node_->opener()) {
     frame_tree_node_->opener()->render_manager()->CreateOpenerProxies(
-        GetSiteInstance());
+        GetSiteInstance(), frame_tree_node_);
   }
 
   int opener_routing_id =
       frame_tree_node_->render_manager()->GetOpenerRoutingID(GetSiteInstance());
   Send(new FrameMsg_UpdateOpener(GetRoutingID(), opener_routing_id));
 }
 
 void RenderFrameProxyHost::OnDetach() {
   if (frame_tree_node_->render_manager()->ForInnerDelegate()) {
     // Only main frame proxy can detach for inner WebContents.
@@ skipping 91 matching lines @@
         new FrameMsg_PostMessageEvent(target_rfh->GetRoutingID(), new_params));
   }
 }
 
 void RenderFrameProxyHost::OnDidChangeOpener(int32 opener_routing_id) {
   frame_tree_node_->render_manager()->DidChangeOpener(opener_routing_id,
                                                       GetSiteInstance());
 }
 
 }  // namespace content