Plumb the correct owner document through DocumentInit::m_owner.

content/renderer/render_frame_impl.h

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef CONTENT_RENDERER_RENDER_FRAME_IMPL_H_
 #define CONTENT_RENDERER_RENDER_FRAME_IMPL_H_
 
 #include <stddef.h>
 #include <stdint.h>
 
@@ skipping 146 matching lines @@
       NON_EXPORTED_BASE(public blink::WebFrameClient),
       NON_EXPORTED_BASE(public blink::WebFrameSerializerClient) {
  public:
   // Creates a new RenderFrame as the main frame of |render_view|.
   static RenderFrameImpl* CreateMainFrame(
       RenderViewImpl* render_view,
       int32_t routing_id,
       int32_t widget_routing_id,
       bool hidden,
       const blink::WebScreenInfo& screen_info,
-      CompositorDependencies* compositor_deps);
+      CompositorDependencies* compositor_deps,
+      blink::WebFrame* opener);
 
   // Creates a new RenderFrame with |routing_id|.  If |proxy_routing_id| is
   // MSG_ROUTING_NONE, it creates the Blink WebLocalFrame and inserts it into
   // the frame tree after the frame identified by
   // |previous_sibling_routing_id|, or as the first child if
   // |previous_sibling_routing_id| is MSG_ROUTING_NONE. Otherwise, the frame is
   // semi-orphaned until it commits, at which point it replaces the proxy
   // identified by |proxy_routing_id|.  The frame's opener is set to the frame
   // identified by |opener_routing_id|.  The frame is created as a child of the
   // RenderFrame identified by |parent_routing_id| or as the top-level frame if
@@ skipping 1025 matching lines @@
 #endif
 
   base::WeakPtrFactory<RenderFrameImpl> weak_factory_;
 
   DISALLOW_COPY_AND_ASSIGN(RenderFrameImpl);
 };
 
 }  // namespace content
 
 #endif  // CONTENT_RENDERER_RENDER_FRAME_IMPL_H_