Plumb the correct owner document through DocumentInit::m_owner.

content/renderer/render_frame_proxy.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/renderer/render_frame_proxy.h"
 
 #include <stdint.h>
 #include <map>
 #include <utility>
 
@@ skipping 71 matching lines @@
   RenderFrameProxy* parent = nullptr;
   if (parent_routing_id != MSG_ROUTING_NONE) {
     parent = RenderFrameProxy::FromRoutingID(parent_routing_id);
     // It is possible that the parent proxy has been detached in this renderer
     // process, just as the parent's real frame was creating this child frame.
     // In this case, do not create the proxy. See https://crbug.com/568670.
     if (!parent)
       return nullptr;
   }
 
+  blink::WebFrame* opener =
+      RenderFrameImpl::ResolveOpener(opener_routing_id, nullptr);

[dcheng, 2016/02/23 00:11:32]

It's a bit awkward to do this lookup again, but this appears unavoidable without
restructuring some of this code.

+
   scoped_ptr<RenderFrameProxy> proxy(
       new RenderFrameProxy(routing_id, MSG_ROUTING_NONE));
   RenderViewImpl* render_view = nullptr;
   RenderWidget* render_widget = nullptr;
   blink::WebRemoteFrame* web_frame = nullptr;
 
   if (!parent) {
     // Create a top level WebRemoteFrame.
     render_view = RenderViewImpl::FromRoutingID(render_view_routing_id);
-    web_frame =
-        blink::WebRemoteFrame::create(replicated_state.scope, proxy.get());
+    web_frame = blink::WebRemoteFrame::create(replicated_state.scope,
+                                              proxy.get(), opener);
     render_view->webview()->setMainFrame(web_frame);
     render_widget = render_view;
   } else {
     // Create a frame under an existing parent. The parent is always expected
     // to be a RenderFrameProxy, because navigations initiated by local frames
     // should not wind up here.
 
     web_frame = parent->web_frame()->createRemoteChild(
         replicated_state.scope,
         blink::WebString::fromUTF8(replicated_state.name),
         blink::WebString::fromUTF8(replicated_state.unique_name),
-        replicated_state.sandbox_flags, proxy.get());
+        replicated_state.sandbox_flags, proxy.get(), opener);
     render_view = parent->render_view();
     render_widget = parent->render_widget();
   }
 
-  blink::WebFrame* opener =
-      RenderFrameImpl::ResolveOpener(opener_routing_id, nullptr);
-  web_frame->setOpener(opener);
-
   proxy->Init(web_frame, render_view, render_widget);
 
   // Initialize proxy's WebRemoteFrame with the security origin and other
   // replicated information.
   // TODO(dcheng): Calling this when parent_routing_id != MSG_ROUTING_NONE is
   // mostly redundant, since we already pass the name and sandbox flags in
   // createLocalChild(). We should update the Blink interface so it also takes
   // the origin. Then it will be clear that the replication call is only needed
   // for the case of setting up a main frame proxy.
   proxy->SetReplicatedState(replicated_state);
@@ skipping 347 matching lines @@
                                     blink::WebLocalFrame* source) {
   int source_routing_id = RenderFrameImpl::FromWebFrame(source)->GetRoutingID();
   Send(new FrameHostMsg_AdvanceFocus(routing_id_, type, source_routing_id));
 }
 
 void RenderFrameProxy::frameFocused() {
   Send(new FrameHostMsg_FrameFocused(routing_id_));
 }
 
 }  // namespace