Plumb the correct owner document through DocumentInit::m_owner.

content/renderer/render_frame_impl.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/renderer/render_frame_impl.h"
 
 #include <map>
 #include <string>
 #include <utility>
 #include <vector>
@@ skipping 796 matching lines @@
   return NULL;
 }
 
 // static
 RenderFrameImpl* RenderFrameImpl::CreateMainFrame(
     RenderViewImpl* render_view,
     int32_t routing_id,
     int32_t widget_routing_id,
     bool hidden,
     const blink::WebScreenInfo& screen_info,
-    CompositorDependencies* compositor_deps) {
+    CompositorDependencies* compositor_deps,
+    blink::WebFrame* opener) {
   // A main frame RenderFrame must have a RenderWidget.
   DCHECK_NE(MSG_ROUTING_NONE, widget_routing_id);
 
   RenderFrameImpl* render_frame =
       RenderFrameImpl::Create(render_view, routing_id);
-  WebLocalFrame* web_frame =
-      WebLocalFrame::create(blink::WebTreeScopeType::Document, render_frame);
+  WebLocalFrame* web_frame = WebLocalFrame::create(
+      blink::WebTreeScopeType::Document, render_frame, opener);
   render_frame->BindToWebFrame(web_frame);
   render_view->webview()->setMainFrame(web_frame);
   render_frame->render_widget_ = RenderWidget::CreateForFrame(
       widget_routing_id, hidden, screen_info, compositor_deps, web_frame);
   // TODO(kenrb): Observing shouldn't be necessary when we sort out
   // WasShown and WasHidden, separating page-level visibility from
   // frame-level visibility.
   // TODO(avi): This DCHECK is to track cleanup for https://crbug.com/545684
   DCHECK_EQ(render_view, render_frame->render_widget_)
       << "Main frame is no longer reusing the RenderView as its widget! "
@@ skipping 28 matching lines @@
     if (previous_sibling_proxy)
       previous_sibling_web_frame = previous_sibling_proxy->web_frame();
 
     // Create the RenderFrame and WebLocalFrame, linking the two.
     render_frame =
         RenderFrameImpl::Create(parent_proxy->render_view(), routing_id);
     web_frame = parent_web_frame->createLocalChild(
         replicated_state.scope, WebString::fromUTF8(replicated_state.name),
         WebString::fromUTF8(replicated_state.unique_name),
         replicated_state.sandbox_flags, render_frame,
-        previous_sibling_web_frame, frame_owner_properties);
+        previous_sibling_web_frame, frame_owner_properties,
+        ResolveOpener(opener_routing_id, nullptr));
 
     // The RenderFrame is created and inserted into the frame tree in the above
     // call to createLocalChild.
     render_frame->in_frame_tree_ = true;
   } else {
     RenderFrameProxy* proxy =
         RenderFrameProxy::FromRoutingID(proxy_routing_id);
     // The remote frame could've been detached while the remote-to-local
     // navigation was being initiated in the browser process. Drop the
     // navigation and don't create the frame in that case.  See
     // https://crbug.com/526304.
     if (!proxy)
       return;
 
     render_frame = RenderFrameImpl::Create(proxy->render_view(), routing_id);
     render_frame->proxy_routing_id_ = proxy_routing_id;
     web_frame = blink::WebLocalFrame::createProvisional(

[Charlie Reis, 2016/02/25 01:08:08]

What about this branch?  Looks like we're losing the opener here.

[dcheng, 2016/02/25 01:13:28]

When we create a provisional frame, we copy a bunch of information over: opener
is one of those bits.

[Charlie Reis, 2016/02/25 21:21:25]

Acknowledged.

         render_frame, proxy->web_frame(), replicated_state.sandbox_flags,
         frame_owner_properties);
   }
   render_frame->BindToWebFrame(web_frame);
   CHECK(parent_routing_id != MSG_ROUTING_NONE || !web_frame->parent());
 
-  WebFrame* opener = ResolveOpener(opener_routing_id, nullptr);
-  web_frame->setOpener(opener);
-
   if (widget_params.routing_id != MSG_ROUTING_NONE) {
     CHECK(!web_frame->parent() ||
           SiteIsolationPolicy::AreCrossProcessFramesPossible());
     render_frame->render_widget_ = RenderWidget::CreateForFrame(
         widget_params.routing_id, widget_params.hidden,
         render_frame->render_view_->screen_info(), compositor_deps, web_frame);
     // TODO(avi): The main frame re-uses the RenderViewImpl as its widget, so
     // avoid double-registering the frame as an observer.
     // https://crbug.com/545684
     if (web_frame->parent()) {
@@ skipping 5212 matching lines @@
                                     int match_count,
                                     int ordinal,
                                     const WebRect& selection_rect,
                                     bool final_status_update) {
   Send(new FrameHostMsg_Find_Reply(routing_id_, request_id, match_count,
                                    selection_rect, ordinal,
                                    final_status_update));
 }
 
 }  // namespace content