Plumb the correct owner document through DocumentInit::m_owner.

chrome/renderer/chrome_render_view_observer.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/renderer/chrome_render_view_observer.h"
 
 #include <stddef.h>
 
 #include "base/bind.h"
 #include "base/bind_helpers.h"
@@ skipping 141 matching lines @@
   if (deemphasized) {
     // 70% opaque grey.
     SkColor greyish = SkColorSetARGB(178, 0, 0, 0);
     render_view()->GetWebView()->setPageOverlayColor(greyish);
   } else {
     render_view()->GetWebView()->setPageOverlayColor(SK_ColorTRANSPARENT);
   }
 }
 #endif
 
-void ChromeRenderViewObserver::DidStartLoading() {
+void ChromeRenderViewObserver::DidCommitProvisionalLoad(

[dcheng, 2016/02/26 22:52:29]

Blink no longer always blindly reuses a Window object when navigating away from
the initial empty document: this better matches the spec-described behavior for
reusing Window objects.

However, since the Window object changes now, injecting the scripts at
DidStartLoading() is too early: the Window object hasn't been updated yet, and
the scripts get blown away when the Window object is replaced when committing
the provisional load.

(Note that this change isn't actually web-visible, but it affects a lot of
test/embedder-driven code that assumed this persistence would always happen.)

+    blink::WebLocalFrame* frame,
+    bool is_new_navigation) {
   if ((render_view()->GetEnabledBindings() & content::BINDINGS_POLICY_WEB_UI) &&
       !webui_javascript_.empty()) {
-    for (size_t i = 0; i < webui_javascript_.size(); ++i) {
-      render_view()->GetMainRenderFrame()->ExecuteJavaScript(
-          webui_javascript_[i]);
-    }
+    for (const auto& script : webui_javascript_)
+      render_view()->GetMainRenderFrame()->ExecuteJavaScript(script);
     webui_javascript_.clear();
   }
 }