Plumb the correct owner document through DocumentInit::m_owner.

third_party/WebKit/Source/core/dom/Document.h

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
  *           (C) 2006 Alexey Proskuryakov (ap@webkit.org)
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009, 2010, 2012 Apple Inc. All rights reserved.
  * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  * Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies)
  * Copyright (C) 2011 Google Inc. All rights reserved.
  *
@@ skipping 840 matching lines @@
     bool hasAnnotatedRegions () const { return m_hasAnnotatedRegions; }
     void setHasAnnotatedRegions(bool f) { m_hasAnnotatedRegions = f; }
     const Vector<AnnotatedRegionValue>& annotatedRegions() const;
     void setAnnotatedRegions(const Vector<AnnotatedRegionValue>&);
 
     void removeAllEventListeners() final;
 
     const SVGDocumentExtensions* svgExtensions();
     SVGDocumentExtensions& accessSVGExtensions();
 
-    void initSecurityContext();
-    void initSecurityContext(const DocumentInit&);
     void initContentSecurityPolicy(PassRefPtrWillBeRawPtr<ContentSecurityPolicy> = nullptr);
 
+    bool isSecureTransitionTo(const KURL&) const;
+
     bool allowInlineEventHandlers(Node*, EventListener*, const String& contextURL, const WTF::OrdinalNumber& contextLine);
     bool allowExecutingScripts(Node*);
 
     void statePopped(PassRefPtr<SerializedScriptValue>);
 
     enum LoadEventProgress {
         LoadEventNotRun,
         LoadEventInProgress,
         LoadEventCompleted,
         BeforeUnloadEventInProgress,
@@ skipping 207 matching lines @@
 private:
     friend class IgnoreDestructiveWriteCountIncrementer;
     friend class NthIndexCache;
 
     bool isDocumentFragment() const = delete; // This will catch anyone doing an unnecessary check.
     bool isDocumentNode() const = delete; // This will catch anyone doing an unnecessary check.
     bool isElementNode() const = delete; // This will catch anyone doing an unnecessary check.
 
     ScriptedAnimationController& ensureScriptedAnimationController();
     ScriptedIdleTaskController& ensureScriptedIdleTaskController();
+    void initSecurityContext(const DocumentInit&);
     SecurityContext& securityContext() final { return *this; }
     EventQueue* eventQueue() const final;
 
     // FIXME: Rename the StyleRecalc state to LayoutTreeUpdate.
     bool hasPendingStyleRecalc() const { return m_lifecycle.state() == DocumentLifecycle::VisualUpdatePending; }
 
     bool shouldScheduleLayoutTreeUpdate() const;
     void scheduleLayoutTreeUpdate();
 
     bool needsFullLayoutTreeUpdate() const;
@@ skipping 343 matching lines @@
 DEFINE_TYPE_CASTS(TreeScope, Document, document, true, true);
 
 } // namespace blink
 
 #ifndef NDEBUG
 // Outside the WebCore namespace for ease of invocation from gdb.
 CORE_EXPORT void showLiveDocumentInstances();
 #endif
 
 #endif // Document_h