Plumb the correct owner document through DocumentInit::m_owner.

third_party/WebKit/Source/core/loader/DocumentLoader.h

 /*
  * Copyright (C) 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  *
  * 1.  Redistributions of source code must retain the above copyright
  *     notice, this list of conditions and the following disclaimer.
@@ skipping 55 matching lines @@
         return adoptRefWillBeNoop(new DocumentLoader(frame, request, data));
     }
     ~DocumentLoader() override;
 
     LocalFrame* frame() const { return m_frame; }
 
     virtual void detachFromFrame();
 
     unsigned long mainResourceIdentifier() const;
 
-    void replaceDocumentWhileExecutingJavaScriptURL(const DocumentInit&, const String& source, Document*);
+    void replaceDocumentWhileExecutingJavaScriptURL(const DocumentInit&, const String& source);
 
     const AtomicString& mimeType() const;
 
     const ResourceRequest& originalRequest() const;
 
     const ResourceRequest& request() const;
 
     ResourceFetcher* fetcher() const { return m_fetcher.get(); }
 
     const SubstituteData& substituteData() const { return m_substituteData; }
@@ skipping 59 matching lines @@
     Resource* startPreload(Resource::Type, FetchRequest&);
 
     DECLARE_VIRTUAL_TRACE();
 
 protected:
     DocumentLoader(LocalFrame*, const ResourceRequest&, const SubstituteData&);
 
     Vector<KURL> m_redirectChain;
 
 private:
-    static PassRefPtrWillBeRawPtr<DocumentWriter> createWriterFor(const Document* ownerDocument, const DocumentInit&, const AtomicString& mimeType, const AtomicString& encoding, bool dispatch, ParserSynchronizationPolicy);
+    static PassRefPtrWillBeRawPtr<DocumentWriter> createWriterFor(const DocumentInit&, const AtomicString& mimeType, const AtomicString& encoding, bool dispatch, ParserSynchronizationPolicy);
 
     void ensureWriter(const AtomicString& mimeType, const KURL& overridingURL = KURL());
     void endWriting(DocumentWriter*);
 
     Document* document() const;
     FrameLoader* frameLoader() const;
 
     void commitIfReady();
     void commitData(const char* bytes, size_t length);
     ResourceLoader* mainResourceLoader() const;
@@ skipping 67 matching lines @@
     // Used to protect against reentrancy into dataReceived().
     bool m_inDataReceived;
     RefPtr<SharedBuffer> m_dataBuffer;
 };
 
 DECLARE_WEAK_IDENTIFIER_MAP(DocumentLoader);
 
 } // namespace blink
 
 #endif // DocumentLoader_h