Plumb the correct owner document through DocumentInit::m_owner.

content/renderer/render_frame_proxy.cc

Index: content/renderer/render_frame_proxy.cc
diff --git a/content/renderer/render_frame_proxy.cc b/content/renderer/render_frame_proxy.cc
index 270e2933cd5b863021abace626155e71b4e83e42..3c44dbe77c2e2d983081eac98f1985503a2e8c0f 100644
--- a/content/renderer/render_frame_proxy.cc
+++ b/content/renderer/render_frame_proxy.cc
@@ -89,6 +89,9 @@ RenderFrameProxy* RenderFrameProxy::CreateFrameProxy(
       return nullptr;
   }
 
+  blink::WebFrame* opener =
+      RenderFrameImpl::ResolveOpener(opener_routing_id, nullptr);

[dcheng, 2016/02/23 00:11:32]

It's a bit awkward to do this lookup again, but this appears unavoidable without
restructuring some of this code.

+
   scoped_ptr<RenderFrameProxy> proxy(
       new RenderFrameProxy(routing_id, MSG_ROUTING_NONE));
   RenderViewImpl* render_view = nullptr;
@@ -98,8 +101,8 @@ RenderFrameProxy* RenderFrameProxy::CreateFrameProxy(
   if (!parent) {
     // Create a top level WebRemoteFrame.
     render_view = RenderViewImpl::FromRoutingID(render_view_routing_id);
-    web_frame =
-        blink::WebRemoteFrame::create(replicated_state.scope, proxy.get());
+    web_frame = blink::WebRemoteFrame::create(replicated_state.scope,
+                                              proxy.get(), opener);
     render_view->webview()->setMainFrame(web_frame);
     render_widget = render_view;
   } else {
@@ -111,15 +114,11 @@ RenderFrameProxy* RenderFrameProxy::CreateFrameProxy(
         replicated_state.scope,
         blink::WebString::fromUTF8(replicated_state.name),
         blink::WebString::fromUTF8(replicated_state.unique_name),
-        replicated_state.sandbox_flags, proxy.get());
+        replicated_state.sandbox_flags, proxy.get(), opener);
     render_view = parent->render_view();
     render_widget = parent->render_widget();
   }
 
-  blink::WebFrame* opener =
-      RenderFrameImpl::ResolveOpener(opener_routing_id, nullptr);
-  web_frame->setOpener(opener);
-
   proxy->Init(web_frame, render_view, render_widget);
 
   // Initialize proxy's WebRemoteFrame with the security origin and other