Plumb the correct owner document through DocumentInit::m_owner.

extensions/browser/app_window/app_window_contents.cc

Index: extensions/browser/app_window/app_window_contents.cc
diff --git a/extensions/browser/app_window/app_window_contents.cc b/extensions/browser/app_window/app_window_contents.cc
index 7f1a7a1d00484bccdc0bbe8ded1cff641dbdb9a5..3cb0cb850de3f289aa460fa311a7ea026df77995 100644
--- a/extensions/browser/app_window/app_window_contents.cc
+++ b/extensions/browser/app_window/app_window_contents.cc
@@ -27,12 +27,15 @@ AppWindowContentsImpl::AppWindowContentsImpl(AppWindow* host)
 AppWindowContentsImpl::~AppWindowContentsImpl() {}
 
 void AppWindowContentsImpl::Initialize(content::BrowserContext* context,
+                                       content::RenderFrameHost* creator_frame,
                                        const GURL& url) {
   url_ = url;
 
-  web_contents_.reset(
-      content::WebContents::Create(content::WebContents::CreateParams(
-          context, content::SiteInstance::CreateForURL(context, url_))));
+  content::WebContents::CreateParams create_params(
+      context, creator_frame->GetSiteInstance());

[dcheng, 2016/02/24 21:59:02]

Without this, we always create a new process. This causes the opener inheritance
bits in Blink to fallover: it can't inherit security origin across a process
boundary.

I /think/ in this case we should always start in the site instance of the
creator... I /think/.

+  create_params.opener_render_process_id = creator_frame->GetProcess()->GetID();
+  create_params.opener_render_frame_id = creator_frame->GetRoutingID();
+  web_contents_.reset(content::WebContents::Create(create_params));
 
   Observe(web_contents_.get());
   web_contents_->GetMutableRendererPrefs()->