Plumb the correct owner document through DocumentInit::m_owner.

content/renderer/render_view_impl.cc

Index: content/renderer/render_view_impl.cc
diff --git a/content/renderer/render_view_impl.cc b/content/renderer/render_view_impl.cc
index 3f7c05a8bb21ae39e8c5d897bd46afed27f941f2..ca38d54e7f3245f9275d62248801dd4ab8cfff4c 100644
--- a/content/renderer/render_view_impl.cc
+++ b/content/renderer/render_view_impl.cc
@@ -686,7 +686,7 @@ void RenderViewImpl::Initialize(const ViewMsg_New_Params& params,
   if (params.main_frame_routing_id != MSG_ROUTING_NONE) {
     main_render_frame_ = RenderFrameImpl::CreateMainFrame(
         this, params.main_frame_routing_id, params.main_frame_widget_routing_id,
-        params.hidden, screen_info(), compositor_deps_);
+        params.hidden, screen_info(), compositor_deps_, opener_frame);
   }
 
   if (params.proxy_routing_id != MSG_ROUTING_NONE) {
@@ -699,11 +699,9 @@ void RenderViewImpl::Initialize(const ViewMsg_New_Params& params,
       main_render_frame_->set_render_frame_proxy(proxy);
     } else {
       CHECK(SiteIsolationPolicy::IsSwappedOutStateForbidden());
-      // Pass MSG_ROUTING_NONE for opener, since actual opener (if any) will be
-      // set separately below.
-      RenderFrameProxy::CreateFrameProxy(params.proxy_routing_id, routing_id(),
-                                         MSG_ROUTING_NONE, MSG_ROUTING_NONE,
-                                         params.replicated_frame_state);
+      RenderFrameProxy::CreateFrameProxy(
+          params.proxy_routing_id, routing_id(), params.opener_frame_route_id,
+          MSG_ROUTING_NONE, params.replicated_frame_state);
     }
   }
 
@@ -808,8 +806,6 @@ void RenderViewImpl::Initialize(const ViewMsg_New_Params& params,
   // If we have an opener_frame but we weren't created by a renderer, then it's
   // the browser asking us to set our opener to another frame.

[alexmos, 2016/02/26 19:55:34]

You might want to update this comment, since we don't set the opener in this
block anymore.

[dcheng, 2016/02/26 22:52:29]

Hmm... what would you suggest for this comment? It's still true: it's just the
setting of the opener happens deeper down in the stack, when creating the
WebFrames.

[alexmos, 2016/02/26 23:54:47]

I just thought it was confusing that it talks about setting the opener for a
block that is setting sandbox flags.  Doesn't the opener get set above this now,
as part of CreateFrameProxy or CreateMainFrame?  And that happens without
looking at was_created_by_renderer now, so "we weren't created by a renderer"
doesn't apply anymore, right?  It might be ok to just remove this comment; the
one inside this if block might be enough.

[dcheng, 2016/02/27 01:41:21]

Done. I also collapsed the two if blocks together.

   if (opener_frame && !was_created_by_renderer) {
-    webview()->mainFrame()->setOpener(opener_frame);
-
     // Ensure that sandbox flags are inherited from an opener in a different

[Charlie Reis, 2016/02/25 01:08:08]

I'm wondering if the rest of this block needs any cleanup as well, now that we
don't have to call setOpener anymore.  It isn't clear to me if it's really
specific to the main frame, in which case it might make sense to move it inside
the frame's initialization?

Anyway, maybe that's a question for Alex and we can leave it here for now.

[dcheng, 2016/02/25 01:13:28]

Maybe… but this patch has affected a lot more plumbing than I was hoping to
touch. It probably does make sense to clean this up too, but probably in a
separate patch.

[Charlie Reis, 2016/02/25 21:21:25]

Separate patch is fine.  Just wanted to raise the question for Alex to see.

[alexmos, 2016/02/26 19:55:34]

Yes, this is specific to the main frame (the scenario where a newly created
popup window needs to inherit its opener's sandbox flags).  I'm fine cleaning
that up in a separate patch later and moving it to something like
CreateMainFrame.

I didn't look through this CL in detail, but it looks like this will now set the
opener for both browser-initiated and renderer-initiated RV creation, since it
drops the was_created_by_renderer check (and it's great that this is now done
consistently).  Did the renderer-initiated path previously rely solely on
setting opener in blink::CreateWindow, and if so, why does createWindowHelper
still need to set the opener?

[dcheng, 2016/02/27 01:41:21]

createWindow() doesn't *always* create a new window, and in that case, Blink
still needs to update the state in the renderer itself.

     // process.  In that case, the browser process will set any inherited
     // sandbox flags in |replicated_frame_state|, so apply them here.