Plumb the correct owner document through DocumentInit::m_owner.

chrome/renderer/chrome_render_view_observer.cc

Index: chrome/renderer/chrome_render_view_observer.cc
diff --git a/chrome/renderer/chrome_render_view_observer.cc b/chrome/renderer/chrome_render_view_observer.cc
index 55a1a569a52e0abbccdf50df321352e95aba00ae..fdee41f7c85225079fa6a459e8055214f4f31963 100644
--- a/chrome/renderer/chrome_render_view_observer.cc
+++ b/chrome/renderer/chrome_render_view_observer.cc
@@ -159,13 +159,13 @@ void ChromeRenderViewObserver::OnSetVisuallyDeemphasized(bool deemphasized) {
 }
 #endif
 
-void ChromeRenderViewObserver::DidStartLoading() {
+void ChromeRenderViewObserver::DidCommitProvisionalLoad(

[dcheng, 2016/02/26 22:52:29]

Blink no longer always blindly reuses a Window object when navigating away from
the initial empty document: this better matches the spec-described behavior for
reusing Window objects.

However, since the Window object changes now, injecting the scripts at
DidStartLoading() is too early: the Window object hasn't been updated yet, and
the scripts get blown away when the Window object is replaced when committing
the provisional load.

(Note that this change isn't actually web-visible, but it affects a lot of
test/embedder-driven code that assumed this persistence would always happen.)

+    blink::WebLocalFrame* frame,
+    bool is_new_navigation) {
   if ((render_view()->GetEnabledBindings() & content::BINDINGS_POLICY_WEB_UI) &&
       !webui_javascript_.empty()) {
-    for (size_t i = 0; i < webui_javascript_.size(); ++i) {
-      render_view()->GetMainRenderFrame()->ExecuteJavaScript(
-          webui_javascript_[i]);
-    }
+    for (const auto& script : webui_javascript_)
+      render_view()->GetMainRenderFrame()->ExecuteJavaScript(script);
     webui_javascript_.clear();
   }
 }