Extend the ToRenderFrameHost magic to FrameTreeNode* and Shell*

content/browser/security_exploit_browsertest.cc

Index: content/browser/security_exploit_browsertest.cc
diff --git a/content/browser/security_exploit_browsertest.cc b/content/browser/security_exploit_browsertest.cc
index e225045e0a0e8856ab2ea973ea552bbaa44d50b8..a7ba3d7eb8505f8a181cf266839e11dfee5201a8 100644
--- a/content/browser/security_exploit_browsertest.cc
+++ b/content/browser/security_exploit_browsertest.cc
@@ -72,8 +72,7 @@ RenderViewHostImpl* PrepareToDuplicateHosts(Shell* shell,
 
   // Open another window, so we generate some more routing ids.
   ShellAddedObserver shell2_observer;
-  EXPECT_TRUE(ExecuteScript(
-      shell->web_contents(), "window.open(document.URL + '#2');"));
+  EXPECT_TRUE(ExecuteScript(shell, "window.open(document.URL + '#2');"));
   Shell* shell2 = shell2_observer.GetShell();
 
   // The new window must be in the same process, but have a new routing id.