RenderWidgetHostViewChildFrame's called a virtual in its ctor.

content/browser/renderer_host/render_widget_host_view_aura_unittest.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/renderer_host/render_widget_host_view_aura.h"
 
 #include <stddef.h>
 #include <stdint.h>
 
 #include <tuple>
@@ skipping 682 matching lines @@
     // is deleted properly upon RWH going away.
     set_widget_host_uses_shutdown_to_destroy(true);
   }
 
   // We explicitly invoke SetUp to allow gesture debounce customization.
   void SetUp() override {
     is_guest_view_hack_ = true;
 
     RenderWidgetHostViewAuraTest::SetUp();
 
-    guest_view_weak_ = (new RenderWidgetHostViewGuest(widget_host_, nullptr,
-                                                      view_->GetWeakPtr()))
+    guest_view_weak_ = (RenderWidgetHostViewGuest::Create(widget_host_, nullptr,
+                                                          view_->GetWeakPtr()))
                            ->GetWeakPtr();
   }
 
   void TearDown() override {
     // Internal override to do nothing, we clean up ourselves in the test body.
     // This helps us test that |guest_view_weak_| does not leak.
   }
 
  protected:
   base::WeakPtr<RenderWidgetHostViewBase> guest_view_weak_;
@@ skipping 3960 matching lines @@
 
     // Retrieve the selected text from clipboard and verify it is as expected.
     base::string16 result_text;
     clipboard->ReadText(ui::CLIPBOARD_TYPE_SELECTION, &result_text);
     EXPECT_EQ(expected_text, result_text);
   }
 }
 #endif
 
 }  // namespace content