RenderWidgetHostViewChildFrame's called a virtual in its ctor.

content/browser/renderer_host/render_widget_host_view_mac_unittest.mm

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/renderer_host/render_widget_host_view_mac.h"
 
 #include <Cocoa/Cocoa.h>
 #include <stddef.h>
 #include <stdint.h>
 #include <tuple>
@@ skipping 1033 matching lines @@
   MockRenderWidgetHostImpl* rwh =
       new MockRenderWidgetHostImpl(&delegate, process_host, routing_id);
   RenderWidgetHostViewMac* view = new RenderWidgetHostViewMac(rwh, true);
 
   // Add a delegate to the view.
   base::scoped_nsobject<MockRenderWidgetHostViewMacDelegate> view_delegate(
       [[MockRenderWidgetHostViewMacDelegate alloc] init]);
   view->SetDelegate(view_delegate.get());
 
   base::WeakPtr<RenderWidgetHostViewBase> guest_rwhv_weak =
-      (new RenderWidgetHostViewGuest(
-           rwh, NULL, view->GetWeakPtr()))->GetWeakPtr();
+      (RenderWidgetHostViewGuest::Create(rwh, NULL, view->GetWeakPtr()))
+          ->GetWeakPtr();
 
   // Remove the cocoa_view() so |view| also goes away before |rwh|.
   {
     base::scoped_nsobject<RenderWidgetHostViewCocoa> rwhv_cocoa;
     rwhv_cocoa.reset([view->cocoa_view() retain]);
   }
   RecycleAndWait();
 
   // Clean up.
   rwh->ShutdownAndDestroyWidget(true);
@@ skipping 417 matching lines @@
   // Repeat for the tab's view.
   [rwhv_cocoa_ setMarkedText:text
                selectedRange:selectedRange
             replacementRange:replacementRange];
   EXPECT_TRUE([rwhv_cocoa_ hasMarkedText]);
   rwhv_mac_->ImeCancelComposition();
   EXPECT_FALSE([rwhv_cocoa_ hasMarkedText]);
 }
 
 }  // namespace content