Make window.open() IPCs be frame-based

content/browser/security_exploit_browsertest.cc

 // Copyright (c) 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <stdint.h>
 
 #include "base/command_line.h"
 #include "base/containers/hash_tables.h"
 #include "base/macros.h"
 #include "base/strings/utf_string_conversions.h"
@@ skipping 255 matching lines @@
           BrowserContext::GetStoragePartition(
               shell()->web_contents()->GetBrowserContext(),
               pending_rvh->GetSiteInstance())->GetDOMStorageContext());
   scoped_refptr<SessionStorageNamespaceImpl> session_storage(
       new SessionStorageNamespaceImpl(dom_storage_context));
   // Cause a deliberate collision in routing ids.
   int32_t main_frame_routing_id = duplicate_routing_id + 1;
   // TODO(avi): This should be made unique from the view routing ID once
   // RenderViewHostImpl has-a RenderWidgetHostImpl. https://crbug.com/545684
   int32_t main_frame_widget_routing_id = duplicate_routing_id;
-  pending_rvh->CreateNewWindow(duplicate_routing_id, main_frame_routing_id,
-                               main_frame_widget_routing_id,
-                               mojom::CreateNewWindowParams(),
-                               session_storage.get());
+  static_cast<RenderFrameHostImpl*>(pending_rvh->GetMainFrame())
+      ->OnCreateNewWindow(duplicate_routing_id, main_frame_routing_id,
+                          main_frame_widget_routing_id,
+                          mojom::CreateNewWindowParams(),
+                          session_storage.get());
 
   // If the above operation doesn't cause a crash, the test has succeeded!
 }
 
 // This is a test for crbug.com/312016. It tries to create two RenderWidgetHosts
 // with the same process and routing ids, which causes a collision. It is almost
 // identical to the AttemptDuplicateRenderViewHost test case.
 IN_PROC_BROWSER_TEST_F(SecurityExploitBrowserTest,
                        AttemptDuplicateRenderWidgetHost) {
   int duplicate_routing_id = MSG_ROUTING_NONE;
@@ skipping 262 matching lines @@
   // separate task of the message loop, so ensure that the process is still
   // considered alive.
   EXPECT_TRUE(root->current_frame_host()->GetProcess()->HasConnection());
 
   exit_observer.Wait();
   EXPECT_FALSE(exit_observer.did_exit_normally());
   ResourceDispatcherHost::Get()->SetDelegate(nullptr);
 }
 
 }  // namespace content