Retrieve NTP thumbnail URLs from the right frame

chrome/renderer/chrome_content_renderer_client.cc

Index: chrome/renderer/chrome_content_renderer_client.cc
diff --git a/chrome/renderer/chrome_content_renderer_client.cc b/chrome/renderer/chrome_content_renderer_client.cc
index cc0cf63ec9392fa562f3289f647a8047352854be..f488753f4bbf68bd2b60ac79dcab918593fc5ba2 100644
--- a/chrome/renderer/chrome_content_renderer_client.cc
+++ b/chrome/renderer/chrome_content_renderer_client.cc
@@ -1153,7 +1153,7 @@ bool ChromeContentRendererClient::WillSendRequest(
     return false;
 
   SearchBox* search_box =
-      SearchBox::Get(content::RenderFrame::FromWebFrame(frame));
+      SearchBox::Get(content::RenderFrame::FromWebFrame(frame->localRoot()));
   if (search_box) {
     // Note: this GURL copy could be avoided if host() were added to WebURL.
     GURL gurl(url);