Why this CL triggers an OilPan crash.

content/renderer/render_view_impl.cc

Index: content/renderer/render_view_impl.cc
diff --git a/content/renderer/render_view_impl.cc b/content/renderer/render_view_impl.cc
index b8376f250824369ce847feeb5c1e35da6f864d55..25f4f88acefb9f1e5ecbf7ebadea18cb50e248c0 100644
--- a/content/renderer/render_view_impl.cc
+++ b/content/renderer/render_view_impl.cc
@@ -612,9 +612,12 @@ void RenderViewImpl::Initialize(
 #endif
   display_mode_ = params.initial_size.display_mode;
 
-  webview_ = WebView::Create(this, is_hidden()
-                                       ? blink::kWebPageVisibilityStateHidden
-                                       : blink::kWebPageVisibilityStateVisible);
+  browsing_instance_id_ = params.browsing_instance_id;
+  webview_ =
+      WebView::Create(this,
+                      is_hidden() ? blink::kWebPageVisibilityStateHidden
+                                  : blink::kWebPageVisibilityStateVisible,
+                      params.browsing_instance_id);
   RenderWidget::Init(show_callback, webview_->GetWidget());
 
   g_view_map.Get().insert(std::make_pair(webview(), this));
@@ -1469,6 +1472,8 @@ WebView* RenderViewImpl::CreateView(WebLocalFrame* creator,
   view_params.main_frame_widget_routing_id = reply->main_frame_widget_route_id;
   view_params.session_storage_namespace_id =
       reply->cloned_session_storage_namespace_id;
+  view_params.browsing_instance_id =
+      creator_frame->render_view()->browsing_instance_id_;
   view_params.swapped_out = false;
   // WebCore will take care of setting the correct name.
   view_params.replicated_frame_state = FrameReplicationState();