NOT YET READY: Making chrome.windows.create establish an actual "opener" relationship.

content/browser/security_exploit_browsertest.cc

 // Copyright (c) 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <stdint.h>
 
 #include "base/command_line.h"
 #include "base/containers/hash_tables.h"
 #include "base/macros.h"
 #include "base/strings/utf_string_conversions.h"
@@ skipping 75 matching lines @@
       shell2->web_contents()->GetRenderViewHost()->GetRoutingID();
   EXPECT_NE(*target_routing_id,
             shell->web_contents()->GetRenderViewHost()->GetRoutingID());
 
   // Now, simulate a link click coming from the renderer.
   GURL extension_url("https://bar.com/simple_page.html");
   WebContentsImpl* wc = static_cast<WebContentsImpl*>(shell->web_contents());
   wc->GetFrameTree()->root()->navigator()->RequestOpenURL(
       wc->GetFrameTree()->root()->current_frame_host(), extension_url, false,
       nullptr, std::string(), Referrer(), WindowOpenDisposition::CURRENT_TAB,
-      false, false, true);
+      false, true);
 
   // Since the navigation above requires a cross-process swap, there will be a
   // speculative/pending RenderFrameHost. Ensure it exists and is in a different
   // process than the initial page.
   RenderFrameHostImpl* next_rfh;
   if (IsBrowserSideNavigationEnabled())
     next_rfh = wc->GetRenderManagerForTesting()->speculative_frame_host();
   else
     next_rfh = wc->GetRenderManagerForTesting()->pending_frame_host();
 
@@ skipping 499 matching lines @@
   // |target_url|.
   WaitForLoadStop(shell()->web_contents());
   EXPECT_EQ(start_url, root->current_frame_host()->GetLastCommittedURL());
 
   // Verify that the malicious renderer got killed.
   exit_observer.Wait();
   EXPECT_FALSE(exit_observer.did_exit_normally());
 }
 
 }  // namespace content