Fix control message handling for RenderFrameProxyHost::Send.

content/browser/frame_host/render_frame_proxy_host.cc

Index: content/browser/frame_host/render_frame_proxy_host.cc
diff --git a/content/browser/frame_host/render_frame_proxy_host.cc b/content/browser/frame_host/render_frame_proxy_host.cc
index 6f502f61e8bb006f4d2e2723b8700446367ce71a..af86c2f60a649a572ab6c87b2fa3066818ddc1d8 100644
--- a/content/browser/frame_host/render_frame_proxy_host.cc
+++ b/content/browser/frame_host/render_frame_proxy_host.cc
@@ -101,7 +101,11 @@ bool RenderFrameProxyHost::Send(IPC::Message *msg) {
   // TODO(nasko): For now, RenderFrameHost uses this object to send IPC messages
   // while swapped out. This can be removed once we don't have a swapped out
   // state on RenderFrameHosts. See https://crbug.com/357747.
-  msg->set_routing_id(routing_id_);
+
+  // Don't reset the routing ID for control messages.  See
+  // https://crbug.com/423538
+  if (msg->routing_id() != MSG_ROUTING_CONTROL)
+    msg->set_routing_id(routing_id_);
   return GetProcess()->Send(msg);
 }