Update createRemoteChild to pass SandboxFlags

content/renderer/render_frame_proxy.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/renderer/render_frame_proxy.h"
 
 #include <map>
 
 #include "base/lazy_instance.h"
 #include "content/child/webmessageportchannel_impl.h"
@@ skipping 56 matching lines @@
     render_view = RenderViewImpl::FromRoutingID(render_view_routing_id);
     web_frame = blink::WebRemoteFrame::create(proxy.get());
     render_view->webview()->setMainFrame(web_frame);
   } else {
     // Create a frame under an existing parent. The parent is always expected
     // to be a RenderFrameProxy, because navigations initiated by local frames
     // should not wind up here.
     RenderFrameProxy* parent =
         RenderFrameProxy::FromRoutingID(parent_routing_id);
     web_frame = parent->web_frame()->createRemoteChild(
-        blink::WebString::fromUTF8(replicated_state.name), proxy.get());
+        blink::WebString::fromUTF8(replicated_state.name),
+        RenderFrameImpl::ContentToWebSandboxFlags(
+            replicated_state.sandbox_flags),
+        proxy.get());
     render_view = parent->render_view();
   }
 
   proxy->Init(web_frame, render_view);
 
   // Initialize proxy's WebRemoteFrame with the security origin and other
   // replicated information.
   proxy->SetReplicatedState(replicated_state);
 
   return proxy.release();
@@ skipping 232 matching lines @@
       blink::WebUserGestureIndicator::isProcessingUserGesture();
   blink::WebUserGestureIndicator::consumeUserGesture();
   Send(new FrameHostMsg_OpenURL(routing_id_, params));
 }
 
 void RenderFrameProxy::forwardInputEvent(const blink::WebInputEvent* event) {
   Send(new FrameHostMsg_ForwardInputEvent(routing_id_, event));
 }
 
 }  // namespace