OOPIF: Specify previous sibling frames when creating RenderFrames.

When initializing a new renderer for an OOP frame, the current
behavior is to first create all the RenderFrameProxies, and then to
create the new RenderFrame, appending it as its parent's last child in
the frame tree.  This disregards the order of sibling frames and thus
may break indexed window access (e.g., window.frames[2]).

This CL passes the previous sibling's routing ID in the
FrameMsg_NewFrame message, so that the new frame can be inserted in
the correct place in the frame tree.  Note that we don't need to do
this for RenderFrameProxies, as those are already created in the
correct order (by CreateProxiesForSiteInstance) when initializing a
new renderer process.

Corresponding Blink CL: https://codereview.chromium.org/1119823003/

BUG=478792

Review URL: https://codereview.chromium.org/1113393004

Cr-Commit-Position: refs/heads/master@{#328384}

1 files changed, 9 insertions, 1 deletions

diff --git a/content/renderer/render_frame_impl.cc b/content/renderer/render_frame_impl.cc
index 043b33c..fba4b77 100644
--- a/content/renderer/render_frame_impl.cc
+++ b/content/renderer/render_frame_impl.cc
@@ -565,6 +565,7 @@ RenderFrameImpl* RenderFrameImpl::FromRoutingID(int32 routing_id) {
 void RenderFrameImpl::CreateFrame(
     int routing_id,
     int parent_routing_id,
+    int previous_sibling_routing_id,
     int proxy_routing_id,
     const FrameReplicationState& replicated_state,
     CompositorDependencies* compositor_deps,
@@ -584,12 +585,19 @@ void RenderFrameImpl::CreateFrame(
     CHECK(parent_proxy);
     blink::WebRemoteFrame* parent_web_frame = parent_proxy->web_frame();
 
+    blink::WebFrame* previous_sibling_web_frame = nullptr;
+    RenderFrameProxy* previous_sibling_proxy =
+        RenderFrameProxy::FromRoutingID(previous_sibling_routing_id);
+    if (previous_sibling_proxy)
+      previous_sibling_web_frame = previous_sibling_proxy->web_frame();
+
     // Create the RenderFrame and WebLocalFrame, linking the two.
     render_frame =
         RenderFrameImpl::Create(parent_proxy->render_view(), routing_id);
     web_frame = parent_web_frame->createLocalChild(
         WebString::fromUTF8(replicated_state.name),
-        ContentToWebSandboxFlags(replicated_state.sandbox_flags), render_frame);
+        ContentToWebSandboxFlags(replicated_state.sandbox_flags), render_frame,
+        previous_sibling_web_frame);
   } else {
     RenderFrameProxy* proxy =
         RenderFrameProxy::FromRoutingID(proxy_routing_id);