Code:  cc::FrameSinkId RenderWidgetHostViewAura::GetFrameSinkId() {
  return delegated_frame_host_ ? delegated_frame_host_->GetFrameSinkId()
                               : cc::FrameSinkId();
 }

Vulnerability Type: 
CWE ID: CWE-254
Summary: The Omnibox implementation in Google Chrome before 48.0.2564.82 allows remote attackers to spoof a document's origin via unspecified vectors.
Commit Message: Allocate a FrameSinkId for RenderWidgetHostViewAura in mus+ash

RenderWidgetHostViewChildFrame expects its parent to have a valid
FrameSinkId. Make sure RenderWidgetHostViewAura has a FrameSinkId even
if DelegatedFrameHost is not used (in mus+ash).

BUG=706553
TBR=jam@chromium.org

Review-Url: https://codereview.chromium.org/2847253003
Cr-Commit-Position: refs/heads/master@{#468179}