Enable sending frame-specific messages to the correct input router.

Presently RenderFrameHostImpl::Send() does not use its own widget's
input router when sending message, meaning messages to subframes could
be sent to the wrong frame. This was discovered while trying to make
InputMsg_SelectRange/InputHostMsg_SelectRange_Ack work properly for
messages sent to an out-of-process iframe.

Note: this is a re-land of https://codereview.chromium.org/2012933002/
originally committed as

https://crrev.com/7a22bf01ea55475b295e40f5bbfd1add2bc73649
Cr-Commit-Position: refs/heads/master@{#396044}

TBR=creis@chromium.org
BUG=470662

Review-Url: https://codereview.chromium.org/2322233003
Cr-Commit-Position: refs/heads/master@{#417586}

content/browser/frame_host/render_frame_host_impl.cc

@@ -528,7 +528,7 @@ blink::WebPageVisibilityState RenderFrameHostImpl::GetVisibilityState() {
 
 bool RenderFrameHostImpl::Send(IPC::Message* message) {
   if (IPC_MESSAGE_ID_CLASS(message->type()) == InputMsgStart) {
-    return render_view_host_->GetWidget()->input_router()->SendInput(
+    return GetRenderWidgetHost()->input_router()->SendInput(
         base::WrapUnique(message));
   }