Fix remote frame origin access in ContentWatcher::NotifyBrowserOfChange.

The frame traversal in that function was accessing the frame's
SecurityOrigin via the document(), which is incorrect in the case of
remote frames which have no document().

BUG=581274

Review URL: https://codereview.chromium.org/1634203002

Cr-Commit-Position: refs/heads/master@{#371592}

extensions/renderer/content_watcher.cc

@@ -97,7 +97,7 @@ void ContentWatcher::NotifyBrowserOfChange(
   std::set<base::StringPiece> transitive_selectors;
   for (blink::WebFrame* frame = top_frame; frame;
        frame = frame->traverseNext(/*wrap=*/false)) {
-    if (top_origin.canAccess(frame->document().securityOrigin())) {
+    if (top_origin.canAccess(frame->securityOrigin())) {
       std::map<blink::WebFrame*, std::set<std::string> >::const_iterator
           frame_selectors = matching_selectors_.find(frame);
       if (frame_selectors != matching_selectors_.end()) {