Loading a same-origin PDF in an iframe routes through the GuestView
MimeHandlerView path (ChromeOS default; selected on Linux via
--disable-features=PdfOopif). The browser commits a template
HTML page in the iframe and creates an <embed> placeholder child
frame in the same renderer process.
The compromised-renderer behaviour (creating a child of the placeholder and
ACKing the Unload without detaching it) is simulated by code injected into
RenderFrameImpl::Unload; see chromium-changes.patch.