Avoid renderer kills on subframe navigations after main frame replaceState.

content/browser/frame_host/navigation_controller_impl.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/frame_host/navigation_controller_impl.h"
 
 #include "base/bind.h"
 #include "base/command_line.h"
 #include "base/logging.h"
 #include "base/metrics/histogram.h"
@@ skipping 1438 matching lines @@
       rfh->GetSiteInstance(),
       params.page_id);
   if (entry_index < 0 ||
       entry_index >= static_cast<int>(entries_.size())) {
     NOTREACHED();
     return false;
   }
 
   // Update the current navigation entry in case we're going back/forward.
   if (entry_index != last_committed_entry_index_) {
-    // Make sure that a subframe commit isn't changing the main frame URL.
+    // Make sure that a subframe commit isn't changing the main frame's origin.
     // Otherwise the renderer process may be confused, leading to a URL spoof.
-    if (GetLastCommittedEntry()->GetURL() !=
-        GetEntryAtIndex(entry_index)->GetURL()) {
+    // We can't check the path since that may change (https://crbug.com/373041).
+    if (GetLastCommittedEntry()->GetURL().GetOrigin() !=
+        GetEntryAtIndex(entry_index)->GetURL().GetOrigin()) {
       bad_message::ReceivedBadMessage(rfh->GetProcess(),
                                       bad_message::NC_AUTO_SUBFRAME);
     }
     last_committed_entry_index_ = entry_index;
     DiscardNonCommittedEntriesInternal();
     return true;
   }
 
   if (base::CommandLine::ForCurrentProcess()->HasSwitch(
           switches::kSitePerProcess)) {
@@ skipping 545 matching lines @@
     }
   }
 }
 
 void NavigationControllerImpl::SetGetTimestampCallbackForTest(
     const base::Callback<base::Time()>& get_timestamp_callback) {
   get_timestamp_callback_ = get_timestamp_callback;
 }
 
 }  // namespace content