Avoid renderer kills on subframe navigations after main frame replaceState.

content/browser/frame_host/navigation_controller_impl.cc

Index: content/browser/frame_host/navigation_controller_impl.cc
diff --git a/content/browser/frame_host/navigation_controller_impl.cc b/content/browser/frame_host/navigation_controller_impl.cc
index 08555a3f9c5714cf6bfab46bbce3a8887d95cdc7..95f5f1307ea128f556e65da57d8f69fadc7b4396 100644
--- a/content/browser/frame_host/navigation_controller_impl.cc
+++ b/content/browser/frame_host/navigation_controller_impl.cc
@@ -1456,10 +1456,11 @@ bool NavigationControllerImpl::RendererDidNavigateAutoSubframe(
 
   // Update the current navigation entry in case we're going back/forward.
   if (entry_index != last_committed_entry_index_) {
-    // Make sure that a subframe commit isn't changing the main frame URL.
+    // Make sure that a subframe commit isn't changing the main frame's origin.
     // Otherwise the renderer process may be confused, leading to a URL spoof.
-    if (GetLastCommittedEntry()->GetURL() !=
-        GetEntryAtIndex(entry_index)->GetURL()) {
+    // We can't check the path since that may change (https://crbug.com/373041).
+    if (GetLastCommittedEntry()->GetURL().GetOrigin() !=
+        GetEntryAtIndex(entry_index)->GetURL().GetOrigin()) {
       bad_message::ReceivedBadMessage(rfh->GetProcess(),
                                       bad_message::NC_AUTO_SUBFRAME);
     }