Kill renderers for bad password forms in --site-per-process.

content/browser/site_instance_impl.cc

Index: content/browser/site_instance_impl.cc
diff --git a/content/browser/site_instance_impl.cc b/content/browser/site_instance_impl.cc
index 42d29421782ea48d17f1ae70cf9ea3fef376f025..ad335f51d3adb867a7dd081236de331e4674a65c 100644
--- a/content/browser/site_instance_impl.cc
+++ b/content/browser/site_instance_impl.cc
@@ -354,6 +354,12 @@ void SiteInstanceImpl::LockToOrigin() {
     if (site_.SchemeIs(content::kGuestScheme))
       return;
 
+    // TODO(creis, nick) https://crbug.com/510588 Chrome UI pages use the same
+    // site (chrome://chrome), so they can't be locked because the site being
+    // loaded doesn't match the SiteInstance.
+    if (site_.SchemeIs(content::kChromeUIScheme))
+      return;
+
     ChildProcessSecurityPolicyImpl* policy =
         ChildProcessSecurityPolicyImpl::GetInstance();
     policy->LockToOrigin(process_->GetID(), site_);