Kill renderer if it changes the main frame's origin on subframe commits.

content/browser/frame_host/navigation_controller_impl.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 /*
  * Copyright (C) 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
  * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved.
  *     (http://www.torchmobile.com/)
  *
@@ skipping 1301 matching lines @@
     // a history auto" navigation.  Update the last committed index accordingly.
     // If we don't recognize the |nav_entry_id|, it might be either a pending
     // entry for a transfer or a recently pruned entry.  We'll handle it below.
     if (entry_index != -1 && entry_index != last_committed_entry_index_) {
       // Make sure that a subframe commit isn't changing the main frame's
       // origin. Otherwise the renderer process may be confused, leading to a
       // URL spoof. We can't check the path since that may change
       // (https://crbug.com/373041).
       if (GetLastCommittedEntry()->GetURL().GetOrigin() !=
           GetEntryAtIndex(entry_index)->GetURL().GetOrigin()) {
-        // TODO(creis): This is unexpectedly being encountered in practice.  If
-        // you encounter this in practice, please post details to
-        // https://crbug.com/486916.  Once that's resolved, we'll change this to
-        // kill the renderer process with bad_message::NC_AUTO_SUBFRAME.
-        NOTREACHED() << "Unexpected main frame origin change on AUTO_SUBFRAME.";
+        bad_message::ReceivedBadMessage(rfh->GetProcess(),
+                                        bad_message::NC_AUTO_SUBFRAME);
       }
 
       // TODO(creis): Update the FrameNavigationEntry in --site-per-process.
       last_committed_entry_index_ = entry_index;
       DiscardNonCommittedEntriesInternal();
       return true;
     }
   }
 
   if (SiteIsolationPolicy::UseSubframeNavigationEntries()) {
@@ skipping 716 matching lines @@
     }
   }
 }
 
 void NavigationControllerImpl::SetGetTimestampCallbackForTest(
     const base::Callback<base::Time()>& get_timestamp_callback) {
   get_timestamp_callback_ = get_timestamp_callback;
 }
 
 }  // namespace content