Kill renderer if it changes the main frame's origin on subframe commits.

content/browser/frame_host/navigation_controller_impl.cc

Index: content/browser/frame_host/navigation_controller_impl.cc
diff --git a/content/browser/frame_host/navigation_controller_impl.cc b/content/browser/frame_host/navigation_controller_impl.cc
index 7446d5153b845270ae510ff358d4c2fb960cf9e4..1a0e4d63dfd9a3eecb700385fdc7d3b8aaf8f5c3 100644
--- a/content/browser/frame_host/navigation_controller_impl.cc
+++ b/content/browser/frame_host/navigation_controller_impl.cc
@@ -1319,11 +1319,8 @@ bool NavigationControllerImpl::RendererDidNavigateAutoSubframe(
       // (https://crbug.com/373041).
       if (GetLastCommittedEntry()->GetURL().GetOrigin() !=
           GetEntryAtIndex(entry_index)->GetURL().GetOrigin()) {
-        // TODO(creis): This is unexpectedly being encountered in practice.  If
-        // you encounter this in practice, please post details to
-        // https://crbug.com/486916.  Once that's resolved, we'll change this to
-        // kill the renderer process with bad_message::NC_AUTO_SUBFRAME.
-        NOTREACHED() << "Unexpected main frame origin change on AUTO_SUBFRAME.";
+        bad_message::ReceivedBadMessage(rfh->GetProcess(),
+                                        bad_message::NC_AUTO_SUBFRAME);
       }
 
       // TODO(creis): Update the FrameNavigationEntry in --site-per-process.