Enhance --enable-strict-site-isolation to prevent a site-isolated renderer

content/public/common/content_switches.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/public/common/content_switches.h"
 
 namespace switches {
 
 // By default, file:// URIs cannot read other file:// URIs. This is an
 // override for developers who need the old behavior for testing.
@@ skipping 224 matching lines @@
 // Cause the OS X sandbox write to syslog every time an access to a resource
 // is denied by the sandbox.
 const char kEnableSandboxLogging[]          = "enable-sandbox-logging";
 
 // Enable the seccomp sandbox (Linux only)
 const char kEnableSeccompSandbox[]          = "enable-seccomp-sandbox";
 
 // Enables StatsTable, logging statistics to a global named shared memory table.
 const char kEnableStatsTable[]              = "enable-stats-table";
 
-// Experimentally ensure each renderer process has pages from only one site.
+// Experimentally ensure each renderer process only has access to the cookies
+// for the top-level site.

[Charlie Reis, 2011/11/10 01:09:26]

I think we're talking about two different things here.  With the changes in this
CL, this flag:
1) ensures a renderer process only has pages from a single site.
2) ensures a renderer process only has access to the cookies from that site.

If we're going to keep both of these behaviors under a single flag, we need to
at least describe them separately.

Personally, while I think it's fun to play with the cookie restriction stuff, I
don't think we'll ever be able to turn it on by default, unlike the
one-site-per-process logic.  As a result, I'm a little hesitant to bake in the
cookie isolation logic without clearly marking it as a separate experiment.

 // This is expected to break compatibility with many pages for now.
 const char kEnableStrictSiteIsolation[]     = "enable-strict-site-isolation";
 
 // Enable multithreaded GPU compositing of web content.
 const char kEnableThreadedCompositing[]     = "enable-threaded-compositing";
 
 // Enable use of experimental TCP sockets API for sending data in the
 // SYN packet.
 const char kEnableTcpFastOpen[]             = "enable-tcp-fastopen";
 
@@ skipping 259 matching lines @@
 // instead of NSS for SSL.
 const char kUseSystemSSL[]                  = "use-system-ssl";
 #endif
 
 #if !defined(OFFICIAL_BUILD)
 // Causes the renderer process to throw an assertion on launch.
 const char kRendererCheckFalseTest[]        = "renderer-check-false-test";
 #endif
 
 }  // namespace switches