Enhance --enable-strict-site-isolation to prevent a site-isolated renderer

content/browser/child_process_security_policy.cc

Index: content/browser/child_process_security_policy.cc
===================================================================
--- content/browser/child_process_security_policy.cc	(revision 111259)
+++ content/browser/child_process_security_policy.cc	(working copy)
@@ -10,6 +10,7 @@
 #include "base/platform_file.h"
 #include "base/stl_util.h"
 #include "base/string_util.h"
+#include "content/browser/site_instance.h"
 #include "content/public/common/bindings_policy.h"
 #include "content/public/common/url_constants.h"
 #include "googleurl/src/gurl.h"
@@ -98,6 +99,17 @@
     return false;
   }
 
+  bool CanUseCookiesForOrigin(const GURL& gurl) {
+    if (origin_lock_.is_empty())
+      return true;
+    GURL site_gurl = SiteInstance::GetSiteForURL(NULL, gurl);
+    return origin_lock_ == site_gurl;
+  }
+
+  void LockToOrigin(const GURL& gurl) {
+    origin_lock_ = gurl;
+  }
+
   bool has_web_ui_bindings() const {
     return enabled_bindings_ & content::BINDINGS_POLICY_WEB_UI;
   }
@@ -124,6 +136,8 @@
 
   bool can_read_raw_cookies_;
 
+  GURL origin_lock_;
+
   DISALLOW_COPY_AND_ASSIGN(SecurityState);
 };
 
@@ -449,3 +463,22 @@
     return false;
   return state->second->HasPermissionsForFile(file, permissions);
 }
+
+bool ChildProcessSecurityPolicy::CanUseCookiesForOrigin(int child_id,
+                                                        const GURL& gurl) {
+  base::AutoLock lock(lock_);
+  SecurityStateMap::iterator state = security_state_.find(child_id);
+  if (state == security_state_.end())
+    return false;
+  return state->second->CanUseCookiesForOrigin(gurl);
+}
+
+void ChildProcessSecurityPolicy::LockToOrigin(int child_id, const GURL& gurl) {
+  // "gurl" can be currently empty in some cases, such as file://blah.
+  DCHECK(SiteInstance::GetSiteForURL(NULL, gurl) == gurl);
+  base::AutoLock lock(lock_);
+  SecurityStateMap::iterator state = security_state_.find(child_id);
+  DCHECK(state != security_state_.end());
+  state->second->LockToOrigin(gurl);
+}
+