Enhance --enable-strict-site-isolation to prevent a site-isolated renderer

content/browser/site_instance.cc

Index: content/browser/site_instance.cc
===================================================================
--- content/browser/site_instance.cc	(revision 109054)
+++ content/browser/site_instance.cc	(working copy)
@@ -4,12 +4,15 @@
 
 #include "content/browser/site_instance.h"
 
+#include "base/command_line.h"
 #include "content/browser/browsing_instance.h"
+#include "content/browser/child_process_security_policy.h"
 #include "content/browser/renderer_host/browser_render_process_host.h"
 #include "content/browser/webui/web_ui_factory.h"
 #include "content/public/browser/content_browser_client.h"
 #include "content/public/browser/notification_service.h"
 #include "content/public/browser/notification_types.h"
+#include "content/public/common/content_switches.h"
 #include "content/public/common/url_constants.h"
 #include "net/base/registry_controlled_domain.h"
 
@@ -86,6 +89,13 @@
 
     // Make sure the process starts at the right max_page_id
     process_->UpdateMaxPageID(max_page_id_);
+
+    const CommandLine& command_line = *CommandLine::ForCurrentProcess();
+    if (command_line.HasSwitch(switches::kEnableStrictSiteIsolation)) {
+      ChildProcessSecurityPolicy* policy =
+          ChildProcessSecurityPolicy::GetInstance();
+      policy->LockToOrigin(process_->id(), site_);
+    }
   }
   DCHECK(process_);