Enhance --enable-strict-site-isolation to prevent a site-isolated renderer

content/public/common/content_switches.cc

Index: content/public/common/content_switches.cc
===================================================================
--- content/public/common/content_switches.cc	(revision 109054)
+++ content/public/common/content_switches.cc	(working copy)
@@ -242,7 +242,8 @@
 // Enables StatsTable, logging statistics to a global named shared memory table.
 const char kEnableStatsTable[]              = "enable-stats-table";
 
-// Experimentally ensure each renderer process has pages from only one site.
+// Experimentally ensure each renderer process only has access to the cookies
+// for the top-level site.

[Charlie Reis, 2011/11/10 01:09:26]

I think we're talking about two different things here.  With the changes in this
CL, this flag:
1) ensures a renderer process only has pages from a single site.
2) ensures a renderer process only has access to the cookies from that site.

If we're going to keep both of these behaviors under a single flag, we need to
at least describe them separately.

Personally, while I think it's fun to play with the cookie restriction stuff, I
don't think we'll ever be able to turn it on by default, unlike the
one-site-per-process logic.  As a result, I'm a little hesitant to bake in the
cookie isolation logic without clearly marking it as a separate experiment.

 // This is expected to break compatibility with many pages for now.
 const char kEnableStrictSiteIsolation[]     = "enable-strict-site-isolation";