Move existing kSitePerProcess checks to a policy-oracle object

content/browser/site_instance_impl.cc

Index: content/browser/site_instance_impl.cc
diff --git a/content/browser/site_instance_impl.cc b/content/browser/site_instance_impl.cc
index 42d29421782ea48d17f1ae70cf9ea3fef376f025..47fb3a944a66ac20d55f4e29f7eb3b7f306e2d99 100644
--- a/content/browser/site_instance_impl.cc
+++ b/content/browser/site_instance_impl.cc
@@ -4,7 +4,6 @@
 
 #include "content/browser/site_instance_impl.h"
 
-#include "base/command_line.h"
 #include "content/browser/browsing_instance.h"
 #include "content/browser/child_process_security_policy_impl.h"
 #include "content/browser/frame_host/debug_urls.h"
@@ -13,7 +12,7 @@
 #include "content/public/browser/content_browser_client.h"
 #include "content/public/browser/render_process_host_factory.h"
 #include "content/public/browser/web_ui_controller_factory.h"
-#include "content/public/common/content_switches.h"
+#include "content/public/common/site_isolation_policy.h"
 #include "content/public/common/url_constants.h"
 #include "net/base/registry_controlled_domains/registry_controlled_domain.h"
 
@@ -211,6 +210,12 @@ bool SiteInstanceImpl::HasWrongProcessForURL(const GURL& url) {
       GetProcess(), browsing_instance_->browser_context(), site_url);
 }
 
+bool SiteInstanceImpl::RequiresDedicatedProcess() {
+  if (!has_site_)
+    return false;
+  return SiteIsolationPolicy::DoesSiteRequireDedicatedProcess(site_);
+}
+
 void SiteInstanceImpl::IncrementRelatedActiveContentsCount() {
   browsing_instance_->increment_active_contents_count();
 }
@@ -341,11 +346,11 @@ void SiteInstanceImpl::RenderProcessHostDestroyed(RenderProcessHost* host) {
 }
 
 void SiteInstanceImpl::LockToOrigin() {
-  // We currently only restrict this process to a particular site if --site-per-
-  // process flag is present.
-  const base::CommandLine& command_line =
-      *base::CommandLine::ForCurrentProcess();
-  if (command_line.HasSwitch(switches::kSitePerProcess)) {
+  // TODO(nick): When all sites are isolated, this operation provides strong
+  // protection. If only some sites are isolated, we need additional logic here
+  // to prevent the non-isolated sites from requesting resources for isolated
+  // sites. (file a bug for this)

[nasko, 2015/07/08 12:52:23]

I assume the "file a bug for this" is to happen before committing this CL,
right?

[ncarter (slow), 2015/07/10 23:29:18]

Done.

+  if (SiteIsolationPolicy::DoesSiteRequireDedicatedProcess(site_)) {
     // Guest processes cannot be locked to its site because guests always have
     // a fixed SiteInstance. The site of GURLs a guest loads doesn't match that
     // SiteInstance. So we skip locking the guest process to the site.