Introduce support for origins that require process isolation.

content/common/site_isolation_policy.cc

Index: content/common/site_isolation_policy.cc
diff --git a/content/common/site_isolation_policy.cc b/content/common/site_isolation_policy.cc
index b3db97ede58b4a304fa8f37b0a76786b1d864658..6b6db62e8f171eef58119ed52239ff608277c3f6 100644
--- a/content/common/site_isolation_policy.cc
+++ b/content/common/site_isolation_policy.cc
@@ -19,7 +19,7 @@ bool SiteIsolationPolicy::AreCrossProcessFramesPossible() {
 // investigated.
 #if defined(OS_ANDROID)
   return UseDedicatedProcessesForAllSites() ||
-         IsTopDocumentIsolationEnabled() ||
+         IsTopDocumentIsolationEnabled() || AreIsolatedOriginsEnabled() ||

[alexmos, 2017/05/03 23:31:08]

I'm a bit sad about this, as I'd love to just enable
AreCrossProcessFramesPossible for Android and then remove it everywhere, but
it's not clear how soon we can do that.  Even with hit testing fixed, we still
have issue 690229 (and possibly others?), so it seems we'll need a workaround
here in the short term.  I ended up just adding the plumbing for the
command-line switch to this CL, since it wasn't that much and we'll need to
expose it anyway.  But we'll need to come back to this if we bake
accounts.google.com into a whitelist without a flag, or when the set of isolated
origins starts to change dynamically (should we enable
AreCrossProcessFramesPossible only when there's 1+ isolated origin, etc). 
Another problem is that the renderer currently also needs it for a couple of
CHECKs, which is the reason I also have to include the new switch in
PropagateBrowserCommandLineToRenderer.

          GetContentClient()->IsSupplementarySiteIsolationModeEnabled() ||
          base::FeatureList::IsEnabled(::features::kGuestViewCrossProcessFrames);
 #else
@@ -43,4 +43,14 @@ bool SiteIsolationPolicy::IsTopDocumentIsolationEnabled() {
       switches::kTopDocumentIsolation);
 }
 
+// static
+bool SiteIsolationPolicy::AreIsolatedOriginsEnabled() {
+  // TODO(alexmos): This currently assumes that isolated origins are only added
+  // via the command-line switch, which may not be true in the future.  Remove
+  // this function when AreCrossProcessFramesPossible becomes true on Android
+  // above.
+  return base::CommandLine::ForCurrentProcess()->HasSwitch(
+      switches::kIsolateOrigins);
+}
+
 }  // namespace content