Keep subdomains of an isolated origin in the isolated origin's SiteInstance.

content/browser/isolated_origin_util.h

Index: content/browser/isolated_origin_util.h
diff --git a/content/browser/isolated_origin_util.h b/content/browser/isolated_origin_util.h
new file mode 100644
index 0000000000000000000000000000000000000000..6d22c7597d7a66b9e2ae00a6f1edfc68fb2b001e
--- /dev/null
+++ b/content/browser/isolated_origin_util.h
@@ -0,0 +1,31 @@
+// Copyright (c) 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_BROWSER_ISOLATED_ORIGIN_UTIL_H_
+#define CONTENT_BROWSER_ISOLATED_ORIGIN_UTIL_H_
+
+#include "url/origin.h"
+
+namespace content {
+
+class IsolatedOriginUtil {
+ public:
+  // Checks whether |origin| matches the isolated origin specified by
+  // |isolated_origin|.  Subdomains are considered to match isolated origins,
+  // so this will be true if
+  // (1) |origin| has the same scheme, host, and port as |isolated_origin|, or
+  // (2) |origin| has the same scheme and port as |isolated_origin|, and its
+  //     host is a subdomain of |isolated_origin|'s host.

[Charlie Reis, 2017/06/28 01:02:18]

As above, we may also want to mention that this doesn't consider sites, which
don't care about port.

[alexmos, 2017/06/28 18:29:51]

Done.

+  //
+  // For example, if |isolated_origin| is https://isolated.foo.com, this will
+  // return true if |origin| is https://isolated.foo.com or
+  // https://bar.isolated.foo.com, but it will return false for an |origin| of
+  // https://unisolated.foo.com or https://foo.com.
+  static bool DoesOriginMatchIsolatedOrigin(const url::Origin& origin,
+                                            const url::Origin& isolated_origin);
+};
+
+}  // namespace content
+
+#endif  // CONTENT_BROWSER_ISOLATED_ORIGIN_UTIL_H_