Keep subdomains of an isolated origin in the isolated origin's SiteInstance.

content/browser/child_process_security_policy_impl.cc

Index: content/browser/child_process_security_policy_impl.cc
diff --git a/content/browser/child_process_security_policy_impl.cc b/content/browser/child_process_security_policy_impl.cc
index a9b54d8cfe3f82ccdb0085d3234220242e539a10..9200820bd3637ec2119c7c927a37746b020eca2a 100644
--- a/content/browser/child_process_security_policy_impl.cc
+++ b/content/browser/child_process_security_policy_impl.cc
@@ -17,6 +17,7 @@
 #include "base/strings/string_split.h"
 #include "base/strings/string_util.h"
 #include "build/build_config.h"
+#include "content/browser/isolated_origin_util.h"
 #include "content/browser/site_instance_impl.h"
 #include "content/common/resource_request_body_impl.h"
 #include "content/common/site_isolation_policy.h"
@@ -1070,10 +1071,11 @@ void ChildProcessSecurityPolicyImpl::AddIsolatedOrigin(
     const url::Origin& origin) {
   CHECK(!origin.unique())
       << "Cannot register a unique origin as an isolated origin.";
-  CHECK(!IsIsolatedOrigin(origin))
-      << "Duplicate isolated origin: " << origin.Serialize();
 
   base::AutoLock lock(lock_);
+  CHECK(!isolated_origins_.count(origin))
+      << "Duplicate isolated origin: " << origin.Serialize();
+
   isolated_origins_.insert(origin);
 }
 
@@ -1090,8 +1092,38 @@ void ChildProcessSecurityPolicyImpl::AddIsolatedOriginsFromCommandLine(
 
 bool ChildProcessSecurityPolicyImpl::IsIsolatedOrigin(
     const url::Origin& origin) {
+  url::Origin unused_result;
+  return GetMatchingIsolatedOrigin(origin, &unused_result);
+}
+
+bool ChildProcessSecurityPolicyImpl::GetMatchingIsolatedOrigin(
+    const url::Origin& origin,
+    url::Origin* result) {
+  *result = url::Origin();
+  base::AutoLock lock(lock_);
+
+  // If multiple isolated origins are registered with a common domain suffix,
+  // return the most specific one.  For example, if foo.isolated.com and
+  // isolated.com are both isolated origins, bar.foo.isolated.com should return
+  // foo.isolated.com.
+  bool found = false;
+  for (auto isolated_origin : isolated_origins_) {
+    if (IsolatedOriginUtil::DoesOriginMatchIsolatedOrigin(origin,
+                                                          isolated_origin)) {
+      if (!found || result->host().length() < isolated_origin.host().length()) {
+        *result = isolated_origin;
+        found = true;
+      }
+    }
+  }
+
+  return found;
+}
+
+void ChildProcessSecurityPolicyImpl::RemoveIsolatedOriginForTesting(
+    const url::Origin& origin) {
   base::AutoLock lock(lock_);
-  return isolated_origins_.find(origin) != isolated_origins_.end();
+  isolated_origins_.erase(origin);
 }
 
 }  // namespace content