Noted here:
https://chromium-review.googlesource.com/c/chromium/src/+/1117704/1/third_party/blink/renderer/platform/weborigin/origin_access_entry.cc#111

We presently appear to look for a suffix length in the UTF-8 encoding of a hostname, and then use that as an index into the 16-bit WTF::String, host_. It's not clear that this is correct (but maybe it's fine for some reason).

We should probably either fix this or document why it's okay.