Upstream: Renderers are running in WebAPKs.

chrome/android/webapk/shell_apk/AndroidManifest.xml

Index: chrome/android/webapk/shell_apk/AndroidManifest.xml
diff --git a/chrome/android/webapk/shell_apk/AndroidManifest.xml b/chrome/android/webapk/shell_apk/AndroidManifest.xml
index 68f9c309120cc13eaa76a5a6bac2996cf735ccef..23640818c2a0faf2e4f4dc05d7fe40c8e6542799 100644
--- a/chrome/android/webapk/shell_apk/AndroidManifest.xml
+++ b/chrome/android/webapk/shell_apk/AndroidManifest.xml
@@ -40,5 +40,19 @@
               <category android:name="android.intent.category.WEBAPK_API" />
             </intent-filter>
         </service>
+        <meta-data android:name="org.chromium.content.browser.NUM_SANDBOXED_SERVICES"
+            android:value="3"/>
+        <service android:name="org.chromium.webapk.lib.common.WebApkSandboxedProcessService0"
+            android:isolatedProcess="true"
+            android:process=":webapk_sandboxed_process0"
+            android:exported="true"/>

[pkotwicz, 2016/06/10 21:29:47]

- Looking at chrome/android/java/AndroidManifest.xml the sandboxed services
specify an android:permission do we need to this here too?
- I think that you need tools:ignore="ExportedService" otherwise proguard
complains

[Xi Han, 2016/06/13 20:04:11]

Add tools:ignore="ExportedService".

Hmmm, if we specify a permission here, does that mean Chrome needs to declare
all these permissions if Chrome wants to connect to WebAPKs' child process?

[pkotwicz, 2016/06/14 01:19:48]

I think that Chrome would have to declare the permission if it wants to connect
with the WebAPK. Chrome's sandboxed renderers use a permission with "signature"
protectionLevel. On second thought, I do not know whether we want to use that
for the WebAPK's sandboxed renderers. Should Chrome and WebAPKs have the same
signature?

[Xi Han, 2016/06/14 21:55:03]

I think WebAPK will be signed by using Chromium keys, same as dev/beta/canary,
but Chrome is signed with Google's key. On the other side, if each WebAPK
declares its own permission for the child process service, while we have to make
Chrome declare all these permissions if Chrome wants to connect to WebAPKs,
which is impossible.

+        <service android:name="org.chromium.webapk.lib.common.WebApkSandboxedProcessService1"
+            android:isolatedProcess="true"
+            android:process=":webapk_sandboxed_process1"
+            android:exported="true"/>
+        <service android:name="org.chromium.webapk.lib.common.WebApkSandboxedProcessService2"
+            android:isolatedProcess="true"
+            android:process=":webapk_sandboxed_process2"
+            android:exported="true"/>
     </application>
 </manifest>