Android webview tries to switch to CE context

android_webview/glue/java/src/com/android/webview/chromium/WebViewChromiumFactoryProvider.java

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 package com.android.webview.chromium;
 
 import android.Manifest;
 import android.app.ActivityManager;
 import android.content.ComponentCallbacks2;
 import android.content.Context;
 import android.content.Intent;
 import android.content.SharedPreferences;
 import android.content.pm.PackageInfo;
 import android.content.pm.PackageManager;
 import android.content.pm.PackageManager.NameNotFoundException;
 import android.net.Uri;
 import android.os.Build;
 import android.os.Looper;
 import android.os.Process;
 import android.os.StrictMode;
+import android.os.UserManager;
 import android.provider.Settings;
 import android.util.Log;
 import android.webkit.CookieManager;
 import android.webkit.GeolocationPermissions;
 import android.webkit.ServiceWorkerController;
 import android.webkit.TokenBindingService;
 import android.webkit.WebStorage;
 import android.webkit.WebView;
 import android.webkit.WebViewDatabase;
 import android.webkit.WebViewFactory;
@@ skipping 161 matching lines @@
      * Constructor called by the API 22 version of {@link WebViewFactory} and later.
      */
     public WebViewChromiumFactoryProvider(android.webkit.WebViewDelegate delegate) {
         initialize(WebViewDelegateFactory.createProxyDelegate(delegate));
     }
 
     @SuppressFBWarnings("DMI_HARDCODED_ABSOLUTE_FILENAME")
     private void initialize(WebViewDelegate webViewDelegate) {
         mWebViewDelegate = webViewDelegate;
 
-        checkStorageIsNotDeviceProtected(mWebViewDelegate.getApplication());
+        Context ctx = switchToCredentialProtectedStorage(
+                mWebViewDelegate.getApplication().getApplicationContext());
 
         // WebView needs to make sure to always use the wrapped application context.
-        ContextUtils.initApplicationContext(
-                ResourcesContextWrapperFactory.get(
-                        mWebViewDelegate.getApplication().getApplicationContext()));
+        ContextUtils.initApplicationContext(ResourcesContextWrapperFactory.get(ctx));
 
         if (isBuildDebuggable()) {
             // Suppress the StrictMode violation as this codepath is only hit on debuggable builds.
             StrictMode.ThreadPolicy oldPolicy = StrictMode.allowThreadDiskReads();
             CommandLine.initFromFile(COMMAND_LINE_FILE);
             StrictMode.setThreadPolicy(oldPolicy);
         } else {
             CommandLine.init(null);
         }
 
@@ skipping 28 matching lines @@
         }
         if (lastVersion != currentVersion) {
             mWebViewPrefs.edit().putInt(VERSION_CODE_PREF, currentVersion).apply();
         }
 
         mShouldDisableThreadChecking =
                 shouldDisableThreadChecking(ContextUtils.getApplicationContext());
         // Now safe to use WebView data directory.
     }
 
-    static void checkStorageIsNotDeviceProtected(Context context) {
+    // Webview must use a CredentialEncrypted Context. If context is a CE context, then simply
+    // return it without modification. Otherwise, create a new CE context and return that instead.
+    static Context switchToCredentialProtectedStorage(Context context) {
+        // For versions N+, android webview must use a CredentialEncrypted Context
         if ((Build.VERSION.CODENAME.equals("N") || Build.VERSION.SDK_INT > Build.VERSION_CODES.M)
                 && context.isDeviceProtectedStorage()) {
-            throw new IllegalArgumentException(
-                    "WebView cannot be used with device protected storage");
+            context = context.createCredentialProtectedStorageContext();
+
+            if (!context.getSystemService(UserManager.class).isUserUnlocked()) {

[Torne, 2016/09/22 09:59:54]

I think you should be getting a lint warning about this line: the version of
getSystemService that takes a Class and returns the correct type (instead of the
old sucky version that takes a String and returns Object) is new in API23 and so
WebView can't expect it to be there in general. In this specific case, it's fine
because the code is guarded by a version check, but the linter is supposed to
point these out and require that you annotate the method to suppress it - is
that not happening for you or am I mistaken?

[Nate Fischer, 2016/09/22 19:47:49]

I don't think I received a lint warning. I was able to run `git cl format` and
`git cl upload` without receiving any warning. Should I make any change here
(such as an annotation) to mark this as the new version? Or will the lint
warnings pop up as the result of some other command? Thanks.

[Torne, 2016/09/23 11:13:15]

I think they happen during the build, not in presubmit? I'm really not sure,
though. It's possible it doesn't detect this case for some reason, or that I'm
mistaken about how it works, I don't write java code that calls android APIs
that frequently.

There's a method annotation to indicate that this method uses a certain minimum
API version and this is okay..

+                throw new IllegalArgumentException(
+                        "WebView cannot be used with device protected storage");
+            }
         }
+        return context;
     }
 
     private static boolean isBuildDebuggable() {
         return !Build.TYPE.equals("user");
     }
 
     /**
      * Both versionCodes should be from a WebView provider package implemented by Chromium.
      * VersionCodes from other kinds of packages won't make any sense in this method.
      *
@@ skipping 374 matching lines @@
                 mWebViewDatabase = new WebViewDatabaseAdapter(this, awDatabase);
             }
         }
         return mWebViewDatabase;
     }
 
     WebViewDelegate getWebViewDelegate() {
         return mWebViewDelegate;
     }
 }