android: Check GSA's broadcast permission.

chrome/android/java/src/org/chromium/chrome/browser/gsa/GSAAccountChangeListener.java

Index: chrome/android/java/src/org/chromium/chrome/browser/gsa/GSAAccountChangeListener.java
diff --git a/chrome/android/java/src/org/chromium/chrome/browser/gsa/GSAAccountChangeListener.java b/chrome/android/java/src/org/chromium/chrome/browser/gsa/GSAAccountChangeListener.java
index b16badae1efd8d4ca72a61ee2343a0bc1c58c788..a9fc2598699294baca4ef2313b02d2d142136208 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/gsa/GSAAccountChangeListener.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/gsa/GSAAccountChangeListener.java
@@ -8,9 +8,12 @@ import android.content.BroadcastReceiver;
 import android.content.Context;
 import android.content.Intent;
 import android.content.IntentFilter;
+import android.content.pm.PackageManager;
 import android.net.Uri;
 import android.os.Bundle;
+import android.os.Process;
 
+import org.chromium.base.ApiCompatibilityUtils;
 import org.chromium.base.Callback;
 import org.chromium.base.ContextUtils;
 import org.chromium.base.metrics.RecordHistogram;
@@ -106,13 +109,28 @@ public class GSAAccountChangeListener {
         context.registerReceiver(gsaUpdatedReceiver, filter);
     }
 
-    private void createGsaClientAndConnect(Context context) {
+    private void createGsaClientAndConnect(final Context context) {
         Callback<Bundle> onMessageReceived = new Callback<Bundle>() {
             @Override
             public void onResult(Bundle result) {
                 boolean supportsBroadcast =
                         result.getBoolean(KEY_SSB_BROADCASTS_ACCOUNT_CHANGE_TO_CHROME);
-                if (supportsBroadcast) notifyGsaBroadcastsAccountChanges();
+
+                if (supportsBroadcast) {
+                    // So, GSA will broadcast the account changes. But the broadcast on GSA side
+                    // requires a permission to be granted to Chrome. This permission has the
+                    // "signature" level, meaning that if for whatever reason Chrome's certificate
+                    // is not the same one as GSA's, then the broadcasts will never arrive.
+                    // Query the package manager to know whether the permission was granted, and
+                    // only switch to the broadcast mechanism if that's the case.
+                    if (ApiCompatibilityUtils.checkPermission(context,
+                                ACCOUNT_UPDATE_BROADCAST_PERMISSION, Process.myPid(),
+                                Process.myUid())
+                            == PackageManager.PERMISSION_GRANTED) {
+                        notifyGsaBroadcastsAccountChanges();
+                    }
+                }
+
                 // If GSA doesn't support the broadcast, we connect several times to the service per
                 // Chrome session (since there is a disconnect() call in
                 // ChromeActivity#onStopWithNative()). Only record the histogram once per startup to