AW: ignore and log SecurityException for intents

Some apps declare a permission-guarded yet exported="true" Activity.
Starting an intent to such an Activity will triggers a
SecurityException. Instead of crashing, we should just ignore these
intents.

Chrome already handles this case, so this CL changes WebView shell and
the default WebViewClient to behave similarly.

This change will have no impact for apps which set their own
WebViewClient, which should represent the vast majority of apps.

R=torne@chromium.org

Bug: 889300
Test: Manual - built a test app as described in http://b/115868439.
Change-Id: Ia9ff8113d4796033661366c06e186d7bb6eb288d
Reviewed-on: https://chromium-review.googlesource.com/1244547Reviewed-by: Richard Coles <torne@chromium.org>
Commit-Queue: Nate Fischer <ntfschr@chromium.org>
Cr-Commit-Position: refs/heads/master@{#594387}

android_webview/java/src/org/chromium/android_webview/AwContentsClient.java

@@ -221,12 +221,18 @@ public abstract class AwContentsClient {
 
         try {
             context.startActivity(intent);
+            return true;
         } catch (ActivityNotFoundException ex) {
             Log.w(TAG, "No application can handle %s", url);
-            return false;
+        } catch (SecurityException ex) {
+            // This can happen if the Activity is exported="true", guarded by a permission, and sets
+            // up an intent filter matching this intent. This is a valid configuration for an
+            // Activity, so instead of crashing, we catch the exception and do nothing. See
+            // https://crbug.com/808494 and https://crbug.com/889300.
+            Log.w(TAG, "SecurityException when starting intent for %s", url);
         }
 
-        return true;
+        return false;
     }
 
     public static Uri[] parseFileChooserResult(int resultCode, Intent intent) {

android_webview/tools/system_webview_shell/apk/src/org/chromium/webview_shell/WebViewBrowserActivity.java

@@ -694,6 +694,12 @@ public class WebViewBrowserActivity extends Activity implements PopupMenu.OnMenu
             return true;
         } catch (ActivityNotFoundException ex) {
             Log.w(TAG, "No application can handle %s", url);
+        } catch (SecurityException ex) {
+            // This can happen if the Activity is exported="true", guarded by a permission, and sets
+            // up an intent filter matching this intent. This is a valid configuration for an
+            // Activity, so instead of crashing, we catch the exception and do nothing. See
+            // https://crbug.com/808494 and https://crbug.com/889300.
+            Log.w(TAG, "SecurityException when starting intent for %s", url);
         }
         return false;
     }