Allow chained startInstrumentation if it's originated from SHELL

If an instrumentation starts another instrumentation and so on,
and the original instrumentation is started from SHELL, allow all
Context#startInstrumentation calls in this chain.

Bug: 237766679
Test: atest CtsAppTestCases:InstrumentationTest
Change-Id: I3ea7aa27bd776fec546908a37f667f680da9c892

services/core/java/com/android/server/am/ActivityManagerService.java

@@ -14838,7 +14838,7 @@ public class ActivityManagerService extends IActivityManager.Stub
             }
 
             if (!Build.IS_DEBUGGABLE && callingUid != ROOT_UID && callingUid != SHELL_UID
-                    && callingUid != SYSTEM_UID) {
+                    && callingUid != SYSTEM_UID && !hasActiveInstrumentationLocked(callingPid)) {
                 // If it's not debug build and not called from root/shell/system uid, reject it.
                 final String msg = "Permission Denial: instrumentation test "
                         + className + " from pid=" + callingPid + ", uid=" + callingUid
@@ -14945,6 +14945,17 @@ public class ActivityManagerService extends IActivityManager.Stub
         return true;
     }
 
+    @GuardedBy("this")
+    private boolean hasActiveInstrumentationLocked(int pid) {
+        if (pid == 0) {
+            return false;
+        }
+        synchronized (mPidsSelfLocked) {
+            ProcessRecord process = mPidsSelfLocked.get(pid);
+            return process != null && process.getActiveInstrumentation() != null;
+        }
+    }
+
     @GuardedBy("this")
     private boolean startInstrumentationOfSdkSandbox(
             ComponentName className,