From a01a0faebfbe6a8bd2ae52c54268ecedd280509b Mon Sep 17 00:00:00 2001
From: Dianne Hackborn <hackbod@google.com>
Date: Tue, 2 Dec 2014 10:33:14 -0800
Subject: [PATCH] Fix issue #18510117: Returning from an activity started
 with...

...startActivityForResult causes SecurityExpcetion

The ReferrerIntent hack was becoming visible to apps, which caused
a mismatch between marshalling/unmarshalling of the IPC call.

Change-Id: Ibcb788327b5bae4426efc826551799fa87d1cbaa
---
 core/java/android/app/ActivityThread.java  |  2 +-
 core/java/android/app/Instrumentation.java | 15 +++++++++------
 2 files changed, 10 insertions(+), 7 deletions(-)

diff --git a/core/java/android/app/ActivityThread.java b/core/java/android/app/ActivityThread.java
index b64e724faa56c..6b4db103e28b7 100644
--- a/core/java/android/app/ActivityThread.java
+++ b/core/java/android/app/ActivityThread.java
@@ -2436,7 +2436,7 @@ public final class ActivityThread {
     private void deliverNewIntents(ActivityClientRecord r, List<ReferrerIntent> intents) {
         final int N = intents.size();
         for (int i=0; i<N; i++) {
-            Intent intent = intents.get(i);
+            ReferrerIntent intent = intents.get(i);
             intent.setExtrasClassLoader(r.activity.getClassLoader());
             intent.prepareToEnterProcess();
             r.activity.mFragments.noteStateNotSaved();
diff --git a/core/java/android/app/Instrumentation.java b/core/java/android/app/Instrumentation.java
index d96153a33e1e5..3c3040473beab 100644
--- a/core/java/android/app/Instrumentation.java
+++ b/core/java/android/app/Instrumentation.java
@@ -1208,14 +1208,17 @@ public class Instrumentation {
      * @param intent The new intent being received.
      */
     public void callActivityOnNewIntent(Activity activity, Intent intent) {
+        activity.onNewIntent(intent);
+    }
+
+    /**
+     * @hide
+     */
+    public void callActivityOnNewIntent(Activity activity, ReferrerIntent intent) {
         final String oldReferrer = activity.mReferrer;
         try {
-            try {
-                activity.mReferrer = ((ReferrerIntent)intent).mReferrer;
-            } catch (ClassCastException e) {
-                activity.mReferrer = null;
-            }
-            activity.onNewIntent(intent);
+            activity.mReferrer = intent.mReferrer;
+            callActivityOnNewIntent(activity, new Intent(intent));
         } finally {
             activity.mReferrer = oldReferrer;
         }