Merge changes from topic "permz"

* changes:
  Flesh out remaining CR.wrap() methods.
  Apps using storage must have runtime permission.
diff --git a/api/test-current.txt b/api/test-current.txt
index 7762baa..bb20af0 100644
--- a/api/test-current.txt
+++ b/api/test-current.txt
@@ -680,9 +680,11 @@
     field public static final String FEATURE_ADOPTABLE_STORAGE = "android.software.adoptable_storage";
     field public static final String FEATURE_FILE_BASED_ENCRYPTION = "android.software.file_based_encryption";
     field public static final int FLAG_PERMISSION_HIDDEN = 1024; // 0x400
+    field public static final int FLAG_PERMISSION_POLICY_FIXED = 4; // 0x4
     field public static final int FLAG_PERMISSION_REVIEW_REQUIRED = 64; // 0x40
     field public static final int FLAG_PERMISSION_REVOKE_ON_UPGRADE = 8; // 0x8
     field public static final int FLAG_PERMISSION_REVOKE_WHEN_REQUESTED = 128; // 0x80
+    field public static final int FLAG_PERMISSION_SYSTEM_FIXED = 16; // 0x10
     field public static final int FLAG_PERMISSION_USER_FIXED = 2; // 0x2
     field public static final int FLAG_PERMISSION_USER_SET = 1; // 0x1
     field public static final int MATCH_FACTORY_ONLY = 2097152; // 0x200000
diff --git a/core/java/android/content/ContentResolver.java b/core/java/android/content/ContentResolver.java
index fa85f0a..791c551 100644
--- a/core/java/android/content/ContentResolver.java
+++ b/core/java/android/content/ContentResolver.java
@@ -1313,6 +1313,12 @@
     public final @Nullable ParcelFileDescriptor openFileDescriptor(@NonNull Uri uri,
             @NonNull String mode, @Nullable CancellationSignal cancellationSignal)
                     throws FileNotFoundException {
+        try {
+            if (mWrapped != null) return mWrapped.openFile(uri, mode, cancellationSignal);
+        } catch (RemoteException e) {
+            return null;
+        }
+
         AssetFileDescriptor afd = openAssetFileDescriptor(uri, mode, cancellationSignal);
         if (afd == null) {
             return null;
@@ -1455,6 +1461,12 @@
         Preconditions.checkNotNull(uri, "uri");
         Preconditions.checkNotNull(mode, "mode");
 
+        try {
+            if (mWrapped != null) return mWrapped.openAssetFile(uri, mode, cancellationSignal);
+        } catch (RemoteException e) {
+            return null;
+        }
+
         String scheme = uri.getScheme();
         if (SCHEME_ANDROID_RESOURCE.equals(scheme)) {
             if (!"r".equals(mode)) {
@@ -1634,6 +1646,12 @@
         Preconditions.checkNotNull(uri, "uri");
         Preconditions.checkNotNull(mimeType, "mimeType");
 
+        try {
+            if (mWrapped != null) return mWrapped.openTypedAssetFile(uri, mimeType, opts, cancellationSignal);
+        } catch (RemoteException e) {
+            return null;
+        }
+
         IContentProvider unstableProvider = acquireUnstableProvider(uri);
         if (unstableProvider == null) {
             throw new FileNotFoundException("No content provider: " + uri);
@@ -3525,12 +3543,7 @@
      */
     public @NonNull Bitmap loadThumbnail(@NonNull Uri uri, @NonNull Size size,
             @Nullable CancellationSignal signal) throws IOException {
-        Objects.requireNonNull(uri);
-        Objects.requireNonNull(size);
-
-        try (ContentProviderClient client = acquireContentProviderClient(uri)) {
-            return loadThumbnail(client, uri, size, signal, ImageDecoder.ALLOCATOR_SOFTWARE);
-        }
+        return loadThumbnail(this, uri, size, signal, ImageDecoder.ALLOCATOR_SOFTWARE);
     }
 
     /** {@hide} */
diff --git a/core/java/android/content/pm/PackageManager.java b/core/java/android/content/pm/PackageManager.java
index 8f7df25..de10bb0 100644
--- a/core/java/android/content/pm/PackageManager.java
+++ b/core/java/android/content/pm/PackageManager.java
@@ -2998,6 +2998,7 @@
      * @hide
      */
     @SystemApi
+    @TestApi
     public static final int FLAG_PERMISSION_POLICY_FIXED =  1 << 2;
 
     /**
@@ -3021,6 +3022,7 @@
      * @hide
      */
     @SystemApi
+    @TestApi
     public static final int FLAG_PERMISSION_SYSTEM_FIXED =  1 << 4;
 
     /**
diff --git a/core/java/android/provider/MediaStore.java b/core/java/android/provider/MediaStore.java
index 7feeeee..e5dbdac 100644
--- a/core/java/android/provider/MediaStore.java
+++ b/core/java/android/provider/MediaStore.java
@@ -31,6 +31,7 @@
 import android.app.Activity;
 import android.app.AppGlobals;
 import android.content.ClipData;
+import android.content.ContentInterface;
 import android.content.ContentProviderClient;
 import android.content.ContentResolver;
 import android.content.ContentUris;
@@ -1714,11 +1715,9 @@
                     url = cr.insert(EXTERNAL_CONTENT_URI, values);
 
                     if (source != null) {
-                        OutputStream imageOut = cr.openOutputStream(url);
-                        try {
-                            source.compress(Bitmap.CompressFormat.JPEG, 50, imageOut);
-                        } finally {
-                            imageOut.close();
+                        try (OutputStream out = new ParcelFileDescriptor.AutoCloseOutputStream(
+                                cr.openFile(url, "w", null))) {
+                            source.compress(Bitmap.CompressFormat.JPEG, 50, out);
                         }
 
                         long id = ContentUris.parseId(url);