fix($sniffer): don't use history.pushState in sandboxed Chrome Packaged Apps

While sandboxed Chrome Packaged Apps (CPAs) have the same restrictions wrt
accessing `history.pushState` as "normal" CPAs, they can't be detected in the
same way, as they do not have access to the same APIs.
Previously, due to their differences from normal CPAs, `$sniffer` would fail to
detect sandboxed CPAs and incorrectly assume `history.pushState` is available
(which resulted in an error being thrown).
This commit fixes the detection of sandboxed CPAs in `$sniffer`.

See angular#11932 and angular#13945 for previous work.

Closes angular#15021

Author: Parent5446

src/ng/sniffer.js

@@ -20,9 +20,15 @@
 function $SnifferProvider() {
   this.$get = ['$window', '$document', function($window, $document) {
     var eventSupport = {},
-        // Chrome Packaged Apps are not allowed to access `history.pushState`. They can be detected by
-        // the presence of `chrome.app.runtime` (see https://developer.chrome.com/apps/api_index)
-        isChromePackagedApp = $window.chrome && $window.chrome.app && $window.chrome.app.runtime,
+        // Chrome Packaged Apps are not allowed to access `history.pushState`.
+        // If not sandboxed, they can be detected by the presence of `chrome.app.runtime`
+        // (see https://developer.chrome.com/apps/api_index). If sandboxed, they can be detected by
+        // the presence of an extension runtime ID and the absence of other Chrome runtime APIs
+        // (see https://developer.chrome.com/apps/manifest/sandbox).
+        isChromePackagedApp =
+            $window.chrome &&
+            ($window.chrome.app && $window.chrome.app.runtime ||
+                !$window.chrome.app && $window.chrome.runtime && $window.chrome.runtime.id),
         hasHistoryPushState = !isChromePackagedApp && $window.history && $window.history.pushState,
         android =
           toInt((/android (\d+)/.exec(lowercase(($window.navigator || {}).userAgent)) || [])[1]),

test/ng/snifferSpec.js

@@ -90,6 +90,28 @@ describe('$sniffer', function() {
 
       expect(pushStateAccessCount).toBe(0);
     });
+
+    it('should not try to access `history.pushState` in sandboxed Chrome Packaged Apps',
+      function() {
+        var pushStateAccessCount = 0;
+
+        var mockHistory = Object.create(Object.prototype, {
+          pushState: {get: function() { pushStateAccessCount++; return noop; }}
+        });
+        var mockWindow = {
+          chrome: {
+            runtime: {
+              id: 'x'
+            }
+          },
+          history: mockHistory
+        };
+
+        sniffer(mockWindow);
+
+        expect(pushStateAccessCount).toBe(0);
+      }
+    );
   });