chrome: Fix URL rewrite on new tab navigation (see issue #2969)

This fixes an `Unhandled chrome.send("getApps");` error when creating a new tab.

Creating a new tab initially loads chrome://newtab which should then be
rewritten to chrome://new-tab-page for normal profiles in
HandleNewTabURLRewrite. Failure to rewrite the URL results in the loading of
NewTabUI instead of the expected NewTabPageUI. NewTabUI loads different
resources for normal vs incognito/guest profiles (new_tab.js vs
incognito_tab.js), and new_tab.js calls chrome.send("getApps") via
page_list_view.js. This then fails in WebUIImpl::ProcessWebUIMessage because
the message is unhandled.

libcef/browser/chrome/chrome_content_browser_client_cef.cc

@@ -286,8 +286,9 @@ ChromeContentBrowserClientCef::CreateLoginDelegate(
 
 void ChromeContentBrowserClientCef::BrowserURLHandlerCreated(
     content::BrowserURLHandler* handler) {
-  scheme::BrowserURLHandlerCreated(handler);
+  // Register the Chrome handlers first for proper URL rewriting.
   ChromeContentBrowserClient::BrowserURLHandlerCreated(handler);
+  scheme::BrowserURLHandlerCreated(handler);
 }
 
 bool ChromeContentBrowserClientCef::IsWebUIAllowedToMakeNetworkRequests(

libcef/browser/net/chrome_scheme_handler.cc

@@ -632,11 +632,16 @@ class CefWebUIControllerFactory : public content::WebUIControllerFactory {
   }
 
   static void BrowserURLHandlerCreated(content::BrowserURLHandler* handler) {
+    // For Chrome runtime this is registered in
+    // ChromeContentBrowserClient::BrowserURLHandlerCreated().
+    if (cef::IsAlloyRuntimeEnabled()) {
       // Handler to rewrite chrome://about and chrome://sync URLs.
       handler->AddHandlerPair(&HandleChromeAboutAndChromeSyncRewrite,
                               content::BrowserURLHandler::null_handler());
+    }
 
-    // chrome: & friends.
+    // chrome: & friends. For Chrome runtime the default registration is
+    // disabled is ChromeContentBrowserClient::BrowserURLHandlerCreated().
     handler->AddHandlerPair(&HandleWebUI, &HandleWebUIReverse);
   }
 

patch/patch.cfg

@@ -250,6 +250,10 @@ patches = [
     # Support override of the User-Agent product component when NetworkService
     # is enabled.
     # https://bitbucket.org/chromiumembedded/cef/issues/2622
+    #
+    # Changes to support the Chrome runtime in CEF
+    # (chrome_content_browser_client.cc).
+    # https://bitbucket.org/chromiumembedded/cef/issues/2969
     'name': 'chrome_browser_product_override',
   },
   {

patch/patches/chrome_browser_product_override.patch

@@ -1,8 +1,16 @@
 diff --git chrome/browser/chrome_content_browser_client.cc chrome/browser/chrome_content_browser_client.cc
-index 19c5989c8b67..e85ce53a22a1 100644
+index 19c5989c8b67..659e6dbebea5 100644
 --- chrome/browser/chrome_content_browser_client.cc
 +++ chrome/browser/chrome_content_browser_client.cc
-@@ -1067,10 +1067,6 @@ void LaunchURL(const GURL& url,
+@@ -37,6 +37,7 @@
+ #include "base/threading/thread_task_runner_handle.h"
+ #include "build/build_config.h"
+ #include "build/chromeos_buildflags.h"
++#include "cef/libcef/features/features.h"
+ #include "chrome/browser/accessibility/accessibility_labels_service.h"
+ #include "chrome/browser/accessibility/accessibility_labels_service_factory.h"
+ #include "chrome/browser/accessibility/caption_util.h"
+@@ -1067,10 +1068,6 @@ void LaunchURL(const GURL& url,
    }
  }
  
@@ -13,7 +21,7 @@ index 19c5989c8b67..e85ce53a22a1 100644
  void MaybeAppendSecureOriginsAllowlistSwitch(base::CommandLine* cmdline) {
    // |allowlist| combines pref/policy + cmdline switch in the browser process.
    // For renderer and utility (e.g. NetworkService) processes the switch is the
-@@ -1258,6 +1254,14 @@ const blink::UserAgentBrandList& GetBrandVersionList() {
+@@ -1258,6 +1255,14 @@ const blink::UserAgentBrandList& GetBrandVersionList() {
    return *greased_brand_version_list;
  }
  
@@ -28,6 +36,18 @@ index 19c5989c8b67..e85ce53a22a1 100644
  std::string GetUserAgent() {
    base::CommandLine* command_line = base::CommandLine::ForCurrentProcess();
    if (command_line->HasSwitch(switches::kUserAgent)) {
+@@ -3610,9 +3615,11 @@ void ChromeContentBrowserClient::BrowserURLHandlerCreated(
+                           &search::HandleNewTabURLReverseRewrite);
+ #endif  // defined(OS_ANDROID)
+ 
++#if !BUILDFLAG(ENABLE_CEF)
+   // chrome: & friends.
+   handler->AddHandlerPair(&ChromeContentBrowserClient::HandleWebUI,
+                           &ChromeContentBrowserClient::HandleWebUIReverse);
++#endif
+ }
+ 
+ base::FilePath ChromeContentBrowserClient::GetDefaultDownloadDirectory() {
 diff --git chrome/browser/chrome_content_browser_client.h chrome/browser/chrome_content_browser_client.h
 index 3ef2329ac8a6..3e3ede99e042 100644
 --- chrome/browser/chrome_content_browser_client.h