Code: void DoCanonicalizeRef(const CHAR* spec,
                       const Component& ref,
                       CanonOutput* output,
                       Component* out_ref) {
  if (ref.len < 0) {
    *out_ref = Component();
    return;
  }

  output->push_back('#');
  out_ref->begin = output->length();

  int end = ref.end();
  for (int i = ref.begin; i < end; i++) {
    if (spec[i] == 0) {
      continue;
    } else if (static_cast<UCHAR>(spec[i]) < 0x20) {
      AppendEscapedChar(static_cast<unsigned char>(spec[i]), output);
    } else if (static_cast<UCHAR>(spec[i]) < 0x80) {
       output->push_back(static_cast<char>(spec[i]));
     } else {
      unsigned code_point;
      ReadUTFChar(spec, &i, end, &code_point);
      AppendUTF8Value(code_point, output);
     }
   }
 
  out_ref->len = output->length() - out_ref->begin;
}

Vulnerability Type: XSS 
CWE ID: CWE-79
Summary: Insufficient encoding of URL fragment identifiers in Blink in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to perform a DOM based XSS attack via a crafted HTML page.
Commit Message: Percent-encode UTF8 characters in URL fragment identifiers.

This brings us into line with Firefox, Safari, and the spec.

Bug: 758523
Change-Id: I7e354ab441222d9fd08e45f0e70f91ad4e35fafe
Reviewed-on: https://chromium-review.googlesource.com/668363
Commit-Queue: Mike West <mkwst@chromium.org>
Reviewed-by: Jochen Eisinger <jochen@chromium.org>
Reviewed-by: Andy Paicu <andypaicu@chromium.org>
Cr-Commit-Position: refs/heads/master@{#507481}