Code:  WebString WebPageSerializer::generateBaseTagDeclaration(const WebString& baseTarget)
 {
     if (baseTarget.isEmpty())
         return String("<base href=\".\">");
     String baseString = "<base href=\".\" target=\"" + static_cast<const String&>(baseTarget) + "\">";
    return baseString;
}

Vulnerability Type: 
CWE ID: CWE-20
Summary: The page serializer in Google Chrome before 47.0.2526.73 mishandles Mark of the Web (MOTW) comments for URLs containing a *--* sequence, which might allow remote attackers to inject HTML via a crafted URL, as demonstrated by an initial http://example.com?-- substring.
Commit Message: Escape "--" in the page URL at page serialization

This patch makes page serializer to escape the page URL embed into a HTML
comment of result HTML[1] to avoid inserting text as HTML from URL by
introducing a static member function |PageSerialzier::markOfTheWebDeclaration()|
for sharing it between |PageSerialzier| and |WebPageSerialzier| classes.

[1] We use following format for serialized HTML:
saved from url=(${lengthOfURL})${URL}

BUG=503217
TEST=webkit_unit_tests --gtest_filter=PageSerializerTest.markOfTheWebDeclaration
TEST=webkit_unit_tests --gtest_filter=WebPageSerializerTest.fromUrlWithMinusMinu

Review URL: https://codereview.chromium.org/1371323003

Cr-Commit-Position: refs/heads/master@{#351736}