Change HTMLTokenizer::Attribute::Range.start initial invalid value from 0 -> -1

In rare cases, BackgroundHTMLParser may feed input SegmentedString starting
w/ attribute name=value pairs. This CL fixes ASSERT failures in such cases.

Before this CL, the attribute {name,value} range start offset initial value
was set to 0. This was based on the assumption that attribute name=value pairs
never have input stream offset of 0. However, this assumption doesn't hold
when BackgroundHTMLParser has XSSAuditor disabled and accurate offset
tracking has been disabled.

This CL changes the initial invalid value to -1 to avoid the issue.

BUG=619141

Review-Url: https://codereview.chromium.org/2121703002
Cr-Commit-Position: refs/heads/master@{#404150}
4 files changed