[turbolizer] Use textContent to set code view

Previously code view was set using innerHTML. This would cause problems
for html characters in the code -- in particular, '<' without a space
after it would start new HTML tags, and the code following it wouldn't
be visible.

Now, the source text is set using textContent, which doesn't parse the
value as HTML and implicitly escapes any HTML characters in the code.

Change-Id: I612a18c37bbb4da6a87063bb39d7f7123a3c4c0d
Reviewed-on: https://chromium-review.googlesource.com/461826Reviewed-by: Daniel Clifford <danno@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44233}

tools/turbolizer/code-view.js

@@ -122,13 +122,13 @@ class CodeView extends View {
 
   initializeCode(sourceText, sourcePosition) {
     var view = this;
-    if (sourceText == "") {
-      var newHtml = "<pre class=\"prettyprint\"</pre>";
-      view.divNode.innerHTML = newHtml;
-    } else {
-      var newHtml =
-          "<pre class=\"prettyprint linenums\">" + sourceText + "</pre>";
-      view.divNode.innerHTML = newHtml;
+    var codePre = document.createElement("pre");
+    codePre.classList.add("prettyprint");
+    view.divNode.innerHTML = "";
+    view.divNode.appendChild(codePre);
+    if (sourceText != "") {
+      codePre.classList.add("linenums");
+      codePre.textContent = sourceText;
       try {
         // Wrap in try to work when offline.
         view.PR.prettyPrint();