only in patch2:
unchanged:
--- a/core/includes/theme.inc
+++ b/core/includes/theme.inc
@@ -1302,7 +1302,9 @@ function template_preprocess_html(&$variables) {
   ];
   $variables['placeholder_token'] = Crypt::randomBytesBase64(55);
   foreach ($types as $type => $placeholder_name) {
-    $placeholder = '<' . $placeholder_name . '-placeholder token="' . $variables['placeholder_token'] . '">';
+    // Placeholder will never be printed for the browser so it should not be
+    // escaped.
+    $placeholder = Markup::create('<' . $placeholder_name . '-placeholder token="' . $variables['placeholder_token'] . '">');
     $variables['#attached']['html_response_attachment_placeholders'][$type] = $placeholder;
   }
 }