Page's <title> double escaped

I think this bug was hidden before #2505989: Controllers render caching at the top level and setting a custom page title lose the title on render cache hits because node title was not cached. On render cache hit we get a title from cache that contains some html tags like <span data-quickedit-field-id="node/1/title/en/full" class="field field-node--title field-name-title field-type-string field-label-hidden">article&039;s &quot;title&quot;</span> and this string is marked as safe, but later the result of strip_tags() in template_preprocess_html() is not marked as safe.

This also affects <title> on node edit page.

+++ b/core/includes/theme.inc
@@ -1256,7 +1256,7 @@ function template_preprocess_html(&$variables) {
+      'title' => trim(Html::decodeEntities(strip_tags($variables['page']['#title']))),

Would SafeString::create(trim(strip_tags($variables['page']['#title']))) work better in case some other code marks an identical string (to the resulting 'title' here) as safe?

#6 .. and do we still need ensure special characters are escaped with htmlspecialchars(Html::decodeEntities(..?

#9

Wait, so why is $variables['page']['#title'] escaped already?

I think it is not already escaped but gets autoescaped (except on render cache miss it is marked safe).

Can we use decodeEntities and autoescaping here or should we use SafeString like #6?

#16.1 doesn't make much sense.. I think we get the title from these:
EntityViewController::buildTitle()

$page['#title'] = $this->renderer->render($page[$label_field]);

NodeForm::form()

$form['#title'] = $this->t('<em>Edit @type</em> @title', array('@type' => node_get_type_label($node), '@title' => $node->label()));

This also affects _title_callback like BlockContentController::getAddFormTitle():

return $this->t('Add %type custom block', array('%type' => $block_content_type->label()));

Special characters in the label of block content type get double escaped.