Escape '&' in javascript URLs for innerHTML/outerHTML

Source/core/editing/MarkupAccumulator.cpp

Index: Source/core/editing/MarkupAccumulator.cpp
diff --git a/Source/core/editing/MarkupAccumulator.cpp b/Source/core/editing/MarkupAccumulator.cpp
index b8f4a541273159d32662091a1de41bc471f886d8..fa01bf2875df102963a0ac988f58592179d8755b 100644
--- a/Source/core/editing/MarkupAccumulator.cpp
+++ b/Source/core/editing/MarkupAccumulator.cpp
@@ -218,6 +218,9 @@ void MarkupAccumulator::appendQuotedURLAttributeValue(StringBuilder& result, con
     String strippedURLString = resolvedURLString.stripWhiteSpace();
     if (protocolIsJavaScript(strippedURLString)) {
         // minimal escaping for javascript urls
+        if (strippedURLString.contains('&'))
+            strippedURLString.replaceWithLiteral('&', "&");
+
         if (strippedURLString.contains('"')) {
             if (strippedURLString.contains('\''))
                 strippedURLString.replaceWithLiteral('"', """);