[reland] SegmentedString::push() should always push a char in front

Source/core/html/parser/HTMLEntityParser.cpp

Index: Source/core/html/parser/HTMLEntityParser.cpp
diff --git a/Source/core/html/parser/HTMLEntityParser.cpp b/Source/core/html/parser/HTMLEntityParser.cpp
index dc30c83715f4f72ba2b92a598ad4d987b51370c8..62167ef4103e2cb8f0c29c8f2ecc792389b364a8 100644
--- a/Source/core/html/parser/HTMLEntityParser.cpp
+++ b/Source/core/html/parser/HTMLEntityParser.cpp
@@ -95,8 +95,8 @@ static void unconsumeCharacters(SegmentedString& source, ConsumedCharacterBuffer
     if (consumedCharacters.size() == 1)
         source.push(consumedCharacters[0]);
     else if (consumedCharacters.size() == 2) {
-        source.push(consumedCharacters[0]);
         source.push(consumedCharacters[1]);
+        source.push(consumedCharacters[0]);
     } else
         source.prepend(SegmentedString(String(consumedCharacters)));
 }
@@ -212,8 +212,8 @@ bool consumeHTMLEntity(SegmentedString& source, DecodedHTMLEntity& decodedEntity
                 entityState = Hex;
                 continue;
             }
-            source.push('#');
             source.push('x');
+            source.push('#');
             return false;
         }
         case MaybeHexUpperCaseX: {
@@ -221,8 +221,8 @@ bool consumeHTMLEntity(SegmentedString& source, DecodedHTMLEntity& decodedEntity
                 entityState = Hex;
                 continue;
             }
-            source.push('#');
             source.push('X');
+            source.push('#');
             return false;
         }
         case Hex: {