Fix corner-cases for WebVTT tokenizer escape handling

Source/core/html/track/vtt/VTTTokenizer.cpp

 /*
  * Copyright (C) 2011 Google Inc.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 123 matching lines @@
                     result.append(noBreakSpace);
                 } else {
                     buffer.append(static_cast<LChar>(cc));
                     result.append(buffer);
                 }
                 buffer.clear();
                 WEBVTT_ADVANCE_TO(DataState);
             } else if (isASCIIAlphanumeric(cc)) {
                 buffer.append(static_cast<LChar>(cc));
                 WEBVTT_ADVANCE_TO(EscapeState);
+            } else if (cc == '<') {
+                result.append(buffer);
+                return emitToken(VTTToken::StringToken(result.toString()));
             } else if (cc == kEndOfFileMarker) {
                 result.append(buffer);
                 return advanceAndEmitToken(source, VTTToken::StringToken(result.toString()));
             } else {
-                if (!equalLiteral(buffer, "&"))
-                    result.append(buffer);
+                result.append(buffer);
                 buffer.clear();
+
+                if (cc == '&') {
+                    buffer.append(static_cast<LChar>(cc));
+                    WEBVTT_ADVANCE_TO(EscapeState);
+                }
+                result.append(cc);
                 WEBVTT_ADVANCE_TO(DataState);
             }
         }
         END_STATE()
 
         WEBVTT_BEGIN_STATE(TagState) {
             if (isTokenizerWhitespace(cc)) {
                 ASSERT(result.isEmpty());
                 WEBVTT_ADVANCE_TO(StartTagAnnotationState);
             } else if (cc == '.') {
@@ skipping 74 matching lines @@
         END_STATE()
 
     }
 
     ASSERT_NOT_REACHED();
     return false;
 }
 
 }