Fix corner-cases for WebVTT tokenizer escape handling

Source/core/html/track/vtt/VTTTokenizer.cpp

Index: Source/core/html/track/vtt/VTTTokenizer.cpp
diff --git a/Source/core/html/track/vtt/VTTTokenizer.cpp b/Source/core/html/track/vtt/VTTTokenizer.cpp
index 9c9c3f451a7724486fea1fa3bf07194962c73786..9dd82a4657527a2ff9832e402c549a55a552daf7 100644
--- a/Source/core/html/track/vtt/VTTTokenizer.cpp
+++ b/Source/core/html/track/vtt/VTTTokenizer.cpp
@@ -141,13 +141,21 @@ bool VTTTokenizer::nextToken(VTTToken& token)
             } else if (isASCIIAlphanumeric(cc)) {
                 buffer.append(static_cast<LChar>(cc));
                 WEBVTT_ADVANCE_TO(EscapeState);
+            } else if (cc == '<') {
+                result.append(buffer);
+                return emitToken(VTTToken::StringToken(result.toString()));
             } else if (cc == kEndOfFileMarker) {
                 result.append(buffer);
                 return advanceAndEmitToken(source, VTTToken::StringToken(result.toString()));
             } else {
-                if (!equalLiteral(buffer, "&"))
-                    result.append(buffer);
+                result.append(buffer);
                 buffer.clear();
+
+                if (cc == '&') {
+                    buffer.append(static_cast<LChar>(cc));
+                    WEBVTT_ADVANCE_TO(EscapeState);
+                }
+                result.append(cc);
                 WEBVTT_ADVANCE_TO(DataState);
             }
         }