PR Checklist

Please check if your PR fulfills the following requirements:

• The commit message follows our guidelines: https://github.com/angular/angular/blob/main/contributing-docs/commit-message-guidelines.md
• Tests for the changes have been added (for bug fixes / features)
• Docs have been added / updated (for bug fixes / features)

PR Type

What kind of change does this PR introduce?

• Bugfix
• Feature
• Code style update (formatting, local variables)
• Refactoring (no functional changes, no api changes)
• Build related changes
• CI related changes
• Documentation content changes
• angular.dev application / infrastructure changes
• Other... Please describe:

What is the current behavior?

Issue Number: N/A

escapeCommentText matches each disallowed marker as a whole with a single global regex. Since String.replace with /g moves lastIndex past each match, a marker that overlaps one already consumed is never seen, and its delimiters stay unescaped.

<!--!> is the shortest case: the scanner takes <!-- at offset 0 and resumes at offset 4, so the --!> sitting at offset 2 (it shares the --) is skipped. Only the leading < gets wrapped:

escapeCommentText('<!--!>');  // '​<​!--!>'  <- still ends the comment
escapeCommentText('<!--->');  // '​<​!--->'  <- same thing via '-->'

Walking the tokenizer over <!-- + ​<​!--!><img src=x onerror=alert(1)> + -->, the !> puts it in comment-end-bang and then back to the data state, so the comment closes early and the <img> after it parses as a live element. That is the round-trip the docstring on this function says it protects.

The existing spec covers each marker on its own ('>', '->', '<!--', '-->', '--!>', '<!-') but never two that share characters, which is why this slipped through.

What is the new behavior?

The pattern matches the </> delimiter along with its surrounding context rather than the whole marker, so nothing a later marker needs is consumed and overlapping markers are all escaped:

escapeCommentText('<!--!>');  // '​<​!--!​>​'
escapeCommentText('<!--->');  // '​<​!---​>​'

The accepted language is unchanged, so output for every case already in dom_spec.ts is byte-identical, including the ones that must stay untouched (.>, .->, <!-.). The three new expectations fail on main and pass here.

Does this PR introduce a breaking change?

• Yes
• No

Other information

The reachable call site today is the ngReflect binding comment in shared.ts, which is dev-mode and opt-in, so the live blast radius is small. Fixing it in escapeCommentText anyway since the escaping contract is what the rest of the comment-node path relies on.