Rewrite Text node attaching to not be N^2

Source/core/html/parser/HTMLDocumentParser.cpp

 /*
  * Copyright (C) 2010 Google, Inc. All Rights Reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 539 matching lines @@
         ASSERT(token().isUninitialized());
     }
 
     // Ensure we haven't been totally deref'ed after pumping. Any caller of this
     // function should be holding a RefPtr to this to ensure we weren't deleted.
     ASSERT(refCount() >= 1);
 
     if (isStopped())
         return;
 
+    if (mode == ForceSynchronous)
+        m_treeBuilder->flush();

[abarth-chromium, 2013/10/11 18:54:04]

Don't you need to check 

if (isStopped())
    return;

here?  It's possible that flushing the tree builder executed JavaScript which
detached the parser.  We don't want to do anything else if that's the case.

+
     if (session.needsYield)
         m_parserScheduler->scheduleForResume();
 
     if (isWaitingForScripts()) {
         ASSERT(m_tokenizer->state() == HTMLTokenizer::DataState);
         if (!m_preloadScanner) {
             m_preloadScanner = adoptPtr(new HTMLPreloadScanner(m_options, document()->url(), document()->devicePixelRatio()));
             m_preloadScanner->appendToEnd(m_input.current());
         }
         m_preloadScanner->scan(m_preloader.get(), document()->baseElementURL());
@@ skipping 387 matching lines @@
         m_parserScheduler->suspend();
 }
 
 void HTMLDocumentParser::resumeScheduledTasks()
 {
     if (m_parserScheduler)
         m_parserScheduler->resume();
 }
 
 }