Rewrite Text node attaching to not be N^2

Source/core/html/parser/HTMLTreeBuilder.cpp

 /*
  * Copyright (C) 2010 Google, Inc. All Rights Reserved.
  * Copyright (C) 2011 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
@@ skipping 320 matching lines @@
 #ifndef NDEBUG
     // This call makes little sense in fragment mode, but for consistency
     // DocumentParser expects detach() to always be called before it's destroyed.
     m_isAttached = false;
 #endif
     // HTMLConstructionSite might be on the callstack when detach() is called
     // otherwise we'd just call m_tree.clear() here instead.
     m_tree.detach();
 }
 
+void HTMLTreeBuilder::flush()
+{
+    m_tree.flush();
+}
+
 HTMLTreeBuilder::FragmentParsingContext::FragmentParsingContext()
     : m_fragment(0)
     , m_contextElement(0)
 {
 }
 
 HTMLTreeBuilder::FragmentParsingContext::FragmentParsingContext(DocumentFragment* fragment, Element* contextElement)
     : m_fragment(fragment)
     , m_contextElement(contextElement)
 {
@@ skipping 37 matching lines @@
     // We might be detached now.
 }
 
 void HTMLTreeBuilder::processToken(AtomicHTMLToken* token)
 {
     if (token->type() == HTMLToken::Character) {
         processCharacter(token);
         return;
     }
 
+    // Any non-character token needs to cause us to flush any pending text immediately.
+    // NOTE: flush() can cause any queued tasks to execute, possibly re-entering the parser.
+    m_tree.flush();

[abarth-chromium, 2013/10/11 18:54:04]

I wonder if we need a faster reject here in the case where there's nothing to
flush.  If you have perf-bot trouble, I'd keep that in mind.

     m_shouldSkipLeadingNewline = false;
 
     switch (token->type()) {
     case HTMLToken::Uninitialized:
     case HTMLToken::Character:
         ASSERT_NOT_REACHED();
         break;
     case HTMLToken::DOCTYPE:
         processDoctypeToken(token);
         break;
@@ skipping 2414 matching lines @@
     ASSERT(m_isAttached);
     // Warning, this may detach the parser. Do not do anything else after this.
     m_tree.finishedParsing();
 }
 
 void HTMLTreeBuilder::parseError(AtomicHTMLToken*)
 {
 }
 
 } // namespace WebCore