Rewrite Text node attaching to not be N^2

Source/core/html/parser/HTMLTreeBuilder.cpp

Index: Source/core/html/parser/HTMLTreeBuilder.cpp
diff --git a/Source/core/html/parser/HTMLTreeBuilder.cpp b/Source/core/html/parser/HTMLTreeBuilder.cpp
index f9252ed237f8142fc95cc57421a9a5a882f9ae5f..4f030cdbd1049e3c2cab3525d4c7e26070526267 100644
--- a/Source/core/html/parser/HTMLTreeBuilder.cpp
+++ b/Source/core/html/parser/HTMLTreeBuilder.cpp
@@ -338,6 +338,11 @@ void HTMLTreeBuilder::detach()
     m_tree.detach();
 }
 
+void HTMLTreeBuilder::flush()
+{
+    m_tree.flush();
+}
+
 HTMLTreeBuilder::FragmentParsingContext::FragmentParsingContext()
     : m_fragment(0)
     , m_contextElement(0)
@@ -395,6 +400,9 @@ void HTMLTreeBuilder::processToken(AtomicHTMLToken* token)
         return;
     }
 
+    // Any non-character token needs to cause us to flush any pending text immediately.
+    // NOTE: flush() can cause any queued tasks to execute, possibly re-entering the parser.
+    m_tree.flush();

[abarth-chromium, 2013/10/11 18:54:04]

I wonder if we need a faster reject here in the case where there's nothing to
flush.  If you have perf-bot trouble, I'd keep that in mind.

     m_shouldSkipLeadingNewline = false;
 
     switch (token->type()) {