<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[177863] trunk/Source/WebCore</title>
</head>
<body>

<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt;  }
#msg dl a { font-weight: bold}
#msg dl a:link    { color:#fc3; }
#msg dl a:active  { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff  {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/177863">177863</a></dd>
<dt>Author</dt> <dd>darin@apple.com</dd>
<dt>Date</dt> <dd>2015-01-02 10:17:05 -0800 (Fri, 02 Jan 2015)</dd>
</dl>

<h3>Log Message</h3>
<pre>Re-land the HTMLTreeBuilder change with the assertion fixed.
https://bugs.webkit.org/show_bug.cgi?id=140032

Reviewed by Andreas Kling.</pre>

<h3>Modified Paths</h3>
<ul>
<li><a href="#trunkSourceWebCoreChangeLog">trunk/Source/WebCore/ChangeLog</a></li>
<li><a href="#trunkSourceWebCorehtmlparserHTMLDocumentParsercpp">trunk/Source/WebCore/html/parser/HTMLDocumentParser.cpp</a></li>
<li><a href="#trunkSourceWebCorehtmlparserHTMLTreeBuildercpp">trunk/Source/WebCore/html/parser/HTMLTreeBuilder.cpp</a></li>
<li><a href="#trunkSourceWebCorehtmlparserHTMLTreeBuilderh">trunk/Source/WebCore/html/parser/HTMLTreeBuilder.h</a></li>
<li><a href="#trunkSourceWebCorehtmlparserTextDocumentParsercpp">trunk/Source/WebCore/html/parser/TextDocumentParser.cpp</a></li>
</ul>

</div>
<div id="patch">
<h3>Diff</h3>
<a id="trunkSourceWebCoreChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/ChangeLog (177862 => 177863)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/ChangeLog        2015-01-02 18:07:48 UTC (rev 177862)
+++ trunk/Source/WebCore/ChangeLog        2015-01-02 18:17:05 UTC (rev 177863)
</span><span class="lines">@@ -1,3 +1,10 @@
</span><ins>+2015-01-02  Darin Adler  &lt;darin@apple.com&gt;
+
+        Re-land the HTMLTreeBuilder change with the assertion fixed.
+        https://bugs.webkit.org/show_bug.cgi?id=140032
+
+        Reviewed by Andreas Kling.
+
</ins><span class="cx"> 2015-01-02  Commit Queue  &lt;commit-queue@webkit.org&gt;
</span><span class="cx"> 
</span><span class="cx">         Unreviewed, rolling out r177859 and r177861.
</span></span></pre></div>
<a id="trunkSourceWebCorehtmlparserHTMLDocumentParsercpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/html/parser/HTMLDocumentParser.cpp (177862 => 177863)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/html/parser/HTMLDocumentParser.cpp        2015-01-02 18:07:48 UTC (rev 177862)
+++ trunk/Source/WebCore/html/parser/HTMLDocumentParser.cpp        2015-01-02 18:17:05 UTC (rev 177863)
</span><span class="lines">@@ -92,7 +92,7 @@
</span><span class="cx">     , m_options(fragment.document())
</span><span class="cx">     , m_token(std::make_unique&lt;HTMLToken&gt;())
</span><span class="cx">     , m_tokenizer(std::make_unique&lt;HTMLTokenizer&gt;(m_options))
</span><del>-    , m_treeBuilder(std::make_unique&lt;HTMLTreeBuilder&gt;(*this, fragment, contextElement, this-&gt;parserContentPolicy(), m_options))
</del><ins>+    , m_treeBuilder(std::make_unique&lt;HTMLTreeBuilder&gt;(*this, fragment, *contextElement, this-&gt;parserContentPolicy(), m_options))
</ins><span class="cx">     , m_xssAuditorDelegate(fragment.document())
</span><span class="cx">     , m_endWasDelayed(false)
</span><span class="cx">     , m_haveBackgroundParser(false)
</span><span class="lines">@@ -118,7 +118,6 @@
</span><span class="cx"> 
</span><span class="cx">     if (m_scriptRunner)
</span><span class="cx">         m_scriptRunner-&gt;detach();
</span><del>-    m_treeBuilder-&gt;detach();
</del><span class="cx">     // FIXME: It seems wrong that we would have a preload scanner here.
</span><span class="cx">     // Yet during fast/dom/HTMLScriptElement/script-load-events.html we do.
</span><span class="cx">     m_preloadScanner = nullptr;
</span><span class="lines">@@ -349,7 +348,7 @@
</span><span class="cx">     if (rawToken.type() != HTMLToken::Character)
</span><span class="cx">         rawToken.clear();
</span><span class="cx"> 
</span><del>-    m_treeBuilder-&gt;constructTree(&amp;token);
</del><ins>+    m_treeBuilder-&gt;constructTree(token);
</ins><span class="cx"> 
</span><span class="cx">     if (!rawToken.isUninitialized()) {
</span><span class="cx">         ASSERT(rawToken.type() == HTMLToken::Character);
</span></span></pre></div>
<a id="trunkSourceWebCorehtmlparserHTMLTreeBuildercpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/html/parser/HTMLTreeBuilder.cpp (177862 => 177863)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/html/parser/HTMLTreeBuilder.cpp        2015-01-02 18:07:48 UTC (rev 177862)
+++ trunk/Source/WebCore/html/parser/HTMLTreeBuilder.cpp        2015-01-02 18:17:05 UTC (rev 177863)
</span><span class="lines">@@ -1,6 +1,6 @@
</span><span class="cx"> /*
</span><span class="cx">  * Copyright (C) 2010 Google, Inc. All Rights Reserved.
</span><del>- * Copyright (C) 2011 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2011, 2015 Apple Inc. All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  * Redistribution and use in source and binary forms, with or without
</span><span class="cx">  * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -33,20 +33,16 @@
</span><span class="cx"> #include &quot;HTMLFormControlElement.h&quot;
</span><span class="cx"> #include &quot;HTMLFormElement.h&quot;
</span><span class="cx"> #include &quot;HTMLOptGroupElement.h&quot;
</span><del>-#include &quot;HTMLOptionElement.h&quot;
</del><span class="cx"> #include &quot;HTMLParserIdioms.h&quot;
</span><del>-#include &quot;HTMLTableElement.h&quot;
-#include &quot;HTMLTemplateElement.h&quot;
</del><span class="cx"> #include &quot;LocalizedStrings.h&quot;
</span><span class="cx"> #include &quot;NotImplemented.h&quot;
</span><span class="cx"> #include &quot;XLinkNames.h&quot;
</span><span class="cx"> #include &quot;XMLNSNames.h&quot;
</span><span class="cx"> #include &quot;XMLNames.h&quot;
</span><del>-#include &lt;wtf/MainThread.h&gt;
</del><span class="cx"> #include &lt;wtf/NeverDestroyed.h&gt;
</span><span class="cx"> #include &lt;wtf/unicode/CharacterNames.h&gt;
</span><span class="cx"> 
</span><del>-#if ENABLE(TELEPHONE_NUMBER_DETECTION)
</del><ins>+#if ENABLE(TELEPHONE_NUMBER_DETECTION) &amp;&amp; PLATFORM(IOS)
</ins><span class="cx"> #include &quot;TelephoneNumberDetector.h&quot;
</span><span class="cx"> #endif
</span><span class="cx"> 
</span><span class="lines">@@ -63,7 +59,7 @@
</span><span class="cx"> 
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-static TextPosition uninitializedPositionValue1()
</del><ins>+static inline TextPosition uninitializedPositionValue1()
</ins><span class="cx"> {
</span><span class="cx">     return TextPosition(OrdinalNumber::fromOneBasedInt(-1), OrdinalNumber::first());
</span><span class="cx"> }
</span><span class="lines">@@ -90,9 +86,7 @@
</span><span class="cx"> 
</span><span class="cx"> static bool isCaptionColOrColgroupTag(const AtomicString&amp; tagName)
</span><span class="cx"> {
</span><del>-    return tagName == captionTag
-        || tagName == colTag
-        || tagName == colgroupTag;
</del><ins>+    return tagName == captionTag || tagName == colTag || tagName == colgroupTag;
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> static bool isTableCellContextTag(const AtomicString&amp; tagName)
</span><span class="lines">@@ -102,9 +96,7 @@
</span><span class="cx"> 
</span><span class="cx"> static bool isTableBodyContextTag(const AtomicString&amp; tagName)
</span><span class="cx"> {
</span><del>-    return tagName == tbodyTag
-        || tagName == tfootTag
-        || tagName == theadTag;
</del><ins>+    return tagName == tbodyTag || tagName == tfootTag || tagName == theadTag;
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> static bool isNonAnchorNonNobrFormattingTag(const AtomicString&amp; tagName)
</span><span class="lines">@@ -125,29 +117,27 @@
</span><span class="cx"> 
</span><span class="cx"> static bool isNonAnchorFormattingTag(const AtomicString&amp; tagName)
</span><span class="cx"> {
</span><del>-    return tagName == nobrTag
-        || isNonAnchorNonNobrFormattingTag(tagName);
</del><ins>+    return tagName == nobrTag || isNonAnchorNonNobrFormattingTag(tagName);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><del>-// http://www.whatwg.org/specs/web-apps/current-work/multipage/parsing.html#formatting
</del><ins>+// https://html.spec.whatwg.org/multipage/syntax.html#formatting
</ins><span class="cx"> static bool isFormattingTag(const AtomicString&amp; tagName)
</span><span class="cx"> {
</span><span class="cx">     return tagName == aTag || isNonAnchorFormattingTag(tagName);
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> class HTMLTreeBuilder::ExternalCharacterTokenBuffer {
</span><del>-    WTF_MAKE_NONCOPYABLE(ExternalCharacterTokenBuffer);
</del><span class="cx"> public:
</span><del>-    explicit ExternalCharacterTokenBuffer(AtomicHTMLToken* token)
-        : m_text(token-&gt;characters(), token-&gt;charactersLength())
-        , m_isAll8BitData(token-&gt;isAll8BitData())
</del><ins>+    explicit ExternalCharacterTokenBuffer(AtomicHTMLToken&amp; token)
+        : m_text(token.characters(), token.charactersLength())
+        , m_isAll8BitData(token.isAll8BitData())
</ins><span class="cx">     {
</span><span class="cx">         ASSERT(!isEmpty());
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     explicit ExternalCharacterTokenBuffer(const String&amp; string)
</span><span class="cx">         : m_text(string)
</span><del>-        , m_isAll8BitData(m_text.length() &amp;&amp; m_text.is8Bit())
</del><ins>+        , m_isAll8BitData(m_text.is8Bit())
</ins><span class="cx">     {
</span><span class="cx">         ASSERT(!isEmpty());
</span><span class="cx">     }
</span><span class="lines">@@ -185,11 +175,7 @@
</span><span class="cx"> 
</span><span class="cx">     String takeRemaining()
</span><span class="cx">     {
</span><del>-        String result;
-        if (m_text.is8Bit() || !isAll8BitData())
-            result = m_text.toString();
-        else
-            result = String::make8BitFrom16BitSource(m_text.characters16(), m_text.length());
</del><ins>+        String result = makeString(m_text);
</ins><span class="cx">         m_text = StringView();
</span><span class="cx">         return result;
</span><span class="cx">     }
</span><span class="lines">@@ -221,8 +207,7 @@
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx"> private:
</span><del>-    template&lt;bool characterPredicate(UChar)&gt;
-    void skipLeading()
</del><ins>+    template&lt;bool characterPredicate(UChar)&gt; void skipLeading()
</ins><span class="cx">     {
</span><span class="cx">         ASSERT(!isEmpty());
</span><span class="cx">         while (characterPredicate(m_text[0])) {
</span><span class="lines">@@ -232,122 +217,124 @@
</span><span class="cx">         }
</span><span class="cx">     }
</span><span class="cx"> 
</span><del>-    template&lt;bool characterPredicate(UChar)&gt;
-    String takeLeading()
</del><ins>+    template&lt;bool characterPredicate(UChar)&gt; String takeLeading()
</ins><span class="cx">     {
</span><span class="cx">         ASSERT(!isEmpty());
</span><span class="cx">         StringView start = m_text;
</span><span class="cx">         skipLeading&lt;characterPredicate&gt;();
</span><span class="cx">         if (start.length() == m_text.length())
</span><span class="cx">             return String();
</span><del>-        StringView leading = start.substring(0, start.length() - m_text.length());
-        if (leading.is8Bit() || !isAll8BitData())
-            return leading.toString();
-        return String::make8BitFrom16BitSource(leading.characters16(), leading.length());
</del><ins>+        return makeString(start.substring(0, start.length() - m_text.length()));
</ins><span class="cx">     }
</span><span class="cx"> 
</span><ins>+    String makeString(StringView stringView) const
+    {
+        if (stringView.is8Bit() || !isAll8BitData())
+            return stringView.toString();
+        return String::make8BitFrom16BitSource(stringView.characters16(), stringView.length());
+    }
+
</ins><span class="cx">     StringView m_text;
</span><span class="cx">     bool m_isAll8BitData;
</span><span class="cx"> };
</span><span class="cx"> 
</span><del>-
-HTMLTreeBuilder::HTMLTreeBuilder(HTMLDocumentParser&amp; parser, HTMLDocument&amp; document, ParserContentPolicy parserContentPolicy, const HTMLParserOptions&amp; options)
-    : m_framesetOk(true)
-#ifndef NDEBUG
-    , m_isAttached(true)
</del><ins>+inline bool HTMLTreeBuilder::isParsingTemplateContents() const
+{
+#if ENABLE(TEMPLATE_ELEMENT)
+    return m_tree.openElements()-&gt;hasTemplateInHTMLScope();
+#else
+    return false;
</ins><span class="cx"> #endif
</span><ins>+}
+
+inline bool HTMLTreeBuilder::isParsingFragmentOrTemplateContents() const
+{
+    return isParsingFragment() || isParsingTemplateContents();
+}
+
+HTMLTreeBuilder::HTMLTreeBuilder(const HTMLDocumentParser&amp; parser, HTMLDocument&amp; document, ParserContentPolicy parserContentPolicy, const HTMLParserOptions&amp; options)
+    : m_parser(parser)
+    , m_options(options)
</ins><span class="cx">     , m_tree(document, parserContentPolicy, options.maximumDOMTreeDepth)
</span><del>-    , m_insertionMode(InsertionMode::Initial)
-    , m_originalInsertionMode(InsertionMode::Initial)
-    , m_shouldSkipLeadingNewline(false)
-    , m_parser(parser)
</del><span class="cx">     , m_scriptToProcessStartPosition(uninitializedPositionValue1())
</span><del>-    , m_options(options)
</del><span class="cx"> {
</span><ins>+#if !ASSERT_DISABLED
+    m_destructionProhibited = false;
+#endif
</ins><span class="cx"> }
</span><span class="cx"> 
</span><del>-// FIXME: Member variables should be grouped into self-initializing structs to
-// minimize code duplication between these constructors.
-HTMLTreeBuilder::HTMLTreeBuilder(HTMLDocumentParser&amp; parser, DocumentFragment&amp; fragment, Element* contextElement, ParserContentPolicy parserContentPolicy, const HTMLParserOptions&amp; options)
-    : m_framesetOk(true)
-#ifndef NDEBUG
-    , m_isAttached(true)
-#endif
</del><ins>+HTMLTreeBuilder::HTMLTreeBuilder(const HTMLDocumentParser&amp; parser, DocumentFragment&amp; fragment, Element&amp; contextElement, ParserContentPolicy parserContentPolicy, const HTMLParserOptions&amp; options)
+    : m_parser(parser)
+    , m_options(options)
</ins><span class="cx">     , m_fragmentContext(fragment, contextElement)
</span><span class="cx">     , m_tree(fragment, parserContentPolicy, options.maximumDOMTreeDepth)
</span><del>-    , m_insertionMode(InsertionMode::Initial)
-    , m_originalInsertionMode(InsertionMode::Initial)
-    , m_shouldSkipLeadingNewline(false)
-    , m_parser(parser)
</del><span class="cx">     , m_scriptToProcessStartPosition(uninitializedPositionValue1())
</span><del>-    , m_options(options)
</del><span class="cx"> {
</span><span class="cx">     ASSERT(isMainThread());
</span><del>-    // FIXME: This assertion will become invalid if &lt;http://webkit.org/b/60316&gt; is fixed.
-    ASSERT(contextElement);
-    if (contextElement) {
-        // Steps 4.2-4.6 of the HTML5 Fragment Case parsing algorithm:
-        // http://www.whatwg.org/specs/web-apps/current-work/multipage/the-end.html#fragment-case
-        // For efficiency, we skip step 4.2 (&quot;Let root be a new html element with no attributes&quot;)
-        // and instead use the DocumentFragment as a root node.
-        m_tree.openElements()-&gt;pushRootNode(HTMLStackItem::create(&amp;fragment, HTMLStackItem::ItemForDocumentFragmentNode));
</del><span class="cx"> 
</span><ins>+    // https://html.spec.whatwg.org/multipage/syntax.html#parsing-html-fragments
+    // For efficiency, we skip step 5 (&quot;Let root be a new html element with no attributes&quot;) and instead use the DocumentFragment as a root node.
+    m_tree.openElements()-&gt;pushRootNode(HTMLStackItem::create(&amp;fragment, HTMLStackItem::ItemForDocumentFragmentNode));
+
</ins><span class="cx"> #if ENABLE(TEMPLATE_ELEMENT)
</span><del>-        if (contextElement-&gt;hasTagName(templateTag))
-            m_templateInsertionModes.append(InsertionMode::TemplateContents);
</del><ins>+    if (contextElement.hasTagName(templateTag))
+        m_templateInsertionModes.append(InsertionMode::TemplateContents);
</ins><span class="cx"> #endif
</span><span class="cx"> 
</span><del>-        resetInsertionModeAppropriately();
-        m_tree.setForm(!contextElement || is&lt;HTMLFormElement&gt;(*contextElement) ? downcast&lt;HTMLFormElement&gt;(contextElement) : HTMLFormElement::findClosestFormAncestor(*contextElement));
-    }
-}
</del><ins>+    resetInsertionModeAppropriately();
</ins><span class="cx"> 
</span><del>-HTMLTreeBuilder::~HTMLTreeBuilder()
-{
-}
</del><ins>+    m_tree.setForm(is&lt;HTMLFormElement&gt;(contextElement) ? &amp;downcast&lt;HTMLFormElement&gt;(contextElement) : HTMLFormElement::findClosestFormAncestor(contextElement));
</ins><span class="cx"> 
</span><del>-void HTMLTreeBuilder::detach()
-{
-#ifndef NDEBUG
-    // This call makes little sense in fragment mode, but for consistency
-    // DocumentParser expects detach() to always be called before it's destroyed.
-    m_isAttached = false;
</del><ins>+#if !ASSERT_DISABLED
+    m_destructionProhibited = false;
</ins><span class="cx"> #endif
</span><del>-    // HTMLConstructionSite might be on the callstack when detach() is called
-    // otherwise we'd just call m_tree.clear() here instead.
-    m_tree.detach();
</del><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> HTMLTreeBuilder::FragmentParsingContext::FragmentParsingContext()
</span><del>-    : m_fragment(0)
</del><span class="cx"> {
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-HTMLTreeBuilder::FragmentParsingContext::FragmentParsingContext(DocumentFragment&amp; fragment, Element* contextElement)
</del><ins>+HTMLTreeBuilder::FragmentParsingContext::FragmentParsingContext(DocumentFragment&amp; fragment, Element&amp; contextElement)
</ins><span class="cx">     : m_fragment(&amp;fragment)
</span><span class="cx"> {
</span><span class="cx">     ASSERT(!fragment.hasChildNodes());
</span><del>-    m_contextElementStackItem = HTMLStackItem::create(contextElement, HTMLStackItem::ItemForContextElement);
</del><ins>+    m_contextElementStackItem = HTMLStackItem::create(&amp;contextElement, HTMLStackItem::ItemForContextElement);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><del>-HTMLTreeBuilder::FragmentParsingContext::~FragmentParsingContext()
</del><ins>+inline Element&amp; HTMLTreeBuilder::FragmentParsingContext::contextElement() const
</ins><span class="cx"> {
</span><ins>+    return *contextElementStackItem().element();
</ins><span class="cx"> }
</span><span class="cx"> 
</span><del>-PassRefPtr&lt;Element&gt; HTMLTreeBuilder::takeScriptToProcess(TextPosition&amp; scriptStartPosition)
</del><ins>+inline HTMLStackItem&amp; HTMLTreeBuilder::FragmentParsingContext::contextElementStackItem() const
</ins><span class="cx"> {
</span><del>-    ASSERT(m_scriptToProcess);
</del><ins>+    ASSERT(m_fragment);
+    return *m_contextElementStackItem;
+}
+
+RefPtr&lt;Element&gt; HTMLTreeBuilder::takeScriptToProcess(TextPosition&amp; scriptStartPosition)
+{
+    ASSERT(!m_destroyed);
+
+    if (!m_scriptToProcess)
+        return nullptr;
+
</ins><span class="cx">     // Unpause ourselves, callers may pause us again when processing the script.
</span><del>-    // The HTML5 spec is written as though scripts are executed inside the tree
-    // builder.  We pause the parser to exit the tree builder, and then resume
-    // before running scripts.
</del><ins>+    // The HTML5 spec is written as though scripts are executed inside the tree builder.
+    // We pause the parser to exit the tree builder, and then resume before running scripts.
</ins><span class="cx">     scriptStartPosition = m_scriptToProcessStartPosition;
</span><span class="cx">     m_scriptToProcessStartPosition = uninitializedPositionValue1();
</span><del>-    return m_scriptToProcess.release();
</del><ins>+    return WTF::move(m_scriptToProcess);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><del>-void HTMLTreeBuilder::constructTree(AtomicHTMLToken* token)
</del><ins>+void HTMLTreeBuilder::constructTree(AtomicHTMLToken&amp; token)
</ins><span class="cx"> {
</span><ins>+#if !ASSERT_DISABLED
+    ASSERT(!m_destroyed);
+    ASSERT(!m_destructionProhibited);
+    m_destructionProhibited = true;
+#endif
+
</ins><span class="cx">     if (shouldProcessTokenInForeignContent(token))
</span><span class="cx">         processTokenInForeignContent(token);
</span><span class="cx">     else
</span><span class="lines">@@ -355,7 +342,7 @@
</span><span class="cx"> 
</span><span class="cx">     if (m_parser.tokenizer()) {
</span><span class="cx">         bool inForeignContent = !m_tree.isEmpty()
</span><del>-            &amp;&amp; !adjustedCurrentStackItem()-&gt;isInHTMLNamespace()
</del><ins>+            &amp;&amp; !adjustedCurrentStackItem().isInHTMLNamespace()
</ins><span class="cx">             &amp;&amp; !HTMLElementStack::isHTMLIntegrationPoint(m_tree.currentStackItem())
</span><span class="cx">             &amp;&amp; !HTMLElementStack::isMathMLTextIntegrationPoint(m_tree.currentStackItem());
</span><span class="cx"> 
</span><span class="lines">@@ -363,13 +350,17 @@
</span><span class="cx">         m_parser.tokenizer()-&gt;setShouldAllowCDATA(inForeignContent);
</span><span class="cx">     }
</span><span class="cx"> 
</span><ins>+#if !ASSERT_DISABLED
+    m_destructionProhibited = false;
+#endif
+
</ins><span class="cx">     m_tree.executeQueuedTasks();
</span><del>-    // We might be detached now.
</del><ins>+    // The tree builder might have been destroyed as an indirect result of executing the queued tasks.
</ins><span class="cx"> }
</span><span class="cx"> 
</span><del>-void HTMLTreeBuilder::processToken(AtomicHTMLToken* token)
</del><ins>+void HTMLTreeBuilder::processToken(AtomicHTMLToken&amp; token)
</ins><span class="cx"> {
</span><del>-    switch (token-&gt;type()) {
</del><ins>+    switch (token.type()) {
</ins><span class="cx">     case HTMLToken::Uninitialized:
</span><span class="cx">         ASSERT_NOT_REACHED();
</span><span class="cx">         break;
</span><span class="lines">@@ -399,12 +390,12 @@
</span><span class="cx">     }
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-void HTMLTreeBuilder::processDoctypeToken(AtomicHTMLToken* token)
</del><ins>+void HTMLTreeBuilder::processDoctypeToken(AtomicHTMLToken&amp; token)
</ins><span class="cx"> {
</span><del>-    ASSERT(token-&gt;type() == HTMLToken::DOCTYPE);
</del><ins>+    ASSERT(token.type() == HTMLToken::DOCTYPE);
</ins><span class="cx">     if (m_insertionMode == InsertionMode::Initial) {
</span><del>-        m_tree.insertDoctype(token);
-        setInsertionMode(InsertionMode::BeforeHTML);
</del><ins>+        m_tree.insertDoctype(&amp;token);
+        m_insertionMode = InsertionMode::BeforeHTML;
</ins><span class="cx">         return;
</span><span class="cx">     }
</span><span class="cx">     if (m_insertionMode == InsertionMode::InTableText) {
</span><span class="lines">@@ -415,17 +406,17 @@
</span><span class="cx">     parseError(token);
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-void HTMLTreeBuilder::processFakeStartTag(const QualifiedName&amp; tagName, const Vector&lt;Attribute&gt;&amp; attributes)
</del><ins>+void HTMLTreeBuilder::processFakeStartTag(const QualifiedName&amp; tagName, Vector&lt;Attribute&gt;&amp;&amp; attributes)
</ins><span class="cx"> {
</span><span class="cx">     // FIXME: We'll need a fancier conversion than just &quot;localName&quot; for SVG/MathML tags.
</span><del>-    AtomicHTMLToken fakeToken(HTMLToken::StartTag, tagName.localName(), attributes);
-    processStartTag(&amp;fakeToken);
</del><ins>+    AtomicHTMLToken fakeToken(HTMLToken::StartTag, tagName.localName(), WTF::move(attributes));
+    processStartTag(fakeToken);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> void HTMLTreeBuilder::processFakeEndTag(const AtomicString&amp; tagName)
</span><span class="cx"> {
</span><span class="cx">     AtomicHTMLToken fakeToken(HTMLToken::EndTag, tagName);
</span><del>-    processEndTag(&amp;fakeToken);
</del><ins>+    processEndTag(fakeToken);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> void HTMLTreeBuilder::processFakeEndTag(const QualifiedName&amp; tagName)
</span><span class="lines">@@ -446,12 +437,12 @@
</span><span class="cx">     if (!m_tree.openElements()-&gt;inButtonScope(pTag.localName()))
</span><span class="cx">         return;
</span><span class="cx">     AtomicHTMLToken endP(HTMLToken::EndTag, pTag.localName());
</span><del>-    processEndTag(&amp;endP);
</del><ins>+    processEndTag(endP);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><del>-Vector&lt;Attribute&gt; HTMLTreeBuilder::attributesForIsindexInput(AtomicHTMLToken* token)
</del><ins>+Vector&lt;Attribute&gt; HTMLTreeBuilder::attributesForIsindexInput(AtomicHTMLToken&amp; token)
</ins><span class="cx"> {
</span><del>-    Vector&lt;Attribute&gt; attributes = token-&gt;attributes();
</del><ins>+    Vector&lt;Attribute&gt; attributes = token.attributes();
</ins><span class="cx">     for (int i = attributes.size() - 1; i &gt;= 0; --i) {
</span><span class="cx">         const QualifiedName&amp; name = attributes.at(i).name();
</span><span class="cx">         if (name.matches(nameAttr) || name.matches(actionAttr) || name.matches(promptAttr))
</span><span class="lines">@@ -462,21 +453,21 @@
</span><span class="cx">     return attributes;
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-void HTMLTreeBuilder::processIsindexStartTagForInBody(AtomicHTMLToken* token)
</del><ins>+void HTMLTreeBuilder::processIsindexStartTagForInBody(AtomicHTMLToken&amp; token)
</ins><span class="cx"> {
</span><del>-    ASSERT(token-&gt;type() == HTMLToken::StartTag);
-    ASSERT(token-&gt;name() == isindexTag);
</del><ins>+    ASSERT(token.type() == HTMLToken::StartTag);
+    ASSERT(token.name() == isindexTag);
</ins><span class="cx">     parseError(token);
</span><span class="cx">     if (m_tree.form() &amp;&amp; !isParsingTemplateContents())
</span><span class="cx">         return;
</span><span class="cx">     notImplemented(); // Acknowledge self-closing flag
</span><span class="cx">     processFakeStartTag(formTag);
</span><del>-    Attribute* actionAttribute = token-&gt;getAttributeItem(actionAttr);
</del><ins>+    Attribute* actionAttribute = token.getAttributeItem(actionAttr);
</ins><span class="cx">     if (actionAttribute)
</span><span class="cx">         m_tree.form()-&gt;setAttribute(actionAttr, actionAttribute-&gt;value());
</span><span class="cx">     processFakeStartTag(hrTag);
</span><span class="cx">     processFakeStartTag(labelTag);
</span><del>-    Attribute* promptAttribute = token-&gt;getAttributeItem(promptAttr);
</del><ins>+    Attribute* promptAttribute = token.getAttributeItem(promptAttr);
</ins><span class="cx">     if (promptAttribute)
</span><span class="cx">         processFakeCharacters(promptAttribute-&gt;value());
</span><span class="cx">     else
</span><span class="lines">@@ -490,41 +481,36 @@
</span><span class="cx"> 
</span><span class="cx"> namespace {
</span><span class="cx"> 
</span><del>-bool isLi(const HTMLStackItem* item)
</del><ins>+bool isLi(const HTMLStackItem&amp; item)
</ins><span class="cx"> {
</span><del>-    return item-&gt;hasTagName(liTag);
</del><ins>+    return item.hasTagName(liTag);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><del>-bool isDdOrDt(const HTMLStackItem* item)
</del><ins>+bool isDdOrDt(const HTMLStackItem&amp; item)
</ins><span class="cx"> {
</span><del>-    return item-&gt;hasTagName(ddTag)
-        || item-&gt;hasTagName(dtTag);
</del><ins>+    return item.hasTagName(ddTag) || item.hasTagName(dtTag);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-template &lt;bool shouldClose(const HTMLStackItem*)&gt;
-void HTMLTreeBuilder::processCloseWhenNestedTag(AtomicHTMLToken* token)
</del><ins>+template &lt;bool shouldClose(const HTMLStackItem&amp;)&gt; void HTMLTreeBuilder::processCloseWhenNestedTag(AtomicHTMLToken&amp; token)
</ins><span class="cx"> {
</span><span class="cx">     m_framesetOk = false;
</span><del>-    HTMLElementStack::ElementRecord* nodeRecord = m_tree.openElements()-&gt;topRecord();
-    while (1) {
-        RefPtr&lt;HTMLStackItem&gt; item = nodeRecord-&gt;stackItem();
-        if (shouldClose(item.get())) {
-            ASSERT(item-&gt;isElementNode());
-            processFakeEndTag(item-&gt;localName());
</del><ins>+    for (auto* nodeRecord = m_tree.openElements()-&gt;topRecord(); ; nodeRecord = nodeRecord-&gt;next()) {
+        HTMLStackItem&amp; item = *nodeRecord-&gt;stackItem();
+        if (shouldClose(item)) {
+            ASSERT(item.isElementNode());
+            processFakeEndTag(item.localName());
</ins><span class="cx">             break;
</span><span class="cx">         }
</span><del>-        if (item-&gt;isSpecialNode() &amp;&amp; !item-&gt;hasTagName(addressTag) &amp;&amp; !item-&gt;hasTagName(divTag) &amp;&amp; !item-&gt;hasTagName(pTag))
</del><ins>+        if (item.isSpecialNode() &amp;&amp; !item.hasTagName(addressTag) &amp;&amp; !item.hasTagName(divTag) &amp;&amp; !item.hasTagName(pTag))
</ins><span class="cx">             break;
</span><del>-        nodeRecord = nodeRecord-&gt;next();
</del><span class="cx">     }
</span><span class="cx">     processFakePEndTagIfPInButtonScope();
</span><del>-    m_tree.insertHTMLElement(token);
</del><ins>+    m_tree.insertHTMLElement(&amp;token);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><del>-template &lt;typename TableQualifiedName&gt;
-static HashMap&lt;AtomicString, QualifiedName&gt; createCaseMap(const TableQualifiedName* const names[], unsigned length)
</del><ins>+template &lt;typename TableQualifiedName&gt; static HashMap&lt;AtomicString, QualifiedName&gt; createCaseMap(const TableQualifiedName* const names[], unsigned length)
</ins><span class="cx"> {
</span><span class="cx">     HashMap&lt;AtomicString, QualifiedName&gt; map;
</span><span class="cx">     for (unsigned i = 0; i &lt; length; ++i) {
</span><span class="lines">@@ -555,8 +541,7 @@
</span><span class="cx">     }
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-template&lt;const QualifiedName* const* attributesTable(), unsigned attributesTableLength&gt;
-static void adjustAttributes(AtomicHTMLToken&amp; token)
</del><ins>+template&lt;const QualifiedName* const* attributesTable(), unsigned attributesTableLength&gt; static void adjustAttributes(AtomicHTMLToken&amp; token)
</ins><span class="cx"> {
</span><span class="cx">     static NeverDestroyed&lt;HashMap&lt;AtomicString, QualifiedName&gt;&gt; map = createCaseMap(attributesTable(), attributesTableLength);
</span><span class="cx">     adjustAttributes(map, token);
</span><span class="lines">@@ -600,28 +585,28 @@
</span><span class="cx">     adjustAttributes(map, token);
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-void HTMLTreeBuilder::processStartTagForInBody(AtomicHTMLToken* token)
</del><ins>+void HTMLTreeBuilder::processStartTagForInBody(AtomicHTMLToken&amp; token)
</ins><span class="cx"> {
</span><del>-    ASSERT(token-&gt;type() == HTMLToken::StartTag);
-    if (token-&gt;name() == htmlTag) {
</del><ins>+    ASSERT(token.type() == HTMLToken::StartTag);
+    if (token.name() == htmlTag) {
</ins><span class="cx">         processHtmlStartTagForInBody(token);
</span><span class="cx">         return;
</span><span class="cx">     }
</span><del>-    if (token-&gt;name() == baseTag
-        || token-&gt;name() == basefontTag
-        || token-&gt;name() == bgsoundTag
-        || token-&gt;name() == commandTag
-        || token-&gt;name() == linkTag
-        || token-&gt;name() == metaTag
-        || token-&gt;name() == noframesTag
-        || token-&gt;name() == scriptTag
-        || token-&gt;name() == styleTag
-        || token-&gt;name() == titleTag) {
</del><ins>+    if (token.name() == baseTag
+        || token.name() == basefontTag
+        || token.name() == bgsoundTag
+        || token.name() == commandTag
+        || token.name() == linkTag
+        || token.name() == metaTag
+        || token.name() == noframesTag
+        || token.name() == scriptTag
+        || token.name() == styleTag
+        || token.name() == titleTag) {
</ins><span class="cx">         bool didProcess = processStartTagForInHead(token);
</span><span class="cx">         ASSERT_UNUSED(didProcess, didProcess);
</span><span class="cx">         return;
</span><span class="cx">     }
</span><del>-    if (token-&gt;name() == bodyTag) {
</del><ins>+    if (token.name() == bodyTag) {
</ins><span class="cx">         parseError(token);
</span><span class="cx">         bool fragmentOrTemplateCase = !m_tree.openElements()-&gt;secondElementIsHTMLBodyElement() || m_tree.openElements()-&gt;hasOnlyOneElement();
</span><span class="cx"> #if ENABLE(TEMPLATE_ELEMENT)
</span><span class="lines">@@ -632,10 +617,10 @@
</span><span class="cx">             return;
</span><span class="cx">         }
</span><span class="cx">         m_framesetOk = false;
</span><del>-        m_tree.insertHTMLBodyStartTagInBody(token);
</del><ins>+        m_tree.insertHTMLBodyStartTagInBody(&amp;token);
</ins><span class="cx">         return;
</span><span class="cx">     }
</span><del>-    if (token-&gt;name() == framesetTag) {
</del><ins>+    if (token.name() == framesetTag) {
</ins><span class="cx">         parseError(token);
</span><span class="cx">         if (!m_tree.openElements()-&gt;secondElementIsHTMLBodyElement() || m_tree.openElements()-&gt;hasOnlyOneElement()) {
</span><span class="cx">             ASSERT(isParsingFragmentOrTemplateContents());
</span><span class="lines">@@ -647,78 +632,78 @@
</span><span class="cx">         m_tree.openElements()-&gt;popUntil(m_tree.openElements()-&gt;bodyElement());
</span><span class="cx">         m_tree.openElements()-&gt;popHTMLBodyElement();
</span><span class="cx">         ASSERT(m_tree.openElements()-&gt;top() == m_tree.openElements()-&gt;htmlElement());
</span><del>-        m_tree.insertHTMLElement(token);
-        setInsertionMode(InsertionMode::InFrameset);
</del><ins>+        m_tree.insertHTMLElement(&amp;token);
+        m_insertionMode = InsertionMode::InFrameset;
</ins><span class="cx">         return;
</span><span class="cx">     }
</span><del>-    if (token-&gt;name() == addressTag
-        || token-&gt;name() == articleTag
-        || token-&gt;name() == asideTag
-        || token-&gt;name() == blockquoteTag
-        || token-&gt;name() == centerTag
-        || token-&gt;name() == detailsTag
-        || token-&gt;name() == dirTag
-        || token-&gt;name() == divTag
-        || token-&gt;name() == dlTag
-        || token-&gt;name() == fieldsetTag
-        || token-&gt;name() == figcaptionTag
-        || token-&gt;name() == figureTag
-        || token-&gt;name() == footerTag
-        || token-&gt;name() == headerTag
-        || token-&gt;name() == hgroupTag
-        || token-&gt;name() == mainTag
-        || token-&gt;name() == menuTag
-        || token-&gt;name() == navTag
-        || token-&gt;name() == olTag
-        || token-&gt;name() == pTag
-        || token-&gt;name() == sectionTag
-        || token-&gt;name() == summaryTag
-        || token-&gt;name() == ulTag) {
</del><ins>+    if (token.name() == addressTag
+        || token.name() == articleTag
+        || token.name() == asideTag
+        || token.name() == blockquoteTag
+        || token.name() == centerTag
+        || token.name() == detailsTag
+        || token.name() == dirTag
+        || token.name() == divTag
+        || token.name() == dlTag
+        || token.name() == fieldsetTag
+        || token.name() == figcaptionTag
+        || token.name() == figureTag
+        || token.name() == footerTag
+        || token.name() == headerTag
+        || token.name() == hgroupTag
+        || token.name() == mainTag
+        || token.name() == menuTag
+        || token.name() == navTag
+        || token.name() == olTag
+        || token.name() == pTag
+        || token.name() == sectionTag
+        || token.name() == summaryTag
+        || token.name() == ulTag) {
</ins><span class="cx">         processFakePEndTagIfPInButtonScope();
</span><del>-        m_tree.insertHTMLElement(token);
</del><ins>+        m_tree.insertHTMLElement(&amp;token);
</ins><span class="cx">         return;
</span><span class="cx">     }
</span><del>-    if (isNumberedHeaderTag(token-&gt;name())) {
</del><ins>+    if (isNumberedHeaderTag(token.name())) {
</ins><span class="cx">         processFakePEndTagIfPInButtonScope();
</span><span class="cx">         if (m_tree.currentStackItem()-&gt;isNumberedHeaderElement()) {
</span><span class="cx">             parseError(token);
</span><span class="cx">             m_tree.openElements()-&gt;pop();
</span><span class="cx">         }
</span><del>-        m_tree.insertHTMLElement(token);
</del><ins>+        m_tree.insertHTMLElement(&amp;token);
</ins><span class="cx">         return;
</span><span class="cx">     }
</span><del>-    if (token-&gt;name() == preTag || token-&gt;name() == listingTag) {
</del><ins>+    if (token.name() == preTag || token.name() == listingTag) {
</ins><span class="cx">         processFakePEndTagIfPInButtonScope();
</span><del>-        m_tree.insertHTMLElement(token);
</del><ins>+        m_tree.insertHTMLElement(&amp;token);
</ins><span class="cx">         m_shouldSkipLeadingNewline = true;
</span><span class="cx">         m_framesetOk = false;
</span><span class="cx">         return;
</span><span class="cx">     }
</span><del>-    if (token-&gt;name() == formTag) {
</del><ins>+    if (token.name() == formTag) {
</ins><span class="cx">         if (m_tree.form() &amp;&amp; !isParsingTemplateContents()) {
</span><span class="cx">             parseError(token);
</span><span class="cx">             return;
</span><span class="cx">         }
</span><span class="cx">         processFakePEndTagIfPInButtonScope();
</span><del>-        m_tree.insertHTMLFormElement(token);
</del><ins>+        m_tree.insertHTMLFormElement(&amp;token);
</ins><span class="cx">         return;
</span><span class="cx">     }
</span><del>-    if (token-&gt;name() == liTag) {
</del><ins>+    if (token.name() == liTag) {
</ins><span class="cx">         processCloseWhenNestedTag&lt;isLi&gt;(token);
</span><span class="cx">         return;
</span><span class="cx">     }
</span><del>-    if (token-&gt;name() == ddTag || token-&gt;name() == dtTag) {
</del><ins>+    if (token.name() == ddTag || token.name() == dtTag) {
</ins><span class="cx">         processCloseWhenNestedTag&lt;isDdOrDt&gt;(token);
</span><span class="cx">         return;
</span><span class="cx">     }
</span><del>-    if (token-&gt;name() == plaintextTag) {
</del><ins>+    if (token.name() == plaintextTag) {
</ins><span class="cx">         processFakePEndTagIfPInButtonScope();
</span><del>-        m_tree.insertHTMLElement(token);
</del><ins>+        m_tree.insertHTMLElement(&amp;token);
</ins><span class="cx">         if (m_parser.tokenizer())
</span><span class="cx">             m_parser.tokenizer()-&gt;setState(HTMLTokenizer::PLAINTEXTState);
</span><span class="cx">         return;
</span><span class="cx">     }
</span><del>-    if (token-&gt;name() == buttonTag) {
</del><ins>+    if (token.name() == buttonTag) {
</ins><span class="cx">         if (m_tree.openElements()-&gt;inScope(buttonTag)) {
</span><span class="cx">             parseError(token);
</span><span class="cx">             processFakeEndTag(buttonTag);
</span><span class="lines">@@ -726,11 +711,11 @@
</span><span class="cx">             return;
</span><span class="cx">         }
</span><span class="cx">         m_tree.reconstructTheActiveFormattingElements();
</span><del>-        m_tree.insertHTMLElement(token);
</del><ins>+        m_tree.insertHTMLElement(&amp;token);
</ins><span class="cx">         m_framesetOk = false;
</span><span class="cx">         return;
</span><span class="cx">     }
</span><del>-    if (token-&gt;name() == aTag) {
</del><ins>+    if (token.name() == aTag) {
</ins><span class="cx">         Element* activeATag = m_tree.activeFormattingElements()-&gt;closestElementInScopeWithName(aTag.localName());
</span><span class="cx">         if (activeATag) {
</span><span class="cx">             parseError(token);
</span><span class="lines">@@ -740,121 +725,117 @@
</span><span class="cx">                 m_tree.openElements()-&gt;remove(activeATag);
</span><span class="cx">         }
</span><span class="cx">         m_tree.reconstructTheActiveFormattingElements();
</span><del>-        m_tree.insertFormattingElement(token);
</del><ins>+        m_tree.insertFormattingElement(&amp;token);
</ins><span class="cx">         return;
</span><span class="cx">     }
</span><del>-    if (isNonAnchorNonNobrFormattingTag(token-&gt;name())) {
</del><ins>+    if (isNonAnchorNonNobrFormattingTag(token.name())) {
</ins><span class="cx">         m_tree.reconstructTheActiveFormattingElements();
</span><del>-        m_tree.insertFormattingElement(token);
</del><ins>+        m_tree.insertFormattingElement(&amp;token);
</ins><span class="cx">         return;
</span><span class="cx">     }
</span><del>-    if (token-&gt;name() == nobrTag) {
</del><ins>+    if (token.name() == nobrTag) {
</ins><span class="cx">         m_tree.reconstructTheActiveFormattingElements();
</span><span class="cx">         if (m_tree.openElements()-&gt;inScope(nobrTag)) {
</span><span class="cx">             parseError(token);
</span><span class="cx">             processFakeEndTag(nobrTag);
</span><span class="cx">             m_tree.reconstructTheActiveFormattingElements();
</span><span class="cx">         }
</span><del>-        m_tree.insertFormattingElement(token);
</del><ins>+        m_tree.insertFormattingElement(&amp;token);
</ins><span class="cx">         return;
</span><span class="cx">     }
</span><del>-    if (token-&gt;name() == appletTag
-        || token-&gt;name() == embedTag
-        || token-&gt;name() == objectTag) {
</del><ins>+    if (token.name() == appletTag || token.name() == embedTag || token.name() == objectTag) {
</ins><span class="cx">         if (!pluginContentIsAllowed(m_tree.parserContentPolicy()))
</span><span class="cx">             return;
</span><span class="cx">     }
</span><del>-    if (token-&gt;name() == appletTag
-        || token-&gt;name() == marqueeTag
-        || token-&gt;name() == objectTag) {
</del><ins>+    if (token.name() == appletTag || token.name() == marqueeTag || token.name() == objectTag) {
</ins><span class="cx">         m_tree.reconstructTheActiveFormattingElements();
</span><del>-        m_tree.insertHTMLElement(token);
</del><ins>+        m_tree.insertHTMLElement(&amp;token);
</ins><span class="cx">         m_tree.activeFormattingElements()-&gt;appendMarker();
</span><span class="cx">         m_framesetOk = false;
</span><span class="cx">         return;
</span><span class="cx">     }
</span><del>-    if (token-&gt;name() == tableTag) {
</del><ins>+    if (token.name() == tableTag) {
</ins><span class="cx">         if (!m_tree.inQuirksMode() &amp;&amp; m_tree.openElements()-&gt;inButtonScope(pTag))
</span><span class="cx">             processFakeEndTag(pTag);
</span><del>-        m_tree.insertHTMLElement(token);
</del><ins>+        m_tree.insertHTMLElement(&amp;token);
</ins><span class="cx">         m_framesetOk = false;
</span><del>-        setInsertionMode(InsertionMode::InTable);
</del><ins>+        m_insertionMode = InsertionMode::InTable;
</ins><span class="cx">         return;
</span><span class="cx">     }
</span><del>-    if (token-&gt;name() == imageTag) {
</del><ins>+    if (token.name() == imageTag) {
</ins><span class="cx">         parseError(token);
</span><span class="cx">         // Apparently we're not supposed to ask.
</span><del>-        token-&gt;setName(imgTag.localName());
</del><ins>+        token.setName(imgTag.localName());
</ins><span class="cx">         // Note the fall through to the imgTag handling below!
</span><span class="cx">     }
</span><del>-    if (token-&gt;name() == areaTag
-        || token-&gt;name() == brTag
-        || token-&gt;name() == embedTag
-        || token-&gt;name() == imgTag
-        || token-&gt;name() == keygenTag
-        || token-&gt;name() == wbrTag) {
</del><ins>+    if (token.name() == areaTag
+        || token.name() == brTag
+        || token.name() == embedTag
+        || token.name() == imgTag
+        || token.name() == keygenTag
+        || token.name() == wbrTag) {
</ins><span class="cx">         m_tree.reconstructTheActiveFormattingElements();
</span><del>-        m_tree.insertSelfClosingHTMLElement(token);
</del><ins>+        m_tree.insertSelfClosingHTMLElement(&amp;token);
</ins><span class="cx">         m_framesetOk = false;
</span><span class="cx">         return;
</span><span class="cx">     }
</span><del>-    if (token-&gt;name() == inputTag) {
-        Attribute* typeAttribute = token-&gt;getAttributeItem(typeAttr);
</del><ins>+    if (token.name() == inputTag) {
+        Attribute* typeAttribute = token.getAttributeItem(typeAttr);
</ins><span class="cx">         m_tree.reconstructTheActiveFormattingElements();
</span><del>-        m_tree.insertSelfClosingHTMLElement(token);
</del><ins>+        m_tree.insertSelfClosingHTMLElement(&amp;token);
</ins><span class="cx">         if (!typeAttribute || !equalIgnoringCase(typeAttribute-&gt;value(), &quot;hidden&quot;))
</span><span class="cx">             m_framesetOk = false;
</span><span class="cx">         return;
</span><span class="cx">     }
</span><del>-    if (token-&gt;name() == paramTag
-        || token-&gt;name() == sourceTag
-        || token-&gt;name() == trackTag) {
-        m_tree.insertSelfClosingHTMLElement(token);
</del><ins>+    if (token.name() == paramTag
+        || token.name() == sourceTag
+        || token.name() == trackTag) {
+        m_tree.insertSelfClosingHTMLElement(&amp;token);
</ins><span class="cx">         return;
</span><span class="cx">     }
</span><del>-    if (token-&gt;name() == hrTag) {
</del><ins>+    if (token.name() == hrTag) {
</ins><span class="cx">         processFakePEndTagIfPInButtonScope();
</span><del>-        m_tree.insertSelfClosingHTMLElement(token);
</del><ins>+        m_tree.insertSelfClosingHTMLElement(&amp;token);
</ins><span class="cx">         m_framesetOk = false;
</span><span class="cx">         return;
</span><span class="cx">     }
</span><del>-    if (token-&gt;name() == isindexTag) {
</del><ins>+    if (token.name() == isindexTag) {
</ins><span class="cx">         processIsindexStartTagForInBody(token);
</span><span class="cx">         return;
</span><span class="cx">     }
</span><del>-    if (token-&gt;name() == textareaTag) {
-        m_tree.insertHTMLElement(token);
</del><ins>+    if (token.name() == textareaTag) {
+        m_tree.insertHTMLElement(&amp;token);
</ins><span class="cx">         m_shouldSkipLeadingNewline = true;
</span><span class="cx">         if (m_parser.tokenizer())
</span><span class="cx">             m_parser.tokenizer()-&gt;setState(HTMLTokenizer::RCDATAState);
</span><span class="cx">         m_originalInsertionMode = m_insertionMode;
</span><span class="cx">         m_framesetOk = false;
</span><del>-        setInsertionMode(InsertionMode::Text);
</del><ins>+        m_insertionMode = InsertionMode::Text;
</ins><span class="cx">         return;
</span><span class="cx">     }
</span><del>-    if (token-&gt;name() == xmpTag) {
</del><ins>+    if (token.name() == xmpTag) {
</ins><span class="cx">         processFakePEndTagIfPInButtonScope();
</span><span class="cx">         m_tree.reconstructTheActiveFormattingElements();
</span><span class="cx">         m_framesetOk = false;
</span><span class="cx">         processGenericRawTextStartTag(token);
</span><span class="cx">         return;
</span><span class="cx">     }
</span><del>-    if (token-&gt;name() == iframeTag) {
</del><ins>+    if (token.name() == iframeTag) {
</ins><span class="cx">         m_framesetOk = false;
</span><span class="cx">         processGenericRawTextStartTag(token);
</span><span class="cx">         return;
</span><span class="cx">     }
</span><del>-    if (token-&gt;name() == noembedTag &amp;&amp; m_options.pluginsEnabled) {
</del><ins>+    if (token.name() == noembedTag &amp;&amp; m_options.pluginsEnabled) {
</ins><span class="cx">         processGenericRawTextStartTag(token);
</span><span class="cx">         return;
</span><span class="cx">     }
</span><del>-    if (token-&gt;name() == noscriptTag &amp;&amp; m_options.scriptEnabled) {
</del><ins>+    if (token.name() == noscriptTag &amp;&amp; m_options.scriptEnabled) {
</ins><span class="cx">         processGenericRawTextStartTag(token);
</span><span class="cx">         return;
</span><span class="cx">     }
</span><del>-    if (token-&gt;name() == selectTag) {
</del><ins>+    if (token.name() == selectTag) {
</ins><span class="cx">         m_tree.reconstructTheActiveFormattingElements();
</span><del>-        m_tree.insertHTMLElement(token);
</del><ins>+        m_tree.insertHTMLElement(&amp;token);
</ins><span class="cx">         m_framesetOk = false;
</span><span class="cx">         if (m_insertionMode == InsertionMode::InTable
</span><span class="cx">             || m_insertionMode == InsertionMode::InCaption
</span><span class="lines">@@ -862,85 +843,86 @@
</span><span class="cx">             || m_insertionMode == InsertionMode::InTableBody
</span><span class="cx">             || m_insertionMode == InsertionMode::InRow
</span><span class="cx">             || m_insertionMode == InsertionMode::InCell)
</span><del>-            setInsertionMode(InsertionMode::InSelectInTable);
</del><ins>+            m_insertionMode = InsertionMode::InSelectInTable;
</ins><span class="cx">         else
</span><del>-            setInsertionMode(InsertionMode::InSelect);
</del><ins>+            m_insertionMode = InsertionMode::InSelect;
</ins><span class="cx">         return;
</span><span class="cx">     }
</span><del>-    if (token-&gt;name() == optgroupTag || token-&gt;name() == optionTag) {
</del><ins>+    if (token.name() == optgroupTag || token.name() == optionTag) {
</ins><span class="cx">         if (is&lt;HTMLOptionElement&gt;(*m_tree.currentStackItem()-&gt;node())) {
</span><span class="cx">             AtomicHTMLToken endOption(HTMLToken::EndTag, optionTag.localName());
</span><del>-            processEndTag(&amp;endOption);
</del><ins>+            processEndTag(endOption);
</ins><span class="cx">         }
</span><span class="cx">         m_tree.reconstructTheActiveFormattingElements();
</span><del>-        m_tree.insertHTMLElement(token);
</del><ins>+        m_tree.insertHTMLElement(&amp;token);
</ins><span class="cx">         return;
</span><span class="cx">     }
</span><del>-    if (token-&gt;name() == rbTag || token-&gt;name() == rtcTag) {
</del><ins>+    if (token.name() == rbTag || token.name() == rtcTag) {
</ins><span class="cx">         if (m_tree.openElements()-&gt;inScope(rubyTag.localName())) {
</span><span class="cx">             m_tree.generateImpliedEndTags();
</span><span class="cx">             if (!m_tree.currentStackItem()-&gt;hasTagName(rubyTag))
</span><span class="cx">                 parseError(token);
</span><span class="cx">         }
</span><del>-        m_tree.insertHTMLElement(token);
</del><ins>+        m_tree.insertHTMLElement(&amp;token);
</ins><span class="cx">         return;
</span><span class="cx">     }
</span><del>-    if (token-&gt;name() == rtTag || token-&gt;name() == rpTag) {
</del><ins>+    if (token.name() == rtTag || token.name() == rpTag) {
</ins><span class="cx">         if (m_tree.openElements()-&gt;inScope(rubyTag.localName())) {
</span><span class="cx">             m_tree.generateImpliedEndTagsWithExclusion(rtcTag.localName());
</span><span class="cx">             if (!m_tree.currentStackItem()-&gt;hasTagName(rubyTag) &amp;&amp; !m_tree.currentStackItem()-&gt;hasTagName(rtcTag))
</span><span class="cx">                 parseError(token);
</span><span class="cx">         }
</span><del>-        m_tree.insertHTMLElement(token);
</del><ins>+        m_tree.insertHTMLElement(&amp;token);
</ins><span class="cx">         return;
</span><span class="cx">     }
</span><del>-    if (token-&gt;name() == MathMLNames::mathTag.localName()) {
</del><ins>+    if (token.name() == MathMLNames::mathTag.localName()) {
</ins><span class="cx">         m_tree.reconstructTheActiveFormattingElements();
</span><del>-        adjustMathMLAttributes(*token);
-        adjustForeignAttributes(*token);
-        m_tree.insertForeignElement(token, MathMLNames::mathmlNamespaceURI);
</del><ins>+        adjustMathMLAttributes(token);
+        adjustForeignAttributes(token);
+        m_tree.insertForeignElement(&amp;token, MathMLNames::mathmlNamespaceURI);
</ins><span class="cx">         return;
</span><span class="cx">     }
</span><del>-    if (token-&gt;name() == SVGNames::svgTag.localName()) {
</del><ins>+    if (token.name() == SVGNames::svgTag.localName()) {
</ins><span class="cx">         m_tree.reconstructTheActiveFormattingElements();
</span><del>-        adjustSVGAttributes(*token);
-        adjustForeignAttributes(*token);
-        m_tree.insertForeignElement(token, SVGNames::svgNamespaceURI);
</del><ins>+        adjustSVGAttributes(token);
+        adjustForeignAttributes(token);
+        m_tree.insertForeignElement(&amp;token, SVGNames::svgNamespaceURI);
</ins><span class="cx">         return;
</span><span class="cx">     }
</span><del>-    if (isCaptionColOrColgroupTag(token-&gt;name())
-        || token-&gt;name() == frameTag
-        || token-&gt;name() == headTag
-        || isTableBodyContextTag(token-&gt;name())
-        || isTableCellContextTag(token-&gt;name())
-        || token-&gt;name() == trTag) {
</del><ins>+    if (isCaptionColOrColgroupTag(token.name())
+        || token.name() == frameTag
+        || token.name() == headTag
+        || isTableBodyContextTag(token.name())
+        || isTableCellContextTag(token.name())
+        || token.name() == trTag) {
</ins><span class="cx">         parseError(token);
</span><span class="cx">         return;
</span><span class="cx">     }
</span><span class="cx"> #if ENABLE(TEMPLATE_ELEMENT)
</span><del>-    if (token-&gt;name() == templateTag) {
</del><ins>+    if (token.name() == templateTag) {
</ins><span class="cx">         processTemplateStartTag(token);
</span><span class="cx">         return;
</span><span class="cx">     }
</span><span class="cx"> #endif
</span><span class="cx">     m_tree.reconstructTheActiveFormattingElements();
</span><del>-    m_tree.insertHTMLElement(token);
</del><ins>+    m_tree.insertHTMLElement(&amp;token);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> #if ENABLE(TEMPLATE_ELEMENT)
</span><del>-void HTMLTreeBuilder::processTemplateStartTag(AtomicHTMLToken* token)
</del><ins>+
+void HTMLTreeBuilder::processTemplateStartTag(AtomicHTMLToken&amp; token)
</ins><span class="cx"> {
</span><span class="cx">     m_tree.activeFormattingElements()-&gt;appendMarker();
</span><del>-    m_tree.insertHTMLElement(token);
</del><ins>+    m_tree.insertHTMLElement(&amp;token);
</ins><span class="cx">     m_templateInsertionModes.append(InsertionMode::TemplateContents);
</span><del>-    setInsertionMode(InsertionMode::TemplateContents);
</del><ins>+    m_insertionMode = InsertionMode::TemplateContents;
</ins><span class="cx"> }
</span><span class="cx"> 
</span><del>-bool HTMLTreeBuilder::processTemplateEndTag(AtomicHTMLToken* token)
</del><ins>+bool HTMLTreeBuilder::processTemplateEndTag(AtomicHTMLToken&amp; token)
</ins><span class="cx"> {
</span><del>-    ASSERT(token-&gt;name() == templateTag.localName());
</del><ins>+    ASSERT(token.name() == templateTag.localName());
</ins><span class="cx">     if (!m_tree.openElements()-&gt;hasTemplateInHTMLScope()) {
</span><del>-        ASSERT(m_templateInsertionModes.isEmpty() || (m_templateInsertionModes.size() == 1 &amp;&amp; m_fragmentContext.contextElement()-&gt;hasTagName(templateTag)));
</del><ins>+        ASSERT(m_templateInsertionModes.isEmpty() || (m_templateInsertionModes.size() == 1 &amp;&amp; m_fragmentContext.contextElement().hasTagName(templateTag)));
</ins><span class="cx">         parseError(token);
</span><span class="cx">         return false;
</span><span class="cx">     }
</span><span class="lines">@@ -954,15 +936,16 @@
</span><span class="cx">     return true;
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-bool HTMLTreeBuilder::processEndOfFileForInTemplateContents(AtomicHTMLToken* token)
</del><ins>+bool HTMLTreeBuilder::processEndOfFileForInTemplateContents(AtomicHTMLToken&amp; token)
</ins><span class="cx"> {
</span><span class="cx">     AtomicHTMLToken endTemplate(HTMLToken::EndTag, templateTag.localName());
</span><del>-    if (!processTemplateEndTag(&amp;endTemplate))
</del><ins>+    if (!processTemplateEndTag(endTemplate))
</ins><span class="cx">         return false;
</span><span class="cx"> 
</span><span class="cx">     processEndOfFile(token);
</span><span class="cx">     return true;
</span><span class="cx"> }
</span><ins>+
</ins><span class="cx"> #endif
</span><span class="cx"> 
</span><span class="cx"> bool HTMLTreeBuilder::processColgroupEndTagForInColumnGroup()
</span><span class="lines">@@ -978,14 +961,14 @@
</span><span class="cx">         return false;
</span><span class="cx">     }
</span><span class="cx">     m_tree.openElements()-&gt;pop();
</span><del>-    setInsertionMode(InsertionMode::InTable);
</del><ins>+    m_insertionMode = InsertionMode::InTable;
</ins><span class="cx">     return true;
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> // http://www.whatwg.org/specs/web-apps/current-work/multipage/tokenization.html#close-the-cell
</span><span class="cx"> void HTMLTreeBuilder::closeTheCell()
</span><span class="cx"> {
</span><del>-    ASSERT(insertionMode() == InsertionMode::InCell);
</del><ins>+    ASSERT(m_insertionMode == InsertionMode::InCell);
</ins><span class="cx">     if (m_tree.openElements()-&gt;inTableScope(tdTag)) {
</span><span class="cx">         ASSERT(!m_tree.openElements()-&gt;inTableScope(thTag));
</span><span class="cx">         processFakeEndTag(tdTag);
</span><span class="lines">@@ -993,45 +976,44 @@
</span><span class="cx">     }
</span><span class="cx">     ASSERT(m_tree.openElements()-&gt;inTableScope(thTag));
</span><span class="cx">     processFakeEndTag(thTag);
</span><del>-    ASSERT(insertionMode() == InsertionMode::InRow);
</del><ins>+    ASSERT(m_insertionMode == InsertionMode::InRow);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><del>-void HTMLTreeBuilder::processStartTagForInTable(AtomicHTMLToken* token)
</del><ins>+void HTMLTreeBuilder::processStartTagForInTable(AtomicHTMLToken&amp; token)
</ins><span class="cx"> {
</span><del>-    ASSERT(token-&gt;type() == HTMLToken::StartTag);
-    if (token-&gt;name() == captionTag) {
</del><ins>+    ASSERT(token.type() == HTMLToken::StartTag);
+    if (token.name() == captionTag) {
</ins><span class="cx">         m_tree.openElements()-&gt;popUntilTableScopeMarker();
</span><span class="cx">         m_tree.activeFormattingElements()-&gt;appendMarker();
</span><del>-        m_tree.insertHTMLElement(token);
-        setInsertionMode(InsertionMode::InCaption);
</del><ins>+        m_tree.insertHTMLElement(&amp;token);
+        m_insertionMode = InsertionMode::InCaption;
</ins><span class="cx">         return;
</span><span class="cx">     }
</span><del>-    if (token-&gt;name() == colgroupTag) {
</del><ins>+    if (token.name() == colgroupTag) {
</ins><span class="cx">         m_tree.openElements()-&gt;popUntilTableScopeMarker();
</span><del>-        m_tree.insertHTMLElement(token);
-        setInsertionMode(InsertionMode::InColumnGroup);
</del><ins>+        m_tree.insertHTMLElement(&amp;token);
+        m_insertionMode = InsertionMode::InColumnGroup;
</ins><span class="cx">         return;
</span><span class="cx">     }
</span><del>-    if (token-&gt;name() == colTag) {
</del><ins>+    if (token.name() == colTag) {
</ins><span class="cx">         processFakeStartTag(colgroupTag);
</span><del>-        ASSERT(insertionMode() == InsertionMode::InColumnGroup);
</del><ins>+        ASSERT(m_insertionMode == InsertionMode::InColumnGroup);
</ins><span class="cx">         processStartTag(token);
</span><span class="cx">         return;
</span><span class="cx">     }
</span><del>-    if (isTableBodyContextTag(token-&gt;name())) {
</del><ins>+    if (isTableBodyContextTag(token.name())) {
</ins><span class="cx">         m_tree.openElements()-&gt;popUntilTableScopeMarker();
</span><del>-        m_tree.insertHTMLElement(token);
-        setInsertionMode(InsertionMode::InTableBody);
</del><ins>+        m_tree.insertHTMLElement(&amp;token);
+        m_insertionMode = InsertionMode::InTableBody;
</ins><span class="cx">         return;
</span><span class="cx">     }
</span><del>-    if (isTableCellContextTag(token-&gt;name())
-        || token-&gt;name() == trTag) {
</del><ins>+    if (isTableCellContextTag(token.name()) || token.name() == trTag) {
</ins><span class="cx">         processFakeStartTag(tbodyTag);
</span><del>-        ASSERT(insertionMode() == InsertionMode::InTableBody);
</del><ins>+        ASSERT(m_insertionMode == InsertionMode::InTableBody);
</ins><span class="cx">         processStartTag(token);
</span><span class="cx">         return;
</span><span class="cx">     }
</span><del>-    if (token-&gt;name() == tableTag) {
</del><ins>+    if (token.name() == tableTag) {
</ins><span class="cx">         parseError(token);
</span><span class="cx">         if (!processTableEndTagForInTable()) {
</span><span class="cx">             ASSERT(isParsingFragmentOrTemplateContents());
</span><span class="lines">@@ -1040,29 +1022,29 @@
</span><span class="cx">         processStartTag(token);
</span><span class="cx">         return;
</span><span class="cx">     }
</span><del>-    if (token-&gt;name() == styleTag || token-&gt;name() == scriptTag) {
</del><ins>+    if (token.name() == styleTag || token.name() == scriptTag) {
</ins><span class="cx">         processStartTagForInHead(token);
</span><span class="cx">         return;
</span><span class="cx">     }
</span><del>-    if (token-&gt;name() == inputTag) {
-        Attribute* typeAttribute = token-&gt;getAttributeItem(typeAttr);
</del><ins>+    if (token.name() == inputTag) {
+        Attribute* typeAttribute = token.getAttributeItem(typeAttr);
</ins><span class="cx">         if (typeAttribute &amp;&amp; equalIgnoringCase(typeAttribute-&gt;value(), &quot;hidden&quot;)) {
</span><span class="cx">             parseError(token);
</span><del>-            m_tree.insertSelfClosingHTMLElement(token);
</del><ins>+            m_tree.insertSelfClosingHTMLElement(&amp;token);
</ins><span class="cx">             return;
</span><span class="cx">         }
</span><span class="cx">         // Fall through to &quot;anything else&quot; case.
</span><span class="cx">     }
</span><del>-    if (token-&gt;name() == formTag) {
</del><ins>+    if (token.name() == formTag) {
</ins><span class="cx">         parseError(token);
</span><span class="cx">         if (m_tree.form() &amp;&amp; !isParsingTemplateContents())
</span><span class="cx">             return;
</span><del>-        m_tree.insertHTMLFormElement(token, true);
</del><ins>+        m_tree.insertHTMLFormElement(&amp;token, true);
</ins><span class="cx">         m_tree.openElements()-&gt;pop();
</span><span class="cx">         return;
</span><span class="cx">     }
</span><span class="cx"> #if ENABLE(TEMPLATE_ELEMENT)
</span><del>-    if (token-&gt;name() == templateTag) {
</del><ins>+    if (token.name() == templateTag) {
</ins><span class="cx">         processTemplateStartTag(token);
</span><span class="cx">         return;
</span><span class="cx">     }
</span><span class="lines">@@ -1072,71 +1054,70 @@
</span><span class="cx">     processStartTagForInBody(token);
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-void HTMLTreeBuilder::processStartTag(AtomicHTMLToken* token)
</del><ins>+void HTMLTreeBuilder::processStartTag(AtomicHTMLToken&amp; token)
</ins><span class="cx"> {
</span><del>-    ASSERT(token-&gt;type() == HTMLToken::StartTag);
-    switch (insertionMode()) {
</del><ins>+    ASSERT(token.type() == HTMLToken::StartTag);
+    switch (m_insertionMode) {
</ins><span class="cx">     case InsertionMode::Initial:
</span><del>-        ASSERT(insertionMode() == InsertionMode::Initial);
</del><span class="cx">         defaultForInitial();
</span><ins>+        ASSERT(m_insertionMode == InsertionMode::BeforeHTML);
</ins><span class="cx">         FALLTHROUGH;
</span><span class="cx">     case InsertionMode::BeforeHTML:
</span><del>-        ASSERT(insertionMode() == InsertionMode::BeforeHTML);
-        if (token-&gt;name() == htmlTag) {
-            m_tree.insertHTMLHtmlStartTagBeforeHTML(token);
-            setInsertionMode(InsertionMode::BeforeHead);
</del><ins>+        if (token.name() == htmlTag) {
+            m_tree.insertHTMLHtmlStartTagBeforeHTML(&amp;token);
+            m_insertionMode = InsertionMode::BeforeHead;
</ins><span class="cx">             return;
</span><span class="cx">         }
</span><span class="cx">         defaultForBeforeHTML();
</span><ins>+        ASSERT(m_insertionMode == InsertionMode::BeforeHead);
</ins><span class="cx">         FALLTHROUGH;
</span><span class="cx">     case InsertionMode::BeforeHead:
</span><del>-        ASSERT(insertionMode() == InsertionMode::BeforeHead);
-        if (token-&gt;name() == htmlTag) {
</del><ins>+        if (token.name() == htmlTag) {
</ins><span class="cx">             processHtmlStartTagForInBody(token);
</span><span class="cx">             return;
</span><span class="cx">         }
</span><del>-        if (token-&gt;name() == headTag) {
-            m_tree.insertHTMLHeadElement(token);
-            setInsertionMode(InsertionMode::InHead);
</del><ins>+        if (token.name() == headTag) {
+            m_tree.insertHTMLHeadElement(&amp;token);
+            m_insertionMode = InsertionMode::InHead;
</ins><span class="cx">             return;
</span><span class="cx">         }
</span><span class="cx">         defaultForBeforeHead();
</span><ins>+        ASSERT(m_insertionMode == InsertionMode::InHead);
</ins><span class="cx">         FALLTHROUGH;
</span><span class="cx">     case InsertionMode::InHead:
</span><del>-        ASSERT(insertionMode() == InsertionMode::InHead);
</del><span class="cx">         if (processStartTagForInHead(token))
</span><span class="cx">             return;
</span><span class="cx">         defaultForInHead();
</span><ins>+        ASSERT(m_insertionMode == InsertionMode::AfterHead);
</ins><span class="cx">         FALLTHROUGH;
</span><span class="cx">     case InsertionMode::AfterHead:
</span><del>-        ASSERT(insertionMode() == InsertionMode::AfterHead);
-        if (token-&gt;name() == htmlTag) {
</del><ins>+        if (token.name() == htmlTag) {
</ins><span class="cx">             processHtmlStartTagForInBody(token);
</span><span class="cx">             return;
</span><span class="cx">         }
</span><del>-        if (token-&gt;name() == bodyTag) {
</del><ins>+        if (token.name() == bodyTag) {
</ins><span class="cx">             m_framesetOk = false;
</span><del>-            m_tree.insertHTMLBodyElement(token);
-            setInsertionMode(InsertionMode::InBody);
</del><ins>+            m_tree.insertHTMLBodyElement(&amp;token);
+            m_insertionMode = InsertionMode::InBody;
</ins><span class="cx">             return;
</span><span class="cx">         }
</span><del>-        if (token-&gt;name() == framesetTag) {
-            m_tree.insertHTMLElement(token);
-            setInsertionMode(InsertionMode::InFrameset);
</del><ins>+        if (token.name() == framesetTag) {
+            m_tree.insertHTMLElement(&amp;token);
+            m_insertionMode = InsertionMode::InFrameset;
</ins><span class="cx">             return;
</span><span class="cx">         }
</span><del>-        if (token-&gt;name() == baseTag
-            || token-&gt;name() == basefontTag
-            || token-&gt;name() == bgsoundTag
-            || token-&gt;name() == linkTag
-            || token-&gt;name() == metaTag
-            || token-&gt;name() == noframesTag
-            || token-&gt;name() == scriptTag
-            || token-&gt;name() == styleTag
</del><ins>+        if (token.name() == baseTag
+            || token.name() == basefontTag
+            || token.name() == bgsoundTag
+            || token.name() == linkTag
+            || token.name() == metaTag
+            || token.name() == noframesTag
+            || token.name() == scriptTag
+            || token.name() == styleTag
</ins><span class="cx"> #if ENABLE(TEMPLATE_ELEMENT)
</span><del>-            || token-&gt;name() == templateTag
</del><ins>+            || token.name() == templateTag
</ins><span class="cx"> #endif
</span><del>-            || token-&gt;name() == titleTag) {
</del><ins>+            || token.name() == titleTag) {
</ins><span class="cx">             parseError(token);
</span><span class="cx">             ASSERT(m_tree.head());
</span><span class="cx">             m_tree.openElements()-&gt;pushHTMLHeadElement(m_tree.headStackItem());
</span><span class="lines">@@ -1144,26 +1125,24 @@
</span><span class="cx">             m_tree.openElements()-&gt;removeHTMLHeadElement(m_tree.head());
</span><span class="cx">             return;
</span><span class="cx">         }
</span><del>-        if (token-&gt;name() == headTag) {
</del><ins>+        if (token.name() == headTag) {
</ins><span class="cx">             parseError(token);
</span><span class="cx">             return;
</span><span class="cx">         }
</span><span class="cx">         defaultForAfterHead();
</span><ins>+        ASSERT(m_insertionMode == InsertionMode::InBody);
</ins><span class="cx">         FALLTHROUGH;
</span><span class="cx">     case InsertionMode::InBody:
</span><del>-        ASSERT(insertionMode() == InsertionMode::InBody);
</del><span class="cx">         processStartTagForInBody(token);
</span><span class="cx">         break;
</span><span class="cx">     case InsertionMode::InTable:
</span><del>-        ASSERT(insertionMode() == InsertionMode::InTable);
</del><span class="cx">         processStartTagForInTable(token);
</span><span class="cx">         break;
</span><span class="cx">     case InsertionMode::InCaption:
</span><del>-        ASSERT(insertionMode() == InsertionMode::InCaption);
-        if (isCaptionColOrColgroupTag(token-&gt;name())
-            || isTableBodyContextTag(token-&gt;name())
-            || isTableCellContextTag(token-&gt;name())
-            || token-&gt;name() == trTag) {
</del><ins>+        if (isCaptionColOrColgroupTag(token.name())
+            || isTableBodyContextTag(token.name())
+            || isTableCellContextTag(token.name())
+            || token.name() == trTag) {
</ins><span class="cx">             parseError(token);
</span><span class="cx">             if (!processCaptionEndTagForInCaption()) {
</span><span class="cx">                 ASSERT(isParsingFragment());
</span><span class="lines">@@ -1175,17 +1154,16 @@
</span><span class="cx">         processStartTagForInBody(token);
</span><span class="cx">         break;
</span><span class="cx">     case InsertionMode::InColumnGroup:
</span><del>-        ASSERT(insertionMode() == InsertionMode::InColumnGroup);
-        if (token-&gt;name() == htmlTag) {
</del><ins>+        if (token.name() == htmlTag) {
</ins><span class="cx">             processHtmlStartTagForInBody(token);
</span><span class="cx">             return;
</span><span class="cx">         }
</span><del>-        if (token-&gt;name() == colTag) {
-            m_tree.insertSelfClosingHTMLElement(token);
</del><ins>+        if (token.name() == colTag) {
+            m_tree.insertSelfClosingHTMLElement(&amp;token);
</ins><span class="cx">             return;
</span><span class="cx">         }
</span><span class="cx"> #if ENABLE(TEMPLATE_ELEMENT)
</span><del>-        if (token-&gt;name() == templateTag) {
</del><ins>+        if (token.name() == templateTag) {
</ins><span class="cx">             processTemplateStartTag(token);
</span><span class="cx">             return;
</span><span class="cx">         }
</span><span class="lines">@@ -1197,21 +1175,20 @@
</span><span class="cx">         processStartTag(token);
</span><span class="cx">         break;
</span><span class="cx">     case InsertionMode::InTableBody:
</span><del>-        ASSERT(insertionMode() == InsertionMode::InTableBody);
-        if (token-&gt;name() == trTag) {
</del><ins>+        if (token.name() == trTag) {
</ins><span class="cx">             m_tree.openElements()-&gt;popUntilTableBodyScopeMarker(); // How is there ever anything to pop?
</span><del>-            m_tree.insertHTMLElement(token);
-            setInsertionMode(InsertionMode::InRow);
</del><ins>+            m_tree.insertHTMLElement(&amp;token);
+            m_insertionMode = InsertionMode::InRow;
</ins><span class="cx">             return;
</span><span class="cx">         }
</span><del>-        if (isTableCellContextTag(token-&gt;name())) {
</del><ins>+        if (isTableCellContextTag(token.name())) {
</ins><span class="cx">             parseError(token);
</span><span class="cx">             processFakeStartTag(trTag);
</span><del>-            ASSERT(insertionMode() == InsertionMode::InRow);
</del><ins>+            ASSERT(m_insertionMode == InsertionMode::InRow);
</ins><span class="cx">             processStartTag(token);
</span><span class="cx">             return;
</span><span class="cx">         }
</span><del>-        if (isCaptionColOrColgroupTag(token-&gt;name()) || isTableBodyContextTag(token-&gt;name())) {
</del><ins>+        if (isCaptionColOrColgroupTag(token.name()) || isTableBodyContextTag(token.name())) {
</ins><span class="cx">             // FIXME: This is slow.
</span><span class="cx">             if (!m_tree.openElements()-&gt;inTableScope(tbodyTag) &amp;&amp; !m_tree.openElements()-&gt;inTableScope(theadTag) &amp;&amp; !m_tree.openElements()-&gt;inTableScope(tfootTag)) {
</span><span class="cx">                 ASSERT(isParsingFragmentOrTemplateContents());
</span><span class="lines">@@ -1227,33 +1204,31 @@
</span><span class="cx">         processStartTagForInTable(token);
</span><span class="cx">         break;
</span><span class="cx">     case InsertionMode::InRow:
</span><del>-        ASSERT(insertionMode() == InsertionMode::InRow);
-        if (isTableCellContextTag(token-&gt;name())) {
</del><ins>+        if (isTableCellContextTag(token.name())) {
</ins><span class="cx">             m_tree.openElements()-&gt;popUntilTableRowScopeMarker();
</span><del>-            m_tree.insertHTMLElement(token);
-            setInsertionMode(InsertionMode::InCell);
</del><ins>+            m_tree.insertHTMLElement(&amp;token);
+            m_insertionMode = InsertionMode::InCell;
</ins><span class="cx">             m_tree.activeFormattingElements()-&gt;appendMarker();
</span><span class="cx">             return;
</span><span class="cx">         }
</span><del>-        if (token-&gt;name() == trTag
-            || isCaptionColOrColgroupTag(token-&gt;name())
-            || isTableBodyContextTag(token-&gt;name())) {
</del><ins>+        if (token.name() == trTag
+            || isCaptionColOrColgroupTag(token.name())
+            || isTableBodyContextTag(token.name())) {
</ins><span class="cx">             if (!processTrEndTagForInRow()) {
</span><span class="cx">                 ASSERT(isParsingFragmentOrTemplateContents());
</span><span class="cx">                 return;
</span><span class="cx">             }
</span><del>-            ASSERT(insertionMode() == InsertionMode::InTableBody);
</del><ins>+            ASSERT(m_insertionMode == InsertionMode::InTableBody);
</ins><span class="cx">             processStartTag(token);
</span><span class="cx">             return;
</span><span class="cx">         }
</span><span class="cx">         processStartTagForInTable(token);
</span><span class="cx">         break;
</span><span class="cx">     case InsertionMode::InCell:
</span><del>-        ASSERT(insertionMode() == InsertionMode::InCell);
-        if (isCaptionColOrColgroupTag(token-&gt;name())
-            || isTableCellContextTag(token-&gt;name())
-            || token-&gt;name() == trTag
-            || isTableBodyContextTag(token-&gt;name())) {
</del><ins>+        if (isCaptionColOrColgroupTag(token.name())
+            || isTableCellContextTag(token.name())
+            || token.name() == trTag
+            || isTableBodyContextTag(token.name())) {
</ins><span class="cx">             // FIXME: This could be more efficient.
</span><span class="cx">             if (!m_tree.openElements()-&gt;inTableScope(tdTag) &amp;&amp; !m_tree.openElements()-&gt;inTableScope(thTag)) {
</span><span class="cx">                 ASSERT(isParsingFragment());
</span><span class="lines">@@ -1268,31 +1243,29 @@
</span><span class="cx">         break;
</span><span class="cx">     case InsertionMode::AfterBody:
</span><span class="cx">     case InsertionMode::AfterAfterBody:
</span><del>-        ASSERT(insertionMode() == InsertionMode::AfterBody || insertionMode() == InsertionMode::AfterAfterBody);
-        if (token-&gt;name() == htmlTag) {
</del><ins>+        if (token.name() == htmlTag) {
</ins><span class="cx">             processHtmlStartTagForInBody(token);
</span><span class="cx">             return;
</span><span class="cx">         }
</span><del>-        setInsertionMode(InsertionMode::InBody);
</del><ins>+        m_insertionMode = InsertionMode::InBody;
</ins><span class="cx">         processStartTag(token);
</span><span class="cx">         break;
</span><span class="cx">     case InsertionMode::InHeadNoscript:
</span><del>-        ASSERT(insertionMode() == InsertionMode::InHeadNoscript);
-        if (token-&gt;name() == htmlTag) {
</del><ins>+        if (token.name() == htmlTag) {
</ins><span class="cx">             processHtmlStartTagForInBody(token);
</span><span class="cx">             return;
</span><span class="cx">         }
</span><del>-        if (token-&gt;name() == basefontTag
-            || token-&gt;name() == bgsoundTag
-            || token-&gt;name() == linkTag
-            || token-&gt;name() == metaTag
-            || token-&gt;name() == noframesTag
-            || token-&gt;name() == styleTag) {
</del><ins>+        if (token.name() == basefontTag
+            || token.name() == bgsoundTag
+            || token.name() == linkTag
+            || token.name() == metaTag
+            || token.name() == noframesTag
+            || token.name() == styleTag) {
</ins><span class="cx">             bool didProcess = processStartTagForInHead(token);
</span><span class="cx">             ASSERT_UNUSED(didProcess, didProcess);
</span><span class="cx">             return;
</span><span class="cx">         }
</span><del>-        if (token-&gt;name() == htmlTag || token-&gt;name() == noscriptTag) {
</del><ins>+        if (token.name() == htmlTag || token.name() == noscriptTag) {
</ins><span class="cx">             parseError(token);
</span><span class="cx">             return;
</span><span class="cx">         }
</span><span class="lines">@@ -1300,25 +1273,24 @@
</span><span class="cx">         processToken(token);
</span><span class="cx">         break;
</span><span class="cx">     case InsertionMode::InFrameset:
</span><del>-        ASSERT(insertionMode() == InsertionMode::InFrameset);
-        if (token-&gt;name() == htmlTag) {
</del><ins>+        if (token.name() == htmlTag) {
</ins><span class="cx">             processHtmlStartTagForInBody(token);
</span><span class="cx">             return;
</span><span class="cx">         }
</span><del>-        if (token-&gt;name() == framesetTag) {
-            m_tree.insertHTMLElement(token);
</del><ins>+        if (token.name() == framesetTag) {
+            m_tree.insertHTMLElement(&amp;token);
</ins><span class="cx">             return;
</span><span class="cx">         }
</span><del>-        if (token-&gt;name() == frameTag) {
-            m_tree.insertSelfClosingHTMLElement(token);
</del><ins>+        if (token.name() == frameTag) {
+            m_tree.insertSelfClosingHTMLElement(&amp;token);
</ins><span class="cx">             return;
</span><span class="cx">         }
</span><del>-        if (token-&gt;name() == noframesTag) {
</del><ins>+        if (token.name() == noframesTag) {
</ins><span class="cx">             processStartTagForInHead(token);
</span><span class="cx">             return;
</span><span class="cx">         }
</span><span class="cx"> #if ENABLE(TEMPLATE_ELEMENT)
</span><del>-        if (token-&gt;name() == templateTag) {
</del><ins>+        if (token.name() == templateTag) {
</ins><span class="cx">             processTemplateStartTag(token);
</span><span class="cx">             return;
</span><span class="cx">         }
</span><span class="lines">@@ -1327,83 +1299,78 @@
</span><span class="cx">         break;
</span><span class="cx">     case InsertionMode::AfterFrameset:
</span><span class="cx">     case InsertionMode::AfterAfterFrameset:
</span><del>-        ASSERT(insertionMode() == InsertionMode::AfterFrameset || insertionMode() == InsertionMode::AfterAfterFrameset);
-        if (token-&gt;name() == htmlTag) {
</del><ins>+        if (token.name() == htmlTag) {
</ins><span class="cx">             processHtmlStartTagForInBody(token);
</span><span class="cx">             return;
</span><span class="cx">         }
</span><del>-        if (token-&gt;name() == noframesTag) {
</del><ins>+        if (token.name() == noframesTag) {
</ins><span class="cx">             processStartTagForInHead(token);
</span><span class="cx">             return;
</span><span class="cx">         }
</span><span class="cx">         parseError(token);
</span><span class="cx">         break;
</span><span class="cx">     case InsertionMode::InSelectInTable:
</span><del>-        ASSERT(insertionMode() == InsertionMode::InSelectInTable);
-        if (token-&gt;name() == captionTag
-            || token-&gt;name() == tableTag
-            || isTableBodyContextTag(token-&gt;name())
-            || token-&gt;name() == trTag
-            || isTableCellContextTag(token-&gt;name())) {
</del><ins>+        if (token.name() == captionTag
+            || token.name() == tableTag
+            || isTableBodyContextTag(token.name())
+            || token.name() == trTag
+            || isTableCellContextTag(token.name())) {
</ins><span class="cx">             parseError(token);
</span><span class="cx">             AtomicHTMLToken endSelect(HTMLToken::EndTag, selectTag.localName());
</span><del>-            processEndTag(&amp;endSelect);
</del><ins>+            processEndTag(endSelect);
</ins><span class="cx">             processStartTag(token);
</span><span class="cx">             return;
</span><span class="cx">         }
</span><span class="cx">         FALLTHROUGH;
</span><span class="cx">     case InsertionMode::InSelect:
</span><del>-        ASSERT(insertionMode() == InsertionMode::InSelect || insertionMode() == InsertionMode::InSelectInTable);
-        if (token-&gt;name() == htmlTag) {
</del><ins>+        if (token.name() == htmlTag) {
</ins><span class="cx">             processHtmlStartTagForInBody(token);
</span><span class="cx">             return;
</span><span class="cx">         }
</span><del>-        if (token-&gt;name() == optionTag) {
</del><ins>+        if (token.name() == optionTag) {
</ins><span class="cx">             if (is&lt;HTMLOptionElement&gt;(*m_tree.currentStackItem()-&gt;node())) {
</span><span class="cx">                 AtomicHTMLToken endOption(HTMLToken::EndTag, optionTag.localName());
</span><del>-                processEndTag(&amp;endOption);
</del><ins>+                processEndTag(endOption);
</ins><span class="cx">             }
</span><del>-            m_tree.insertHTMLElement(token);
</del><ins>+            m_tree.insertHTMLElement(&amp;token);
</ins><span class="cx">             return;
</span><span class="cx">         }
</span><del>-        if (token-&gt;name() == optgroupTag) {
</del><ins>+        if (token.name() == optgroupTag) {
</ins><span class="cx">             if (is&lt;HTMLOptionElement&gt;(*m_tree.currentStackItem()-&gt;node())) {
</span><span class="cx">                 AtomicHTMLToken endOption(HTMLToken::EndTag, optionTag.localName());
</span><del>-                processEndTag(&amp;endOption);
</del><ins>+                processEndTag(endOption);
</ins><span class="cx">             }
</span><span class="cx">             if (is&lt;HTMLOptGroupElement&gt;(*m_tree.currentStackItem()-&gt;node())) {
</span><span class="cx">                 AtomicHTMLToken endOptgroup(HTMLToken::EndTag, optgroupTag.localName());
</span><del>-                processEndTag(&amp;endOptgroup);
</del><ins>+                processEndTag(endOptgroup);
</ins><span class="cx">             }
</span><del>-            m_tree.insertHTMLElement(token);
</del><ins>+            m_tree.insertHTMLElement(&amp;token);
</ins><span class="cx">             return;
</span><span class="cx">         }
</span><del>-        if (token-&gt;name() == selectTag) {
</del><ins>+        if (token.name() == selectTag) {
</ins><span class="cx">             parseError(token);
</span><span class="cx">             AtomicHTMLToken endSelect(HTMLToken::EndTag, selectTag.localName());
</span><del>-            processEndTag(&amp;endSelect);
</del><ins>+            processEndTag(endSelect);
</ins><span class="cx">             return;
</span><span class="cx">         }
</span><del>-        if (token-&gt;name() == inputTag
-            || token-&gt;name() == keygenTag
-            || token-&gt;name() == textareaTag) {
</del><ins>+        if (token.name() == inputTag || token.name() == keygenTag || token.name() == textareaTag) {
</ins><span class="cx">             parseError(token);
</span><span class="cx">             if (!m_tree.openElements()-&gt;inSelectScope(selectTag)) {
</span><span class="cx">                 ASSERT(isParsingFragment());
</span><span class="cx">                 return;
</span><span class="cx">             }
</span><span class="cx">             AtomicHTMLToken endSelect(HTMLToken::EndTag, selectTag.localName());
</span><del>-            processEndTag(&amp;endSelect);
</del><ins>+            processEndTag(endSelect);
</ins><span class="cx">             processStartTag(token);
</span><span class="cx">             return;
</span><span class="cx">         }
</span><del>-        if (token-&gt;name() == scriptTag) {
</del><ins>+        if (token.name() == scriptTag) {
</ins><span class="cx">             bool didProcess = processStartTagForInHead(token);
</span><span class="cx">             ASSERT_UNUSED(didProcess, didProcess);
</span><span class="cx">             return;
</span><span class="cx">         }
</span><span class="cx"> #if ENABLE(TEMPLATE_ELEMENT)
</span><del>-        if (token-&gt;name() == templateTag) {
</del><ins>+        if (token.name() == templateTag) {
</ins><span class="cx">             processTemplateStartTag(token);
</span><span class="cx">             return;
</span><span class="cx">         }
</span><span class="lines">@@ -1416,31 +1383,31 @@
</span><span class="cx">     case InsertionMode::Text:
</span><span class="cx">         ASSERT_NOT_REACHED();
</span><span class="cx">         break;
</span><del>-    case InsertionMode::TemplateContents:
</del><span class="cx"> #if ENABLE(TEMPLATE_ELEMENT)
</span><del>-        if (token-&gt;name() == templateTag) {
</del><ins>+    case InsertionMode::TemplateContents:
+        if (token.name() == templateTag) {
</ins><span class="cx">             processTemplateStartTag(token);
</span><span class="cx">             return;
</span><span class="cx">         }
</span><span class="cx"> 
</span><del>-        if (token-&gt;name() == linkTag
-            || token-&gt;name() == scriptTag
-            || token-&gt;name() == styleTag
-            || token-&gt;name() == metaTag) {
</del><ins>+        if (token.name() == linkTag
+            || token.name() == scriptTag
+            || token.name() == styleTag
+            || token.name() == metaTag) {
</ins><span class="cx">             processStartTagForInHead(token);
</span><span class="cx">             return;
</span><span class="cx">         }
</span><span class="cx"> 
</span><span class="cx">         InsertionMode insertionMode = InsertionMode::TemplateContents;
</span><del>-        if (token-&gt;name() == frameTag)
</del><ins>+        if (token.name() == frameTag)
</ins><span class="cx">             insertionMode = InsertionMode::InFrameset;
</span><del>-        else if (token-&gt;name() == colTag)
</del><ins>+        else if (token.name() == colTag)
</ins><span class="cx">             insertionMode = InsertionMode::InColumnGroup;
</span><del>-        else if (isCaptionColOrColgroupTag(token-&gt;name()) || isTableBodyContextTag(token-&gt;name()))
</del><ins>+        else if (isCaptionColOrColgroupTag(token.name()) || isTableBodyContextTag(token.name()))
</ins><span class="cx">             insertionMode = InsertionMode::InTable;
</span><del>-        else if (token-&gt;name() == trTag)
</del><ins>+        else if (token.name() == trTag)
</ins><span class="cx">             insertionMode = InsertionMode::InTableBody;
</span><del>-        else if (isTableCellContextTag(token-&gt;name()))
</del><ins>+        else if (isTableCellContextTag(token.name()))
</ins><span class="cx">             insertionMode = InsertionMode::InRow;
</span><span class="cx">         else
</span><span class="cx">             insertionMode = InsertionMode::InBody;
</span><span class="lines">@@ -1448,17 +1415,15 @@
</span><span class="cx">         ASSERT(insertionMode != InsertionMode::TemplateContents);
</span><span class="cx">         ASSERT(m_templateInsertionModes.last() == InsertionMode::TemplateContents);
</span><span class="cx">         m_templateInsertionModes.last() = insertionMode;
</span><del>-        setInsertionMode(insertionMode);
</del><ins>+        m_insertionMode = insertionMode;
</ins><span class="cx"> 
</span><span class="cx">         processStartTag(token);
</span><del>-#else
-        ASSERT_NOT_REACHED();
-#endif
</del><span class="cx">         break;
</span><ins>+#endif
</ins><span class="cx">     }
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-void HTMLTreeBuilder::processHtmlStartTagForInBody(AtomicHTMLToken* token)
</del><ins>+void HTMLTreeBuilder::processHtmlStartTagForInBody(AtomicHTMLToken&amp; token)
</ins><span class="cx"> {
</span><span class="cx">     parseError(token);
</span><span class="cx"> #if ENABLE(TEMPLATE_ELEMENT)
</span><span class="lines">@@ -1467,45 +1432,43 @@
</span><span class="cx">         return;
</span><span class="cx">     }
</span><span class="cx"> #endif
</span><del>-    m_tree.insertHTMLHtmlStartTagInBody(token);
</del><ins>+    m_tree.insertHTMLHtmlStartTagInBody(&amp;token);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><del>-bool HTMLTreeBuilder::processBodyEndTagForInBody(AtomicHTMLToken* token)
</del><ins>+bool HTMLTreeBuilder::processBodyEndTagForInBody(AtomicHTMLToken&amp; token)
</ins><span class="cx"> {
</span><del>-    ASSERT(token-&gt;type() == HTMLToken::EndTag);
-    ASSERT(token-&gt;name() == bodyTag);
</del><ins>+    ASSERT(token.type() == HTMLToken::EndTag);
+    ASSERT(token.name() == bodyTag);
</ins><span class="cx">     if (!m_tree.openElements()-&gt;inScope(bodyTag.localName())) {
</span><span class="cx">         parseError(token);
</span><span class="cx">         return false;
</span><span class="cx">     }
</span><span class="cx">     notImplemented(); // Emit a more specific parse error based on stack contents.
</span><del>-    setInsertionMode(InsertionMode::AfterBody);
</del><ins>+    m_insertionMode = InsertionMode::AfterBody;
</ins><span class="cx">     return true;
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-void HTMLTreeBuilder::processAnyOtherEndTagForInBody(AtomicHTMLToken* token)
</del><ins>+void HTMLTreeBuilder::processAnyOtherEndTagForInBody(AtomicHTMLToken&amp; token)
</ins><span class="cx"> {
</span><del>-    ASSERT(token-&gt;type() == HTMLToken::EndTag);
-    HTMLElementStack::ElementRecord* record = m_tree.openElements()-&gt;topRecord();
-    while (1) {
-        RefPtr&lt;HTMLStackItem&gt; item = record-&gt;stackItem();
-        if (item-&gt;matchesHTMLTag(token-&gt;name())) {
-            m_tree.generateImpliedEndTagsWithExclusion(token-&gt;name());
-            if (!m_tree.currentStackItem()-&gt;matchesHTMLTag(token-&gt;name()))
</del><ins>+    ASSERT(token.type() == HTMLToken::EndTag);
+    for (auto* record = m_tree.openElements()-&gt;topRecord(); ; record = record-&gt;next()) {
+        HTMLStackItem&amp; item = *record-&gt;stackItem();
+        if (item.matchesHTMLTag(token.name())) {
+            m_tree.generateImpliedEndTagsWithExclusion(token.name());
+            if (!m_tree.currentStackItem()-&gt;matchesHTMLTag(token.name()))
</ins><span class="cx">                 parseError(token);
</span><del>-            m_tree.openElements()-&gt;popUntilPopped(item-&gt;element());
</del><ins>+            m_tree.openElements()-&gt;popUntilPopped(item.element());
</ins><span class="cx">             return;
</span><span class="cx">         }
</span><del>-        if (item-&gt;isSpecialNode()) {
</del><ins>+        if (item.isSpecialNode()) {
</ins><span class="cx">             parseError(token);
</span><span class="cx">             return;
</span><span class="cx">         }
</span><del>-        record = record-&gt;next();
</del><span class="cx">     }
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> // http://www.whatwg.org/specs/web-apps/current-work/multipage/tokenization.html#parsing-main-inbody
</span><del>-void HTMLTreeBuilder::callTheAdoptionAgency(AtomicHTMLToken* token)
</del><ins>+void HTMLTreeBuilder::callTheAdoptionAgency(AtomicHTMLToken&amp; token)
</ins><span class="cx"> {
</span><span class="cx">     // The adoption agency algorithm is N^2. We limit the number of iterations
</span><span class="cx">     // to stop from hanging the whole browser. This limit is specified in the
</span><span class="lines">@@ -1517,7 +1480,7 @@
</span><span class="cx">     // 1, 2, 3 and 16 are covered by the for() loop.
</span><span class="cx">     for (int i = 0; i &lt; outerIterationLimit; ++i) {
</span><span class="cx">         // 4.
</span><del>-        Element* formattingElement = m_tree.activeFormattingElements()-&gt;closestElementInScopeWithName(token-&gt;name());
</del><ins>+        Element* formattingElement = m_tree.activeFormattingElements()-&gt;closestElementInScopeWithName(token.name());
</ins><span class="cx">         // 4.a
</span><span class="cx">         if (!formattingElement)
</span><span class="cx">             return processAnyOtherEndTagForInBody(token);
</span><span class="lines">@@ -1528,7 +1491,7 @@
</span><span class="cx">             return;
</span><span class="cx">         }
</span><span class="cx">         // 4.b
</span><del>-        HTMLElementStack::ElementRecord* formattingElementRecord = m_tree.openElements()-&gt;find(formattingElement);
</del><ins>+        auto* formattingElementRecord = m_tree.openElements()-&gt;find(formattingElement);
</ins><span class="cx">         if (!formattingElementRecord) {
</span><span class="cx">             parseError(token);
</span><span class="cx">             m_tree.activeFormattingElements()-&gt;remove(formattingElement);
</span><span class="lines">@@ -1538,7 +1501,7 @@
</span><span class="cx">         if (formattingElement != m_tree.currentElement())
</span><span class="cx">             parseError(token);
</span><span class="cx">         // 5.
</span><del>-        HTMLElementStack::ElementRecord* furthestBlock = m_tree.openElements()-&gt;furthestBlockForFormattingElement(formattingElement);
</del><ins>+        auto* furthestBlock = m_tree.openElements()-&gt;furthestBlockForFormattingElement(formattingElement);
</ins><span class="cx">         // 6.
</span><span class="cx">         if (!furthestBlock) {
</span><span class="cx">             m_tree.openElements()-&gt;popUntilPopped(formattingElement);
</span><span class="lines">@@ -1551,9 +1514,9 @@
</span><span class="cx">         // 8.
</span><span class="cx">         HTMLFormattingElementList::Bookmark bookmark = m_tree.activeFormattingElements()-&gt;bookmarkFor(formattingElement);
</span><span class="cx">         // 9.
</span><del>-        HTMLElementStack::ElementRecord* node = furthestBlock;
-        HTMLElementStack::ElementRecord* nextNode = node-&gt;next();
-        HTMLElementStack::ElementRecord* lastNode = furthestBlock;
</del><ins>+        auto* node = furthestBlock;
+        auto* nextNode = node-&gt;next();
+        auto* lastNode = furthestBlock;
</ins><span class="cx">         // 9.1, 9.2, 9.3 and 9.11 are covered by the for() loop.
</span><span class="cx">         for (int i = 0; i &lt; innerIterationLimit; ++i) {
</span><span class="cx">             // 9.4
</span><span class="lines">@@ -1604,9 +1567,8 @@
</span><span class="cx"> {
</span><span class="cx">     // http://www.whatwg.org/specs/web-apps/current-work/multipage/parsing.html#reset-the-insertion-mode-appropriately
</span><span class="cx">     bool last = false;
</span><del>-    HTMLElementStack::ElementRecord* nodeRecord = m_tree.openElements()-&gt;topRecord();
-    while (1) {
-        RefPtr&lt;HTMLStackItem&gt; item = nodeRecord-&gt;stackItem();
</del><ins>+    for (auto* record = m_tree.openElements()-&gt;topRecord(); ; record = record-&gt;next()) {
+        HTMLStackItem* item = record-&gt;stackItem().get();
</ins><span class="cx">         if (item-&gt;node() == m_tree.openElements()-&gt;rootNode()) {
</span><span class="cx">             last = true;
</span><span class="cx"> #if ENABLE(TEMPLATE_ELEMENT)
</span><span class="lines">@@ -1616,78 +1578,104 @@
</span><span class="cx">             bool shouldCreateItem = true;
</span><span class="cx"> #endif
</span><span class="cx">             if (shouldCreateItem)
</span><del>-                item = m_fragmentContext.contextElementStackItem();
</del><ins>+                item = &amp;m_fragmentContext.contextElementStackItem();
</ins><span class="cx">         }
</span><ins>+
</ins><span class="cx"> #if ENABLE(TEMPLATE_ELEMENT)
</span><del>-        if (item-&gt;hasTagName(templateTag))
-            return setInsertionMode(m_templateInsertionModes.last());
</del><ins>+        if (item-&gt;hasTagName(templateTag)) {
+            m_insertionMode = m_templateInsertionModes.last();
+            return;
+        }
</ins><span class="cx"> #endif
</span><span class="cx">         if (item-&gt;hasTagName(selectTag)) {
</span><span class="cx"> #if ENABLE(TEMPLATE_ELEMENT)
</span><span class="cx">             if (!last) {
</span><span class="cx">                 while (item-&gt;node() != m_tree.openElements()-&gt;rootNode() &amp;&amp; !item-&gt;hasTagName(templateTag)) {
</span><del>-                    nodeRecord = nodeRecord-&gt;next();
-                    item = nodeRecord-&gt;stackItem();
-                    if (is&lt;HTMLTableElement&gt;(*item-&gt;node()))
-                        return setInsertionMode(InsertionMode::InSelectInTable);
</del><ins>+                    record = record-&gt;next();
+                    item = record-&gt;stackItem().get();
+                    if (is&lt;HTMLTableElement&gt;(*item-&gt;node())) {
+                        m_insertionMode = InsertionMode::InSelectInTable;
+                        return;
+                    }
</ins><span class="cx">                 }
</span><span class="cx">             }
</span><span class="cx"> #endif
</span><del>-            return setInsertionMode(InsertionMode::InSelect);
</del><ins>+            m_insertionMode = InsertionMode::InSelect;
+            return;
</ins><span class="cx">         }
</span><del>-        if (item-&gt;hasTagName(tdTag) || item-&gt;hasTagName(thTag))
-            return setInsertionMode(InsertionMode::InCell);
-        if (item-&gt;hasTagName(trTag))
-            return setInsertionMode(InsertionMode::InRow);
-        if (item-&gt;hasTagName(tbodyTag) || item-&gt;hasTagName(theadTag) || item-&gt;hasTagName(tfootTag))
-            return setInsertionMode(InsertionMode::InTableBody);
-        if (item-&gt;hasTagName(captionTag))
-            return setInsertionMode(InsertionMode::InCaption);
</del><ins>+        if (item-&gt;hasTagName(tdTag) || item-&gt;hasTagName(thTag)) {
+            m_insertionMode = InsertionMode::InCell;
+            return;
+        }
+        if (item-&gt;hasTagName(trTag)) {
+            m_insertionMode = InsertionMode::InRow;
+            return;
+        }
+        if (item-&gt;hasTagName(tbodyTag) || item-&gt;hasTagName(theadTag) || item-&gt;hasTagName(tfootTag)) {
+            m_insertionMode = InsertionMode::InTableBody;
+            return;
+        }
+        if (item-&gt;hasTagName(captionTag)) {
+            m_insertionMode = InsertionMode::InCaption;
+            return;
+        }
</ins><span class="cx">         if (item-&gt;hasTagName(colgroupTag)) {
</span><del>-            return setInsertionMode(InsertionMode::InColumnGroup);
</del><ins>+            m_insertionMode = InsertionMode::InColumnGroup;
+            return;
</ins><span class="cx">         }
</span><del>-        if (is&lt;HTMLTableElement&gt;(*item-&gt;node()))
-            return setInsertionMode(InsertionMode::InTable);
</del><ins>+        if (is&lt;HTMLTableElement&gt;(*item-&gt;node())) {
+            m_insertionMode = InsertionMode::InTable;
+            return;
+        }
</ins><span class="cx">         if (item-&gt;hasTagName(headTag)) {
</span><span class="cx"> #if ENABLE(TEMPLATE_ELEMENT)
</span><del>-            if (!m_fragmentContext.fragment() || m_fragmentContext.contextElement() != item-&gt;node())
-                return setInsertionMode(InsertionMode::InHead);
</del><ins>+            if (!m_fragmentContext.fragment() || &amp;m_fragmentContext.contextElement() != item-&gt;node()) {
+                m_insertionMode = InsertionMode::InHead;
+                return;
+            }
</ins><span class="cx"> #endif
</span><del>-            return setInsertionMode(InsertionMode::InBody);
</del><ins>+            m_insertionMode = InsertionMode::InBody;
+            return;
</ins><span class="cx">         }
</span><del>-        if (item-&gt;hasTagName(bodyTag))
-            return setInsertionMode(InsertionMode::InBody);
</del><ins>+        if (item-&gt;hasTagName(bodyTag)) {
+            m_insertionMode = InsertionMode::InBody;
+            return;
+        }
</ins><span class="cx">         if (item-&gt;hasTagName(framesetTag)) {
</span><del>-            return setInsertionMode(InsertionMode::InFrameset);
</del><ins>+            m_insertionMode = InsertionMode::InFrameset;
+            return;
</ins><span class="cx">         }
</span><span class="cx">         if (item-&gt;hasTagName(htmlTag)) {
</span><del>-            if (m_tree.headStackItem())
-                return setInsertionMode(InsertionMode::AfterHead);
</del><ins>+            if (m_tree.headStackItem()) {
+                m_insertionMode = InsertionMode::AfterHead;
+                return;
+            }
</ins><span class="cx">             ASSERT(isParsingFragment());
</span><del>-            return setInsertionMode(InsertionMode::BeforeHead);
</del><ins>+            m_insertionMode = InsertionMode::BeforeHead;
+            return;
</ins><span class="cx">         }
</span><span class="cx">         if (last) {
</span><span class="cx">             ASSERT(isParsingFragment());
</span><del>-            return setInsertionMode(InsertionMode::InBody);
</del><ins>+            m_insertionMode = InsertionMode::InBody;
+            return;
</ins><span class="cx">         }
</span><del>-        nodeRecord = nodeRecord-&gt;next();
</del><span class="cx">     }
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-void HTMLTreeBuilder::processEndTagForInTableBody(AtomicHTMLToken* token)
</del><ins>+void HTMLTreeBuilder::processEndTagForInTableBody(AtomicHTMLToken&amp; token)
</ins><span class="cx"> {
</span><del>-    ASSERT(token-&gt;type() == HTMLToken::EndTag);
-    if (isTableBodyContextTag(token-&gt;name())) {
-        if (!m_tree.openElements()-&gt;inTableScope(token-&gt;name())) {
</del><ins>+    ASSERT(token.type() == HTMLToken::EndTag);
+    if (isTableBodyContextTag(token.name())) {
+        if (!m_tree.openElements()-&gt;inTableScope(token.name())) {
</ins><span class="cx">             parseError(token);
</span><span class="cx">             return;
</span><span class="cx">         }
</span><span class="cx">         m_tree.openElements()-&gt;popUntilTableBodyScopeMarker();
</span><span class="cx">         m_tree.openElements()-&gt;pop();
</span><del>-        setInsertionMode(InsertionMode::InTable);
</del><ins>+        m_insertionMode = InsertionMode::InTable;
</ins><span class="cx">         return;
</span><span class="cx">     }
</span><del>-    if (token-&gt;name() == tableTag) {
</del><ins>+    if (token.name() == tableTag) {
</ins><span class="cx">         // FIXME: This is slow.
</span><span class="cx">         if (!m_tree.openElements()-&gt;inTableScope(tbodyTag) &amp;&amp; !m_tree.openElements()-&gt;inTableScope(theadTag) &amp;&amp; !m_tree.openElements()-&gt;inTableScope(tfootTag)) {
</span><span class="cx">             ASSERT(isParsingFragmentOrTemplateContents());
</span><span class="lines">@@ -1700,83 +1688,83 @@
</span><span class="cx">         processEndTag(token);
</span><span class="cx">         return;
</span><span class="cx">     }
</span><del>-    if (token-&gt;name() == bodyTag
-        || isCaptionColOrColgroupTag(token-&gt;name())
-        || token-&gt;name() == htmlTag
-        || isTableCellContextTag(token-&gt;name())
-        || token-&gt;name() == trTag) {
</del><ins>+    if (token.name() == bodyTag
+        || isCaptionColOrColgroupTag(token.name())
+        || token.name() == htmlTag
+        || isTableCellContextTag(token.name())
+        || token.name() == trTag) {
</ins><span class="cx">         parseError(token);
</span><span class="cx">         return;
</span><span class="cx">     }
</span><span class="cx">     processEndTagForInTable(token);
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-void HTMLTreeBuilder::processEndTagForInRow(AtomicHTMLToken* token)
</del><ins>+void HTMLTreeBuilder::processEndTagForInRow(AtomicHTMLToken&amp; token)
</ins><span class="cx"> {
</span><del>-    ASSERT(token-&gt;type() == HTMLToken::EndTag);
-    if (token-&gt;name() == trTag) {
</del><ins>+    ASSERT(token.type() == HTMLToken::EndTag);
+    if (token.name() == trTag) {
</ins><span class="cx">         processTrEndTagForInRow();
</span><span class="cx">         return;
</span><span class="cx">     }
</span><del>-    if (token-&gt;name() == tableTag) {
</del><ins>+    if (token.name() == tableTag) {
</ins><span class="cx">         if (!processTrEndTagForInRow()) {
</span><span class="cx">             ASSERT(isParsingFragmentOrTemplateContents());
</span><span class="cx">             return;
</span><span class="cx">         }
</span><del>-        ASSERT(insertionMode() == InsertionMode::InTableBody);
</del><ins>+        ASSERT(m_insertionMode == InsertionMode::InTableBody);
</ins><span class="cx">         processEndTag(token);
</span><span class="cx">         return;
</span><span class="cx">     }
</span><del>-    if (isTableBodyContextTag(token-&gt;name())) {
-        if (!m_tree.openElements()-&gt;inTableScope(token-&gt;name())) {
</del><ins>+    if (isTableBodyContextTag(token.name())) {
+        if (!m_tree.openElements()-&gt;inTableScope(token.name())) {
</ins><span class="cx">             parseError(token);
</span><span class="cx">             return;
</span><span class="cx">         }
</span><span class="cx">         processFakeEndTag(trTag);
</span><del>-        ASSERT(insertionMode() == InsertionMode::InTableBody);
</del><ins>+        ASSERT(m_insertionMode == InsertionMode::InTableBody);
</ins><span class="cx">         processEndTag(token);
</span><span class="cx">         return;
</span><span class="cx">     }
</span><del>-    if (token-&gt;name() == bodyTag
-        || isCaptionColOrColgroupTag(token-&gt;name())
-        || token-&gt;name() == htmlTag
-        || isTableCellContextTag(token-&gt;name())) {
</del><ins>+    if (token.name() == bodyTag
+        || isCaptionColOrColgroupTag(token.name())
+        || token.name() == htmlTag
+        || isTableCellContextTag(token.name())) {
</ins><span class="cx">         parseError(token);
</span><span class="cx">         return;
</span><span class="cx">     }
</span><span class="cx">     processEndTagForInTable(token);
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-void HTMLTreeBuilder::processEndTagForInCell(AtomicHTMLToken* token)
</del><ins>+void HTMLTreeBuilder::processEndTagForInCell(AtomicHTMLToken&amp; token)
</ins><span class="cx"> {
</span><del>-    ASSERT(token-&gt;type() == HTMLToken::EndTag);
-    if (isTableCellContextTag(token-&gt;name())) {
-        if (!m_tree.openElements()-&gt;inTableScope(token-&gt;name())) {
</del><ins>+    ASSERT(token.type() == HTMLToken::EndTag);
+    if (isTableCellContextTag(token.name())) {
+        if (!m_tree.openElements()-&gt;inTableScope(token.name())) {
</ins><span class="cx">             parseError(token);
</span><span class="cx">             return;
</span><span class="cx">         }
</span><span class="cx">         m_tree.generateImpliedEndTags();
</span><del>-        if (!m_tree.currentStackItem()-&gt;matchesHTMLTag(token-&gt;name()))
</del><ins>+        if (!m_tree.currentStackItem()-&gt;matchesHTMLTag(token.name()))
</ins><span class="cx">             parseError(token);
</span><del>-        m_tree.openElements()-&gt;popUntilPopped(token-&gt;name());
</del><ins>+        m_tree.openElements()-&gt;popUntilPopped(token.name());
</ins><span class="cx">         m_tree.activeFormattingElements()-&gt;clearToLastMarker();
</span><del>-        setInsertionMode(InsertionMode::InRow);
</del><ins>+        m_insertionMode = InsertionMode::InRow;
</ins><span class="cx">         return;
</span><span class="cx">     }
</span><del>-    if (token-&gt;name() == bodyTag
-        || isCaptionColOrColgroupTag(token-&gt;name())
-        || token-&gt;name() == htmlTag) {
</del><ins>+    if (token.name() == bodyTag
+        || isCaptionColOrColgroupTag(token.name())
+        || token.name() == htmlTag) {
</ins><span class="cx">         parseError(token);
</span><span class="cx">         return;
</span><span class="cx">     }
</span><del>-    if (token-&gt;name() == tableTag
-        || token-&gt;name() == trTag
-        || isTableBodyContextTag(token-&gt;name())) {
-        if (!m_tree.openElements()-&gt;inTableScope(token-&gt;name())) {
</del><ins>+    if (token.name() == tableTag
+        || token.name() == trTag
+        || isTableBodyContextTag(token.name())) {
+        if (!m_tree.openElements()-&gt;inTableScope(token.name())) {
</ins><span class="cx"> #if ENABLE(TEMPLATE_ELEMENT)
</span><del>-            ASSERT(isTableBodyContextTag(token-&gt;name()) || m_tree.openElements()-&gt;inTableScope(templateTag) || isParsingFragment());
</del><ins>+            ASSERT(isTableBodyContextTag(token.name()) || m_tree.openElements()-&gt;inTableScope(templateTag) || isParsingFragment());
</ins><span class="cx"> #else
</span><del>-            ASSERT(isTableBodyContextTag(token-&gt;name()) || isParsingFragment());
</del><ins>+            ASSERT(isTableBodyContextTag(token.name()) || isParsingFragment());
</ins><span class="cx"> #endif
</span><span class="cx">             parseError(token);
</span><span class="cx">             return;
</span><span class="lines">@@ -1788,55 +1776,55 @@
</span><span class="cx">     processEndTagForInBody(token);
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-void HTMLTreeBuilder::processEndTagForInBody(AtomicHTMLToken* token)
</del><ins>+void HTMLTreeBuilder::processEndTagForInBody(AtomicHTMLToken&amp; token)
</ins><span class="cx"> {
</span><del>-    ASSERT(token-&gt;type() == HTMLToken::EndTag);
-    if (token-&gt;name() == bodyTag) {
</del><ins>+    ASSERT(token.type() == HTMLToken::EndTag);
+    if (token.name() == bodyTag) {
</ins><span class="cx">         processBodyEndTagForInBody(token);
</span><span class="cx">         return;
</span><span class="cx">     }
</span><del>-    if (token-&gt;name() == htmlTag) {
</del><ins>+    if (token.name() == htmlTag) {
</ins><span class="cx">         AtomicHTMLToken endBody(HTMLToken::EndTag, bodyTag.localName());
</span><del>-        if (processBodyEndTagForInBody(&amp;endBody))
</del><ins>+        if (processBodyEndTagForInBody(endBody))
</ins><span class="cx">             processEndTag(token);
</span><span class="cx">         return;
</span><span class="cx">     }
</span><del>-    if (token-&gt;name() == addressTag
-        || token-&gt;name() == articleTag
-        || token-&gt;name() == asideTag
-        || token-&gt;name() == blockquoteTag
-        || token-&gt;name() == buttonTag
-        || token-&gt;name() == centerTag
-        || token-&gt;name() == detailsTag
-        || token-&gt;name() == dirTag
-        || token-&gt;name() == divTag
-        || token-&gt;name() == dlTag
-        || token-&gt;name() == fieldsetTag
-        || token-&gt;name() == figcaptionTag
-        || token-&gt;name() == figureTag
-        || token-&gt;name() == footerTag
-        || token-&gt;name() == headerTag
-        || token-&gt;name() == hgroupTag
-        || token-&gt;name() == listingTag
-        || token-&gt;name() == mainTag
-        || token-&gt;name() == menuTag
-        || token-&gt;name() == navTag
-        || token-&gt;name() == olTag
-        || token-&gt;name() == preTag
-        || token-&gt;name() == sectionTag
-        || token-&gt;name() == summaryTag
-        || token-&gt;name() == ulTag) {
-        if (!m_tree.openElements()-&gt;inScope(token-&gt;name())) {
</del><ins>+    if (token.name() == addressTag
+        || token.name() == articleTag
+        || token.name() == asideTag
+        || token.name() == blockquoteTag
+        || token.name() == buttonTag
+        || token.name() == centerTag
+        || token.name() == detailsTag
+        || token.name() == dirTag
+        || token.name() == divTag
+        || token.name() == dlTag
+        || token.name() == fieldsetTag
+        || token.name() == figcaptionTag
+        || token.name() == figureTag
+        || token.name() == footerTag
+        || token.name() == headerTag
+        || token.name() == hgroupTag
+        || token.name() == listingTag
+        || token.name() == mainTag
+        || token.name() == menuTag
+        || token.name() == navTag
+        || token.name() == olTag
+        || token.name() == preTag
+        || token.name() == sectionTag
+        || token.name() == summaryTag
+        || token.name() == ulTag) {
+        if (!m_tree.openElements()-&gt;inScope(token.name())) {
</ins><span class="cx">             parseError(token);
</span><span class="cx">             return;
</span><span class="cx">         }
</span><span class="cx">         m_tree.generateImpliedEndTags();
</span><del>-        if (!m_tree.currentStackItem()-&gt;matchesHTMLTag(token-&gt;name()))
</del><ins>+        if (!m_tree.currentStackItem()-&gt;matchesHTMLTag(token.name()))
</ins><span class="cx">             parseError(token);
</span><del>-        m_tree.openElements()-&gt;popUntilPopped(token-&gt;name());
</del><ins>+        m_tree.openElements()-&gt;popUntilPopped(token.name());
</ins><span class="cx">         return;
</span><span class="cx">     }
</span><del>-    if (token-&gt;name() == formTag) {
</del><ins>+    if (token.name() == formTag) {
</ins><span class="cx">         if (!isParsingTemplateContents()) {
</span><span class="cx">             RefPtr&lt;Element&gt; node = m_tree.takeForm();
</span><span class="cx">             if (!node || !m_tree.openElements()-&gt;inScope(node.get())) {
</span><span class="lines">@@ -1848,89 +1836,86 @@
</span><span class="cx">                 parseError(token);
</span><span class="cx">             m_tree.openElements()-&gt;remove(node.get());
</span><span class="cx">         } else {
</span><del>-            if (!m_tree.openElements()-&gt;inScope(token-&gt;name())) {
</del><ins>+            if (!m_tree.openElements()-&gt;inScope(token.name())) {
</ins><span class="cx">                 parseError(token);
</span><span class="cx">                 return;
</span><span class="cx">             }
</span><span class="cx">             m_tree.generateImpliedEndTags();
</span><span class="cx">             if (!m_tree.currentNode()-&gt;hasTagName(formTag))
</span><span class="cx">                 parseError(token);
</span><del>-            m_tree.openElements()-&gt;popUntilPopped(token-&gt;name());
</del><ins>+            m_tree.openElements()-&gt;popUntilPopped(token.name());
</ins><span class="cx">         }
</span><span class="cx">     }
</span><del>-    if (token-&gt;name() == pTag) {
-        if (!m_tree.openElements()-&gt;inButtonScope(token-&gt;name())) {
</del><ins>+    if (token.name() == pTag) {
+        if (!m_tree.openElements()-&gt;inButtonScope(token.name())) {
</ins><span class="cx">             parseError(token);
</span><span class="cx">             processFakeStartTag(pTag);
</span><del>-            ASSERT(m_tree.openElements()-&gt;inScope(token-&gt;name()));
</del><ins>+            ASSERT(m_tree.openElements()-&gt;inScope(token.name()));
</ins><span class="cx">             processEndTag(token);
</span><span class="cx">             return;
</span><span class="cx">         }
</span><del>-        m_tree.generateImpliedEndTagsWithExclusion(token-&gt;name());
-        if (!m_tree.currentStackItem()-&gt;matchesHTMLTag(token-&gt;name()))
</del><ins>+        m_tree.generateImpliedEndTagsWithExclusion(token.name());
+        if (!m_tree.currentStackItem()-&gt;matchesHTMLTag(token.name()))
</ins><span class="cx">             parseError(token);
</span><del>-        m_tree.openElements()-&gt;popUntilPopped(token-&gt;name());
</del><ins>+        m_tree.openElements()-&gt;popUntilPopped(token.name());
</ins><span class="cx">         return;
</span><span class="cx">     }
</span><del>-    if (token-&gt;name() == liTag) {
-        if (!m_tree.openElements()-&gt;inListItemScope(token-&gt;name())) {
</del><ins>+    if (token.name() == liTag) {
+        if (!m_tree.openElements()-&gt;inListItemScope(token.name())) {
</ins><span class="cx">             parseError(token);
</span><span class="cx">             return;
</span><span class="cx">         }
</span><del>-        m_tree.generateImpliedEndTagsWithExclusion(token-&gt;name());
-        if (!m_tree.currentStackItem()-&gt;matchesHTMLTag(token-&gt;name()))
</del><ins>+        m_tree.generateImpliedEndTagsWithExclusion(token.name());
+        if (!m_tree.currentStackItem()-&gt;matchesHTMLTag(token.name()))
</ins><span class="cx">             parseError(token);
</span><del>-        m_tree.openElements()-&gt;popUntilPopped(token-&gt;name());
</del><ins>+        m_tree.openElements()-&gt;popUntilPopped(token.name());
</ins><span class="cx">         return;
</span><span class="cx">     }
</span><del>-    if (token-&gt;name() == ddTag
-        || token-&gt;name() == dtTag) {
-        if (!m_tree.openElements()-&gt;inScope(token-&gt;name())) {
</del><ins>+    if (token.name() == ddTag || token.name() == dtTag) {
+        if (!m_tree.openElements()-&gt;inScope(token.name())) {
</ins><span class="cx">             parseError(token);
</span><span class="cx">             return;
</span><span class="cx">         }
</span><del>-        m_tree.generateImpliedEndTagsWithExclusion(token-&gt;name());
-        if (!m_tree.currentStackItem()-&gt;matchesHTMLTag(token-&gt;name()))
</del><ins>+        m_tree.generateImpliedEndTagsWithExclusion(token.name());
+        if (!m_tree.currentStackItem()-&gt;matchesHTMLTag(token.name()))
</ins><span class="cx">             parseError(token);
</span><del>-        m_tree.openElements()-&gt;popUntilPopped(token-&gt;name());
</del><ins>+        m_tree.openElements()-&gt;popUntilPopped(token.name());
</ins><span class="cx">         return;
</span><span class="cx">     }
</span><del>-    if (isNumberedHeaderTag(token-&gt;name())) {
</del><ins>+    if (isNumberedHeaderTag(token.name())) {
</ins><span class="cx">         if (!m_tree.openElements()-&gt;hasNumberedHeaderElementInScope()) {
</span><span class="cx">             parseError(token);
</span><span class="cx">             return;
</span><span class="cx">         }
</span><span class="cx">         m_tree.generateImpliedEndTags();
</span><del>-        if (!m_tree.currentStackItem()-&gt;matchesHTMLTag(token-&gt;name()))
</del><ins>+        if (!m_tree.currentStackItem()-&gt;matchesHTMLTag(token.name()))
</ins><span class="cx">             parseError(token);
</span><span class="cx">         m_tree.openElements()-&gt;popUntilNumberedHeaderElementPopped();
</span><span class="cx">         return;
</span><span class="cx">     }
</span><del>-    if (isFormattingTag(token-&gt;name())) {
</del><ins>+    if (isFormattingTag(token.name())) {
</ins><span class="cx">         callTheAdoptionAgency(token);
</span><span class="cx">         return;
</span><span class="cx">     }
</span><del>-    if (token-&gt;name() == appletTag
-        || token-&gt;name() == marqueeTag
-        || token-&gt;name() == objectTag) {
-        if (!m_tree.openElements()-&gt;inScope(token-&gt;name())) {
</del><ins>+    if (token.name() == appletTag || token.name() == marqueeTag || token.name() == objectTag) {
+        if (!m_tree.openElements()-&gt;inScope(token.name())) {
</ins><span class="cx">             parseError(token);
</span><span class="cx">             return;
</span><span class="cx">         }
</span><span class="cx">         m_tree.generateImpliedEndTags();
</span><del>-        if (!m_tree.currentStackItem()-&gt;matchesHTMLTag(token-&gt;name()))
</del><ins>+        if (!m_tree.currentStackItem()-&gt;matchesHTMLTag(token.name()))
</ins><span class="cx">             parseError(token);
</span><del>-        m_tree.openElements()-&gt;popUntilPopped(token-&gt;name());
</del><ins>+        m_tree.openElements()-&gt;popUntilPopped(token.name());
</ins><span class="cx">         m_tree.activeFormattingElements()-&gt;clearToLastMarker();
</span><span class="cx">         return;
</span><span class="cx">     }
</span><del>-    if (token-&gt;name() == brTag) {
</del><ins>+    if (token.name() == brTag) {
</ins><span class="cx">         parseError(token);
</span><span class="cx">         processFakeStartTag(brTag);
</span><span class="cx">         return;
</span><span class="cx">     }
</span><span class="cx"> #if ENABLE(TEMPLATE_ELEMENT)
</span><del>-    if (token-&gt;name() == templateTag) {
</del><ins>+    if (token.name() == templateTag) {
</ins><span class="cx">         processTemplateEndTag(token);
</span><span class="cx">         return;
</span><span class="cx">     }
</span><span class="lines">@@ -1949,7 +1934,7 @@
</span><span class="cx">     // FIXME: parse error if (!m_tree.currentStackItem()-&gt;hasTagName(captionTag))
</span><span class="cx">     m_tree.openElements()-&gt;popUntilPopped(captionTag.localName());
</span><span class="cx">     m_tree.activeFormattingElements()-&gt;clearToLastMarker();
</span><del>-    setInsertionMode(InsertionMode::InTable);
</del><ins>+    m_insertionMode = InsertionMode::InTable;
</ins><span class="cx">     return true;
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="lines">@@ -1963,7 +1948,7 @@
</span><span class="cx">     m_tree.openElements()-&gt;popUntilTableRowScopeMarker();
</span><span class="cx">     ASSERT(m_tree.currentStackItem()-&gt;hasTagName(trTag));
</span><span class="cx">     m_tree.openElements()-&gt;pop();
</span><del>-    setInsertionMode(InsertionMode::InTableBody);
</del><ins>+    m_insertionMode = InsertionMode::InTableBody;
</ins><span class="cx">     return true;
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="lines">@@ -1979,19 +1964,19 @@
</span><span class="cx">     return true;
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-void HTMLTreeBuilder::processEndTagForInTable(AtomicHTMLToken* token)
</del><ins>+void HTMLTreeBuilder::processEndTagForInTable(AtomicHTMLToken&amp; token)
</ins><span class="cx"> {
</span><del>-    ASSERT(token-&gt;type() == HTMLToken::EndTag);
-    if (token-&gt;name() == tableTag) {
</del><ins>+    ASSERT(token.type() == HTMLToken::EndTag);
+    if (token.name() == tableTag) {
</ins><span class="cx">         processTableEndTagForInTable();
</span><span class="cx">         return;
</span><span class="cx">     }
</span><del>-    if (token-&gt;name() == bodyTag
-        || isCaptionColOrColgroupTag(token-&gt;name())
-        || token-&gt;name() == htmlTag
-        || isTableBodyContextTag(token-&gt;name())
-        || isTableCellContextTag(token-&gt;name())
-        || token-&gt;name() == trTag) {
</del><ins>+    if (token.name() == bodyTag
+        || isCaptionColOrColgroupTag(token.name())
+        || token.name() == htmlTag
+        || isTableBodyContextTag(token.name())
+        || isTableCellContextTag(token.name())
+        || token.name() == trTag) {
</ins><span class="cx">         parseError(token);
</span><span class="cx">         return;
</span><span class="cx">     }
</span><span class="lines">@@ -2001,75 +1986,73 @@
</span><span class="cx">     processEndTagForInBody(token);
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-void HTMLTreeBuilder::processEndTag(AtomicHTMLToken* token)
</del><ins>+void HTMLTreeBuilder::processEndTag(AtomicHTMLToken&amp; token)
</ins><span class="cx"> {
</span><del>-    ASSERT(token-&gt;type() == HTMLToken::EndTag);
-    switch (insertionMode()) {
</del><ins>+    ASSERT(token.type() == HTMLToken::EndTag);
+    switch (m_insertionMode) {
</ins><span class="cx">     case InsertionMode::Initial:
</span><del>-        ASSERT(insertionMode() == InsertionMode::Initial);
</del><ins>+        ASSERT(m_insertionMode == InsertionMode::Initial);
</ins><span class="cx">         defaultForInitial();
</span><span class="cx">         FALLTHROUGH;
</span><span class="cx">     case InsertionMode::BeforeHTML:
</span><del>-        ASSERT(insertionMode() == InsertionMode::BeforeHTML);
-        if (token-&gt;name() != headTag &amp;&amp; token-&gt;name() != bodyTag &amp;&amp; token-&gt;name() != htmlTag &amp;&amp; token-&gt;name() != brTag) {
</del><ins>+        ASSERT(m_insertionMode == InsertionMode::BeforeHTML);
+        if (token.name() != headTag &amp;&amp; token.name() != bodyTag &amp;&amp; token.name() != htmlTag &amp;&amp; token.name() != brTag) {
</ins><span class="cx">             parseError(token);
</span><span class="cx">             return;
</span><span class="cx">         }
</span><span class="cx">         defaultForBeforeHTML();
</span><ins>+        ASSERT(m_insertionMode == InsertionMode::BeforeHead);
</ins><span class="cx">         FALLTHROUGH;
</span><span class="cx">     case InsertionMode::BeforeHead:
</span><del>-        ASSERT(insertionMode() == InsertionMode::BeforeHead);
-        if (token-&gt;name() != headTag &amp;&amp; token-&gt;name() != bodyTag &amp;&amp; token-&gt;name() != htmlTag &amp;&amp; token-&gt;name() != brTag) {
</del><ins>+        if (token.name() != headTag &amp;&amp; token.name() != bodyTag &amp;&amp; token.name() != htmlTag &amp;&amp; token.name() != brTag) {
</ins><span class="cx">             parseError(token);
</span><span class="cx">             return;
</span><span class="cx">         }
</span><span class="cx">         defaultForBeforeHead();
</span><ins>+        ASSERT(m_insertionMode == InsertionMode::InHead);
</ins><span class="cx">         FALLTHROUGH;
</span><span class="cx">     case InsertionMode::InHead:
</span><del>-        ASSERT(insertionMode() == InsertionMode::InHead);
</del><span class="cx">         // FIXME: This case should be broken out into processEndTagForInHead,
</span><span class="cx">         // because other end tag cases now refer to it (&quot;process the token for using the rules of the &quot;in head&quot; insertion mode&quot;).
</span><span class="cx">         // but because the logic falls through to InsertionMode::AfterHead, that gets a little messy.
</span><span class="cx"> #if ENABLE(TEMPLATE_ELEMENT)
</span><del>-        if (token-&gt;name() == templateTag) {
</del><ins>+        if (token.name() == templateTag) {
</ins><span class="cx">             processTemplateEndTag(token);
</span><span class="cx">             return;
</span><span class="cx">         }
</span><span class="cx"> #endif
</span><del>-        if (token-&gt;name() == headTag) {
</del><ins>+        if (token.name() == headTag) {
</ins><span class="cx">             m_tree.openElements()-&gt;popHTMLHeadElement();
</span><del>-            setInsertionMode(InsertionMode::AfterHead);
</del><ins>+            m_insertionMode = InsertionMode::AfterHead;
</ins><span class="cx">             return;
</span><span class="cx">         }
</span><del>-        if (token-&gt;name() != bodyTag &amp;&amp; token-&gt;name() != htmlTag &amp;&amp; token-&gt;name() != brTag) {
</del><ins>+        if (token.name() != bodyTag &amp;&amp; token.name() != htmlTag &amp;&amp; token.name() != brTag) {
</ins><span class="cx">             parseError(token);
</span><span class="cx">             return;
</span><span class="cx">         }
</span><span class="cx">         defaultForInHead();
</span><ins>+        ASSERT(m_insertionMode == InsertionMode::AfterHead);
</ins><span class="cx">         FALLTHROUGH;
</span><span class="cx">     case InsertionMode::AfterHead:
</span><del>-        ASSERT(insertionMode() == InsertionMode::AfterHead);
-        if (token-&gt;name() != bodyTag &amp;&amp; token-&gt;name() != htmlTag &amp;&amp; token-&gt;name() != brTag) {
</del><ins>+        if (token.name() != bodyTag &amp;&amp; token.name() != htmlTag &amp;&amp; token.name() != brTag) {
</ins><span class="cx">             parseError(token);
</span><span class="cx">             return;
</span><span class="cx">         }
</span><span class="cx">         defaultForAfterHead();
</span><ins>+        ASSERT(m_insertionMode == InsertionMode::InBody);
</ins><span class="cx">         FALLTHROUGH;
</span><span class="cx">     case InsertionMode::InBody:
</span><del>-        ASSERT(insertionMode() == InsertionMode::InBody);
</del><span class="cx">         processEndTagForInBody(token);
</span><span class="cx">         break;
</span><span class="cx">     case InsertionMode::InTable:
</span><del>-        ASSERT(insertionMode() == InsertionMode::InTable);
</del><span class="cx">         processEndTagForInTable(token);
</span><span class="cx">         break;
</span><span class="cx">     case InsertionMode::InCaption:
</span><del>-        ASSERT(insertionMode() == InsertionMode::InCaption);
-        if (token-&gt;name() == captionTag) {
</del><ins>+        if (token.name() == captionTag) {
</ins><span class="cx">             processCaptionEndTagForInCaption();
</span><span class="cx">             return;
</span><span class="cx">         }
</span><del>-        if (token-&gt;name() == tableTag) {
</del><ins>+        if (token.name() == tableTag) {
</ins><span class="cx">             parseError(token);
</span><span class="cx">             if (!processCaptionEndTagForInCaption()) {
</span><span class="cx">                 ASSERT(isParsingFragment());
</span><span class="lines">@@ -2078,30 +2061,29 @@
</span><span class="cx">             processEndTag(token);
</span><span class="cx">             return;
</span><span class="cx">         }
</span><del>-        if (token-&gt;name() == bodyTag
-            || token-&gt;name() == colTag
-            || token-&gt;name() == colgroupTag
-            || token-&gt;name() == htmlTag
-            || isTableBodyContextTag(token-&gt;name())
-            || isTableCellContextTag(token-&gt;name())
-            || token-&gt;name() == trTag) {
</del><ins>+        if (token.name() == bodyTag
+            || token.name() == colTag
+            || token.name() == colgroupTag
+            || token.name() == htmlTag
+            || isTableBodyContextTag(token.name())
+            || isTableCellContextTag(token.name())
+            || token.name() == trTag) {
</ins><span class="cx">             parseError(token);
</span><span class="cx">             return;
</span><span class="cx">         }
</span><span class="cx">         processEndTagForInBody(token);
</span><span class="cx">         break;
</span><span class="cx">     case InsertionMode::InColumnGroup:
</span><del>-        ASSERT(insertionMode() == InsertionMode::InColumnGroup);
-        if (token-&gt;name() == colgroupTag) {
</del><ins>+        if (token.name() == colgroupTag) {
</ins><span class="cx">             processColgroupEndTagForInColumnGroup();
</span><span class="cx">             return;
</span><span class="cx">         }
</span><del>-        if (token-&gt;name() == colTag) {
</del><ins>+        if (token.name() == colTag) {
</ins><span class="cx">             parseError(token);
</span><span class="cx">             return;
</span><span class="cx">         }
</span><span class="cx"> #if ENABLE(TEMPLATE_ELEMENT)
</span><del>-        if (token-&gt;name() == templateTag) {
</del><ins>+        if (token.name() == templateTag) {
</ins><span class="cx">             processTemplateEndTag(token);
</span><span class="cx">             return;
</span><span class="cx">         }
</span><span class="lines">@@ -2113,44 +2095,39 @@
</span><span class="cx">         processEndTag(token);
</span><span class="cx">         break;
</span><span class="cx">     case InsertionMode::InRow:
</span><del>-        ASSERT(insertionMode() == InsertionMode::InRow);
</del><span class="cx">         processEndTagForInRow(token);
</span><span class="cx">         break;
</span><span class="cx">     case InsertionMode::InCell:
</span><del>-        ASSERT(insertionMode() == InsertionMode::InCell);
</del><span class="cx">         processEndTagForInCell(token);
</span><span class="cx">         break;
</span><span class="cx">     case InsertionMode::InTableBody:
</span><del>-        ASSERT(insertionMode() == InsertionMode::InTableBody);
</del><span class="cx">         processEndTagForInTableBody(token);
</span><span class="cx">         break;
</span><span class="cx">     case InsertionMode::AfterBody:
</span><del>-        ASSERT(insertionMode() == InsertionMode::AfterBody);
-        if (token-&gt;name() == htmlTag) {
</del><ins>+        if (token.name() == htmlTag) {
</ins><span class="cx">             if (isParsingFragment()) {
</span><span class="cx">                 parseError(token);
</span><span class="cx">                 return;
</span><span class="cx">             }
</span><del>-            setInsertionMode(InsertionMode::AfterAfterBody);
</del><ins>+            m_insertionMode = InsertionMode::AfterAfterBody;
</ins><span class="cx">             return;
</span><span class="cx">         }
</span><span class="cx">         FALLTHROUGH;
</span><span class="cx">     case InsertionMode::AfterAfterBody:
</span><del>-        ASSERT(insertionMode() == InsertionMode::AfterBody || insertionMode() == InsertionMode::AfterAfterBody);
</del><ins>+        ASSERT(m_insertionMode == InsertionMode::AfterBody || m_insertionMode == InsertionMode::AfterAfterBody);
</ins><span class="cx">         parseError(token);
</span><del>-        setInsertionMode(InsertionMode::InBody);
</del><ins>+        m_insertionMode = InsertionMode::InBody;
</ins><span class="cx">         processEndTag(token);
</span><span class="cx">         break;
</span><span class="cx">     case InsertionMode::InHeadNoscript:
</span><del>-        ASSERT(insertionMode() == InsertionMode::InHeadNoscript);
-        if (token-&gt;name() == noscriptTag) {
</del><ins>+        if (token.name() == noscriptTag) {
</ins><span class="cx">             ASSERT(m_tree.currentStackItem()-&gt;hasTagName(noscriptTag));
</span><span class="cx">             m_tree.openElements()-&gt;pop();
</span><span class="cx">             ASSERT(m_tree.currentStackItem()-&gt;hasTagName(headTag));
</span><del>-            setInsertionMode(InsertionMode::InHead);
</del><ins>+            m_insertionMode = InsertionMode::InHead;
</ins><span class="cx">             return;
</span><span class="cx">         }
</span><del>-        if (token-&gt;name() != brTag) {
</del><ins>+        if (token.name() != brTag) {
</ins><span class="cx">             parseError(token);
</span><span class="cx">             return;
</span><span class="cx">         }
</span><span class="lines">@@ -2158,13 +2135,13 @@
</span><span class="cx">         processToken(token);
</span><span class="cx">         break;
</span><span class="cx">     case InsertionMode::Text:
</span><del>-        if (token-&gt;name() == scriptTag) {
</del><ins>+        if (token.name() == scriptTag) {
</ins><span class="cx">             // Pause ourselves so that parsing stops until the script can be processed by the caller.
</span><span class="cx">             ASSERT(m_tree.currentStackItem()-&gt;hasTagName(scriptTag));
</span><span class="cx">             if (scriptingContentIsAllowed(m_tree.parserContentPolicy()))
</span><span class="cx">                 m_scriptToProcess = m_tree.currentElement();
</span><span class="cx">             m_tree.openElements()-&gt;pop();
</span><del>-            setInsertionMode(m_originalInsertionMode);
</del><ins>+            m_insertionMode = m_originalInsertionMode;
</ins><span class="cx"> 
</span><span class="cx">             if (m_parser.tokenizer()) {
</span><span class="cx">                 // This token will not have been created by the tokenizer if a
</span><span class="lines">@@ -2177,11 +2154,10 @@
</span><span class="cx">             return;
</span><span class="cx">         }
</span><span class="cx">         m_tree.openElements()-&gt;pop();
</span><del>-        setInsertionMode(m_originalInsertionMode);
</del><ins>+        m_insertionMode = m_originalInsertionMode;
</ins><span class="cx">         break;
</span><span class="cx">     case InsertionMode::InFrameset:
</span><del>-        ASSERT(insertionMode() == InsertionMode::InFrameset);
-        if (token-&gt;name() == framesetTag) {
</del><ins>+        if (token.name() == framesetTag) {
</ins><span class="cx">             bool ignoreFramesetForFragmentParsing  = m_tree.currentIsRootNode();
</span><span class="cx"> #if ENABLE(TEMPLATE_ELEMENT)
</span><span class="cx">             ignoreFramesetForFragmentParsing = ignoreFramesetForFragmentParsing || m_tree.openElements()-&gt;hasTemplateInHTMLScope();
</span><span class="lines">@@ -2193,46 +2169,44 @@
</span><span class="cx">             }
</span><span class="cx">             m_tree.openElements()-&gt;pop();
</span><span class="cx">             if (!isParsingFragment() &amp;&amp; !m_tree.currentStackItem()-&gt;hasTagName(framesetTag))
</span><del>-                setInsertionMode(InsertionMode::AfterFrameset);
</del><ins>+                m_insertionMode = InsertionMode::AfterFrameset;
</ins><span class="cx">             return;
</span><span class="cx">         }
</span><span class="cx"> #if ENABLE(TEMPLATE_ELEMENT)
</span><del>-        if (token-&gt;name() == templateTag) {
</del><ins>+        if (token.name() == templateTag) {
</ins><span class="cx">             processTemplateEndTag(token);
</span><span class="cx">             return;
</span><span class="cx">         }
</span><span class="cx"> #endif
</span><span class="cx">         break;
</span><span class="cx">     case InsertionMode::AfterFrameset:
</span><del>-        ASSERT(insertionMode() == InsertionMode::AfterFrameset);
-        if (token-&gt;name() == htmlTag) {
-            setInsertionMode(InsertionMode::AfterAfterFrameset);
</del><ins>+        if (token.name() == htmlTag) {
+            m_insertionMode = InsertionMode::AfterAfterFrameset;
</ins><span class="cx">             return;
</span><span class="cx">         }
</span><span class="cx">         FALLTHROUGH;
</span><span class="cx">     case InsertionMode::AfterAfterFrameset:
</span><del>-        ASSERT(insertionMode() == InsertionMode::AfterFrameset || insertionMode() == InsertionMode::AfterAfterFrameset);
</del><ins>+        ASSERT(m_insertionMode == InsertionMode::AfterFrameset || m_insertionMode == InsertionMode::AfterAfterFrameset);
</ins><span class="cx">         parseError(token);
</span><span class="cx">         break;
</span><span class="cx">     case InsertionMode::InSelectInTable:
</span><del>-        ASSERT(insertionMode() == InsertionMode::InSelectInTable);
-        if (token-&gt;name() == captionTag
-            || token-&gt;name() == tableTag
-            || isTableBodyContextTag(token-&gt;name())
-            || token-&gt;name() == trTag
-            || isTableCellContextTag(token-&gt;name())) {
</del><ins>+        if (token.name() == captionTag
+            || token.name() == tableTag
+            || isTableBodyContextTag(token.name())
+            || token.name() == trTag
+            || isTableCellContextTag(token.name())) {
</ins><span class="cx">             parseError(token);
</span><del>-            if (m_tree.openElements()-&gt;inTableScope(token-&gt;name())) {
</del><ins>+            if (m_tree.openElements()-&gt;inTableScope(token.name())) {
</ins><span class="cx">                 AtomicHTMLToken endSelect(HTMLToken::EndTag, selectTag.localName());
</span><del>-                processEndTag(&amp;endSelect);
</del><ins>+                processEndTag(endSelect);
</ins><span class="cx">                 processEndTag(token);
</span><span class="cx">             }
</span><span class="cx">             return;
</span><span class="cx">         }
</span><span class="cx">         FALLTHROUGH;
</span><span class="cx">     case InsertionMode::InSelect:
</span><del>-        ASSERT(insertionMode() == InsertionMode::InSelect || insertionMode() == InsertionMode::InSelectInTable);
-        if (token-&gt;name() == optgroupTag) {
</del><ins>+        ASSERT(m_insertionMode == InsertionMode::InSelect || m_insertionMode == InsertionMode::InSelectInTable);
+        if (token.name() == optgroupTag) {
</ins><span class="cx">             if (is&lt;HTMLOptionElement&gt;(*m_tree.currentStackItem()-&gt;node()) &amp;&amp; m_tree.oneBelowTop() &amp;&amp; is&lt;HTMLOptGroupElement&gt;(*m_tree.oneBelowTop()-&gt;node()))
</span><span class="cx">                 processFakeEndTag(optionTag);
</span><span class="cx">             if (is&lt;HTMLOptGroupElement&gt;(*m_tree.currentStackItem()-&gt;node())) {
</span><span class="lines">@@ -2242,7 +2216,7 @@
</span><span class="cx">             parseError(token);
</span><span class="cx">             return;
</span><span class="cx">         }
</span><del>-        if (token-&gt;name() == optionTag) {
</del><ins>+        if (token.name() == optionTag) {
</ins><span class="cx">             if (is&lt;HTMLOptionElement&gt;(*m_tree.currentStackItem()-&gt;node())) {
</span><span class="cx">                 m_tree.openElements()-&gt;pop();
</span><span class="cx">                 return;
</span><span class="lines">@@ -2250,8 +2224,8 @@
</span><span class="cx">             parseError(token);
</span><span class="cx">             return;
</span><span class="cx">         }
</span><del>-        if (token-&gt;name() == selectTag) {
-            if (!m_tree.openElements()-&gt;inSelectScope(token-&gt;name())) {
</del><ins>+        if (token.name() == selectTag) {
+            if (!m_tree.openElements()-&gt;inSelectScope(token.name())) {
</ins><span class="cx">                 ASSERT(isParsingFragment());
</span><span class="cx">                 parseError(token);
</span><span class="cx">                 return;
</span><span class="lines">@@ -2261,7 +2235,7 @@
</span><span class="cx">             return;
</span><span class="cx">         }
</span><span class="cx"> #if ENABLE(TEMPLATE_ELEMENT)
</span><del>-        if (token-&gt;name() == templateTag) {
</del><ins>+        if (token.name() == templateTag) {
</ins><span class="cx">             processTemplateEndTag(token);
</span><span class="cx">             return;
</span><span class="cx">         }
</span><span class="lines">@@ -2271,31 +2245,29 @@
</span><span class="cx">         defaultForInTableText();
</span><span class="cx">         processEndTag(token);
</span><span class="cx">         break;
</span><del>-    case InsertionMode::TemplateContents:
</del><span class="cx"> #if ENABLE(TEMPLATE_ELEMENT)
</span><del>-        if (token-&gt;name() == templateTag) {
</del><ins>+    case InsertionMode::TemplateContents:
+        if (token.name() == templateTag) {
</ins><span class="cx">             processTemplateEndTag(token);
</span><span class="cx">             return;
</span><span class="cx">         }
</span><del>-#else
-        ASSERT_NOT_REACHED();
-#endif
</del><span class="cx">         break;
</span><ins>+#endif
</ins><span class="cx">     }
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-void HTMLTreeBuilder::processComment(AtomicHTMLToken* token)
</del><ins>+void HTMLTreeBuilder::processComment(AtomicHTMLToken&amp; token)
</ins><span class="cx"> {
</span><del>-    ASSERT(token-&gt;type() == HTMLToken::Comment);
</del><ins>+    ASSERT(token.type() == HTMLToken::Comment);
</ins><span class="cx">     if (m_insertionMode == InsertionMode::Initial
</span><span class="cx">         || m_insertionMode == InsertionMode::BeforeHTML
</span><span class="cx">         || m_insertionMode == InsertionMode::AfterAfterBody
</span><span class="cx">         || m_insertionMode == InsertionMode::AfterAfterFrameset) {
</span><del>-        m_tree.insertCommentOnDocument(token);
</del><ins>+        m_tree.insertCommentOnDocument(&amp;token);
</ins><span class="cx">         return;
</span><span class="cx">     }
</span><span class="cx">     if (m_insertionMode == InsertionMode::AfterBody) {
</span><del>-        m_tree.insertCommentOnHTMLHtmlElement(token);
</del><ins>+        m_tree.insertCommentOnHTMLHtmlElement(&amp;token);
</ins><span class="cx">         return;
</span><span class="cx">     }
</span><span class="cx">     if (m_insertionMode == InsertionMode::InTableText) {
</span><span class="lines">@@ -2303,18 +2275,19 @@
</span><span class="cx">         processComment(token);
</span><span class="cx">         return;
</span><span class="cx">     }
</span><del>-    m_tree.insertComment(token);
</del><ins>+    m_tree.insertComment(&amp;token);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><del>-void HTMLTreeBuilder::processCharacter(AtomicHTMLToken* token)
</del><ins>+void HTMLTreeBuilder::processCharacter(AtomicHTMLToken&amp; token)
</ins><span class="cx"> {
</span><del>-    ASSERT(token-&gt;type() == HTMLToken::Character);
</del><ins>+    ASSERT(token.type() == HTMLToken::Character);
</ins><span class="cx">     ExternalCharacterTokenBuffer buffer(token);
</span><span class="cx">     processCharacterBuffer(buffer);
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-// FIXME: Extract the following iOS-specific code into a separate file.
</del><span class="cx"> #if ENABLE(TELEPHONE_NUMBER_DETECTION) &amp;&amp; PLATFORM(IOS)
</span><ins>+
+// FIXME: Extract the following iOS-specific code into a separate file.
</ins><span class="cx"> // From the string 4089961010, creates a link of the form &lt;a href=&quot;tel:4089961010&quot;&gt;4089961010&lt;/a&gt; and inserts it.
</span><span class="cx"> void HTMLTreeBuilder::insertPhoneNumberLink(const String&amp; string)
</span><span class="cx"> {
</span><span class="lines">@@ -2325,10 +2298,10 @@
</span><span class="cx">     AtomicHTMLToken aStartToken(HTMLToken::StartTag, aTagLocalName, attributes);
</span><span class="cx">     AtomicHTMLToken aEndToken(HTMLToken::EndTag, aTagLocalName);
</span><span class="cx"> 
</span><del>-    processStartTag(&amp;aStartToken);
</del><ins>+    processStartTag(aStartToken);
</ins><span class="cx">     m_tree.executeQueuedTasks();
</span><span class="cx">     m_tree.insertTextNode(string);
</span><del>-    processEndTag(&amp;aEndToken);
</del><ins>+    processEndTag(aEndToken);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> // Locates the phone numbers in the string and deals with it
</span><span class="lines">@@ -2398,6 +2371,7 @@
</span><span class="cx">     } while (currentNode);
</span><span class="cx">     return true;
</span><span class="cx"> }
</span><ins>+
</ins><span class="cx"> #endif // ENABLE(TELEPHONE_NUMBER_DETECTION) &amp;&amp; PLATFORM(IOS)
</span><span class="cx"> 
</span><span class="cx"> void HTMLTreeBuilder::processCharacterBuffer(ExternalCharacterTokenBuffer&amp; buffer)
</span><span class="lines">@@ -2421,77 +2395,68 @@
</span><span class="cx">             return;
</span><span class="cx">     }
</span><span class="cx"> 
</span><del>-    switch (insertionMode()) {
-    case InsertionMode::Initial: {
-        ASSERT(insertionMode() == InsertionMode::Initial);
</del><ins>+    switch (m_insertionMode) {
+    case InsertionMode::Initial:
</ins><span class="cx">         buffer.skipLeadingWhitespace();
</span><span class="cx">         if (buffer.isEmpty())
</span><span class="cx">             return;
</span><span class="cx">         defaultForInitial();
</span><ins>+        ASSERT(m_insertionMode == InsertionMode::BeforeHTML);
</ins><span class="cx">         FALLTHROUGH;
</span><del>-    }
-    case InsertionMode::BeforeHTML: {
-        ASSERT(insertionMode() == InsertionMode::BeforeHTML);
</del><ins>+    case InsertionMode::BeforeHTML:
</ins><span class="cx">         buffer.skipLeadingWhitespace();
</span><span class="cx">         if (buffer.isEmpty())
</span><span class="cx">             return;
</span><span class="cx">         defaultForBeforeHTML();
</span><ins>+        ASSERT(m_insertionMode == InsertionMode::BeforeHead);
</ins><span class="cx">         FALLTHROUGH;
</span><del>-    }
-    case InsertionMode::BeforeHead: {
-        ASSERT(insertionMode() == InsertionMode::BeforeHead);
</del><ins>+    case InsertionMode::BeforeHead:
</ins><span class="cx">         buffer.skipLeadingWhitespace();
</span><span class="cx">         if (buffer.isEmpty())
</span><span class="cx">             return;
</span><span class="cx">         defaultForBeforeHead();
</span><ins>+        ASSERT(m_insertionMode == InsertionMode::InHead);
</ins><span class="cx">         FALLTHROUGH;
</span><del>-    }
</del><span class="cx">     case InsertionMode::InHead: {
</span><del>-        ASSERT(insertionMode() == InsertionMode::InHead);
</del><span class="cx">         String leadingWhitespace = buffer.takeLeadingWhitespace();
</span><span class="cx">         if (!leadingWhitespace.isEmpty())
</span><span class="cx">             m_tree.insertTextNode(leadingWhitespace, AllWhitespace);
</span><span class="cx">         if (buffer.isEmpty())
</span><span class="cx">             return;
</span><span class="cx">         defaultForInHead();
</span><ins>+        ASSERT(m_insertionMode == InsertionMode::AfterHead);
</ins><span class="cx">         FALLTHROUGH;
</span><span class="cx">     }
</span><span class="cx">     case InsertionMode::AfterHead: {
</span><del>-        ASSERT(insertionMode() == InsertionMode::AfterHead);
</del><span class="cx">         String leadingWhitespace = buffer.takeLeadingWhitespace();
</span><span class="cx">         if (!leadingWhitespace.isEmpty())
</span><span class="cx">             m_tree.insertTextNode(leadingWhitespace, AllWhitespace);
</span><span class="cx">         if (buffer.isEmpty())
</span><span class="cx">             return;
</span><span class="cx">         defaultForAfterHead();
</span><ins>+        ASSERT(m_insertionMode == InsertionMode::InBody);
</ins><span class="cx">         FALLTHROUGH;
</span><span class="cx">     }
</span><span class="cx">     case InsertionMode::InBody:
</span><span class="cx">     case InsertionMode::InCaption:
</span><del>-    case InsertionMode::TemplateContents:
-    case InsertionMode::InCell: {
</del><ins>+    case InsertionMode::InCell:
</ins><span class="cx"> #if ENABLE(TEMPLATE_ELEMENT)
</span><del>-        ASSERT(insertionMode() == InsertionMode::InBody || insertionMode() == InsertionMode::InCaption || insertionMode() == InsertionMode::InCell || insertionMode() == InsertionMode::TemplateContents);
-#else
-        ASSERT(insertionMode() != InsertionMode::TemplateContents);
-        ASSERT(insertionMode() == InsertionMode::InBody || insertionMode() == InsertionMode::InCaption || insertionMode() == InsertionMode::InCell);
</del><ins>+    case InsertionMode::TemplateContents:
</ins><span class="cx"> #endif
</span><span class="cx">         processCharacterBufferForInBody(buffer);
</span><span class="cx">         break;
</span><del>-    }
</del><span class="cx">     case InsertionMode::InTable:
</span><span class="cx">     case InsertionMode::InTableBody:
</span><del>-    case InsertionMode::InRow: {
-        ASSERT(insertionMode() == InsertionMode::InTable || insertionMode() == InsertionMode::InTableBody || insertionMode() == InsertionMode::InRow);
</del><ins>+    case InsertionMode::InRow:
</ins><span class="cx">         ASSERT(m_pendingTableCharacters.isEmpty());
</span><span class="cx">         if (m_tree.currentStackItem()-&gt;isElementNode()
</span><del>-            &amp;&amp; (is&lt;HTMLTableElement&gt;(*m_tree.currentStackItem()-&gt;node())
</del><ins>+            &amp;&amp; (is&lt;HTMLTableElement&gt;(*m_tree.currentStackItem()-&gt;element())
</ins><span class="cx">                 || m_tree.currentStackItem()-&gt;hasTagName(HTMLNames::tbodyTag)
</span><span class="cx">                 || m_tree.currentStackItem()-&gt;hasTagName(HTMLNames::tfootTag)
</span><span class="cx">                 || m_tree.currentStackItem()-&gt;hasTagName(HTMLNames::theadTag)
</span><span class="cx">                 || m_tree.currentStackItem()-&gt;hasTagName(HTMLNames::trTag))) {
</span><span class="cx">             m_originalInsertionMode = m_insertionMode;
</span><del>-            setInsertionMode(InsertionMode::InTableText);
</del><ins>+            m_insertionMode = InsertionMode::InTableText;
</ins><span class="cx">             // Note that we fall through to the InsertionMode::InTableText case below.
</span><span class="cx">         } else {
</span><span class="cx">             HTMLConstructionSite::RedirectToFosterParentGuard redirecter(m_tree);
</span><span class="lines">@@ -2499,13 +2464,10 @@
</span><span class="cx">             break;
</span><span class="cx">         }
</span><span class="cx">         FALLTHROUGH;
</span><del>-    }
-    case InsertionMode::InTableText: {
</del><ins>+    case InsertionMode::InTableText:
</ins><span class="cx">         buffer.giveRemainingTo(m_pendingTableCharacters);
</span><span class="cx">         break;
</span><del>-    }
</del><span class="cx">     case InsertionMode::InColumnGroup: {
</span><del>-        ASSERT(insertionMode() == InsertionMode::InColumnGroup);
</del><span class="cx">         String leadingWhitespace = buffer.takeLeadingWhitespace();
</span><span class="cx">         if (!leadingWhitespace.isEmpty())
</span><span class="cx">             m_tree.insertTextNode(leadingWhitespace, AllWhitespace);
</span><span class="lines">@@ -2521,19 +2483,14 @@
</span><span class="cx">         goto ReprocessBuffer;
</span><span class="cx">     }
</span><span class="cx">     case InsertionMode::AfterBody:
</span><del>-    case InsertionMode::AfterAfterBody: {
-        ASSERT(insertionMode() == InsertionMode::AfterBody || insertionMode() == InsertionMode::AfterAfterBody);
</del><ins>+    case InsertionMode::AfterAfterBody:
</ins><span class="cx">         // FIXME: parse error
</span><del>-        setInsertionMode(InsertionMode::InBody);
</del><ins>+        m_insertionMode = InsertionMode::InBody;
</ins><span class="cx">         goto ReprocessBuffer;
</span><del>-    }
-    case InsertionMode::Text: {
-        ASSERT(insertionMode() == InsertionMode::Text);
</del><ins>+    case InsertionMode::Text:
</ins><span class="cx">         m_tree.insertTextNode(buffer.takeRemaining());
</span><span class="cx">         break;
</span><del>-    }
</del><span class="cx">     case InsertionMode::InHeadNoscript: {
</span><del>-        ASSERT(insertionMode() == InsertionMode::InHeadNoscript);
</del><span class="cx">         String leadingWhitespace = buffer.takeLeadingWhitespace();
</span><span class="cx">         if (!leadingWhitespace.isEmpty())
</span><span class="cx">             m_tree.insertTextNode(leadingWhitespace, AllWhitespace);
</span><span class="lines">@@ -2544,7 +2501,6 @@
</span><span class="cx">     }
</span><span class="cx">     case InsertionMode::InFrameset:
</span><span class="cx">     case InsertionMode::AfterFrameset: {
</span><del>-        ASSERT(insertionMode() == InsertionMode::InFrameset || insertionMode() == InsertionMode::AfterFrameset || insertionMode() == InsertionMode::AfterAfterFrameset);
</del><span class="cx">         String leadingWhitespace = buffer.takeRemainingWhitespace();
</span><span class="cx">         if (!leadingWhitespace.isEmpty())
</span><span class="cx">             m_tree.insertTextNode(leadingWhitespace, AllWhitespace);
</span><span class="lines">@@ -2553,11 +2509,9 @@
</span><span class="cx">         break;
</span><span class="cx">     }
</span><span class="cx">     case InsertionMode::InSelectInTable:
</span><del>-    case InsertionMode::InSelect: {
-        ASSERT(insertionMode() == InsertionMode::InSelect || insertionMode() == InsertionMode::InSelectInTable);
</del><ins>+    case InsertionMode::InSelect:
</ins><span class="cx">         m_tree.insertTextNode(buffer.takeRemaining());
</span><span class="cx">         break;
</span><del>-    }
</del><span class="cx">     case InsertionMode::AfterAfterFrameset: {
</span><span class="cx">         String leadingWhitespace = buffer.takeRemainingWhitespace();
</span><span class="cx">         if (!leadingWhitespace.isEmpty()) {
</span><span class="lines">@@ -2583,64 +2537,55 @@
</span><span class="cx"> #else
</span><span class="cx">     m_tree.insertTextNode(characters);
</span><span class="cx"> #endif
</span><del>-
</del><span class="cx">     if (m_framesetOk &amp;&amp; !isAllWhitespaceOrReplacementCharacters(characters))
</span><span class="cx">         m_framesetOk = false;
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-void HTMLTreeBuilder::processEndOfFile(AtomicHTMLToken* token)
</del><ins>+void HTMLTreeBuilder::processEndOfFile(AtomicHTMLToken&amp; token)
</ins><span class="cx"> {
</span><del>-    ASSERT(token-&gt;type() == HTMLToken::EndOfFile);
-    switch (insertionMode()) {
</del><ins>+    ASSERT(token.type() == HTMLToken::EndOfFile);
+    switch (m_insertionMode) {
</ins><span class="cx">     case InsertionMode::Initial:
</span><del>-        ASSERT(insertionMode() == InsertionMode::Initial);
</del><span class="cx">         defaultForInitial();
</span><ins>+        ASSERT(m_insertionMode == InsertionMode::BeforeHTML);
</ins><span class="cx">         FALLTHROUGH;
</span><span class="cx">     case InsertionMode::BeforeHTML:
</span><del>-        ASSERT(insertionMode() == InsertionMode::BeforeHTML);
</del><span class="cx">         defaultForBeforeHTML();
</span><ins>+        ASSERT(m_insertionMode == InsertionMode::BeforeHead);
</ins><span class="cx">         FALLTHROUGH;
</span><span class="cx">     case InsertionMode::BeforeHead:
</span><del>-        ASSERT(insertionMode() == InsertionMode::BeforeHead);
</del><span class="cx">         defaultForBeforeHead();
</span><ins>+        ASSERT(m_insertionMode == InsertionMode::InHead);
</ins><span class="cx">         FALLTHROUGH;
</span><span class="cx">     case InsertionMode::InHead:
</span><del>-        ASSERT(insertionMode() == InsertionMode::InHead);
</del><span class="cx">         defaultForInHead();
</span><ins>+        ASSERT(m_insertionMode == InsertionMode::AfterHead);
</ins><span class="cx">         FALLTHROUGH;
</span><span class="cx">     case InsertionMode::AfterHead:
</span><del>-        ASSERT(insertionMode() == InsertionMode::AfterHead);
</del><span class="cx">         defaultForAfterHead();
</span><ins>+        ASSERT(m_insertionMode == InsertionMode::InBody);
</ins><span class="cx">         FALLTHROUGH;
</span><span class="cx">     case InsertionMode::InBody:
</span><span class="cx">     case InsertionMode::InCell:
</span><span class="cx">     case InsertionMode::InCaption:
</span><span class="cx">     case InsertionMode::InRow:
</span><del>-#if ENABLE(TEMPLATE_ELEMENT)
-        ASSERT(insertionMode() == InsertionMode::InBody || insertionMode() == InsertionMode::InCell || insertionMode() == InsertionMode::InCaption || insertionMode() == InsertionMode::InRow || insertionMode() == InsertionMode::TemplateContents);
-#else
-        ASSERT(insertionMode() != InsertionMode::TemplateContents);
-        ASSERT(insertionMode() == InsertionMode::InBody || insertionMode() == InsertionMode::InCell || insertionMode() == InsertionMode::InCaption || insertionMode() == InsertionMode::InRow);
-#endif
</del><span class="cx">         notImplemented(); // Emit parse error based on what elements are still open.
</span><span class="cx"> #if ENABLE(TEMPLATE_ELEMENT)
</span><del>-        if (!m_templateInsertionModes.isEmpty())
</del><ins>+        if (!m_templateInsertionModes.isEmpty()) {
</ins><span class="cx">             if (processEndOfFileForInTemplateContents(token))
</span><span class="cx">                 return;
</span><ins>+        }
</ins><span class="cx"> #endif
</span><span class="cx">         break;
</span><span class="cx">     case InsertionMode::AfterBody:
</span><span class="cx">     case InsertionMode::AfterAfterBody:
</span><del>-        ASSERT(insertionMode() == InsertionMode::AfterBody || insertionMode() == InsertionMode::AfterAfterBody);
</del><span class="cx">         break;
</span><span class="cx">     case InsertionMode::InHeadNoscript:
</span><del>-        ASSERT(insertionMode() == InsertionMode::InHeadNoscript);
</del><span class="cx">         defaultForInHeadNoscript();
</span><span class="cx">         processEndOfFile(token);
</span><span class="cx">         return;
</span><span class="cx">     case InsertionMode::AfterFrameset:
</span><span class="cx">     case InsertionMode::AfterAfterFrameset:
</span><del>-        ASSERT(insertionMode() == InsertionMode::AfterFrameset || insertionMode() == InsertionMode::AfterAfterFrameset);
</del><span class="cx">         break;
</span><span class="cx">     case InsertionMode::InColumnGroup:
</span><span class="cx">         if (m_tree.currentIsRootNode()) {
</span><span class="lines">@@ -2659,14 +2604,14 @@
</span><span class="cx">     case InsertionMode::InTableBody:
</span><span class="cx">     case InsertionMode::InSelectInTable:
</span><span class="cx">     case InsertionMode::InSelect:
</span><del>-        ASSERT(insertionMode() == InsertionMode::InSelect || insertionMode() == InsertionMode::InSelectInTable || insertionMode() == InsertionMode::InTable || insertionMode() == InsertionMode::InFrameset || insertionMode() == InsertionMode::InTableBody || insertionMode() == InsertionMode::InColumnGroup);
</del><ins>+        ASSERT(m_insertionMode == InsertionMode::InSelect || m_insertionMode == InsertionMode::InSelectInTable || m_insertionMode == InsertionMode::InTable || m_insertionMode == InsertionMode::InFrameset || m_insertionMode == InsertionMode::InTableBody || m_insertionMode == InsertionMode::InColumnGroup);
</ins><span class="cx">         if (m_tree.currentNode() != m_tree.openElements()-&gt;rootNode())
</span><span class="cx">             parseError(token);
</span><del>-
</del><span class="cx"> #if ENABLE(TEMPLATE_ELEMENT)
</span><del>-        if (!m_templateInsertionModes.isEmpty())
</del><ins>+        if (!m_templateInsertionModes.isEmpty()) {
</ins><span class="cx">             if (processEndOfFileForInTemplateContents(token))
</span><span class="cx">                 return;
</span><ins>+        }
</ins><span class="cx"> #endif
</span><span class="cx">         break;
</span><span class="cx">     case InsertionMode::InTableText:
</span><span class="lines">@@ -2679,16 +2624,14 @@
</span><span class="cx">             notImplemented(); // mark the script element as &quot;already started&quot;.
</span><span class="cx">         m_tree.openElements()-&gt;pop();
</span><span class="cx">         ASSERT(m_originalInsertionMode != InsertionMode::Text);
</span><del>-        setInsertionMode(m_originalInsertionMode);
</del><ins>+        m_insertionMode = m_originalInsertionMode;
</ins><span class="cx">         processEndOfFile(token);
</span><span class="cx">         return;
</span><del>-    case InsertionMode::TemplateContents:
</del><span class="cx"> #if ENABLE(TEMPLATE_ELEMENT)
</span><ins>+    case InsertionMode::TemplateContents:
</ins><span class="cx">         if (processEndOfFileForInTemplateContents(token))
</span><span class="cx">             return;
</span><span class="cx">         break;
</span><del>-#else
-        ASSERT_NOT_REACHED();
</del><span class="cx"> #endif
</span><span class="cx">     }
</span><span class="cx">     ASSERT(m_tree.currentNode());
</span><span class="lines">@@ -2700,38 +2643,38 @@
</span><span class="cx">     notImplemented();
</span><span class="cx">     m_tree.setDefaultCompatibilityMode();
</span><span class="cx">     // FIXME: parse error
</span><del>-    setInsertionMode(InsertionMode::BeforeHTML);
</del><ins>+    m_insertionMode = InsertionMode::BeforeHTML;
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> void HTMLTreeBuilder::defaultForBeforeHTML()
</span><span class="cx"> {
</span><span class="cx">     AtomicHTMLToken startHTML(HTMLToken::StartTag, htmlTag.localName());
</span><span class="cx">     m_tree.insertHTMLHtmlStartTagBeforeHTML(&amp;startHTML);
</span><del>-    setInsertionMode(InsertionMode::BeforeHead);
</del><ins>+    m_insertionMode = InsertionMode::BeforeHead;
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> void HTMLTreeBuilder::defaultForBeforeHead()
</span><span class="cx"> {
</span><span class="cx">     AtomicHTMLToken startHead(HTMLToken::StartTag, headTag.localName());
</span><del>-    processStartTag(&amp;startHead);
</del><ins>+    processStartTag(startHead);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> void HTMLTreeBuilder::defaultForInHead()
</span><span class="cx"> {
</span><span class="cx">     AtomicHTMLToken endHead(HTMLToken::EndTag, headTag.localName());
</span><del>-    processEndTag(&amp;endHead);
</del><ins>+    processEndTag(endHead);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> void HTMLTreeBuilder::defaultForInHeadNoscript()
</span><span class="cx"> {
</span><span class="cx">     AtomicHTMLToken endNoscript(HTMLToken::EndTag, noscriptTag.localName());
</span><del>-    processEndTag(&amp;endNoscript);
</del><ins>+    processEndTag(endNoscript);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> void HTMLTreeBuilder::defaultForAfterHead()
</span><span class="cx"> {
</span><span class="cx">     AtomicHTMLToken startBody(HTMLToken::StartTag, bodyTag.localName());
</span><del>-    processStartTag(&amp;startBody);
</del><ins>+    processStartTag(startBody);
</ins><span class="cx">     m_framesetOk = true;
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="lines">@@ -2745,90 +2688,90 @@
</span><span class="cx">         m_tree.reconstructTheActiveFormattingElements();
</span><span class="cx">         m_tree.insertTextNode(characters, NotAllWhitespace);
</span><span class="cx">         m_framesetOk = false;
</span><del>-        setInsertionMode(m_originalInsertionMode);
</del><ins>+        m_insertionMode = m_originalInsertionMode;
</ins><span class="cx">         return;
</span><span class="cx">     }
</span><span class="cx">     m_tree.insertTextNode(characters);
</span><del>-    setInsertionMode(m_originalInsertionMode);
</del><ins>+    m_insertionMode = m_originalInsertionMode;
</ins><span class="cx"> }
</span><span class="cx"> 
</span><del>-bool HTMLTreeBuilder::processStartTagForInHead(AtomicHTMLToken* token)
</del><ins>+bool HTMLTreeBuilder::processStartTagForInHead(AtomicHTMLToken&amp; token)
</ins><span class="cx"> {
</span><del>-    ASSERT(token-&gt;type() == HTMLToken::StartTag);
-    if (token-&gt;name() == htmlTag) {
</del><ins>+    ASSERT(token.type() == HTMLToken::StartTag);
+    if (token.name() == htmlTag) {
</ins><span class="cx">         processHtmlStartTagForInBody(token);
</span><span class="cx">         return true;
</span><span class="cx">     }
</span><del>-    if (token-&gt;name() == baseTag
-        || token-&gt;name() == basefontTag
-        || token-&gt;name() == bgsoundTag
-        || token-&gt;name() == commandTag
-        || token-&gt;name() == linkTag
-        || token-&gt;name() == metaTag) {
-        m_tree.insertSelfClosingHTMLElement(token);
</del><ins>+    if (token.name() == baseTag
+        || token.name() == basefontTag
+        || token.name() == bgsoundTag
+        || token.name() == commandTag
+        || token.name() == linkTag
+        || token.name() == metaTag) {
+        m_tree.insertSelfClosingHTMLElement(&amp;token);
</ins><span class="cx">         // Note: The custom processing for the &lt;meta&gt; tag is done in HTMLMetaElement::process().
</span><span class="cx">         return true;
</span><span class="cx">     }
</span><del>-    if (token-&gt;name() == titleTag) {
</del><ins>+    if (token.name() == titleTag) {
</ins><span class="cx">         processGenericRCDATAStartTag(token);
</span><span class="cx">         return true;
</span><span class="cx">     }
</span><del>-    if (token-&gt;name() == noscriptTag) {
</del><ins>+    if (token.name() == noscriptTag) {
</ins><span class="cx">         if (m_options.scriptEnabled) {
</span><span class="cx">             processGenericRawTextStartTag(token);
</span><span class="cx">             return true;
</span><span class="cx">         }
</span><del>-        m_tree.insertHTMLElement(token);
-        setInsertionMode(InsertionMode::InHeadNoscript);
</del><ins>+        m_tree.insertHTMLElement(&amp;token);
+        m_insertionMode = InsertionMode::InHeadNoscript;
</ins><span class="cx">         return true;
</span><span class="cx">     }
</span><del>-    if (token-&gt;name() == noframesTag || token-&gt;name() == styleTag) {
</del><ins>+    if (token.name() == noframesTag || token.name() == styleTag) {
</ins><span class="cx">         processGenericRawTextStartTag(token);
</span><span class="cx">         return true;
</span><span class="cx">     }
</span><del>-    if (token-&gt;name() == scriptTag) {
</del><ins>+    if (token.name() == scriptTag) {
</ins><span class="cx">         processScriptStartTag(token);
</span><del>-        if (m_options.usePreHTML5ParserQuirks &amp;&amp; token-&gt;selfClosing())
</del><ins>+        if (m_options.usePreHTML5ParserQuirks &amp;&amp; token.selfClosing())
</ins><span class="cx">             processFakeEndTag(scriptTag);
</span><span class="cx">         return true;
</span><span class="cx">     }
</span><span class="cx"> #if ENABLE(TEMPLATE_ELEMENT)
</span><del>-    if (token-&gt;name() == templateTag) {
</del><ins>+    if (token.name() == templateTag) {
</ins><span class="cx">         processTemplateStartTag(token);
</span><span class="cx">         return true;
</span><span class="cx">     }
</span><span class="cx"> #endif
</span><del>-    if (token-&gt;name() == headTag) {
</del><ins>+    if (token.name() == headTag) {
</ins><span class="cx">         parseError(token);
</span><span class="cx">         return true;
</span><span class="cx">     }
</span><span class="cx">     return false;
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-void HTMLTreeBuilder::processGenericRCDATAStartTag(AtomicHTMLToken* token)
</del><ins>+void HTMLTreeBuilder::processGenericRCDATAStartTag(AtomicHTMLToken&amp; token)
</ins><span class="cx"> {
</span><del>-    ASSERT(token-&gt;type() == HTMLToken::StartTag);
-    m_tree.insertHTMLElement(token);
</del><ins>+    ASSERT(token.type() == HTMLToken::StartTag);
+    m_tree.insertHTMLElement(&amp;token);
</ins><span class="cx">     if (m_parser.tokenizer())
</span><span class="cx">         m_parser.tokenizer()-&gt;setState(HTMLTokenizer::RCDATAState);
</span><span class="cx">     m_originalInsertionMode = m_insertionMode;
</span><del>-    setInsertionMode(InsertionMode::Text);
</del><ins>+    m_insertionMode = InsertionMode::Text;
</ins><span class="cx"> }
</span><span class="cx"> 
</span><del>-void HTMLTreeBuilder::processGenericRawTextStartTag(AtomicHTMLToken* token)
</del><ins>+void HTMLTreeBuilder::processGenericRawTextStartTag(AtomicHTMLToken&amp; token)
</ins><span class="cx"> {
</span><del>-    ASSERT(token-&gt;type() == HTMLToken::StartTag);
-    m_tree.insertHTMLElement(token);
</del><ins>+    ASSERT(token.type() == HTMLToken::StartTag);
+    m_tree.insertHTMLElement(&amp;token);
</ins><span class="cx">     if (m_parser.tokenizer())
</span><span class="cx">         m_parser.tokenizer()-&gt;setState(HTMLTokenizer::RAWTEXTState);
</span><span class="cx">     m_originalInsertionMode = m_insertionMode;
</span><del>-    setInsertionMode(InsertionMode::Text);
</del><ins>+    m_insertionMode = InsertionMode::Text;
</ins><span class="cx"> }
</span><span class="cx"> 
</span><del>-void HTMLTreeBuilder::processScriptStartTag(AtomicHTMLToken* token)
</del><ins>+void HTMLTreeBuilder::processScriptStartTag(AtomicHTMLToken&amp; token)
</ins><span class="cx"> {
</span><del>-    ASSERT(token-&gt;type() == HTMLToken::StartTag);
-    m_tree.insertScriptElement(token);
</del><ins>+    ASSERT(token.type() == HTMLToken::StartTag);
+    m_tree.insertScriptElement(&amp;token);
</ins><span class="cx">     if (m_parser.tokenizer())
</span><span class="cx">         m_parser.tokenizer()-&gt;setState(HTMLTokenizer::ScriptDataState);
</span><span class="cx">     m_originalInsertionMode = m_insertionMode;
</span><span class="lines">@@ -2837,55 +2780,55 @@
</span><span class="cx"> 
</span><span class="cx">     m_scriptToProcessStartPosition = position;
</span><span class="cx"> 
</span><del>-    setInsertionMode(InsertionMode::Text);
</del><ins>+    m_insertionMode = InsertionMode::Text;
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> // http://www.whatwg.org/specs/web-apps/current-work/#adjusted-current-node
</span><del>-HTMLStackItem* HTMLTreeBuilder::adjustedCurrentStackItem() const
</del><ins>+HTMLStackItem&amp; HTMLTreeBuilder::adjustedCurrentStackItem() const
</ins><span class="cx"> {
</span><span class="cx">     ASSERT(!m_tree.isEmpty());
</span><span class="cx">     if (isParsingFragment() &amp;&amp; m_tree.openElements()-&gt;hasOnlyOneElement())
</span><span class="cx">         return m_fragmentContext.contextElementStackItem();
</span><span class="cx"> 
</span><del>-    return m_tree.currentStackItem();
</del><ins>+    return *m_tree.currentStackItem();
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> // http://www.whatwg.org/specs/web-apps/current-work/multipage/tree-construction.html#tree-construction
</span><del>-bool HTMLTreeBuilder::shouldProcessTokenInForeignContent(AtomicHTMLToken* token)
</del><ins>+bool HTMLTreeBuilder::shouldProcessTokenInForeignContent(AtomicHTMLToken&amp; token)
</ins><span class="cx"> {
</span><span class="cx">     if (m_tree.isEmpty())
</span><span class="cx">         return false;
</span><del>-    HTMLStackItem* adjustedCurrentNode = adjustedCurrentStackItem();
-    if (adjustedCurrentNode-&gt;isInHTMLNamespace())
</del><ins>+    HTMLStackItem&amp; adjustedCurrentNode = adjustedCurrentStackItem();
+    if (adjustedCurrentNode.isInHTMLNamespace())
</ins><span class="cx">         return false;
</span><del>-    if (HTMLElementStack::isMathMLTextIntegrationPoint(adjustedCurrentNode)) {
-        if (token-&gt;type() == HTMLToken::StartTag
-            &amp;&amp; token-&gt;name() != MathMLNames::mglyphTag
-            &amp;&amp; token-&gt;name() != MathMLNames::malignmarkTag)
</del><ins>+    if (HTMLElementStack::isMathMLTextIntegrationPoint(&amp;adjustedCurrentNode)) {
+        if (token.type() == HTMLToken::StartTag
+            &amp;&amp; token.name() != MathMLNames::mglyphTag
+            &amp;&amp; token.name() != MathMLNames::malignmarkTag)
</ins><span class="cx">             return false;
</span><del>-        if (token-&gt;type() == HTMLToken::Character)
</del><ins>+        if (token.type() == HTMLToken::Character)
</ins><span class="cx">             return false;
</span><span class="cx">     }
</span><del>-    if (adjustedCurrentNode-&gt;hasTagName(MathMLNames::annotation_xmlTag)
-        &amp;&amp; token-&gt;type() == HTMLToken::StartTag
-        &amp;&amp; token-&gt;name() == SVGNames::svgTag)
</del><ins>+    if (adjustedCurrentNode.hasTagName(MathMLNames::annotation_xmlTag)
+        &amp;&amp; token.type() == HTMLToken::StartTag
+        &amp;&amp; token.name() == SVGNames::svgTag)
</ins><span class="cx">         return false;
</span><del>-    if (HTMLElementStack::isHTMLIntegrationPoint(adjustedCurrentNode)) {
-        if (token-&gt;type() == HTMLToken::StartTag)
</del><ins>+    if (HTMLElementStack::isHTMLIntegrationPoint(&amp;adjustedCurrentNode)) {
+        if (token.type() == HTMLToken::StartTag)
</ins><span class="cx">             return false;
</span><del>-        if (token-&gt;type() == HTMLToken::Character)
</del><ins>+        if (token.type() == HTMLToken::Character)
</ins><span class="cx">             return false;
</span><span class="cx">     }
</span><del>-    if (token-&gt;type() == HTMLToken::EndOfFile)
</del><ins>+    if (token.type() == HTMLToken::EndOfFile)
</ins><span class="cx">         return false;
</span><span class="cx">     return true;
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-void HTMLTreeBuilder::processTokenInForeignContent(AtomicHTMLToken* token)
</del><ins>+void HTMLTreeBuilder::processTokenInForeignContent(AtomicHTMLToken&amp; token)
</ins><span class="cx"> {
</span><del>-    HTMLStackItem* adjustedCurrentNode = adjustedCurrentStackItem();
</del><ins>+    HTMLStackItem&amp; adjustedCurrentNode = adjustedCurrentStackItem();
</ins><span class="cx">     
</span><del>-    switch (token-&gt;type()) {
</del><ins>+    switch (token.type()) {
</ins><span class="cx">     case HTMLToken::Uninitialized:
</span><span class="cx">         ASSERT_NOT_REACHED();
</span><span class="cx">         break;
</span><span class="lines">@@ -2893,67 +2836,67 @@
</span><span class="cx">         parseError(token);
</span><span class="cx">         break;
</span><span class="cx">     case HTMLToken::StartTag: {
</span><del>-        if (token-&gt;name() == bTag
-            || token-&gt;name() == bigTag
-            || token-&gt;name() == blockquoteTag
-            || token-&gt;name() == bodyTag
-            || token-&gt;name() == brTag
-            || token-&gt;name() == centerTag
-            || token-&gt;name() == codeTag
-            || token-&gt;name() == ddTag
-            || token-&gt;name() == divTag
-            || token-&gt;name() == dlTag
-            || token-&gt;name() == dtTag
-            || token-&gt;name() == emTag
-            || token-&gt;name() == embedTag
-            || isNumberedHeaderTag(token-&gt;name())
-            || token-&gt;name() == headTag
-            || token-&gt;name() == hrTag
-            || token-&gt;name() == iTag
-            || token-&gt;name() == imgTag
-            || token-&gt;name() == liTag
-            || token-&gt;name() == listingTag
-            || token-&gt;name() == menuTag
-            || token-&gt;name() == metaTag
-            || token-&gt;name() == nobrTag
-            || token-&gt;name() == olTag
-            || token-&gt;name() == pTag
-            || token-&gt;name() == preTag
-            || token-&gt;name() == rubyTag
-            || token-&gt;name() == sTag
-            || token-&gt;name() == smallTag
-            || token-&gt;name() == spanTag
-            || token-&gt;name() == strongTag
-            || token-&gt;name() == strikeTag
-            || token-&gt;name() == subTag
-            || token-&gt;name() == supTag
-            || token-&gt;name() == tableTag
-            || token-&gt;name() == ttTag
-            || token-&gt;name() == uTag
-            || token-&gt;name() == ulTag
-            || token-&gt;name() == varTag
-            || (token-&gt;name() == fontTag &amp;&amp; (token-&gt;getAttributeItem(colorAttr) || token-&gt;getAttributeItem(faceAttr) || token-&gt;getAttributeItem(sizeAttr)))) {
</del><ins>+        if (token.name() == bTag
+            || token.name() == bigTag
+            || token.name() == blockquoteTag
+            || token.name() == bodyTag
+            || token.name() == brTag
+            || token.name() == centerTag
+            || token.name() == codeTag
+            || token.name() == ddTag
+            || token.name() == divTag
+            || token.name() == dlTag
+            || token.name() == dtTag
+            || token.name() == emTag
+            || token.name() == embedTag
+            || isNumberedHeaderTag(token.name())
+            || token.name() == headTag
+            || token.name() == hrTag
+            || token.name() == iTag
+            || token.name() == imgTag
+            || token.name() == liTag
+            || token.name() == listingTag
+            || token.name() == menuTag
+            || token.name() == metaTag
+            || token.name() == nobrTag
+            || token.name() == olTag
+            || token.name() == pTag
+            || token.name() == preTag
+            || token.name() == rubyTag
+            || token.name() == sTag
+            || token.name() == smallTag
+            || token.name() == spanTag
+            || token.name() == strongTag
+            || token.name() == strikeTag
+            || token.name() == subTag
+            || token.name() == supTag
+            || token.name() == tableTag
+            || token.name() == ttTag
+            || token.name() == uTag
+            || token.name() == ulTag
+            || token.name() == varTag
+            || (token.name() == fontTag &amp;&amp; (token.getAttributeItem(colorAttr) || token.getAttributeItem(faceAttr) || token.getAttributeItem(sizeAttr)))) {
</ins><span class="cx">             parseError(token);
</span><span class="cx">             m_tree.openElements()-&gt;popUntilForeignContentScopeMarker();
</span><span class="cx">             processStartTag(token);
</span><span class="cx">             return;
</span><span class="cx">         }
</span><del>-        const AtomicString&amp; currentNamespace = adjustedCurrentNode-&gt;namespaceURI();
</del><ins>+        const AtomicString&amp; currentNamespace = adjustedCurrentNode.namespaceURI();
</ins><span class="cx">         if (currentNamespace == MathMLNames::mathmlNamespaceURI)
</span><del>-            adjustMathMLAttributes(*token);
</del><ins>+            adjustMathMLAttributes(token);
</ins><span class="cx">         if (currentNamespace == SVGNames::svgNamespaceURI) {
</span><del>-            adjustSVGTagNameCase(*token);
-            adjustSVGAttributes(*token);
</del><ins>+            adjustSVGTagNameCase(token);
+            adjustSVGAttributes(token);
</ins><span class="cx">         }
</span><del>-        adjustForeignAttributes(*token);
-        m_tree.insertForeignElement(token, currentNamespace);
</del><ins>+        adjustForeignAttributes(token);
+        m_tree.insertForeignElement(&amp;token, currentNamespace);
</ins><span class="cx">         break;
</span><span class="cx">     }
</span><span class="cx">     case HTMLToken::EndTag: {
</span><del>-        if (adjustedCurrentNode-&gt;namespaceURI() == SVGNames::svgNamespaceURI)
-            adjustSVGTagNameCase(*token);
</del><ins>+        if (adjustedCurrentNode.namespaceURI() == SVGNames::svgNamespaceURI)
+            adjustSVGTagNameCase(token);
</ins><span class="cx"> 
</span><del>-        if (token-&gt;name() == SVGNames::scriptTag &amp;&amp; m_tree.currentStackItem()-&gt;hasTagName(SVGNames::scriptTag)) {
</del><ins>+        if (token.name() == SVGNames::scriptTag &amp;&amp; m_tree.currentStackItem()-&gt;hasTagName(SVGNames::scriptTag)) {
</ins><span class="cx">             if (scriptingContentIsAllowed(m_tree.parserContentPolicy()))
</span><span class="cx">                 m_scriptToProcess = m_tree.currentElement();
</span><span class="cx">             m_tree.openElements()-&gt;pop();
</span><span class="lines">@@ -2961,11 +2904,11 @@
</span><span class="cx">         }
</span><span class="cx">         if (!m_tree.currentStackItem()-&gt;isInHTMLNamespace()) {
</span><span class="cx">             // FIXME: This code just wants an Element* iterator, instead of an ElementRecord*
</span><del>-            HTMLElementStack::ElementRecord* nodeRecord = m_tree.openElements()-&gt;topRecord();
-            if (!nodeRecord-&gt;stackItem()-&gt;hasLocalName(token-&gt;name()))
</del><ins>+            auto* nodeRecord = m_tree.openElements()-&gt;topRecord();
+            if (!nodeRecord-&gt;stackItem()-&gt;hasLocalName(token.name()))
</ins><span class="cx">                 parseError(token);
</span><span class="cx">             while (1) {
</span><del>-                if (nodeRecord-&gt;stackItem()-&gt;hasLocalName(token-&gt;name())) {
</del><ins>+                if (nodeRecord-&gt;stackItem()-&gt;hasLocalName(token.name())) {
</ins><span class="cx">                     m_tree.openElements()-&gt;popUntilPopped(nodeRecord-&gt;element());
</span><span class="cx">                     return;
</span><span class="cx">                 }
</span><span class="lines">@@ -2980,10 +2923,10 @@
</span><span class="cx">         break;
</span><span class="cx">     }
</span><span class="cx">     case HTMLToken::Comment:
</span><del>-        m_tree.insertComment(token);
</del><ins>+        m_tree.insertComment(&amp;token);
</ins><span class="cx">         return;
</span><span class="cx">     case HTMLToken::Character: {
</span><del>-        String characters = String(token-&gt;characters(), token-&gt;charactersLength());
</del><ins>+        String characters = String(token.characters(), token.charactersLength());
</ins><span class="cx">         m_tree.insertTextNode(characters);
</span><span class="cx">         if (m_framesetOk &amp;&amp; !isAllWhitespaceOrReplacementCharacters(characters))
</span><span class="cx">             m_framesetOk = false;
</span><span class="lines">@@ -2997,6 +2940,8 @@
</span><span class="cx"> 
</span><span class="cx"> void HTMLTreeBuilder::finished()
</span><span class="cx"> {
</span><ins>+    ASSERT(!m_destroyed);
+
</ins><span class="cx">     if (isParsingFragment())
</span><span class="cx">         return;
</span><span class="cx"> 
</span><span class="lines">@@ -3004,12 +2949,11 @@
</span><span class="cx">     ASSERT(m_templateInsertionModes.isEmpty());
</span><span class="cx"> #endif
</span><span class="cx"> 
</span><del>-    ASSERT(m_isAttached);
-    // Warning, this may detach the parser. Do not do anything else after this.
</del><span class="cx">     m_tree.finishedParsing();
</span><ins>+    // The tree builder might have been destroyed as an indirect result of finishing the parsing.
</ins><span class="cx"> }
</span><span class="cx"> 
</span><del>-void HTMLTreeBuilder::parseError(AtomicHTMLToken*)
</del><ins>+inline void HTMLTreeBuilder::parseError(AtomicHTMLToken&amp;)
</ins><span class="cx"> {
</span><span class="cx"> }
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceWebCorehtmlparserHTMLTreeBuilderh"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/html/parser/HTMLTreeBuilder.h (177862 => 177863)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/html/parser/HTMLTreeBuilder.h        2015-01-02 18:07:48 UTC (rev 177862)
+++ trunk/Source/WebCore/html/parser/HTMLTreeBuilder.h        2015-01-02 18:17:05 UTC (rev 177863)
</span><span class="lines">@@ -1,6 +1,6 @@
</span><span class="cx"> /*
</span><span class="cx">  * Copyright (C) 2010 Google, Inc. All Rights Reserved.
</span><del>- * Copyright (C) 2011 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2011, 2015 Apple Inc. All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  * Redistribution and use in source and binary forms, with or without
</span><span class="cx">  * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -27,64 +27,37 @@
</span><span class="cx"> #ifndef HTMLTreeBuilder_h
</span><span class="cx"> #define HTMLTreeBuilder_h
</span><span class="cx"> 
</span><del>-#include &quot;FragmentScriptingPermission.h&quot;
</del><span class="cx"> #include &quot;HTMLConstructionSite.h&quot;
</span><del>-#include &quot;HTMLElementStack.h&quot;
-#include &quot;HTMLFormattingElementList.h&quot;
</del><span class="cx"> #include &quot;HTMLParserOptions.h&quot;
</span><del>-#include &quot;HTMLStackItem.h&quot;
-#include &quot;HTMLTokenizer.h&quot;
-#include &lt;wtf/Noncopyable.h&gt;
-#include &lt;wtf/PassRefPtr.h&gt;
-#include &lt;wtf/RefPtr.h&gt;
-#include &lt;wtf/Vector.h&gt;
-#include &lt;wtf/text/StringBuilder.h&gt;
-#include &lt;wtf/text/TextPosition.h&gt;
</del><span class="cx"> 
</span><span class="cx"> namespace WebCore {
</span><span class="cx"> 
</span><del>-class AtomicHTMLToken;
-class Document;
-class DocumentFragment;
-class Element;
-class Frame;
-class HTMLToken;
-class HTMLDocument;
-class Node;
</del><span class="cx"> class HTMLDocumentParser;
</span><span class="cx"> 
</span><span class="cx"> class HTMLTreeBuilder {
</span><del>-    WTF_MAKE_NONCOPYABLE(HTMLTreeBuilder); WTF_MAKE_FAST_ALLOCATED;
</del><ins>+    WTF_MAKE_FAST_ALLOCATED;
</ins><span class="cx"> public:
</span><del>-    HTMLTreeBuilder(HTMLDocumentParser&amp;, HTMLDocument&amp;, ParserContentPolicy, const HTMLParserOptions&amp;);
-    HTMLTreeBuilder(HTMLDocumentParser&amp;, DocumentFragment&amp;, Element* contextElement, ParserContentPolicy, const HTMLParserOptions&amp;);
</del><ins>+    HTMLTreeBuilder(const HTMLDocumentParser&amp;, HTMLDocument&amp;, ParserContentPolicy, const HTMLParserOptions&amp;);
+    HTMLTreeBuilder(const HTMLDocumentParser&amp;, DocumentFragment&amp;, Element&amp; contextElement, ParserContentPolicy, const HTMLParserOptions&amp;);
+    void setShouldSkipLeadingNewline(bool);
+
</ins><span class="cx">     ~HTMLTreeBuilder();
</span><span class="cx"> 
</span><del>-    const HTMLElementStack* openElements() const { return m_tree.openElements(); }
</del><ins>+    bool isParsingFragment() const;
</ins><span class="cx"> 
</span><del>-    bool isParsingFragment() const { return !!m_fragmentContext.fragment(); }
-#if ENABLE(TEMPLATE_ELEMENT)
-    bool isParsingTemplateContents() const { return m_tree.openElements()-&gt;hasTemplateInHTMLScope(); }
-#else
-    bool isParsingTemplateContents() const { return false; }
-#endif
-    bool isParsingFragmentOrTemplateContents() const { return isParsingFragment() || isParsingTemplateContents(); }
</del><ins>+    void constructTree(AtomicHTMLToken&amp;);
</ins><span class="cx"> 
</span><del>-    void detach();
</del><ins>+    bool hasParserBlockingScript() const;
</ins><span class="cx"> 
</span><del>-    void constructTree(AtomicHTMLToken*);
-
-    bool hasParserBlockingScript() const { return !!m_scriptToProcess; }
</del><span class="cx">     // Must be called to take the parser-blocking script before calling the parser again.
</span><del>-    PassRefPtr&lt;Element&gt; takeScriptToProcess(TextPosition&amp; scriptStartPosition);
</del><ins>+    RefPtr&lt;Element&gt; takeScriptToProcess(TextPosition&amp; scriptStartPosition);
</ins><span class="cx"> 
</span><span class="cx">     // Done, close any open tags, etc.
</span><span class="cx">     void finished();
</span><span class="cx"> 
</span><del>-    void setShouldSkipLeadingNewline(bool shouldSkip) { m_shouldSkipLeadingNewline = shouldSkip; }
-
</del><span class="cx"> private:
</span><span class="cx">     class ExternalCharacterTokenBuffer;
</span><ins>+
</ins><span class="cx">     // Represents HTML5 &quot;insertion mode&quot;
</span><span class="cx">     // http://www.whatwg.org/specs/web-apps/current-work/multipage/parsing.html#insertion-mode
</span><span class="cx">     enum class InsertionMode {
</span><span class="lines">@@ -94,7 +67,9 @@
</span><span class="cx">         InHead,
</span><span class="cx">         InHeadNoscript,
</span><span class="cx">         AfterHead,
</span><ins>+#if ENABLE(TEMPLATE_ELEMENT)
</ins><span class="cx">         TemplateContents,
</span><ins>+#endif
</ins><span class="cx">         InBody,
</span><span class="cx">         Text,
</span><span class="cx">         InTable,
</span><span class="lines">@@ -113,52 +88,54 @@
</span><span class="cx">         AfterAfterFrameset,
</span><span class="cx">     };
</span><span class="cx"> 
</span><del>-#if ENABLE(TELEPHONE_NUMBER_DETECTION)
</del><ins>+    bool isParsingTemplateContents() const;
+    bool isParsingFragmentOrTemplateContents() const;
+
+#if ENABLE(TELEPHONE_NUMBER_DETECTION) &amp;&amp; PLATFORM(IOS)
</ins><span class="cx">     void insertPhoneNumberLink(const String&amp;);
</span><span class="cx">     void linkifyPhoneNumbers(const String&amp;);
</span><span class="cx"> #endif
</span><span class="cx"> 
</span><del>-    void processToken(AtomicHTMLToken*);
</del><ins>+    void processToken(AtomicHTMLToken&amp;);
</ins><span class="cx"> 
</span><del>-    void processDoctypeToken(AtomicHTMLToken*);
-    void processStartTag(AtomicHTMLToken*);
-    void processEndTag(AtomicHTMLToken*);
-    void processComment(AtomicHTMLToken*);
-    void processCharacter(AtomicHTMLToken*);
-    void processEndOfFile(AtomicHTMLToken*);
</del><ins>+    void processDoctypeToken(AtomicHTMLToken&amp;);
+    void processStartTag(AtomicHTMLToken&amp;);
+    void processEndTag(AtomicHTMLToken&amp;);
+    void processComment(AtomicHTMLToken&amp;);
+    void processCharacter(AtomicHTMLToken&amp;);
+    void processEndOfFile(AtomicHTMLToken&amp;);
</ins><span class="cx"> 
</span><del>-    bool processStartTagForInHead(AtomicHTMLToken*);
-    void processStartTagForInBody(AtomicHTMLToken*);
-    void processStartTagForInTable(AtomicHTMLToken*);
-    void processEndTagForInBody(AtomicHTMLToken*);
-    void processEndTagForInTable(AtomicHTMLToken*);
-    void processEndTagForInTableBody(AtomicHTMLToken*);
-    void processEndTagForInRow(AtomicHTMLToken*);
-    void processEndTagForInCell(AtomicHTMLToken*);
</del><ins>+    bool processStartTagForInHead(AtomicHTMLToken&amp;);
+    void processStartTagForInBody(AtomicHTMLToken&amp;);
+    void processStartTagForInTable(AtomicHTMLToken&amp;);
+    void processEndTagForInBody(AtomicHTMLToken&amp;);
+    void processEndTagForInTable(AtomicHTMLToken&amp;);
+    void processEndTagForInTableBody(AtomicHTMLToken&amp;);
+    void processEndTagForInRow(AtomicHTMLToken&amp;);
+    void processEndTagForInCell(AtomicHTMLToken&amp;);
</ins><span class="cx"> 
</span><del>-    void processIsindexStartTagForInBody(AtomicHTMLToken*);
-    void processHtmlStartTagForInBody(AtomicHTMLToken*);
-    bool processBodyEndTagForInBody(AtomicHTMLToken*);
</del><ins>+    void processIsindexStartTagForInBody(AtomicHTMLToken&amp;);
+    void processHtmlStartTagForInBody(AtomicHTMLToken&amp;);
+    bool processBodyEndTagForInBody(AtomicHTMLToken&amp;);
</ins><span class="cx">     bool processTableEndTagForInTable();
</span><span class="cx">     bool processCaptionEndTagForInCaption();
</span><span class="cx">     bool processColgroupEndTagForInColumnGroup();
</span><span class="cx">     bool processTrEndTagForInRow();
</span><del>-    // FIXME: This function should be inlined into its one call site or it
-    // needs to assert which tokens it can be called with.
-    void processAnyOtherEndTagForInBody(AtomicHTMLToken*);
</del><span class="cx"> 
</span><ins>+    void processAnyOtherEndTagForInBody(AtomicHTMLToken&amp;);
+
</ins><span class="cx">     void processCharacterBuffer(ExternalCharacterTokenBuffer&amp;);
</span><span class="cx">     inline void processCharacterBufferForInBody(ExternalCharacterTokenBuffer&amp;);
</span><span class="cx"> 
</span><del>-    void processFakeStartTag(const QualifiedName&amp;, const Vector&lt;Attribute&gt;&amp; attributes = Vector&lt;Attribute&gt;());
</del><ins>+    void processFakeStartTag(const QualifiedName&amp;, Vector&lt;Attribute&gt;&amp;&amp; attributes = Vector&lt;Attribute&gt;());
</ins><span class="cx">     void processFakeEndTag(const QualifiedName&amp;);
</span><span class="cx">     void processFakeEndTag(const AtomicString&amp;);
</span><span class="cx">     void processFakeCharacters(const String&amp;);
</span><span class="cx">     void processFakePEndTagIfPInButtonScope();
</span><span class="cx"> 
</span><del>-    void processGenericRCDATAStartTag(AtomicHTMLToken*);
-    void processGenericRawTextStartTag(AtomicHTMLToken*);
-    void processScriptStartTag(AtomicHTMLToken*);
</del><ins>+    void processGenericRCDATAStartTag(AtomicHTMLToken&amp;);
+    void processGenericRawTextStartTag(AtomicHTMLToken&amp;);
+    void processScriptStartTag(AtomicHTMLToken&amp;);
</ins><span class="cx"> 
</span><span class="cx">     // Default processing for the different insertion modes.
</span><span class="cx">     void defaultForInitial();
</span><span class="lines">@@ -169,81 +146,104 @@
</span><span class="cx">     void defaultForAfterHead();
</span><span class="cx">     void defaultForInTableText();
</span><span class="cx"> 
</span><del>-    inline bool shouldProcessTokenInForeignContent(AtomicHTMLToken*);
-    void processTokenInForeignContent(AtomicHTMLToken*);
</del><ins>+    bool shouldProcessTokenInForeignContent(AtomicHTMLToken&amp;);
+    void processTokenInForeignContent(AtomicHTMLToken&amp;);
</ins><span class="cx">     
</span><del>-    inline HTMLStackItem* adjustedCurrentStackItem() const;
</del><ins>+    HTMLStackItem&amp; adjustedCurrentStackItem() const;
</ins><span class="cx"> 
</span><del>-    Vector&lt;Attribute&gt; attributesForIsindexInput(AtomicHTMLToken*);
</del><ins>+    Vector&lt;Attribute&gt; attributesForIsindexInput(AtomicHTMLToken&amp;);
</ins><span class="cx"> 
</span><del>-    void callTheAdoptionAgency(AtomicHTMLToken*);
</del><ins>+    void callTheAdoptionAgency(AtomicHTMLToken&amp;);
</ins><span class="cx"> 
</span><span class="cx">     void closeTheCell();
</span><span class="cx"> 
</span><del>-    template &lt;bool shouldClose(const HTMLStackItem*)&gt;
-    void processCloseWhenNestedTag(AtomicHTMLToken*);
</del><ins>+    template &lt;bool shouldClose(const HTMLStackItem&amp;)&gt; void processCloseWhenNestedTag(AtomicHTMLToken&amp;);
</ins><span class="cx"> 
</span><del>-    void parseError(AtomicHTMLToken*);
</del><ins>+    void parseError(AtomicHTMLToken&amp;);
</ins><span class="cx"> 
</span><del>-    InsertionMode insertionMode() const { return m_insertionMode; }
-    void setInsertionMode(InsertionMode mode) { m_insertionMode = mode; }
-
</del><span class="cx">     void resetInsertionModeAppropriately();
</span><span class="cx"> 
</span><span class="cx"> #if ENABLE(TEMPLATE_ELEMENT)
</span><del>-    void processTemplateStartTag(AtomicHTMLToken*);
-    bool processTemplateEndTag(AtomicHTMLToken*);
-    bool processEndOfFileForInTemplateContents(AtomicHTMLToken*);
</del><ins>+    void processTemplateStartTag(AtomicHTMLToken&amp;);
+    bool processTemplateEndTag(AtomicHTMLToken&amp;);
+    bool processEndOfFileForInTemplateContents(AtomicHTMLToken&amp;);
</ins><span class="cx"> #endif
</span><span class="cx"> 
</span><span class="cx">     class FragmentParsingContext {
</span><del>-        WTF_MAKE_NONCOPYABLE(FragmentParsingContext);
</del><span class="cx">     public:
</span><span class="cx">         FragmentParsingContext();
</span><del>-        FragmentParsingContext(DocumentFragment&amp;, Element* contextElement);
-        ~FragmentParsingContext();
</del><ins>+        FragmentParsingContext(DocumentFragment&amp;, Element&amp; contextElement);
</ins><span class="cx"> 
</span><del>-        DocumentFragment* fragment() const { return m_fragment; }
-        Element* contextElement() const { ASSERT(m_fragment); return m_contextElementStackItem-&gt;element(); }
-        HTMLStackItem* contextElementStackItem() const { ASSERT(m_fragment); return m_contextElementStackItem.get(); }
</del><ins>+        DocumentFragment* fragment() const;
+        Element&amp; contextElement() const;
+        HTMLStackItem&amp; contextElementStackItem() const;
</ins><span class="cx"> 
</span><span class="cx">     private:
</span><del>-        DocumentFragment* m_fragment;
</del><ins>+        DocumentFragment* m_fragment { nullptr };
</ins><span class="cx">         RefPtr&lt;HTMLStackItem&gt; m_contextElementStackItem;
</span><span class="cx">     };
</span><span class="cx"> 
</span><del>-    bool m_framesetOk;
-#ifndef NDEBUG
-    bool m_isAttached;
-#endif
-    FragmentParsingContext m_fragmentContext;
</del><ins>+    const HTMLDocumentParser&amp; m_parser;
+    const HTMLParserOptions m_options;
+    const FragmentParsingContext m_fragmentContext;
+
</ins><span class="cx">     HTMLConstructionSite m_tree;
</span><span class="cx"> 
</span><del>-    // http://www.whatwg.org/specs/web-apps/current-work/multipage/parsing.html#insertion-mode
-    InsertionMode m_insertionMode;
-
-    // http://www.whatwg.org/specs/web-apps/current-work/multipage/parsing.html#original-insertion-mode
-    InsertionMode m_originalInsertionMode;
-
</del><ins>+    // https://html.spec.whatwg.org/multipage/syntax.html#the-insertion-mode
+    InsertionMode m_insertionMode { InsertionMode::Initial };
+    InsertionMode m_originalInsertionMode { InsertionMode::Initial };
</ins><span class="cx"> #if ENABLE(TEMPLATE_ELEMENT)
</span><del>-    Vector&lt;InsertionMode&gt; m_templateInsertionModes;
</del><ins>+    Vector&lt;InsertionMode, 1&gt; m_templateInsertionModes;
</ins><span class="cx"> #endif
</span><span class="cx"> 
</span><del>-    // http://www.whatwg.org/specs/web-apps/current-work/multipage/tokenization.html#pending-table-character-tokens
</del><ins>+    // https://html.spec.whatwg.org/multipage/syntax.html#concept-pending-table-char-tokens
</ins><span class="cx">     StringBuilder m_pendingTableCharacters;
</span><span class="cx"> 
</span><del>-    bool m_shouldSkipLeadingNewline;
-
-    // We access parser because HTML5 spec requires that we be able to change the state of the tokenizer
-    // from within parser actions. We also need it to track the current position.
-    HTMLDocumentParser&amp; m_parser;
-
</del><span class="cx">     RefPtr&lt;Element&gt; m_scriptToProcess; // &lt;script&gt; tag which needs processing before resuming the parser.
</span><span class="cx">     TextPosition m_scriptToProcessStartPosition; // Starting line number of the script tag needing processing.
</span><span class="cx"> 
</span><del>-    HTMLParserOptions m_options;
</del><ins>+    bool m_shouldSkipLeadingNewline { false };
+
+    bool m_framesetOk { true };
+
+#if !ASSERT_DISABLED
+    bool m_destroyed { false };
+    bool m_destructionProhibited { true };
+#endif
</ins><span class="cx"> };
</span><span class="cx"> 
</span><ins>+inline HTMLTreeBuilder::~HTMLTreeBuilder()
+{
+#if !ASSERT_DISABLED
+    ASSERT(!m_destroyed);
+    ASSERT(!m_destructionProhibited);
+    m_destroyed = true;
+#endif
</ins><span class="cx"> }
</span><span class="cx"> 
</span><ins>+inline void HTMLTreeBuilder::setShouldSkipLeadingNewline(bool shouldSkip)
+{
+    ASSERT(!m_destroyed);
+    m_shouldSkipLeadingNewline = shouldSkip;
+}
+
+inline bool HTMLTreeBuilder::isParsingFragment() const
+{
+    ASSERT(!m_destroyed);
+    return !!m_fragmentContext.fragment();
+}
+
+inline bool HTMLTreeBuilder::hasParserBlockingScript() const
+{
+    ASSERT(!m_destroyed);
+    return !!m_scriptToProcess;
+}
+
+inline DocumentFragment* HTMLTreeBuilder::FragmentParsingContext::fragment() const
+{
+    return m_fragment;
+}
+
+}
+
</ins><span class="cx"> #endif
</span></span></pre></div>
<a id="trunkSourceWebCorehtmlparserTextDocumentParsercpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/html/parser/TextDocumentParser.cpp (177862 => 177863)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/html/parser/TextDocumentParser.cpp        2015-01-02 18:07:48 UTC (rev 177862)
+++ trunk/Source/WebCore/html/parser/TextDocumentParser.cpp        2015-01-02 18:17:05 UTC (rev 177863)
</span><span class="lines">@@ -59,7 +59,7 @@
</span><span class="cx">     Vector&lt;Attribute&gt; attributes;
</span><span class="cx">     attributes.append(Attribute(styleAttr, &quot;word-wrap: break-word; white-space: pre-wrap;&quot;));
</span><span class="cx">     AtomicHTMLToken fakePre(HTMLToken::StartTag, preTag.localName(), attributes);
</span><del>-    treeBuilder()-&gt;constructTree(&amp;fakePre);
</del><ins>+    treeBuilder()-&gt;constructTree(fakePre);
</ins><span class="cx"> 
</span><span class="cx">     // Normally we would skip the first \n after a &lt;pre&gt; element, but we don't
</span><span class="cx">     // want to skip the first \n for text documents!
</span></span></pre>
</div>
</div>

</body>
</html>