Imported WebKit commit 0fbd41c4e13f5a190faf160bf993eee614e6e18e (http://svn.webkit.org/repository/webkit/trunk@123477)

New snapshot that adapts to latest Qt API changes

11 files changed, 760 insertions, 669 deletions

diff --git a/Source/WebCore/html/parser/HTMLConstructionSite.cpp b/Source/WebCore/html/parser/HTMLConstructionSite.cpp
index 9454f5fd9..cc8bc29d2 100644
--- a/Source/WebCore/html/parser/HTMLConstructionSite.cpp
+++ b/Source/WebCore/html/parser/HTMLConstructionSite.cpp
@@ -39,6 +39,7 @@
 #include "HTMLNames.h"
 #include "HTMLParserIdioms.h"
 #include "HTMLScriptElement.h"
+#include "HTMLStackItem.h"
 #include "HTMLToken.h"
 #include "HTMLTokenizer.h"
 #include "LocalizedStrings.h"
@@ -192,33 +193,33 @@ void HTMLConstructionSite::dispatchDocumentElementAvailableIfNeeded()
         m_document->frame()->loader()->dispatchDocumentElementAvailable();
 }
 
-void HTMLConstructionSite::insertHTMLHtmlStartTagBeforeHTML(AtomicHTMLToken& token)
+void HTMLConstructionSite::insertHTMLHtmlStartTagBeforeHTML(AtomicHTMLToken* token)
 {
     RefPtr<HTMLHtmlElement> element = HTMLHtmlElement::create(m_document);
-    element->parserSetAttributes(token.attributes(), m_fragmentScriptingPermission);
+    element->parserSetAttributes(token->attributes(), m_fragmentScriptingPermission);
     attachLater(m_attachmentRoot, element);
-    m_openElements.pushHTMLHtmlElement(element);
+    m_openElements.pushHTMLHtmlElement(HTMLStackItem::create(element, token));
 
     executeQueuedTasks();
     element->insertedByParser();
     dispatchDocumentElementAvailableIfNeeded();
 }
 
-void HTMLConstructionSite::mergeAttributesFromTokenIntoElement(AtomicHTMLToken& token, Element* element)
+void HTMLConstructionSite::mergeAttributesFromTokenIntoElement(AtomicHTMLToken* token, Element* element)
 {
-    if (token.attributes().isEmpty())
+    if (token->attributes().isEmpty())
         return;
 
     ElementAttributeData* elementAttributeData = element->ensureAttributeData();
 
-    for (unsigned i = 0; i < token.attributes().size(); ++i) {
-        const Attribute& tokenAttribute = token.attributes().at(i);
+    for (unsigned i = 0; i < token->attributes().size(); ++i) {
+        const Attribute& tokenAttribute = token->attributes().at(i);
         if (!elementAttributeData->getAttributeItem(tokenAttribute.name()))
             element->setAttribute(tokenAttribute.name(), tokenAttribute.value());
     }
 }
 
-void HTMLConstructionSite::insertHTMLHtmlStartTagInBody(AtomicHTMLToken& token)
+void HTMLConstructionSite::insertHTMLHtmlStartTagInBody(AtomicHTMLToken* token)
 {
     // Fragments do not have a root HTML element, so any additional HTML elements
     // encountered during fragment parsing should be ignored.
@@ -228,16 +229,16 @@ void HTMLConstructionSite::insertHTMLHtmlStartTagInBody(AtomicHTMLToken& token)
     mergeAttributesFromTokenIntoElement(token, m_openElements.htmlElement());
 }
 
-void HTMLConstructionSite::insertHTMLBodyStartTagInBody(AtomicHTMLToken& token)
+void HTMLConstructionSite::insertHTMLBodyStartTagInBody(AtomicHTMLToken* token)
 {
     mergeAttributesFromTokenIntoElement(token, m_openElements.bodyElement());
 }
 
-void HTMLConstructionSite::insertDoctype(AtomicHTMLToken& token)
+void HTMLConstructionSite::insertDoctype(AtomicHTMLToken* token)
 {
-    ASSERT(token.type() == HTMLTokenTypes::DOCTYPE);
+    ASSERT(token->type() == HTMLTokenTypes::DOCTYPE);
 
-    RefPtr<DocumentType> doctype = DocumentType::create(m_document, token.name(), String::adopt(token.publicIdentifier()), String::adopt(token.systemIdentifier()));
+    RefPtr<DocumentType> doctype = DocumentType::create(m_document, token->name(), String::adopt(token->publicIdentifier()), String::adopt(token->systemIdentifier()));
     attachLater(m_attachmentRoot, doctype.release());
 
     // DOCTYPE nodes are only processed when parsing fragments w/o contextElements, which
@@ -249,7 +250,7 @@ void HTMLConstructionSite::insertDoctype(AtomicHTMLToken& token)
     if (m_isParsingFragment)
         return;
 
-    if (token.forceQuirks())
+    if (token->forceQuirks())
         m_document->setCompatibilityMode(Document::QuirksMode);
     else {
         // We need to actually add the Doctype node to the DOM.
@@ -258,61 +259,61 @@ void HTMLConstructionSite::insertDoctype(AtomicHTMLToken& token)
     }
 }
 
-void HTMLConstructionSite::insertComment(AtomicHTMLToken& token)
+void HTMLConstructionSite::insertComment(AtomicHTMLToken* token)
 {
-    ASSERT(token.type() == HTMLTokenTypes::Comment);
-    attachLater(currentNode(), Comment::create(currentNode()->document(), token.comment()));
+    ASSERT(token->type() == HTMLTokenTypes::Comment);
+    attachLater(currentNode(), Comment::create(currentNode()->document(), token->comment()));
 }
 
-void HTMLConstructionSite::insertCommentOnDocument(AtomicHTMLToken& token)
+void HTMLConstructionSite::insertCommentOnDocument(AtomicHTMLToken* token)
 {
-    ASSERT(token.type() == HTMLTokenTypes::Comment);
-    attachLater(m_attachmentRoot, Comment::create(m_document, token.comment()));
+    ASSERT(token->type() == HTMLTokenTypes::Comment);
+    attachLater(m_attachmentRoot, Comment::create(m_document, token->comment()));
 }
 
-void HTMLConstructionSite::insertCommentOnHTMLHtmlElement(AtomicHTMLToken& token)
+void HTMLConstructionSite::insertCommentOnHTMLHtmlElement(AtomicHTMLToken* token)
 {
-    ASSERT(token.type() == HTMLTokenTypes::Comment);
+    ASSERT(token->type() == HTMLTokenTypes::Comment);
     ContainerNode* parent = m_openElements.rootNode();
-    attachLater(parent, Comment::create(parent->document(), token.comment()));
+    attachLater(parent, Comment::create(parent->document(), token->comment()));
 }
 
-void HTMLConstructionSite::insertHTMLHeadElement(AtomicHTMLToken& token)
+void HTMLConstructionSite::insertHTMLHeadElement(AtomicHTMLToken* token)
 {
     ASSERT(!shouldFosterParent());
     m_head = createHTMLElement(token);
     attachLater(currentNode(), m_head);
-    m_openElements.pushHTMLHeadElement(m_head);
+    m_openElements.pushHTMLHeadElement(HTMLStackItem::create(m_head, token));
 }
 
-void HTMLConstructionSite::insertHTMLBodyElement(AtomicHTMLToken& token)
+void HTMLConstructionSite::insertHTMLBodyElement(AtomicHTMLToken* token)
 {
     ASSERT(!shouldFosterParent());
     RefPtr<Element> body = createHTMLElement(token);
     attachLater(currentNode(), body);
-    m_openElements.pushHTMLBodyElement(body.release());
+    m_openElements.pushHTMLBodyElement(HTMLStackItem::create(body.release(), token));
 }
 
-void HTMLConstructionSite::insertHTMLFormElement(AtomicHTMLToken& token, bool isDemoted)
+void HTMLConstructionSite::insertHTMLFormElement(AtomicHTMLToken* token, bool isDemoted)
 {
     RefPtr<Element> element = createHTMLElement(token);
     ASSERT(element->hasTagName(formTag));
     m_form = static_pointer_cast<HTMLFormElement>(element.release());
     m_form->setDemoted(isDemoted);
     attachLater(currentNode(), m_form);
-    m_openElements.push(m_form);
+    m_openElements.push(HTMLStackItem::create(m_form, token));
 }
 
-void HTMLConstructionSite::insertHTMLElement(AtomicHTMLToken& token)
+void HTMLConstructionSite::insertHTMLElement(AtomicHTMLToken* token)
 {
     RefPtr<Element> element = createHTMLElement(token);
     attachLater(currentNode(), element);
-    m_openElements.push(element.release());
+    m_openElements.push(HTMLStackItem::create(element.release(), token));
 }
 
-void HTMLConstructionSite::insertSelfClosingHTMLElement(AtomicHTMLToken& token)
+void HTMLConstructionSite::insertSelfClosingHTMLElement(AtomicHTMLToken* token)
 {
-    ASSERT(token.type() == HTMLTokenTypes::StartTag);
+    ASSERT(token->type() == HTMLTokenTypes::StartTag);
     // Normally HTMLElementStack is responsible for calling finishParsingChildren,
     // but self-closing elements are never in the element stack so the stack
     // doesn't get a chance to tell them that we're done parsing their children.
@@ -321,16 +322,16 @@ void HTMLConstructionSite::insertSelfClosingHTMLElement(AtomicHTMLToken& token)
     // http://www.whatwg.org/specs/web-apps/current-work/multipage/tokenization.html#acknowledge-self-closing-flag
 }
 
-void HTMLConstructionSite::insertFormattingElement(AtomicHTMLToken& token)
+void HTMLConstructionSite::insertFormattingElement(AtomicHTMLToken* token)
 {
     // http://www.whatwg.org/specs/web-apps/current-work/multipage/parsing.html#the-stack-of-open-elements
     // Possible active formatting elements include:
     // a, b, big, code, em, font, i, nobr, s, small, strike, strong, tt, and u.
     insertHTMLElement(token);
-    m_activeFormattingElements.append(currentElement());
+    m_activeFormattingElements.append(currentElementRecord()->stackItem());
 }
 
-void HTMLConstructionSite::insertScriptElement(AtomicHTMLToken& token)
+void HTMLConstructionSite::insertScriptElement(AtomicHTMLToken* token)
 {
     // http://www.whatwg.org/specs/web-apps/current-work/multipage/scripting-1.html#already-started
     // http://html5.org/specs/dom-parsing.html#dom-range-createcontextualfragment
@@ -341,20 +342,20 @@ void HTMLConstructionSite::insertScriptElement(AtomicHTMLToken& token)
     const bool alreadyStarted = m_isParsingFragment && parserInserted;
     RefPtr<HTMLScriptElement> element = HTMLScriptElement::create(scriptTag, currentNode()->document(), parserInserted, alreadyStarted);
     if (m_fragmentScriptingPermission != DisallowScriptingContent)
-        element->parserSetAttributes(token.attributes(), m_fragmentScriptingPermission);
+        element->parserSetAttributes(token->attributes(), m_fragmentScriptingPermission);
     attachLater(currentNode(), element);
-    m_openElements.push(element.release());
+    m_openElements.push(HTMLStackItem::create(element.release(), token));
 }
 
-void HTMLConstructionSite::insertForeignElement(AtomicHTMLToken& token, const AtomicString& namespaceURI)
+void HTMLConstructionSite::insertForeignElement(AtomicHTMLToken* token, const AtomicString& namespaceURI)
 {
-    ASSERT(token.type() == HTMLTokenTypes::StartTag);
+    ASSERT(token->type() == HTMLTokenTypes::StartTag);
     notImplemented(); // parseError when xmlns or xmlns:xlink are wrong.
 
     RefPtr<Element> element = createElement(token, namespaceURI);
-    attachLater(currentNode(), element, token.selfClosing());
-    if (!token.selfClosing())
-        m_openElements.push(element.release());
+    attachLater(currentNode(), element, token->selfClosing());
+    if (!token->selfClosing())
+        m_openElements.push(HTMLStackItem::create(element.release(), token, namespaceURI));
 }
 
 void HTMLConstructionSite::insertTextNode(const String& characters, WhitespaceMode whitespaceMode)
@@ -398,48 +399,34 @@ void HTMLConstructionSite::insertTextNode(const String& characters, WhitespaceMo
     }
 }
 
-PassRefPtr<Element> HTMLConstructionSite::createElement(AtomicHTMLToken& token, const AtomicString& namespaceURI)
+PassRefPtr<Element> HTMLConstructionSite::createElement(AtomicHTMLToken* token, const AtomicString& namespaceURI)
 {
-    QualifiedName tagName(nullAtom, token.name(), namespaceURI);
+    QualifiedName tagName(nullAtom, token->name(), namespaceURI);
     RefPtr<Element> element = currentNode()->document()->createElement(tagName, true);
-    element->parserSetAttributes(token.attributes(), m_fragmentScriptingPermission);
+    element->parserSetAttributes(token->attributes(), m_fragmentScriptingPermission);
     return element.release();
 }
 
-PassRefPtr<Element> HTMLConstructionSite::createHTMLElement(AtomicHTMLToken& token)
+PassRefPtr<Element> HTMLConstructionSite::createHTMLElement(AtomicHTMLToken* token)
 {
-    QualifiedName tagName(nullAtom, token.name(), xhtmlNamespaceURI);
+    QualifiedName tagName(nullAtom, token->name(), xhtmlNamespaceURI);
     // FIXME: This can't use HTMLConstructionSite::createElement because we
     // have to pass the current form element.  We should rework form association
     // to occur after construction to allow better code sharing here.
     RefPtr<Element> element = HTMLElementFactory::createHTMLElement(tagName, currentNode()->document(), form(), true);
-    element->parserSetAttributes(token.attributes(), m_fragmentScriptingPermission);
+    element->parserSetAttributes(token->attributes(), m_fragmentScriptingPermission);
     ASSERT(element->isHTMLElement());
     return element.release();
 }
 
-PassRefPtr<Element> HTMLConstructionSite::createHTMLElementFromElementRecord(HTMLElementStack::ElementRecord* record)
+PassRefPtr<HTMLStackItem> HTMLConstructionSite::createElementFromSavedToken(HTMLStackItem* item)
 {
-    return createHTMLElementFromSavedElement(record->element());
-}
-
-PassRefPtr<Element> HTMLConstructionSite::createHTMLElementFromSavedElement(Element* element)
-{
-    // FIXME: This method is wrong.  We should be using the original token.
-    // Using an Element* causes us to fail examples like this:
-    // <b id="1"><p><script>document.getElementById("1").id = "2"</script></p>TEXT</b>
-    // When reconstructTheActiveFormattingElements calls this method to open
-    // a second <b> tag to wrap TEXT, it will have id "2", even though the HTML5
-    // spec implies it should be "1".  Minefield matches the HTML5 spec here.
-
-    ASSERT(element->isHTMLElement()); // otherwise localName() might be wrong.
-
-    Vector<Attribute> clonedAttributes;
-    if (ElementAttributeData* attributeData = element->updatedAttributeData())
-        clonedAttributes = attributeData->clonedAttributeVector();
-
-    AtomicHTMLToken fakeToken(HTMLTokenTypes::StartTag, element->localName(), clonedAttributes);
-    return createHTMLElement(fakeToken);
+    RefPtr<Element> element;
+    if (item->namespaceURI() == HTMLNames::xhtmlNamespaceURI)
+        element = createHTMLElement(item->token());
+    else
+        element = createElement(item->token(), item->namespaceURI());
+    return HTMLStackItem::create(element.release(), item->token(), item->namespaceURI());
 }
 
 bool HTMLConstructionSite::indexOfFirstUnopenFormattingElement(unsigned& firstUnopenElementIndex) const
@@ -469,10 +456,10 @@ void HTMLConstructionSite::reconstructTheActiveFormattingElements()
     ASSERT(unopenEntryIndex < m_activeFormattingElements.size());
     for (; unopenEntryIndex < m_activeFormattingElements.size(); ++unopenEntryIndex) {
         HTMLFormattingElementList::Entry& unopenedEntry = m_activeFormattingElements.at(unopenEntryIndex);
-        RefPtr<Element> reconstructed = createHTMLElementFromSavedElement(unopenedEntry.element());
-        attachLater(currentNode(), reconstructed);
-        m_openElements.push(reconstructed.release());
-        unopenedEntry.replaceElement(currentElement());
+        RefPtr<HTMLStackItem> reconstructed = createElementFromSavedToken(unopenedEntry.stackItem().get());
+        attachLater(currentNode(), reconstructed->node());
+        m_openElements.push(reconstructed);
+        unopenedEntry.replaceElement(reconstructed.release());
     }
 }
 
diff --git a/Source/WebCore/html/parser/HTMLConstructionSite.h b/Source/WebCore/html/parser/HTMLConstructionSite.h
index 367c0fe26..a43668b1a 100644
--- a/Source/WebCore/html/parser/HTMLConstructionSite.h
+++ b/Source/WebCore/html/parser/HTMLConstructionSite.h
@@ -87,26 +87,26 @@ public:
     void detach();
     void executeQueuedTasks();
 
-    void insertDoctype(AtomicHTMLToken&);
-    void insertComment(AtomicHTMLToken&);
-    void insertCommentOnDocument(AtomicHTMLToken&);
-    void insertCommentOnHTMLHtmlElement(AtomicHTMLToken&);
-    void insertHTMLElement(AtomicHTMLToken&);
-    void insertSelfClosingHTMLElement(AtomicHTMLToken&);
-    void insertFormattingElement(AtomicHTMLToken&);
-    void insertHTMLHeadElement(AtomicHTMLToken&);
-    void insertHTMLBodyElement(AtomicHTMLToken&);
-    void insertHTMLFormElement(AtomicHTMLToken&, bool isDemoted = false);
-    void insertScriptElement(AtomicHTMLToken&);
+    void insertDoctype(AtomicHTMLToken*);
+    void insertComment(AtomicHTMLToken*);
+    void insertCommentOnDocument(AtomicHTMLToken*);
+    void insertCommentOnHTMLHtmlElement(AtomicHTMLToken*);
+    void insertHTMLElement(AtomicHTMLToken*);
+    void insertSelfClosingHTMLElement(AtomicHTMLToken*);
+    void insertFormattingElement(AtomicHTMLToken*);
+    void insertHTMLHeadElement(AtomicHTMLToken*);
+    void insertHTMLBodyElement(AtomicHTMLToken*);
+    void insertHTMLFormElement(AtomicHTMLToken*, bool isDemoted = false);
+    void insertScriptElement(AtomicHTMLToken*);
     void insertTextNode(const String&, WhitespaceMode = WhitespaceUnknown);
-    void insertForeignElement(AtomicHTMLToken&, const AtomicString& namespaceURI);
+    void insertForeignElement(AtomicHTMLToken*, const AtomicString& namespaceURI);
 
-    void insertHTMLHtmlStartTagBeforeHTML(AtomicHTMLToken&);
-    void insertHTMLHtmlStartTagInBody(AtomicHTMLToken&);
-    void insertHTMLBodyStartTagInBody(AtomicHTMLToken&);
+    void insertHTMLHtmlStartTagBeforeHTML(AtomicHTMLToken*);
+    void insertHTMLHtmlStartTagInBody(AtomicHTMLToken*);
+    void insertHTMLBodyStartTagInBody(AtomicHTMLToken*);
 
-    PassRefPtr<Element> createHTMLElement(AtomicHTMLToken&);
-    PassRefPtr<Element> createHTMLElementFromElementRecord(HTMLElementStack::ElementRecord*);
+    PassRefPtr<Element> createHTMLElement(AtomicHTMLToken*);
+    PassRefPtr<HTMLStackItem> createElementFromSavedToken(HTMLStackItem*);
 
     bool shouldFosterParent() const;
     void fosterParent(PassRefPtr<Node>);
@@ -118,6 +118,7 @@ public:
     void generateImpliedEndTagsWithExclusion(const AtomicString& tagName);
 
     bool isEmpty() const { return !m_openElements.stackDepth(); }
+    HTMLElementStack::ElementRecord* currentElementRecord() const { return m_openElements.topRecord(); }
     Element* currentElement() const { return m_openElements.top(); }
     ContainerNode* currentNode() const { return m_openElements.topNode(); }
     Element* oneBelowTop() const { return m_openElements.oneBelowTop(); }
@@ -160,10 +161,9 @@ private:
 
     void findFosterSite(HTMLConstructionSiteTask&);
 
-    PassRefPtr<Element> createHTMLElementFromSavedElement(Element*);
-    PassRefPtr<Element> createElement(AtomicHTMLToken&, const AtomicString& namespaceURI);
+    PassRefPtr<Element> createElement(AtomicHTMLToken*, const AtomicString& namespaceURI);
 
-    void mergeAttributesFromTokenIntoElement(AtomicHTMLToken&, Element*);
+    void mergeAttributesFromTokenIntoElement(AtomicHTMLToken*, Element*);
     void dispatchDocumentElementAvailableIfNeeded();
 
     Document* m_document;
diff --git a/Source/WebCore/html/parser/HTMLElementStack.cpp b/Source/WebCore/html/parser/HTMLElementStack.cpp
index cd5d08a55..7acab9ae7 100644
--- a/Source/WebCore/html/parser/HTMLElementStack.cpp
+++ b/Source/WebCore/html/parser/HTMLElementStack.cpp
@@ -125,23 +125,23 @@ inline bool isSelectScopeMarker(ContainerNode* node)
 
 }
 
-HTMLElementStack::ElementRecord::ElementRecord(PassRefPtr<ContainerNode> node, PassOwnPtr<ElementRecord> next)
-    : m_node(node)
+HTMLElementStack::ElementRecord::ElementRecord(PassRefPtr<HTMLStackItem> item, PassOwnPtr<ElementRecord> next)
+    : m_item(item)
     , m_next(next)
 {
-    ASSERT(m_node);
+    ASSERT(m_item);
 }
 
 HTMLElementStack::ElementRecord::~ElementRecord()
 {
 }
 
-void HTMLElementStack::ElementRecord::replaceElement(PassRefPtr<Element> element)
+void HTMLElementStack::ElementRecord::replaceElement(PassRefPtr<HTMLStackItem> item)
 {
-    ASSERT(element);
-    ASSERT(!m_node || m_node->isElementNode());
+    ASSERT(item);
+    ASSERT(!m_item || m_item->node()->isElementNode());
     // FIXME: Should this call finishParsingChildren?
-    m_node = element;
+    m_item = item;
 }
 
 bool HTMLElementStack::ElementRecord::isAbove(ElementRecord* other) const
@@ -307,62 +307,62 @@ void HTMLElementStack::popUntilForeignContentScopeMarker()
         pop();
 }
     
-void HTMLElementStack::pushRootNode(PassRefPtr<ContainerNode> rootNode)
+void HTMLElementStack::pushRootNode(PassRefPtr<HTMLStackItem> rootItem)
 {
-    ASSERT(rootNode->nodeType() == Node::DOCUMENT_FRAGMENT_NODE);
-    pushRootNodeCommon(rootNode);
+    ASSERT(rootItem->node()->nodeType() == Node::DOCUMENT_FRAGMENT_NODE);
+    pushRootNodeCommon(rootItem);
 }
 
-void HTMLElementStack::pushHTMLHtmlElement(PassRefPtr<Element> element)
+void HTMLElementStack::pushHTMLHtmlElement(PassRefPtr<HTMLStackItem> item)
 {
-    ASSERT(element->hasTagName(HTMLNames::htmlTag));
-    pushRootNodeCommon(element);
+    ASSERT(item->element()->hasTagName(HTMLNames::htmlTag));
+    pushRootNodeCommon(item);
 }
     
-void HTMLElementStack::pushRootNodeCommon(PassRefPtr<ContainerNode> rootNode)
+void HTMLElementStack::pushRootNodeCommon(PassRefPtr<HTMLStackItem> rootItem)
 {
     ASSERT(!m_top);
     ASSERT(!m_rootNode);
-    m_rootNode = rootNode.get();
-    pushCommon(rootNode);
+    m_rootNode = rootItem->node();
+    pushCommon(rootItem);
 }
 
-void HTMLElementStack::pushHTMLHeadElement(PassRefPtr<Element> element)
+void HTMLElementStack::pushHTMLHeadElement(PassRefPtr<HTMLStackItem> item)
 {
-    ASSERT(element->hasTagName(HTMLNames::headTag));
+    ASSERT(item->element()->hasTagName(HTMLNames::headTag));
     ASSERT(!m_headElement);
-    m_headElement = element.get();
-    pushCommon(element);
+    m_headElement = item->element();
+    pushCommon(item);
 }
 
-void HTMLElementStack::pushHTMLBodyElement(PassRefPtr<Element> element)
+void HTMLElementStack::pushHTMLBodyElement(PassRefPtr<HTMLStackItem> item)
 {
-    ASSERT(element->hasTagName(HTMLNames::bodyTag));
+    ASSERT(item->element()->hasTagName(HTMLNames::bodyTag));
     ASSERT(!m_bodyElement);
-    m_bodyElement = element.get();
-    pushCommon(element);
+    m_bodyElement = item->element();
+    pushCommon(item);
 }
 
-void HTMLElementStack::push(PassRefPtr<Element> element)
+void HTMLElementStack::push(PassRefPtr<HTMLStackItem> item)
 {
-    ASSERT(!element->hasTagName(HTMLNames::htmlTag));
-    ASSERT(!element->hasTagName(HTMLNames::headTag));
-    ASSERT(!element->hasTagName(HTMLNames::bodyTag));
+    ASSERT(!item->element()->hasTagName(HTMLNames::htmlTag));
+    ASSERT(!item->element()->hasTagName(HTMLNames::headTag));
+    ASSERT(!item->element()->hasTagName(HTMLNames::bodyTag));
     ASSERT(m_rootNode);
-    pushCommon(element);
+    pushCommon(item);
 }
 
-void HTMLElementStack::insertAbove(PassRefPtr<Element> element, ElementRecord* recordBelow)
+void HTMLElementStack::insertAbove(PassRefPtr<HTMLStackItem> item, ElementRecord* recordBelow)
 {
-    ASSERT(element);
+    ASSERT(item);
     ASSERT(recordBelow);
     ASSERT(m_top);
-    ASSERT(!element->hasTagName(HTMLNames::htmlTag));
-    ASSERT(!element->hasTagName(HTMLNames::headTag));
-    ASSERT(!element->hasTagName(HTMLNames::bodyTag));
+    ASSERT(!item->element()->hasTagName(HTMLNames::htmlTag));
+    ASSERT(!item->element()->hasTagName(HTMLNames::headTag));
+    ASSERT(!item->element()->hasTagName(HTMLNames::bodyTag));
     ASSERT(m_rootNode);
     if (recordBelow == m_top) {
-        push(element);
+        push(item);
         return;
     }
 
@@ -371,7 +371,7 @@ void HTMLElementStack::insertAbove(PassRefPtr<Element> element, ElementRecord* r
             continue;
 
         m_stackDepth++;
-        recordAbove->setNext(adoptPtr(new ElementRecord(element, recordAbove->releaseNext())));
+        recordAbove->setNext(adoptPtr(new ElementRecord(item, recordAbove->releaseNext())));
         recordAbove->next()->element()->beginParsingChildren();
         return;
     }
@@ -567,12 +567,12 @@ ContainerNode* HTMLElementStack::rootNode() const
     return m_rootNode;
 }
 
-void HTMLElementStack::pushCommon(PassRefPtr<ContainerNode> node)
+void HTMLElementStack::pushCommon(PassRefPtr<HTMLStackItem> item)
 {
     ASSERT(m_rootNode);
 
     m_stackDepth++;
-    m_top = adoptPtr(new ElementRecord(node, m_top.release()));
+    m_top = adoptPtr(new ElementRecord(item, m_top.release()));
 }
 
 void HTMLElementStack::popCommon()
diff --git a/Source/WebCore/html/parser/HTMLElementStack.h b/Source/WebCore/html/parser/HTMLElementStack.h
index f7baa3644..6e3125130 100644
--- a/Source/WebCore/html/parser/HTMLElementStack.h
+++ b/Source/WebCore/html/parser/HTMLElementStack.h
@@ -29,6 +29,7 @@
 
 #include "Element.h"
 #include "HTMLNames.h"
+#include "HTMLStackItem.h"
 #include <wtf/Forward.h>
 #include <wtf/Noncopyable.h>
 #include <wtf/OwnPtr.h>
@@ -55,23 +56,23 @@ public:
     public:
         ~ElementRecord(); // Public for ~PassOwnPtr()
     
-        Element* element() const { return toElement(m_node.get()); }
-        ContainerNode* node() const { return m_node.get(); }
-        void replaceElement(PassRefPtr<Element>);
+        Element* element() const { return m_item->element(); }
+        ContainerNode* node() const { return m_item->node(); }
+        PassRefPtr<HTMLStackItem> stackItem() const { return m_item; }
+        void replaceElement(PassRefPtr<HTMLStackItem>);
 
         bool isAbove(ElementRecord*) const;
 
         ElementRecord* next() const { return m_next.get(); }
-
     private:
         friend class HTMLElementStack;
 
-        ElementRecord(PassRefPtr<ContainerNode>, PassOwnPtr<ElementRecord>);
+        ElementRecord(PassRefPtr<HTMLStackItem>, PassOwnPtr<ElementRecord>);
 
         PassOwnPtr<ElementRecord> releaseNext() { return m_next.release(); }
         void setNext(PassOwnPtr<ElementRecord> next) { m_next = next; }
 
-        RefPtr<ContainerNode> m_node;
+        RefPtr<HTMLStackItem> m_item;
         OwnPtr<ElementRecord> m_next;
     };
 
@@ -97,13 +98,13 @@ public:
     ElementRecord* find(Element*) const;
     ElementRecord* topmost(const AtomicString& tagName) const;
 
-    void insertAbove(PassRefPtr<Element>, ElementRecord*);
+    void insertAbove(PassRefPtr<HTMLStackItem>, ElementRecord*);
 
-    void push(PassRefPtr<Element>);
-    void pushRootNode(PassRefPtr<ContainerNode>);
-    void pushHTMLHtmlElement(PassRefPtr<Element>);
-    void pushHTMLHeadElement(PassRefPtr<Element>);
-    void pushHTMLBodyElement(PassRefPtr<Element>);
+    void push(PassRefPtr<HTMLStackItem>);
+    void pushRootNode(PassRefPtr<HTMLStackItem>);
+    void pushHTMLHtmlElement(PassRefPtr<HTMLStackItem>);
+    void pushHTMLHeadElement(PassRefPtr<HTMLStackItem>);
+    void pushHTMLBodyElement(PassRefPtr<HTMLStackItem>);
 
     void pop();
     void popUntil(const AtomicString& tagName);
@@ -156,8 +157,8 @@ public:
 #endif
 
 private:
-    void pushCommon(PassRefPtr<ContainerNode>);
-    void pushRootNodeCommon(PassRefPtr<ContainerNode>);
+    void pushCommon(PassRefPtr<HTMLStackItem>);
+    void pushRootNodeCommon(PassRefPtr<HTMLStackItem>);
     void popCommon();
     void removeNonTopCommon(Element*);
 
diff --git a/Source/WebCore/html/parser/HTMLFormattingElementList.cpp b/Source/WebCore/html/parser/HTMLFormattingElementList.cpp
index 0145de0e6..b42cebd6b 100644
--- a/Source/WebCore/html/parser/HTMLFormattingElementList.cpp
+++ b/Source/WebCore/html/parser/HTMLFormattingElementList.cpp
@@ -87,25 +87,25 @@ HTMLFormattingElementList::Bookmark HTMLFormattingElementList::bookmarkFor(Eleme
     return Bookmark(&at(index));
 }
 
-void HTMLFormattingElementList::swapTo(Element* oldElement, Element* newElement, const Bookmark& bookmark)
+void HTMLFormattingElementList::swapTo(Element* oldElement, PassRefPtr<HTMLStackItem> newItem, const Bookmark& bookmark)
 {
     ASSERT(contains(oldElement));
-    ASSERT(!contains(newElement));
+    ASSERT(!contains(newItem->element()));
     if (!bookmark.hasBeenMoved()) {
         ASSERT(bookmark.mark()->element() == oldElement);
-        bookmark.mark()->replaceElement(newElement);
+        bookmark.mark()->replaceElement(newItem);
         return;
     }
     size_t index = bookmark.mark() - first();
     ASSERT(index < size());
-    m_entries.insert(index + 1, newElement);
+    m_entries.insert(index + 1, newItem);
     remove(oldElement);
 }
 
-void HTMLFormattingElementList::append(Element* element)
+void HTMLFormattingElementList::append(PassRefPtr<HTMLStackItem> item)
 {
-    ensureNoahsArkCondition(element);
-    m_entries.append(element);
+    ensureNoahsArkCondition(item->element());
+    m_entries.append(item);
 }
 
 void HTMLFormattingElementList::remove(Element* element)
diff --git a/Source/WebCore/html/parser/HTMLFormattingElementList.h b/Source/WebCore/html/parser/HTMLFormattingElementList.h
index 79fe2ff37..9f3545d25 100644
--- a/Source/WebCore/html/parser/HTMLFormattingElementList.h
+++ b/Source/WebCore/html/parser/HTMLFormattingElementList.h
@@ -26,6 +26,7 @@
 #ifndef HTMLFormattingElementList_h
 #define HTMLFormattingElementList_h
 
+#include "HTMLStackItem.h"
 #include <wtf/Forward.h>
 #include <wtf/RefPtr.h>
 #include <wtf/Vector.h>
@@ -47,35 +48,35 @@ public:
     class Entry {
     public:
         // Inline because they're hot and Vector<T> uses them.
-        explicit Entry(Element* element)
-            : m_element(element)
+        explicit Entry(PassRefPtr<HTMLStackItem> item)
+            : m_item(item)
         {
-            ASSERT(element);
         }
         enum MarkerEntryType { MarkerEntry };
         Entry(MarkerEntryType)
-            : m_element(0)
+            : m_item(0)
         {
         }
         ~Entry() {}
 
-        bool isMarker() const { return !m_element; }
+        bool isMarker() const { return !m_item; }
 
+        PassRefPtr<HTMLStackItem> stackItem() const { return m_item; }
         Element* element() const
         {
-            // The fact that !m_element == isMarker() is an implementation detail
+            // The fact that !m_item == isMarker() is an implementation detail
             // callers should check isMarker() before calling element().
-            ASSERT(m_element);
-            return m_element.get();
+            ASSERT(m_item);
+            return m_item->element();
         }
-        void replaceElement(PassRefPtr<Element> element) { m_element = element; }
+        void replaceElement(PassRefPtr<HTMLStackItem> item) { m_item = item; }
 
         // Needed for use with Vector.  These are super-hot and must be inline.
-        bool operator==(Element* element) const { return m_element == element; }
-        bool operator!=(Element* element) const { return m_element != element; }
+        bool operator==(Element* element) const { return !m_item ? !element : m_item->element() == element; }
+        bool operator!=(Element* element) const { return !m_item ? !!element : m_item->element() != element; }
 
     private:
-        RefPtr<Element> m_element;
+        RefPtr<HTMLStackItem> m_item;
     };
 
     class Bookmark {
@@ -107,11 +108,11 @@ public:
 
     Entry* find(Element*);
     bool contains(Element*);
-    void append(Element*);
+    void append(PassRefPtr<HTMLStackItem>);
     void remove(Element*);
 
     Bookmark bookmarkFor(Element*);
-    void swapTo(Element* oldElement, Element* newElement, const Bookmark&);
+    void swapTo(Element* oldElement, PassRefPtr<HTMLStackItem> newItem, const Bookmark&);
 
     void appendMarker();
     // clearToLastMarker also clears the marker (per the HTML5 spec).
diff --git a/Source/WebCore/html/parser/HTMLStackItem.h b/Source/WebCore/html/parser/HTMLStackItem.h
new file mode 100644
index 000000000..7dc760730
--- /dev/null
+++ b/Source/WebCore/html/parser/HTMLStackItem.h
@@ -0,0 +1,85 @@
+/*
+ * Copyright (C) 2012 Company 100, Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY GOOGLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL GOOGLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef HTMLStackItem_h
+#define HTMLStackItem_h
+
+#include "Element.h"
+#include "HTMLNames.h"
+#include "HTMLToken.h"
+
+#include <wtf/RefCounted.h>
+#include <wtf/RefPtr.h>
+#include <wtf/text/AtomicString.h>
+
+namespace WebCore {
+
+class ContainerNode;
+
+class HTMLStackItem : public RefCounted<HTMLStackItem> {
+public:
+    // DocumentFragment case.
+    static PassRefPtr<HTMLStackItem> create(PassRefPtr<ContainerNode> node)
+    {
+        return adoptRef(new HTMLStackItem(node));
+    }
+
+    // Used by HTMLElementStack and HTMLFormattingElementList.
+    static PassRefPtr<HTMLStackItem> create(PassRefPtr<ContainerNode> node, PassRefPtr<AtomicHTMLToken> token, const AtomicString& namespaceURI = HTMLNames::xhtmlNamespaceURI)
+    {
+        return adoptRef(new HTMLStackItem(node, token, namespaceURI));
+    }
+
+    Element* element() const { return toElement(m_node.get()); }
+    ContainerNode* node() const { return m_node.get(); }
+
+    AtomicHTMLToken* token() { return m_token.get(); }
+    const AtomicString& namespaceURI() const { return m_namespaceURI; }
+
+private:
+    HTMLStackItem(PassRefPtr<ContainerNode> node)
+        : m_node(node)
+        , m_isDocumentFragmentNode(true)
+    {
+    }
+
+    HTMLStackItem(PassRefPtr<ContainerNode> node, PassRefPtr<AtomicHTMLToken> token, const AtomicString& namespaceURI = HTMLNames::xhtmlNamespaceURI)
+        : m_node(node)
+        , m_token(token)
+        , m_namespaceURI(namespaceURI)
+        , m_isDocumentFragmentNode(false)
+    {
+    }
+
+    RefPtr<ContainerNode> m_node;
+
+    RefPtr<AtomicHTMLToken> m_token;
+    AtomicString m_namespaceURI;
+    bool m_isDocumentFragmentNode;
+};
+
+} // namespace WebCore
+
+#endif // HTMLStackItem_h
diff --git a/Source/WebCore/html/parser/HTMLToken.h b/Source/WebCore/html/parser/HTMLToken.h
index 3a87e224d..3099c785c 100644
--- a/Source/WebCore/html/parser/HTMLToken.h
+++ b/Source/WebCore/html/parser/HTMLToken.h
@@ -27,6 +27,8 @@
 #define HTMLToken_h
 
 #include "MarkupTokenBase.h"
+#include <wtf/RefCounted.h>
+#include <wtf/RefPtr.h>
 
 namespace WebCore {
 
@@ -81,14 +83,17 @@ public:
     }
 };
 
-class AtomicHTMLToken : public AtomicMarkupTokenBase<HTMLToken> {
+class AtomicHTMLToken : public AtomicMarkupTokenBase<HTMLToken>, public RefCounted<AtomicHTMLToken> {
     WTF_MAKE_NONCOPYABLE(AtomicHTMLToken);
 public:
-    AtomicHTMLToken(HTMLToken& token) : AtomicMarkupTokenBase<HTMLToken>(&token) { }
+    static PassRefPtr<AtomicHTMLToken> create(HTMLToken& token)
+    {
+        return adoptRef(new AtomicHTMLToken(token));
+    }
 
-    AtomicHTMLToken(HTMLTokenTypes::Type type, const AtomicString& name, const Vector<Attribute>& attributes = Vector<Attribute>())
-        : AtomicMarkupTokenBase<HTMLToken>(type, name, attributes)
+    static PassRefPtr<AtomicHTMLToken> create(HTMLTokenTypes::Type type, const AtomicString& name, const Vector<Attribute>& attributes = Vector<Attribute>())
     {
+        return adoptRef(new AtomicHTMLToken(type, name, attributes));
     }
 
     bool forceQuirks() const
@@ -96,6 +101,16 @@ public:
         ASSERT(m_type == HTMLTokenTypes::DOCTYPE);
         return m_doctypeData->m_forceQuirks;
     }
+private:
+    AtomicHTMLToken(HTMLToken& token)
+        : AtomicMarkupTokenBase<HTMLToken>(&token)
+    {
+    }
+
+    AtomicHTMLToken(HTMLTokenTypes::Type type, const AtomicString& name, const Vector<Attribute>& attributes = Vector<Attribute>())
+        : AtomicMarkupTokenBase<HTMLToken>(type, name, attributes)
+    {
+    }
 };
 
 }
diff --git a/Source/WebCore/html/parser/HTMLTreeBuilder.cpp b/Source/WebCore/html/parser/HTMLTreeBuilder.cpp
index 6a2b0e770..729388d58 100644
--- a/Source/WebCore/html/parser/HTMLTreeBuilder.cpp
+++ b/Source/WebCore/html/parser/HTMLTreeBuilder.cpp
@@ -40,6 +40,7 @@
 #include "HTMLNames.h"
 #include "HTMLParserIdioms.h"
 #include "HTMLScriptElement.h"
+#include "HTMLStackItem.h"
 #include "HTMLToken.h"
 #include "HTMLTokenizer.h"
 #include "LocalizedStrings.h"
@@ -245,9 +246,9 @@ HTMLFormElement* closestFormAncestor(Element* element)
 class HTMLTreeBuilder::ExternalCharacterTokenBuffer {
     WTF_MAKE_NONCOPYABLE(ExternalCharacterTokenBuffer);
 public:
-    explicit ExternalCharacterTokenBuffer(AtomicHTMLToken& token)
-        : m_current(token.characters().data())
-        , m_end(m_current + token.characters().size())
+    explicit ExternalCharacterTokenBuffer(AtomicHTMLToken* token)
+        : m_current(token->characters().data())
+        , m_end(m_current + token->characters().size())
     {
         ASSERT(!isEmpty());
     }
@@ -380,7 +381,7 @@ HTMLTreeBuilder::HTMLTreeBuilder(HTMLDocumentParser* parser, DocumentFragment* f
         // http://www.whatwg.org/specs/web-apps/current-work/multipage/the-end.html#fragment-case
         // For efficiency, we skip step 4.2 ("Let root be a new html element with no attributes")
         // and instead use the DocumentFragment as a root node.
-        m_tree.openElements()->pushRootNode(fragment);
+        m_tree.openElements()->pushRootNode(HTMLStackItem::create(fragment));
         resetInsertionModeAppropriately();
         m_tree.setForm(closestFormAncestor(contextElement));
     }
@@ -433,7 +434,7 @@ PassRefPtr<Element> HTMLTreeBuilder::takeScriptToProcess(TextPosition& scriptSta
 
 void HTMLTreeBuilder::constructTreeFromToken(HTMLToken& rawToken)
 {
-    AtomicHTMLToken token(rawToken);
+    RefPtr<AtomicHTMLToken> token = AtomicHTMLToken::create(rawToken);
 
     // We clear the rawToken in case constructTreeFromAtomicToken
     // synchronously re-enters the parser. We don't clear the token immedately
@@ -448,7 +449,7 @@ void HTMLTreeBuilder::constructTreeFromToken(HTMLToken& rawToken)
     if (rawToken.type() != HTMLTokenTypes::Character)
         rawToken.clear();
 
-    constructTreeFromAtomicToken(token);
+    constructTreeFromAtomicToken(token.get());
 
     if (!rawToken.isUninitialized()) {
         ASSERT(rawToken.type() == HTMLTokenTypes::Character);
@@ -456,7 +457,7 @@ void HTMLTreeBuilder::constructTreeFromToken(HTMLToken& rawToken)
     }
 }
 
-void HTMLTreeBuilder::constructTreeFromAtomicToken(AtomicHTMLToken& token)
+void HTMLTreeBuilder::constructTreeFromAtomicToken(AtomicHTMLToken* token)
 {
     if (shouldProcessTokenInForeignContent(token))
         processTokenInForeignContent(token);
@@ -475,9 +476,9 @@ void HTMLTreeBuilder::constructTreeFromAtomicToken(AtomicHTMLToken& token)
     // We might be detached now.
 }
 
-void HTMLTreeBuilder::processToken(AtomicHTMLToken& token)
+void HTMLTreeBuilder::processToken(AtomicHTMLToken* token)
 {
-    switch (token.type()) {
+    switch (token->type()) {
     case HTMLTokenTypes::Uninitialized:
         ASSERT_NOT_REACHED();
         break;
@@ -507,9 +508,9 @@ void HTMLTreeBuilder::processToken(AtomicHTMLToken& token)
     }
 }
 
-void HTMLTreeBuilder::processDoctypeToken(AtomicHTMLToken& token)
+void HTMLTreeBuilder::processDoctypeToken(AtomicHTMLToken* token)
 {
-    ASSERT(token.type() == HTMLTokenTypes::DOCTYPE);
+    ASSERT(token->type() == HTMLTokenTypes::DOCTYPE);
     if (m_insertionMode == InitialMode) {
         m_tree.insertDoctype(token);
         setInsertionMode(BeforeHTMLMode);
@@ -526,15 +527,15 @@ void HTMLTreeBuilder::processDoctypeToken(AtomicHTMLToken& token)
 void HTMLTreeBuilder::processFakeStartTag(const QualifiedName& tagName, const Vector<Attribute>& attributes)
 {
     // FIXME: We'll need a fancier conversion than just "localName" for SVG/MathML tags.
-    AtomicHTMLToken fakeToken(HTMLTokenTypes::StartTag, tagName.localName(), attributes);
-    processStartTag(fakeToken);
+    RefPtr<AtomicHTMLToken> fakeToken = AtomicHTMLToken::create(HTMLTokenTypes::StartTag, tagName.localName(), attributes);
+    processStartTag(fakeToken.get());
 }
 
 void HTMLTreeBuilder::processFakeEndTag(const QualifiedName& tagName)
 {
     // FIXME: We'll need a fancier conversion than just "localName" for SVG/MathML tags.
-    AtomicHTMLToken fakeToken(HTMLTokenTypes::EndTag, tagName.localName());
-    processEndTag(fakeToken);
+    RefPtr<AtomicHTMLToken> fakeToken = AtomicHTMLToken::create(HTMLTokenTypes::EndTag, tagName.localName());
+    processEndTag(fakeToken.get());
 }
 
 void HTMLTreeBuilder::processFakeCharacters(const String& characters)
@@ -548,13 +549,13 @@ void HTMLTreeBuilder::processFakePEndTagIfPInButtonScope()
 {
     if (!m_tree.openElements()->inButtonScope(pTag.localName()))
         return;
-    AtomicHTMLToken endP(HTMLTokenTypes::EndTag, pTag.localName());
-    processEndTag(endP);
+    RefPtr<AtomicHTMLToken> endP = AtomicHTMLToken::create(HTMLTokenTypes::EndTag, pTag.localName());
+    processEndTag(endP.get());
 }
 
-Vector<Attribute> HTMLTreeBuilder::attributesForIsindexInput(AtomicHTMLToken& token)
+Vector<Attribute> HTMLTreeBuilder::attributesForIsindexInput(AtomicHTMLToken* token)
 {
-    Vector<Attribute> attributes = token.attributes();
+    Vector<Attribute> attributes = token->attributes();
     for (int i = attributes.size() - 1; i >= 0; --i) {
         const QualifiedName& name = attributes.at(i).name();
         if (name.matches(nameAttr) || name.matches(actionAttr) || name.matches(promptAttr))
@@ -565,21 +566,21 @@ Vector<Attribute> HTMLTreeBuilder::attributesForIsindexInput(AtomicHTMLToken& to
     return attributes;
 }
 
-void HTMLTreeBuilder::processIsindexStartTagForInBody(AtomicHTMLToken& token)
+void HTMLTreeBuilder::processIsindexStartTagForInBody(AtomicHTMLToken* token)
 {
-    ASSERT(token.type() == HTMLTokenTypes::StartTag);
-    ASSERT(token.name() == isindexTag);
+    ASSERT(token->type() == HTMLTokenTypes::StartTag);
+    ASSERT(token->name() == isindexTag);
     parseError(token);
     if (m_tree.form())
         return;
     notImplemented(); // Acknowledge self-closing flag
     processFakeStartTag(formTag);
-    Attribute* actionAttribute = token.getAttributeItem(actionAttr);
+    Attribute* actionAttribute = token->getAttributeItem(actionAttr);
     if (actionAttribute)
         m_tree.form()->setAttribute(actionAttr, actionAttribute->value());
     processFakeStartTag(hrTag);
     processFakeStartTag(labelTag);
-    Attribute* promptAttribute = token.getAttributeItem(promptAttr);
+    Attribute* promptAttribute = token->getAttributeItem(promptAttr);
     if (promptAttribute)
         processFakeCharacters(promptAttribute->value());
     else
@@ -607,7 +608,7 @@ bool isDdOrDt(const ContainerNode* element)
 }
 
 template <bool shouldClose(const ContainerNode*)>
-void HTMLTreeBuilder::processCloseWhenNestedTag(AtomicHTMLToken& token)
+void HTMLTreeBuilder::processCloseWhenNestedTag(AtomicHTMLToken* token)
 {
     m_framesetOk = false;
     HTMLElementStack::ElementRecord* nodeRecord = m_tree.openElements()->topRecord();
@@ -641,7 +642,7 @@ void mapLoweredLocalNameToName(PrefixedNameToQualifiedNameMap* map, QualifiedNam
     }
 }
 
-void adjustSVGTagNameCase(AtomicHTMLToken& token)
+void adjustSVGTagNameCase(AtomicHTMLToken* token)
 {
     static PrefixedNameToQualifiedNameMap* caseMap = 0;
     if (!caseMap) {
@@ -651,14 +652,14 @@ void adjustSVGTagNameCase(AtomicHTMLToken& token)
         mapLoweredLocalNameToName(caseMap, svgTags, length);
     }
 
-    const QualifiedName& casedName = caseMap->get(token.name());
+    const QualifiedName& casedName = caseMap->get(token->name());
     if (casedName.localName().isNull())
         return;
-    token.setName(casedName.localName());
+    token->setName(casedName.localName());
 }
 
 template<QualifiedName** getAttrs(size_t* length)>
-void adjustAttributes(AtomicHTMLToken& token)
+void adjustAttributes(AtomicHTMLToken* token)
 {
     static PrefixedNameToQualifiedNameMap* caseMap = 0;
     if (!caseMap) {
@@ -668,20 +669,20 @@ void adjustAttributes(AtomicHTMLToken& token)
         mapLoweredLocalNameToName(caseMap, attrs, length);
     }
 
-    for (unsigned i = 0; i < token.attributes().size(); ++i) {
-        Attribute& tokenAttribute = token.attributes().at(i);
+    for (unsigned i = 0; i < token->attributes().size(); ++i) {
+        Attribute& tokenAttribute = token->attributes().at(i);
         const QualifiedName& casedName = caseMap->get(tokenAttribute.localName());
         if (!casedName.localName().isNull())
             tokenAttribute.parserSetName(casedName);
     }
 }
 
-void adjustSVGAttributes(AtomicHTMLToken& token)
+void adjustSVGAttributes(AtomicHTMLToken* token)
 {
     adjustAttributes<SVGNames::getSVGAttrs>(token);
 }
 
-void adjustMathMLAttributes(AtomicHTMLToken& token)
+void adjustMathMLAttributes(AtomicHTMLToken* token)
 {
     adjustAttributes<MathMLNames::getMathMLAttrs>(token);
 }
@@ -697,7 +698,7 @@ void addNamesWithPrefix(PrefixedNameToQualifiedNameMap* map, const AtomicString&
     }
 }
 
-void adjustForeignAttributes(AtomicHTMLToken& token)
+void adjustForeignAttributes(AtomicHTMLToken* token)
 {
     static PrefixedNameToQualifiedNameMap* map = 0;
     if (!map) {
@@ -713,8 +714,8 @@ void adjustForeignAttributes(AtomicHTMLToken& token)
         map->add("xmlns:xlink", QualifiedName("xmlns", "xlink", XMLNSNames::xmlnsNamespaceURI));
     }
 
-    for (unsigned i = 0; i < token.attributes().size(); ++i) {
-        Attribute& tokenAttribute = token.attributes().at(i);
+    for (unsigned i = 0; i < token->attributes().size(); ++i) {
+        Attribute& tokenAttribute = token->attributes().at(i);
         const QualifiedName& name = map->get(tokenAttribute.localName());
         if (!name.localName().isNull())
             tokenAttribute.parserSetName(name);
@@ -723,28 +724,28 @@ void adjustForeignAttributes(AtomicHTMLToken& token)
 
 }
 
-void HTMLTreeBuilder::processStartTagForInBody(AtomicHTMLToken& token)
+void HTMLTreeBuilder::processStartTagForInBody(AtomicHTMLToken* token)
 {
-    ASSERT(token.type() == HTMLTokenTypes::StartTag);
-    if (token.name() == htmlTag) {
+    ASSERT(token->type() == HTMLTokenTypes::StartTag);
+    if (token->name() == htmlTag) {
         processHtmlStartTagForInBody(token);
         return;
     }
-    if (token.name() == baseTag
-        || token.name() == basefontTag
-        || token.name() == bgsoundTag
-        || token.name() == commandTag
-        || token.name() == linkTag
-        || token.name() == metaTag
-        || token.name() == noframesTag
-        || token.name() == scriptTag
-        || token.name() == styleTag
-        || token.name() == titleTag) {
+    if (token->name() == baseTag
+        || token->name() == basefontTag
+        || token->name() == bgsoundTag
+        || token->name() == commandTag
+        || token->name() == linkTag
+        || token->name() == metaTag
+        || token->name() == noframesTag
+        || token->name() == scriptTag
+        || token->name() == styleTag
+        || token->name() == titleTag) {
         bool didProcess = processStartTagForInHead(token);
         ASSERT_UNUSED(didProcess, didProcess);
         return;
     }
-    if (token.name() == bodyTag) {
+    if (token->name() == bodyTag) {
         parseError(token);
         if (!m_tree.openElements()->secondElementIsHTMLBodyElement() || m_tree.openElements()->hasOnlyOneElement()) {
             ASSERT(isParsingFragment());
@@ -754,7 +755,7 @@ void HTMLTreeBuilder::processStartTagForInBody(AtomicHTMLToken& token)
         m_tree.insertHTMLBodyStartTagInBody(token);
         return;
     }
-    if (token.name() == framesetTag) {
+    if (token->name() == framesetTag) {
         parseError(token);
         if (!m_tree.openElements()->secondElementIsHTMLBodyElement() || m_tree.openElements()->hasOnlyOneElement()) {
             ASSERT(isParsingFragment());
@@ -772,33 +773,33 @@ void HTMLTreeBuilder::processStartTagForInBody(AtomicHTMLToken& token)
         setInsertionMode(InFramesetMode);
         return;
     }
-    if (token.name() == addressTag
-        || token.name() == articleTag
-        || token.name() == asideTag
-        || token.name() == blockquoteTag
-        || token.name() == centerTag
-        || token.name() == detailsTag
-        || token.name() == dirTag
-        || token.name() == divTag
-        || token.name() == dlTag
-        || token.name() == fieldsetTag
-        || token.name() == figcaptionTag
-        || token.name() == figureTag
-        || token.name() == footerTag
-        || token.name() == headerTag
-        || token.name() == hgroupTag
-        || token.name() == menuTag
-        || token.name() == navTag
-        || token.name() == olTag
-        || token.name() == pTag
-        || token.name() == sectionTag
-        || token.name() == summaryTag
-        || token.name() == ulTag) {
+    if (token->name() == addressTag
+        || token->name() == articleTag
+        || token->name() == asideTag
+        || token->name() == blockquoteTag
+        || token->name() == centerTag
+        || token->name() == detailsTag
+        || token->name() == dirTag
+        || token->name() == divTag
+        || token->name() == dlTag
+        || token->name() == fieldsetTag
+        || token->name() == figcaptionTag
+        || token->name() == figureTag
+        || token->name() == footerTag
+        || token->name() == headerTag
+        || token->name() == hgroupTag
+        || token->name() == menuTag
+        || token->name() == navTag
+        || token->name() == olTag
+        || token->name() == pTag
+        || token->name() == sectionTag
+        || token->name() == summaryTag
+        || token->name() == ulTag) {
         processFakePEndTagIfPInButtonScope();
         m_tree.insertHTMLElement(token);
         return;
     }
-    if (isNumberedHeaderTag(token.name())) {
+    if (isNumberedHeaderTag(token->name())) {
         processFakePEndTagIfPInButtonScope();
         if (isNumberedHeaderTag(m_tree.currentNode()->localName())) {
             parseError(token);
@@ -807,14 +808,14 @@ void HTMLTreeBuilder::processStartTagForInBody(AtomicHTMLToken& token)
         m_tree.insertHTMLElement(token);
         return;
     }
-    if (token.name() == preTag || token.name() == listingTag) {
+    if (token->name() == preTag || token->name() == listingTag) {
         processFakePEndTagIfPInButtonScope();
         m_tree.insertHTMLElement(token);
         m_shouldSkipLeadingNewline = true;
         m_framesetOk = false;
         return;
     }
-    if (token.name() == formTag) {
+    if (token->name() == formTag) {
         if (m_tree.form()) {
             parseError(token);
             return;
@@ -823,21 +824,21 @@ void HTMLTreeBuilder::processStartTagForInBody(AtomicHTMLToken& token)
         m_tree.insertHTMLFormElement(token);
         return;
     }
-    if (token.name() == liTag) {
+    if (token->name() == liTag) {
         processCloseWhenNestedTag<isLi>(token);
         return;
     }
-    if (token.name() == ddTag || token.name() == dtTag) {
+    if (token->name() == ddTag || token->name() == dtTag) {
         processCloseWhenNestedTag<isDdOrDt>(token);
         return;
     }
-    if (token.name() == plaintextTag) {
+    if (token->name() == plaintextTag) {
         processFakePEndTagIfPInButtonScope();
         m_tree.insertHTMLElement(token);
         m_parser->tokenizer()->setState(HTMLTokenizerState::PLAINTEXTState);
         return;
     }
-    if (token.name() == buttonTag) {
+    if (token->name() == buttonTag) {
         if (m_tree.openElements()->inScope(buttonTag)) {
             parseError(token);
             processFakeEndTag(buttonTag);
@@ -849,7 +850,7 @@ void HTMLTreeBuilder::processStartTagForInBody(AtomicHTMLToken& token)
         m_framesetOk = false;
         return;
     }
-    if (token.name() == aTag) {
+    if (token->name() == aTag) {
         Element* activeATag = m_tree.activeFormattingElements()->closestElementInScopeWithName(aTag.localName());
         if (activeATag) {
             parseError(token);
@@ -862,12 +863,12 @@ void HTMLTreeBuilder::processStartTagForInBody(AtomicHTMLToken& token)
         m_tree.insertFormattingElement(token);
         return;
     }
-    if (isNonAnchorNonNobrFormattingTag(token.name())) {
+    if (isNonAnchorNonNobrFormattingTag(token->name())) {
         m_tree.reconstructTheActiveFormattingElements();
         m_tree.insertFormattingElement(token);
         return;
     }
-    if (token.name() == nobrTag) {
+    if (token->name() == nobrTag) {
         m_tree.reconstructTheActiveFormattingElements();
         if (m_tree.openElements()->inScope(nobrTag)) {
             parseError(token);
@@ -877,16 +878,16 @@ void HTMLTreeBuilder::processStartTagForInBody(AtomicHTMLToken& token)
         m_tree.insertFormattingElement(token);
         return;
     }
-    if (token.name() == appletTag
-        || token.name() == marqueeTag
-        || token.name() == objectTag) {
+    if (token->name() == appletTag
+        || token->name() == marqueeTag
+        || token->name() == objectTag) {
         m_tree.reconstructTheActiveFormattingElements();
         m_tree.insertHTMLElement(token);
         m_tree.activeFormattingElements()->appendMarker();
         m_framesetOk = false;
         return;
     }
-    if (token.name() == tableTag) {
+    if (token->name() == tableTag) {
         if (!m_document->inQuirksMode() && m_tree.openElements()->inButtonScope(pTag))
             processFakeEndTag(pTag);
         m_tree.insertHTMLElement(token);
@@ -894,48 +895,48 @@ void HTMLTreeBuilder::processStartTagForInBody(AtomicHTMLToken& token)
         setInsertionMode(InTableMode);
         return;
     }
-    if (token.name() == imageTag) {
+    if (token->name() == imageTag) {
         parseError(token);
         // Apparently we're not supposed to ask.
-        token.setName(imgTag.localName());
+        token->setName(imgTag.localName());
         // Note the fall through to the imgTag handling below!
     }
-    if (token.name() == areaTag
-        || token.name() == brTag
-        || token.name() == embedTag
-        || token.name() == imgTag
-        || token.name() == keygenTag
-        || token.name() == wbrTag) {
+    if (token->name() == areaTag
+        || token->name() == brTag
+        || token->name() == embedTag
+        || token->name() == imgTag
+        || token->name() == keygenTag
+        || token->name() == wbrTag) {
         m_tree.reconstructTheActiveFormattingElements();
         m_tree.insertSelfClosingHTMLElement(token);
         m_framesetOk = false;
         return;
     }
-    if (token.name() == inputTag) {
-        Attribute* typeAttribute = token.getAttributeItem(typeAttr);
+    if (token->name() == inputTag) {
+        Attribute* typeAttribute = token->getAttributeItem(typeAttr);
         m_tree.reconstructTheActiveFormattingElements();
         m_tree.insertSelfClosingHTMLElement(token);
         if (!typeAttribute || !equalIgnoringCase(typeAttribute->value(), "hidden"))
             m_framesetOk = false;
         return;
     }
-    if (token.name() == paramTag
-        || token.name() == sourceTag
-        || token.name() == trackTag) {
+    if (token->name() == paramTag
+        || token->name() == sourceTag
+        || token->name() == trackTag) {
         m_tree.insertSelfClosingHTMLElement(token);
         return;
     }
-    if (token.name() == hrTag) {
+    if (token->name() == hrTag) {
         processFakePEndTagIfPInButtonScope();
         m_tree.insertSelfClosingHTMLElement(token);
         m_framesetOk = false;
         return;
     }
-    if (token.name() == isindexTag) {
+    if (token->name() == isindexTag) {
         processIsindexStartTagForInBody(token);
         return;
     }
-    if (token.name() == textareaTag) {
+    if (token->name() == textareaTag) {
         m_tree.insertHTMLElement(token);
         m_shouldSkipLeadingNewline = true;
         m_parser->tokenizer()->setState(HTMLTokenizerState::RCDATAState);
@@ -944,27 +945,27 @@ void HTMLTreeBuilder::processStartTagForInBody(AtomicHTMLToken& token)
         setInsertionMode(TextMode);
         return;
     }
-    if (token.name() == xmpTag) {
+    if (token->name() == xmpTag) {
         processFakePEndTagIfPInButtonScope();
         m_tree.reconstructTheActiveFormattingElements();
         m_framesetOk = false;
         processGenericRawTextStartTag(token);
         return;
     }
-    if (token.name() == iframeTag) {
+    if (token->name() == iframeTag) {
         m_framesetOk = false;
         processGenericRawTextStartTag(token);
         return;
     }
-    if (token.name() == noembedTag && pluginsEnabled(m_document->frame())) {
+    if (token->name() == noembedTag && pluginsEnabled(m_document->frame())) {
         processGenericRawTextStartTag(token);
         return;
     }
-    if (token.name() == noscriptTag && scriptEnabled(m_document->frame())) {
+    if (token->name() == noscriptTag && scriptEnabled(m_document->frame())) {
         processGenericRawTextStartTag(token);
         return;
     }
-    if (token.name() == selectTag) {
+    if (token->name() == selectTag) {
         m_tree.reconstructTheActiveFormattingElements();
         m_tree.insertHTMLElement(token);
         m_framesetOk = false;
@@ -979,16 +980,16 @@ void HTMLTreeBuilder::processStartTagForInBody(AtomicHTMLToken& token)
             setInsertionMode(InSelectMode);
         return;
     }
-    if (token.name() == optgroupTag || token.name() == optionTag) {
+    if (token->name() == optgroupTag || token->name() == optionTag) {
         if (m_tree.currentNode()->hasTagName(optionTag)) {
-            AtomicHTMLToken endOption(HTMLTokenTypes::EndTag, optionTag.localName());
-            processEndTag(endOption);
+            RefPtr<AtomicHTMLToken> endOption = AtomicHTMLToken::create(HTMLTokenTypes::EndTag, optionTag.localName());
+            processEndTag(endOption.get());
         }
         m_tree.reconstructTheActiveFormattingElements();
         m_tree.insertHTMLElement(token);
         return;
     }
-    if (token.name() == rpTag || token.name() == rtTag) {
+    if (token->name() == rpTag || token->name() == rtTag) {
         if (m_tree.openElements()->inScope(rubyTag.localName())) {
             m_tree.generateImpliedEndTags();
             if (!m_tree.currentNode()->hasTagName(rubyTag))
@@ -997,26 +998,26 @@ void HTMLTreeBuilder::processStartTagForInBody(AtomicHTMLToken& token)
         m_tree.insertHTMLElement(token);
         return;
     }
-    if (token.name() == MathMLNames::mathTag.localName()) {
+    if (token->name() == MathMLNames::mathTag.localName()) {
         m_tree.reconstructTheActiveFormattingElements();
         adjustMathMLAttributes(token);
         adjustForeignAttributes(token);
         m_tree.insertForeignElement(token, MathMLNames::mathmlNamespaceURI);
         return;
     }
-    if (token.name() == SVGNames::svgTag.localName()) {
+    if (token->name() == SVGNames::svgTag.localName()) {
         m_tree.reconstructTheActiveFormattingElements();
         adjustSVGAttributes(token);
         adjustForeignAttributes(token);
         m_tree.insertForeignElement(token, SVGNames::svgNamespaceURI);
         return;
     }
-    if (isCaptionColOrColgroupTag(token.name())
-        || token.name() == frameTag
-        || token.name() == headTag
-        || isTableBodyContextTag(token.name())
-        || isTableCellContextTag(token.name())
-        || token.name() == trTag) {
+    if (isCaptionColOrColgroupTag(token->name())
+        || token->name() == frameTag
+        || token->name() == headTag
+        || isTableBodyContextTag(token->name())
+        || isTableCellContextTag(token->name())
+        || token->name() == trTag) {
         parseError(token);
         return;
     }
@@ -1050,42 +1051,42 @@ void HTMLTreeBuilder::closeTheCell()
     ASSERT(insertionMode() == InRowMode);
 }
 
-void HTMLTreeBuilder::processStartTagForInTable(AtomicHTMLToken& token)
+void HTMLTreeBuilder::processStartTagForInTable(AtomicHTMLToken* token)
 {
-    ASSERT(token.type() == HTMLTokenTypes::StartTag);
-    if (token.name() == captionTag) {
+    ASSERT(token->type() == HTMLTokenTypes::StartTag);
+    if (token->name() == captionTag) {
         m_tree.openElements()->popUntilTableScopeMarker();
         m_tree.activeFormattingElements()->appendMarker();
         m_tree.insertHTMLElement(token);
         setInsertionMode(InCaptionMode);
         return;
     }
-    if (token.name() == colgroupTag) {
+    if (token->name() == colgroupTag) {
         m_tree.openElements()->popUntilTableScopeMarker();
         m_tree.insertHTMLElement(token);
         setInsertionMode(InColumnGroupMode);
         return;
     }
-    if (token.name() == colTag) {
+    if (token->name() == colTag) {
         processFakeStartTag(colgroupTag);
         ASSERT(InColumnGroupMode);
         processStartTag(token);
         return;
     }
-    if (isTableBodyContextTag(token.name())) {
+    if (isTableBodyContextTag(token->name())) {
         m_tree.openElements()->popUntilTableScopeMarker();
         m_tree.insertHTMLElement(token);
         setInsertionMode(InTableBodyMode);
         return;
     }
-    if (isTableCellContextTag(token.name())
-        || token.name() == trTag) {
+    if (isTableCellContextTag(token->name())
+        || token->name() == trTag) {
         processFakeStartTag(tbodyTag);
         ASSERT(insertionMode() == InTableBodyMode);
         processStartTag(token);
         return;
     }
-    if (token.name() == tableTag) {
+    if (token->name() == tableTag) {
         parseError(token);
         if (!processTableEndTagForInTable()) {
             ASSERT(isParsingFragment());
@@ -1094,12 +1095,12 @@ void HTMLTreeBuilder::processStartTagForInTable(AtomicHTMLToken& token)
         processStartTag(token);
         return;
     }
-    if (token.name() == styleTag || token.name() == scriptTag) {
+    if (token->name() == styleTag || token->name() == scriptTag) {
         processStartTagForInHead(token);
         return;
     }
-    if (token.name() == inputTag) {
-        Attribute* typeAttribute = token.getAttributeItem(typeAttr);
+    if (token->name() == inputTag) {
+        Attribute* typeAttribute = token->getAttributeItem(typeAttr);
         if (typeAttribute && equalIgnoringCase(typeAttribute->value(), "hidden")) {
             parseError(token);
             m_tree.insertSelfClosingHTMLElement(token);
@@ -1107,7 +1108,7 @@ void HTMLTreeBuilder::processStartTagForInTable(AtomicHTMLToken& token)
         }
         // Fall through to "anything else" case.
     }
-    if (token.name() == formTag) {
+    if (token->name() == formTag) {
         parseError(token);
         if (m_tree.form())
             return;
@@ -1120,9 +1121,9 @@ void HTMLTreeBuilder::processStartTagForInTable(AtomicHTMLToken& token)
     processStartTagForInBody(token);
 }
 
-void HTMLTreeBuilder::processStartTag(AtomicHTMLToken& token)
+void HTMLTreeBuilder::processStartTag(AtomicHTMLToken* token)
 {
-    ASSERT(token.type() == HTMLTokenTypes::StartTag);
+    ASSERT(token->type() == HTMLTokenTypes::StartTag);
     switch (insertionMode()) {
     case InitialMode:
         ASSERT(insertionMode() == InitialMode);
@@ -1130,7 +1131,7 @@ void HTMLTreeBuilder::processStartTag(AtomicHTMLToken& token)
         // Fall through.
     case BeforeHTMLMode:
         ASSERT(insertionMode() == BeforeHTMLMode);
-        if (token.name() == htmlTag) {
+        if (token->name() == htmlTag) {
             m_tree.insertHTMLHtmlStartTagBeforeHTML(token);
             setInsertionMode(BeforeHeadMode);
             return;
@@ -1139,11 +1140,11 @@ void HTMLTreeBuilder::processStartTag(AtomicHTMLToken& token)
         // Fall through.
     case BeforeHeadMode:
         ASSERT(insertionMode() == BeforeHeadMode);
-        if (token.name() == htmlTag) {
+        if (token->name() == htmlTag) {
             processHtmlStartTagForInBody(token);
             return;
         }
-        if (token.name() == headTag) {
+        if (token->name() == headTag) {
             m_tree.insertHTMLHeadElement(token);
             setInsertionMode(InHeadMode);
             return;
@@ -1158,38 +1159,38 @@ void HTMLTreeBuilder::processStartTag(AtomicHTMLToken& token)
         // Fall through.
     case AfterHeadMode:
         ASSERT(insertionMode() == AfterHeadMode);
-        if (token.name() == htmlTag) {
+        if (token->name() == htmlTag) {
             processHtmlStartTagForInBody(token);
             return;
         }
-        if (token.name() == bodyTag) {
+        if (token->name() == bodyTag) {
             m_framesetOk = false;
             m_tree.insertHTMLBodyElement(token);
             setInsertionMode(InBodyMode);
             return;
         }
-        if (token.name() == framesetTag) {
+        if (token->name() == framesetTag) {
             m_tree.insertHTMLElement(token);
             setInsertionMode(InFramesetMode);
             return;
         }
-        if (token.name() == baseTag
-            || token.name() == basefontTag
-            || token.name() == bgsoundTag
-            || token.name() == linkTag
-            || token.name() == metaTag
-            || token.name() == noframesTag
-            || token.name() == scriptTag
-            || token.name() == styleTag
-            || token.name() == titleTag) {
+        if (token->name() == baseTag
+            || token->name() == basefontTag
+            || token->name() == bgsoundTag
+            || token->name() == linkTag
+            || token->name() == metaTag
+            || token->name() == noframesTag
+            || token->name() == scriptTag
+            || token->name() == styleTag
+            || token->name() == titleTag) {
             parseError(token);
             ASSERT(m_tree.head());
-            m_tree.openElements()->pushHTMLHeadElement(m_tree.head());
+            m_tree.openElements()->pushHTMLHeadElement(HTMLStackItem::create(m_tree.head(), token));
             processStartTagForInHead(token);
             m_tree.openElements()->removeHTMLHeadElement(m_tree.head());
             return;
         }
-        if (token.name() == headTag) {
+        if (token->name() == headTag) {
             parseError(token);
             return;
         }
@@ -1205,10 +1206,10 @@ void HTMLTreeBuilder::processStartTag(AtomicHTMLToken& token)
         break;
     case InCaptionMode:
         ASSERT(insertionMode() == InCaptionMode);
-        if (isCaptionColOrColgroupTag(token.name())
-            || isTableBodyContextTag(token.name())
-            || isTableCellContextTag(token.name())
-            || token.name() == trTag) {
+        if (isCaptionColOrColgroupTag(token->name())
+            || isTableBodyContextTag(token->name())
+            || isTableCellContextTag(token->name())
+            || token->name() == trTag) {
             parseError(token);
             if (!processCaptionEndTagForInCaption()) {
                 ASSERT(isParsingFragment());
@@ -1221,11 +1222,11 @@ void HTMLTreeBuilder::processStartTag(AtomicHTMLToken& token)
         break;
     case InColumnGroupMode:
         ASSERT(insertionMode() == InColumnGroupMode);
-        if (token.name() == htmlTag) {
+        if (token->name() == htmlTag) {
             processHtmlStartTagForInBody(token);
             return;
         }
-        if (token.name() == colTag) {
+        if (token->name() == colTag) {
             m_tree.insertSelfClosingHTMLElement(token);
             return;
         }
@@ -1237,20 +1238,20 @@ void HTMLTreeBuilder::processStartTag(AtomicHTMLToken& token)
         break;
     case InTableBodyMode:
         ASSERT(insertionMode() == InTableBodyMode);
-        if (token.name() == trTag) {
+        if (token->name() == trTag) {
             m_tree.openElements()->popUntilTableBodyScopeMarker(); // How is there ever anything to pop?
             m_tree.insertHTMLElement(token);
             setInsertionMode(InRowMode);
             return;
         }
-        if (isTableCellContextTag(token.name())) {
+        if (isTableCellContextTag(token->name())) {
             parseError(token);
             processFakeStartTag(trTag);
             ASSERT(insertionMode() == InRowMode);
             processStartTag(token);
             return;
         }
-        if (isCaptionColOrColgroupTag(token.name()) || isTableBodyContextTag(token.name())) {
+        if (isCaptionColOrColgroupTag(token->name()) || isTableBodyContextTag(token->name())) {
             // FIXME: This is slow.
             if (!m_tree.openElements()->inTableScope(tbodyTag.localName()) && !m_tree.openElements()->inTableScope(theadTag.localName()) && !m_tree.openElements()->inTableScope(tfootTag.localName())) {
                 ASSERT(isParsingFragment());
@@ -1267,16 +1268,16 @@ void HTMLTreeBuilder::processStartTag(AtomicHTMLToken& token)
         break;
     case InRowMode:
         ASSERT(insertionMode() == InRowMode);
-        if (isTableCellContextTag(token.name())) {
+        if (isTableCellContextTag(token->name())) {
             m_tree.openElements()->popUntilTableRowScopeMarker();
             m_tree.insertHTMLElement(token);
             setInsertionMode(InCellMode);
             m_tree.activeFormattingElements()->appendMarker();
             return;
         }
-        if (token.name() == trTag
-            || isCaptionColOrColgroupTag(token.name())
-            || isTableBodyContextTag(token.name())) {
+        if (token->name() == trTag
+            || isCaptionColOrColgroupTag(token->name())
+            || isTableBodyContextTag(token->name())) {
             if (!processTrEndTagForInRow()) {
                 ASSERT(isParsingFragment());
                 return;
@@ -1289,10 +1290,10 @@ void HTMLTreeBuilder::processStartTag(AtomicHTMLToken& token)
         break;
     case InCellMode:
         ASSERT(insertionMode() == InCellMode);
-        if (isCaptionColOrColgroupTag(token.name())
-            || isTableCellContextTag(token.name())
-            || token.name() == trTag
-            || isTableBodyContextTag(token.name())) {
+        if (isCaptionColOrColgroupTag(token->name())
+            || isTableCellContextTag(token->name())
+            || token->name() == trTag
+            || isTableBodyContextTag(token->name())) {
             // FIXME: This could be more efficient.
             if (!m_tree.openElements()->inTableScope(tdTag) && !m_tree.openElements()->inTableScope(thTag)) {
                 ASSERT(isParsingFragment());
@@ -1308,7 +1309,7 @@ void HTMLTreeBuilder::processStartTag(AtomicHTMLToken& token)
     case AfterBodyMode:
     case AfterAfterBodyMode:
         ASSERT(insertionMode() == AfterBodyMode || insertionMode() == AfterAfterBodyMode);
-        if (token.name() == htmlTag) {
+        if (token->name() == htmlTag) {
             processHtmlStartTagForInBody(token);
             return;
         }
@@ -1317,21 +1318,21 @@ void HTMLTreeBuilder::processStartTag(AtomicHTMLToken& token)
         break;
     case InHeadNoscriptMode:
         ASSERT(insertionMode() == InHeadNoscriptMode);
-        if (token.name() == htmlTag) {
+        if (token->name() == htmlTag) {
             processHtmlStartTagForInBody(token);
             return;
         }
-        if (token.name() == basefontTag
-            || token.name() == bgsoundTag
-            || token.name() == linkTag
-            || token.name() == metaTag
-            || token.name() == noframesTag
-            || token.name() == styleTag) {
+        if (token->name() == basefontTag
+            || token->name() == bgsoundTag
+            || token->name() == linkTag
+            || token->name() == metaTag
+            || token->name() == noframesTag
+            || token->name() == styleTag) {
             bool didProcess = processStartTagForInHead(token);
             ASSERT_UNUSED(didProcess, didProcess);
             return;
         }
-        if (token.name() == htmlTag || token.name() == noscriptTag) {
+        if (token->name() == htmlTag || token->name() == noscriptTag) {
             parseError(token);
             return;
         }
@@ -1340,19 +1341,19 @@ void HTMLTreeBuilder::processStartTag(AtomicHTMLToken& token)
         break;
     case InFramesetMode:
         ASSERT(insertionMode() == InFramesetMode);
-        if (token.name() == htmlTag) {
+        if (token->name() == htmlTag) {
             processHtmlStartTagForInBody(token);
             return;
         }
-        if (token.name() == framesetTag) {
+        if (token->name() == framesetTag) {
             m_tree.insertHTMLElement(token);
             return;
         }
-        if (token.name() == frameTag) {
+        if (token->name() == frameTag) {
             m_tree.insertSelfClosingHTMLElement(token);
             return;
         }
-        if (token.name() == noframesTag) {
+        if (token->name() == noframesTag) {
             processStartTagForInHead(token);
             return;
         }
@@ -1361,11 +1362,11 @@ void HTMLTreeBuilder::processStartTag(AtomicHTMLToken& token)
     case AfterFramesetMode:
     case AfterAfterFramesetMode:
         ASSERT(insertionMode() == AfterFramesetMode || insertionMode() == AfterAfterFramesetMode);
-        if (token.name() == htmlTag) {
+        if (token->name() == htmlTag) {
             processHtmlStartTagForInBody(token);
             return;
         }
-        if (token.name() == noframesTag) {
+        if (token->name() == noframesTag) {
             processStartTagForInHead(token);
             return;
         }
@@ -1373,64 +1374,64 @@ void HTMLTreeBuilder::processStartTag(AtomicHTMLToken& token)
         break;
     case InSelectInTableMode:
         ASSERT(insertionMode() == InSelectInTableMode);
-        if (token.name() == captionTag
-            || token.name() == tableTag
-            || isTableBodyContextTag(token.name())
-            || token.name() == trTag
-            || isTableCellContextTag(token.name())) {
+        if (token->name() == captionTag
+            || token->name() == tableTag
+            || isTableBodyContextTag(token->name())
+            || token->name() == trTag
+            || isTableCellContextTag(token->name())) {
             parseError(token);
-            AtomicHTMLToken endSelect(HTMLTokenTypes::EndTag, selectTag.localName());
-            processEndTag(endSelect);
+            RefPtr<AtomicHTMLToken> endSelect = AtomicHTMLToken::create(HTMLTokenTypes::EndTag, selectTag.localName());
+            processEndTag(endSelect.get());
             processStartTag(token);
             return;
         }
         // Fall through
     case InSelectMode:
         ASSERT(insertionMode() == InSelectMode || insertionMode() == InSelectInTableMode);
-        if (token.name() == htmlTag) {
+        if (token->name() == htmlTag) {
             processHtmlStartTagForInBody(token);
             return;
         }
-        if (token.name() == optionTag) {
+        if (token->name() == optionTag) {
             if (m_tree.currentNode()->hasTagName(optionTag)) {
-                AtomicHTMLToken endOption(HTMLTokenTypes::EndTag, optionTag.localName());
-                processEndTag(endOption);
+                RefPtr<AtomicHTMLToken> endOption = AtomicHTMLToken::create(HTMLTokenTypes::EndTag, optionTag.localName());
+                processEndTag(endOption.get());
             }
             m_tree.insertHTMLElement(token);
             return;
         }
-        if (token.name() == optgroupTag) {
+        if (token->name() == optgroupTag) {
             if (m_tree.currentNode()->hasTagName(optionTag)) {
-                AtomicHTMLToken endOption(HTMLTokenTypes::EndTag, optionTag.localName());
-                processEndTag(endOption);
+                RefPtr<AtomicHTMLToken> endOption = AtomicHTMLToken::create(HTMLTokenTypes::EndTag, optionTag.localName());
+                processEndTag(endOption.get());
             }
             if (m_tree.currentNode()->hasTagName(optgroupTag)) {
-                AtomicHTMLToken endOptgroup(HTMLTokenTypes::EndTag, optgroupTag.localName());
-                processEndTag(endOptgroup);
+                RefPtr<AtomicHTMLToken> endOptgroup = AtomicHTMLToken::create(HTMLTokenTypes::EndTag, optgroupTag.localName());
+                processEndTag(endOptgroup.get());
             }
             m_tree.insertHTMLElement(token);
             return;
         }
-        if (token.name() == selectTag) {
+        if (token->name() == selectTag) {
             parseError(token);
-            AtomicHTMLToken endSelect(HTMLTokenTypes::EndTag, selectTag.localName());
-            processEndTag(endSelect);
+            RefPtr<AtomicHTMLToken> endSelect = AtomicHTMLToken::create(HTMLTokenTypes::EndTag, selectTag.localName());
+            processEndTag(endSelect.get());
             return;
         }
-        if (token.name() == inputTag
-            || token.name() == keygenTag
-            || token.name() == textareaTag) {
+        if (token->name() == inputTag
+            || token->name() == keygenTag
+            || token->name() == textareaTag) {
             parseError(token);
             if (!m_tree.openElements()->inSelectScope(selectTag)) {
                 ASSERT(isParsingFragment());
                 return;
             }
-            AtomicHTMLToken endSelect(HTMLTokenTypes::EndTag, selectTag.localName());
-            processEndTag(endSelect);
+            RefPtr<AtomicHTMLToken> endSelect = AtomicHTMLToken::create(HTMLTokenTypes::EndTag, selectTag.localName());
+            processEndTag(endSelect.get());
             processStartTag(token);
             return;
         }
-        if (token.name() == scriptTag) {
+        if (token->name() == scriptTag) {
             bool didProcess = processStartTagForInHead(token);
             ASSERT_UNUSED(didProcess, didProcess);
             return;
@@ -1446,16 +1447,16 @@ void HTMLTreeBuilder::processStartTag(AtomicHTMLToken& token)
     }
 }
 
-void HTMLTreeBuilder::processHtmlStartTagForInBody(AtomicHTMLToken& token)
+void HTMLTreeBuilder::processHtmlStartTagForInBody(AtomicHTMLToken* token)
 {
     parseError(token);
     m_tree.insertHTMLHtmlStartTagInBody(token);
 }
 
-bool HTMLTreeBuilder::processBodyEndTagForInBody(AtomicHTMLToken& token)
+bool HTMLTreeBuilder::processBodyEndTagForInBody(AtomicHTMLToken* token)
 {
-    ASSERT(token.type() == HTMLTokenTypes::EndTag);
-    ASSERT(token.name() == bodyTag);
+    ASSERT(token->type() == HTMLTokenTypes::EndTag);
+    ASSERT(token->name() == bodyTag);
     if (!m_tree.openElements()->inScope(bodyTag.localName())) {
         parseError(token);
         return false;
@@ -1465,15 +1466,15 @@ bool HTMLTreeBuilder::processBodyEndTagForInBody(AtomicHTMLToken& token)
     return true;
 }
 
-void HTMLTreeBuilder::processAnyOtherEndTagForInBody(AtomicHTMLToken& token)
+void HTMLTreeBuilder::processAnyOtherEndTagForInBody(AtomicHTMLToken* token)
 {
-    ASSERT(token.type() == HTMLTokenTypes::EndTag);
+    ASSERT(token->type() == HTMLTokenTypes::EndTag);
     HTMLElementStack::ElementRecord* record = m_tree.openElements()->topRecord();
     while (1) {
         RefPtr<ContainerNode> node = record->node();
-        if (node->hasLocalName(token.name())) {
-            m_tree.generateImpliedEndTagsWithExclusion(token.name());
-            if (!m_tree.currentNode()->hasLocalName(token.name()))
+        if (node->hasLocalName(token->name())) {
+            m_tree.generateImpliedEndTagsWithExclusion(token->name());
+            if (!m_tree.currentNode()->hasLocalName(token->name()))
                 parseError(token);
             m_tree.openElements()->popUntilPopped(toElement(node.get()));
             return;
@@ -1502,7 +1503,7 @@ HTMLElementStack::ElementRecord* HTMLTreeBuilder::furthestBlockForFormattingElem
 }
 
 // http://www.whatwg.org/specs/web-apps/current-work/multipage/tokenization.html#parsing-main-inbody
-void HTMLTreeBuilder::callTheAdoptionAgency(AtomicHTMLToken& token)
+void HTMLTreeBuilder::callTheAdoptionAgency(AtomicHTMLToken* token)
 {
     // The adoption agency algorithm is N^2. We limit the number of iterations
     // to stop from hanging the whole browser. This limit is specified in the
@@ -1513,7 +1514,7 @@ void HTMLTreeBuilder::callTheAdoptionAgency(AtomicHTMLToken& token)
 
     for (int i = 0; i < outerIterationLimit; ++i) {
         // 1.
-        Element* formattingElement = m_tree.activeFormattingElements()->closestElementInScopeWithName(token.name());
+        Element* formattingElement = m_tree.activeFormattingElements()->closestElementInScopeWithName(token->name());
         if (!formattingElement || ((m_tree.openElements()->contains(formattingElement)) && !m_tree.openElements()->inScope(formattingElement))) {
             parseError(token);
             notImplemented(); // Check the stack of open elements for a more specific parse error.
@@ -1559,10 +1560,11 @@ void HTMLTreeBuilder::callTheAdoptionAgency(AtomicHTMLToken& token)
             if (node == formattingElementRecord)
                 break;
             // 6.5
-            RefPtr<Element> newElement = m_tree.createHTMLElementFromElementRecord(node);
+            RefPtr<HTMLStackItem> newItem = m_tree.createElementFromSavedToken(node->stackItem().get());
+
             HTMLFormattingElementList::Entry* nodeEntry = m_tree.activeFormattingElements()->find(node->element());
-            nodeEntry->replaceElement(newElement.get());
-            node->replaceElement(newElement.release());
+            nodeEntry->replaceElement(newItem);
+            node->replaceElement(newItem.release());
             // 6.4 -- Intentionally out of order to handle the case where node
             // was replaced in 6.5.
             // http://www.w3.org/Bugs/Public/show_bug.cgi?id=10096
@@ -1595,25 +1597,25 @@ void HTMLTreeBuilder::callTheAdoptionAgency(AtomicHTMLToken& token)
                 lastNode->element()->lazyAttach();
         }
         // 8
-        RefPtr<Element> newElement = m_tree.createHTMLElementFromElementRecord(formattingElementRecord);
+        RefPtr<HTMLStackItem> newItem = m_tree.createElementFromSavedToken(formattingElementRecord->stackItem().get());
         // 9
-        newElement->takeAllChildrenFrom(furthestBlock->element());
+        newItem->element()->takeAllChildrenFrom(furthestBlock->element());
         // 10
         Element* furthestBlockElement = furthestBlock->element();
         // FIXME: All this creation / parserAddChild / attach business should
         //        be in HTMLConstructionSite.  My guess is that steps 8--12
         //        should all be in some HTMLConstructionSite function.
-        furthestBlockElement->parserAddChild(newElement);
-        if (furthestBlockElement->attached() && !newElement->attached()) {
-            // Notice that newElement might already be attached if, for example, one of the reparented
+        furthestBlockElement->parserAddChild(newItem->element());
+        if (furthestBlockElement->attached() && !newItem->element()->attached()) {
+            // Notice that newItem->element() might already be attached if, for example, one of the reparented
             // children is a style element, which attaches itself automatically.
-            newElement->attach();
+            newItem->element()->attach();
         }
         // 11
-        m_tree.activeFormattingElements()->swapTo(formattingElement, newElement.get(), bookmark);
+        m_tree.activeFormattingElements()->swapTo(formattingElement, newItem, bookmark);
         // 12
         m_tree.openElements()->remove(formattingElement);
-        m_tree.openElements()->insertAbove(newElement, furthestBlock);
+        m_tree.openElements()->insertAbove(newItem, furthestBlock);
     }
 }
 
@@ -1669,11 +1671,11 @@ void HTMLTreeBuilder::resetInsertionModeAppropriately()
     }
 }
 
-void HTMLTreeBuilder::processEndTagForInTableBody(AtomicHTMLToken& token)
+void HTMLTreeBuilder::processEndTagForInTableBody(AtomicHTMLToken* token)
 {
-    ASSERT(token.type() == HTMLTokenTypes::EndTag);
-    if (isTableBodyContextTag(token.name())) {
-        if (!m_tree.openElements()->inTableScope(token.name())) {
+    ASSERT(token->type() == HTMLTokenTypes::EndTag);
+    if (isTableBodyContextTag(token->name())) {
+        if (!m_tree.openElements()->inTableScope(token->name())) {
             parseError(token);
             return;
         }
@@ -1682,7 +1684,7 @@ void HTMLTreeBuilder::processEndTagForInTableBody(AtomicHTMLToken& token)
         setInsertionMode(InTableMode);
         return;
     }
-    if (token.name() == tableTag) {
+    if (token->name() == tableTag) {
         // FIXME: This is slow.
         if (!m_tree.openElements()->inTableScope(tbodyTag.localName()) && !m_tree.openElements()->inTableScope(theadTag.localName()) && !m_tree.openElements()->inTableScope(tfootTag.localName())) {
             ASSERT(isParsingFragment());
@@ -1695,25 +1697,25 @@ void HTMLTreeBuilder::processEndTagForInTableBody(AtomicHTMLToken& token)
         processEndTag(token);
         return;
     }
-    if (token.name() == bodyTag
-        || isCaptionColOrColgroupTag(token.name())
-        || token.name() == htmlTag
-        || isTableCellContextTag(token.name())
-        || token.name() == trTag) {
+    if (token->name() == bodyTag
+        || isCaptionColOrColgroupTag(token->name())
+        || token->name() == htmlTag
+        || isTableCellContextTag(token->name())
+        || token->name() == trTag) {
         parseError(token);
         return;
     }
     processEndTagForInTable(token);
 }
 
-void HTMLTreeBuilder::processEndTagForInRow(AtomicHTMLToken& token)
+void HTMLTreeBuilder::processEndTagForInRow(AtomicHTMLToken* token)
 {
-    ASSERT(token.type() == HTMLTokenTypes::EndTag);
-    if (token.name() == trTag) {
+    ASSERT(token->type() == HTMLTokenTypes::EndTag);
+    if (token->name() == trTag) {
         processTrEndTagForInRow();
         return;
     }
-    if (token.name() == tableTag) {
+    if (token->name() == tableTag) {
         if (!processTrEndTagForInRow()) {
             ASSERT(isParsingFragment());
             return;
@@ -1722,8 +1724,8 @@ void HTMLTreeBuilder::processEndTagForInRow(AtomicHTMLToken& token)
         processEndTag(token);
         return;
     }
-    if (isTableBodyContextTag(token.name())) {
-        if (!m_tree.openElements()->inTableScope(token.name())) {
+    if (isTableBodyContextTag(token->name())) {
+        if (!m_tree.openElements()->inTableScope(token->name())) {
             parseError(token);
             return;
         }
@@ -1732,43 +1734,43 @@ void HTMLTreeBuilder::processEndTagForInRow(AtomicHTMLToken& token)
         processEndTag(token);
         return;
     }
-    if (token.name() == bodyTag
-        || isCaptionColOrColgroupTag(token.name())
-        || token.name() == htmlTag
-        || isTableCellContextTag(token.name())) {
+    if (token->name() == bodyTag
+        || isCaptionColOrColgroupTag(token->name())
+        || token->name() == htmlTag
+        || isTableCellContextTag(token->name())) {
         parseError(token);
         return;
     }
     processEndTagForInTable(token);
 }
 
-void HTMLTreeBuilder::processEndTagForInCell(AtomicHTMLToken& token)
+void HTMLTreeBuilder::processEndTagForInCell(AtomicHTMLToken* token)
 {
-    ASSERT(token.type() == HTMLTokenTypes::EndTag);
-    if (isTableCellContextTag(token.name())) {
-        if (!m_tree.openElements()->inTableScope(token.name())) {
+    ASSERT(token->type() == HTMLTokenTypes::EndTag);
+    if (isTableCellContextTag(token->name())) {
+        if (!m_tree.openElements()->inTableScope(token->name())) {
             parseError(token);
             return;
         }
         m_tree.generateImpliedEndTags();
-        if (!m_tree.currentNode()->hasLocalName(token.name()))
+        if (!m_tree.currentNode()->hasLocalName(token->name()))
             parseError(token);
-        m_tree.openElements()->popUntilPopped(token.name());
+        m_tree.openElements()->popUntilPopped(token->name());
         m_tree.activeFormattingElements()->clearToLastMarker();
         setInsertionMode(InRowMode);
         return;
     }
-    if (token.name() == bodyTag
-        || isCaptionColOrColgroupTag(token.name())
-        || token.name() == htmlTag) {
+    if (token->name() == bodyTag
+        || isCaptionColOrColgroupTag(token->name())
+        || token->name() == htmlTag) {
         parseError(token);
         return;
     }
-    if (token.name() == tableTag
-        || token.name() == trTag
-        || isTableBodyContextTag(token.name())) {
-        if (!m_tree.openElements()->inTableScope(token.name())) {
-            ASSERT(isTableBodyContextTag(token.name()) || isParsingFragment());
+    if (token->name() == tableTag
+        || token->name() == trTag
+        || isTableBodyContextTag(token->name())) {
+        if (!m_tree.openElements()->inTableScope(token->name())) {
+            ASSERT(isTableBodyContextTag(token->name()) || isParsingFragment());
             parseError(token);
             return;
         }
@@ -1779,54 +1781,54 @@ void HTMLTreeBuilder::processEndTagForInCell(AtomicHTMLToken& token)
     processEndTagForInBody(token);
 }
 
-void HTMLTreeBuilder::processEndTagForInBody(AtomicHTMLToken& token)
+void HTMLTreeBuilder::processEndTagForInBody(AtomicHTMLToken* token)
 {
-    ASSERT(token.type() == HTMLTokenTypes::EndTag);
-    if (token.name() == bodyTag) {
+    ASSERT(token->type() == HTMLTokenTypes::EndTag);
+    if (token->name() == bodyTag) {
         processBodyEndTagForInBody(token);
         return;
     }
-    if (token.name() == htmlTag) {
-        AtomicHTMLToken endBody(HTMLTokenTypes::EndTag, bodyTag.localName());
-        if (processBodyEndTagForInBody(endBody))
+    if (token->name() == htmlTag) {
+        RefPtr<AtomicHTMLToken> endBody = AtomicHTMLToken::create(HTMLTokenTypes::EndTag, bodyTag.localName());
+        if (processBodyEndTagForInBody(endBody.get()))
             processEndTag(token);
         return;
     }
-    if (token.name() == addressTag
-        || token.name() == articleTag
-        || token.name() == asideTag
-        || token.name() == blockquoteTag
-        || token.name() == buttonTag
-        || token.name() == centerTag
-        || token.name() == detailsTag
-        || token.name() == dirTag
-        || token.name() == divTag
-        || token.name() == dlTag
-        || token.name() == fieldsetTag
-        || token.name() == figcaptionTag
-        || token.name() == figureTag
-        || token.name() == footerTag
-        || token.name() == headerTag
-        || token.name() == hgroupTag
-        || token.name() == listingTag
-        || token.name() == menuTag
-        || token.name() == navTag
-        || token.name() == olTag
-        || token.name() == preTag
-        || token.name() == sectionTag
-        || token.name() == summaryTag
-        || token.name() == ulTag) {
-        if (!m_tree.openElements()->inScope(token.name())) {
+    if (token->name() == addressTag
+        || token->name() == articleTag
+        || token->name() == asideTag
+        || token->name() == blockquoteTag
+        || token->name() == buttonTag
+        || token->name() == centerTag
+        || token->name() == detailsTag
+        || token->name() == dirTag
+        || token->name() == divTag
+        || token->name() == dlTag
+        || token->name() == fieldsetTag
+        || token->name() == figcaptionTag
+        || token->name() == figureTag
+        || token->name() == footerTag
+        || token->name() == headerTag
+        || token->name() == hgroupTag
+        || token->name() == listingTag
+        || token->name() == menuTag
+        || token->name() == navTag
+        || token->name() == olTag
+        || token->name() == preTag
+        || token->name() == sectionTag
+        || token->name() == summaryTag
+        || token->name() == ulTag) {
+        if (!m_tree.openElements()->inScope(token->name())) {
             parseError(token);
             return;
         }
         m_tree.generateImpliedEndTags();
-        if (!m_tree.currentNode()->hasLocalName(token.name()))
+        if (!m_tree.currentNode()->hasLocalName(token->name()))
             parseError(token);
-        m_tree.openElements()->popUntilPopped(token.name());
+        m_tree.openElements()->popUntilPopped(token->name());
         return;
     }
-    if (token.name() == formTag) {
+    if (token->name() == formTag) {
         RefPtr<Element> node = m_tree.takeForm();
         if (!node || !m_tree.openElements()->inScope(node.get())) {
             parseError(token);
@@ -1837,73 +1839,73 @@ void HTMLTreeBuilder::processEndTagForInBody(AtomicHTMLToken& token)
             parseError(token);
         m_tree.openElements()->remove(node.get());
     }
-    if (token.name() == pTag) {
-        if (!m_tree.openElements()->inButtonScope(token.name())) {
+    if (token->name() == pTag) {
+        if (!m_tree.openElements()->inButtonScope(token->name())) {
             parseError(token);
             processFakeStartTag(pTag);
-            ASSERT(m_tree.openElements()->inScope(token.name()));
+            ASSERT(m_tree.openElements()->inScope(token->name()));
             processEndTag(token);
             return;
         }
-        m_tree.generateImpliedEndTagsWithExclusion(token.name());
-        if (!m_tree.currentNode()->hasLocalName(token.name()))
+        m_tree.generateImpliedEndTagsWithExclusion(token->name());
+        if (!m_tree.currentNode()->hasLocalName(token->name()))
             parseError(token);
-        m_tree.openElements()->popUntilPopped(token.name());
+        m_tree.openElements()->popUntilPopped(token->name());
         return;
     }
-    if (token.name() == liTag) {
-        if (!m_tree.openElements()->inListItemScope(token.name())) {
+    if (token->name() == liTag) {
+        if (!m_tree.openElements()->inListItemScope(token->name())) {
             parseError(token);
             return;
         }
-        m_tree.generateImpliedEndTagsWithExclusion(token.name());
-        if (!m_tree.currentNode()->hasLocalName(token.name()))
+        m_tree.generateImpliedEndTagsWithExclusion(token->name());
+        if (!m_tree.currentNode()->hasLocalName(token->name()))
             parseError(token);
-        m_tree.openElements()->popUntilPopped(token.name());
+        m_tree.openElements()->popUntilPopped(token->name());
         return;
     }
-    if (token.name() == ddTag
-        || token.name() == dtTag) {
-        if (!m_tree.openElements()->inScope(token.name())) {
+    if (token->name() == ddTag
+        || token->name() == dtTag) {
+        if (!m_tree.openElements()->inScope(token->name())) {
             parseError(token);
             return;
         }
-        m_tree.generateImpliedEndTagsWithExclusion(token.name());
-        if (!m_tree.currentNode()->hasLocalName(token.name()))
+        m_tree.generateImpliedEndTagsWithExclusion(token->name());
+        if (!m_tree.currentNode()->hasLocalName(token->name()))
             parseError(token);
-        m_tree.openElements()->popUntilPopped(token.name());
+        m_tree.openElements()->popUntilPopped(token->name());
         return;
     }
-    if (isNumberedHeaderTag(token.name())) {
+    if (isNumberedHeaderTag(token->name())) {
         if (!m_tree.openElements()->hasNumberedHeaderElementInScope()) {
             parseError(token);
             return;
         }
         m_tree.generateImpliedEndTags();
-        if (!m_tree.currentNode()->hasLocalName(token.name()))
+        if (!m_tree.currentNode()->hasLocalName(token->name()))
             parseError(token);
         m_tree.openElements()->popUntilNumberedHeaderElementPopped();
         return;
     }
-    if (isFormattingTag(token.name())) {
+    if (isFormattingTag(token->name())) {
         callTheAdoptionAgency(token);
         return;
     }
-    if (token.name() == appletTag
-        || token.name() == marqueeTag
-        || token.name() == objectTag) {
-        if (!m_tree.openElements()->inScope(token.name())) {
+    if (token->name() == appletTag
+        || token->name() == marqueeTag
+        || token->name() == objectTag) {
+        if (!m_tree.openElements()->inScope(token->name())) {
             parseError(token);
             return;
         }
         m_tree.generateImpliedEndTags();
-        if (!m_tree.currentNode()->hasLocalName(token.name()))
+        if (!m_tree.currentNode()->hasLocalName(token->name()))
             parseError(token);
-        m_tree.openElements()->popUntilPopped(token.name());
+        m_tree.openElements()->popUntilPopped(token->name());
         m_tree.activeFormattingElements()->clearToLastMarker();
         return;
     }
-    if (token.name() == brTag) {
+    if (token->name() == brTag) {
         parseError(token);
         processFakeStartTag(brTag);
         return;
@@ -1952,19 +1954,19 @@ bool HTMLTreeBuilder::processTableEndTagForInTable()
     return true;
 }
 
-void HTMLTreeBuilder::processEndTagForInTable(AtomicHTMLToken& token)
+void HTMLTreeBuilder::processEndTagForInTable(AtomicHTMLToken* token)
 {
-    ASSERT(token.type() == HTMLTokenTypes::EndTag);
-    if (token.name() == tableTag) {
+    ASSERT(token->type() == HTMLTokenTypes::EndTag);
+    if (token->name() == tableTag) {
         processTableEndTagForInTable();
         return;
     }
-    if (token.name() == bodyTag
-        || isCaptionColOrColgroupTag(token.name())
-        || token.name() == htmlTag
-        || isTableBodyContextTag(token.name())
-        || isTableCellContextTag(token.name())
-        || token.name() == trTag) {
+    if (token->name() == bodyTag
+        || isCaptionColOrColgroupTag(token->name())
+        || token->name() == htmlTag
+        || isTableBodyContextTag(token->name())
+        || isTableCellContextTag(token->name())
+        || token->name() == trTag) {
         parseError(token);
         return;
     }
@@ -1974,9 +1976,9 @@ void HTMLTreeBuilder::processEndTagForInTable(AtomicHTMLToken& token)
     processEndTagForInBody(token);
 }
 
-void HTMLTreeBuilder::processEndTag(AtomicHTMLToken& token)
+void HTMLTreeBuilder::processEndTag(AtomicHTMLToken* token)
 {
-    ASSERT(token.type() == HTMLTokenTypes::EndTag);
+    ASSERT(token->type() == HTMLTokenTypes::EndTag);
     switch (insertionMode()) {
     case InitialMode:
         ASSERT(insertionMode() == InitialMode);
@@ -1984,7 +1986,7 @@ void HTMLTreeBuilder::processEndTag(AtomicHTMLToken& token)
         // Fall through.
     case BeforeHTMLMode:
         ASSERT(insertionMode() == BeforeHTMLMode);
-        if (token.name() != headTag && token.name() != bodyTag && token.name() != htmlTag && token.name() != brTag) {
+        if (token->name() != headTag && token->name() != bodyTag && token->name() != htmlTag && token->name() != brTag) {
             parseError(token);
             return;
         }
@@ -1992,7 +1994,7 @@ void HTMLTreeBuilder::processEndTag(AtomicHTMLToken& token)
         // Fall through.
     case BeforeHeadMode:
         ASSERT(insertionMode() == BeforeHeadMode);
-        if (token.name() != headTag && token.name() != bodyTag && token.name() != htmlTag && token.name() != brTag) {
+        if (token->name() != headTag && token->name() != bodyTag && token->name() != htmlTag && token->name() != brTag) {
             parseError(token);
             return;
         }
@@ -2000,12 +2002,12 @@ void HTMLTreeBuilder::processEndTag(AtomicHTMLToken& token)
         // Fall through.
     case InHeadMode:
         ASSERT(insertionMode() == InHeadMode);
-        if (token.name() == headTag) {
+        if (token->name() == headTag) {
             m_tree.openElements()->popHTMLHeadElement();
             setInsertionMode(AfterHeadMode);
             return;
         }
-        if (token.name() != bodyTag && token.name() != htmlTag && token.name() != brTag) {
+        if (token->name() != bodyTag && token->name() != htmlTag && token->name() != brTag) {
             parseError(token);
             return;
         }
@@ -2013,7 +2015,7 @@ void HTMLTreeBuilder::processEndTag(AtomicHTMLToken& token)
         // Fall through.
     case AfterHeadMode:
         ASSERT(insertionMode() == AfterHeadMode);
-        if (token.name() != bodyTag && token.name() != htmlTag && token.name() != brTag) {
+        if (token->name() != bodyTag && token->name() != htmlTag && token->name() != brTag) {
             parseError(token);
             return;
         }
@@ -2029,11 +2031,11 @@ void HTMLTreeBuilder::processEndTag(AtomicHTMLToken& token)
         break;
     case InCaptionMode:
         ASSERT(insertionMode() == InCaptionMode);
-        if (token.name() == captionTag) {
+        if (token->name() == captionTag) {
             processCaptionEndTagForInCaption();
             return;
         }
-        if (token.name() == tableTag) {
+        if (token->name() == tableTag) {
             parseError(token);
             if (!processCaptionEndTagForInCaption()) {
                 ASSERT(isParsingFragment());
@@ -2042,13 +2044,13 @@ void HTMLTreeBuilder::processEndTag(AtomicHTMLToken& token)
             processEndTag(token);
             return;
         }
-        if (token.name() == bodyTag
-            || token.name() == colTag
-            || token.name() == colgroupTag
-            || token.name() == htmlTag
-            || isTableBodyContextTag(token.name())
-            || isTableCellContextTag(token.name())
-            || token.name() == trTag) {
+        if (token->name() == bodyTag
+            || token->name() == colTag
+            || token->name() == colgroupTag
+            || token->name() == htmlTag
+            || isTableBodyContextTag(token->name())
+            || isTableCellContextTag(token->name())
+            || token->name() == trTag) {
             parseError(token);
             return;
         }
@@ -2056,11 +2058,11 @@ void HTMLTreeBuilder::processEndTag(AtomicHTMLToken& token)
         break;
     case InColumnGroupMode:
         ASSERT(insertionMode() == InColumnGroupMode);
-        if (token.name() == colgroupTag) {
+        if (token->name() == colgroupTag) {
             processColgroupEndTagForInColumnGroup();
             return;
         }
-        if (token.name() == colTag) {
+        if (token->name() == colTag) {
             parseError(token);
             return;
         }
@@ -2084,7 +2086,7 @@ void HTMLTreeBuilder::processEndTag(AtomicHTMLToken& token)
         break;
     case AfterBodyMode:
         ASSERT(insertionMode() == AfterBodyMode);
-        if (token.name() == htmlTag) {
+        if (token->name() == htmlTag) {
             if (isParsingFragment()) {
                 parseError(token);
                 return;
@@ -2101,14 +2103,14 @@ void HTMLTreeBuilder::processEndTag(AtomicHTMLToken& token)
         break;
     case InHeadNoscriptMode:
         ASSERT(insertionMode() == InHeadNoscriptMode);
-        if (token.name() == noscriptTag) {
+        if (token->name() == noscriptTag) {
             ASSERT(m_tree.currentElement()->hasTagName(noscriptTag));
             m_tree.openElements()->pop();
             ASSERT(m_tree.currentElement()->hasTagName(headTag));
             setInsertionMode(InHeadMode);
             return;
         }
-        if (token.name() != brTag) {
+        if (token->name() != brTag) {
             parseError(token);
             return;
         }
@@ -2116,7 +2118,7 @@ void HTMLTreeBuilder::processEndTag(AtomicHTMLToken& token)
         processToken(token);
         break;
     case TextMode:
-        if (token.name() == scriptTag) {
+        if (token->name() == scriptTag) {
             // Pause ourselves so that parsing stops until the script can be processed by the caller.
             ASSERT(m_tree.currentElement()->hasTagName(scriptTag));
             m_scriptToProcess = m_tree.currentElement();
@@ -2138,7 +2140,7 @@ void HTMLTreeBuilder::processEndTag(AtomicHTMLToken& token)
         break;
     case InFramesetMode:
         ASSERT(insertionMode() == InFramesetMode);
-        if (token.name() == framesetTag) {
+        if (token->name() == framesetTag) {
             if (m_tree.currentNode() == m_tree.openElements()->rootNode()) {
                 parseError(token);
                 return;
@@ -2151,7 +2153,7 @@ void HTMLTreeBuilder::processEndTag(AtomicHTMLToken& token)
         break;
     case AfterFramesetMode:
         ASSERT(insertionMode() == AfterFramesetMode);
-        if (token.name() == htmlTag) {
+        if (token->name() == htmlTag) {
             setInsertionMode(AfterAfterFramesetMode);
             return;
         }
@@ -2162,15 +2164,15 @@ void HTMLTreeBuilder::processEndTag(AtomicHTMLToken& token)
         break;
     case InSelectInTableMode:
         ASSERT(insertionMode() == InSelectInTableMode);
-        if (token.name() == captionTag
-            || token.name() == tableTag
-            || isTableBodyContextTag(token.name())
-            || token.name() == trTag
-            || isTableCellContextTag(token.name())) {
+        if (token->name() == captionTag
+            || token->name() == tableTag
+            || isTableBodyContextTag(token->name())
+            || token->name() == trTag
+            || isTableCellContextTag(token->name())) {
             parseError(token);
-            if (m_tree.openElements()->inTableScope(token.name())) {
-                AtomicHTMLToken endSelect(HTMLTokenTypes::EndTag, selectTag.localName());
-                processEndTag(endSelect);
+            if (m_tree.openElements()->inTableScope(token->name())) {
+                RefPtr<AtomicHTMLToken> endSelect = AtomicHTMLToken::create(HTMLTokenTypes::EndTag, selectTag.localName());
+                processEndTag(endSelect.get());
                 processEndTag(token);
             }
             return;
@@ -2178,7 +2180,7 @@ void HTMLTreeBuilder::processEndTag(AtomicHTMLToken& token)
         // Fall through.
     case InSelectMode:
         ASSERT(insertionMode() == InSelectMode || insertionMode() == InSelectInTableMode);
-        if (token.name() == optgroupTag) {
+        if (token->name() == optgroupTag) {
             if (m_tree.currentNode()->hasTagName(optionTag) && m_tree.oneBelowTop() && m_tree.oneBelowTop()->hasTagName(optgroupTag))
                 processFakeEndTag(optionTag);
             if (m_tree.currentNode()->hasTagName(optgroupTag)) {
@@ -2188,7 +2190,7 @@ void HTMLTreeBuilder::processEndTag(AtomicHTMLToken& token)
             parseError(token);
             return;
         }
-        if (token.name() == optionTag) {
+        if (token->name() == optionTag) {
             if (m_tree.currentNode()->hasTagName(optionTag)) {
                 m_tree.openElements()->pop();
                 return;
@@ -2196,8 +2198,8 @@ void HTMLTreeBuilder::processEndTag(AtomicHTMLToken& token)
             parseError(token);
             return;
         }
-        if (token.name() == selectTag) {
-            if (!m_tree.openElements()->inSelectScope(token.name())) {
+        if (token->name() == selectTag) {
+            if (!m_tree.openElements()->inSelectScope(token->name())) {
                 ASSERT(isParsingFragment());
                 parseError(token);
                 return;
@@ -2214,9 +2216,9 @@ void HTMLTreeBuilder::processEndTag(AtomicHTMLToken& token)
     }
 }
 
-void HTMLTreeBuilder::processComment(AtomicHTMLToken& token)
+void HTMLTreeBuilder::processComment(AtomicHTMLToken* token)
 {
-    ASSERT(token.type() == HTMLTokenTypes::Comment);
+    ASSERT(token->type() == HTMLTokenTypes::Comment);
     if (m_insertionMode == InitialMode
         || m_insertionMode == BeforeHTMLMode
         || m_insertionMode == AfterAfterBodyMode
@@ -2236,9 +2238,9 @@ void HTMLTreeBuilder::processComment(AtomicHTMLToken& token)
     m_tree.insertComment(token);
 }
 
-void HTMLTreeBuilder::processCharacter(AtomicHTMLToken& token)
+void HTMLTreeBuilder::processCharacter(AtomicHTMLToken* token)
 {
-    ASSERT(token.type() == HTMLTokenTypes::Character);
+    ASSERT(token->type() == HTMLTokenTypes::Character);
     ExternalCharacterTokenBuffer buffer(token);
     processCharacterBuffer(buffer);
 }
@@ -2419,9 +2421,9 @@ void HTMLTreeBuilder::processCharacterBufferForInBody(ExternalCharacterTokenBuff
         m_framesetOk = false;
 }
 
-void HTMLTreeBuilder::processEndOfFile(AtomicHTMLToken& token)
+void HTMLTreeBuilder::processEndOfFile(AtomicHTMLToken* token)
 {
-    ASSERT(token.type() == HTMLTokenTypes::EndOfFile);
+    ASSERT(token->type() == HTMLTokenTypes::EndOfFile);
     switch (insertionMode()) {
     case InitialMode:
         ASSERT(insertionMode() == InitialMode);
@@ -2512,33 +2514,33 @@ void HTMLTreeBuilder::defaultForInitial()
 
 void HTMLTreeBuilder::defaultForBeforeHTML()
 {
-    AtomicHTMLToken startHTML(HTMLTokenTypes::StartTag, htmlTag.localName());
-    m_tree.insertHTMLHtmlStartTagBeforeHTML(startHTML);
+    RefPtr<AtomicHTMLToken> startHTML = AtomicHTMLToken::create(HTMLTokenTypes::StartTag, htmlTag.localName());
+    m_tree.insertHTMLHtmlStartTagBeforeHTML(startHTML.get());
     setInsertionMode(BeforeHeadMode);
 }
 
 void HTMLTreeBuilder::defaultForBeforeHead()
 {
-    AtomicHTMLToken startHead(HTMLTokenTypes::StartTag, headTag.localName());
-    processStartTag(startHead);
+    RefPtr<AtomicHTMLToken> startHead = AtomicHTMLToken::create(HTMLTokenTypes::StartTag, headTag.localName());
+    processStartTag(startHead.get());
 }
 
 void HTMLTreeBuilder::defaultForInHead()
 {
-    AtomicHTMLToken endHead(HTMLTokenTypes::EndTag, headTag.localName());
-    processEndTag(endHead);
+    RefPtr<AtomicHTMLToken> endHead = AtomicHTMLToken::create(HTMLTokenTypes::EndTag, headTag.localName());
+    processEndTag(endHead.get());
 }
 
 void HTMLTreeBuilder::defaultForInHeadNoscript()
 {
-    AtomicHTMLToken endNoscript(HTMLTokenTypes::EndTag, noscriptTag.localName());
-    processEndTag(endNoscript);
+    RefPtr<AtomicHTMLToken> endNoscript = AtomicHTMLToken::create(HTMLTokenTypes::EndTag, noscriptTag.localName());
+    processEndTag(endNoscript.get());
 }
 
 void HTMLTreeBuilder::defaultForAfterHead()
 {
-    AtomicHTMLToken startBody(HTMLTokenTypes::StartTag, bodyTag.localName());
-    processStartTag(startBody);
+    RefPtr<AtomicHTMLToken> startBody = AtomicHTMLToken::create(HTMLTokenTypes::StartTag, bodyTag.localName());
+    processStartTag(startBody.get());
     m_framesetOk = true;
 }
 
@@ -2559,28 +2561,28 @@ void HTMLTreeBuilder::defaultForInTableText()
     setInsertionMode(m_originalInsertionMode);
 }
 
-bool HTMLTreeBuilder::processStartTagForInHead(AtomicHTMLToken& token)
+bool HTMLTreeBuilder::processStartTagForInHead(AtomicHTMLToken* token)
 {
-    ASSERT(token.type() == HTMLTokenTypes::StartTag);
-    if (token.name() == htmlTag) {
+    ASSERT(token->type() == HTMLTokenTypes::StartTag);
+    if (token->name() == htmlTag) {
         processHtmlStartTagForInBody(token);
         return true;
     }
-    if (token.name() == baseTag
-        || token.name() == basefontTag
-        || token.name() == bgsoundTag
-        || token.name() == commandTag
-        || token.name() == linkTag
-        || token.name() == metaTag) {
+    if (token->name() == baseTag
+        || token->name() == basefontTag
+        || token->name() == bgsoundTag
+        || token->name() == commandTag
+        || token->name() == linkTag
+        || token->name() == metaTag) {
         m_tree.insertSelfClosingHTMLElement(token);
         // Note: The custom processing for the <meta> tag is done in HTMLMetaElement::process().
         return true;
     }
-    if (token.name() == titleTag) {
+    if (token->name() == titleTag) {
         processGenericRCDATAStartTag(token);
         return true;
     }
-    if (token.name() == noscriptTag) {
+    if (token->name() == noscriptTag) {
         if (scriptEnabled(m_document->frame())) {
             processGenericRawTextStartTag(token);
             return true;
@@ -2589,44 +2591,44 @@ bool HTMLTreeBuilder::processStartTagForInHead(AtomicHTMLToken& token)
         setInsertionMode(InHeadNoscriptMode);
         return true;
     }
-    if (token.name() == noframesTag || token.name() == styleTag) {
+    if (token->name() == noframesTag || token->name() == styleTag) {
         processGenericRawTextStartTag(token);
         return true;
     }
-    if (token.name() == scriptTag) {
+    if (token->name() == scriptTag) {
         processScriptStartTag(token);
-        if (m_usePreHTML5ParserQuirks && token.selfClosing())
+        if (m_usePreHTML5ParserQuirks && token->selfClosing())
             processFakeEndTag(scriptTag);
         return true;
     }
-    if (token.name() == headTag) {
+    if (token->name() == headTag) {
         parseError(token);
         return true;
     }
     return false;
 }
 
-void HTMLTreeBuilder::processGenericRCDATAStartTag(AtomicHTMLToken& token)
+void HTMLTreeBuilder::processGenericRCDATAStartTag(AtomicHTMLToken* token)
 {
-    ASSERT(token.type() == HTMLTokenTypes::StartTag);
+    ASSERT(token->type() == HTMLTokenTypes::StartTag);
     m_tree.insertHTMLElement(token);
     m_parser->tokenizer()->setState(HTMLTokenizerState::RCDATAState);
     m_originalInsertionMode = m_insertionMode;
     setInsertionMode(TextMode);
 }
 
-void HTMLTreeBuilder::processGenericRawTextStartTag(AtomicHTMLToken& token)
+void HTMLTreeBuilder::processGenericRawTextStartTag(AtomicHTMLToken* token)
 {
-    ASSERT(token.type() == HTMLTokenTypes::StartTag);
+    ASSERT(token->type() == HTMLTokenTypes::StartTag);
     m_tree.insertHTMLElement(token);
     m_parser->tokenizer()->setState(HTMLTokenizerState::RAWTEXTState);
     m_originalInsertionMode = m_insertionMode;
     setInsertionMode(TextMode);
 }
 
-void HTMLTreeBuilder::processScriptStartTag(AtomicHTMLToken& token)
+void HTMLTreeBuilder::processScriptStartTag(AtomicHTMLToken* token)
 {
-    ASSERT(token.type() == HTMLTokenTypes::StartTag);
+    ASSERT(token->type() == HTMLTokenTypes::StartTag);
     m_tree.insertScriptElement(token);
     m_parser->tokenizer()->setState(HTMLTokenizerState::ScriptDataState);
     m_originalInsertionMode = m_insertionMode;
@@ -2639,7 +2641,7 @@ void HTMLTreeBuilder::processScriptStartTag(AtomicHTMLToken& token)
 }
 
 // http://www.whatwg.org/specs/web-apps/current-work/multipage/tree-construction.html#tree-construction
-bool HTMLTreeBuilder::shouldProcessTokenInForeignContent(AtomicHTMLToken& token)
+bool HTMLTreeBuilder::shouldProcessTokenInForeignContent(AtomicHTMLToken* token)
 {
     if (m_tree.isEmpty())
         return false;
@@ -2647,31 +2649,31 @@ bool HTMLTreeBuilder::shouldProcessTokenInForeignContent(AtomicHTMLToken& token)
     if (isInHTMLNamespace(node))
         return false;
     if (HTMLElementStack::isMathMLTextIntegrationPoint(node)) {
-        if (token.type() == HTMLTokenTypes::StartTag
-            && token.name() != MathMLNames::mglyphTag
-            && token.name() != MathMLNames::malignmarkTag)
+        if (token->type() == HTMLTokenTypes::StartTag
+            && token->name() != MathMLNames::mglyphTag
+            && token->name() != MathMLNames::malignmarkTag)
             return false;
-        if (token.type() == HTMLTokenTypes::Character)
+        if (token->type() == HTMLTokenTypes::Character)
             return false;
     }
     if (node->hasTagName(MathMLNames::annotation_xmlTag)
-        && token.type() == HTMLTokenTypes::StartTag
-        && token.name() == SVGNames::svgTag)
+        && token->type() == HTMLTokenTypes::StartTag
+        && token->name() == SVGNames::svgTag)
         return false;
     if (HTMLElementStack::isHTMLIntegrationPoint(node)) {
-        if (token.type() == HTMLTokenTypes::StartTag)
+        if (token->type() == HTMLTokenTypes::StartTag)
             return false;
-        if (token.type() == HTMLTokenTypes::Character)
+        if (token->type() == HTMLTokenTypes::Character)
             return false;
     }
-    if (token.type() == HTMLTokenTypes::EndOfFile)
+    if (token->type() == HTMLTokenTypes::EndOfFile)
         return false;
     return true;
 }
 
-void HTMLTreeBuilder::processTokenInForeignContent(AtomicHTMLToken& token)
+void HTMLTreeBuilder::processTokenInForeignContent(AtomicHTMLToken* token)
 {
-    switch (token.type()) {
+    switch (token->type()) {
     case HTMLTokenTypes::Uninitialized:
         ASSERT_NOT_REACHED();
         break;
@@ -2679,46 +2681,46 @@ void HTMLTreeBuilder::processTokenInForeignContent(AtomicHTMLToken& token)
         parseError(token);
         break;
     case HTMLTokenTypes::StartTag: {
-        if (token.name() == bTag
-            || token.name() == bigTag
-            || token.name() == blockquoteTag
-            || token.name() == bodyTag
-            || token.name() == brTag
-            || token.name() == centerTag
-            || token.name() == codeTag
-            || token.name() == ddTag
-            || token.name() == divTag
-            || token.name() == dlTag
-            || token.name() == dtTag
-            || token.name() == emTag
-            || token.name() == embedTag
-            || isNumberedHeaderTag(token.name())
-            || token.name() == headTag
-            || token.name() == hrTag
-            || token.name() == iTag
-            || token.name() == imgTag
-            || token.name() == liTag
-            || token.name() == listingTag
-            || token.name() == menuTag
-            || token.name() == metaTag
-            || token.name() == nobrTag
-            || token.name() == olTag
-            || token.name() == pTag
-            || token.name() == preTag
-            || token.name() == rubyTag
-            || token.name() == sTag
-            || token.name() == smallTag
-            || token.name() == spanTag
-            || token.name() == strongTag
-            || token.name() == strikeTag
-            || token.name() == subTag
-            || token.name() == supTag
-            || token.name() == tableTag
-            || token.name() == ttTag
-            || token.name() == uTag
-            || token.name() == ulTag
-            || token.name() == varTag
-            || (token.name() == fontTag && (token.getAttributeItem(colorAttr) || token.getAttributeItem(faceAttr) || token.getAttributeItem(sizeAttr)))) {
+        if (token->name() == bTag
+            || token->name() == bigTag
+            || token->name() == blockquoteTag
+            || token->name() == bodyTag
+            || token->name() == brTag
+            || token->name() == centerTag
+            || token->name() == codeTag
+            || token->name() == ddTag
+            || token->name() == divTag
+            || token->name() == dlTag
+            || token->name() == dtTag
+            || token->name() == emTag
+            || token->name() == embedTag
+            || isNumberedHeaderTag(token->name())
+            || token->name() == headTag
+            || token->name() == hrTag
+            || token->name() == iTag
+            || token->name() == imgTag
+            || token->name() == liTag
+            || token->name() == listingTag
+            || token->name() == menuTag
+            || token->name() == metaTag
+            || token->name() == nobrTag
+            || token->name() == olTag
+            || token->name() == pTag
+            || token->name() == preTag
+            || token->name() == rubyTag
+            || token->name() == sTag
+            || token->name() == smallTag
+            || token->name() == spanTag
+            || token->name() == strongTag
+            || token->name() == strikeTag
+            || token->name() == subTag
+            || token->name() == supTag
+            || token->name() == tableTag
+            || token->name() == ttTag
+            || token->name() == uTag
+            || token->name() == ulTag
+            || token->name() == varTag
+            || (token->name() == fontTag && (token->getAttributeItem(colorAttr) || token->getAttributeItem(faceAttr) || token->getAttributeItem(sizeAttr)))) {
             parseError(token);
             m_tree.openElements()->popUntilForeignContentScopeMarker();
             processStartTag(token);
@@ -2739,7 +2741,7 @@ void HTMLTreeBuilder::processTokenInForeignContent(AtomicHTMLToken& token)
         if (m_tree.currentNode()->namespaceURI() == SVGNames::svgNamespaceURI)
             adjustSVGTagNameCase(token);
 
-        if (token.name() == SVGNames::scriptTag && m_tree.currentNode()->hasTagName(SVGNames::scriptTag)) {
+        if (token->name() == SVGNames::scriptTag && m_tree.currentNode()->hasTagName(SVGNames::scriptTag)) {
             m_scriptToProcess = m_tree.currentElement();
             m_tree.openElements()->pop();
             return;
@@ -2747,10 +2749,10 @@ void HTMLTreeBuilder::processTokenInForeignContent(AtomicHTMLToken& token)
         if (!isInHTMLNamespace(m_tree.currentNode())) {
             // FIXME: This code just wants an Element* iterator, instead of an ElementRecord*
             HTMLElementStack::ElementRecord* nodeRecord = m_tree.openElements()->topRecord();
-            if (!nodeRecord->node()->hasLocalName(token.name()))
+            if (!nodeRecord->node()->hasLocalName(token->name()))
                 parseError(token);
             while (1) {
-                if (nodeRecord->node()->hasLocalName(token.name())) {
+                if (nodeRecord->node()->hasLocalName(token->name())) {
                     m_tree.openElements()->popUntilPopped(nodeRecord->element());
                     return;
                 }
@@ -2768,7 +2770,7 @@ void HTMLTreeBuilder::processTokenInForeignContent(AtomicHTMLToken& token)
         m_tree.insertComment(token);
         return;
     case HTMLTokenTypes::Character: {
-        String characters = String(token.characters().data(), token.characters().size());
+        String characters = String(token->characters().data(), token->characters().size());
         m_tree.insertTextNode(characters);
         if (m_framesetOk && !isAllWhitespaceOrReplacementCharacters(characters))
             m_framesetOk = false;
@@ -2790,7 +2792,7 @@ void HTMLTreeBuilder::finished()
     m_document->finishedParsing();
 }
 
-void HTMLTreeBuilder::parseError(AtomicHTMLToken&)
+void HTMLTreeBuilder::parseError(AtomicHTMLToken*)
 {
 }
 
diff --git a/Source/WebCore/html/parser/HTMLTreeBuilder.h b/Source/WebCore/html/parser/HTMLTreeBuilder.h
index 192884e5b..3f2114c5a 100644
--- a/Source/WebCore/html/parser/HTMLTreeBuilder.h
+++ b/Source/WebCore/html/parser/HTMLTreeBuilder.h
@@ -72,7 +72,7 @@ public:
 
     // The token really should be passed as a const& since it's never modified.
     void constructTreeFromToken(HTMLToken&);
-    void constructTreeFromAtomicToken(AtomicHTMLToken&);
+    void constructTreeFromAtomicToken(AtomicHTMLToken*);
 
     bool hasParserBlockingScript() const { return !!m_scriptToProcess; }
     // Must be called to take the parser-blocking script before calling the parser again.
@@ -118,34 +118,34 @@ private:
     HTMLTreeBuilder(HTMLDocumentParser*, HTMLDocument*, bool reportErrors, bool usePreHTML5ParserQuirks, unsigned maximumDOMTreeDepth);
     HTMLTreeBuilder(HTMLDocumentParser*, DocumentFragment*, Element* contextElement, FragmentScriptingPermission, bool usePreHTML5ParserQuirks, unsigned maximumDOMTreeDepth);
 
-    void processToken(AtomicHTMLToken&);
-
-    void processDoctypeToken(AtomicHTMLToken&);
-    void processStartTag(AtomicHTMLToken&);
-    void processEndTag(AtomicHTMLToken&);
-    void processComment(AtomicHTMLToken&);
-    void processCharacter(AtomicHTMLToken&);
-    void processEndOfFile(AtomicHTMLToken&);
-
-    bool processStartTagForInHead(AtomicHTMLToken&);
-    void processStartTagForInBody(AtomicHTMLToken&);
-    void processStartTagForInTable(AtomicHTMLToken&);
-    void processEndTagForInBody(AtomicHTMLToken&);
-    void processEndTagForInTable(AtomicHTMLToken&);
-    void processEndTagForInTableBody(AtomicHTMLToken&);
-    void processEndTagForInRow(AtomicHTMLToken&);
-    void processEndTagForInCell(AtomicHTMLToken&);
-
-    void processIsindexStartTagForInBody(AtomicHTMLToken&);
-    void processHtmlStartTagForInBody(AtomicHTMLToken&);
-    bool processBodyEndTagForInBody(AtomicHTMLToken&);
+    void processToken(AtomicHTMLToken*);
+
+    void processDoctypeToken(AtomicHTMLToken*);
+    void processStartTag(AtomicHTMLToken*);
+    void processEndTag(AtomicHTMLToken*);
+    void processComment(AtomicHTMLToken*);
+    void processCharacter(AtomicHTMLToken*);
+    void processEndOfFile(AtomicHTMLToken*);
+
+    bool processStartTagForInHead(AtomicHTMLToken*);
+    void processStartTagForInBody(AtomicHTMLToken*);
+    void processStartTagForInTable(AtomicHTMLToken*);
+    void processEndTagForInBody(AtomicHTMLToken*);
+    void processEndTagForInTable(AtomicHTMLToken*);
+    void processEndTagForInTableBody(AtomicHTMLToken*);
+    void processEndTagForInRow(AtomicHTMLToken*);
+    void processEndTagForInCell(AtomicHTMLToken*);
+
+    void processIsindexStartTagForInBody(AtomicHTMLToken*);
+    void processHtmlStartTagForInBody(AtomicHTMLToken*);
+    bool processBodyEndTagForInBody(AtomicHTMLToken*);
     bool processTableEndTagForInTable();
     bool processCaptionEndTagForInCaption();
     bool processColgroupEndTagForInColumnGroup();
     bool processTrEndTagForInRow();
     // FIXME: This function should be inlined into its one call site or it
     // needs to assert which tokens it can be called with.
-    void processAnyOtherEndTagForInBody(AtomicHTMLToken&);
+    void processAnyOtherEndTagForInBody(AtomicHTMLToken*);
 
     void processCharacterBuffer(ExternalCharacterTokenBuffer&);
     inline void processCharacterBufferForInBody(ExternalCharacterTokenBuffer&);
@@ -155,9 +155,9 @@ private:
     void processFakeCharacters(const String&);
     void processFakePEndTagIfPInButtonScope();
 
-    void processGenericRCDATAStartTag(AtomicHTMLToken&);
-    void processGenericRawTextStartTag(AtomicHTMLToken&);
-    void processScriptStartTag(AtomicHTMLToken&);
+    void processGenericRCDATAStartTag(AtomicHTMLToken*);
+    void processGenericRawTextStartTag(AtomicHTMLToken*);
+    void processScriptStartTag(AtomicHTMLToken*);
 
     // Default processing for the different insertion modes.
     void defaultForInitial();
@@ -168,22 +168,22 @@ private:
     void defaultForAfterHead();
     void defaultForInTableText();
 
-    inline bool shouldProcessTokenInForeignContent(AtomicHTMLToken&);
-    void processTokenInForeignContent(AtomicHTMLToken&);
+    inline bool shouldProcessTokenInForeignContent(AtomicHTMLToken*);
+    void processTokenInForeignContent(AtomicHTMLToken*);
 
-    Vector<Attribute> attributesForIsindexInput(AtomicHTMLToken&);
+    Vector<Attribute> attributesForIsindexInput(AtomicHTMLToken*);
 
     HTMLElementStack::ElementRecord* furthestBlockForFormattingElement(Element*);
-    void callTheAdoptionAgency(AtomicHTMLToken&);
+    void callTheAdoptionAgency(AtomicHTMLToken*);
 
     void closeTheCell();
 
     template <bool shouldClose(const ContainerNode*)>
-    void processCloseWhenNestedTag(AtomicHTMLToken&);
+    void processCloseWhenNestedTag(AtomicHTMLToken*);
 
     bool m_framesetOk;
 
-    void parseError(AtomicHTMLToken&);
+    void parseError(AtomicHTMLToken*);
 
     InsertionMode insertionMode() const { return m_insertionMode; }
     void setInsertionMode(InsertionMode mode) { m_insertionMode = mode; }
diff --git a/Source/WebCore/html/parser/TextDocumentParser.cpp b/Source/WebCore/html/parser/TextDocumentParser.cpp
index 734edf09f..e38d0e0c4 100644
--- a/Source/WebCore/html/parser/TextDocumentParser.cpp
+++ b/Source/WebCore/html/parser/TextDocumentParser.cpp
@@ -62,9 +62,9 @@ void TextDocumentParser::insertFakePreElement()
 
     Vector<Attribute> attributes;
     attributes.append(Attribute(styleAttr, "word-wrap: break-word; white-space: pre-wrap;"));
-    AtomicHTMLToken fakePre(HTMLTokenTypes::StartTag, preTag.localName(), attributes);
+    RefPtr<AtomicHTMLToken> fakePre = AtomicHTMLToken::create(HTMLTokenTypes::StartTag, preTag.localName(), attributes);
 
-    treeBuilder()->constructTreeFromAtomicToken(fakePre);
+    treeBuilder()->constructTreeFromAtomicToken(fakePre.get());
     // Normally we would skip the first \n after a <pre> element, but we don't
     // want to skip the first \n for text documents!
     treeBuilder()->setShouldSkipLeadingNewline(false);