Because of the way shared string buffers work, HTMLContentSink::AddAttributes isn't quite optimal in the way it does an atom lookup for attribute names. In particular, calling ToLowerCase on the shared buffer heap-allocates a new (mutable) buffer, then lowercases the string in-place, then the string is copied again (while being converted to UTF-8) into a stack buffer when do_GetAtom is called. In addition to this, dealing with the shared buffer incurs overhead from doing an atomic increment on the buffer reference count (which is silly since we know we'll need a mutable buffer). I have a patch which does the UTF-8 conversion (into a mutable buffer) up-front, which gets rid of the heap allocation, extra string copy, and atomic increment overhead. It seems to give a Tp win of about 1%.
Comment on attachment 149181 [details] [diff] [review] patch r+sr=bzbarsky; fix nsHTMLFragmentContentSink too, though?