Some preliminary profiling on Mac brings up this hot path. Here is a profile:
https://share.firefox.dev/3JZjT6y

Here is the python script I ran against WWI while profiling:

import sys
import pyax

ATTRIBUTES = [
    "AXChildren",
    "AXParent",
    "AXRole",
    "AXRoleDescription",
    "AXSubrole",
    "AXTitle",
    "AXDescription",
    "AXHelp",
    "AXValue",
    "AXValueDescription",
    "AXSize",
    "AXPosition",
    "AXEnabled",
    "AXFocused",
    "AXWindow",
    "AXFrame",
    "AXTitleUIElement",
    "AXTopLevelUIElement",
    "AXHasPopup",
    "AXARIACurrent",
    "AXSelected",
    "AXRequired",
    "AXElementBusy",
    "AXLinkedUIElements",
    "AXARIAControls",
    "AXDOMIdentifier",
    "AXURL",
    "AXLinkUIElements",
    "AXPopupValue",
    "AXVisited",
    "AXExpanded",
    "AXMain",
    "AXMinimized",
    "AXSelectedChildren",
    "AXTabs",
    "AXContents",
    "AXOrientation",
    "AXMenuItemMarkChar",
    "AXLoaded",
    "AXLoadingProgress",
    "AXMinValue",
    "AXMaxValue",
    "AXRowCount",
    "AXColumnCount",
    "AXRows",
    "AXColumns",
    "AXIndex",
    "AXRowIndexRange",
    "AXColumnIndexRange",
    "AXRowHeaderUIElements",
    "AXColumnHeaderUIElements",
    "AXIdentifier",
    "AXVisibleChildren",
    "AXDisclosing",
    "AXDisclosedByRow",
    "AXDisclosureLevel",
    "AXDisclosedRows",
    "AXSelectedRows",
    "AXMathRootRadicand",
    "AXMathRootIndex",
    "AXMathFractionNumerator",
    "AXMathFractionDenominator",
    "AXMathLineThickness",
    "AXMathBase",
    "AXMathSubscript",
    "AXMathSuperscript",
    "AXMathUnder",
    "AXMathOver",
    "AXInvalid",
    "AXSelectedText",
    "AXSelectedTextRange",
    "AXNumberOfCharacters",
    # "AXVisibleCharacterRange",
    "AXInsertionPointLineNumber",
    "AXEditableAncestor",
    "AXHighestEditableAncestor",
    "AXFocusableAncestor",
    "AXARIAAtomic",
    "AXARIALive",
    "AXARIARelevant",
]

ATTRIBUTE_TIMES = {}

def tree_scrape(element, indent=0):
    total = 1
    for attr in ATTRIBUTES:
        element[attr]

    # element.get_multiple_attribute_values(*ATTRIBUTES)
    for child in element:
        total += tree_scrape(child, indent + 1)
    return total


if __name__ == "__main__":
    app_name = sys.argv[-1]
    app = pyax.get_application_by_name(app_name)
    acc = pyax.get_web_root(app)
    print(acc)
    print(tree_scrape(acc))

Note that pushing this into the cache from content isn't a good option. See bug 1795221.

As discussed in the CtW meeting today, some open questions:

1. How much does this impact real world performance; i.e. with VO? Profiling with VO running could be interesting.
2. How is WebKit not impacted by this? Do they have some trick that might be useful to know about? Note that as far as I know in Gecko, even in the DOM, there is no fast path (hash, etc.) for looking up names, only ids. Does WebKit have a fast path for names?

Possible solutions (not mutually exclusive):

1. Use nsAutoString instead of nsString to avoid heap allocations.
2. Cache the hash part of the href separately to avoid string searching... but that would "waste" a fair chunk of memory.
3. Maintain a hash map of name/id strings to acc ids.