Could we perhaps recycle some of the memory nsHTML5TreeBuilder::startTokenization and nsHTML5Tokenizer::start() reserve? Memory allocation and deallocation shows up pretty high in the Shark profiles. (Note, in my simple .innerHTML tests html5 parser is already faster than the old parser)

Is the parser startup the main allocation problem? I would have guessed nsHtml5StackNode and nsString.

I could re-profile, but in my testcase (setting innerHTML to some simple string value) it was really those two methods mentioned in comment 0 which were causing most of the (de)allocation.