webpack 5.108.2 → 5.108.4

package/lib/html/syntax.js

@@ -383,9 +383,9 @@ const walkHtmlTokens = (input, pos = 0, callbacks = {}) => {
 	let tagStart = pos;
 	let tagNameStart = -1;
 	let tagNameEnd = -1;
-	let attrNameStart = -1;
-	let attrNameEnd = -1;
-	let attrValueStart = -1;
+	let attributeNameStart = -1;
+	let attributeNameEnd = -1;
+	let attributeValueStart = -1;
 	let attrQuoteType = QUOTE_NONE;
 	let commentStart = pos;
 	let lastOpenTagName = "";
@@ -526,19 +526,19 @@ const walkHtmlTokens = (input, pos = 0, callbacks = {}) => {
 		// the callback is expected to do the same advance based on the
 		// reported `quoteType`.
 		let nextPos = attrQuoteType === QUOTE_NONE ? endPos : endPos + 1;
-		if (callbacks.attribute !== undefined && attrNameStart !== -1) {
+		if (callbacks.attribute !== undefined && attributeNameStart !== -1) {
 			nextPos = callbacks.attribute(
 				input,
-				attrNameStart,
-				attrNameEnd,
-				attrValueStart,
-				attrValueStart === -1 ? -1 : endPos,
+				attributeNameStart,
+				attributeNameEnd,
+				attributeValueStart,
+				attributeValueStart === -1 ? -1 : endPos,
 				attrQuoteType
 			);
 		}
-		if (attrNameStart !== -1) tagHasAttributes = true;
-		attrNameStart = -1;
-		attrValueStart = -1;
+		if (attributeNameStart !== -1) tagHasAttributes = true;
+		attributeNameStart = -1;
+		attributeValueStart = -1;
 		attrQuoteType = QUOTE_NONE;
 		return nextPos;
 	};
@@ -806,14 +806,14 @@ const walkHtmlTokens = (input, pos = 0, callbacks = {}) => {
 						pos + 1,
 						"warning"
 					);
-					attrNameStart = pos;
+					attributeNameStart = pos;
 					state = STATE_ATTRIBUTE_NAME;
 					pos++;
 				} else {
 					// Anything else
 					// Start a new attribute in the current tag token. Set that attribute name
 					// and value to the empty string. Reconsume in the attribute name state.
-					attrNameStart = pos;
+					attributeNameStart = pos;
 					state = STATE_ATTRIBUTE_NAME;
 					// Reconsume
 				}
@@ -831,11 +831,11 @@ const walkHtmlTokens = (input, pos = 0, callbacks = {}) => {
 				// EOF
 				// Reconsume in the after attribute name state.
 				if (isSpace(cc) || cc === CC_SOLIDUS || cc === CC_GREATER_THAN) {
-					attrNameEnd = pos;
+					attributeNameEnd = pos;
 					state = STATE_AFTER_ATTRIBUTE_NAME;
 					// Reconsume
 				} else if (cc === CC_EQUALS) {
-					attrNameEnd = pos;
+					attributeNameEnd = pos;
 					state = STATE_BEFORE_ATTRIBUTE_VALUE;
 					pos++;
 				} else {
@@ -915,7 +915,7 @@ const walkHtmlTokens = (input, pos = 0, callbacks = {}) => {
 					// Anything else
 					// Start a new attribute in the current tag token.
 					emitAttribute(pos);
-					attrNameStart = pos;
+					attributeNameStart = pos;
 					state = STATE_ATTRIBUTE_NAME;
 					// Reconsume
 				}
@@ -934,14 +934,14 @@ const walkHtmlTokens = (input, pos = 0, callbacks = {}) => {
 				} else if (cc === CC_QUOTATION_MARK) {
 					// U+0022 QUOTATION MARK (")
 					// Switch to the attribute value (double-quoted) state.
-					attrValueStart = pos + 1;
+					attributeValueStart = pos + 1;
 					attrQuoteType = QUOTE_DOUBLE;
 					state = STATE_ATTRIBUTE_VALUE_DOUBLE_QUOTED;
 					pos++;
 				} else if (cc === CC_APOSTROPHE) {
 					// U+0027 APOSTROPHE (')
 					// Switch to the attribute value (single-quoted) state.
-					attrValueStart = pos + 1;
+					attributeValueStart = pos + 1;
 					attrQuoteType = QUOTE_SINGLE;
 					state = STATE_ATTRIBUTE_VALUE_SINGLE_QUOTED;
 					pos++;
@@ -952,7 +952,7 @@ const walkHtmlTokens = (input, pos = 0, callbacks = {}) => {
 					// an empty value range pointing at the `>` so the open-tag offset range
 					// still includes the `>`.
 					reportError("missing-attribute-value", pos, pos + 1, "warning");
-					attrValueStart = pos;
+					attributeValueStart = pos;
 					attrQuoteType = QUOTE_NONE;
 					pos = emitAttribute(pos);
 					if (input.charCodeAt(tagStart + 1) === CC_SOLIDUS) {
@@ -966,7 +966,7 @@ const walkHtmlTokens = (input, pos = 0, callbacks = {}) => {
 				} else {
 					// Anything else
 					// Reconsume in the attribute value (unquoted) state.
-					attrValueStart = pos;
+					attributeValueStart = pos;
 					attrQuoteType = QUOTE_NONE;
 					state = STATE_ATTRIBUTE_VALUE_UNQUOTED;
 					// Reconsume
@@ -1301,7 +1301,20 @@ const walkHtmlTokens = (input, pos = 0, callbacks = {}) => {
 					if (cc === CC_NULL) {
 						reportError("unexpected-null-character", pos, pos + 1, "warning");
 					}
+					// Fast-forward ordinary comment text without re-entering the
+					// state switch; stop on the significant code points above.
 					pos++;
+					while (pos < len) {
+						const c2 = input.charCodeAt(pos);
+						if (
+							c2 === CC_LESS_THAN ||
+							c2 === CC_HYPHEN_MINUS ||
+							c2 === CC_NULL
+						) {
+							break;
+						}
+						pos++;
+					}
 				}
 				break;
 
@@ -3175,25 +3188,25 @@ const walkHtmlTokens = (input, pos = 0, callbacks = {}) => {
 					pos + runLen < len && input.charCodeAt(pos + runLen) === CC_SEMICOLON;
 				namedEntityConsumed = 0;
 				let matchedWithSemicolon = false;
-				// Slice the candidate run from `input` once; prefixes are taken from
-				// this short string instead of re-slicing the (potentially huge)
-				// input per length.
-				const run = input.slice(pos, pos + runLen);
-				for (let n = runLen; n > 0; n--) {
-					const bare = n === runLen ? run : run.slice(0, n);
-					// Try with trailing `;` first if one is present after the run.
-					if (
-						n === runLen &&
-						hasSemicolon &&
-						HTML_ENTITIES[`${bare};`] !== undefined
-					) {
-						namedEntityConsumed = n + 1;
+				// Try the full run with its trailing `;` first — the overwhelmingly
+				// common case (`&amp;`, `&nbsp;`, …) then needs exactly one slice.
+				if (hasSemicolon && runLen > 0) {
+					const withSemicolon = input.slice(pos, pos + runLen + 1);
+					if (HTML_ENTITIES[withSemicolon] !== undefined) {
+						namedEntityConsumed = runLen + 1;
 						matchedWithSemicolon = true;
-						break;
 					}
-					if (HTML_ENTITIES[bare] !== undefined) {
-						namedEntityConsumed = n;
-						break;
+				}
+				if (namedEntityConsumed === 0) {
+					// Slice the candidate run once; prefixes come from this short
+					// string instead of re-slicing the input per length.
+					const run = input.slice(pos, pos + runLen);
+					for (let n = runLen; n > 0; n--) {
+						const bare = n === runLen ? run : run.slice(0, n);
+						if (HTML_ENTITIES[bare] !== undefined) {
+							namedEntityConsumed = n;
+							break;
+						}
 					}
 				}
 				if (namedEntityConsumed > 0) {
@@ -3208,12 +3221,10 @@ const walkHtmlTokens = (input, pos = 0, callbacks = {}) => {
 							returnState === STATE_ATTRIBUTE_VALUE_DOUBLE_QUOTED ||
 							returnState === STATE_ATTRIBUTE_VALUE_SINGLE_QUOTED ||
 							returnState === STATE_ATTRIBUTE_VALUE_UNQUOTED;
-						if (
-							!(
-								inAttribute &&
-								(next === CC_EQUALS || isAsciiAlphanumeric(next))
-							)
-						) {
+						if (!(
+							inAttribute &&
+							(next === CC_EQUALS || isAsciiAlphanumeric(next))
+						)) {
 							reportError(
 								"missing-semicolon-after-character-reference",
 								pos + namedEntityConsumed,
@@ -3470,11 +3481,11 @@ const walkHtmlTokens = (input, pos = 0, callbacks = {}) => {
 		// dropping the in-progress tag, we emit its offset range up to EOF.
 		reportError("eof-in-tag", len, len, "error");
 		// If we hit EOF mid-attribute-name, the name runs to EOF. Set
-		// attrNameEnd here so the emitted attribute range is valid.
-		if (state === STATE_ATTRIBUTE_NAME && attrNameStart !== -1) {
-			attrNameEnd = len;
+		// attributeNameEnd here so the emitted attribute range is valid.
+		if (state === STATE_ATTRIBUTE_NAME && attributeNameStart !== -1) {
+			attributeNameEnd = len;
 		}
-		if (attrNameStart !== -1) emitAttribute(len);
+		if (attributeNameStart !== -1) emitAttribute(len);
 		// If we hit EOF before the tag-name end was recorded, the name runs
 		// to EOF. `tagNameEnd` may carry over from a previously emitted tag,
 		// so reset it whenever it's missing or stale (less than `tagNameStart`)
@@ -3697,6 +3708,15 @@ const decodeOneReference = (match, nextCharCode, isAttribute) => {
 	return match;
 };
 
+// Hoisted `replace` callbacks (one per `isAttribute` mode) — no closure
+// per decode call, and the callback stays monomorphic.
+/** @type {(match: string, offset: number, source: string) => string} */
+const _decodeReferenceInText = (match, offset, source) =>
+	decodeOneReference(match, source.charCodeAt(offset + match.length), false);
+/** @type {(match: string, offset: number, source: string) => string} */
+const _decodeReferenceInAttribute = (match, offset, source) =>
+	decodeOneReference(match, source.charCodeAt(offset + match.length), true);
+
 /**
  * Decode HTML character references in a string. Handles all numeric
  * references (with WHATWG remap of 0x00, surrogates, out-of-range, and the
@@ -3715,12 +3735,9 @@ const decodeOneReference = (match, nextCharCode, isAttribute) => {
 const decodeHtmlEntities = (str, isAttribute) => {
 	if (!str.includes("&")) return str;
 
-	return str.replace(CHARACTER_REFERENCE_REGEXP, (match, offset, source) =>
-		decodeOneReference(
-			match,
-			source.charCodeAt(offset + match.length),
-			isAttribute
-		)
+	return str.replace(
+		CHARACTER_REFERENCE_REGEXP,
+		isAttribute ? _decodeReferenceInAttribute : _decodeReferenceInText
 	);
 };
 
@@ -3779,6 +3796,354 @@ const NS_MATHML = 1;
 const NS_SVG = 2;
 
 /**
+ * AST node `type` discriminators. Numeric for the same reason as the CSS
+ * `NodeType`: compact integer `===` dispatch on the tree-construction and
+ * visitor-walk hot paths.
+ * @type {{ Document: 1, DocumentFragment: 2, Element: 3, Text: 4, Comment: 5, Doctype: 6 }}
+ */
+const NodeType = {
+	Document: 1,
+	DocumentFragment: 2,
+	Element: 3,
+	Text: 4,
+	Comment: 5,
+	Doctype: 6
+};
+
+/**
+ * A contiguous run of attribute ids in the attribute columns — how a start-tag
+ * token and an element refer to their attributes. `start` is the first id
+ * (`count` 0 = none).
+ * @typedef {{ start: number, count: number }} AttributeRun
+ */
+
+// Shared frozen empty run for attributeless elements and synthesized tags.
+const EMPTY_ATTRS = /** @type {AttributeRun} */ (
+	Object.freeze({ start: 0, count: 0 })
+);
+
+// === Struct-of-arrays AST backend ===
+// One AST node = one integer id (`HtmlNodeRef`) indexing the parallel columns
+// below — no per-node object and no per-parent children array. Tree shape
+// lives in the four link columns (parent / firstChild / lastChild /
+// nextSibling); the only heap references are the string payload / attribute
+// name-and-value side arrays. Columns are module-level and reused
+// across parses (grown, never shrunk — the CSS parser's `_soa*` strategy), so
+// a steady-state parse allocates almost nothing per node; consumers must fully
+// read a tree before the next `buildHtmlAst` call. Id 0 is reserved as
+// "no node" so the link columns can use 0 as null.
+let _hCap = 0;
+let _hN = 0;
+/** `NodeType` per node */
+let _hTy = new Uint8Array(0);
+/** bits 0-1 namespace (`NS_*`), bit 2 self-closing (void element) */
+let _hFl = new Uint8Array(0);
+let _hSt = new Int32Array(0);
+let _hEn = new Int32Array(0);
+/** end offset of an element's opening tag (after `>`) */
+let _hTagEnd = new Int32Array(0);
+/** end offset of an element's tag name */
+let _hNameEnd = new Int32Array(0);
+/** under `skip.text`, end offset of a raw-text element's body (`HtmlAstSkip`) */
+let _hCEnd = new Int32Array(0);
+/** a `<template>`'s content DocumentFragment (0 = none) */
+let _hTc = new Int32Array(0);
+let _hParent = new Int32Array(0);
+let _hFirst = new Int32Array(0);
+let _hLast = new Int32Array(0);
+let _hNext = new Int32Array(0);
+/** @type {string[]} tag name / text data / comment data / doctype name */
+const _hStr = [];
+/** first attribute id of an element's contiguous run */
+let _hAStart = new Int32Array(0);
+/** attribute count of an element's run */
+let _hACount = new Int32Array(0);
+// The single doctype node's public/system ids (a document inserts at most one
+// doctype node — later doctype tokens are ignored — so no column is needed).
+/** @type {string | null} */
+let _hDocPub = null;
+/** @type {string | null} */
+let _hDocSys = null;
+
+const NS_MASK = 3;
+const FLAG_SELF_CLOSING = 4;
+
+/** @type {(el: HtmlNodeRef) => string} */
+const _tag = (el) => _hStr[el];
+/** @type {(el: HtmlNodeRef) => number} */
+const _ns = (el) => _hFl[el] & NS_MASK;
+
+// === Attribute columns ===
+// One attribute = one integer id into these columns; an element (and a
+// start-tag token) holds a contiguous run. The value string is derived from
+// the source by offset on read — `_aVal` carries an override only for
+// valueless attributes (`""`) and offset-less adoption-agency clones — and the
+// html5lib serializer name is derived from the adjusted name plus one flag
+// bit, so per attribute only the interned name pointer is retained.
+let _aCap = 0;
+let _aN = 0;
+let _aNameStart = new Int32Array(0);
+let _aNameEnd = new Int32Array(0);
+let _aValStart = new Int32Array(0);
+let _aValEnd = new Int32Array(0);
+/** bit 0: name has a `FOREIGN_ATTR_NS` serializer name (set on foreign adjust) */
+let _aFl = new Uint8Array(0);
+/** @type {string[]} lowercased (foreign-content: adjusted) attribute name */
+const _aName = [];
+/** @type {(string | null)[]} value override (null = slice the source by offset) */
+const _aVal = [];
+/** source of the current parse, for by-offset attribute values */
+let _hSrc = "";
+
+/** @param {number} need minimum capacity */
+const _aGrow = (need) => {
+	let cap = _aCap || 4096;
+	while (cap < need) cap *= 2;
+	const nameStart = new Int32Array(cap);
+	nameStart.set(_aNameStart);
+	_aNameStart = nameStart;
+	const nameEnd = new Int32Array(cap);
+	nameEnd.set(_aNameEnd);
+	_aNameEnd = nameEnd;
+	const valStart = new Int32Array(cap);
+	valStart.set(_aValStart);
+	_aValStart = valStart;
+	const valEnd = new Int32Array(cap);
+	valEnd.set(_aValEnd);
+	_aValEnd = valEnd;
+	const fl = new Uint8Array(cap);
+	fl.set(_aFl);
+	_aFl = fl;
+	_aCap = cap;
+};
+
+/** @type {(name: string, value: string | null, nameStart: number, nameEnd: number, valueStart: number, valueEnd: number) => number} */
+const _aAlloc = (name, value, nameStart, nameEnd, valueStart, valueEnd) => {
+	const i = ++_aN;
+	if (i >= _aCap) _aGrow(i + 1);
+	_aNameStart[i] = nameStart;
+	_aNameEnd[i] = nameEnd;
+	_aValStart[i] = valueStart;
+	_aValEnd[i] = valueEnd;
+	_aFl[i] = 0;
+	// Ids are sequential, so these indexed writes append (arrays stay packed).
+	_aName[i] = name;
+	_aVal[i] = value;
+	return i;
+};
+
+/** @type {(i: number) => string} */
+const _aValueOf = (i) => {
+	const v = _aVal[i];
+	return v !== null ? v : _hSrc.slice(_aValStart[i], _aValEnd[i]);
+};
+
+// Linear name lookup in a run — attribute lists are short, a loop beats a Map.
+/** @type {(start: number, count: number, name: string) => number} */
+const _aFind = (start, count, name) => {
+	for (let i = start; i < start + count; i++) {
+		if (_aName[i] === name) return i;
+	}
+	return 0;
+};
+
+/** @type {(i: number) => number} exact copy of an attribute into a new id */
+const _aCopy = (i) => {
+	const c = _aAlloc(
+		_aName[i],
+		_aVal[i],
+		_aNameStart[i],
+		_aNameEnd[i],
+		_aValStart[i],
+		_aValEnd[i]
+	);
+	_aFl[c] = _aFl[i];
+	return c;
+};
+
+// html5lib serializer name, derived: a `FOREIGN_ATTR_NS`-adjusted attribute is
+// flagged (its name is the table key), and a camelCase-adjusted name contains
+// an uppercase letter (unadjusted names are always lowercased), serializing as
+// itself. Everything else serializes as the plain name (undefined here).
+/** @type {(i: number) => string | undefined} */
+const _aSerializedName = (i) => {
+	if ((_aFl[i] & 1) !== 0) return FOREIGN_ATTR_NS[_aName[i]];
+	const name = _aName[i];
+	return /[A-Z]/.test(name) ? name : undefined;
+};
+
+/** @param {number} need minimum capacity */
+const _hGrow = (need) => {
+	let cap = _hCap || 4096;
+	while (cap < need) cap *= 2;
+	const ty = new Uint8Array(cap);
+	ty.set(_hTy);
+	_hTy = ty;
+	const fl = new Uint8Array(cap);
+	fl.set(_hFl);
+	_hFl = fl;
+	const st = new Int32Array(cap);
+	st.set(_hSt);
+	_hSt = st;
+	const en = new Int32Array(cap);
+	en.set(_hEn);
+	_hEn = en;
+	const tagEnd = new Int32Array(cap);
+	tagEnd.set(_hTagEnd);
+	_hTagEnd = tagEnd;
+	const nameEnd = new Int32Array(cap);
+	nameEnd.set(_hNameEnd);
+	_hNameEnd = nameEnd;
+	const cEnd = new Int32Array(cap);
+	cEnd.set(_hCEnd);
+	_hCEnd = cEnd;
+	const tc = new Int32Array(cap);
+	tc.set(_hTc);
+	_hTc = tc;
+	const parent = new Int32Array(cap);
+	parent.set(_hParent);
+	_hParent = parent;
+	const first = new Int32Array(cap);
+	first.set(_hFirst);
+	_hFirst = first;
+	const last = new Int32Array(cap);
+	last.set(_hLast);
+	_hLast = last;
+	const next = new Int32Array(cap);
+	next.set(_hNext);
+	_hNext = next;
+	const aStart = new Int32Array(cap);
+	aStart.set(_hAStart);
+	_hAStart = aStart;
+	const aCount = new Int32Array(cap);
+	aCount.set(_hACount);
+	_hACount = aCount;
+	_hCap = cap;
+};
+
+/** Start a new parse: invalidate all prior refs, release prior heap refs. */
+const _hReset = () => {
+	_hN = 0;
+	_aN = 0;
+	_hStr.length = 0;
+	_aName.length = 0;
+	_aVal.length = 0;
+	// Keep id 0 ("no node" / "no attribute") occupied so writes stay packed.
+	_hStr.push("");
+	_aName.push("");
+	_aVal.push(null);
+	_hDocPub = null;
+	_hDocSys = null;
+};
+
+// Release the side arrays' heap references (strings, attribute names/values)
+// once a walk has consumed the tree, so the retained columns don't pin the
+// parsed source until the next parse.
+const _hRelease = () => {
+	_hN = 0;
+	_aN = 0;
+	_hStr.length = 0;
+	_aName.length = 0;
+	_aVal.length = 0;
+	_hSrc = "";
+	_hDocPub = null;
+	_hDocSys = null;
+};
+
+/** @type {(type: number, start: number, end: number) => HtmlNodeRef} */
+const _hAlloc = (type, start, end) => {
+	const i = ++_hN;
+	if (i >= _hCap) _hGrow(i + 1);
+	_hTy[i] = type;
+	_hFl[i] = 0;
+	_hSt[i] = start;
+	_hEn[i] = end;
+	_hTagEnd[i] = 0;
+	_hNameEnd[i] = 0;
+	_hCEnd[i] = 0;
+	_hTc[i] = 0;
+	_hParent[i] = 0;
+	_hFirst[i] = 0;
+	_hLast[i] = 0;
+	_hNext[i] = 0;
+	_hAStart[i] = 0;
+	_hACount[i] = 0;
+	// Ids are sequential, so this indexed write appends (array stays packed).
+	_hStr[i] = "";
+	return i;
+};
+
+// Raw child append — no text merging, no `<template>` content redirect (the
+// tree builder layers those on top). `node` must be detached (`next` = 0).
+/** @type {(parent: HtmlNodeRef, node: HtmlNodeRef) => void} */
+const _hAppend = (parent, node) => {
+	_hParent[node] = parent;
+	const last = _hLast[parent];
+	if (last === 0) _hFirst[parent] = node;
+	else _hNext[last] = node;
+	_hLast[parent] = node;
+};
+
+/** @type {(data: string, start: number, end: number) => HtmlNodeRef} */
+const _mkText = (data, start, end) => {
+	const i = _hAlloc(NodeType.Text, start, end);
+	_hStr[i] = data;
+	return i;
+};
+
+/** @type {(data: string, start: number, end: number) => HtmlNodeRef} */
+const _mkComment = (data, start, end) => {
+	const i = _hAlloc(NodeType.Comment, start, end);
+	_hStr[i] = data;
+	return i;
+};
+
+// Marker entry in the active-formatting-elements list (never a valid ref).
+const AFE_MARKER = -1;
+
+// Clone of an element's attribute run: keep name/value (and the serializer
+// name flag) but drop source offsets so the consumer doesn't emit a duplicate
+// dependency for the reopened element's spans. Values are materialized since
+// the offsets are gone.
+const cloneAttrs = (/** @type {HtmlElement} */ el) => {
+	const start = _hAStart[el];
+	const count = _hACount[el];
+	const newStart = _aN + 1;
+	for (let i = start; i < start + count; i++) {
+		const c = _aAlloc(_aName[i], _aValueOf(i), -1, -1, -1, -1);
+		_aFl[c] = _aFl[i];
+	}
+	return { start: newStart, count };
+};
+
+// Merge a repeated `<html>`/`<body>` tag's attributes into the element: only
+// names not already present are added (in source order after the existing
+// ones). Runs are contiguous, so any addition re-allocates the whole run; the
+// old slots are orphaned (at most once per repeated tag, rare).
+const mergeAttrs = (
+	/** @type {HtmlElement} */ el,
+	/** @type {AttributeRun} */ run
+) => {
+	const start = _hAStart[el];
+	const count = _hACount[el];
+	let extra = 0;
+	for (let i = run.start; i < run.start + run.count; i++) {
+		if (_aFind(start, count, _aName[i]) === 0) extra++;
+	}
+	if (extra === 0) return;
+	const newStart = _aN + 1;
+	for (let i = start; i < start + count; i++) _aCopy(i);
+	for (let i = run.start; i < run.start + run.count; i++) {
+		if (_aFind(start, count, _aName[i]) === 0) _aCopy(i);
+	}
+	_hAStart[el] = newStart;
+	_hACount[el] = count + extra;
+};
+
+/**
+ * A materialized attribute as returned by `A.attributes` (tests/tooling) —
+ * the parser-facing representation is an id into the attribute columns, read
+ * through the scalar `A.attr*` accessors.
  * @typedef {object} HtmlAttribute
  * @property {string} name lowercased (and, in foreign content, adjusted) attribute name
  * @property {string} value
@@ -3790,60 +4155,27 @@ const NS_SVG = 2;
  */
 
 /**
- * @typedef {object} HtmlElement
- * @property {typeof NodeType.Element} type
- * @property {string} tagName
- * @property {number} namespace
- * @property {HtmlAttribute[]} attributes
- * @property {HtmlNode[]} children
- * @property {boolean} selfClosing
- * @property {number} start
- * @property {number} end
- * @property {number} tagEnd end offset of the opening tag (after `>`)
- * @property {number} nameEnd end offset of the tag name
- * @property {HtmlDocumentFragment=} templateContent `<template>` content fragment
- */
-
-/**
- * @typedef {object} HtmlText
- * @property {typeof NodeType.Text} type
- * @property {string} data
- * @property {number} start
- * @property {number} end
+ * A node reference into the struct-of-arrays AST: an integer id indexing the
+ * parallel `_h*` columns. Read fields through the exported accessor `A`. Refs
+ * are only valid until the next `buildHtmlAst` call — the columns are reused
+ * across parses — so consume a tree fully before parsing again.
+ * @typedef {number} HtmlNodeRef
  */
 
-/**
- * @typedef {object} HtmlComment
- * @property {typeof NodeType.Comment} type
- * @property {string} data
- * @property {number} start
- * @property {number} end
- */
-
-/**
- * @typedef {object} HtmlDoctype
- * @property {typeof NodeType.Doctype} type
- * @property {string} name
- * @property {string | null} publicId
- * @property {string | null} systemId
- * @property {number} start
- * @property {number} end
- */
+/** @typedef {HtmlNodeRef} HtmlElement ref to an Element node */
+/** @typedef {HtmlNodeRef} HtmlText ref to a Text node */
+/** @typedef {HtmlNodeRef} HtmlComment ref to a Comment node */
+/** @typedef {HtmlNodeRef} HtmlDoctype ref to a Doctype node */
+/** @typedef {HtmlNodeRef} HtmlDocument ref to the Document node */
+/** @typedef {HtmlNodeRef} HtmlDocumentFragment ref to a DocumentFragment node */
+/** @typedef {HtmlNodeRef} HtmlNode */
 
 /**
- * @typedef {object} HtmlDocument
- * @property {typeof NodeType.Document} type
- * @property {HtmlNode[]} children
+ * An attribute reference: an integer id into the attribute columns, read
+ * through the `A.attr*` accessors. Same validity contract as `HtmlNodeRef`.
+ * @typedef {number} HtmlAttributeRef
  */
 
-/**
- * @typedef {object} HtmlDocumentFragment
- * @property {typeof NodeType.DocumentFragment} type
- * @property {HtmlNode[]} children
- */
-
-/** @typedef {HtmlElement | HtmlText | HtmlComment | HtmlDoctype} HtmlNode */
-
 /** @typedef {{ start: number, end: number, tagEnd: number, nameEnd: number }} TagPos */
 
 // Tree-construction token `type` discriminators. Numeric for the same reason
@@ -3859,7 +4191,7 @@ const TOKEN_EOF = 6;
 /** @typedef {{ type: typeof TOKEN_CHAR, data: string, start: number, end: number }} CharToken */
 /** @typedef {{ type: typeof TOKEN_COMMENT, data: string, start: number, end: number }} CommentToken */
 /** @typedef {{ type: typeof TOKEN_DOCTYPE, name: string, publicId: (string | null), systemId: (string | null), start: number, end: number }} DoctypeToken */
-/** @typedef {{ type: typeof TOKEN_START_TAG, name: string, attrs: HtmlAttribute[], selfClosing: boolean, pos: TagPos, swallowNewline?: boolean }} StartTagToken */
+/** @typedef {{ type: typeof TOKEN_START_TAG, name: string, attrs: AttributeRun, selfClosing: boolean, pos: TagPos, swallowNewline?: boolean }} StartTagToken */
 /** @typedef {{ type: typeof TOKEN_END_TAG, name: string, pos: TagPos }} EndTagToken */
 /** @typedef {{ type: typeof TOKEN_EOF }} EofToken */
 
@@ -3876,10 +4208,10 @@ const TOKEN_EOF = 6;
  * stale values that those handlers never read. Tokens that must outlive the
  * current callback (buffered table characters, synthesized re-dispatches) are
  * copied into fresh plain objects instead.
- * @typedef {{ type: number, name: string, data: string, attrs: HtmlAttribute[], selfClosing: boolean, start: number, end: number, publicId: (string | null), systemId: (string | null), swallowNewline: boolean, pos: TagPos }} MutableToken
+ * @typedef {{ type: number, name: string, data: string, attrs: AttributeRun, selfClosing: boolean, start: number, end: number, publicId: (string | null), systemId: (string | null), swallowNewline: boolean, pos: TagPos }} MutableToken
  */
 
-/** @typedef {{ parent: HtmlElement | HtmlDocument | HtmlDocumentFragment, beforeNode: (HtmlNode | null) }} InsertionPlace */
+/** @typedef {{ parent: HtmlNodeRef, beforeNode: HtmlNodeRef }} InsertionPlace `beforeNode` 0 = plain append */
 
 // Insertion modes (§13.2.4.1). Numeric for the same reason as the token and
 // `NodeType` enums: `runMode` dispatches on `mode` once per token.
@@ -4043,9 +4375,11 @@ const FORMATTING = new Set([
 const HEADING = new Set(["h1", "h2", "h3", "h4", "h5", "h6"]);
 
 const isSpecial = (/** @type {HtmlElement} */ el) => {
-	if (el.namespace === NS_HTML) return SPECIAL.has(el.tagName);
-	if (el.namespace === NS_MATHML) return MATHML_SPECIAL.has(el.tagName);
-	if (el.namespace === NS_SVG) return SVG_SPECIAL.has(el.tagName.toLowerCase());
+	const ns = _ns(el);
+	const tag = _tag(el);
+	if (ns === NS_HTML) return SPECIAL.has(tag);
+	if (ns === NS_MATHML) return MATHML_SPECIAL.has(tag);
+	if (ns === NS_SVG) return SVG_SPECIAL.has(tag.toLowerCase());
 	return false;
 };
 
@@ -4493,14 +4827,13 @@ const FOREIGN_BREAKOUT = new Set([
 ]);
 const FONT_BREAKOUT_ATTRS = new Set(["color", "face", "size"]);
 
-// Shared frozen empty attribute list for attributeless elements (the common
-// case). Only `<html>`/`<body>` ever receive merged attributes and are always
-// built with their own mutable array, so sharing this everywhere else is safe
-// and avoids an empty array per element. Frozen so an accidental mutation
-// throws instead of corrupting other elements.
-const EMPTY_ATTRS = /** @type {HtmlAttribute[]} */ (
-	/** @type {unknown} */ (Object.freeze([]))
-);
+// `<font color|face|size>` breaks out of foreign content (§13.2.6.5).
+const hasFontBreakoutAttr = (/** @type {AttributeRun} */ run) => {
+	for (let i = run.start; i < run.start + run.count; i++) {
+		if (FONT_BREAKOUT_ATTRS.has(_aName[i])) return true;
+	}
+	return false;
+};
 
 /**
  * Hash of the ASCII-lowercased `name` for the intern tables below; must stay
@@ -4518,33 +4851,58 @@ const hashLowerName = (name) => {
 	return h;
 };
 
+// Text-run scan classes for the `skip.text` fast path: 2 = stop the fast
+// path (& / NUL / CR), 1 = ASCII whitespace, 0 = ordinary text.
+const _TEXT_SCAN_CLASS = new Uint8Array(128);
+_TEXT_SCAN_CLASS[0x09] = 1;
+_TEXT_SCAN_CLASS[0x0a] = 1;
+_TEXT_SCAN_CLASS[0x0c] = 1;
+_TEXT_SCAN_CLASS[0x20] = 1;
+_TEXT_SCAN_CLASS[0x26] = 2;
+_TEXT_SCAN_CLASS[0x00] = 2;
+_TEXT_SCAN_CLASS[0x0d] = 2;
+
 /**
  * @param {Iterable<string>} names lowercase names to intern
- * @returns {Map<number, string | string[]>} hash → name(s)
+ * @returns {{ mask: number, hashes: Int32Array, values: (string | string[] | undefined)[] }} open-addressed intern table
  */
 const buildNameInternTable = (names) => {
-	/** @type {Map<number, string | string[]>} */
-	const table = new Map();
-	for (const name of names) {
+	// Open-addressed table (~25% load): the per-name probe is one or two array
+	// reads instead of a `Map#get`, and the tables are built once at startup.
+	const unique = [...new Set(names)];
+	let size = 8;
+	while (size < unique.length * 4) size <<= 1;
+	const mask = size - 1;
+	const hashes = new Int32Array(size);
+	/** @type {(string | string[] | undefined)[]} */
+	const values = Array.from({ length: size });
+	for (const name of unique) {
 		const h = hashLowerName(name);
-		const cur = table.get(h);
+		let slot = h & mask;
+		while (values[slot] !== undefined && hashes[slot] !== h) {
+			slot = (slot + 1) & mask;
+		}
+		const cur = values[slot];
 		if (cur === undefined) {
-			table.set(h, name);
+			hashes[slot] = h;
+			values[slot] = name;
 		} else if (typeof cur === "string") {
-			if (cur !== name) table.set(h, [cur, name]);
-		} else if (!cur.includes(name)) {
+			values[slot] = [cur, name];
+		} else {
 			cur.push(name);
 		}
 	}
-	return table;
+	return { mask, hashes, values };
 };
 
+/** @typedef {ReturnType<typeof buildNameInternTable>} NameInternTable */
+
 /**
  * The lowercased name for `input[start..end)`, returning the shared interned
  * string for known names — skipping the per-tag `slice().toLowerCase()`
  * allocation, and making the tree builder's many Set/Map lookups and `===`
  * comparisons on the name hit one string instance with a cached hash.
- * @param {Map<number, string | string[]>} table intern table
+ * @param {NameInternTable} table intern table
  * @param {string} input source text
  * @param {number} start name start
  * @param {number} end name end
@@ -4557,15 +4915,22 @@ const internLowerName = (table, input, start, end) => {
 		if (c >= 0x41 && c <= 0x5a) c += 0x20;
 		h = ((h << 5) - h + c) | 0;
 	}
-	const hit = table.get(h);
-	if (hit !== undefined) {
-		if (typeof hit === "string") {
-			if (rangeEqualsLower(input, start, end, hit)) return hit;
-		} else {
-			for (let i = 0; i < hit.length; i++) {
-				if (rangeEqualsLower(input, start, end, hit[i])) return hit[i];
+	const { mask, hashes, values } = table;
+	let slot = h & mask;
+	for (;;) {
+		const hit = values[slot];
+		if (hit === undefined) break;
+		if (hashes[slot] === h) {
+			if (typeof hit === "string") {
+				if (rangeEqualsLower(input, start, end, hit)) return hit;
+			} else {
+				for (let i = 0; i < hit.length; i++) {
+					if (rangeEqualsLower(input, start, end, hit[i])) return hit[i];
+				}
 			}
+			break;
 		}
+		slot = (slot + 1) & mask;
 	}
 	// Unknown name (custom element, data-* attribute, non-ASCII, …).
 	return input.slice(start, end).toLowerCase();
@@ -4604,50 +4969,71 @@ const ATTR_NAME_INTERN = buildNameInternTable(
 // Hoisted so the many `open.some(...)` "is there an open HTML <template>?"
 // checks reuse one predicate instead of allocating an arrow per call.
 const isHtmlTemplateEl = (/** @type {HtmlElement} */ e) =>
-	e.tagName === "template" && e.namespace === NS_HTML;
+	_tag(e) === "template" && _ns(e) === NS_HTML;
 
-// Linear attribute lookup by name — avoids the per-call arrow `Array#find`
-// would allocate (attribute lists are short, so a plain loop is faster too).
-const findAttr = (
-	/** @type {HtmlAttribute[]} */ attrs,
-	/** @type {string} */ name
-) => {
-	for (let i = 0; i < attrs.length; i++) {
-		if (attrs[i].name === name) return attrs[i];
-	}
-	return undefined;
-};
+// Raw text / escapable raw text elements (WHATWG §13.1.2) plus the other
+// RAWTEXT/RCDATA/PLAINTEXT-tokenized elements. Under `skip.text` their body's
+// end offset is recorded on the element (see `insertCharacters`) so a consumer
+// can read the raw content span without a `Text` node.
+const RAW_TEXT_ELEMENTS = new Set([
+	"script",
+	"style",
+	"textarea",
+	"title",
+	"xmp",
+	"iframe",
+	"noembed",
+	"noframes",
+	"noscript",
+	"plaintext"
+]);
+
+/** Shared empty skip set so the common (no-skip) call allocates nothing. */
+const EMPTY_SKIP = Object.freeze({});
+
+/**
+ * Optional node kinds a consumer can drop from the AST for speed/memory. Each
+ * is a pure output reduction — tree construction (and quirks detection) runs
+ * unchanged, so element structure and offsets are identical either way.
+ * @typedef {object} HtmlAstSkip
+ * @property {boolean=} text drop every `Text` node. Raw-text element bodies (`<script>`/`<style>`/…) aren't emitted either — their content span is recorded as the element's `contentEnd` (see `RAW_TEXT_ELEMENTS`) so a consumer can read `[tagEnd, contentEnd]` by offset. For consumers that read text by offset (e.g. `HtmlParser`), never the html5lib serializer.
+ * @property {boolean=} comments drop comment nodes entirely. Not for consumers that read comments (e.g. webpack magic comments).
+ * @property {boolean=} doctype drop the doctype node; quirks-mode detection is unaffected.
+ */
 
 /**
  * @param {string} source HTML source
  * @param {string=} fragmentContext context element name for fragment parsing (e.g. `td`, `svg path`); omit for a full document
- * @returns {HtmlDocument} document AST
+ * @param {HtmlAstSkip=} skip node kinds to omit from the AST (see `HtmlAstSkip`); omit to build the full tree
+ * @returns {HtmlDocument} ref to the document node — read through `A`; valid until the next parse
  */
-const buildHtmlAst = (source, fragmentContext) => {
-	/** @type {HtmlDocument} */
-	const doc = { type: NodeType.Document, children: [] };
+const buildHtmlAst = (source, fragmentContext, skip = EMPTY_SKIP) => {
+	const skipText = skip.text === true;
+	const skipComments = skip.comments === true;
+	const skipDoctype = skip.doctype === true;
+	_hReset();
+	_hSrc = source;
+	const doc = _hAlloc(NodeType.Document, 0, 0);
 	let mode = MODE_INITIAL;
 	// Mode to return to after MODE_TEXT / MODE_IN_TABLE_TEXT (0 = unset).
 	let originalMode = 0;
 	/** @type {HtmlElement[]} stack of open elements (bottom .. top) */
 	const open = [];
-	/** @type {{ element?: HtmlElement, marker?: boolean }[]} active formatting elements */
+	/** @type {HtmlNodeRef[]} active formatting elements (AFE_MARKER = marker) */
 	const afe = [];
-	const afeEl = (/** @type {{ element?: HtmlElement }} */ e) =>
-		/** @type {HtmlElement} */ (e.element);
-	/** @type {HtmlElement | null} */
-	let head = null;
-	/** @type {HtmlElement | null} */
-	let form = null;
+	/** @type {HtmlElement} 0 = none */
+	let head = 0;
+	/** @type {HtmlElement} 0 = none */
+	let form = 0;
 	let framesetOk = true;
-	/** @type {HtmlAttribute[]} */
-	let pendingAttrs = [];
+	// First attribute id of the tag currently being tokenized (0 = none).
+	let pendAttrStart = 0;
 	let fosterParenting = false;
 	/** @type {number[]} */
 	const templateModes = [];
 	let quirks = false;
-	/** @type {HtmlElement | null} */
-	let fragment = null;
+	/** @type {HtmlElement} fragment context element (0 = document parse) */
+	let fragment = 0;
 	// End offset of the token currently being processed (for element `.end`).
 	let tokenEnd = 0;
 
@@ -4660,70 +5046,68 @@ const buildHtmlAst = (source, fragmentContext) => {
 	const mkEl = (
 		/** @type {string} */ tagName,
 		/** @type {number} */ ns,
-		/** @type {HtmlAttribute[] | undefined} */ attributes,
+		/** @type {AttributeRun} */ attrs,
 		/** @type {TagPos | null | undefined} */ pos
-	) =>
-		/** @type {HtmlElement} */ ({
-			type: NodeType.Element,
-			tagName,
-			namespace: ns,
-			attributes: attributes || EMPTY_ATTRS,
-			children: [],
-			selfClosing: ns === NS_HTML && VOID.has(tagName),
-			start: pos ? pos.start : 0,
-			end: pos ? pos.end : 0,
-			tagEnd: pos ? pos.tagEnd : 0,
-			nameEnd: pos ? pos.nameEnd : 0,
-			// Present from creation (only `<template>` fills it) so every element
-			// keeps one monomorphic hidden class for the open-stack/scope loops.
-			templateContent: undefined
-		});
-
-	// Clone of a formatting element's attributes: keep name/value (and the
-	// serializer name) but drop source offsets so the consumer doesn't emit a
-	// duplicate dependency for the reopened element's spans.
-	const cloneAttrs = (/** @type {HtmlAttribute[]} */ attributes) =>
-		attributes.map((a) => ({
-			name: a.name,
-			value: a.value,
-			serializedName: a.serializedName,
-			nameStart: -1,
-			nameEnd: -1,
-			valueStart: -1,
-			valueEnd: -1
-		}));
+	) => {
+		const el = _hAlloc(
+			NodeType.Element,
+			pos ? pos.start : 0,
+			pos ? pos.end : 0
+		);
+		// Void HTML elements are marked self-closing and never receive children.
+		_hFl[el] =
+			ns === NS_HTML && VOID.has(tagName) ? ns | FLAG_SELF_CLOSING : ns;
+		_hStr[el] = tagName;
+		_hAStart[el] = attrs.start;
+		_hACount[el] = attrs.count;
+		if (pos) {
+			_hTagEnd[el] = pos.tagEnd;
+			_hNameEnd[el] = pos.nameEnd;
+			// End of a raw-text element's body under `skip.text` (defaults to the
+			// body start, i.e. empty); lets consumers read `<script>`/`<style>`
+			// content as [`tagEnd`, `contentEnd`] without a `Text` node.
+			_hCEnd[el] = pos.tagEnd;
+		}
+		return el;
+	};
 
 	/**
-	 * @param {HtmlElement | HtmlDocument | HtmlDocumentFragment} parent container
-	 * @returns {HtmlNode[]} children array to insert into
+	 * A `<template>`'s children live in its content fragment; inserting into a
+	 * template really inserts there (the spec's "template contents" redirect).
+	 * @param {HtmlNodeRef} parent container
+	 * @returns {HtmlNodeRef} effective container to link children into
 	 */
-	const childrenOf = (parent) =>
-		parent.type === NodeType.Element && parent.templateContent
-			? parent.templateContent.children
-			: parent.children;
+	const effParent = (parent) => {
+		const tc = _hTc[parent];
+		return tc !== 0 ? tc : parent;
+	};
 
 	const appendTo = (
-		/** @type {HtmlElement | HtmlDocument | HtmlDocumentFragment} */ parent,
-		/** @type {HtmlNode} */ node
+		/** @type {HtmlNodeRef} */ parent,
+		/** @type {HtmlNodeRef} */ node
 	) => {
-		const arr = childrenOf(parent);
-		const last = arr[arr.length - 1];
-		if (node.type === NodeType.Text && last && last.type === NodeType.Text) {
-			last.data += node.data;
-			if (node.end !== undefined) last.end = node.end;
+		const p = effParent(parent);
+		const last = _hLast[p];
+		if (
+			_hTy[node] === NodeType.Text &&
+			last !== 0 &&
+			_hTy[last] === NodeType.Text
+		) {
+			_hStr[last] += _hStr[node];
+			_hEn[last] = _hEn[node];
 			return;
 		}
-		arr.push(node);
+		_hAppend(p, node);
 	};
 
 	// Reused result of `appropriatePlace` — consumed synchronously by
 	// `insertAtPlace` and never retained, so one shared object avoids an
 	// allocation per inserted node.
 	/** @type {InsertionPlace} */
-	const sharedPlace = { parent: doc, beforeNode: null };
+	const sharedPlace = { parent: doc, beforeNode: 0 };
 	const placeAt = (
-		/** @type {HtmlElement | HtmlDocument | HtmlDocumentFragment} */ parent,
-		/** @type {HtmlNode | null} */ beforeNode
+		/** @type {HtmlNodeRef} */ parent,
+		/** @type {HtmlNodeRef} */ beforeNode
 	) => {
 		sharedPlace.parent = parent;
 		sharedPlace.beforeNode = beforeNode;
@@ -4735,23 +5119,23 @@ const buildHtmlAst = (source, fragmentContext) => {
 		const target = cur();
 		if (
 			fosterParenting &&
-			TABLE_CONTEXT.has(target.tagName) &&
-			target.namespace === NS_HTML
+			TABLE_CONTEXT.has(_tag(target)) &&
+			_ns(target) === NS_HTML
 		) {
 			// find last template / last table
 			let lastTemplate = -1;
 			let lastTable = -1;
 			for (let i = open.length - 1; i >= 0; i--) {
 				if (
-					open[i].tagName === "template" &&
-					open[i].namespace === NS_HTML &&
+					_tag(open[i]) === "template" &&
+					_ns(open[i]) === NS_HTML &&
 					lastTemplate === -1
 				) {
 					lastTemplate = i;
 				}
 				if (
-					open[i].tagName === "table" &&
-					open[i].namespace === NS_HTML &&
+					_tag(open[i]) === "table" &&
+					_ns(open[i]) === NS_HTML &&
 					lastTable === -1
 				) {
 					lastTable = i;
@@ -4761,53 +5145,52 @@ const buildHtmlAst = (source, fragmentContext) => {
 				lastTemplate !== -1 &&
 				(lastTable === -1 || lastTemplate > lastTable)
 			) {
-				return placeAt(open[lastTemplate], null);
+				return placeAt(open[lastTemplate], 0);
 			}
 			if (lastTable === -1) {
-				return placeAt(open[0], null);
+				return placeAt(open[0], 0);
 			}
 			const table = open[lastTable];
-			// find table's parent in tree
-			const tp = findParent(table);
-			if (tp) return placeAt(tp, table);
-			return placeAt(open[lastTable - 1], null);
-		}
-		return placeAt(target, null);
-	};
-
-	const findParent = (/** @type {HtmlNode} */ node) => {
-		// search the whole document tree for the parent of node
-		/** @type {(HtmlElement | HtmlDocument | HtmlDocumentFragment)[]} */
-		const stack = [doc];
-		while (stack.length) {
-			const x =
-				/** @type {HtmlElement | HtmlDocument | HtmlDocumentFragment} */ (
-					stack.pop()
-				);
-			for (const k of childrenOf(x)) {
-				if (k === node) return x;
-				if (k.type === NodeType.Element) stack.push(k);
-			}
+			const tp = _hParent[table];
+			if (tp !== 0) return placeAt(tp, table);
+			return placeAt(open[lastTable - 1], 0);
 		}
-		return null;
+		return placeAt(target, 0);
 	};
 
 	const insertAtPlace = (
 		/** @type {InsertionPlace} */ place,
-		/** @type {HtmlNode} */ node
+		/** @type {HtmlNodeRef} */ node
 	) => {
-		if (place.beforeNode) {
-			const arr = childrenOf(place.parent);
-			const idx = arr.indexOf(place.beforeNode);
+		const before = place.beforeNode;
+		if (before !== 0) {
+			const p = effParent(place.parent);
+			// Find `before`'s previous sibling (insert-before is a rare foster/
+			// adoption path, so the sibling scan stays off the hot path).
+			let prev = 0;
+			let c = _hFirst[p];
+			while (c !== 0 && c !== before) {
+				prev = c;
+				c = _hNext[c];
+			}
+			if (c === 0) {
+				// `before` not under `parent` (not reachable from the spec paths).
+				appendTo(place.parent, node);
+				return;
+			}
 			if (
-				node.type === NodeType.Text &&
-				idx > 0 &&
-				arr[idx - 1].type === NodeType.Text
+				_hTy[node] === NodeType.Text &&
+				prev !== 0 &&
+				_hTy[prev] === NodeType.Text
 			) {
-				/** @type {HtmlText} */ (arr[idx - 1]).data += node.data;
+				// Before-node merge deliberately does not bump the sibling's `end`.
+				_hStr[prev] += _hStr[node];
 				return;
 			}
-			arr.splice(idx, 0, node);
+			_hParent[node] = p;
+			_hNext[node] = before;
+			if (prev === 0) _hFirst[p] = node;
+			else _hNext[prev] = node;
 		} else {
 			appendTo(place.parent, node);
 		}
@@ -4819,28 +5202,55 @@ const buildHtmlAst = (source, fragmentContext) => {
 		/** @type {number} */ end
 	) => {
 		const place = appropriatePlace();
-		if (place.parent.type === NodeType.Document) return; // never insert text into document
+		if (_hTy[place.parent] === NodeType.Document) return; // never insert text into document
+		// `skip.text`: drop every `Text` node — construction already used the
+		// decoded token, so removing the node never affects element structure.
+		// For a raw-text element record the body end so a consumer reads the span
+		// [`tagEnd`, `contentEnd`] without a `Text` node (see `HtmlParser`).
+		// Namespace-agnostic: `HtmlParser` extracts `<script>`/`<style>` bodies in
+		// foreign content (e.g. SVG `<style>`) too.
+		if (skipText) {
+			const p = place.parent;
+			if (_hTy[p] === NodeType.Element && RAW_TEXT_ELEMENTS.has(_tag(p))) {
+				_hCEnd[p] = end;
+			}
+			return;
+		}
 		// Inlined text insert: when the run merges into the adjacent text sibling
 		// (common with inline formatting) only the string is appended — no
 		// throwaway text node is allocated. Mirrors `insertAtPlace`/`appendTo`,
 		// including that the before-node merge does not bump `end`.
-		const arr = childrenOf(place.parent);
-		if (place.beforeNode) {
-			const idx = arr.indexOf(place.beforeNode);
-			const prev = idx > 0 ? arr[idx - 1] : undefined;
-			if (prev && prev.type === NodeType.Text) {
-				prev.data += data;
+		const p = effParent(place.parent);
+		const before = place.beforeNode;
+		if (before !== 0) {
+			let prev = 0;
+			let c = _hFirst[p];
+			while (c !== 0 && c !== before) {
+				prev = c;
+				c = _hNext[c];
+			}
+			if (c === 0) {
+				// `before` not under `parent` (not reachable from the spec paths).
+				_hAppend(p, _mkText(data, start, end));
+				return;
+			}
+			if (prev !== 0 && _hTy[prev] === NodeType.Text) {
+				_hStr[prev] += data;
 				return;
 			}
-			arr.splice(idx, 0, { type: NodeType.Text, data, start, end });
+			const node = _mkText(data, start, end);
+			_hParent[node] = p;
+			_hNext[node] = before;
+			if (prev === 0) _hFirst[p] = node;
+			else _hNext[prev] = node;
 		} else {
-			const last = arr[arr.length - 1];
-			if (last && last.type === NodeType.Text) {
-				last.data += data;
-				last.end = end;
+			const last = _hLast[p];
+			if (last !== 0 && _hTy[last] === NodeType.Text) {
+				_hStr[last] += data;
+				_hEn[last] = end;
 				return;
 			}
-			arr.push({ type: NodeType.Text, data, start, end });
+			_hAppend(p, _mkText(data, start, end));
 		}
 	};
 
@@ -4851,16 +5261,17 @@ const buildHtmlAst = (source, fragmentContext) => {
 	 * @param {InsertionPlace=} place explicit insertion place
 	 */
 	const insertComment = (data, start, end, place) => {
+		if (skipComments) return;
 		const p = place || appropriatePlace();
-		insertAtPlace(p, { type: NodeType.Comment, data, start, end });
+		insertAtPlace(p, _mkComment(data, start, end));
 	};
 
 	const insertHtmlElement = (
 		/** @type {string} */ tagName,
-		/** @type {HtmlAttribute[]} */ attributes,
+		/** @type {AttributeRun} */ attrs,
 		/** @type {TagPos | null} */ pos
 	) => {
-		const el = mkEl(tagName, NS_HTML, attributes, pos);
+		const el = mkEl(tagName, NS_HTML, attrs, pos);
 		const place = appropriatePlace();
 		insertAtPlace(place, el);
 		open.push(el);
@@ -4870,10 +5281,10 @@ const buildHtmlAst = (source, fragmentContext) => {
 	const insertForeignElement = (
 		/** @type {string} */ tagName,
 		/** @type {number} */ ns,
-		/** @type {HtmlAttribute[]} */ attributes,
+		/** @type {AttributeRun} */ attrs,
 		/** @type {TagPos | null} */ pos
 	) => {
-		const el = mkEl(tagName, ns, attributes, pos);
+		const el = mkEl(tagName, ns, attrs, pos);
 		const place = appropriatePlace();
 		insertAtPlace(place, el);
 		open.push(el);
@@ -4882,10 +5293,10 @@ const buildHtmlAst = (source, fragmentContext) => {
 
 	// ---- scopes ----
 	const isScopeBoundary = (/** @type {HtmlElement} */ el) => {
-		if (el.namespace === NS_HTML) return HTML_SCOPE.has(el.tagName);
-		if (el.namespace === NS_MATHML) return MATHML_SPECIAL.has(el.tagName);
-		if (el.namespace === NS_SVG) {
-			return SVG_SPECIAL.has(el.tagName.toLowerCase());
+		if (_ns(el) === NS_HTML) return HTML_SCOPE.has(_tag(el));
+		if (_ns(el) === NS_MATHML) return MATHML_SPECIAL.has(_tag(el));
+		if (_ns(el) === NS_SVG) {
+			return SVG_SPECIAL.has(_tag(el).toLowerCase());
 		}
 		return false;
 	};
@@ -4900,10 +5311,10 @@ const buildHtmlAst = (source, fragmentContext) => {
 		/** @type {number} */ kind
 	) => {
 		if (isScopeBoundary(el)) return true;
-		if (el.namespace !== NS_HTML) return false;
-		if (kind === SCOPE_BUTTON) return el.tagName === "button";
+		if (_ns(el) !== NS_HTML) return false;
+		if (kind === SCOPE_BUTTON) return _tag(el) === "button";
 		if (kind === SCOPE_LIST_ITEM) {
-			return el.tagName === "ol" || el.tagName === "ul";
+			return _tag(el) === "ol" || _tag(el) === "ul";
 		}
 		return false;
 	};
@@ -4915,7 +5326,7 @@ const buildHtmlAst = (source, fragmentContext) => {
 	) => {
 		for (let i = open.length - 1; i >= 0; i--) {
 			const el = open[i];
-			if (el.namespace === NS_HTML && el.tagName === tagName) return true;
+			if (_ns(el) === NS_HTML && _tag(el) === tagName) return true;
 			if (isBoundaryForKind(el, kind)) return false;
 		}
 		return false;
@@ -4939,9 +5350,9 @@ const buildHtmlAst = (source, fragmentContext) => {
 		const set = typeof target === "string" ? null : target;
 		for (let i = open.length - 1; i >= 0; i--) {
 			const el = open[i];
-			if (el.namespace === NS_HTML) {
-				if (set ? set.has(el.tagName) : el.tagName === target) return true;
-				if (TABLE_SCOPE_STOP.has(el.tagName)) return false;
+			if (_ns(el) === NS_HTML) {
+				if (set ? set.has(_tag(el)) : _tag(el) === target) return true;
+				if (TABLE_SCOPE_STOP.has(_tag(el))) return false;
 			}
 		}
 		return false;
@@ -4949,11 +5360,7 @@ const buildHtmlAst = (source, fragmentContext) => {
 	const generateImpliedEndTags = (except = "") => {
 		while (open.length) {
 			const el = cur();
-			if (
-				el.namespace === NS_HTML &&
-				IMPLIED.has(el.tagName) &&
-				el.tagName !== except
-			) {
+			if (_ns(el) === NS_HTML && IMPLIED.has(_tag(el)) && _tag(el) !== except) {
 				open.pop();
 			} else {
 				break;
@@ -4963,7 +5370,7 @@ const buildHtmlAst = (source, fragmentContext) => {
 	const generateImpliedEndTagsThorough = () => {
 		while (open.length) {
 			const el = cur();
-			if (el.namespace === NS_HTML && IMPLIED_THOROUGH.has(el.tagName)) {
+			if (_ns(el) === NS_HTML && IMPLIED_THOROUGH.has(_tag(el))) {
 				open.pop();
 			} else {
 				break;
@@ -4976,12 +5383,8 @@ const buildHtmlAst = (source, fragmentContext) => {
 		let count = 0;
 		for (let i = afe.length - 1; i >= 0; i--) {
 			const e = afe[i];
-			if (e.marker) break;
-			if (
-				afeEl(e).tagName === el.tagName &&
-				afeEl(e).namespace === el.namespace &&
-				sameAttrs(afeEl(e), el)
-			) {
+			if (e === AFE_MARKER) break;
+			if (_tag(e) === _tag(el) && _ns(e) === _ns(el) && sameAttrs(e, el)) {
 				count++;
 				if (count === 3) {
 					afe.splice(i, 1);
@@ -4989,60 +5392,49 @@ const buildHtmlAst = (source, fragmentContext) => {
 				}
 			}
 		}
-		afe.push({ element: el });
+		afe.push(el);
 	};
 	const sameAttrs = (
 		/** @type {HtmlElement} */ a,
 		/** @type {HtmlElement} */ b
 	) => {
-		const aa = a.attributes;
-		const ba = b.attributes;
-		if (aa.length !== ba.length) return false;
+		const aStart = _hAStart[a];
+		const aCount = _hACount[a];
+		const bStart = _hAStart[b];
+		const bCount = _hACount[b];
+		if (aCount !== bCount) return false;
 		// Names are unique (deduped), counts tiny — a nested scan beats a Map
-		// here and allocates nothing on this formatting-element hot path.
-		for (let i = 0; i < ba.length; i++) {
-			const x = ba[i];
-			let ok = false;
-			for (let j = 0; j < aa.length; j++) {
-				if (aa[j].name === x.name) {
-					ok = aa[j].value === x.value;
-					break;
-				}
-			}
-			if (!ok) return false;
+		// here on this formatting-element hot path.
+		for (let i = bStart; i < bStart + bCount; i++) {
+			const j = _aFind(aStart, aCount, _aName[i]);
+			if (j === 0 || _aValueOf(j) !== _aValueOf(i)) return false;
 		}
 		return true;
 	};
-	const insertMarker = () => afe.push({ marker: true });
+	const insertMarker = () => afe.push(AFE_MARKER);
 	const clearAfeToMarker = () => {
 		while (afe.length) {
-			const e = /** @type {{ marker?: boolean }} */ (afe.pop());
-			if (e.marker) break;
+			if (afe.pop() === AFE_MARKER) break;
 		}
 	};
 	const reconstructAfe = () => {
 		if (afe.length === 0) return;
 		let i = afe.length - 1;
-		if (afe[i].marker || open.includes(afeEl(afe[i]))) return;
+		if (afe[i] === AFE_MARKER || open.includes(afe[i])) return;
 		while (i > 0) {
 			i--;
-			if (afe[i].marker || open.includes(afeEl(afe[i]))) {
+			if (afe[i] === AFE_MARKER || open.includes(afe[i])) {
 				i++;
 				break;
 			}
 		}
 		for (; i < afe.length; i++) {
 			const e = afe[i];
-			const el = mkEl(
-				afeEl(e).tagName,
-				afeEl(e).namespace,
-				cloneAttrs(afeEl(e).attributes),
-				null
-			);
+			const el = mkEl(_tag(e), _ns(e), cloneAttrs(e), null);
 			const place = appropriatePlace();
 			insertAtPlace(place, el);
 			open.push(el);
-			afe[i] = { element: el };
+			afe[i] = el;
 		}
 	};
 
@@ -5052,23 +5444,23 @@ const buildHtmlAst = (source, fragmentContext) => {
 		// pop until a p has been popped
 		while (open.length) {
 			const el = /** @type {HtmlElement} */ (open.pop());
-			el.end = tokenEnd;
-			if (el.namespace === NS_HTML && el.tagName === "p") break;
+			_hEn[el] = tokenEnd;
+			if (_ns(el) === NS_HTML && _tag(el) === "p") break;
 		}
 	};
 
 	const popUntil = (/** @type {string} */ tagName) => {
 		while (open.length) {
 			const el = /** @type {HtmlElement} */ (open.pop());
-			el.end = tokenEnd;
-			if (el.namespace === NS_HTML && el.tagName === tagName) break;
+			_hEn[el] = tokenEnd;
+			if (_ns(el) === NS_HTML && _tag(el) === tagName) break;
 		}
 	};
 	const popUntilOneOf = (/** @type {Set<string>} */ set) => {
 		while (open.length) {
 			const el = /** @type {HtmlElement} */ (open.pop());
-			el.end = tokenEnd;
-			if (el.namespace === NS_HTML && set.has(el.tagName)) break;
+			_hEn[el] = tokenEnd;
+			if (_ns(el) === NS_HTML && set.has(_tag(el))) break;
 		}
 	};
 
@@ -5081,8 +5473,8 @@ const buildHtmlAst = (source, fragmentContext) => {
 				last = true;
 				if (fragment) node = fragment;
 			}
-			const tn = node.tagName;
-			if (node.namespace === NS_HTML) {
+			const tn = _tag(node);
+			if (_ns(node) === NS_HTML) {
 				if ((tn === "td" || tn === "th") && !last) {
 					mode = MODE_IN_CELL;
 					return;
@@ -5175,7 +5567,7 @@ const buildHtmlAst = (source, fragmentContext) => {
 		const useForeign =
 			open.length > 0 &&
 			ac &&
-			ac.namespace !== NS_HTML &&
+			_ns(ac) !== NS_HTML &&
 			ty !== TOKEN_EOF &&
 			shouldUseForeignRules(ac, t);
 		if (useForeign) {
@@ -5189,7 +5581,7 @@ const buildHtmlAst = (source, fragmentContext) => {
 		/** @type {HtmlElement} */ ac,
 		/** @type {Token} */ t
 	) => {
-		if (ac.namespace === NS_HTML) return false;
+		if (_ns(ac) === NS_HTML) return false;
 		if (t.type === TOKEN_START_TAG) {
 			if (
 				mathmlTextIntegrationPoint(ac) &&
@@ -5199,8 +5591,8 @@ const buildHtmlAst = (source, fragmentContext) => {
 				return false;
 			}
 			if (
-				ac.namespace === NS_MATHML &&
-				ac.tagName === "annotation-xml" &&
+				_ns(ac) === NS_MATHML &&
+				_tag(ac) === "annotation-xml" &&
 				t.name === "svg"
 			) {
 				return false;
@@ -5219,20 +5611,19 @@ const buildHtmlAst = (source, fragmentContext) => {
 	};
 
 	const mathmlTextIntegrationPoint = (/** @type {HtmlElement} */ el) =>
-		el.namespace === NS_MATHML && MATHML_TEXT_INTEGRATION.has(el.tagName);
+		_ns(el) === NS_MATHML && MATHML_TEXT_INTEGRATION.has(_tag(el));
 	const htmlIntegrationPoint = (/** @type {HtmlElement} */ el) => {
-		if (el.namespace === NS_MATHML && el.tagName === "annotation-xml") {
-			const enc = findAttr(el.attributes, "encoding");
-			if (
-				enc &&
-				(enc.value.toLowerCase() === "text/html" ||
-					enc.value.toLowerCase() === "application/xhtml+xml")
-			) {
-				return true;
+		if (_ns(el) === NS_MATHML && _tag(el) === "annotation-xml") {
+			const enc = _aFind(_hAStart[el], _hACount[el], "encoding");
+			if (enc !== 0) {
+				const value = _aValueOf(enc).toLowerCase();
+				if (value === "text/html" || value === "application/xhtml+xml") {
+					return true;
+				}
 			}
 			return false;
 		}
-		if (el.namespace === NS_SVG && SVG_SPECIAL.has(el.tagName.toLowerCase())) {
+		if (_ns(el) === NS_SVG && SVG_SPECIAL.has(_tag(el).toLowerCase())) {
 			return true;
 		}
 		return false;
@@ -5240,37 +5631,28 @@ const buildHtmlAst = (source, fragmentContext) => {
 
 	const adjustSvgTag = (/** @type {string} */ name) =>
 		/** @type {Record<string, string>} */ (SVG_TAG_ADJUST)[name] || name;
+	// Adjust a foreign start tag's attribute run in place (the run is consumed
+	// only by this tag's element): SVG camelCase names are rewritten, and
+	// namespaced names get the serializer-name flag (see `_aSerializedName`).
 	const adjustForeignAttrs = (
-		/** @type {HtmlAttribute[]} */ attrs,
+		/** @type {AttributeRun} */ run,
 		/** @type {number} */ ns
 	) => {
-		// Reuse the original array/objects until an attribute actually needs
-		// adjusting; unchanged attributes keep serializedName === undefined and
-		// the serializer falls back to `name`. Avoids a new array + object per
-		// attribute on every foreign element.
-		let out = attrs;
-		for (let i = 0; i < attrs.length; i++) {
-			const a = attrs[i];
-			let name = a.name;
-			/** @type {string | undefined} */
-			let serializedName;
+		for (let i = run.start; i < run.start + run.count; i++) {
+			const name = _aName[i];
 			if (
 				ns === NS_SVG &&
 				/** @type {Record<string, string>} */ (SVG_ATTR_ADJUST)[name]
 			) {
-				name = /** @type {Record<string, string>} */ (SVG_ATTR_ADJUST)[name];
-				serializedName = name;
+				_aName[i] = /** @type {Record<string, string>} */ (SVG_ATTR_ADJUST)[
+					name
+				];
 			}
-			if (/** @type {Record<string, string>} */ (FOREIGN_ATTR_NS)[a.name]) {
-				serializedName = /** @type {Record<string, string>} */ (
-					FOREIGN_ATTR_NS
-				)[a.name];
+			if (/** @type {Record<string, string>} */ (FOREIGN_ATTR_NS)[name]) {
+				_aFl[i] |= 1;
 			}
-			if (name === a.name && serializedName === undefined) continue;
-			if (out === attrs) out = [...attrs];
-			out[i] = { ...a, name, serializedName };
 		}
-		return out;
+		return run;
 	};
 
 	const foreignContent = (/** @type {Token} */ t) => {
@@ -5287,17 +5669,16 @@ const buildHtmlAst = (source, fragmentContext) => {
 		}
 		if (t.type === TOKEN_DOCTYPE) return;
 		if (t.type === TOKEN_START_TAG) {
-			const acn = adjustedCurrent().namespace;
+			const acn = _ns(adjustedCurrent());
 			if (
 				FOREIGN_BREAKOUT.has(t.name) ||
-				(t.name === "font" &&
-					t.attrs.some((a) => FONT_BREAKOUT_ATTRS.has(a.name)))
+				(t.name === "font" && hasFontBreakoutAttr(t.attrs))
 			) {
 				// parse error; pop until integration point / html / mathml-text-integration
 				while (open.length > 1) {
 					const c = cur();
 					if (
-						c.namespace === NS_HTML ||
+						_ns(c) === NS_HTML ||
 						mathmlTextIntegrationPoint(c) ||
 						htmlIntegrationPoint(c)
 					) {
@@ -5327,8 +5708,8 @@ const buildHtmlAst = (source, fragmentContext) => {
 		if (t.type === TOKEN_END_TAG) {
 			if (
 				t.name === "script" &&
-				cur().tagName === "script" &&
-				cur().namespace === NS_SVG
+				_tag(cur()) === "script" &&
+				_ns(cur()) === NS_SVG
 			) {
 				open.pop();
 				return;
@@ -5338,7 +5719,7 @@ const buildHtmlAst = (source, fragmentContext) => {
 			if (t.name === "p" || t.name === "br") {
 				while (
 					open.length > 1 &&
-					cur().namespace !== NS_HTML &&
+					_ns(cur()) !== NS_HTML &&
 					!mathmlTextIntegrationPoint(cur()) &&
 					!htmlIntegrationPoint(cur())
 				) {
@@ -5350,21 +5731,18 @@ const buildHtmlAst = (source, fragmentContext) => {
 			// any other end tag
 			let i = open.length - 1;
 			let node = open[i];
-			if (node.tagName.toLowerCase() !== t.name) {
+			if (_tag(node).toLowerCase() !== t.name) {
 				/* parse error */
 			}
 			while (i >= 0) {
 				node = open[i];
 				if (i === 0) return;
-				if (
-					node.namespace !== NS_HTML &&
-					node.tagName.toLowerCase() === t.name
-				) {
+				if (_ns(node) !== NS_HTML && _tag(node).toLowerCase() === t.name) {
 					while (open.length > i) open.pop();
 					return;
 				}
 				i--;
-				if (open[i] && open[i].namespace === NS_HTML) {
+				if (open[i] && _ns(open[i]) === NS_HTML) {
 					runMode(t);
 					return;
 				}
@@ -5379,11 +5757,7 @@ const buildHtmlAst = (source, fragmentContext) => {
 	) => {
 		// step 1
 		const c = cur();
-		if (
-			c.namespace === NS_HTML &&
-			c.tagName === subject &&
-			!afe.some((e) => !e.marker && e.element === c)
-		) {
+		if (_ns(c) === NS_HTML && _tag(c) === subject && !afe.includes(c)) {
 			open.pop();
 			return true;
 		}
@@ -5393,17 +5767,14 @@ const buildHtmlAst = (source, fragmentContext) => {
 			// find formatting element
 			let fmtIdx = -1;
 			for (let i = afe.length - 1; i >= 0; i--) {
-				if (afe[i].marker) break;
-				if (
-					afeEl(afe[i]).tagName === subject &&
-					afeEl(afe[i]).namespace === NS_HTML
-				) {
+				if (afe[i] === AFE_MARKER) break;
+				if (_tag(afe[i]) === subject && _ns(afe[i]) === NS_HTML) {
 					fmtIdx = i;
 					break;
 				}
 			}
 			if (fmtIdx === -1) return false; // act as any other end tag
-			const fmt = afeEl(afe[fmtIdx]);
+			const fmt = afe[fmtIdx];
 			const openIdx = open.indexOf(fmt);
 			if (openIdx === -1) {
 				afe.splice(fmtIdx, 1);
@@ -5435,10 +5806,7 @@ const buildHtmlAst = (source, fragmentContext) => {
 				nodeIdx--;
 				node = open[nodeIdx];
 				if (node === fmt) break;
-				const nodeRef = node;
-				let nodeAfeIdx = afe.findIndex(
-					(e) => !e.marker && e.element === nodeRef
-				);
+				let nodeAfeIdx = afe.indexOf(node);
 				if (inner > 3 && nodeAfeIdx !== -1) {
 					afe.splice(nodeAfeIdx, 1);
 					if (nodeAfeIdx < bookmark) bookmark--;
@@ -5449,13 +5817,8 @@ const buildHtmlAst = (source, fragmentContext) => {
 					continue;
 				}
 				// create clone
-				const clone = mkEl(
-					node.tagName,
-					node.namespace,
-					cloneAttrs(node.attributes),
-					null
-				);
-				afe[nodeAfeIdx] = { element: clone };
+				const clone = mkEl(_tag(node), _ns(node), cloneAttrs(node), null);
+				afe[nodeAfeIdx] = clone;
 				open[nodeIdx] = clone;
 				node = clone;
 				if (lastNode === furthest) bookmark = nodeAfeIdx + 1;
@@ -5469,23 +5832,27 @@ const buildHtmlAst = (source, fragmentContext) => {
 			const place = placeForCommonAncestor(commonAncestor);
 			insertAtPlace(place, lastNode);
 			// create element for fmt token, take children of furthest
-			const cloneFmt = mkEl(
-				fmt.tagName,
-				fmt.namespace,
-				cloneAttrs(fmt.attributes),
-				null
-			);
-			const kids = [...furthest.children];
-			furthest.children.length = 0;
-			for (const k of kids) appendTo(cloneFmt, k);
+			const cloneFmt = mkEl(_tag(fmt), _ns(fmt), cloneAttrs(fmt), null);
+			// Take all direct children of `furthest` (a template's content fragment
+			// deliberately stays put — mirrors childrenOf-less spec behavior here).
+			let k = _hFirst[furthest];
+			_hFirst[furthest] = 0;
+			_hLast[furthest] = 0;
+			while (k !== 0) {
+				const next = _hNext[k];
+				_hNext[k] = 0;
+				_hParent[k] = 0;
+				appendTo(cloneFmt, k);
+				k = next;
+			}
 			appendTo(furthest, cloneFmt);
 			// remove fmt from afe, insert clone at bookmark
-			const curFmtIdx = afe.findIndex((e) => !e.marker && e.element === fmt);
+			const curFmtIdx = afe.indexOf(fmt);
 			if (curFmtIdx !== -1) {
 				afe.splice(curFmtIdx, 1);
 				if (curFmtIdx < bookmark) bookmark--;
 			}
-			afe.splice(bookmark, 0, { element: cloneFmt });
+			afe.splice(bookmark, 0, cloneFmt);
 			// remove fmt from open, insert clone below furthest
 			const ofi = open.indexOf(fmt);
 			if (ofi !== -1) open.splice(ofi, 1);
@@ -5499,8 +5866,8 @@ const buildHtmlAst = (source, fragmentContext) => {
 		/** @type {HtmlElement} */ commonAncestor
 	) => {
 		if (
-			TABLE_CONTEXT.has(commonAncestor.tagName) &&
-			commonAncestor.namespace === NS_HTML
+			TABLE_CONTEXT.has(_tag(commonAncestor)) &&
+			_ns(commonAncestor) === NS_HTML
 		) {
 			// foster
 			// reuse appropriatePlace logic but rooted differently: emulate
@@ -5508,15 +5875,15 @@ const buildHtmlAst = (source, fragmentContext) => {
 			let lastTable = -1;
 			for (let i = open.length - 1; i >= 0; i--) {
 				if (
-					open[i].tagName === "template" &&
-					open[i].namespace === NS_HTML &&
+					_tag(open[i]) === "template" &&
+					_ns(open[i]) === NS_HTML &&
 					lastTemplate === -1
 				) {
 					lastTemplate = i;
 				}
 				if (
-					open[i].tagName === "table" &&
-					open[i].namespace === NS_HTML &&
+					_tag(open[i]) === "table" &&
+					_ns(open[i]) === NS_HTML &&
 					lastTable === -1
 				) {
 					lastTable = i;
@@ -5526,23 +5893,32 @@ const buildHtmlAst = (source, fragmentContext) => {
 				lastTemplate !== -1 &&
 				(lastTable === -1 || lastTemplate > lastTable)
 			) {
-				return { parent: open[lastTemplate], beforeNode: null };
+				return { parent: open[lastTemplate], beforeNode: 0 };
 			}
-			if (lastTable === -1) return { parent: open[0], beforeNode: null };
+			if (lastTable === -1) return { parent: open[0], beforeNode: 0 };
 			const table = open[lastTable];
-			const tp = findParent(table);
-			if (tp) return { parent: tp, beforeNode: table };
-			return { parent: open[lastTable - 1], beforeNode: null };
+			const tp = _hParent[table];
+			if (tp !== 0) return { parent: tp, beforeNode: table };
+			return { parent: open[lastTable - 1], beforeNode: 0 };
 		}
-		return { parent: commonAncestor, beforeNode: null };
+		return { parent: commonAncestor, beforeNode: 0 };
 	};
 
-	const detach = (/** @type {HtmlNode} */ node) => {
-		const p = findParent(node);
-		if (!p) return;
-		const arr = childrenOf(p);
-		const idx = arr.indexOf(node);
-		if (idx !== -1) arr.splice(idx, 1);
+	const detach = (/** @type {HtmlNodeRef} */ node) => {
+		const p = _hParent[node];
+		if (p === 0) return;
+		let prev = 0;
+		let c = _hFirst[p];
+		while (c !== 0 && c !== node) {
+			prev = c;
+			c = _hNext[c];
+		}
+		if (c === 0) return;
+		if (prev === 0) _hFirst[p] = _hNext[node];
+		else _hNext[prev] = _hNext[node];
+		if (_hLast[p] === node) _hLast[p] = prev;
+		_hNext[node] = 0;
+		_hParent[node] = 0;
 	};
 
 	// ---------- insertion modes ----------
@@ -5700,18 +6076,20 @@ const buildHtmlAst = (source, fragmentContext) => {
 			return;
 		}
 		if (t.type === TOKEN_COMMENT) {
-			insertComment(t.data, t.start, t.end, { parent: doc, beforeNode: null });
+			insertComment(t.data, t.start, t.end, { parent: doc, beforeNode: 0 });
 			return;
 		}
 		if (t.type === TOKEN_DOCTYPE) {
-			doc.children.push({
-				type: NodeType.Doctype,
-				name: t.name,
-				publicId: t.publicId,
-				systemId: t.systemId,
-				start: t.start,
-				end: t.end
-			});
+			// `skip.doctype` drops the node only; quirks detection below is unaffected.
+			if (!skipDoctype) {
+				const dt = _hAlloc(NodeType.Doctype, t.start, t.end);
+				_hStr[dt] = t.name;
+				// At most one doctype node is ever inserted (later doctype tokens
+				// are ignored), so its ids live in two per-parse scalars.
+				_hDocPub = t.publicId;
+				_hDocSys = t.systemId;
+				_hAppend(doc, dt);
+			}
 			quirks = isQuirky(t.name, t.publicId, t.systemId);
 			mode = MODE_BEFORE_HTML;
 			return;
@@ -5724,7 +6102,7 @@ const buildHtmlAst = (source, fragmentContext) => {
 	modes.beforeHtml = (t) => {
 		if (t.type === TOKEN_DOCTYPE) return;
 		if (t.type === TOKEN_COMMENT) {
-			insertComment(t.data, t.start, t.end, { parent: doc, beforeNode: null });
+			insertComment(t.data, t.start, t.end, { parent: doc, beforeNode: 0 });
 			return;
 		}
 		if (t.type === TOKEN_CHAR) {
@@ -5734,7 +6112,7 @@ const buildHtmlAst = (source, fragmentContext) => {
 		}
 		if (t.type === TOKEN_START_TAG && t.name === "html") {
 			const el = mkEl("html", NS_HTML, t.attrs, t.pos);
-			doc.children.push(el);
+			_hAppend(doc, el);
 			open.push(el);
 			mode = MODE_BEFORE_HEAD;
 			return;
@@ -5742,8 +6120,8 @@ const buildHtmlAst = (source, fragmentContext) => {
 		if (t.type === TOKEN_END_TAG && !HEAD_BODY_HTML_BR.has(t.name)) {
 			return;
 		}
-		const el = mkEl("html", NS_HTML, [], null);
-		doc.children.push(el);
+		const el = mkEl("html", NS_HTML, EMPTY_ATTRS, null);
+		_hAppend(doc, el);
 		open.push(el);
 		mode = MODE_BEFORE_HEAD;
 		process(t);
@@ -5819,7 +6197,10 @@ const buildHtmlAst = (source, fragmentContext) => {
 				mode = MODE_IN_TEMPLATE;
 				templateModes.push(MODE_IN_TEMPLATE);
 				const el = cur();
-				el.templateContent = { type: NodeType.DocumentFragment, children: [] };
+				const fragment = _hAlloc(NodeType.DocumentFragment, 0, 0);
+				// Parent link so the iterative walk can ascend out of the content.
+				_hParent[fragment] = el;
+				_hTc[el] = fragment;
 				return;
 			}
 			if (t.name === "head") return;
@@ -5887,7 +6268,7 @@ const buildHtmlAst = (source, fragmentContext) => {
 		if (t.type === TOKEN_CHAR) {
 			const r = leadingWs(t, true);
 			if (!r) return;
-			insertHtmlElement("body", [], null);
+			insertHtmlElement("body", EMPTY_ATTRS, null);
 			mode = MODE_IN_BODY;
 			process(r);
 			return;
@@ -5924,7 +6305,7 @@ const buildHtmlAst = (source, fragmentContext) => {
 			if (t.name === "template") return modes.inHead(t);
 			if (!BODY_HTML_BR.has(t.name)) return;
 		}
-		insertHtmlElement("body", [], null);
+		insertHtmlElement("body", EMPTY_ATTRS, null);
 		mode = MODE_IN_BODY;
 		process(t);
 	};
@@ -5962,10 +6343,10 @@ const buildHtmlAst = (source, fragmentContext) => {
 	const anyOtherEndTag = (/** @type {string} */ name) => {
 		for (let i = open.length - 1; i >= 0; i--) {
 			const node = open[i];
-			if (node.namespace === NS_HTML && node.tagName === name) {
+			if (_ns(node) === NS_HTML && _tag(node) === name) {
 				generateImpliedEndTags(name);
 				while (open.length > i) {
-					open[open.length - 1].end = tokenEnd;
+					_hEn[open[open.length - 1]] = tokenEnd;
 					open.pop();
 				}
 				return;
@@ -5980,12 +6361,7 @@ const buildHtmlAst = (source, fragmentContext) => {
 			if (open.some(isHtmlTemplateEl)) {
 				return;
 			}
-			const htmlEl = open[0];
-			for (const a of t.attrs) {
-				if (!htmlEl.attributes.some((x) => x.name === a.name)) {
-					htmlEl.attributes.push(a);
-				}
-			}
+			mergeAttrs(open[0], t.attrs);
 			return;
 		}
 		if (HEAD_ELEMENTS.has(name)) {
@@ -5993,20 +6369,16 @@ const buildHtmlAst = (source, fragmentContext) => {
 		}
 		if (name === "body") {
 			const second = open[1];
-			if (!second || second.tagName !== "body" || open.some(isHtmlTemplateEl)) {
+			if (!second || _tag(second) !== "body" || open.some(isHtmlTemplateEl)) {
 				return;
 			}
 			framesetOk = false;
-			for (const a of t.attrs) {
-				if (!second.attributes.some((x) => x.name === a.name)) {
-					second.attributes.push(a);
-				}
-			}
+			mergeAttrs(second, t.attrs);
 			return;
 		}
 		if (name === "frameset") {
 			const second = open[1];
-			if (!second || second.tagName !== "body") return;
+			if (!second || _tag(second) !== "body") return;
 			if (!framesetOk) return;
 			detach(second);
 			while (open.length > 1) open.pop();
@@ -6021,7 +6393,7 @@ const buildHtmlAst = (source, fragmentContext) => {
 		}
 		if (HEADING.has(name)) {
 			closeIfPInButtonScope();
-			if (cur().namespace === NS_HTML && HEADING.has(cur().tagName)) open.pop();
+			if (_ns(cur()) === NS_HTML && HEADING.has(_tag(cur()))) open.pop();
 			insertHtmlElement(name, t.attrs, t.pos);
 			return;
 		}
@@ -6047,14 +6419,14 @@ const buildHtmlAst = (source, fragmentContext) => {
 			framesetOk = false;
 			for (let i = open.length - 1; i >= 0; i--) {
 				const node = open[i];
-				if (node.namespace === NS_HTML && node.tagName === "li") {
+				if (_ns(node) === NS_HTML && _tag(node) === "li") {
 					generateImpliedEndTags("li");
 					popUntil("li");
 					break;
 				}
 				if (
 					isSpecial(node) &&
-					!(node.namespace === NS_HTML && ADDRESS_DIV_P.has(node.tagName))
+					!(_ns(node) === NS_HTML && ADDRESS_DIV_P.has(_tag(node)))
 				) {
 					break;
 				}
@@ -6068,16 +6440,16 @@ const buildHtmlAst = (source, fragmentContext) => {
 			for (let i = open.length - 1; i >= 0; i--) {
 				const node = open[i];
 				if (
-					node.namespace === NS_HTML &&
-					(node.tagName === "dd" || node.tagName === "dt")
+					_ns(node) === NS_HTML &&
+					(_tag(node) === "dd" || _tag(node) === "dt")
 				) {
-					generateImpliedEndTags(node.tagName);
-					popUntil(node.tagName);
+					generateImpliedEndTags(_tag(node));
+					popUntil(_tag(node));
 					break;
 				}
 				if (
 					isSpecial(node) &&
-					!(node.namespace === NS_HTML && ADDRESS_DIV_P.has(node.tagName))
+					!(_ns(node) === NS_HTML && ADDRESS_DIV_P.has(_tag(node)))
 				) {
 					break;
 				}
@@ -6104,14 +6476,12 @@ const buildHtmlAst = (source, fragmentContext) => {
 		if (name === "a") {
 			// if there's an <a> in afe after last marker
 			for (let i = afe.length - 1; i >= 0; i--) {
-				if (afe[i].marker) break;
-				if (afeEl(afe[i]).tagName === "a") {
+				if (afe[i] === AFE_MARKER) break;
+				if (_tag(afe[i]) === "a") {
 					adoptionAgency("a", t.pos);
-					const idx = afe.findIndex(
-						(e) => !e.marker && afeEl(e).tagName === "a"
-					);
+					const idx = afe.findIndex((e) => e !== AFE_MARKER && _tag(e) === "a");
 					if (idx !== -1) {
-						const el = afeEl(afe[idx]);
+						const el = afe[idx];
 						afe.splice(idx, 1);
 						const oi = open.indexOf(el);
 						if (oi !== -1) open.splice(oi, 1);
@@ -6171,16 +6541,18 @@ const buildHtmlAst = (source, fragmentContext) => {
 				resetInsertionMode();
 			} else if (
 				fragment &&
-				fragment.namespace === NS_HTML &&
-				fragment.tagName === "select"
+				_ns(fragment) === NS_HTML &&
+				_tag(fragment) === "select"
 			) {
 				return;
 			}
 			reconstructAfe();
 			insertHtmlElement("input", t.attrs, t.pos);
 			open.pop();
-			const ty = findAttr(t.attrs, "type");
-			if (!ty || ty.value.toLowerCase() !== "hidden") framesetOk = false;
+			const ty = _aFind(t.attrs.start, t.attrs.count, "type");
+			if (ty === 0 || _aValueOf(ty).toLowerCase() !== "hidden") {
+				framesetOk = false;
+			}
 			return;
 		}
 		if (PARAM_SOURCE_TRACK.has(name)) {
@@ -6189,8 +6561,8 @@ const buildHtmlAst = (source, fragmentContext) => {
 			return;
 		}
 		if (name === "hr") {
-			if (cur().namespace === NS_HTML && cur().tagName === "option") open.pop();
-			if (cur().namespace === NS_HTML && cur().tagName === "optgroup") {
+			if (_ns(cur()) === NS_HTML && _tag(cur()) === "option") open.pop();
+			if (_ns(cur()) === NS_HTML && _tag(cur()) === "optgroup") {
 				open.pop();
 			}
 			closeIfPInButtonScope();
@@ -6239,11 +6611,11 @@ const buildHtmlAst = (source, fragmentContext) => {
 			return;
 		}
 		if (name === "optgroup" || name === "option") {
-			if (cur().namespace === NS_HTML && cur().tagName === "option") open.pop();
+			if (_ns(cur()) === NS_HTML && _tag(cur()) === "option") open.pop();
 			if (
 				name === "optgroup" &&
-				cur().namespace === NS_HTML &&
-				cur().tagName === "optgroup"
+				_ns(cur()) === NS_HTML &&
+				_tag(cur()) === "optgroup"
 			) {
 				open.pop();
 			}
@@ -6283,20 +6655,13 @@ const buildHtmlAst = (source, fragmentContext) => {
 		insertHtmlElement(name, t.attrs, t.pos);
 	};
 
-	const adjustMathmlAttrs = (/** @type {HtmlAttribute[]} */ attrs) => {
-		// Only `definitionurl` is rewritten; reuse the original array otherwise.
-		let out = attrs;
-		for (let i = 0; i < attrs.length; i++) {
-			if (attrs[i].name === "definitionurl") {
-				if (out === attrs) out = [...attrs];
-				out[i] = {
-					...attrs[i],
-					name: "definitionURL",
-					serializedName: "definitionURL"
-				};
-			}
+	// Only `definitionurl` is rewritten (in place — the run is consumed only by
+	// this tag's element); the camelCase name serializes as itself.
+	const adjustMathmlAttrs = (/** @type {AttributeRun} */ run) => {
+		for (let i = run.start; i < run.start + run.count; i++) {
+			if (_aName[i] === "definitionurl") _aName[i] = "definitionURL";
 		}
-		return out;
+		return run;
 	};
 
 	const endTagInBody = (/** @type {EndTagToken} */ t) => {
@@ -6323,7 +6688,7 @@ const buildHtmlAst = (source, fragmentContext) => {
 		if (name === "form") {
 			if (!open.some(isHtmlTemplateEl)) {
 				const node = form;
-				form = null;
+				form = 0;
 				if (!node || !inScopeEl(node)) return;
 				generateImpliedEndTags();
 				const idx = open.indexOf(node);
@@ -6420,7 +6785,7 @@ const buildHtmlAst = (source, fragmentContext) => {
 			// current element: a non-matching name (e.g. a fragment context), or
 			// a name that ran straight to EOF with no delimiter (`</script` at
 			// EOF — the tokenizer still emits a partial tag there).
-			if (cur() && (t.name !== cur().tagName || t.pos.end === t.pos.nameEnd)) {
+			if (cur() && (t.name !== _tag(cur()) || t.pos.end === t.pos.nameEnd)) {
 				insertCharacters(
 					source.slice(t.pos.start, t.pos.end),
 					t.pos.start,
@@ -6440,7 +6805,7 @@ const buildHtmlAst = (source, fragmentContext) => {
 	modes.inTable = (t) => {
 		if (t.type === TOKEN_CHAR) {
 			const c = cur();
-			if (TABLE_CONTEXT.has(c.tagName) && c.namespace === NS_HTML) {
+			if (TABLE_CONTEXT.has(_tag(c)) && _ns(c) === NS_HTML) {
 				pendingTableChars = { list: [], hasNonWs: false };
 				originalMode = mode;
 				mode = MODE_IN_TABLE_TEXT;
@@ -6495,8 +6860,8 @@ const buildHtmlAst = (source, fragmentContext) => {
 				return modes.inHead(t);
 			}
 			if (name === "input") {
-				const ty = findAttr(t.attrs, "type");
-				if (ty && ty.value.toLowerCase() === "hidden") {
+				const ty = _aFind(t.attrs.start, t.attrs.count, "type");
+				if (ty !== 0 && _aValueOf(ty).toLowerCase() === "hidden") {
 					insertHtmlElement("input", t.attrs, t.pos);
 					open.pop();
 					return;
@@ -6566,7 +6931,7 @@ const buildHtmlAst = (source, fragmentContext) => {
 	const clearStackToTableContext = () => {
 		while (open.length) {
 			const c = cur();
-			if (c.namespace === NS_HTML && CLEAR_TABLE.has(c.tagName)) {
+			if (_ns(c) === NS_HTML && CLEAR_TABLE.has(_tag(c))) {
 				break;
 			}
 			open.pop();
@@ -6575,7 +6940,7 @@ const buildHtmlAst = (source, fragmentContext) => {
 	const clearStackToTableBodyContext = () => {
 		while (open.length) {
 			const c = cur();
-			if (c.namespace === NS_HTML && CLEAR_TABLE_BODY.has(c.tagName)) {
+			if (_ns(c) === NS_HTML && CLEAR_TABLE_BODY.has(_tag(c))) {
 				break;
 			}
 			open.pop();
@@ -6584,7 +6949,7 @@ const buildHtmlAst = (source, fragmentContext) => {
 	const clearStackToTableRowContext = () => {
 		while (open.length) {
 			const c = cur();
-			if (c.namespace === NS_HTML && CLEAR_TABLE_ROW.has(c.tagName)) {
+			if (_ns(c) === NS_HTML && CLEAR_TABLE_ROW.has(_tag(c))) {
 				break;
 			}
 			open.pop();
@@ -6617,7 +6982,7 @@ const buildHtmlAst = (source, fragmentContext) => {
 		if (t.type === TOKEN_CHAR) {
 			const r = leadingWs(t, true);
 			if (!r) return;
-			if (cur().tagName !== "colgroup") return;
+			if (_tag(cur()) !== "colgroup") return;
 			open.pop();
 			mode = MODE_IN_TABLE;
 			process(r);
@@ -6635,7 +7000,7 @@ const buildHtmlAst = (source, fragmentContext) => {
 			return;
 		}
 		if (t.type === TOKEN_END_TAG && t.name === "colgroup") {
-			if (cur().tagName !== "colgroup") return;
+			if (_tag(cur()) !== "colgroup") return;
 			open.pop();
 			mode = MODE_IN_TABLE;
 			return;
@@ -6648,7 +7013,7 @@ const buildHtmlAst = (source, fragmentContext) => {
 			return modes.inHead(t);
 		}
 		if (t.type === TOKEN_EOF) return modes.inBody(t);
-		if (cur().tagName !== "colgroup") return;
+		if (_tag(cur()) !== "colgroup") return;
 		open.pop();
 		mode = MODE_IN_TABLE;
 		process(t);
@@ -6798,7 +7163,7 @@ const buildHtmlAst = (source, fragmentContext) => {
 		if (t.type === TOKEN_COMMENT) {
 			insertComment(t.data, t.start, t.end, {
 				parent: open[0],
-				beforeNode: null
+				beforeNode: 0
 			});
 			return;
 		}
@@ -6831,9 +7196,9 @@ const buildHtmlAst = (source, fragmentContext) => {
 			return;
 		}
 		if (t.type === TOKEN_END_TAG && t.name === "frameset") {
-			if (cur().tagName === "html") return;
+			if (_tag(cur()) === "html") return;
 			open.pop();
-			if (!fragment && cur().tagName !== "frameset") mode = MODE_AFTER_FRAMESET;
+			if (!fragment && _tag(cur()) !== "frameset") mode = MODE_AFTER_FRAMESET;
 			return;
 		}
 		if (t.type === TOKEN_START_TAG && t.name === "frame") {
@@ -6869,7 +7234,7 @@ const buildHtmlAst = (source, fragmentContext) => {
 
 	modes.afterAfterBody = (t) => {
 		if (t.type === TOKEN_COMMENT) {
-			insertComment(t.data, t.start, t.end, { parent: doc, beforeNode: null });
+			insertComment(t.data, t.start, t.end, { parent: doc, beforeNode: 0 });
 			return;
 		}
 		if (t.type === TOKEN_DOCTYPE) return modes.inBody(t);
@@ -6882,7 +7247,7 @@ const buildHtmlAst = (source, fragmentContext) => {
 
 	modes.afterAfterFrameset = (t) => {
 		if (t.type === TOKEN_COMMENT) {
-			insertComment(t.data, t.start, t.end, { parent: doc, beforeNode: null });
+			insertComment(t.data, t.start, t.end, { parent: doc, beforeNode: 0 });
 			return;
 		}
 		if (t.type === TOKEN_DOCTYPE) return modes.inBody(t);
@@ -6904,9 +7269,9 @@ const buildHtmlAst = (source, fragmentContext) => {
 			ctxNs = NS_MATHML;
 			ctxName = ctxName.slice(5);
 		}
-		fragment = mkEl(ctxName, ctxNs, [], null);
-		const htmlEl = mkEl("html", NS_HTML, [], null);
-		doc.children.push(htmlEl);
+		fragment = mkEl(ctxName, ctxNs, EMPTY_ATTRS, null);
+		const htmlEl = mkEl("html", NS_HTML, EMPTY_ATTRS, null);
+		_hAppend(doc, htmlEl);
 		open.push(htmlEl);
 		if (ctxNs !== NS_HTML) {
 			mode = MODE_IN_BODY;
@@ -6949,7 +7314,7 @@ const buildHtmlAst = (source, fragmentContext) => {
 		type: TOKEN_EOF,
 		name: "",
 		data: "",
-		attrs: [],
+		attrs: { start: 0, count: 0 },
 		selfClosing: false,
 		start: 0,
 		end: 0,
@@ -6964,9 +7329,9 @@ const buildHtmlAst = (source, fragmentContext) => {
 	walkHtmlTokens(source, 0, {
 		isForeign: () => {
 			const ac = adjustedCurrent();
-			return open.length > 0 && ac && ac.namespace !== NS_HTML;
+			return open.length > 0 && ac !== 0 && _ns(ac) !== NS_HTML;
 		},
-		fragmentContext: fragment ? fragment.tagName : undefined,
+		fragmentContext: fragment ? _tag(fragment) : undefined,
 		parseError: (input, code) => {
 			if (code === "eof-in-tag") eofInTag = true;
 		},
@@ -6988,7 +7353,7 @@ const buildHtmlAst = (source, fragmentContext) => {
 			// The tokenizer emits CDATA sections through this callback too.
 			if (input.startsWith("<![CDATA[", start)) {
 				const ac = adjustedCurrent();
-				if (open.length > 0 && ac && ac.namespace !== NS_HTML) {
+				if (open.length > 0 && ac && _ns(ac) !== NS_HTML) {
 					const innerEnd = input.endsWith("]]>", end) ? end - 3 : end;
 					const data = input.slice(start + 9, innerEnd).replace(/\r\n?/g, "\n");
 					if (data !== "") {
@@ -7030,17 +7395,40 @@ const buildHtmlAst = (source, fragmentContext) => {
 			return end;
 		},
 		text: (input, start, end) => {
+			// `skip.text` fast path: node dropped, so only whitespace-ness matters.
+			// With no `&`/`\0`/`\r` (and no pending newline-swallow) the decoded value
+			// equals the raw range — dispatch a canonical marker (`" "`/`"x"`) without
+			// the slice + entity decode; anything trickier falls through.
+			if (skipText && !swallowNextNewline) {
+				let hasNonWs = false;
+				let i = start;
+				for (; i < end; i++) {
+					const c = input.charCodeAt(i);
+					// 2 = break (& / NUL / CR), 1 = whitespace, 0 = other.
+					const cls = c < 128 ? _TEXT_SCAN_CLASS[c] : 0;
+					if (cls === 2) break;
+					if (cls === 0) hasNonWs = true;
+				}
+				if (i === end) {
+					tok.type = TOKEN_CHAR;
+					tok.data = hasNonWs ? "x" : " ";
+					tok.start = start;
+					tok.end = end;
+					dispatch();
+					return end;
+				}
+			}
 			const raw = input.slice(start, end);
 			// CR normalization only when a CR is actually present (common case has none).
 			const s = !raw.includes("\r") ? raw : raw.replace(/\r\n?/g, "\n");
 			const top = adjustedCurrent();
 			const rawMode =
 				mode === MODE_TEXT ||
-				(top && top.namespace === NS_HTML && top.tagName === "plaintext");
+				(top && _ns(top) === NS_HTML && _tag(top) === "plaintext");
 			const noDecode =
 				top &&
-				top.namespace === NS_HTML &&
-				NO_DECODE_TEXT.has(top.tagName) &&
+				_ns(top) === NS_HTML &&
+				NO_DECODE_TEXT.has(_tag(top)) &&
 				(mode === MODE_TEXT || mode === MODE_IN_BODY);
 			let data = noDecode ? s : decode(s, false);
 			// In RAWTEXT/RCDATA/script/PLAINTEXT, NULL becomes U+FFFD (tokenizer
@@ -7061,32 +7449,29 @@ const buildHtmlAst = (source, fragmentContext) => {
 		},
 		attribute: (input, nameStart, nameEnd, valueStart, valueEnd, quoteType) => {
 			const name = internLowerName(ATTR_NAME_INTERN, input, nameStart, nameEnd);
-			// Raw (undecoded) value: consumers re-resolve requests from it and the
-			// offsets must stay aligned with the source. Entity decoding for the
-			// html5lib serializer happens there, not here.
-			const value = valueStart !== -1 ? input.slice(valueStart, valueEnd) : "";
+			if (pendAttrStart === 0) pendAttrStart = _aN + 1;
 			// Drop duplicate attribute names (per spec). Plain loop avoids a
 			// per-attribute closure allocation on this hot path.
 			let dup = false;
-			for (let i = 0; i < pendingAttrs.length; i++) {
-				if (pendingAttrs[i].name === name) {
+			for (let i = pendAttrStart; i <= _aN; i++) {
+				if (_aName[i] === name) {
 					dup = true;
 					break;
 				}
 			}
 			if (!dup) {
-				// Field order/shape matches `cloneAttrs` / `adjustForeignAttrs` output
-				// (serializedName present from creation) so all attribute objects
-				// share one hidden class.
-				pendingAttrs.push({
+				// The raw (undecoded) value is read from the source by offset on
+				// demand: consumers re-resolve requests from it and the offsets must
+				// stay aligned with the source. Only a valueless attribute stores an
+				// override ("").
+				_aAlloc(
 					name,
-					value,
-					serializedName: undefined,
+					valueStart !== -1 ? null : "",
 					nameStart,
 					nameEnd,
 					valueStart,
 					valueEnd
-				});
+				);
 			}
 			if (valueStart === -1) return nameEnd;
 			return quoteType !== QUOTE_NONE ? valueEnd + 1 : valueEnd;
@@ -7095,25 +7480,19 @@ const buildHtmlAst = (source, fragmentContext) => {
 			// A start tag the tokenizer only emitted because it hit EOF mid-tag
 			// is dropped, matching the spec's eof-in-tag handling.
 			if (eofInTag) {
-				if (pendingAttrs.length !== 0) pendingAttrs = [];
+				// Any attribute slots already allocated for it are orphaned.
+				pendAttrStart = 0;
 				return end;
 			}
 			const name = internLowerName(TAG_NAME_INTERN, input, nameStart, nameEnd);
 			if (name === "selectedcontent") sawSelectedContent = true;
-			// Attributeless elements share the frozen EMPTY_ATTRS (no allocation);
-			// the empty pendingAttrs buffer is reused for the next tag. `<html>`
-			// and `<body>` keep their own mutable array since later duplicate tags
-			// merge attributes into it.
-			let attrs;
-			if (pendingAttrs.length === 0 && name !== "html" && name !== "body") {
-				attrs = EMPTY_ATTRS;
-			} else {
-				attrs = pendingAttrs;
-				pendingAttrs = [];
-			}
 			tok.type = TOKEN_START_TAG;
 			tok.name = name;
-			tok.attrs = attrs;
+			// The reused token carries the tag's attribute run; every consumer of
+			// `t.attrs` runs synchronously within this dispatch.
+			tok.attrs.start = pendAttrStart;
+			tok.attrs.count = pendAttrStart === 0 ? 0 : _aN + 1 - pendAttrStart;
+			pendAttrStart = 0;
 			tok.selfClosing = selfClosing;
 			tok.swallowNewline = false;
 			tok.pos.start = start;
@@ -7126,8 +7505,8 @@ const buildHtmlAst = (source, fragmentContext) => {
 		},
 		closeTag: (input, start, end, nameStart, nameEnd) => {
 			const name = internLowerName(TAG_NAME_INTERN, input, nameStart, nameEnd);
-			// End tags drop any parsed attributes; only reallocate if non-empty.
-			if (pendingAttrs.length !== 0) pendingAttrs = [];
+			// End tags drop any parsed attributes (the slots are orphaned).
+			pendAttrStart = 0;
 			tok.type = TOKEN_END_TAG;
 			tok.name = name;
 			tok.pos.start = start;
@@ -7141,63 +7520,70 @@ const buildHtmlAst = (source, fragmentContext) => {
 	tok.type = TOKEN_EOF;
 	dispatch();
 
-	if (sawSelectedContent) mirrorSelectedContent(doc, null);
+	if (sawSelectedContent) mirrorSelectedContent(doc, 0);
 
 	return doc;
 };
 
 /**
- * Deep-clone a node, dropping source offsets so cloned content does not
- * re-emit dependencies.
- * @param {HtmlNode} node node
- * @returns {HtmlNode} clone
+ * Deep-clone a node into fresh ids, dropping attribute source offsets and the
+ * raw-text body span so cloned content does not re-emit dependencies.
+ * @param {HtmlNodeRef} node node
+ * @returns {HtmlNodeRef} clone
  */
 const cloneSubtree = (node) => {
-	if (node.type !== NodeType.Element) return { ...node };
-	return {
-		type: NodeType.Element,
-		tagName: node.tagName,
-		namespace: node.namespace,
-		attributes: node.attributes.map((a) => ({
-			name: a.name,
-			value: a.value,
-			serializedName: a.serializedName,
-			nameStart: -1,
-			nameEnd: -1,
-			valueStart: -1,
-			valueEnd: -1
-		})),
-		children: node.children.map(cloneSubtree),
-		selfClosing: node.selfClosing,
-		start: node.start,
-		end: node.end,
-		tagEnd: node.tagEnd,
-		nameEnd: node.nameEnd
-	};
+	const ty = _hTy[node];
+	const clone = _hAlloc(ty, _hSt[node], _hEn[node]);
+	_hStr[clone] = _hStr[node];
+	if (ty !== NodeType.Element) return clone;
+	_hFl[clone] = _hFl[node];
+	const attrs = cloneAttrs(node);
+	_hAStart[clone] = attrs.start;
+	_hACount[clone] = attrs.count;
+	_hTagEnd[clone] = _hTagEnd[node];
+	_hNameEnd[clone] = _hNameEnd[node];
+	// Empty body span: the clone re-emits no raw-text dependency.
+	_hCEnd[clone] = _hTagEnd[node];
+	for (let k = _hFirst[node]; k !== 0; k = _hNext[k]) {
+		_hAppend(clone, cloneSubtree(k));
+	}
+	// Clone `<template>` content into the clone's own fragment.
+	const tc = _hTc[node];
+	if (tc !== 0) {
+		const fragment = _hAlloc(NodeType.DocumentFragment, 0, 0);
+		// Parent link so the iterative walk can ascend out of the content.
+		_hParent[fragment] = clone;
+		_hTc[clone] = fragment;
+		for (let k = _hFirst[tc]; k !== 0; k = _hNext[k]) {
+			_hAppend(fragment, cloneSubtree(k));
+		}
+	}
+	return clone;
 };
 
 /**
  * The selected option of a select: the last `<option selected>`, else the
  * first option (scanning direct children and `<optgroup>` children).
  * @param {HtmlElement} select select element
- * @returns {HtmlElement | null} selected option
+ * @returns {HtmlElement} selected option (0 = none)
  */
 const selectedOption = (select) => {
 	/** @type {HtmlElement[]} */
 	const options = [];
 	/** @param {HtmlElement} el element */
 	const collect = (el) => {
-		for (const c of el.children) {
-			if (c.type !== NodeType.Element || c.namespace !== NS_HTML) continue;
-			if (c.tagName === "option") options.push(c);
-			else if (c.tagName === "optgroup") collect(c);
+		for (let c = _hFirst[el]; c !== 0; c = _hNext[c]) {
+			if (_hTy[c] !== NodeType.Element || _ns(c) !== NS_HTML) continue;
+			if (_hStr[c] === "option") options.push(c);
+			else if (_hStr[c] === "optgroup") collect(c);
 		}
 	};
 	collect(select);
-	if (options.length === 0) return null;
+	if (options.length === 0) return 0;
 	for (let i = options.length - 1; i >= 0; i--) {
-		if (options[i].attributes.some((a) => a.name === "selected")) {
-			return options[i];
+		const el = options[i];
+		if (_aFind(_hAStart[el], _hACount[el], "selected") !== 0) {
+			return el;
 		}
 	}
 	return options[0];
@@ -7206,25 +7592,31 @@ const selectedOption = (select) => {
 /**
  * Fill each `<selectedcontent>` with a clone of its `<select>`'s selected
  * option subtree (the customizable-select mirroring behavior).
- * @param {HtmlElement | HtmlDocument | HtmlDocumentFragment} node node
- * @param {HtmlElement | null} select nearest ancestor select
+ * @param {HtmlNodeRef} node node
+ * @param {HtmlElement} select nearest ancestor select (0 = none)
  */
 const mirrorSelectedContent = (node, select) => {
-	const children =
-		node.type === NodeType.Element && node.templateContent
-			? node.templateContent.children
-			: node.children;
-	for (const child of children) {
-		if (child.type !== NodeType.Element) continue;
-		if (child.namespace === NS_HTML && child.tagName === "select") {
+	// A `<template>`'s children live in its content fragment.
+	const tc = _hTc[node];
+	const container = tc !== 0 ? tc : node;
+	for (let child = _hFirst[container]; child !== 0; child = _hNext[child]) {
+		if (_hTy[child] !== NodeType.Element) continue;
+		if (_ns(child) === NS_HTML && _hStr[child] === "select") {
 			mirrorSelectedContent(child, child);
 		} else if (
-			select &&
-			child.namespace === NS_HTML &&
-			child.tagName === "selectedcontent"
+			select !== 0 &&
+			_ns(child) === NS_HTML &&
+			_hStr[child] === "selectedcontent"
 		) {
 			const option = selectedOption(select);
-			if (option) child.children = option.children.map(cloneSubtree);
+			if (option !== 0) {
+				// Replace the children with clones of the option's subtree.
+				_hFirst[child] = 0;
+				_hLast[child] = 0;
+				for (let k = _hFirst[option]; k !== 0; k = _hNext[k]) {
+					_hAppend(child, cloneSubtree(k));
+				}
+			}
 		} else {
 			mirrorSelectedContent(child, select);
 		}
@@ -7257,37 +7649,20 @@ const parseDoctype = (/** @type {string} */ raw) => {
 	return { name, publicId, systemId };
 };
 
-/**
- * AST node `type` discriminators. Numeric for the same reason as the CSS
- * `NodeType`: compact integer `===` dispatch on the tree-construction and
- * visitor-walk hot paths. Members are literal-typed so `node.type ===
- * NodeType.X` still narrows the `HtmlNode` union.
- * @type {{ Document: 1, DocumentFragment: 2, Element: 3, Text: 4, Comment: 5, Doctype: 6 }}
- */
-const NodeType = {
-	Document: 1,
-	DocumentFragment: 2,
-	Element: 3,
-	Text: 4,
-	Comment: 5,
-	Doctype: 6
-};
-
 /** @typedef {HtmlNode | HtmlDocument | HtmlDocumentFragment} HtmlVisitableNode */
 
 // HTML-typed views over the generic visitor machinery (`util/SourceProcessor`).
 /**
- * @typedef {import("../util/SourceProcessor").VisitorContext} VisitorContext
- * @typedef {import("../util/SourceProcessor").VisitorFn<HtmlVisitableNode>} VisitorFn
- * @typedef {import("../util/SourceProcessor").VisitorBucket<HtmlVisitableNode>} VisitorBucket
- * @typedef {import("../util/SourceProcessor").VisitorMap<HtmlVisitableNode>} VisitorMap
- * @typedef {import("../util/SourceProcessor").CompiledVisitorMap<HtmlVisitableNode>} CompiledVisitorMap
+ * @typedef {import("../util/SourceProcessor").VisitorFn<HtmlPath>} VisitorFn
+ * @typedef {import("../util/SourceProcessor").VisitorBucket<HtmlPath>} VisitorBucket
+ * @typedef {import("../util/SourceProcessor").VisitorMap<HtmlPath>} VisitorMap
+ * @typedef {import("../util/SourceProcessor").CompiledVisitorMap<HtmlPath>} CompiledVisitorMap
  */
 
 /**
  * @typedef {object} HtmlProcessOptions
- * @property {string=} fragmentContext context element tag name for fragment parsing (see `buildHtmlAst`)
- * @property {(HtmlDocument | HtmlDocumentFragment)=} ast walk this pre-built AST instead of parsing the input
+ * @property {string=} fragmentContext context element tag name for fragment parsing (see `buildHtmlAst`); the HTML analog of the CSS parser's `as` parse-mode option
+ * @property {HtmlAstSkip=} skip node kinds to omit from the AST for speed/memory (see `HtmlAstSkip`)
  */
 
 /**
@@ -7299,54 +7674,97 @@ const NodeType = {
  * @param {HtmlProcessOptions} options process options
  */
 const grammar = (input, visitors, options) => {
-	// Babel's `path.skip()`, children-only. Reset per `enter` dispatch.
-	let skipFlag = false;
-	const visitorCtx = {
-		skipChildren() {
-			skipFlag = true;
-		}
+	const root = buildHtmlAst(input, options.fragmentContext, options.skip);
+
+	// Iterative depth-first walk over the link columns: `firstChild`
+	// / `nextSibling` descend, the `parent` column ascends, so arbitrarily deep
+	// markup can't overflow the call stack (the old recursive walk died at
+	// ~10⁵ nesting). A `<template>`'s content fragment is visited before the
+	// element's children; ascending out of it continues with those children
+	// (the fragment is never in a sibling chain, `_hNext` = 0).
+	/**
+	 * Fire a node's `enter` visitors; true when the walk may descend.
+	 * @param {HtmlNodeRef} node node
+	 * @returns {boolean} false when a visitor called `skipChildren()`
+	 */
+	const enter = (node) => {
+		const b = visitors[_hTy[node]];
+		if (b === undefined || b.enter.length === 0) return true;
+		_walkSkip = false;
+		_curNode = node;
+		const p = _hParent[node];
+		_curParent = p === 0 ? null : p;
+		const e = b.enter;
+		for (let i = 0; i < e.length; i++) e[i](A);
+		const skip = _walkSkip;
+		_walkSkip = false;
+		return !skip;
 	};
-
 	/**
-	 * Fetches the node's visitor bucket once (reused for enter + exit) and uses
-	 * index loops — `for…of` would allocate an iterator per node on this hot path.
-	 * @param {HtmlVisitableNode} node subtree root
-	 * @param {HtmlVisitableNode | null} parent enclosing node
+	 * Fire a node's `exit` visitors.
+	 * @param {HtmlNodeRef} node node
 	 */
-	const walk = (node, parent) => {
-		const b = visitors[node.type];
-		let skip = false;
-		if (b !== undefined && b.enter.length !== 0) {
-			skipFlag = false;
-			const e = b.enter;
-			for (let i = 0; i < e.length; i++) e[i](node, parent, visitorCtx);
-			skip = skipFlag;
-			skipFlag = false;
-		}
-		if (!skip) {
-			if (node.type === NodeType.Element) {
-				// `<template>` children live in a separate content fragment, not in
-				// `children` — walk it first so template content is not skipped.
-				const tc = node.templateContent;
-				if (tc !== undefined) walk(tc, node);
-				const c = node.children;
-				for (let i = 0; i < c.length; i++) walk(c[i], node);
-			} else if (
-				node.type === NodeType.Document ||
-				node.type === NodeType.DocumentFragment
-			) {
-				const c = node.children;
-				for (let i = 0; i < c.length; i++) walk(c[i], node);
-			}
-			// All other types are leaves.
+	const exit = (node) => {
+		const b = visitors[_hTy[node]];
+		if (b === undefined) return;
+		_curNode = node;
+		const p = _hParent[node];
+		_curParent = p === 0 ? null : p;
+		const x = b.exit;
+		for (let i = 0; i < x.length; i++) x[i](A);
+	};
+	/**
+	 * First node to visit inside `node` (template content before children).
+	 * @param {HtmlNodeRef} node node
+	 * @returns {HtmlNodeRef} first inner node (0 = leaf)
+	 */
+	const firstInner = (node) => {
+		const ty = _hTy[node];
+		if (ty === NodeType.Element) {
+			const tc = _hTc[node];
+			return tc !== 0 ? tc : _hFirst[node];
 		}
-		if (b !== undefined) {
-			const x = b.exit;
-			for (let i = 0; i < x.length; i++) x[i](node, parent, visitorCtx);
+		if (ty === NodeType.Document || ty === NodeType.DocumentFragment) {
+			return _hFirst[node];
 		}
+		return 0;
 	};
 
-	walk(options.ast || buildHtmlAst(input, options.fragmentContext), null);
+	let node = root;
+	descend: for (;;) {
+		if (enter(node)) {
+			const inner = firstInner(node);
+			if (inner !== 0) {
+				node = inner;
+				continue;
+			}
+		}
+		// Leaf (or skipped): exit and move sideways / upwards.
+		for (;;) {
+			exit(node);
+			if (node === root) break descend;
+			const parent = _hParent[node];
+			// Out of a template's content fragment: the element's children follow.
+			if (_hTc[parent] === node) {
+				const first = _hFirst[parent];
+				if (first !== 0) {
+					node = first;
+					continue descend;
+				}
+			} else {
+				const sibling = _hNext[node];
+				if (sibling !== 0) {
+					node = sibling;
+					continue descend;
+				}
+			}
+			node = parent;
+		}
+	}
+
+	// The walk consumed the tree: release the side arrays' heap references so
+	// the reused columns don't pin this parse's strings until the next parse.
+	_hRelease();
 };
 
 /**
@@ -7354,10 +7772,10 @@ const grammar = (input, visitors, options) => {
  * `grammar`. Babel-style usage:
  *
  * ```
- * processor.use({ [NodeType.Element]: (el) => {}, [NodeType.Comment]: { enter, exit } });
+ * processor.use({ [NodeType.Element]: (path) => {}, [NodeType.Comment]: { enter, exit } });
  * processor.process(source);
  * ```
- * @extends {GenericSourceProcessor<HtmlVisitableNode, HtmlProcessOptions>}
+ * @extends {GenericSourceProcessor<HtmlPath, HtmlProcessOptions>}
  */
 class SourceProcessor extends GenericSourceProcessor {
 	constructor() {
@@ -7377,12 +7795,14 @@ const SMALL_LETTER_W = "w".charCodeAt(0);
 const SMALL_LETTER_X = "x".charCodeAt(0);
 const SMALL_LETTER_H = "h".charCodeAt(0);
 // (Don't use \s, to avoid matching non-breaking space)
+// Sticky so `collectCharacters` matches at an offset without slicing the
+// whole remaining input per call (which made srcset parsing quadratic).
 // eslint-disable-next-line no-control-regex
-const LEADING_SPACES_REGEXP = /^[ \t\n\r\u000C]+/;
+const LEADING_SPACES_REGEXP = /[ \t\n\r\u000C]+/y;
 // eslint-disable-next-line no-control-regex
-const LEADING_COMMAS_OR_SPACES_REGEXP = /^[, \t\n\r\u000C]+/;
+const LEADING_COMMAS_OR_SPACES_REGEXP = /[, \t\n\r\u000C]+/y;
 // eslint-disable-next-line no-control-regex
-const LEADING_NOT_SPACES = /^[^ \t\n\r\u000C]+/;
+const LEADING_NOT_SPACES = /[^ \t\n\r\u000C]+/y;
 const TRAILING_COMMAS_REGEXP = /[,]+$/;
 const NON_NEGATIVE_INTEGER_REGEXP = /^\d+$/;
 // ( Positive or negative or unsigned integers or decimals, without or without exponents.
@@ -7405,8 +7825,8 @@ const parseSrcset = (input) => {
 	let url;
 	/** @type {string[]} */
 	let descriptors;
-	/** @type {string} */
-	let currentDescriptor;
+	/** @type {number} */
+	let descriptorStart;
 	/** @type {string} */
 	let state;
 	/** @type {number} */
@@ -7420,16 +7840,15 @@ const parseSrcset = (input) => {
 	const candidates = [];
 
 	/**
-	 * @param {RegExp} regExp reg exp to collect characters
+	 * @param {RegExp} regExp sticky reg exp to collect characters
 	 * @returns {string | undefined} characters
 	 */
 	function collectCharacters(regExp) {
-		/** @type {string} */
-		let chars;
-		const match = regExp.exec(input.slice(Math.max(0, position)));
+		regExp.lastIndex = Math.max(0, position);
+		const match = regExp.exec(input);
 
 		if (match) {
-			[chars] = match;
+			const [chars] = match;
 			position += chars.length;
 
 			return chars;
@@ -7560,7 +7979,8 @@ const parseSrcset = (input) => {
 		collectCharacters(LEADING_SPACES_REGEXP);
 
 		// 8.2. Let current descriptor be the empty string.
-		currentDescriptor = "";
+		// (Tracked as a start offset, `-1` = empty; sliced once per descriptor.)
+		descriptorStart = -1;
 
 		// 8.3. Let state be in descriptor.
 		state = "in descriptor";
@@ -7582,9 +8002,9 @@ const parseSrcset = (input) => {
 				// descriptors and let current descriptor be the empty string.
 				// Set state to after descriptor.
 				if (isSpace(charCode)) {
-					if (currentDescriptor) {
-						descriptors.push(currentDescriptor);
-						currentDescriptor = "";
+					if (descriptorStart !== -1) {
+						descriptors.push(input.slice(descriptorStart, position));
+						descriptorStart = -1;
 						state = "after descriptor";
 					}
 				}
@@ -7595,8 +8015,8 @@ const parseSrcset = (input) => {
 				else if (charCode === COMMA) {
 					position += 1;
 
-					if (currentDescriptor) {
-						descriptors.push(currentDescriptor);
+					if (descriptorStart !== -1) {
+						descriptors.push(input.slice(descriptorStart, position - 1));
 					}
 
 					parseDescriptors();
@@ -7606,15 +8026,15 @@ const parseSrcset = (input) => {
 				// U+0028 LEFT PARENTHESIS (()
 				// Append charCode to current descriptor. Set state to in parens.
 				else if (charCode === LEFT_PARENTHESIS) {
-					currentDescriptor += input.charAt(position);
+					if (descriptorStart === -1) descriptorStart = position;
 					state = "in parens";
 				}
 				// EOF
 				// If current descriptor is not empty, append current descriptor to
 				// descriptors. Jump to the step labeled descriptor parser.
 				else if (Number.isNaN(charCode)) {
-					if (currentDescriptor) {
-						descriptors.push(currentDescriptor);
+					if (descriptorStart !== -1) {
+						descriptors.push(input.slice(descriptorStart, position));
 					}
 
 					parseDescriptors();
@@ -7623,8 +8043,8 @@ const parseSrcset = (input) => {
 
 					// Anything else
 					// Append charCode to current descriptor.
-				} else {
-					currentDescriptor += input.charAt(position);
+				} else if (descriptorStart === -1) {
+					descriptorStart = position;
 				}
 			}
 			// In parens
@@ -7632,22 +8052,18 @@ const parseSrcset = (input) => {
 				// U+0029 RIGHT PARENTHESIS ())
 				// Append charCode to current descriptor. Set state to in descriptor.
 				if (charCode === RIGHT_PARENTHESIS) {
-					currentDescriptor += input.charAt(position);
 					state = "in descriptor";
 				}
 				// EOF
 				// Append current descriptor to descriptors. Jump to the step labeled
 				// descriptor parser.
 				else if (Number.isNaN(charCode)) {
-					descriptors.push(currentDescriptor);
+					descriptors.push(input.slice(descriptorStart, position));
 					parseDescriptors();
 					return;
 				}
 				// Anything else
-				// Append charCode to current descriptor.
-				else {
-					currentDescriptor += input.charAt(position);
-				}
+				// Append charCode to current descriptor. (Covered by the tracked range.)
 			}
 			// After descriptor
 			else if (state === "after descriptor") {
@@ -7719,6 +8135,270 @@ const parseSrcset = (input) => {
 	}
 };
 
+// Babel's `path.skip()`, children-only: set by `A.skipChildren()` during an
+// `enter` dispatch, consumed by the walk.
+let _walkSkip = false;
+// The walk's current position (`A.node` / `A.parent` read these; module-level
+// so the accessor methods' defaults avoid self-referential `this` typing).
+/** @type {HtmlNodeRef} */
+let _curNode = 0;
+/** @type {HtmlNodeRef | null} */
+let _curParent = null;
+
+/* eslint-disable jsdoc/require-template -- `A` below is the accessor const, not a type parameter */
+/**
+ * The HTML path (Babel's `path` shape): the AST accessor with the walk's
+ * current position on it — the single argument every visitor receives.
+ * @typedef {typeof A} HtmlPath
+ */
+/* eslint-enable jsdoc/require-template */
+
+// AST field-access seam (mirrors the CSS parser's `A`): every AST field a
+// consumer reads goes through one of these accessors, so the node
+// representation can change underneath without touching consumers. `n` is an
+// `HtmlNodeRef`; results are valid until the next `buildHtmlAst` call.
+const A = {
+	// === path position (rebound by the walk before every visitor call) ===
+	/**
+	 * @returns {HtmlNodeRef} current node — only valid during a visitor callback
+	 */
+	get node() {
+		return _curNode;
+	},
+	/**
+	 * @returns {HtmlNodeRef | null} enclosing node (null = the document root)
+	 */
+	get parent() {
+		return _curParent;
+	},
+	/** Stop the walk descending into the current node (enter only). */
+	skipChildren() {
+		_walkSkip = true;
+	},
+	// === field reads — `n` defaults to the current node ===
+	/**
+	 * @param {HtmlNodeRef=} n node
+	 * @returns {number} `NodeType`
+	 */
+	type(n = _curNode) {
+		return _hTy[n];
+	},
+	/**
+	 * @param {HtmlNodeRef=} n node
+	 * @returns {number} start offset
+	 */
+	start(n = _curNode) {
+		return _hSt[n];
+	},
+	/**
+	 * @param {HtmlNodeRef=} n node
+	 * @returns {number} end offset
+	 */
+	end(n = _curNode) {
+		return _hEn[n];
+	},
+	/**
+	 * @param {HtmlElement=} n element
+	 * @returns {string} lowercased (foreign-content: adjusted) tag name
+	 */
+	tagName(n = _curNode) {
+		return _hStr[n];
+	},
+	/**
+	 * @param {HtmlElement=} n element
+	 * @returns {number} `NS_*` namespace
+	 */
+	namespace(n = _curNode) {
+		return _hFl[n] & NS_MASK;
+	},
+	/**
+	 * @param {HtmlElement=} n element
+	 * @returns {boolean} true for void elements
+	 */
+	selfClosing(n = _curNode) {
+		return (_hFl[n] & FLAG_SELF_CLOSING) !== 0;
+	},
+	// materialized attribute list — test/tooling convenience, allocates; the
+	// parser reads attributes through the scalar accessors below
+	/**
+	 * @param {HtmlElement=} n element
+	 * @returns {HtmlAttribute[]} materialized attributes
+	 */
+	attributes(n = _curNode) {
+		const out = [];
+		const start = _hAStart[n];
+		for (let i = start; i < start + _hACount[n]; i++) {
+			out.push({
+				name: _aName[i],
+				value: _aValueOf(i),
+				serializedName: _aSerializedName(i),
+				nameStart: _aNameStart[i],
+				nameEnd: _aNameEnd[i],
+				valueStart: _aValStart[i],
+				valueEnd: _aValEnd[i]
+			});
+		}
+		return out;
+	},
+	/**
+	 * @param {HtmlElement=} n element
+	 * @returns {number} attribute count
+	 */
+	attributeCount(n = _curNode) {
+		return _hACount[n];
+	},
+	/**
+	 * The i-th attribute of an element, as an id for the `attribute*` reads.
+	 * @param {number} i attribute index
+	 * @param {HtmlElement=} n element
+	 * @returns {HtmlAttributeRef} attribute ref
+	 */
+	attributeAt(i, n = _curNode) {
+		return _hAStart[n] + i;
+	},
+	/**
+	 * Linear lookup by (lowercased) name.
+	 * @param {string} name attribute name
+	 * @param {HtmlElement=} n element
+	 * @returns {HtmlAttributeRef} attribute ref (0 = not present)
+	 */
+	findAttribute(name, n = _curNode) {
+		return _aFind(_hAStart[n], _hACount[n], name);
+	},
+	/**
+	 * @param {HtmlAttributeRef} a attribute ref
+	 * @returns {string} lowercased (foreign-content: adjusted) attribute name
+	 */
+	attributeName(a) {
+		return _aName[a];
+	},
+	/**
+	 * @param {HtmlAttributeRef} a attribute ref
+	 * @returns {string} raw (undecoded) attribute value ("" when valueless)
+	 */
+	attributeValue(a) {
+		return _aValueOf(a);
+	},
+	/**
+	 * @param {HtmlAttributeRef} a attribute ref
+	 * @returns {number} name start offset
+	 */
+	attributeNameStart(a) {
+		return _aNameStart[a];
+	},
+	/**
+	 * @param {HtmlAttributeRef} a attribute ref
+	 * @returns {number} name end offset
+	 */
+	attributeNameEnd(a) {
+		return _aNameEnd[a];
+	},
+	/**
+	 * @param {HtmlAttributeRef} a attribute ref
+	 * @returns {number} value start offset (-1 when valueless or on adoption-agency clones)
+	 */
+	attributeValueStart(a) {
+		return _aValStart[a];
+	},
+	/**
+	 * @param {HtmlAttributeRef} a attribute ref
+	 * @returns {number} value end offset
+	 */
+	attributeValueEnd(a) {
+		return _aValEnd[a];
+	},
+	/**
+	 * @param {HtmlElement=} n element
+	 * @returns {number} end offset of the opening tag (after `>`)
+	 */
+	tagEnd(n = _curNode) {
+		return _hTagEnd[n];
+	},
+	/**
+	 * @param {HtmlElement=} n element
+	 * @returns {number} end offset of the tag name
+	 */
+	nameEnd(n = _curNode) {
+		return _hNameEnd[n];
+	},
+	/**
+	 * @param {HtmlElement=} n element
+	 * @returns {number} under `skip.text`, end offset of a raw-text element's body (`tagEnd` when empty)
+	 */
+	contentEnd(n = _curNode) {
+		return _hCEnd[n];
+	},
+	/**
+	 * @param {HtmlElement=} n element
+	 * @returns {HtmlDocumentFragment} `<template>` content fragment (0 = none)
+	 */
+	templateContent(n = _curNode) {
+		return _hTc[n];
+	},
+	/**
+	 * @param {HtmlText | HtmlComment=} n text / comment node
+	 * @returns {string} decoded text / comment data
+	 */
+	data(n = _curNode) {
+		return _hStr[n];
+	},
+	/**
+	 * @param {HtmlDoctype=} n doctype node
+	 * @returns {string} doctype name
+	 */
+	doctypeName(n = _curNode) {
+		return _hStr[n];
+	},
+	// The doctype ids are per-parse scalars (a document has at most one
+	// doctype node); the node parameter is accepted for call-shape uniformity.
+	/**
+	 * @param {HtmlDoctype=} _n doctype node
+	 * @returns {string | null} doctype public id
+	 */
+	doctypePublicId(_n) {
+		return _hDocPub;
+	},
+	/**
+	 * @param {HtmlDoctype=} _n doctype node
+	 * @returns {string | null} doctype system id
+	 */
+	doctypeSystemId(_n) {
+		return _hDocSys;
+	},
+	// === tree links (0 = none) ===
+	/**
+	 * @param {HtmlNodeRef=} n node
+	 * @returns {HtmlNodeRef} first child
+	 */
+	firstChild(n = _curNode) {
+		return _hFirst[n];
+	},
+	/**
+	 * @param {HtmlNodeRef=} n node
+	 * @returns {HtmlNodeRef} next sibling
+	 */
+	nextSibling(n = _curNode) {
+		return _hNext[n];
+	},
+	/**
+	 * @param {HtmlNodeRef=} n node
+	 * @returns {HtmlNodeRef} parent node (a `<template>`'s content links to its fragment)
+	 */
+	parentOf(n = _curNode) {
+		return _hParent[n];
+	},
+	/**
+	 * @param {HtmlNodeRef=} n node
+	 * @returns {HtmlNodeRef[]} materialized child list — test/tooling convenience, allocates
+	 */
+	children(n = _curNode) {
+		const out = [];
+		for (let c = _hFirst[n]; c !== 0; c = _hNext[c]) out.push(c);
+		return out;
+	}
+};
+
+module.exports.A = A;
 module.exports.NS_HTML = NS_HTML;
 module.exports.NS_MATHML = NS_MATHML;
 module.exports.NS_SVG = NS_SVG;
@@ -7733,6 +8413,5 @@ module.exports.SourceProcessor = SourceProcessor;
 module.exports.buildHtmlAst = buildHtmlAst;
 module.exports.decodeHtmlEntities = decodeHtmlEntities;
 module.exports.decodeHtmlEntitiesWithMap = decodeHtmlEntitiesWithMap;
-module.exports.findAttr = findAttr;
 module.exports.parseSrcset = parseSrcset;
 module.exports.walkHtmlTokens = walkHtmlTokens;