Make HTML5 parser not crash in AAA on cnn.com

content/html/parser/src/nsHtml5AttributeName.h

@@ -55,6 +55,7 @@ class nsHtml5StackNode;
 class nsHtml5UTF16Buffer;
 class nsHtml5Portability;
 
+
 class nsHtml5AttributeName
 {
   private:

content/html/parser/src/nsHtml5ElementName.h

@@ -55,6 +55,7 @@ class nsHtml5StackNode;
 class nsHtml5UTF16Buffer;
 class nsHtml5Portability;
 
+
 class nsHtml5ElementName
 {
   public:

content/html/parser/src/nsHtml5HtmlAttributes.h

@@ -56,6 +56,7 @@ class nsHtml5StackNode;
 class nsHtml5UTF16Buffer;
 class nsHtml5Portability;
 
+
 class nsHtml5HtmlAttributes
 {
   public:

content/html/parser/src/nsHtml5MetaScanner.h

@@ -56,6 +56,7 @@ class nsHtml5StackNode;
 class nsHtml5UTF16Buffer;
 class nsHtml5Portability;
 
+
 class nsHtml5MetaScanner
 {
   private:

content/html/parser/src/nsHtml5Portability.h

@@ -55,6 +55,7 @@ class nsHtml5HtmlAttributes;
 class nsHtml5StackNode;
 class nsHtml5UTF16Buffer;
 
+
 class nsHtml5Portability
 {
   public:

content/html/parser/src/nsHtml5StackNode.h

@@ -56,6 +56,7 @@ class nsHtml5HtmlAttributes;
 class nsHtml5UTF16Buffer;
 class nsHtml5Portability;
 
+
 class nsHtml5StackNode
 {
   public:

content/html/parser/src/nsHtml5Tokenizer.h

@@ -58,6 +58,7 @@ class nsHtml5StackNode;
 class nsHtml5UTF16Buffer;
 class nsHtml5Portability;
 
+
 class nsHtml5Tokenizer
 {
   private:

content/html/parser/src/nsHtml5TreeBuilder.cpp

@@ -3236,6 +3236,8 @@ nsHtml5TreeBuilder::reconstructTheActiveFormattingElements()
     }
     push(entryClone);
     listOfActiveFormattingElements[entryPos] = entryClone;
+    entry->release();
+    entryClone->retain();
   }
 }
 

content/html/parser/src/nsHtml5UTF16Buffer.h

@@ -55,6 +55,7 @@ class nsHtml5HtmlAttributes;
 class nsHtml5StackNode;
 class nsHtml5Portability;
 
+
 class nsHtml5UTF16Buffer
 {
   private: