I caused this regression recently and Hyatt and I discussed a fix.
Created attachment 28482 [details] work in progress -- missing ChangeLog but otherwise may be ready to go
Just an FYI: On one of the Chrome performance tests, I found this to be about a 3-4% regression. That test has about 700 assignments to innerHTML over the course of 56 pages.
Created attachment 28507 [details] patch
Given their interest in this bug, I'm hoping that Dave Hyatt or Darin Fisher will review the patch. This is the fix I discussed with Hyatt.
I could make the AppendMarkupState thing a bit more elegant by making that "state" object into a class, with the appendMarkup function a member function.
Created attachment 28578 [details] improved patch
Comment on attachment 28578 [details] improved patch r=me
http://trac.webkit.org/changeset/41791