This appears to be caused by ElementAttributeData::setAttributes() which does m_attributes.resize() before cloning attributes one by one. The resize() fills the attribute vector with default-constructed objects (incurring hash lookups for QualifiedNames and whatnot.)
Created attachment 138308 [details] Patch
Comment on attachment 138308 [details] Patch r=me
Comment on attachment 138308 [details] Patch Clearing flags on attachment: 138308 Committed r114879: <http://trac.webkit.org/changeset/114879>
All reviewed patches have been landed. Closing bug.