--- a/parser/html/nsHtml5SpeculativeLoad.cpp
+++ b/parser/html/nsHtml5SpeculativeLoad.cpp
@@ -10,23 +10,27 @@ nsHtml5SpeculativeLoad::nsHtml5Speculati
   :
 #ifdef DEBUG
   mOpCode(eSpeculativeLoadUninitialized),
 #endif
   mIsAsync(false),
   mIsDefer(false)
 {
   MOZ_COUNT_CTOR(nsHtml5SpeculativeLoad);
+  new(&mCharsetOrSrcset) nsString;
 }
 
 nsHtml5SpeculativeLoad::~nsHtml5SpeculativeLoad()
 {
   MOZ_COUNT_DTOR(nsHtml5SpeculativeLoad);
   NS_ASSERTION(mOpCode != eSpeculativeLoadUninitialized,
                "Uninitialized speculative load.");
+  if (mOpCode != eSpeculativeLoadSetDocumentCharset) {
+    mCharsetOrSrcset.~nsString();
+  }
 }
 
 void
 nsHtml5SpeculativeLoad::Perform(nsHtml5TreeOpExecutor* aExecutor)
 {
   switch (mOpCode) {
     case eSpeculativeLoadBase:
       aExecutor->SetSpeculationBase(mUrlOrSizes);
@@ -68,22 +72,20 @@ nsHtml5SpeculativeLoad::Perform(nsHtml5T
     case eSpeculativeLoadStyle:
       aExecutor->PreloadStyle(mUrlOrSizes, mCharsetOrSrcset, mCrossOriginOrMedia, mReferrerPolicyOrIntegrity,
                               mTypeOrCharsetSourceOrDocumentModeOrMetaCSPOrSizesOrIntegrity);
       break;
     case eSpeculativeLoadManifest:  
       aExecutor->ProcessOfflineManifest(mUrlOrSizes);
       break;
     case eSpeculativeLoadSetDocumentCharset: {
-        nsAutoCString narrowName;
-        CopyUTF16toUTF8(mCharsetOrSrcset, narrowName);
         NS_ASSERTION(mTypeOrCharsetSourceOrDocumentModeOrMetaCSPOrSizesOrIntegrity.Length() == 1,
             "Unexpected charset source string");
         int32_t intSource = (int32_t)mTypeOrCharsetSourceOrDocumentModeOrMetaCSPOrSizesOrIntegrity.First();
-        aExecutor->SetDocumentCharsetAndSource(Encoding::ForName(narrowName),
+        aExecutor->SetDocumentCharsetAndSource(WrapNotNull(mEncoding),
                                                intSource);
       }
       break;
     case eSpeculativeLoadSetDocumentMode: {
         NS_ASSERTION(mTypeOrCharsetSourceOrDocumentModeOrMetaCSPOrSizesOrIntegrity.Length() == 1,
             "Unexpected document mode string");
         nsHtml5DocumentMode mode =
             (nsHtml5DocumentMode)mTypeOrCharsetSourceOrDocumentModeOrMetaCSPOrSizesOrIntegrity.First();

--- a/parser/html/nsHtml5SpeculativeLoad.h
+++ b/parser/html/nsHtml5SpeculativeLoad.h
@@ -26,16 +26,18 @@ enum eHtml5SpeculativeLoad {
   eSpeculativeLoadStyle,
   eSpeculativeLoadManifest,
   eSpeculativeLoadSetDocumentCharset,
   eSpeculativeLoadSetDocumentMode,
   eSpeculativeLoadPreconnect
 };
 
 class nsHtml5SpeculativeLoad {
+    using Encoding = mozilla::Encoding;
+    template <typename T> using NotNull = mozilla::NotNull<T>;
   public:
     nsHtml5SpeculativeLoad();
     ~nsHtml5SpeculativeLoad();
 
     inline void InitBase(nsHtml5String aUrl)
     {
       NS_PRECONDITION(mOpCode == eSpeculativeLoadUninitialized,
                       "Trying to reinitialize a speculative load!");
@@ -185,23 +187,24 @@ class nsHtml5SpeculativeLoad {
      * is set via this operation, we are committed to it unless chardet or
      * a late meta cause a reload. The reason why a parser
      * thread-discovered charset gets communicated via the speculative load
      * queue as opposed to tree operation queue is that the charset change
      * must get processed before any actual speculative loads such as style
      * sheets. Thus, encoding decisions by the parser thread have to maintain
      * the queue order relative to true speculative loads. See bug 675499.
      */
-    inline void InitSetDocumentCharset(nsACString& aCharset,
+    inline void InitSetDocumentCharset(NotNull<const Encoding*> aEncoding,
                                        int32_t aCharsetSource)
     {
       NS_PRECONDITION(mOpCode == eSpeculativeLoadUninitialized,
                       "Trying to reinitialize a speculative load!");
       mOpCode = eSpeculativeLoadSetDocumentCharset;
-      CopyUTF8toUTF16(aCharset, mCharsetOrSrcset);
+      mCharsetOrSrcset.~nsString();
+      mEncoding = aEncoding;
       mTypeOrCharsetSourceOrDocumentModeOrMetaCSPOrSizesOrIntegrity.Assign((char16_t)aCharsetSource);
     }
 
     /**
      * Speculative document mode setting isn't really speculative. Once it
      * happens, we are committed to it. However, this information needs to
      * travel in the speculation queue in order to have this information
      * available before parsing the speculatively loaded style sheets.
@@ -252,17 +255,20 @@ class nsHtml5SpeculativeLoad {
     /**
      * If mOpCode is eSpeculativeLoadStyle or eSpeculativeLoadScript[FromHead]
      * then this is the value of the "charset" attribute. For
      * eSpeculativeLoadSetDocumentCharset it is the charset that the
      * document's charset is being set to. If mOpCode is eSpeculativeLoadImage
      * or eSpeculativeLoadPictureSource, this is the value of the "srcset" attribute.
      * If the attribute is not set, this will be a void string. Otherwise it's empty.
      */
-    nsString mCharsetOrSrcset;
+    union {
+      nsString mCharsetOrSrcset;
+      const Encoding* mEncoding;
+    };
     /**
      * If mOpCode is eSpeculativeLoadSetDocumentCharset, this is a
      * one-character string whose single character's code point is to be
      * interpreted as a charset source integer. If mOpCode is
      * eSpeculativeLoadSetDocumentMode, this is a one-character string whose
      * single character's code point is to be interpreted as an
      * nsHtml5DocumentMode. If mOpCode is eSpeculativeLoadCSP, this is a meta
      * element's CSP value. If mOpCode is eSpeculativeLoadImage, this is the

--- a/parser/html/nsHtml5TreeBuilderCppSupplement.h
+++ b/parser/html/nsHtml5TreeBuilderCppSupplement.h
@@ -1192,20 +1192,18 @@ nsHtml5TreeBuilder::FlushLoads()
 
 void
 nsHtml5TreeBuilder::SetDocumentCharset(NotNull<const Encoding*> aEncoding,
                                        int32_t aCharsetSource)
 {
   if (mBuilder) {
     mBuilder->SetDocumentCharsetAndSource(aEncoding, aCharsetSource);
   } else if (mSpeculativeLoadStage) {
-    nsAutoCString charset;
-    aEncoding->Name(charset);
     mSpeculativeLoadQueue.AppendElement()->InitSetDocumentCharset(
-      charset, aCharsetSource);
+      aEncoding, aCharsetSource);
   } else {
     mOpQueue.AppendElement()->Init(
       eTreeOpSetDocumentCharset, aEncoding, aCharsetSource);
   }
 }
 
 void
 nsHtml5TreeBuilder::StreamEnded()