LibWeb: Avoid assertion failure on parsing numeric character references

Tests/LibWeb/TestHTMLTokenizer.cpp

@@ -166,7 +166,7 @@ TEST_CASE(multiple_attributes)
 
 TEST_CASE(character_reference_in_attribute)
 {
-    auto tokens = run_tokenizer("<p foo=a&amp;b bar='a&amp;b' baz=\"a&amp;b\">");
+    auto tokens = run_tokenizer("<p foo=a&amp;b bar='a&#38;b' baz=\"a&#x26;b\">");
     BEGIN_ENUMERATION(tokens);
     EXPECT_START_TAG_TOKEN(p);
     EXPECT_TAG_TOKEN_ATTRIBUTE_COUNT(3);

Userland/Libraries/LibWeb/HTML/Parser/HTMLTokenizer.cpp

@@ -1554,7 +1554,7 @@ _StartOfFunction:
                 ON('#')
                 {
                     m_temporary_buffer.append(current_input_character.value());
-                    SWITCH_TO(NumericCharacterReference);
+                    SWITCH_TO_WITH_UNCLEAN_BUILDER(NumericCharacterReference);
                 }
                 ANYTHING_ELSE
                 {
@@ -1630,12 +1630,12 @@ _StartOfFunction:
                 ON('X')
                 {
                     m_temporary_buffer.append(current_input_character.value());
-                    SWITCH_TO(HexadecimalCharacterReferenceStart);
+                    SWITCH_TO_WITH_UNCLEAN_BUILDER(HexadecimalCharacterReferenceStart);
                 }
                 ON('x')
                 {
                     m_temporary_buffer.append(current_input_character.value());
-                    SWITCH_TO(HexadecimalCharacterReferenceStart);
+                    SWITCH_TO_WITH_UNCLEAN_BUILDER(HexadecimalCharacterReferenceStart);
                 }
                 ANYTHING_ELSE
                 {
@@ -1696,7 +1696,7 @@ _StartOfFunction:
                 }
                 ON(';')
                 {
-                    SWITCH_TO(NumericCharacterReferenceEnd);
+                    SWITCH_TO_WITH_UNCLEAN_BUILDER(NumericCharacterReferenceEnd);
                 }
                 ANYTHING_ELSE
                 {
@@ -1716,7 +1716,7 @@ _StartOfFunction:
                 }
                 ON(';')
                 {
-                    SWITCH_TO(NumericCharacterReferenceEnd);
+                    SWITCH_TO_WITH_UNCLEAN_BUILDER(NumericCharacterReferenceEnd);
                 }
                 ANYTHING_ELSE
                 {