mirror of
https://github.com/block/buzz.git
synced 2026-11-14 13:21:02 +00:00
11ea8c928e
Every avatar build checks its URL: `parseAnimatedAvatarUrl` scans for the `#buzz-anim=` fragment and parses both halves, and `usesInsetAgentArtwork` also runs `Uri.tryParse` and a regex. For an ordinary URL that's a few microseconds. Some profile pictures are `data:image/png;base64,...` URLs, though, and those cost about 0.7 ms per check for 100 KB on a Mac, because the fragment search and `Uri` normalization read the whole string. Channel screens, the native navigation bar payload and the DM header portrait run these checks on every build, so a channel with such members pays for them frame after frame. Both functions can only answer yes for an HTTP(S) URL, so they now first look at the first six characters and return early unless the URL starts with `http:` or `https:` (in any case). A data URL is turned away without reading the rest of it. The authority is still checked by `Uri` as before, which also accepts backslashes there (`https:\\host`). ### Validation Added test pinning the answers this check must keep: an `https://` preset poster is inset artwork in any case and with backslash authorities (`https:\\`, `https:/\`, `https:\/`), while `http://`, a leading space, a data URL, an empty string and null are not; an animated avatar URL still is. Existing animated avatar tests (including a data-URL poster with a `#buzz-anim=` fragment) pass; full mobile test suite and `flutter analyze` pass. On an iPhone 12 mini signed in to Block's Builderlab (instrumented profile build), opening a channel whose members include two data-URL avatars (100 KB and 150 KB): over the first 7 seconds, the CPU profile spent 69 ms in these checks before this change and none with it (0 of 647 samples). ### Regressions None expected. Every URL the new check turns away already got the same answer before: `_isHttpUrl` and the preset check both need scheme `http` or `https`, which `Uri` only reports for a string that starts with `http:` or `https:` (it lowercases the scheme, so case doesn't matter, and a leading space already parsed to no scheme). Reviewers compared the old and new functions on several thousand generated URLs (case, whitespace, IDN, punycode, backslash forms) and found no differences. --------- Signed-off-by: Tom Brow <tomb@squareup.com> Co-authored-by: Tom Brow <tomb@squareup.com> Co-authored-by: studio <dc2fc481343672df31a689840c09299972e704dac592e0da6f18486646a7ee3e@buzz.block.builderlab.xyz>