[tifroz]

Summary

Building the content-blocker injection script for large CSS payloads is slow on Android during navigation. For 957 KB of CSS on a physical Samsung SM-S721U, the median script-building time dropped from 1,003 ms to 41 ms, a 24.5× speedup.

Use org.json.JSONObject.quote(css) directly on Android to avoid Skip JSONSerialization's per-character UTF-8 allocations. CSS content and injection guards remain unchanged. The Apple implementation and public APIs are unchanged.

Testing

• Nine targeted Android instrumentation tests passed on the physical Samsung phone, with no failures or skips.
• New coverage in Tests/SkipWebTests/AndroidCSSInjectionTests.swift checks escaping, Unicode, control characters, trimming and joining, empty input, and real WebView execution. The WebView test confirms unchanged CSS text, no script escape, and successful element hiding.
• Existing coverage in Tests/SkipWebTests/WebContentBlockerTests.swift checks domain, URL, and frame guards.
• Benchmark measured the complete script-building call with 957,353 bytes of CSS and 8,192 rules, using five warm-up calls and 15 measured calls per run.
• PR preparation verified the saved test log and matching production-source checksum. The branch was already current with upstream/main; no source changes or test reruns were needed during preparation. git diff --check passed.

Risks / Limitations

The benchmark covers script construction on one physical Android device using a debug instrumentation build. It does not measure total navigation time. The real WebView test requires an Android device or emulator and skips under Robolectric.