Source map consumer: Decode VLQ mappings in a single pass

[robhogan]

MappingsConsumer decoded a map by slicing each segment out as a string, decoding it with vlq through a Map cache, and spreading a generator into an array:

metro/packages/metro-source-map/src/Consumer/MappingsConsumer.js

Lines 127 to 133 in b7c2055

	const mappingRaw = mappingsRaw.slice(i, next);
	let decodedVlqValues;
	if (vlqCache.has(mappingRaw)) {
	decodedVlqValues = vlqCache.get(mappingRaw);
	} else {
	decodedVlqValues = decodeVlq(mappingRaw);
	vlqCache.set(mappingRaw, decodedVlqValues);

This decodes base64 VLQ in place from character codes, in one pass. Output is unchanged, including the errors for malformed segments, and vlq is dropped from metro-source-map's dependencies.

composeSourceMaps is 1.63x faster than #1978 (95% CI 1.62-1.64x) and 1.89x faster than main (1,801ms -> 1,107ms on our benchmark app), with 16% less memory (1,069MB -> 898MB) and identical output.

Benchmark

AI-driven.

	Time (median)	vs previous	vs main	Composition memory	vs previous	vs main	Peak RSS
main	2,088ms (2,082 to 2,094)			1,070MB (1,070 to 1,070)			1,664MB
#1978	1,801ms (1,794 to 1,806)		-13.6% (-13.8 to -13.3)	1,069MB (1,069 to 1,069)		-0.1% (-0.2 to -0.1)	1,663MB
This PR	1,107ms (1,099 to 1,111)	-38.6% (-38.9 to -38.3)	-47.1% (-47.4 to -46.7)	898MB (897 to 899)	-16.0% (-16.1 to -15.8)	-15.9% (-16.1 to -15.6)	1,492MB

Changelog

 - **[Performance]**: Decode source maps in one pass in `metro-source-map`'s `Consumer`

Test plan

New tests for multi-digit and negative deltas, empty segments and lines, and malformed segments. They pass on main too.

Benchmark (AI-driven): Mattermost Mobile 2.45.0 (React Native 0.83.9, Metro 0.83.7), iOS release bundle, unminified: 7,086 sources, 52.6MB bundle, 82.4MB flat source map. Composed with its hermesc -O -output-source-map map (hermes-compiler 0.14.1, 10.7MB, 1.84M segments). Timings are composeSourceMaps alone, excluding JSON parsing, over 105 rounds on Node 22.13.1 on an M5 Pro. Each round runs main, every PR in this stack and a memory baseline, in a shuffled order. Figures are medians with 95% bootstrap confidence intervals, for changes of the per-round paired ratio. Composition memory is peak RSS less that of the same process parsing both maps without composing them (594MB).

[Copilot]

Copilot review overview

🟡 Changes recommended

The decoder has unresolved correctness and malformed-input compatibility issues.

Review effort: Lite
Findings: 1

Open (1)

• Use unsigned shift for full-range VLQ zig-zag decoding · New

What changed in this PR

Optimizes source-map VLQ decoding with a single-pass inline decoder and removes the direct vlq dependency.

Changes:

• Replaces per-segment decoding with in-place character-code parsing.
• Adds coverage for complex and malformed mappings.
• Removes vlq from metro-source-map dependencies.

File	Summary	Findings
packages/​metro-source-map/​src/​Consumer/​MappingsConsumer.js	Implements single-pass VLQ decoding.	Critical unsigned-shift compatibility issue; truncated fields may be silently accepted; malformed-input error text changes.
packages/​metro-source-map/​src/​__tests__/​Consumer-test.js	Adds decoding and malformed-input tests.	No findings.
packages/​metro-source-map/​package.json	Removes the obsolete dependency.	No findings.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[robhogan]

This is safe to merge without Meta import because even though we're dropping a dependency here, metro-symbolicate has the same vlq dependency, so no lockfile change.

(This code snippet makes it look like we're dropping two deps - we're not, source-map just loses the trailing comma)

[Copilot]

Copilot review overview

🔵 Needs a closer look

One or more issues must be addressed before approval.

Review effort: Lite
Findings: None

Resolved since last review (1)

• Use unsigned shift for full-range VLQ zig-zag decoding