From 26137abbdf70a26b2ec65fa5cc76c6b88af4ffd7 Mon Sep 17 00:00:00 2001
From: martincostello <martin@martincostello.com>
Date: Fri, 25 Sep 2026 11:42:39 +0100
Subject: [PATCH 1/2] [perf] Cache validated W3C tracestate per-thread

`ValidateTraceState` re-parses and rebuilds the `tracestate` value on every call, even when `Activity.TraceStateString` is typically set once for the lifetime of a span and its children. A single incoming request that fanned out to several outgoing calls would redo the same work work for each.

Adds a last-(input,output)-pair cache to skip re-parsing when the value hasn't changed since the last call on the same thread.
---
 .../src/System/Diagnostics/W3CPropagator.cs   | 22 +++++++++++++++++++
 1 file changed, 22 insertions(+)

diff --git a/src/libraries/System.Diagnostics.DiagnosticSource/src/System/Diagnostics/W3CPropagator.cs b/src/libraries/System.Diagnostics.DiagnosticSource/src/System/Diagnostics/W3CPropagator.cs
index c02c575bbce010..ea44efdda4cf81 100644
--- a/src/libraries/System.Diagnostics.DiagnosticSource/src/System/Diagnostics/W3CPropagator.cs
+++ b/src/libraries/System.Diagnostics.DiagnosticSource/src/System/Diagnostics/W3CPropagator.cs
@@ -152,6 +152,15 @@ internal static bool TryExtractBaggage(string? baggageString, out IEnumerable<Ke
         // value       = 0*255(chr) nblk-chr
         // nblk-chr    = %x21-2B / %x2D-3C / %x3E-7E
         // chr         = %x20 / nblk-chr
+        // A single incoming request commonly fans out to several outgoing calls that
+        // all inject the same (unmodified) Activity.TraceStateString (see InjectTraceState),
+        // typically all from the same thread for a given request. Cache the last
+        // (input, output) pair per thread to skip re-parsing and rebuilding it every time.
+        [ThreadStatic]
+        private static string? t_lastRawTraceState;
+        [ThreadStatic]
+        private static string? t_lastValidatedTraceState;
+
         internal static string? ValidateTraceState(string? traceState)
         {
             if (string.IsNullOrEmpty(traceState))
@@ -159,6 +168,19 @@ internal static bool TryExtractBaggage(string? baggageString, out IEnumerable<Ke
                 return null;
             }
 
+            if (ReferenceEquals(traceState, t_lastRawTraceState))
+            {
+                return t_lastValidatedTraceState;
+            }
+
+            string? validated = ValidateTraceStateCore(traceState);
+            t_lastRawTraceState = traceState;
+            t_lastValidatedTraceState = validated;
+            return validated;
+        }
+
+        private static string? ValidateTraceStateCore(string traceState)
+        {
             int entries = 0;
             using ValueStringBuilder vsb = new ValueStringBuilder(stackalloc char[Math.Min(traceState.Length, MaxTraceStateEncodedLength)]);
 

From 239ee3890287a155d554bfd9f2e0233270ec86bb Mon Sep 17 00:00:00 2001
From: martincostello <martin@martincostello.com>
Date: Fri, 25 Sep 2026 12:25:16 +0100
Subject: [PATCH 2/2] Address feedback

Do not cache values larger than the maximum allowed length.
---
 .../src/System/Diagnostics/W3CPropagator.cs              | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/src/libraries/System.Diagnostics.DiagnosticSource/src/System/Diagnostics/W3CPropagator.cs b/src/libraries/System.Diagnostics.DiagnosticSource/src/System/Diagnostics/W3CPropagator.cs
index ea44efdda4cf81..0b074539f1cd56 100644
--- a/src/libraries/System.Diagnostics.DiagnosticSource/src/System/Diagnostics/W3CPropagator.cs
+++ b/src/libraries/System.Diagnostics.DiagnosticSource/src/System/Diagnostics/W3CPropagator.cs
@@ -168,6 +168,15 @@ internal static bool TryExtractBaggage(string? baggageString, out IEnumerable<Ke
                 return null;
             }
 
+            // ValidateTraceState also runs on the raw carrier value from an incoming (untrusted)
+            // request, via ExtractTraceIdAndState. Don't let an arbitrarily large or malformed
+            // value get rooted in per-thread state for the thread's lifetime just because it was
+            // seen once - only cache inputs already within a valid tracestate's own size limit.
+            if (traceState.Length > MaxTraceStateEncodedLength)
+            {
+                return ValidateTraceStateCore(traceState);
+            }
+
             if (ReferenceEquals(traceState, t_lastRawTraceState))
             {
                 return t_lastValidatedTraceState;