Avalonia

Commit Graph

Author	SHA1	Message	Date
Benedikt Stebner	eeb9e36a05	[Text] Glyph Outline Part 1/13 - Utility types for glyph outline support (#21405 ) * Harden cmap/name/post parsing against malformed fonts Fonts are untrusted input, but several pre-existing table parsers throw out of the GlyphTypeface constructor on hostile data, denying the whole font instead of degrading the affected (cosmetic) table. - name: wrap NameTable.Load in try/catch so a malformed table falls back to a default family name (same outcome as an absent name), and bounds-check NameRecord.GetValue's (offset,length) slice — the record array is validated at load but each record's storage slice is read later during construction. - post: wrap PostTable.Load so a malformed cosmetic-hint table degrades to defaults rather than denying the font. - cmap format 12/13: clamp the declared length and group count to the buffer, computing the group span in long to avoid the nGroups12 int overflow a hostile count would wrap to a negative slice length. - cmap format 4 selection: score a Windows Symbol subtable worse than any Unicode subtable so ASCII resolves regardless of subtable order, while a Symbol-only font still selects its only subtable. maxp/cmap remain fatal by design. Behavioural hardening only; public API unchanged. Backportable independently of the glyph-outline stack. Clamp cmap range contents and harden binary reader primitives Format 12/13 group contents are attacker-controlled: TryGetRange used to hand the raw uint32 end straight to per-codepoint consumers, so a group with endCharCode 0x7FFFFFFF turned range enumeration into an unbounded (for int.MaxValue, non-terminating) loop. Clamp ranges to the Unicode range and map inverted/out-of-range groups to empty ranges so later groups still enumerate. Give the format 4 constructor the same treatment its format 12 sibling already received: clamp the declared length and segment count to what the buffer actually holds instead of slicing unchecked (debug asserts replaced by the clamps). In BigEndianBinaryReader, bounds-check array reads before allocating (a hostile length is rejected instead of attempting the allocation), make EnsureAvailable overflow-proof, and clamp ReadBytes against negative counts. * Add font parsing infrastructure for glyph outline/color drawing Introduces shared utility types that subsequent PRs will use to implement GetGlyphOutline (glyf table) and GetGlyphDrawing (COLR v0/v1) on GlyphTypeface: - ObjectPool<T>: thread-safe object pool used by Decyclers - Decycler<T> / CycleGuard<T> / DecyclerException: generic cycle-detection and depth-limiting utility for recursive font-table traversal (composite glyphs, paint graphs) - FontVariationSettings: parameter type for the upcoming GetGlyphOutline / GetGlyphDrawing overloads - IGlyphDrawing / GlyphDrawingType: return-type contract for color glyph drawings (outline, color layers, SVG, bitmap) - CharacterToGlyphMapDictionary: lightweight, allocation-free IReadOnlyDictionary<int, ushort> view over the cmap, plus CharacterToGlyphMap.AsReadOnlyDictionary() to expose it No behavior change; types are not yet consumed in this PR. * Apply suggestions from code review Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> * Validate ObjectPool maxSize and add unit tests The ObjectPool<T> constructor previously accepted any maxSize value. A value of 0 or below silently caused every Return to be discarded, which is hard to diagnose at the call site. - Reject maxSize < 1 with ArgumentOutOfRangeException at construction. - Document the new precondition in the XML comment. - Add ObjectPoolTests covering: factory null guard, maxSize bounds, Rent/Return basics, Return ignoring null, max-size enforcement, validator invocation and rejection, validator-as-reset, plus concurrent stress tests for cap enforcement and parallel use. * Validate Decycler maxDepth and add unit tests The Decycler<T> constructor previously accepted any maxDepth value. A value of 0 or below made the very first Enter throw DepthLimitExceeded, which presents as a cycle/depth error at use time instead of pointing at the construction site. - Reject maxDepth < 1 with ArgumentOutOfRangeException at construction. - Document the new precondition in the XML comment. - Add DecyclerTests covering: maxDepth bounds, Enter/Exit lifecycle, nested depth, cycle detection, depth-limit-exceeded, depth-vs-cycle ordering, no state mutation on failed Enter, Reset semantics, guard idempotency, MaxDepth/CurrentDepth properties, and a struct type other than int. * Add tests for CharacterToGlyphMap.AsReadOnlyDictionary Covers the IReadOnlyDictionary<int, ushort> view returned by AsReadOnlyDictionary, using the existing Inter font asset: - ContainsKey agrees with the underlying map for both mapped and unmapped code points. - Indexer returns the same glyph id as map.GetGlyph for several representative ASCII characters. - Indexer throws KeyNotFoundException for an unmapped code point. - TryGetValue: positive and negative paths. - Count is positive and matches the enumerated pair count. - Enumeration yields (key, value) pairs that round-trip through the underlying CharacterToGlyphMap. - Keys enumeration and pair-key enumeration agree. - Two AsReadOnlyDictionary() calls produce functionally equivalent views (no identity assumption). Tests live alongside the existing CharacterToGlyphMap tests in GlyphTypefaceTests so they can reuse the CustomPlatformTypeface helper. * Redesign FontVariationSettings; add GlyphDrawingOptions FontVariationSettings is changed from a public record to a sealed class with internal factory methods (FromCoordinates / FromInstance), a FrozenDictionary backing for NormalizedCoordinates, and structural Equals/GetHashCode. The type now exclusively models variable-font axis configuration; palette and bitmap-strike concerns are moved out. GlyphDrawingOptions is a new public sealed record that carries the drawing options that are independent of axis configuration: an optional CPAL palette index (≥ 0) and an optional bitmap-strike pixel size (≥ 1). Both properties validate at init time and the type participates in record-equality and with-expressions. Tests are added for both types (48 new assertions). * Make FontVariationSettings factories public FromCoordinates and FromInstance are promoted from internal to public. They were kept internal while the consuming public API was being designed; that design is now settled (GlyphTypeface.CreateVariationSettings / VariationAxes / VariationInstances, planned for PR2). Class-level remarks are updated to describe the typeface-agnostic design rationale and point to GlyphTypeface.CreateVariationSettings as the preferred entry point for user-space axis values. * Tighten contracts and docs on font-parsing infra Polish pass on the shared infrastructure types so the contract surface is unambiguous before PR2 (GetGlyphOutline) and PR3 (GetGlyphDrawing) build on it: - IGlyphDrawing now exposes GlyphDrawingType Type so callers can branch on format without downcasting. The GlyphDrawingType enum was already defined but unreferenced by the interface; this closes the loop. PR3's ColorGlyphDrawing and ColorGlyphV1Drawing already implement the property, so the rebase is a no-op. - IGlyphDrawing.Bounds and Draw(origin) get explicit coordinate-space docs (drawing-space, Y-down; origin is the post-flipped glyph anchor). - Decycler<T> gets a class-level remarks block stating it is not thread-safe (one instance per traversal) and that Enter throws on cycle / depth-limit so callers can catch at the outermost site. - FontVariationSettings.Default documents that null and Default are interchangeable for parameters typed as FontVariationSettings?. - ObjectPool.Return documents that callers must not return the same item twice without an intervening Rent — the pool does not detect duplicate returns by design. Tests: - ObjectPool: validator must not be invoked on Rent (pins the validate-on-return contract). - GlyphDrawingOptions: parameterless ctor equals Default (record equality should make them interchangeable). - FontVariationSettings: FromCoordinates with both coordinates AND instanceIndex populated (combined form documented in the API). 83 tests pass (was 76). * Reshape FontVariationSettings for cache-key use Switch from a class wrapping FrozenDictionary + nullable instance index to a readonly struct backed by a sorted ImmutableArray of a dedicated FontVariationCoordinate record-struct. Driven by the type's role as a field on FontCollectionKey: - Hash code is computed once at construction and cached. Lookups in the font-resolution cache no longer pay an OrderBy allocation per call. - Equality is a parallel walk over two sorted arrays — no hash lookup, no TryGetValue per element. Short-circuits on cached-hash mismatch. - TryGetCoordinate / GetCoordinateOrDefault are linear scans, faster than hash lookup for the typical handful-of-axes case. - default(FontVariationSettings) is the "no variation" value. The old Default singleton goes away; nullable-handling at the cache layer becomes unnecessary. - InstanceIndex is dropped from the type. Named-instance selection is a typeface-level concern that resolves to coordinates; the runtime settings carry coordinates only, matching CSS / HarfBuzz / DirectWrite conventions. Tests rewritten: 34 cases covering struct semantics, sorting, TryGetCoordinate, hash caching, equality short-circuits, and the FontVariationCoordinate record's own equality. * Apply suggestions from code review Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> * Fix auto suggestion * Add synthetic-font test harness SyntheticFont / BigEndianBuffer build and mutate in-memory sfnt fonts so the table parsers can be exercised against hand-crafted malformed input without a platform shaper. Shared by every parser PR's malformed-font tests. * Characterize cmap/name/post degradation on malformed input Regression guards over the synthetic-font harness: a truncated post/name table degrades to defaults / a fallback family name instead of denying the font, the cmap format-12 nGroups12 overflow is clamped, and Format-4 selection prefers a Unicode subtable over Windows Symbol regardless of directory order. Fix dictionary wrapper contract, guard double-exit, and zero-coordinate canonicalization CharacterToGlyphMapDictionary mixed two membership predicates: Keys and Count filtered by ContainsGlyph while the indexer, TryGetValue and the enumerator used TryGetGlyph, so glyph-0 mappings produced keys the indexer rejected. Everything now answers through TryGetGlyph, and the Count walk (O(codepoints) over the mapped ranges) is computed once and cached. Decycler.Exit decremented the depth unconditionally: CycleGuard is a copyable ref struct, so a copied guard could exit the same id twice and grant later traversals extra depth budget. Depth is now only returned when the id was actually removed from the visited set. FontVariationSettings.FromCoordinates kept zero-valued coordinates, so an explicitly-default axis (wght=0 normalized) hashed and compared as a distinct value from settings omitting the axis - producing duplicate variation clones and font-collection cache entries downstream. Both factories now canonicalize zeros away (after the duplicate-axis check, which the dictionary overload previously skipped entirely). * Document the cmap dictionary view and tighten Decycler/ObjectPool internals Add XML docs to CharacterToGlyphMapDictionary's members. Collapse Decycler.Enter's Contains-then-Add into a single HashSet.Add (a false return means the id was already visited - a cycle). Make ObjectPool's lock-free count fast-check a volatile read. * Simplify FontVariationSettings.Equals to a span SequenceEqual Map the coordinate comparison onto the inner array via the span overload (Coordinates normalizes default to Empty, so both spans are valid). The span SequenceEqual avoids the boxing the LINQ overload would incur on this dictionary-key type, and FontVariationCoordinate's record-struct value equality drives the element compare. The cached-hash early-out is kept. * Add pre-allocation validation in NameTable.Load so malformed name tables are rejected before creating the names array. * Make PostTable.Load to catch only the malformed-data exception raised by this parsing path, instead of catching everything. * Raise ArgumentOutOfRangeException for negative count * Validate tableLength for CmapFormat12Or13Table ctor * Fixes GlyphDrawingOptions ArgumentOutOfRangeException nameof usage * Fix CmapFormat4Table ctor: clamp parallel-array offsets to tableLength When a malformed subtable declares a length that drives _segCount to 0, startCodeOffset = endCodeOffset + 02 + 2 (reservedPad) can exceed tableLength, causing Slice() to throw and denying the font entirely. Apply Math.Min(offset, tableLength) to each derived array offset so that zero-length slices always start at a valid position, degrading silently to an empty mapping instead of crashing. Revert change * Only handle specific exceptions in NameTable.Load Guard against negative count in BigEndianBuffer.Zeros * Speak user space in the public variation API Normalized coordinates are font-relative - the same value means different user positions under different fvar ranges and avar maps - so they cannot be authored in a style before font resolution and do not interpolate meaningfully. Every mainstream API (CSS font-variation-settings, DirectWrite, HarfBuzz, Skia) traffics in user-space values, and a public normalized type named like theirs invites passing wght=700 into a [-1,1] slot. - new public currency: FontVariation (tag=value in designer units) and an immutable FontVariationSettings with Parse/ToString ("wght=700,wdth=85"), order-independent structural equality, a cached hash, and CSS last-wins duplicate handling - usable as a style value and a cache key - the normalized pair moves out of public view: FontVariationCoordinate becomes internal NormalizedVariationCoordinate and the normalized settings struct becomes internal NormalizedVariationPosition, unchanged in behavior - the user-space -> normalized conversion stays a per-font, application- time concern; the fvar/avar reader lands in a follow-up PR * Accept infinite font variation values Infinities clamp to the axis range at apply time like any out-of-range value, so only NaN is rejected now. Parse also uses explicit number styles instead of NumberStyles.Float since the value text is pre-trimmed and the whitespace flags were redundant. * Guard NameRecord.GetValue against decoder exceptions The selected encodings use replacement fallback and never throw on malformed bytes, but degrade to an empty value anyway so an exception-throwing fallback can never deny the font. * Use nameof(value) in GlyphDrawingOptions setter exceptions Matches the .NET runtime convention for property setters, also used elsewhere in this repo (e.g. FormattedText). --------- Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Co-authored-by: Julien Lebosquain <julien@lebosquain.net>	3 weeks ago

Author

SHA1

Message

Date

Benedikt Stebner

eeb9e36a05

[Text] Glyph Outline Part 1/13 - Utility types for glyph outline support (#21405 )

* Harden cmap/name/post parsing against malformed fonts

Fonts are untrusted input, but several pre-existing table parsers throw out
of the GlyphTypeface constructor on hostile data, denying the whole font
instead of degrading the affected (cosmetic) table.

- name: wrap NameTable.Load in try/catch so a malformed table falls back to a
default family name (same outcome as an absent name), and bounds-check
NameRecord.GetValue's (offset,length) slice — the record array is validated
at load but each record's storage slice is read later during construction.
- post: wrap PostTable.Load so a malformed cosmetic-hint table degrades to
defaults rather than denying the font.
- cmap format 12/13: clamp the declared length and group count to the buffer,
computing the group span in long to avoid the nGroups*12 int overflow a
hostile count would wrap to a negative slice length.
- cmap format 4 selection: score a Windows Symbol subtable worse than any
Unicode subtable so ASCII resolves regardless of subtable order, while a
Symbol-only font still selects its only subtable.

maxp/cmap remain fatal by design. Behavioural hardening only; public API
unchanged. Backportable independently of the glyph-outline stack.

* Clamp cmap range contents and harden binary reader primitives

Format 12/13 group contents are attacker-controlled: TryGetRange used to
hand the raw uint32 end straight to per-codepoint consumers, so a group
with endCharCode 0x7FFFFFFF turned range enumeration into an unbounded
(for int.MaxValue, non-terminating) loop. Clamp ranges to the Unicode
range and map inverted/out-of-range groups to empty ranges so later
groups still enumerate.

Give the format 4 constructor the same treatment its format 12 sibling
already received: clamp the declared length and segment count to what
the buffer actually holds instead of slicing unchecked (debug asserts
replaced by the clamps).

In BigEndianBinaryReader, bounds-check array reads before allocating
(a hostile length is rejected instead of attempting the allocation),
make EnsureAvailable overflow-proof, and clamp ReadBytes against
negative counts.

* Add font parsing infrastructure for glyph outline/color drawing

Introduces shared utility types that subsequent PRs will use to
implement GetGlyphOutline (glyf table) and GetGlyphDrawing
(COLR v0/v1) on GlyphTypeface:

- ObjectPool<T>: thread-safe object pool used by Decyclers
- Decycler<T> / CycleGuard<T> / DecyclerException: generic
cycle-detection and depth-limiting utility for recursive
font-table traversal (composite glyphs, paint graphs)
- FontVariationSettings: parameter type for the upcoming
GetGlyphOutline / GetGlyphDrawing overloads
- IGlyphDrawing / GlyphDrawingType: return-type contract for color
glyph drawings (outline, color layers, SVG, bitmap)
- CharacterToGlyphMapDictionary: lightweight, allocation-free
IReadOnlyDictionary<int, ushort> view over the cmap, plus
CharacterToGlyphMap.AsReadOnlyDictionary() to expose it

No behavior change; types are not yet consumed in this PR.

* Apply suggestions from code review

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

* Validate ObjectPool maxSize and add unit tests

The ObjectPool<T> constructor previously accepted any maxSize value.
A value of 0 or below silently caused every Return to be discarded,
which is hard to diagnose at the call site.

- Reject maxSize < 1 with ArgumentOutOfRangeException at construction.
- Document the new precondition in the XML comment.
- Add ObjectPoolTests covering: factory null guard, maxSize bounds,
Rent/Return basics, Return ignoring null, max-size enforcement,
validator invocation and rejection, validator-as-reset, plus
concurrent stress tests for cap enforcement and parallel use.

* Validate Decycler maxDepth and add unit tests

The Decycler<T> constructor previously accepted any maxDepth value.
A value of 0 or below made the very first Enter throw
DepthLimitExceeded, which presents as a cycle/depth error at use time
instead of pointing at the construction site.

- Reject maxDepth < 1 with ArgumentOutOfRangeException at construction.
- Document the new precondition in the XML comment.
- Add DecyclerTests covering: maxDepth bounds, Enter/Exit lifecycle,
nested depth, cycle detection, depth-limit-exceeded, depth-vs-cycle
ordering, no state mutation on failed Enter, Reset semantics,
guard idempotency, MaxDepth/CurrentDepth properties, and a struct
type other than int.

* Add tests for CharacterToGlyphMap.AsReadOnlyDictionary

Covers the IReadOnlyDictionary<int, ushort> view returned by
AsReadOnlyDictionary, using the existing Inter font asset:

- ContainsKey agrees with the underlying map for both mapped and
unmapped code points.
- Indexer returns the same glyph id as map.GetGlyph for several
representative ASCII characters.
- Indexer throws KeyNotFoundException for an unmapped code point.
- TryGetValue: positive and negative paths.
- Count is positive and matches the enumerated pair count.
- Enumeration yields (key, value) pairs that round-trip through the
underlying CharacterToGlyphMap.
- Keys enumeration and pair-key enumeration agree.
- Two AsReadOnlyDictionary() calls produce functionally equivalent
views (no identity assumption).

Tests live alongside the existing CharacterToGlyphMap tests in
GlyphTypefaceTests so they can reuse the CustomPlatformTypeface
helper.

* Redesign FontVariationSettings; add GlyphDrawingOptions

FontVariationSettings is changed from a public record to a sealed class
with internal factory methods (FromCoordinates / FromInstance), a
FrozenDictionary backing for NormalizedCoordinates, and structural
Equals/GetHashCode. The type now exclusively models variable-font axis
configuration; palette and bitmap-strike concerns are moved out.

GlyphDrawingOptions is a new public sealed record that carries the
drawing options that are independent of axis configuration: an optional
CPAL palette index (≥ 0) and an optional bitmap-strike pixel size (≥ 1).
Both properties validate at init time and the type participates in
record-equality and with-expressions.

Tests are added for both types (48 new assertions).

* Make FontVariationSettings factories public

FromCoordinates and FromInstance are promoted from internal to public.
They were kept internal while the consuming public API was being designed;
that design is now settled (GlyphTypeface.CreateVariationSettings /
VariationAxes / VariationInstances, planned for PR2).

Class-level remarks are updated to describe the typeface-agnostic design
rationale and point to GlyphTypeface.CreateVariationSettings as the
preferred entry point for user-space axis values.

* Tighten contracts and docs on font-parsing infra

Polish pass on the shared infrastructure types so the contract surface is
unambiguous before PR2 (GetGlyphOutline) and PR3 (GetGlyphDrawing) build
on it:

- IGlyphDrawing now exposes GlyphDrawingType Type so callers can branch
on format without downcasting. The GlyphDrawingType enum was already
defined but unreferenced by the interface; this closes the loop.
PR3's ColorGlyphDrawing and ColorGlyphV1Drawing already implement the
property, so the rebase is a no-op.
- IGlyphDrawing.Bounds and Draw(origin) get explicit coordinate-space
docs (drawing-space, Y-down; origin is the post-flipped glyph anchor).
- Decycler<T> gets a class-level remarks block stating it is not
thread-safe (one instance per traversal) and that Enter throws on
cycle / depth-limit so callers can catch at the outermost site.
- FontVariationSettings.Default documents that null and Default are
interchangeable for parameters typed as FontVariationSettings?.
- ObjectPool.Return documents that callers must not return the same
item twice without an intervening Rent — the pool does not detect
duplicate returns by design.

Tests:
- ObjectPool: validator must not be invoked on Rent (pins the
validate-on-return contract).
- GlyphDrawingOptions: parameterless ctor equals Default (record
equality should make them interchangeable).
- FontVariationSettings: FromCoordinates with both coordinates AND
instanceIndex populated (combined form documented in the API).

83 tests pass (was 76).

* Reshape FontVariationSettings for cache-key use

Switch from a class wrapping FrozenDictionary + nullable instance index
to a readonly struct backed by a sorted ImmutableArray of a dedicated
FontVariationCoordinate record-struct. Driven by the type's role as a
field on FontCollectionKey:

- Hash code is computed once at construction and cached. Lookups in the
font-resolution cache no longer pay an OrderBy allocation per call.
- Equality is a parallel walk over two sorted arrays — no hash lookup,
no TryGetValue per element. Short-circuits on cached-hash mismatch.
- TryGetCoordinate / GetCoordinateOrDefault are linear scans, faster
than hash lookup for the typical handful-of-axes case.
- default(FontVariationSettings) is the "no variation" value. The old
Default singleton goes away; nullable-handling at the cache layer
becomes unnecessary.
- InstanceIndex is dropped from the type. Named-instance selection is
a typeface-level concern that resolves to coordinates; the runtime
settings carry coordinates only, matching CSS / HarfBuzz / DirectWrite
conventions.

Tests rewritten: 34 cases covering struct semantics, sorting,
TryGetCoordinate, hash caching, equality short-circuits, and the
FontVariationCoordinate record's own equality.

* Apply suggestions from code review

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

* Fix auto suggestion

* Add synthetic-font test harness

SyntheticFont / BigEndianBuffer build and mutate in-memory sfnt fonts so the
table parsers can be exercised against hand-crafted malformed input without a
platform shaper. Shared by every parser PR's malformed-font tests.

* Characterize cmap/name/post degradation on malformed input

Regression guards over the synthetic-font harness: a truncated post/name table
degrades to defaults / a fallback family name instead of denying the font, the
cmap format-12 nGroups*12 overflow is clamped, and Format-4 selection prefers a
Unicode subtable over Windows Symbol regardless of directory order.

* Fix dictionary wrapper contract, guard double-exit, and zero-coordinate canonicalization

CharacterToGlyphMapDictionary mixed two membership predicates: Keys and
Count filtered by ContainsGlyph while the indexer, TryGetValue and the
enumerator used TryGetGlyph, so glyph-0 mappings produced keys the
indexer rejected. Everything now answers through TryGetGlyph, and the
Count walk (O(codepoints) over the mapped ranges) is computed once and
cached.

Decycler.Exit decremented the depth unconditionally: CycleGuard is a
copyable ref struct, so a copied guard could exit the same id twice and
grant later traversals extra depth budget. Depth is now only returned
when the id was actually removed from the visited set.

FontVariationSettings.FromCoordinates kept zero-valued coordinates, so
an explicitly-default axis (wght=0 normalized) hashed and compared as a
distinct value from settings omitting the axis - producing duplicate
variation clones and font-collection cache entries downstream. Both
factories now canonicalize zeros away (after the duplicate-axis check,
which the dictionary overload previously skipped entirely).

* Document the cmap dictionary view and tighten Decycler/ObjectPool internals

Add XML docs to CharacterToGlyphMapDictionary's members. Collapse
Decycler.Enter's Contains-then-Add into a single HashSet.Add (a false
return means the id was already visited - a cycle). Make ObjectPool's
lock-free count fast-check a volatile read.

* Simplify FontVariationSettings.Equals to a span SequenceEqual

Map the coordinate comparison onto the inner array via the span overload
(Coordinates normalizes default to Empty, so both spans are valid). The
span SequenceEqual avoids the boxing the LINQ overload would incur on
this dictionary-key type, and FontVariationCoordinate's record-struct
value equality drives the element compare. The cached-hash early-out is
kept.

* Add pre-allocation validation in NameTable.Load so malformed name tables are rejected before creating the names array.

* Make PostTable.Load to catch only the malformed-data exception raised by this parsing path, instead of catching everything.

* Raise ArgumentOutOfRangeException for negative count

* Validate tableLength for CmapFormat12Or13Table ctor

* Fixes GlyphDrawingOptions ArgumentOutOfRangeException nameof usage

* Fix CmapFormat4Table ctor: clamp parallel-array offsets to tableLength

When a malformed subtable declares a length that drives _segCount to 0,
startCodeOffset = endCodeOffset + 0*2 + 2 (reservedPad) can exceed
tableLength, causing Slice() to throw and denying the font entirely.

Apply Math.Min(offset, tableLength) to each derived array offset so that
zero-length slices always start at a valid position, degrading silently
to an empty mapping instead of crashing.

* Revert change

* Only handle specific exceptions in NameTable.Load
Guard against negative count in BigEndianBuffer.Zeros

* Speak user space in the public variation API

Normalized coordinates are font-relative - the same value means different
user positions under different fvar ranges and avar maps - so they cannot
be authored in a style before font resolution and do not interpolate
meaningfully. Every mainstream API (CSS font-variation-settings,
DirectWrite, HarfBuzz, Skia) traffics in user-space values, and a public
normalized type named like theirs invites passing wght=700 into a [-1,1]
slot.

- new public currency: FontVariation (tag=value in designer units) and an
immutable FontVariationSettings with Parse/ToString ("wght=700,wdth=85"),
order-independent structural equality, a cached hash, and CSS last-wins
duplicate handling - usable as a style value and a cache key
- the normalized pair moves out of public view: FontVariationCoordinate
becomes internal NormalizedVariationCoordinate and the normalized
settings struct becomes internal NormalizedVariationPosition, unchanged
in behavior
- the user-space -> normalized conversion stays a per-font, application-
time concern; the fvar/avar reader lands in a follow-up PR

* Accept infinite font variation values

Infinities clamp to the axis range at apply time like any out-of-range
value, so only NaN is rejected now. Parse also uses explicit number
styles instead of NumberStyles.Float since the value text is pre-trimmed
and the whitespace flags were redundant.

* Guard NameRecord.GetValue against decoder exceptions

The selected encodings use replacement fallback and never throw on
malformed bytes, but degrade to an empty value anyway so an
exception-throwing fallback can never deny the font.

* Use nameof(value) in GlyphDrawingOptions setter exceptions

Matches the .NET runtime convention for property setters, also used
elsewhere in this repo (e.g. FormattedText).

---------

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Julien Lebosquain <julien@lebosquain.net>

3 weeks ago

1 Commits (fixes/macos-owned-window-level-inheritance)