619180 - @font-face ligatures are no longer displayed on OS X

Status: RESOLVED WONTFIX

(Core :: Layout: Text and Fonts, defect)

Description

[j. 'mach' wust]

User-Agent:       Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Build Identifier: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13

Firefox used to have an exemplary support of ligatures. It would display both AAT ligatures and OpenType ligatures. This great feature has appearently been completely abandoned.

Reproducible: Always

Steps to Reproduce:
1. Visit any page with an @font-face font that uses ligatures.

Actual Results:  
No ligatures any more.

Expected Results:  
Ligatures (as there used to be up to Firefox 3.6.12).

I guess that Firefox stopped supporting ligatures because of the [@font-face] investigate support for OpenType sanitizer library: https://bugzilla.mozilla.org/show_bug.cgi?id=527276

There was probably some benefit in doing that. As for me, I only see the downside of it: Ligatures just stopped working. Peeking at the ots DesignDoc, I see that it says the following: "Some languages such as Indic/Thai/Arabic need GSUB/GDEF/GPOS support. Probably we should support them whenever necessary." There are obviously more languages than these that need ligatures, for example German when typeset in a fraktur font (as can be verified in the Duden, the authoritative reference book on German orthography). So it would seem like a good idea that ligatures should be supported whenever necessary.

Comment 1

[John Daggett (:jtd)]

Yes, unfortunately the decision was made to use OTS to avoid security problems related to OSX font system handling of maliciously constructed fonts.  In effect, this strips out the AAT and OT layout tables.  Apple has patched many of these in the latest system release but there was a general concern that we should be much stricter about font validation on OSX, based on the number of problems we've found.

The solution will be to upgrade to Firefox 4 when available.  Harfbuzz supports ligatures and there's a special codepath to pass the OT tables to harfbuzz (but not CoreText).  Downloadable AAT fonts are also, unfortunately, no longer supported.  We could add support for sanitizing these (see bug 602411) but I doubt there's enough of a use case to balance the complexity of validating these.

Comment 2

[Jonathan Kew [:jfkthame]]

This is essentially the same as bug 619180, which referred to GPOS kerning rather than ligatures, but in both cases, the fact that OTS strips the OpenType layout tables (for security/stability reasons) means that this feature no longer works with downloadable fonts on OS X.

These features *are* still supported in Firefox 4, so it's not correct to say that they have been abandoned; in fact, Firefox 4 introduces more extensive support for OpenType layout features. But for 3.6.x, I don't think we can do anything about this; the Apple font code we rely on for text layout is too fragile, and allowing downloadable fonts to use these features exposes the browser to too many risks.

You can go to about:config and set gfx.downloadable_fonts.sanitize.preserve_otl_tables to "true" in order to restore this behavior, but this means you will be more vulnerable to bad (or malicious) fonts on web pages that may crash or otherwise disrupt the browser or even the OS.

Comment 3

[John Daggett (:jtd)]

(In reply to comment #2)
> This is essentially the same as bug 619180, which referred to GPOS kerning
> rather than ligatures...

Um, this is bug 619180, I think you meant a different bug, no?

Comment 4

[Jonathan Kew [:jfkthame]]

(In reply to comment #3)
> Um, this is bug 619180, I think you meant a different bug, no?

Errr..... yes.  I meant bug 619061.