[csswg-drafts] [css-font-loading] document.fonts is too vagely defined (#6126)

MatsPalmgren has just created a new issue for https://github.com/w3c/csswg-drafts:

== [css-font-loading] document.fonts is too vagely defined ==
I'm adding a `@font-face` rule for a built-in font to the UA sheet in Gecko. This caused a ton of WPT failures because our implementation of `document.fonts` included it the `FontFaceSet` it returns.  The WPT framework itself makes the assumption (in [/infrastructure/assumptions/document-fonts-ready.html](https://wpt.fyi/results/infrastructure/assumptions/document-fonts-ready.html)) that `document.fonts` returns an empty set if the document itself hasn't added any font sources yet.

The spec says:
https://drafts.csswg.org/css-font-loading/#font-face-source
> The value of the context’s fonts attribute is its font source, which provides all of the fonts used in font-related operations, unless defined otherwise.

and further:
https://drafts.csswg.org/css-font-loading/#document-font-face-set
> The set entries for a document’s font source must be initially populated with all the CSS-connected FontFace objects from all of the CSS @font-face rules in the document’s stylesheets, in document order.

It's unclear from the quoted spec text (and the spec in general) whether `document.fonts` should be initially empty, or if it should include User and UserAgent origin font sources too.

We tend to think that it should be explicitly defined to start out empty, and thus that only Author origin font sources are exposed to the document. For a few reasons:
1. it seems unlikely that web developers want to see fonts other than their own in `document.fonts`
2. the semantics of `FontFaceSet.delete` (and `clear`) on a User or UserAgent font is unclear; it doesn't seem like a document should have the authority to remove either
3. exposing User origin fonts to the document seems like a privacy / fingerprinting issue

Perhaps one should read from "in the document’s stylesheets, in document order" that only sheets linked, or embedded, from the document itself (and their `@import`s) should be included, but that's vague.  A clear definition of "the document’s stylesheets" seems missing too.

CC @jfkthame 

Please view or discuss this issue at https://github.com/w3c/csswg-drafts/issues/6126 using your GitHub account


-- 
Sent via github-notify-ml as configured in https://github.com/w3c/github-notify-ml-config

Received on Monday, 22 March 2021 16:44:08 UTC