Bug 1715507 - Support different levels of font-visibility per context, depending on tracking/fingerprinting protection settings. r=emilio

Differential Revision: https://phabricator.services.mozilla.com/D124196

layout/base/nsPresContext.cpp

@@ -335,12 +335,13 @@ static const char* gExactCallbackPrefs[] = {
     "nglayout.debug.paint_flashing_chrome",
     "nglayout.debug.paint_flashing",
     "privacy.resistFingerprinting",
+    "privacy.trackingprotection.enabled",
     nullptr,
 };
 
 static const char* gPrefixCallbackPrefs[] = {
-    "font.", "browser.display.",    "browser.viewport.",
-    "bidi.", "gfx.font_rendering.", "layout.css.font-visibility.",
+    "bidi.", "browser.display.",    "browser.viewport.",
+    "font.", "gfx.font_rendering.", "layout.css.font-visibility.",
     nullptr,
 };
 
@@ -800,14 +801,37 @@ nsresult nsPresContext::Init(nsDeviceContext* aDeviceContext) {
 
 bool nsPresContext::UpdateFontVisibility() {
   FontVisibility oldValue = mFontVisibility;
-  if (StaticPrefs::privacy_resistFingerprinting()) {
-    mFontVisibility = FontVisibility::Base;
-  } else {
-    mFontVisibility = FontVisibility(
-        std::min(int32_t(FontVisibility::User),
-                 std::max(int32_t(FontVisibility::Base),
-                          StaticPrefs::layout_css_font_visibility_level())));
+
+  // Is this a private browsing context?
+  bool isPrivate = false;
+  if (nsCOMPtr<nsILoadContext> loadContext = mDocument->GetLoadContext()) {
+    isPrivate = loadContext->UsePrivateBrowsing();
   }
+
+  // Read the relevant pref depending on RFP/trackingProtection state
+  // to determine the visibility level to use.
+  int32_t level;
+  if (StaticPrefs::privacy_resistFingerprinting()) {
+    level = StaticPrefs::layout_css_font_visibility_resistFingerprinting();
+  } else if (StaticPrefs::privacy_trackingprotection_enabled() ||
+             (isPrivate &&
+              StaticPrefs::privacy_trackingprotection_pbmode_enabled())) {
+    level = StaticPrefs::layout_css_font_visibility_trackingprotection();
+  } else {
+    level = StaticPrefs::layout_css_font_visibility_standard();
+  }
+
+  // For private browsing contexts, apply the private-mode limit.
+  if (isPrivate) {
+    int32_t priv = StaticPrefs::layout_css_font_visibility_private();
+    level = std::max(std::min(level, priv), int32_t(FontVisibility::Base));
+  }
+
+  // Clamp result to the valid range of levels.
+  level = std::max(std::min(level, int32_t(FontVisibility::User)),
+                   int32_t(FontVisibility::Base));
+
+  mFontVisibility = FontVisibility(level);
   return mFontVisibility != oldValue;
 }
 

modules/libpref/init/StaticPrefList.yaml

@@ -6969,8 +6969,29 @@
 #   1 - only base system fonts
 #   2 - also fonts from optional language packs
 #   3 - also user-installed fonts
-- name: layout.css.font-visibility.level
-  type: RelaxedAtomicInt32
+- name: layout.css.font-visibility.standard
+  type: int32_t
+  value: 3
+  mirror: always
+
+# font-visibility setting when Tracking Protection is enabled
+- name: layout.css.font-visibility.trackingprotection
+  type: int32_t
+  value: 3
+  mirror: always
+
+# font-visibility setting when Resist Fingerprinting is enabled
+- name: layout.css.font-visibility.resistFingerprinting
+  type: int32_t
+  value: 1
+  mirror: always
+
+# Max font-visibility setting for Private Browsing contexts
+# (The actual value used in a private-browsing context will be the lesser of
+# the appropriate standard/trackingprotection/RFP value from above, and the
+# private-browsing level specified by this pref.)
+- name: layout.css.font-visibility.private
+  type: int32_t
   value: 3
   mirror: always