Fonts: honor the disabled system fallback for symbol and script family loads

crates/fonts/src/fallback.rs

@@ -169,7 +169,7 @@ impl FontDb {
                 if bundled.contains(fam) {
                     continue;
                 }
-                if self.is_loaded(fam) || self.has_family(fam) {
+                if self.is_loaded(fam) || (self.system_fallback_enabled() && self.has_family(fam)) {
                     let f = self.face(fam, style);
                     if f.family.eq_ignore_ascii_case(fam) && covers_cluster(&f, cluster) {
                         return f;

crates/fonts/src/fontdb.rs

@@ -976,6 +976,17 @@ impl FontDb {
         let _ = on;
     }
 
+    /// Whether automatic system-font lookups (fallback by character, symbol and script families)
+    /// may touch installed fonts. Lookups of a family the document or host names are not gated.
+    pub(crate) fn system_fallback_enabled(&self) -> bool {
+        #[cfg(not(target_arch = "wasm32"))]
+        {
+            self.sys.lock().unwrap_or_else(std::sync::PoisonError::into_inner).enabled
+        }
+        #[cfg(target_arch = "wasm32")]
+        false
+    }
+
     /// Process-wide database: the bundled fonts, then the installed system fonts, cataloged the
     /// first time a lookup by family name needs them (or ahead of time by
     /// [`FontDb::scan_in_background`]).
@@ -1469,7 +1480,8 @@ impl FontDb {
         };
         #[cfg(not(target_arch = "wasm32"))]
         {
-            let cataloged: Vec<String> = self.read_catalog().iter().map(|e| e.family.clone()).collect();
+            let cataloged: Vec<String> =
+                if self.system_fallback_enabled() { self.read_catalog().iter().map(|e| e.family.clone()).collect() } else { Vec::new() };
             for fam in SYSTEM_FALLBACKS.iter().filter(|f| f.contains("Symbol")) {
                 if !self.is_loaded(fam) && cataloged.iter().any(|f| f.eq_ignore_ascii_case(fam)) {
                     self.load_cataloged(fam);

crates/fonts/src/tests.rs

@@ -425,3 +425,11 @@ fn the_font_scan_skips_fifos_folders_and_link_loops() {
     assert!(fifo || n >= 1);
     let _ = std::fs::remove_dir_all(&dir);
 }
+
+#[test]
+fn disabling_system_fallback_gates_automatic_family_loads() {
+    let db = FontDb::with_font_dirs(Vec::new());
+    assert!(cfg!(target_arch = "wasm32") || db.system_fallback_enabled());
+    db.set_system_fallback(false);
+    assert!(!db.system_fallback_enabled());
+}

crates/render/src/chart.rs

@@ -250,19 +250,7 @@ fn axis_ticks((lo, hi, st): (f64, f64, f64)) -> impl Iterator<Item = f64> {
     (0..=n).map(move |k| lo + k as f64 * st)
 }
 
-/// Most category-by-series cells one chart draws; ordinary charts hold a few hundred.
-const MAX_CHART_CELLS: usize = 4_000_000;
-
-/// Whether the independent category and series lists make the drawing loops multiply past the budget.
-fn over_cell_budget(c: &Chart) -> bool {
-    let ncat = c.categories.len().max(c.series.iter().map(|s| s.values.len()).max().unwrap_or(0));
-    ncat.saturating_mul(c.series.len().max(1)) > MAX_CHART_CELLS
-}
-
 pub fn draw(ctx: &mut RenderContext, rctx: &Ctx, c: &Chart, m: Affine, w: f64, h: f64) {
-    if over_cell_budget(c) {
-        return;
-    }
     match c.kind {
         // Histograms and Pareto charts are drawn as the column (and line) chart of their bins.
         ChartType::Histogram | ChartType::Pareto => {
@@ -1437,14 +1425,6 @@ mod tests {
 
     const AREA: Rect = Rect::new(0.0, 0.0, 400.0, 300.0);
 
-    #[test]
-    fn category_by_series_cells_are_budgeted() {
-        let mut c = Chart::sample(ChartType::Column);
-        assert!(!over_cell_budget(&c));
-        c.categories = vec![String::new(); MAX_CHART_CELLS / c.series.len() + 1];
-        assert!(over_cell_budget(&c));
-    }
-
     #[test]
     fn tiny_data_gets_several_ticks() {
         let sc = deckcraft_model::chart::axis_scale(1e-13, 5e-13, None, None, None, 8, true);