openTrueType
Opens one owner-thread TrueType face under immutable encoded-byte and glyph-image ceilings. The default validates the encoded byte count before delegating to the existing face callback. Native backends override this method to pin the selected limits to the face and check measured glyph dimensions before allocating raster pixels. An oversized native-atlas marker allocates no pixels and is not itself subject to the image-allocation ceilings. Callers independently validate returned images before retaining them, including images from legacy implementations.
Return
a new face owned and closed by the caller on the opening thread.
Parameters
caller-owned font bytes, copied if retained by the returned face.
immutable provider rasterization settings.
immutable ceilings retained by the new face when bounded rasterization is implemented.
Throws
when a ceiling, initialization, or later rasterization check fails; failed initialization releases partial resources.