BTW, are you currently passing COLR/CPAL to DirectWrite sanitiser before its use? Currently Chrome is passing that without any check https://cs.chromium.org/chromium/src/third_party/WebKit/Source/platform/fonts/WebFontDecoder.cpp?q=cpal+colr&sq=package:chromium&l=109 so you should make sure if sanitizing is actually happening by some party on these tables at least once. However, a harfbuzz based implementation would make these much more secure.

CCing OTS maintainer and harfbuzz contributor.

Interesting that it currently doesn't render as color on all size, unlike Firefox,

data:text/html;charset=utf8,<script>document.write("%F0%9F%8F%AF".repeat(20).replace(/./ug, (x, i) => `<span style="font-size: ${i * 10}px;">${x}</spatn> `))</script>

(probably starts to become b&w on a different size on a lowdpi screen)

Deleted: Emoji.png 107 KB

	Emoji.png 107 KB View Download

Progressing http://savannah.nongnu.org/bugs/?44689 can finish this also I'd guess.

Very early WIP: https://skia-review.googlesource.com/c/skia/+/121620

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/e38057af680ddee23e865fef10f11a99cff67ee7

commit e38057af680ddee23e865fef10f11a99cff67ee7
Author: Dominik Röttsches <drott@chromium.org>
Date: Thu May 31 14:29:26 2018

Roll src/third_party/freetype/src/ d45d4b97e..0589f6e6e (2 commits)

https://chromium.googlesource.com/chromium/src/third_party/freetype2.git/+log/d45d4b97e6a0..0589f6e6ee6e

$ git log d45d4b97e..0589f6e6e --date=short --no-merges --format='%ad %ae %s'
2018-05-31 wl [sfnt] Get colors from `CPAL' table in right order (#54015).
2018-05-30 wl ftcolor.h: Improve API design, fix typos (#54011, #54014).

Created with:
  roll-dep src/third_party/freetype/src
R=bungeman@chromium.org,drott@chromium.org

CQ_INCLUDE_TRYBOTS=master.tryserver.chromium.linux:linux_chromium_msan_rel_ng

PDFium-Issue:  pdfium:1100 
Bug:  617379 
Change-Id: Ifd5b6caf6699e9f6cf1b498dfc4a57fb3dc9acca
Reviewed-on: https://chromium-review.googlesource.com/1079760
Reviewed-by: Ben Wagner <bungeman@chromium.org>
Commit-Queue: Dominik Röttsches <drott@chromium.org>
Cr-Commit-Position: refs/heads/master@{#563222}
[modify] https://crrev.com/e38057af680ddee23e865fef10f11a99cff67ee7/DEPS
[modify] https://crrev.com/e38057af680ddee23e865fef10f11a99cff67ee7/third_party/freetype/README.chromium

COLR/CPAL support for FreeType now landed in Skia in [1], [2], which automatically brings support to Android, CrOS and Linux. What remains to be done is improve WebFontTypefaceFactory to fall back to FreeType on Windows and Mac OS versions that do not support COLR/CPAL.

[1] https://skia.googlesource.com/skia/+/f3ca1c6abb07889b66f4aace6469db5ed1c69e3f
[2] Skia Roll including COLR/CPAL on FreeType implementation https://chromium-review.googlesource.com/c/chromium/src/+/1171445

Attached: Screenshot of Chromacheck on Linux 

Deleted: chromacheck_linux.png 98.2 KB

	chromacheck_linux.png 98.2 KB View Download

\m/ ^_^

COLR/CPAL is now available on all Blink platforms. On Windows pre 8.1 and Mac OS 10.12 and below we fallback to FreeType.