Font rasterization concurrency in `golang.org/x/image`: experimental evidence, ownership, and a decision not to change upstream

Abstract

Sharing an `opentype.Face` across goroutines produces *data races* reported by the Go race detector. Two interpretations are possible: treat the sharing as a defect to fix with a patch, or as use incompatible with the documented contract that `font.Face` is not safe for concurrent use. In this work, we distinguish those interpretations through mutable-state mapping, causal reproduction with 13 hypotheses and orthogonal controls, a performance baseline, and a comparison of six ownership patterns (A–F). We observe real concurrent accesses under sharing and, without `-race`, observable corruption (digest mismatch) and panics. The **one Face per worker** pattern (C) satisfies the contract, remains race-free, and on the `Glyph` path was statistically indistinguishable from E and F in our experiments (`benchstat`, `~`), while A, B, and D were significantly slower. Among the requirements and alternatives evaluated, the only missing capability, independent mask lifetime, would require a public API change. We found no evidence that justifies an upstream change under those requirements; the expected functional diff remains empty.