diff --git a/darwin/aat.m b/darwin/aat.m
index 84b13c83..45a97b00 100644
--- a/darwin/aat.m
+++ b/darwin/aat.m
@@ -18,7 +18,7 @@ static void boolspec(uint32_t value, uint16_t type, uint16_t ifTrue, uint16_t if
 	pcall(p, type, ifFalse);
 }
 
-void openTypeToAAT(char a, char b, char c, char d, uint32_t value, void *data)
+static int foreach(char a, char b, char c, char d, uint32_t value, void *data)
 {
 	struct openTypeAATParams *p = (struct openTypeAATParams *) data;
 
@@ -394,4 +394,15 @@ void openTypeToAAT(char a, char b, char c, char d, uint32_t value, void *data)
 			pcall(p, kUpperCaseType, kUpperCasePetiteCapsSelector);
 		break;
 	}
+	// TODO handle this properly
+	return 0;
+}
+
+void openTypeToAAT(uiOpenTypeFeatures *otf, void (*doAAT)(uint16_t type, uint16_t selector, void *data), void *data)
+{
+	struct openTypeAATParams p;
+
+	p.doAAT = doAAT;
+	p.data = data;
+	uiOpenTypeFeaturesForEach(otf, foreach, &p);
 }
diff --git a/darwin/attrstr.m b/darwin/attrstr.m
index 3e5797b4..556b09ad 100644
--- a/darwin/attrstr.m
+++ b/darwin/attrstr.m
@@ -155,6 +155,7 @@ static void doAAT(uint16_t type, uint16_t selector, void *data)
 		fp->nFeatures++;
 		if (fp->nFeatures == maxFeatures) {
 			// TODO
+			// TODO move this check to the top like in the drawtext example? and all the other instances of this?
 		}
 	});
 }
@@ -257,14 +258,15 @@ static int processAttribute(uiAttributedString *s, uiAttributeSpec *spec, size_t
 		if (spec->Value == uiDrawUnderlineColorCustom)
 			CFRelease(color);
 		break;
-	default:
-		// handle typographic features
+	case uiAttributeFeatures:
 		ap.p = p;
 		ap.start = start;
 		ap.end = end;
-		// TODO check if unhandled and complain
-		specToAAT(spec, doAAT, &ap);
+		openTypeToAAT((uiOpenTypeFeatures *) (spec->Value), doAAT, &ap);
 		break;
+	default:
+		// TODO complain
+		;
 	}
 	return 0;
 }
diff --git a/darwin/opentype.m b/darwin/opentype.m
index c8158356..25939299 100644
--- a/darwin/opentype.m
+++ b/darwin/opentype.m
@@ -29,14 +29,6 @@ uiOpenTypeFeatures *uiOpenTypeFeaturesClone(uiOpenTypeFeatures *otf)
 	return out;
 }
 
-// TODO provide to aat.m too; remove x8tox32() when doing so
-#define x8to32(x) ((uint32_t) (((uint8_t) (x)) & 0xFF))
-#define mkTag(a, b, c, d)		\
-	((x8tox32(a) << 24) |	\
-	(x8tox32(b) << 16) |		\
-	(x8tox32(c) << 8) |		\
-	x8tox32(d))
-
 // why are there no NSNumber methods for stdint.h or the equivalent core foundation types?...
 #define mkMapObject(tag) [NSNumber numberWithUnsignedLongLong:((unsigned long long) tag)]
 #define mapObjectValue(num) ((uint32_t) [num unsignedLongLongValue])
diff --git a/darwin/uipriv_darwin.h b/darwin/uipriv_darwin.h
index c3de53e2..8c4bff07 100644
--- a/darwin/uipriv_darwin.h
+++ b/darwin/uipriv_darwin.h
@@ -152,5 +152,14 @@ typedef void (^backgroundBlock)(uiDrawContext *c, uiDrawTextLayout *layout, doub
 extern CFAttributedStringRef attrstrToCoreFoundation(uiDrawTextLayoutParams *p, NSArray **backgroundBlocks);
 
 // aat.m
-typedef void (*specToAATEnumFunc)(uint16_t type, uint16_t selector, void *data);
-extern int specToAAT(uiAttributeSpec *spec, specToAATEnumFunc f, void *data);
+extern void openTypeToAAT(uiOpenTypeFeatures *otf, void (*doAAT)(uint16_t type, uint16_t selector, void *data), void *data);
+
+// opentype.m
+// TODO this is only used by opentype.m and aat.m; figure out some better way to handle this
+// TODO remove x8tox32()
+#define x8to32(x) ((uint32_t) (((uint8_t) (x)) & 0xFF))
+#define mkTag(a, b, c, d)		\
+	((x8tox32(a) << 24) |	\
+	(x8tox32(b) << 16) |		\
+	(x8tox32(c) << 8) |		\
+	x8tox32(d))