Fix ChanContext backtrack matching with GPOS

Reported on mailing list by Keith Stribley and Khaled Hosny.

3 files changed, 7 insertions, 6 deletions

diff --git a/src/hb-buffer-private.hh b/src/hb-buffer-private.hh
index a1291651..d8834c55 100644
--- a/src/hb-buffer-private.hh
+++ b/src/hb-buffer-private.hh
@@ -99,7 +99,7 @@ struct _hb_buffer_t {
 
   unsigned int i; /* Cursor into ->info and ->pos arrays */
   unsigned int len; /* Length of ->info and ->pos arrays */
-  unsigned int out_len; /* Length of ->out array */
+  unsigned int out_len; /* Length of ->out array if have_output */
 
   hb_glyph_info_t     *info;
   hb_glyph_info_t     *out_info;
@@ -111,6 +111,8 @@ struct _hb_buffer_t {
 
 
   /* Methods */
+  inline unsigned int backtrack_len (void) const
+  { return this->have_output? this->out_len : this->i; }
   inline unsigned int next_serial (void) { return serial++; }
   inline void swap (void) { _hb_buffer_swap (this); }
   inline void clear_output (void) { _hb_buffer_clear_output (this); }
@@ -137,7 +139,6 @@ struct _hb_buffer_t {
 			 unsigned int cluster_start,
 			 unsigned int cluster_end)
   { _hb_buffer_set_masks (this, value, mask, cluster_start, cluster_end); }
-
 };
 
 
diff --git a/src/hb-buffer.cc b/src/hb-buffer.cc
index f50d87b1..04ae8c92 100644
--- a/src/hb-buffer.cc
+++ b/src/hb-buffer.cc
@@ -45,7 +45,7 @@ static hb_buffer_t _hb_buffer_nil = {
  *
  * As an optimization, both info and out_info may point to the
  * same piece of memory, which is owned by info.  This remains the
- * case as long as out_len doesn't exceed len at any time.
+ * case as long as out_len doesn't exceed i at any time.
  * In that case, swap() is no-op and the glyph operations operate
  * mostly in-place.
  *
diff --git a/src/hb-ot-layout-gsubgpos-private.hh b/src/hb-ot-layout-gsubgpos-private.hh
index c2b2eea8..f2aca6b8 100644
--- a/src/hb-ot-layout-gsubgpos-private.hh
+++ b/src/hb-ot-layout-gsubgpos-private.hh
@@ -155,10 +155,10 @@ static inline bool match_backtrack (hb_apply_context_t *c,
 				    match_func_t match_func,
 				    const void *match_data)
 {
-  if (unlikely (c->buffer->out_len < count))
+  if (unlikely (c->buffer->backtrack_len () < count))
     return false;
 
-  for (unsigned int i = 0, j = c->buffer->out_len - 1; i < count; i++, j--)
+  for (unsigned int i = 0, j = c->buffer->backtrack_len () - 1; i < count; i++, j--)
   {
     while (_hb_ot_layout_skip_mark (c->layout->face, &c->buffer->out_info[j], c->lookup_props, NULL))
     {
@@ -562,7 +562,7 @@ static inline bool chain_context_lookup (hb_apply_context_t *c,
 					 ChainContextLookupContext &lookup_context)
 {
   /* First guess */
-  if (unlikely (c->buffer->out_len < backtrackCount ||
+  if (unlikely (c->buffer->backtrack_len () < backtrackCount ||
 		c->buffer->i + inputCount + lookaheadCount > c->buffer->len ||
 		inputCount + lookaheadCount > c->context_length))
     return false;