[HarfBuzz] harfbuzz: Branch 'master' - 3 commits

[Behdad Esfahbod]

 src/hb-ot-layout-gsub-table.hh                                                      |    5 +++-
 src/hb-set.hh                                                                       |   12 +++++-----
 test/fuzzing/fonts/clusterfuzz-testcase-minimized-hb-subset-fuzzer-5067936541179904 |binary
 3 files changed, 10 insertions(+), 7 deletions(-)

New commits:
commit a9e0bdc35dfcbead7d4b6fa249d60ebedd7d43ca
Author: Behdad Esfahbod <behdad at behdad.org>
Date:   Thu Nov 22 21:30:04 2018 -0500

    [GSUB] Don't flush glyphset during recursion in closure()
    
    See comment.
    
    Supercedes https://github.com/harfbuzz/harfbuzz/pull/1401
    Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11366

diff --git a/src/hb-ot-layout-gsub-table.hh b/src/hb-ot-layout-gsub-table.hh
index 715317b5..501f2308 100644
--- a/src/hb-ot-layout-gsub-table.hh
+++ b/src/hb-ot-layout-gsub-table.hh
@@ -1449,7 +1449,10 @@ struct SubstLookup : Lookup
 
     hb_closure_context_t::return_t ret = dispatch_recurse_func (c, lookup_index);
 
-    c->flush ();
+    /* While in theory we should flush here, it will cause timeouts because a recursive
+     * lookup can keep growing the glyph set.  Skip, and outer loop will retry up to
+     * HB_CLOSURE_MAX_STAGES time, which should be enough for every realistic font. */
+    //c->flush ();
 
     return ret;
   }
commit 8982830d3ec54f50cc951de9569520fafc735e75
Author: Garret Rieger <grieger at google.com>
Date:   Mon Nov 19 13:00:24 2018 -0800

    [subset] add fuzzer testcase.

diff --git a/test/fuzzing/fonts/clusterfuzz-testcase-minimized-hb-subset-fuzzer-5067936541179904 b/test/fuzzing/fonts/clusterfuzz-testcase-minimized-hb-subset-fuzzer-5067936541179904
new file mode 100644
index 00000000..9f57f7be
Binary files /dev/null and b/test/fuzzing/fonts/clusterfuzz-testcase-minimized-hb-subset-fuzzer-5067936541179904 differ
commit d0e81b2cc85d09d01905c5fc5b3382c25eaa3bb3
Author: Behdad Esfahbod <behdad at behdad.org>
Date:   Thu Nov 22 21:20:39 2018 -0500

    [set] Rename

diff --git a/src/hb-set.hh b/src/hb-set.hh
index bc26ed3c..cc061a7c 100644
--- a/src/hb-set.hh
+++ b/src/hb-set.hh
@@ -341,11 +341,11 @@ struct hb_set_t
   {
     /* TODO perform op even if !successful. */
     if (unlikely (!successful)) return;
-    page_t *p = page_for (g);
-    if (!p)
+    page_t *page = page_for (g);
+    if (!page)
       return;
     dirty ();
-    p->del (g);
+    page->del (g);
   }
   inline void del_range (hb_codepoint_t a, hb_codepoint_t b)
   {
@@ -357,10 +357,10 @@ struct hb_set_t
   }
   inline bool has (hb_codepoint_t g) const
   {
-    const page_t *p = page_for (g);
-    if (!p)
+    const page_t *page = page_for (g);
+    if (!page)
       return false;
-    return p->has (g);
+    return page->has (g);
   }
   inline bool intersects (hb_codepoint_t first,
 			  hb_codepoint_t last) const