[HarfBuzz] harfbuzz: Branch 'master' - 2 commits

[Behdad Esfahbod]

 src/hb-aat-layout-morx-table.hh |    8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

New commits:
commit 6aa019c4af6b64bb732205e6051f3e73e1b70721
Author: Behdad Esfahbod <behdad at behdad.org>
Date:   Fri Oct 26 22:02:17 2018 -0700

    [morx] Fix merge_cluster to end at last ligature component
    
    Don't assume current position was a component in the ligature.

diff --git a/src/hb-aat-layout-morx-table.hh b/src/hb-aat-layout-morx-table.hh
index 5b21358e..a5620910 100644
--- a/src/hb-aat-layout-morx-table.hh
+++ b/src/hb-aat-layout-morx-table.hh
@@ -443,6 +443,7 @@ struct LigatureSubtable
 	    DEBUG_MSG (APPLY, nullptr, "Produced ligature %d", lig);
 	    buffer->replace_glyph (lig);
 
+	    unsigned int lig_end = match_positions[match_length - 1] + 1;
 	    /* Now go and delete all subsequent components. */
 	    while (match_length - 1 > cursor)
 	    {
@@ -451,7 +452,7 @@ struct LigatureSubtable
 	      buffer->replace_glyph (DELETED_GLYPH);
 	    }
 
-	    buffer->move_to (end + 1);
+	    buffer->move_to (lig_end);
 	    buffer->merge_out_clusters (match_positions[cursor], buffer->out_len);
 	  }
 
commit 00ae4be6bf8b1d0800043167c5cf95187ac12515
Author: Behdad Esfahbod <behdad at behdad.org>
Date:   Fri Oct 26 21:59:20 2018 -0700

    [morx] Fix bailing out ligation at end-of-text
    
    Check was after a move_to, which wouldn't work.
    
    Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11147

diff --git a/src/hb-aat-layout-morx-table.hh b/src/hb-aat-layout-morx-table.hh
index 22a99443..5b21358e 100644
--- a/src/hb-aat-layout-morx-table.hh
+++ b/src/hb-aat-layout-morx-table.hh
@@ -399,6 +399,9 @@ struct LigatureSubtable
 	if (unlikely (!match_length))
 	  return true;
 
+	if (buffer->idx >= buffer->len)
+	  return false; // TODO Work on previous instead?
+
 	unsigned int cursor = match_length;
         do
 	{
@@ -421,8 +424,6 @@ struct LigatureSubtable
 	  if (uoffset & 0x20000000)
 	    uoffset |= 0xC0000000; /* Sign-extend. */
 	  int32_t offset = (int32_t) uoffset;
-	  if (buffer->idx >= buffer->len)
-	    return false; // TODO Work on previous instead?
 	  unsigned int component_idx = buffer->cur().codepoint + offset;
 
 	  const HBUINT16 &componentData = component[component_idx];