Merge branch 'master' into cff-subset

src/hb-aat-layout-ankr-table.hh

@@ -82,9 +82,9 @@ struct ankr
   protected:
   HBUINT16	version; 	/* Version number (set to zero) */
   HBUINT16	flags;		/* Flags (currently unused; set to zero) */
-  LOffsetTo<Lookup<Offset<HBUINT16, false> > >
+  LOffsetTo<Lookup<Offset<HBUINT16, false> >, false>
 		lookupTable;	/* Offset to the table's lookup table */
-  LOffsetTo<HBUINT8>
+  LOffsetTo<HBUINT8, false>
 		anchorData;	/* Offset to the glyph data table */
 
   public:

src/hb-aat-layout-common.hh

@@ -291,7 +291,9 @@ struct Lookup
   LookupFormat8<T>	format8;
   } u;
   public:
-  DEFINE_SIZE_UNION (2, format);
+  DEFINE_SIZE_MIN (0); /* 0 min size, makes sure this cannot be used on null pool,
+			* because Format0 has unbounded size depending on num_glyphs.
+			* We cannot define custom null bytes for a template :(. */
 };
 
 

src/hb-aat-layout-kerx-table.hh

@@ -278,10 +278,10 @@ struct KerxSubTableFormat2
   protected:
   KerxSubTableHeader	header;
   HBUINT32		rowWidth;	/* The width, in bytes, of a row in the table. */
-  LOffsetTo<Lookup<HBUINT16> >
+  LOffsetTo<Lookup<HBUINT16>, false>
 			leftClassTable;	/* Offset from beginning of this subtable to
 					 * left-hand class table. */
-  LOffsetTo<Lookup<HBUINT16> >
+  LOffsetTo<Lookup<HBUINT16>, false>
 			rightClassTable;/* Offset from beginning of this subtable to
 					 * right-hand class table. */
   LOffsetTo<UnsizedArrayOf<FWORD>, false>
@@ -514,16 +514,16 @@ struct KerxSubTableFormat6
   {
     TRACE_SANITIZE (this);
     return_trace (likely (c->check_struct (this) &&
-			  is_long () ?
-			  (
-			    u.l.rowIndexTable.sanitize (c, this) &&
-			    u.l.columnIndexTable.sanitize (c, this) &&
-			    c->check_range (this, u.l.array)
-			  ) : (
-			    u.s.rowIndexTable.sanitize (c, this) &&
-			    u.s.columnIndexTable.sanitize (c, this) &&
-			    c->check_range (this, u.s.array)
-			  )));
+			  (is_long () ?
+			   (
+			     u.l.rowIndexTable.sanitize (c, this) &&
+			     u.l.columnIndexTable.sanitize (c, this) &&
+			     c->check_range (this, u.l.array)
+			   ) : (
+			     u.s.rowIndexTable.sanitize (c, this) &&
+			     u.s.columnIndexTable.sanitize (c, this) &&
+			     c->check_range (this, u.s.array)
+			   ))));
   }
 
   struct accelerator_t
@@ -548,17 +548,15 @@ struct KerxSubTableFormat6
   {
     struct Long
     {
-      LOffsetTo<Lookup<HBUINT32> >	rowIndexTable;
-      LOffsetTo<Lookup<HBUINT32> >	columnIndexTable;
-      LOffsetTo<UnsizedArrayOf<FWORD32>, false>
-					array;
+      LOffsetTo<Lookup<HBUINT32>, false>	rowIndexTable;
+      LOffsetTo<Lookup<HBUINT32>, false>	columnIndexTable;
+      LOffsetTo<UnsizedArrayOf<FWORD32>, false>	array;
     } l;
     struct Short
     {
-      LOffsetTo<Lookup<HBUINT16> >	rowIndexTable;
-      LOffsetTo<Lookup<HBUINT16> >	columnIndexTable;
-      LOffsetTo<UnsizedArrayOf<FWORD>, false>
-					array;
+      LOffsetTo<Lookup<HBUINT16>, false>	rowIndexTable;
+      LOffsetTo<Lookup<HBUINT16>, false>	columnIndexTable;
+      LOffsetTo<UnsizedArrayOf<FWORD>, false>	array;
     } s;
   } u;
   public:

src/hb-aat-layout-morx-table.hh

@@ -270,7 +270,7 @@ struct ContextualSubtable
     private:
     bool mark_set;
     unsigned int mark;
-    const UnsizedOffsetListOf<Lookup<GlyphID>, HBUINT32> &subs;
+    const UnsizedOffsetListOf<Lookup<GlyphID>, HBUINT32, false> &subs;
   };
 
   inline bool apply (hb_aat_apply_context_t *c) const
@@ -311,7 +311,7 @@ struct ContextualSubtable
   protected:
   StateTable<EntryData>
 		machine;
-  LOffsetTo<UnsizedOffsetListOf<Lookup<GlyphID>, HBUINT32>, false>
+  LOffsetTo<UnsizedOffsetListOf<Lookup<GlyphID>, HBUINT32, false>, false>
 		substitutionTables;
   public:
   DEFINE_SIZE_STATIC (20);
@@ -393,16 +393,18 @@ struct LigatureSubtable
 	unsigned int ligature_idx = 0;
 
 	if (unlikely (!match_length))
-	  return false;
+	  return true;
 
+	/* TODO Only when ligation happens? */
 	buffer->merge_out_clusters (match_positions[0], buffer->out_len);
 
+	unsigned int cursor = match_length;
         do
 	{
-	  if (unlikely (!match_length))
-	    return false;
+	  if (unlikely (!cursor))
+	    break;
 
-	  buffer->move_to (match_positions[--match_length]);
+	  buffer->move_to (match_positions[--cursor]);
 
 	  const HBUINT32 &actionData = ligAction[action_idx];
 	  if (unlikely (!actionData.sanitize (&c->sanitizer))) return false;
@@ -410,7 +412,7 @@ struct LigatureSubtable
 
 	  uint32_t uoffset = action & LigActionOffset;
 	  if (uoffset & 0x20000000)
-	    uoffset += 0xC0000000;
+	    uoffset |= 0xC0000000; /* Sign-extend. */
 	  int32_t offset = (int32_t) uoffset;
 	  if (buffer->idx >= buffer->len)
 	    return false; // TODO Work on previous instead?
@@ -426,20 +428,21 @@ struct LigatureSubtable
 	    if (unlikely (!ligatureData.sanitize (&c->sanitizer))) return false;
 	    hb_codepoint_t lig = ligatureData;
 
-	    match_positions[match_length++] = buffer->out_len;
 	    buffer->replace_glyph (lig);
 
-	    //ligature_idx = 0; // XXX Yes or no?
-	  }
-	  else
-	  {
-	    buffer->skip_glyph ();
-	    end--;
+	    /* Now go and delete all subsequent components. */
+	    while (match_length - 1 > cursor)
+	    {
+	      buffer->move_to (match_positions[--match_length]);
+	      buffer->skip_glyph ();
+	      end--;
+	    }
 	  }
 
 	  action_idx++;
 	}
 	while (!(action & LigActionLast));
+	match_length = 0;
 	buffer->move_to (end);
       }
 

src/hb-buffer.cc

@@ -359,6 +359,8 @@ hb_buffer_t::replace_glyphs (unsigned int num_in,
 {
   if (unlikely (!make_room_for (num_in, num_out))) return;
 
+  assert (idx + num_in <= len);
+
   merge_clusters (idx, idx + num_in);
 
   hb_glyph_info_t orig_info = info[idx];

src/hb-open-type.hh

@@ -385,12 +385,12 @@ struct UnsizedArrayOf
 };
 
 /* Unsized array of offset's */
-template <typename Type, typename OffsetType>
-struct UnsizedOffsetArrayOf : UnsizedArrayOf<OffsetTo<Type, OffsetType> > {};
+template <typename Type, typename OffsetType, bool has_null=true>
+struct UnsizedOffsetArrayOf : UnsizedArrayOf<OffsetTo<Type, OffsetType, has_null> > {};
 
 /* Unsized array of offsets relative to the beginning of the array itself. */
-template <typename Type, typename OffsetType>
-struct UnsizedOffsetListOf : UnsizedOffsetArrayOf<Type, OffsetType>
+template <typename Type, typename OffsetType, bool has_null=true>
+struct UnsizedOffsetListOf : UnsizedOffsetArrayOf<Type, OffsetType, has_null>
 {
   inline const Type& operator [] (unsigned int i) const
   {
@@ -400,13 +400,13 @@ struct UnsizedOffsetListOf : UnsizedOffsetArrayOf<Type, OffsetType>
   inline bool sanitize (hb_sanitize_context_t *c, unsigned int count) const
   {
     TRACE_SANITIZE (this);
-    return_trace ((UnsizedOffsetArrayOf<Type, OffsetType>::sanitize (c, count, this)));
+    return_trace ((UnsizedOffsetArrayOf<Type, OffsetType, has_null>::sanitize (c, count, this)));
   }
   template <typename T>
   inline bool sanitize (hb_sanitize_context_t *c, unsigned int count, T user_data) const
   {
     TRACE_SANITIZE (this);
-    return_trace ((UnsizedOffsetArrayOf<Type, OffsetType>::sanitize (c, count, this, user_data)));
+    return_trace ((UnsizedOffsetArrayOf<Type, OffsetType, has_null>::sanitize (c, count, this, user_data)));
   }
 };
 

src/hb-ot-color-cbdt-table.hh

@@ -209,9 +209,10 @@ struct IndexSubtableRecord
 		  offsetToSubtable.sanitize (c, base, lastGlyphIndex - firstGlyphIndex + 1));
   }
 
-  inline bool get_extents (hb_glyph_extents_t *extents) const
+  inline bool get_extents (hb_glyph_extents_t *extents,
+			   const void *base) const
   {
-    return (this+offsetToSubtable).get_extents (extents);
+    return (base+offsetToSubtable).get_extents (extents);
   }
 
   bool get_image_data (unsigned int  gid,
@@ -420,7 +421,7 @@ struct CBDT
       if (!subtable_record || !x_ppem || !y_ppem)
 	return false;
 
-      if (subtable_record->get_extents (extents))
+      if (subtable_record->get_extents (extents, base))
 	return true;
 
       unsigned int image_offset = 0, image_length = 0, image_format = 0;

src/hb-ot-kern-table.hh

@@ -38,9 +38,10 @@ struct hb_kern_machine_t
   hb_kern_machine_t (const Driver &driver_) : driver (driver_) {}
 
   HB_NO_SANITIZE_SIGNED_INTEGER_OVERFLOW
-  inline void kern (hb_font_t *font,
-		    hb_buffer_t  *buffer,
-		    hb_mask_t kern_mask) const
+  inline void kern (hb_font_t   *font,
+		    hb_buffer_t *buffer,
+		    hb_mask_t    kern_mask,
+		    bool         scale = true) const
   {
     OT::hb_ot_apply_context_t c (1, font, buffer);
     c.set_lookup_mask (kern_mask);
@@ -69,7 +70,6 @@ struct hb_kern_machine_t
 
       unsigned int i = idx;
       unsigned int j = skippy_iter.idx;
-      hb_position_t kern1, kern2;
 
       hb_position_t kern = driver.get_kerning (info[i].codepoint,
 					       info[j].codepoint);
@@ -78,17 +78,23 @@ struct hb_kern_machine_t
       if (likely (!kern))
         goto skip;
 
-      kern1 = kern >> 1;
-      kern2 = kern - kern1;
 
       if (horizontal)
       {
+        if (scale)
+	  kern = font->em_scale_x (kern);
+	hb_position_t kern1 = kern >> 1;
+	hb_position_t kern2 = kern - kern1;
 	pos[i].x_advance += kern1;
 	pos[j].x_advance += kern2;
 	pos[j].x_offset += kern2;
       }
       else
       {
+        if (scale)
+	  kern = font->em_scale_y (kern);
+	hb_position_t kern1 = kern >> 1;
+	hb_position_t kern2 = kern - kern1;
 	pos[i].y_advance += kern1;
 	pos[j].y_advance += kern2;
 	pos[j].y_offset += kern2;

src/hb-ot-layout-gpos-table.hh

@@ -1658,7 +1658,10 @@ reverse_cursive_minor_offset (hb_glyph_position_t *pos, unsigned int i, hb_direc
   pos[j].attach_type() = type;
 }
 static void
-propagate_attachment_offsets (hb_glyph_position_t *pos, unsigned int i, hb_direction_t direction)
+propagate_attachment_offsets (hb_glyph_position_t *pos,
+			      unsigned int len,
+			      unsigned int i,
+			      hb_direction_t direction)
 {
   /* Adjusts offsets of attached glyphs (both cursive and mark) to accumulate
    * offset of glyph they are attached to. */
@@ -1666,11 +1669,14 @@ propagate_attachment_offsets (hb_glyph_position_t *pos, unsigned int i, hb_direc
   if (likely (!chain))
     return;
 
+  pos[i].attach_chain() = 0;
+
   unsigned int j = (int) i + chain;
 
-  pos[i].attach_chain() = 0;
+  if (unlikely (j >= len))
+    return;
 
-  propagate_attachment_offsets (pos, j, direction);
+  propagate_attachment_offsets (pos, len, j, direction);
 
   assert (!!(type & ATTACH_TYPE_MARK) ^ !!(type & ATTACH_TYPE_CURSIVE));
 
@@ -1726,7 +1732,7 @@ GPOS::position_finish_offsets (hb_font_t *font HB_UNUSED, hb_buffer_t *buffer)
   /* Handle attachments */
   if (buffer->scratch_flags & HB_BUFFER_SCRATCH_FLAG_HAS_GPOS_ATTACHMENT)
     for (unsigned int i = 0; i < len; i++)
-      propagate_attachment_offsets (pos, i, direction);
+      propagate_attachment_offsets (pos, len, i, direction);
 }
 
 

src/hb-ot-layout.cc

@@ -1197,7 +1197,7 @@ hb_ot_layout_feature_get_name_ids (hb_face_t    *face,
  *                called with an offset till resulting char_count gets to a number
  *                lower than input buffer (or consider using just a bigger buffer for
  *                one shot copying).
- * @char_count: (in/out) (allow-none): The count of characters for which this feature
+ * @char_count: (inout) (allow-none): The count of characters for which this feature
  *              provides glyph variants. (May be zero.)
  * @characters: (out) (allow-none): A buffer pointer. The Unicode Scalar Value
  *              of the characters for which this feature provides glyph variants.

src/hb-ot-shape-fallback.cc

@@ -466,7 +466,7 @@ _hb_ot_shape_fallback_kern (const hb_ot_shape_plan_t *plan,
     return;
   hb_ot_shape_fallback_kern_driver_t driver (font, buffer);
   hb_kern_machine_t<hb_ot_shape_fallback_kern_driver_t> machine (driver);
-  machine.kern (font, buffer, plan->kern_mask);
+  machine.kern (font, buffer, plan->kern_mask, false);
 }
 
 

src/hb-ot-tag.cc

@@ -327,11 +327,11 @@ parse_private_use_subtag (const char     *private_use_subtag,
  * @language: an #hb_language_t to convert.
  * @script_count: (allow-none): maximum number of script tags to retrieve (IN)
  * and actual number of script tags retrieved (OUT)
- * @script_tags: (allow-none): array of size at least @script_count to store the
+ * @script_tags: (out) (allow-none): array of size at least @script_count to store the
  * script tag results
  * @language_count: (allow-none): maximum number of language tags to retrieve
  * (IN) and actual number of language tags retrieved (OUT)
- * @language_tags: (allow-none): array of size at least @language_count to store
+ * @language_tags: (out) (allow-none): array of size at least @language_count to store
  * the language tag results
  *
  * Converts an #hb_script_t and an #hb_language_t to script and language tags.

test/api/CMakeLists.txt

@@ -4,7 +4,7 @@ if (HB_HAVE_GLIB)
 
   list (APPEND TEST_PROGS
     test-ot-color
-    test-ot-nameid
+    test-ot-name
     test-ot-tag
     test-c
     test-cplusplus

test/api/Makefile.am

@@ -75,7 +75,7 @@ endif
 
 TEST_PROGS += \
 	test-ot-color \
-	test-ot-nameid \
+	test-ot-name \
 	test-ot-tag \
 	test-ot-extents-cff \
 	$(NULL)

test/api/test-multithread.c

@@ -154,13 +154,15 @@ main (int argc, char **argv)
   hb_face_t *face = hb_face_create (blob, 0);
   font = hb_font_create (face);
 
-  hb_ot_font_set_funcs (font);
-
+  /* Fill the reference */
   ref_buffer = hb_buffer_create ();
   fill_the_buffer (ref_buffer);
 
+  /* Unnecessary, since version 2 it is ot-font by default */
+  hb_ot_font_set_funcs (font);
   test_body ();
 
+  /* Test hb-ft in multithread */
   hb_ft_font_set_funcs (font);
   test_body ();
 

test/api/test-ot-name.c

@@ -23,35 +23,16 @@
  *
  */
 
-#include <hb.h>
+#include "hb-test.h"
+
 #include <hb-ot.h>
-#include <glib.h>
 
 static const char *font_path = "fonts/cv01.otf";
+static hb_face_t *face;
 
-int
-main (int argc, char **argv)
+static void
+test_ot_layout_feature_get_name_ids_and_characters ()
 {
-  g_test_init (&argc, &argv, NULL);
-
-#if GLIB_CHECK_VERSION(2,37,2)
-  gchar *default_path = g_test_build_filename (G_TEST_DIST, font_path, NULL);
-#else
-  gchar *default_path = g_strdup (font_path);
-#endif
-
-  hb_blob_t *blob;
-  hb_face_t *face;
-  hb_font_t *font;
-
-  char *path = argc > 1 && *argv[1] ? argv[1] : (char *) default_path;
-  blob = hb_blob_create_from_file (path);
-  if (hb_blob_get_length (blob) == 0)
-    g_error ("Font not found.");
-
-  face = hb_face_create (blob, 0);
-  font = hb_font_create (face);
-
   hb_tag_t cv01 = HB_TAG ('c','v','0','1');
   unsigned int feature_index;
   if (!hb_ot_layout_language_find_feature (face,
@@ -89,12 +70,33 @@ main (int argc, char **argv)
   g_assert (char_count == 2);
   g_assert (characters[0] == 10);
   g_assert (characters[1] == 24030);
+}
+
+int
+main (int argc, char **argv)
+{
+  g_test_init (&argc, &argv, NULL);
+
+#if GLIB_CHECK_VERSION(2,37,2)
+  gchar *default_path = g_test_build_filename (G_TEST_DIST, font_path, NULL);
+#else
+  gchar *default_path = g_strdup (font_path);
+#endif
+
+  hb_blob_t *blob;
+
+  char *path = argc > 1 && *argv[1] ? argv[1] : (char *) default_path;
+  blob = hb_blob_create_from_file (path);
+  if (hb_blob_get_length (blob) == 0)
+    g_error ("Font not found.");
 
-  hb_font_destroy (font);
+  face = hb_face_create (blob, 0);
+
+  hb_test_add (test_ot_layout_feature_get_name_ids_and_characters);
+
+  unsigned int result = hb_test_run ();
   hb_face_destroy (face);
   hb_blob_destroy (blob);
-
   g_free (default_path);
-
-  return 0;
+  return result;
 }

test/fuzzing/Makefile.am

@@ -18,6 +18,7 @@ EXTRA_DIST += \
 	run-shape-fuzzer-tests.py \
 	run-subset-fuzzer-tests.py \
 	CMakeLists.txt \
+	fonts \
 	$(NULL)
 
 check_PROGRAMS = \