[subset] fixes infinite loop in hb_set_get_max().

Fixes https://oss-fuzz.com/testcase-detail/5363902507515904

src/hb-set.hh

@@ -832,7 +832,7 @@ struct hb_set_t
   hb_codepoint_t get_max () const
   {
     unsigned int count = pages.length;
-    for (int i = count - 1; i >= 0; i++)
+    for (int i = count - 1; i >= 0; i--)
       if (!page_at (i).is_empty ())
 	return page_map[(unsigned) i].major * page_t::PAGE_BITS + page_at (i).get_max ();
     return INVALID;

test/api/test-set.c

@@ -121,6 +121,11 @@ test_set_basic (void)
   hb_set_del (s, 800);
   g_assert (!hb_set_has (s, 800));
 
+  g_assert_cmpint (hb_set_get_max (s), ==, 799);
+
+  hb_set_del_range (s, 0, 799);
+  g_assert_cmpint (hb_set_get_max (s), ==, HB_SET_VALUE_INVALID);
+
   hb_set_destroy (s);
 }