diff --git a/src/hb-aat-layout-morx-table.hh b/src/hb-aat-layout-morx-table.hh
index d2a66509c..766292b31 100644
--- a/src/hb-aat-layout-morx-table.hh
+++ b/src/hb-aat-layout-morx-table.hh
@@ -448,13 +448,13 @@ struct ChainSubtable
     Insertion		= 5
   };
 
-  inline void apply (hb_apply_context_t *c) const
+  inline void apply (hb_apply_context_t *c, const char *end) const
   {
-    dispatch (c);
+    dispatch (c, end);
   }
 
   template <typename context_t>
-  inline typename context_t::return_t dispatch (context_t *c) const
+  inline typename context_t::return_t dispatch (context_t *c, const char *end) const
   {
     unsigned int subtable_type = get_type ();
     TRACE_DISPATCH (this, subtable_type);
@@ -476,7 +476,7 @@ struct ChainSubtable
 	!c->check_range (this, length))
       return_trace (false);
 
-    return_trace (dispatch (c));
+    return_trace (dispatch (c, c->end));
   }
 
   protected:
@@ -496,13 +496,13 @@ struct ChainSubtable
 
 struct Chain
 {
-  inline void apply (hb_apply_context_t *c) const
+  inline void apply (hb_apply_context_t *c, const char *end) const
   {
     const ChainSubtable *subtable = &StructAtOffset<ChainSubtable> (featureZ, featureZ[0].static_size * featureCount);
     unsigned int count = subtableCount;
     for (unsigned int i = 0; i < count; i++)
     {
-      subtable->apply (c);
+      subtable->apply (c, end);
       subtable = &StructAfter<ChainSubtable> (*subtable);
     }
   }
@@ -555,13 +555,14 @@ struct morx
 {
   static const hb_tag_t tableTag = HB_AAT_TAG_MORX;
 
-  inline void apply (hb_apply_context_t *c) const
+  inline void apply (hb_apply_context_t *c, unsigned int length) const
   {
+    const char *end = (const char *) this + length;
     const Chain *chain = chains;
     unsigned int count = chainCount;
     for (unsigned int i = 0; i < count; i++)
     {
-      chain->apply (c);
+      chain->apply (c, end);
       chain = &StructAfter<Chain> (*chain);
     }
   }
diff --git a/src/hb-aat-layout.cc b/src/hb-aat-layout.cc
index 79f0ae65f..7455787f1 100644
--- a/src/hb-aat-layout.cc
+++ b/src/hb-aat-layout.cc
@@ -37,11 +37,20 @@
  */
 
 static inline const AAT::morx&
-_get_morx (hb_face_t *face)
+_get_morx (hb_face_t *face, unsigned int *length = nullptr)
 {
-  if (unlikely (!hb_ot_shaper_face_data_ensure (face))) return OT::Null(AAT::morx);
+  if (unlikely (!hb_ot_shaper_face_data_ensure (face)))
+  {
+    if (length)
+      *length = 0;
+    return OT::Null(AAT::morx);
+  }
   hb_ot_layout_t * layout = hb_ot_layout_from_face (face);
-  return *(layout->morx.get ()); /* XXX this doesn't call set_num_glyphs on sanitizer. */
+  /* XXX this doesn't call set_num_glyphs on sanitizer. */
+  const AAT::morx& morx = *(layout->morx.get ());
+  if (length)
+    *length = hb_blob_get_length (layout->morx.blob);
+  return morx;
 }
 
 static inline void
@@ -61,6 +70,7 @@ _hb_aat_layout_create (hb_face_t *face)
 void
 hb_aat_layout_substitute (OT::hb_apply_context_t *c)
 {
-  const AAT::morx& morx = _get_morx (c->face);
-  morx.apply (c);
+  unsigned int length;
+  const AAT::morx& morx = _get_morx (c->face, &length);
+  morx.apply (c, length);
 }
diff --git a/src/hb-open-type-private.hh b/src/hb-open-type-private.hh
index 736497d9b..04e4a4e1b 100644
--- a/src/hb-open-type-private.hh
+++ b/src/hb-open-type-private.hh
@@ -1145,8 +1145,8 @@ struct hb_lazy_table_loader_t
   inline void init (hb_face_t *face_)
   {
     face = face_;
-    instance = nullptr;
     blob = nullptr;
+    instance = nullptr;
   }
 
   inline void fini (void)
@@ -1177,10 +1177,10 @@ struct hb_lazy_table_loader_t
     return get();
   }
 
-  private:
   hb_face_t *face;
-  T *instance;
   mutable hb_blob_t *blob;
+  private:
+  mutable T *instance;
 };