diff --git a/src/hb-subset-cff1.cc b/src/hb-subset-cff1.cc
index 900d829a9..b71db122c 100644
--- a/src/hb-subset-cff1.cc
+++ b/src/hb-subset-cff1.cc
@@ -556,13 +556,7 @@ struct cff1_subset_plan
       if (sid != last_sid + 1)
       {
 	code_pair_t pair { sid, glyph };
-	// This is stupid to do manually but it does show speedup.
-	// We should find up where the slowdown comes from in push()
-	// and fix it.
-	if ((int) subset_charset_ranges.length < subset_charset_ranges.allocated)
-	  subset_charset_ranges.arrayZ[subset_charset_ranges.length++] = pair;
-	else
-	  subset_charset_ranges.push (pair);
+	subset_charset_ranges.push (pair);
       }
       last_sid = sid;
     }
diff --git a/src/hb-vector.hh b/src/hb-vector.hh
index 7cf237933..12d07ea03 100644
--- a/src/hb-vector.hh
+++ b/src/hb-vector.hh
@@ -228,15 +228,14 @@ struct hb_vector_t
 	    hb_enable_if (std::is_copy_constructible<T2>::value)>
   Type *push (T&& v)
   {
-    if (unlikely (!alloc (length + 1)))
+    if (unlikely ((int) length >= allocated && !alloc (length + 1)))
       // If push failed to allocate then don't copy v, since this may cause
       // the created copy to leak memory since we won't have stored a
       // reference to it.
       return std::addressof (Crap (Type));
 
     /* Emplace. */
-    length++;
-    Type *p = std::addressof (arrayZ[length - 1]);
+    Type *p = std::addressof (arrayZ[length++]);
     return new (p) Type (std::forward<T> (v));
   }