8139012: Better font substitutions

Reviewed-by: prr, srl, mschoene

src/share/native/sun/font/layout/ContextualSubstSubtables.cpp

@@ -243,14 +243,14 @@ le_uint32 ContextualSubstitutionFormat1Subtable::process(const LETableReference
         le_uint16 srSetCount = SWAPW(subRuleSetCount);
 
         if (coverageIndex < srSetCount) {
-            LEReferenceToArrayOf<Offset> subRuleSetTableOffsetArrayRef(base, success,
-                    &subRuleSetTableOffsetArray[coverageIndex], 1);
+            LEReferenceToArrayOf<Offset>
+                subRuleSetTableOffsetArrayRef(base, success, subRuleSetTableOffsetArray, srSetCount);
             if (LE_FAILURE(success)) {
                 return 0;
             }
             Offset subRuleSetTableOffset = SWAPW(subRuleSetTableOffsetArray[coverageIndex]);
-            LEReferenceTo<SubRuleSetTable>
-                 subRuleSetTable(base, success, (const SubRuleSetTable *) ((char *) this + subRuleSetTableOffset));
+            LEReferenceTo<SubRuleSetTable> subRuleSetTable(base, success, subRuleSetTableOffset);
+            if (LE_FAILURE(success)) { return 0; }
             le_uint16 subRuleCount = SWAPW(subRuleSetTable->subRuleCount);
             le_int32 position = glyphIterator->getCurrStreamPosition();
 
@@ -264,6 +264,7 @@ le_uint32 ContextualSubstitutionFormat1Subtable::process(const LETableReference
                     SWAPW(subRuleSetTable->subRuleTableOffsetArray[subRule]);
                 LEReferenceTo<SubRuleTable>
                      subRuleTable(subRuleSetTable, success, subRuleTableOffset);
+                if (LE_FAILURE(success)) { return 0; }
                 le_uint16 matchCount = SWAPW(subRuleTable->glyphCount) - 1;
                 le_uint16 substCount = SWAPW(subRuleTable->substCount);
                 LEReferenceToArrayOf<TTGlyphID> inputGlyphArray(base, success, subRuleTable->inputGlyphArray, matchCount+2);
@@ -304,8 +305,8 @@ le_uint32 ContextualSubstitutionFormat2Subtable::process(const LETableReference
     }
 
     if (coverageIndex >= 0) {
-        LEReferenceTo<ClassDefinitionTable> classDefinitionTable(base, success,
-                                                                 (const ClassDefinitionTable *) ((char *) this + SWAPW(classDefTableOffset)));
+        LEReferenceTo<ClassDefinitionTable> classDefinitionTable(base, success, SWAPW(classDefTableOffset));
+        if (LE_FAILURE(success)) { return 0; }
         le_uint16 scSetCount = SWAPW(subClassSetCount);
         le_int32 setClass = classDefinitionTable->getGlyphClass(classDefinitionTable,
                                                                 glyphIterator->getCurrGlyphID(),
@@ -313,44 +314,45 @@ le_uint32 ContextualSubstitutionFormat2Subtable::process(const LETableReference
 
         if (setClass < scSetCount) {
             LEReferenceToArrayOf<Offset>
-                 subClassSetTableOffsetArrayRef(base, success, subClassSetTableOffsetArray, setClass);
+                subClassSetTableOffsetArrayRef(base, success, subClassSetTableOffsetArray, scSetCount);
             if (LE_FAILURE(success)) { return 0; }
             if (subClassSetTableOffsetArray[setClass] != 0) {
 
-            Offset subClassSetTableOffset = SWAPW(subClassSetTableOffsetArray[setClass]);
-            LEReferenceTo<SubClassSetTable>
-                 subClassSetTable(base, success, (const SubClassSetTable *) ((char *) this + subClassSetTableOffset));
-            le_uint16 subClassRuleCount = SWAPW(subClassSetTable->subClassRuleCount);
-            le_int32 position = glyphIterator->getCurrStreamPosition();
+                Offset subClassSetTableOffset = SWAPW(subClassSetTableOffsetArray[setClass]);
+                LEReferenceTo<SubClassSetTable> subClassSetTable(base, success, subClassSetTableOffset);
+                if (LE_FAILURE(success)) { return 0; }
+                le_uint16 subClassRuleCount = SWAPW(subClassSetTable->subClassRuleCount);
+                le_int32 position = glyphIterator->getCurrStreamPosition();
                 LEReferenceToArrayOf<Offset>
                     subClassRuleTableOffsetArrayRef(base, success, subClassSetTable->subClassRuleTableOffsetArray, subClassRuleCount);
                 if (LE_FAILURE(success)) {
                     return 0;
                 }
-            for (le_uint16 scRule = 0; scRule < subClassRuleCount; scRule += 1) {
-                Offset subClassRuleTableOffset =
-                    SWAPW(subClassSetTable->subClassRuleTableOffsetArray[scRule]);
-                LEReferenceTo<SubClassRuleTable>
-                     subClassRuleTable(subClassSetTable, success, subClassRuleTableOffset);
-                le_uint16 matchCount = SWAPW(subClassRuleTable->glyphCount) - 1;
-                le_uint16 substCount = SWAPW(subClassRuleTable->substCount);
+                for (le_uint16 scRule = 0; scRule < subClassRuleCount; scRule += 1) {
+                    Offset subClassRuleTableOffset =
+                        SWAPW(subClassSetTable->subClassRuleTableOffsetArray[scRule]);
+                    LEReferenceTo<SubClassRuleTable>
+                        subClassRuleTable(subClassSetTable, success, subClassRuleTableOffset);
+                    if (LE_FAILURE(success)) { return 0; }
+                    le_uint16 matchCount = SWAPW(subClassRuleTable->glyphCount) - 1;
+                    le_uint16 substCount = SWAPW(subClassRuleTable->substCount);
 
-                LEReferenceToArrayOf<le_uint16> classArray(base, success, subClassRuleTable->classArray, matchCount+1);
+                    LEReferenceToArrayOf<le_uint16> classArray(base, success, subClassRuleTable->classArray, matchCount+1);
 
-                if (LE_FAILURE(success)) { return 0; }
-                if (matchGlyphClasses(classArray, matchCount, glyphIterator, classDefinitionTable, success)) {
-                    LEReferenceToArrayOf<SubstitutionLookupRecord>
-                      substLookupRecordArray(base, success, (const SubstitutionLookupRecord *) &subClassRuleTable->classArray[matchCount], substCount);
+                    if (LE_FAILURE(success)) { return 0; }
+                    if (matchGlyphClasses(classArray, matchCount, glyphIterator, classDefinitionTable, success)) {
+                        LEReferenceToArrayOf<SubstitutionLookupRecord>
+                          substLookupRecordArray(base, success, (const SubstitutionLookupRecord *) &subClassRuleTable->classArray[matchCount], substCount);
 
-                    applySubstitutionLookups(lookupProcessor, substLookupRecordArray, substCount, glyphIterator, fontInstance, position, success);
+                        applySubstitutionLookups(lookupProcessor, substLookupRecordArray, substCount, glyphIterator, fontInstance, position, success);
 
-                    return matchCount + 1;
-                }
+                        return matchCount + 1;
+                    }
 
-                glyphIterator->setCurrStreamPosition(position);
+                    glyphIterator->setCurrStreamPosition(position);
+                }
             }
         }
-        }
 
         // XXX If we get here, the table is mal-formed...
     }
@@ -463,13 +465,13 @@ le_uint32 ChainingContextualSubstitutionFormat1Subtable::process(const LETableRe
 
         if (coverageIndex < srSetCount) {
             LEReferenceToArrayOf<Offset>
-                chainSubRuleSetTableOffsetArrayRef(base, success, chainSubRuleSetTableOffsetArray, coverageIndex);
+                chainSubRuleSetTableOffsetArrayRef(base, success, chainSubRuleSetTableOffsetArray, srSetCount);
             if (LE_FAILURE(success)) {
                 return 0;
             }
             Offset chainSubRuleSetTableOffset = SWAPW(chainSubRuleSetTableOffsetArray[coverageIndex]);
-            LEReferenceTo<ChainSubRuleSetTable>
-                 chainSubRuleSetTable(base, success, (const ChainSubRuleSetTable *) ((char *) this + chainSubRuleSetTableOffset));
+            LEReferenceTo<ChainSubRuleSetTable> chainSubRuleSetTable(base, success, chainSubRuleSetTableOffset);
+            if (LE_FAILURE(success)) { return 0; }
             le_uint16 chainSubRuleCount = SWAPW(chainSubRuleSetTable->chainSubRuleCount);
             le_int32 position = glyphIterator->getCurrStreamPosition();
             GlyphIterator tempIterator(*glyphIterator, emptyFeatureList);
@@ -550,17 +552,17 @@ le_uint32 ChainingContextualSubstitutionFormat2Subtable::process(const LETableRe
 
     if (coverageIndex >= 0) {
         LEReferenceTo<ClassDefinitionTable>
-             backtrackClassDefinitionTable(base, success, (const ClassDefinitionTable *) ((char *) this + SWAPW(backtrackClassDefTableOffset)));
+             backtrackClassDefinitionTable(base, success, SWAPW(backtrackClassDefTableOffset));
         LEReferenceTo<ClassDefinitionTable>
-             inputClassDefinitionTable(base, success, (const ClassDefinitionTable *) ((char *) this + SWAPW(inputClassDefTableOffset)));
+             inputClassDefinitionTable(base, success, SWAPW(inputClassDefTableOffset));
         LEReferenceTo<ClassDefinitionTable>
-             lookaheadClassDefinitionTable(base, success, (const ClassDefinitionTable *) ((char *) this + SWAPW(lookaheadClassDefTableOffset)));
+             lookaheadClassDefinitionTable(base, success, SWAPW(lookaheadClassDefTableOffset));
         le_uint16 scSetCount = SWAPW(chainSubClassSetCount);
         le_int32 setClass = inputClassDefinitionTable->getGlyphClass(inputClassDefinitionTable,
                                                                      glyphIterator->getCurrGlyphID(),
                                                                      success);
         LEReferenceToArrayOf<Offset>
-            chainSubClassSetTableOffsetArrayRef(base, success, chainSubClassSetTableOffsetArray, setClass);
+            chainSubClassSetTableOffsetArrayRef(base, success, chainSubClassSetTableOffsetArray, scSetCount);
         if (LE_FAILURE(success)) {
             return 0;
         }
@@ -568,7 +570,8 @@ le_uint32 ChainingContextualSubstitutionFormat2Subtable::process(const LETableRe
         if (setClass < scSetCount && chainSubClassSetTableOffsetArray[setClass] != 0) {
             Offset chainSubClassSetTableOffset = SWAPW(chainSubClassSetTableOffsetArray[setClass]);
             LEReferenceTo<ChainSubClassSetTable>
-                 chainSubClassSetTable(base, success, (const ChainSubClassSetTable *) ((char *) this + chainSubClassSetTableOffset));
+                 chainSubClassSetTable(base, success, chainSubClassSetTableOffset);
+            if (LE_FAILURE(success)) { return 0; }
             le_uint16 chainSubClassRuleCount = SWAPW(chainSubClassSetTable->chainSubClassRuleCount);
             le_int32 position = glyphIterator->getCurrStreamPosition();
             GlyphIterator tempIterator(*glyphIterator, emptyFeatureList);
@@ -582,6 +585,7 @@ le_uint32 ChainingContextualSubstitutionFormat2Subtable::process(const LETableRe
                     SWAPW(chainSubClassSetTable->chainSubClassRuleTableOffsetArray[scRule]);
                 LEReferenceTo<ChainSubClassRuleTable>
                      chainSubClassRuleTable(chainSubClassSetTable, success, chainSubClassRuleTableOffset);
+                if (LE_FAILURE(success)) { return 0; }
                 le_uint16 backtrackGlyphCount = SWAPW(chainSubClassRuleTable->backtrackGlyphCount);
                 LEReferenceToArrayOf<le_uint16>   backtrackClassArray(base, success, chainSubClassRuleTable->backtrackClassArray, backtrackGlyphCount);
                 if( LE_FAILURE(success) ) { return 0; }

src/share/native/sun/font/layout/CursiveAttachmentSubtables.cpp

@@ -46,7 +46,7 @@ le_uint32 CursiveAttachmentSubtable::process(const LEReferenceTo<CursiveAttachme
     le_uint16 eeCount       = SWAPW(entryExitCount);
 
     LEReferenceToArrayOf<EntryExitRecord>
-        entryExitRecordsArrayRef(base, success, entryExitRecords, coverageIndex);
+        entryExitRecordsArrayRef(base, success, entryExitRecords, eeCount);
 
     if (coverageIndex < 0 || coverageIndex >= eeCount || LE_FAILURE(success)) {
         glyphIterator->setCursiveGlyph();

src/share/native/sun/font/layout/Features.cpp

@@ -41,7 +41,7 @@ U_NAMESPACE_BEGIN
 LEReferenceTo<FeatureTable> FeatureListTable::getFeatureTable(const LETableReference &base, le_uint16 featureIndex, LETag *featureTag, LEErrorCode &success) const
 {
     LEReferenceToArrayOf<FeatureRecord>
-        featureRecordArrayRef(base, success, featureRecordArray, featureIndex+1);
+        featureRecordArrayRef(base, success, featureRecordArray, SWAPW(featureCount));
 
   if (featureIndex >= SWAPW(featureCount) || LE_FAILURE(success)) {
     return LEReferenceTo<FeatureTable>();

src/share/native/sun/font/layout/MarkToBasePosnSubtables.cpp

@@ -93,7 +93,7 @@ le_int32 MarkToBasePositioningSubtable::process(const LETableReference &base, Gl
     }
     LEReferenceTo<BaseRecord> baseRecord(base, success, &baseArray->baseRecordArray[baseCoverage * mcCount]);
     if( LE_FAILURE(success) ) { return 0; }
-    LEReferenceToArrayOf<Offset> baseAnchorTableOffsetArray(base, success, &(baseRecord->baseAnchorTableOffsetArray[0]), markClass+1);
+    LEReferenceToArrayOf<Offset> baseAnchorTableOffsetArray(base, success, &(baseRecord->baseAnchorTableOffsetArray[0]), mcCount);
 
     if( LE_FAILURE(success) ) { return 0; }
     Offset anchorTableOffset = SWAPW(baseRecord->baseAnchorTableOffsetArray[markClass]);

src/share/native/sun/font/layout/MarkToLigaturePosnSubtables.cpp

@@ -83,6 +83,7 @@ le_int32 MarkToLigaturePositioningSubtable::process(const LETableReference &base
     LEGlyphID ligatureGlyph = findLigatureGlyph(&ligatureIterator);
     le_int32 ligatureCoverage = getBaseCoverage(base, (LEGlyphID) ligatureGlyph, success);
     LEReferenceTo<LigatureArray> ligatureArray(base, success, SWAPW(baseArrayOffset));
+    if (LE_FAILURE(success)) { return 0; }
     le_uint16 ligatureCount = SWAPW(ligatureArray->ligatureCount);
 
     if (ligatureCoverage < 0 || ligatureCoverage >= ligatureCount) {
@@ -95,6 +96,7 @@ le_int32 MarkToLigaturePositioningSubtable::process(const LETableReference &base
     le_int32 markPosition = glyphIterator->getCurrStreamPosition();
     Offset ligatureAttachOffset = SWAPW(ligatureArray->ligatureAttachTableOffsetArray[ligatureCoverage]);
     LEReferenceTo<LigatureAttachTable> ligatureAttachTable(ligatureArray, success, ligatureAttachOffset);
+    if (LE_FAILURE(success)) { return 0; }
     le_int32 componentCount = SWAPW(ligatureAttachTable->componentCount);
     le_int32 component = ligatureIterator.getMarkComponent(markPosition);
 
@@ -104,10 +106,12 @@ le_int32 MarkToLigaturePositioningSubtable::process(const LETableReference &base
     }
 
     LEReferenceTo<ComponentRecord> componentRecord(base, success, &ligatureAttachTable->componentRecordArray[component * mcCount]);
-    LEReferenceToArrayOf<Offset> ligatureAnchorTableOffsetArray(base, success, &(componentRecord->ligatureAnchorTableOffsetArray[0]), markClass+1);
+    if (LE_FAILURE(success)) { return 0; }
+    LEReferenceToArrayOf<Offset> ligatureAnchorTableOffsetArray(base, success, &(componentRecord->ligatureAnchorTableOffsetArray[0]), mcCount);
     if( LE_FAILURE(success) ) { return 0; }
     Offset anchorTableOffset = SWAPW(componentRecord->ligatureAnchorTableOffsetArray[markClass]);
     LEReferenceTo<AnchorTable> anchorTable(ligatureAttachTable, success, anchorTableOffset);
+    if (LE_FAILURE(success)) { return 0; }
     LEPoint ligatureAnchor, markAdvance, pixels;
 
     anchorTable->getAnchor(anchorTable, ligatureGlyph, fontInstance, ligatureAnchor, success);