more leak fixes

src/hb-ot-cff1-table.hh

@@ -1133,7 +1133,7 @@ struct cff1
     {
       sc.end_processing ();
       topDict.fini ();
-      fontDicts.fini ();
+      fontDicts.fini_deep ();
       privateDicts.fini_deep ();
       hb_blob_destroy (blob);
       blob = nullptr;

src/hb-ot-cff2-table.hh

@@ -486,6 +486,7 @@ struct cff2
 	CFF2FontDict_Interpreter font_interp;
 	font_interp.env.init (fontDictStr);
 	font = fontDicts.push ();
+	if (font == &Crap(CFF2FontDictValues)) { fini (); return; }
 	font->init ();
 	if (unlikely (!font_interp.interpret (*font))) { fini (); return; }
 
@@ -506,7 +507,7 @@ struct cff2
     inline void fini (void)
     {
       sc.end_processing ();
-      fontDicts.fini ();
+      fontDicts.fini_deep ();
       privateDicts.fini_deep ();
       hb_blob_destroy (blob);
       blob = nullptr;