[aat] More adjustment to ContextualSubtable

See comment.

With this, MORX-20 passes if I turn --verify off.  Our unsafe-to-break
logic is currently broken in presence of end-of-text actions.  That's,
ugh, extra work to fix.  Let me try...

src/hb-aat-layout-morx-table.hh

@@ -198,6 +198,7 @@ struct ContextualSubtable
 
     inline driver_context_t (const ContextualSubtable *table) :
 	ret (false),
+	mark_set (false),
 	mark (0),
 	last_zero_before_mark (0),
 	subs (table+table->substitutionTables) {}
@@ -207,6 +208,11 @@ struct ContextualSubtable
     {
       hb_buffer_t *buffer = driver->buffer;
 
+      /* Looks like CoreText applies neither mark nor current substitution for
+       * end-of-text if mark was not explicitly set. */
+      if (buffer->idx == buffer->len && !mark_set)
+        return true;
+
       if (entry->data.markIndex != 0xFFFF)
       {
 	const Lookup<GlyphID> &lookup = subs[entry->data.markIndex];
@@ -235,6 +241,7 @@ struct ContextualSubtable
 
       if (entry->flags & SetMark)
       {
+	mark_set = true;
 	mark = buffer->idx;
 	last_zero_before_mark = driver->last_zero;
       }
@@ -245,6 +252,7 @@ struct ContextualSubtable
     public:
     bool ret;
     private:
+    bool mark_set;
     unsigned int mark;
     unsigned int last_zero_before_mark;
     const UnsizedOffsetListOf<Lookup<GlyphID>, HBUINT32> &subs;