auto_array has constructor/destructor. Cannot be used in POD object, as the clang
bots all noticed...

sketch a subset<T> and call it for cmap. Add subset to cmap, albeit not working even for the msot basic case just yet

Such a headache that Windows defines UINT8, ...; Just prefix it.

Untested, but compiles.

Not functional change (expected!).

This makes a lot of code safer.  We only try modifying the object in one
place, after making sure it's safe to do so.  So, do a const_cast<> in
that one place...

Simplifies hb_in_range() calls as the type can be inferred.
The rest is obsessiveness, I admit.

There may be more.  There are members that are by definition
redundant or reserved and not needed, NOT what we *currently*
don't use.

I'm sure there's more...

Such that the complexity of the algorithm used is clear at
call site.

Roboto was hitting this.  FreeType also has pretty much the
same code for this, in ttcmap.c:tt_cmap4_validate():

    /* in certain fonts, the `length' field is invalid and goes */
    /* out of bound.  We try to correct this here...            */
    if ( table + length > valid->limit )
    {
      if ( valid->level >= FT_VALIDATE_TIGHT )
        FT_INVALID_TOO_SHORT;

      length = (FT_UInt)( valid->limit - table );
    }

Can happen either in broken fonts, or as a result of sanitize().