--- a/jdk/src/share/native/sun/font/layout/LigatureSubstProc2.cpp	Tue Feb 26 10:07:26 2013 -0800
+++ b/jdk/src/share/native/sun/font/layout/LigatureSubstProc2.cpp	Thu Mar 07 10:02:20 2013 -0800
@@ -47,15 +47,18 @@
 
 UOBJECT_DEFINE_RTTI_IMPLEMENTATION(LigatureSubstitutionProcessor2)
 
-LigatureSubstitutionProcessor2::LigatureSubstitutionProcessor2(const MorphSubtableHeader2 *morphSubtableHeader)
-  : StateTableProcessor2(morphSubtableHeader)
+LigatureSubstitutionProcessor2::LigatureSubstitutionProcessor2(const LEReferenceTo<MorphSubtableHeader2> &morphSubtableHeader, LEErrorCode &success)
+  : StateTableProcessor2(morphSubtableHeader, success),
+  ligActionOffset(0),
+  ligatureSubstitutionHeader(morphSubtableHeader, success), componentOffset(0), ligatureOffset(0), entryTable()
 {
-    ligatureSubstitutionHeader = (const LigatureSubstitutionHeader2 *) morphSubtableHeader;
+    if (LE_FAILURE(success)) return;
+
     ligActionOffset = SWAPL(ligatureSubstitutionHeader->ligActionOffset);
     componentOffset = SWAPL(ligatureSubstitutionHeader->componentOffset);
     ligatureOffset = SWAPL(ligatureSubstitutionHeader->ligatureOffset);
 
-    entryTable = (const LigatureSubstitutionStateEntry2 *) ((char *) &stateTableHeader->stHeader + entryTableOffset);
+    entryTable = LEReferenceToArrayOf<LigatureSubstitutionStateEntry2>(stHeader, success, entryTableOffset, LE_UNBOUNDED_ARRAY);
 }
 
 LigatureSubstitutionProcessor2::~LigatureSubstitutionProcessor2()
@@ -67,9 +70,11 @@
     m = -1;
 }
 
-le_uint16 LigatureSubstitutionProcessor2::processStateEntry(LEGlyphStorage &glyphStorage, le_int32 &currGlyph, EntryTableIndex2 index)
+le_uint16 LigatureSubstitutionProcessor2::processStateEntry(LEGlyphStorage &glyphStorage, le_int32 &currGlyph, EntryTableIndex2 index, LEErrorCode &success)
 {
-    const LigatureSubstitutionStateEntry2 *entry = &entryTable[index];
+    const LigatureSubstitutionStateEntry2 *entry = entryTable.getAlias(index, success);
+    if(LE_FAILURE(success)) return 0;
+
     le_uint16 nextStateIndex = SWAPW(entry->nextStateIndex);
     le_uint16 flags = SWAPW(entry->entryFlags);
     le_uint16 ligActionIndex = SWAPW(entry->ligActionIndex);
@@ -81,7 +86,7 @@
         componentStack[m] = currGlyph;
     } else if ( m == -1) {
         // bad font- skip this glyph.
-        LE_DEBUG_BAD_FONT("m==-1")
+        //LE_DEBUG_BAD_FONT("m==-1 (componentCount went negative)")
         currGlyph+= dir;
         return nextStateIndex;
     }
@@ -89,29 +94,25 @@
     ByteOffset actionOffset = flags & lsfPerformAction;
 
     if (actionOffset != 0) {
-        const LigatureActionEntry *ap = (const LigatureActionEntry *) ((char *) &ligatureSubstitutionHeader->stHeader + ligActionOffset) + ligActionIndex;
-        const TTGlyphID *ligatureTable = (const TTGlyphID *) ((char *) &ligatureSubstitutionHeader->stHeader + ligatureOffset);
+        LEReferenceTo<LigatureActionEntry> ap(stHeader, success, ligActionOffset); // byte offset
+        ap.addObject(ligActionIndex - 1, success);  // index offset ( one before the actual start, because we will pre-increment)
+        LEReferenceToArrayOf<TTGlyphID> ligatureTable(stHeader, success, ligatureOffset, LE_UNBOUNDED_ARRAY);
         LigatureActionEntry action;
         le_int32 offset, i = 0;
         le_int32 stack[nComponents];
         le_int16 mm = -1;
 
-        const le_uint16 *componentTable = (const le_uint16 *)((char *) &ligatureSubstitutionHeader->stHeader + componentOffset);
-
-        const le_uint16 *tableEnd = (const le_uint16 *)((char *) &ligatureSubstitutionHeader + SWAPL(ligatureSubstitutionHeader->length));
-
-        // Check if the font is internally consistent
-        if(tableEnd < (const le_uint16*)&ligatureSubstitutionHeader  // stated end wrapped around?
-           || componentTable > tableEnd) { // offset past end of stated length?
+        LEReferenceToArrayOf<le_uint16> componentTable(stHeader, success, componentOffset, LE_UNBOUNDED_ARRAY);
+        if(LE_FAILURE(success)) {
           currGlyph+= dir;
-          LE_DEBUG_BAD_FONT("ligatureSubstHeader off end of table")
             return nextStateIndex; // get out! bad font
         }
 
         do {
             le_uint32 componentGlyph = componentStack[m--]; // pop off
 
-            action = SWAPL(*ap++);
+            ap.addObject(success);
+            action = SWAPL(*ap.getAlias());
 
             if (m < 0) {
                 m = nComponents - 1;
@@ -124,10 +125,10 @@
                   currGlyph+= dir;
                   return nextStateIndex; // get out! bad font
                 }
-                i += SWAPW(componentTable[LE_GET_GLYPH(glyphStorage[componentGlyph]) + (SignExtend(offset, lafComponentOffsetMask))]);
+                i += SWAPW(componentTable(LE_GET_GLYPH(glyphStorage[componentGlyph]) + (SignExtend(offset, lafComponentOffsetMask)),success));
 
                 if (action & (lafLast | lafStore))  {
-                    TTGlyphID ligatureGlyph = SWAPW(ligatureTable[i]);
+                  TTGlyphID ligatureGlyph = SWAPW(ligatureTable(i,success));
                     glyphStorage[componentGlyph] = LE_SET_GLYPH(glyphStorage[componentGlyph], ligatureGlyph);
                     if(mm==nComponents) {
                       LE_DEBUG_BAD_FONT("exceeded nComponents");