--- a/jdk/src/share/native/sun/font/layout/StateTableProcessor2.cpp	Tue Feb 26 10:07:26 2013 -0800
+++ b/jdk/src/share/native/sun/font/layout/StateTableProcessor2.cpp	Thu Mar 07 10:02:20 2013 -0800
@@ -45,27 +45,33 @@
 {
 }
 
-StateTableProcessor2::StateTableProcessor2(const MorphSubtableHeader2 *morphSubtableHeader)
-  : SubtableProcessor2(morphSubtableHeader)
+StateTableProcessor2::StateTableProcessor2(const LEReferenceTo<MorphSubtableHeader2> &morphSubtableHeader, LEErrorCode &success)
+  : SubtableProcessor2(morphSubtableHeader, success), stateTableHeader(morphSubtableHeader, success),
+    stHeader(stateTableHeader, success, (const StateTableHeader2*)&stateTableHeader->stHeader),
+    nClasses(0), classTableOffset(0), stateArrayOffset(0), entryTableOffset(0), classTable(), format(0),
+    stateArray()
 {
-    stateTableHeader = (const MorphStateTableHeader2 *) morphSubtableHeader;
-    nClasses = SWAPL(stateTableHeader->stHeader.nClasses);
-    classTableOffset = SWAPL(stateTableHeader->stHeader.classTableOffset);
-    stateArrayOffset = SWAPL(stateTableHeader->stHeader.stateArrayOffset);
-    entryTableOffset = SWAPL(stateTableHeader->stHeader.entryTableOffset);
+  if (LE_FAILURE(success)) {
+    return;
+  }
+  nClasses = SWAPL(stHeader->nClasses);
+  classTableOffset = SWAPL(stHeader->classTableOffset);
+  stateArrayOffset = SWAPL(stHeader->stateArrayOffset);
+  entryTableOffset = SWAPL(stHeader->entryTableOffset);
 
-    classTable = (LookupTable *) ((char *) &stateTableHeader->stHeader + classTableOffset);
-    format = SWAPW(classTable->format);
+  classTable = LEReferenceTo<LookupTable>(stHeader, success, classTableOffset);
+  format = SWAPW(classTable->format);
 
-    stateArray = (const EntryTableIndex2 *) ((char *) &stateTableHeader->stHeader + stateArrayOffset);
+  stateArray = LEReferenceToArrayOf<EntryTableIndex2>(stHeader, success, stateArrayOffset, LE_UNBOUNDED_ARRAY);
 }
 
 StateTableProcessor2::~StateTableProcessor2()
 {
 }
 
-void StateTableProcessor2::process(LEGlyphStorage &glyphStorage)
+void StateTableProcessor2::process(LEGlyphStorage &glyphStorage, LEErrorCode &success)
 {
+    if (LE_FAILURE(success)) return;
     // Start at state 0
     // XXX: How do we know when to start at state 1?
     le_uint16 currentState = 0;
@@ -85,9 +91,11 @@
     switch (format) {
         case ltfSimpleArray: {
 #ifdef TEST_FORMAT
-            SimpleArrayLookupTable *lookupTable0 = (SimpleArrayLookupTable *) classTable;
+          LEReferenceTo<SimpleArrayLookupTable> lookupTable0(classTable, success);
+          if(LE_FAILURE(success)) break;
             while ((dir == 1 && currGlyph <= glyphCount) || (dir == -1 && currGlyph >= -1)) {
-                if(LE_STATE_PATIENCE_DECR()) {
+                if (LE_FAILURE(success)) break;
+                if (LE_STATE_PATIENCE_DECR()) {
                   LE_DEBUG_BAD_FONT("patience exceeded - state table not moving")
                   break; // patience exceeded.
                 }
@@ -105,7 +113,7 @@
                         classCode = SWAPW(lookupTable0->valueArray[gid]);
                     }
                 }
-                EntryTableIndex2 entryTableIndex = SWAPW(stateArray[classCode + currentState * nClasses]);
+                EntryTableIndex2 entryTableIndex = SWAPW(stateArray(classCode + currentState * nClasses, success));
                 LE_STATE_PATIENCE_CURR(le_int32, currGlyph);
                 currentState = processStateEntry(glyphStorage, currGlyph, entryTableIndex); // return a zero-based index instead of a byte offset
                 LE_STATE_PATIENCE_INCR(currGlyph);
@@ -114,10 +122,12 @@
             break;
         }
         case ltfSegmentSingle: {
-            SegmentSingleLookupTable *lookupTable2 = (SegmentSingleLookupTable *) classTable;
+          LEReferenceTo<SegmentSingleLookupTable> lookupTable2(classTable, success);
+          if(LE_FAILURE(success)) break;
             while ((dir == 1 && currGlyph <= glyphCount) || (dir == -1 && currGlyph >= -1)) {
-                if(LE_STATE_PATIENCE_DECR()) {
-                  LE_DEBUG_BAD_FONT("patience exceeded - state table not moving")
+                if (LE_FAILURE(success)) break;
+                if (LE_STATE_PATIENCE_DECR()) {
+                  LE_DEBUG_BAD_FONT("patience exceeded  - state table not moving")
                   break; // patience exceeded.
                 }
                 LookupValue classCode = classCodeOOB;
@@ -131,15 +141,16 @@
                     if (glyphCode == 0xFFFF) {
                         classCode = classCodeDEL;
                     } else {
-                        const LookupSegment *segment = lookupTable2->lookupSegment(lookupTable2->segments, gid);
-                        if (segment != NULL) {
+                      const LookupSegment *segment =
+                        lookupTable2->lookupSegment(lookupTable2, lookupTable2->segments, gid, success);
+                        if (segment != NULL && LE_SUCCESS(success)) {
                             classCode = SWAPW(segment->value);
                         }
                     }
                 }
-                EntryTableIndex2 entryTableIndex = SWAPW(stateArray[classCode + currentState * nClasses]);
+                EntryTableIndex2 entryTableIndex = SWAPW(stateArray(classCode + currentState * nClasses,success));
                 LE_STATE_PATIENCE_CURR(le_int32, currGlyph);
-                currentState = processStateEntry(glyphStorage, currGlyph, entryTableIndex);
+                currentState = processStateEntry(glyphStorage, currGlyph, entryTableIndex, success);
                 LE_STATE_PATIENCE_INCR(currGlyph);
             }
             break;
@@ -149,9 +160,10 @@
             break;
         }
         case ltfSingleTable: {
-            SingleTableLookupTable *lookupTable6 = (SingleTableLookupTable *) classTable;
+            LEReferenceTo<SingleTableLookupTable> lookupTable6(classTable, success);
             while ((dir == 1 && currGlyph <= glyphCount) || (dir == -1 && currGlyph >= -1)) {
-                if(LE_STATE_PATIENCE_DECR()) {
+                if (LE_FAILURE(success)) break;
+                if (LE_STATE_PATIENCE_DECR()) {
                   LE_DEBUG_BAD_FONT("patience exceeded - state table not moving")
                   break; // patience exceeded.
                 }
@@ -170,21 +182,22 @@
                     if (glyphCode == 0xFFFF) {
                         classCode = classCodeDEL;
                     } else {
-                        const LookupSingle *segment = lookupTable6->lookupSingle(lookupTable6->entries, gid);
+                      const LookupSingle *segment = lookupTable6->lookupSingle(lookupTable6, lookupTable6->entries, gid, success);
                         if (segment != NULL) {
                             classCode = SWAPW(segment->value);
                         }
                     }
                 }
-                EntryTableIndex2 entryTableIndex = SWAPW(stateArray[classCode + currentState * nClasses]);
+                EntryTableIndex2 entryTableIndex = SWAPW(stateArray(classCode + currentState * nClasses, success));
                 LE_STATE_PATIENCE_CURR(le_int32, currGlyph);
-                currentState = processStateEntry(glyphStorage, currGlyph, entryTableIndex);
+                currentState = processStateEntry(glyphStorage, currGlyph, entryTableIndex, success);
                 LE_STATE_PATIENCE_INCR(currGlyph);
             }
             break;
         }
         case ltfTrimmedArray: {
-            TrimmedArrayLookupTable *lookupTable8 = (TrimmedArrayLookupTable *) classTable;
+            LEReferenceTo<TrimmedArrayLookupTable> lookupTable8(classTable, success);
+            if (LE_FAILURE(success)) break;
             TTGlyphID firstGlyph = SWAPW(lookupTable8->firstGlyph);
             TTGlyphID lastGlyph  = firstGlyph + SWAPW(lookupTable8->glyphCount);
 
@@ -206,9 +219,9 @@
                         classCode = SWAPW(lookupTable8->valueArray[glyphCode - firstGlyph]);
                     }
                 }
-                EntryTableIndex2 entryTableIndex = SWAPW(stateArray[classCode + currentState * nClasses]);
+                EntryTableIndex2 entryTableIndex = SWAPW(stateArray(classCode + currentState * nClasses, success));
                 LE_STATE_PATIENCE_CURR(le_int32, currGlyph);
-                currentState = processStateEntry(glyphStorage, currGlyph, entryTableIndex);
+                currentState = processStateEntry(glyphStorage, currGlyph, entryTableIndex, success);
                 LE_STATE_PATIENCE_INCR(currGlyph);
             }
             break;