diff -r 9289c4214a35 -r 25db2c8f3cf8 src/java.desktop/share/native/libfontmanager/harfbuzz/hb-ot-layout-common-private.hh
--- a/src/java.desktop/share/native/libfontmanager/harfbuzz/hb-ot-layout-common-private.hh	Wed May 30 08:10:41 2018 -0700
+++ b/src/java.desktop/share/native/libfontmanager/harfbuzz/hb-ot-layout-common-private.hh	Wed May 30 12:20:00 2018 -0700
@@ -155,13 +155,13 @@
   }
 
   template <typename set_t>
-  inline void add_coverage (set_t *glyphs) const {
-    glyphs->add_range (start, end);
+  inline bool add_coverage (set_t *glyphs) const {
+    return glyphs->add_range (start, end);
   }
 
   GlyphID       start;          /* First GlyphID in the range */
   GlyphID       end;            /* Last GlyphID in the range */
-  USHORT        value;          /* Value */
+  HBUINT16      value;          /* Value */
   public:
   DEFINE_SIZE_STATIC (6);
 };
@@ -175,7 +175,7 @@
                                    unsigned int *_indexes /* OUT */) const
   {
     if (_count) {
-      const USHORT *arr = this->sub_array (start_offset, _count);
+      const HBUINT16 *arr = this->sub_array (start_offset, _count);
       unsigned int count = *_count;
       for (unsigned int i = 0; i < count; i++)
         _indexes[i] = arr[i];
@@ -216,9 +216,9 @@
     return_trace (c->check_struct (this) && featureIndex.sanitize (c));
   }
 
-  Offset<>      lookupOrderZ;   /* = Null (reserved for an offset to a
+  Offset16      lookupOrderZ;   /* = Null (reserved for an offset to a
                                  * reordering table) */
-  USHORT        reqFeatureIndex;/* Index of a feature required for this
+  HBUINT16      reqFeatureIndex;/* Index of a feature required for this
                                  * language system--if no required features
                                  * = 0xFFFFu */
   IndexArray    featureIndex;   /* Array of indices into the FeatureList */
@@ -299,7 +299,7 @@
      * better.
      *
      * Assume that the offset to the size feature is according to specification,
-     * and make the following value checks. If it fails, assume the the size
+     * and make the following value checks. If it fails, assume the size
      * feature is calculated as versions of MakeOTF before the AFDKO 2.0 built it.
      * If this fails, reject the 'size' feature. The older makeOTF's calculated the
      * offset from the beginning of the FeatureList table, rather than from the
@@ -343,12 +343,12 @@
       return_trace (true);
   }
 
-  USHORT        designSize;     /* Represents the design size in 720/inch
+  HBUINT16      designSize;     /* Represents the design size in 720/inch
                                  * units (decipoints).  The design size entry
                                  * must be non-zero.  When there is a design
                                  * size but no recommended size range, the
                                  * rest of the array will consist of zeros. */
-  USHORT        subfamilyID;    /* Has no independent meaning, but serves
+  HBUINT16      subfamilyID;    /* Has no independent meaning, but serves
                                  * as an identifier that associates fonts
                                  * in a subfamily. All fonts which share a
                                  * Preferred or Font Family name and which
@@ -358,7 +358,7 @@
                                  * same subfamily value. If this value is
                                  * zero, the remaining fields in the array
                                  * will be ignored. */
-  USHORT        subfamilyNameID;/* If the preceding value is non-zero, this
+  HBUINT16      subfamilyNameID;/* If the preceding value is non-zero, this
                                  * value must be set in the range 256 - 32767
                                  * (inclusive). It records the value of a
                                  * field in the name table, which must
@@ -372,10 +372,10 @@
                                  * subfamily in a menu.  Applications will
                                  * choose the appropriate version based on
                                  * their selection criteria. */
-  USHORT        rangeStart;     /* Large end of the recommended usage range
+  HBUINT16      rangeStart;     /* Large end of the recommended usage range
                                  * (inclusive), stored in 720/inch units
                                  * (decipoints). */
-  USHORT        rangeEnd;       /* Small end of the recommended usage range
+  HBUINT16      rangeEnd;       /* Small end of the recommended usage range
                                    (exclusive), stored in 720/inch units
                                  * (decipoints). */
   public:
@@ -393,12 +393,12 @@
     return_trace (c->check_struct (this));
   }
 
-  USHORT        version;        /* (set to 0): This corresponds to a “minor”
+  HBUINT16      version;        /* (set to 0): This corresponds to a “minor”
                                  * version number. Additional data may be
                                  * added to the end of this Feature Parameters
                                  * table in the future. */
 
-  USHORT        uiNameID;       /* The 'name' table name ID that specifies a
+  HBUINT16      uiNameID;       /* The 'name' table name ID that specifies a
                                  * string (or strings, for multiple languages)
                                  * for a user-interface label for this
                                  * feature.  The values of uiLabelNameId and
@@ -426,25 +426,25 @@
                   characters.sanitize (c));
   }
 
-  USHORT        format;                 /* Format number is set to 0. */
-  USHORT        featUILableNameID;      /* The ‘name’ table name ID that
+  HBUINT16      format;                 /* Format number is set to 0. */
+  HBUINT16      featUILableNameID;      /* The ‘name’ table name ID that
                                          * specifies a string (or strings,
                                          * for multiple languages) for a
                                          * user-interface label for this
                                          * feature. (May be nullptr.) */
-  USHORT        featUITooltipTextNameID;/* The ‘name’ table name ID that
+  HBUINT16      featUITooltipTextNameID;/* The ‘name’ table name ID that
                                          * specifies a string (or strings,
                                          * for multiple languages) that an
                                          * application can use for tooltip
                                          * text for this feature. (May be
                                          * nullptr.) */
-  USHORT        sampleTextNameID;       /* The ‘name’ table name ID that
+  HBUINT16      sampleTextNameID;       /* The ‘name’ table name ID that
                                          * specifies sample text that
                                          * illustrates the effect of this
                                          * feature. (May be nullptr.) */
-  USHORT        numNamedParameters;     /* Number of named parameters. (May
+  HBUINT16      numNamedParameters;     /* Number of named parameters. (May
                                          * be zero.) */
-  USHORT        firstParamUILabelNameID;/* The first ‘name’ table name ID
+  HBUINT16      firstParamUILabelNameID;/* The first ‘name’ table name ID
                                          * used to specify strings for
                                          * user-interface labels for the
                                          * feature parameters. (Must be zero
@@ -562,7 +562,7 @@
 typedef RecordListOf<Feature> FeatureList;
 
 
-struct LookupFlag : USHORT
+struct LookupFlag : HBUINT16
 {
   enum Flags {
     RightToLeft         = 0x0001u,
@@ -608,7 +608,7 @@
     unsigned int flag = lookupFlag;
     if (unlikely (flag & LookupFlag::UseMarkFilteringSet))
     {
-      const USHORT &markFilteringSet = StructAfter<USHORT> (subTable);
+      const HBUINT16 &markFilteringSet = StructAfter<HBUINT16> (subTable);
       flag += (markFilteringSet << 16);
     }
     return flag;
@@ -640,7 +640,7 @@
     if (unlikely (!subTable.serialize (c, num_subtables))) return_trace (false);
     if (lookupFlag & LookupFlag::UseMarkFilteringSet)
     {
-      USHORT &markFilteringSet = StructAfter<USHORT> (subTable);
+      HBUINT16 &markFilteringSet = StructAfter<HBUINT16> (subTable);
       markFilteringSet.set (lookup_props >> 16);
     }
     return_trace (true);
@@ -653,18 +653,18 @@
     if (!(c->check_struct (this) && subTable.sanitize (c))) return_trace (false);
     if (lookupFlag & LookupFlag::UseMarkFilteringSet)
     {
-      const USHORT &markFilteringSet = StructAfter<USHORT> (subTable);
+      const HBUINT16 &markFilteringSet = StructAfter<HBUINT16> (subTable);
       if (!markFilteringSet.sanitize (c)) return_trace (false);
     }
     return_trace (true);
   }
 
   private:
-  USHORT        lookupType;             /* Different enumerations for GSUB and GPOS */
-  USHORT        lookupFlag;             /* Lookup qualifiers */
-  ArrayOf<Offset<> >
+  HBUINT16      lookupType;             /* Different enumerations for GSUB and GPOS */
+  HBUINT16      lookupFlag;             /* Lookup qualifiers */
+  ArrayOf<Offset16>
                 subTable;               /* Array of SubTables */
-  USHORT        markFilteringSetX[VAR]; /* Index (base 0) into GDEF mark glyph sets
+  HBUINT16      markFilteringSetX[VAR]; /* Index (base 0) into GDEF mark glyph sets
                                          * structure. This field is only present if bit
                                          * UseMarkFilteringSet of lookup flags is set. */
   public:
@@ -700,7 +700,7 @@
     if (unlikely (!c->extend (glyphArray))) return_trace (false);
     for (unsigned int i = 0; i < num_glyphs; i++)
       glyphArray[i] = glyphs[i];
-    glyphs.advance (num_glyphs);
+    glyphs += num_glyphs;
     return_trace (true);
   }
 
@@ -715,10 +715,8 @@
   }
 
   template <typename set_t>
-  inline void add_coverage (set_t *glyphs) const {
-    unsigned int count = glyphArray.len;
-    for (unsigned int i = 0; i < count; i++)
-      glyphs->add (glyphArray[i]);
+  inline bool add_coverage (set_t *glyphs) const {
+    return glyphs->add_sorted_array (glyphArray.array, glyphArray.len);
   }
 
   public:
@@ -737,7 +735,7 @@
   private:
 
   protected:
-  USHORT        coverageFormat; /* Format identifier--format = 1 */
+  HBUINT16      coverageFormat; /* Format identifier--format = 1 */
   SortedArrayOf<GlyphID>
                 glyphArray;     /* Array of GlyphIDs--in numerical order */
   public:
@@ -791,7 +789,7 @@
       } else {
         rangeRecord[range].end = glyphs[i];
       }
-    glyphs.advance (num_glyphs);
+    glyphs += num_glyphs;
     return_trace (true);
   }
 
@@ -817,10 +815,12 @@
   }
 
   template <typename set_t>
-  inline void add_coverage (set_t *glyphs) const {
+  inline bool add_coverage (set_t *glyphs) const {
     unsigned int count = rangeRecord.len;
     for (unsigned int i = 0; i < count; i++)
-      rangeRecord[i].add_coverage (glyphs);
+      if (unlikely (!rangeRecord[i].add_coverage (glyphs)))
+        return false;
+    return true;
   }
 
   public:
@@ -860,7 +860,7 @@
   private:
 
   protected:
-  USHORT        coverageFormat; /* Format identifier--format = 2 */
+  HBUINT16      coverageFormat; /* Format identifier--format = 2 */
   SortedArrayOf<RangeRecord>
                 rangeRecord;    /* Array of glyph ranges--ordered by
                                  * Start GlyphID. rangeCount entries
@@ -874,8 +874,8 @@
   inline unsigned int get_coverage (hb_codepoint_t glyph_id) const
   {
     switch (u.format) {
-    case 1: return u.format1.get_coverage(glyph_id);
-    case 2: return u.format2.get_coverage(glyph_id);
+    case 1: return u.format1.get_coverage (glyph_id);
+    case 2: return u.format2.get_coverage (glyph_id);
     default:return NOT_COVERED;
     }
   }
@@ -927,12 +927,14 @@
     }
   }
 
+  /* Might return false if array looks unsorted.
+   * Used for faster rejection of corrupt data. */
   template <typename set_t>
-  inline void add_coverage (set_t *glyphs) const {
+  inline bool add_coverage (set_t *glyphs) const {
     switch (u.format) {
-    case 1: u.format1.add_coverage (glyphs); break;
-    case 2: u.format2.add_coverage (glyphs); break;
-    default:                                 break;
+    case 1: return u.format1.add_coverage (glyphs);
+    case 2: return u.format2.add_coverage (glyphs);
+    default:return false;
     }
   }
 
@@ -985,7 +987,7 @@
 
   protected:
   union {
-  USHORT                format;         /* Format identifier */
+  HBUINT16              format;         /* Format identifier */
   CoverageFormat1       format1;
   CoverageFormat2       format2;
   } u;
@@ -1018,11 +1020,36 @@
   }
 
   template <typename set_t>
-  inline void add_class (set_t *glyphs, unsigned int klass) const {
+  inline bool add_coverage (set_t *glyphs) const {
+    unsigned int start = 0;
     unsigned int count = classValue.len;
     for (unsigned int i = 0; i < count; i++)
+    {
+      if (classValue[i])
+        continue;
+
+      if (start != i)
+        if (unlikely (!glyphs->add_range (startGlyph + start, startGlyph + i)))
+          return false;
+
+      start = i + 1;
+    }
+    if (start != count)
+      if (unlikely (!glyphs->add_range (startGlyph + start, startGlyph + count)))
+        return false;
+
+    return true;
+  }
+
+  template <typename set_t>
+  inline bool add_class (set_t *glyphs, unsigned int klass) const {
+    unsigned int count = classValue.len;
+    for (unsigned int i = 0; i < count; i++)
+    {
       if (classValue[i] == klass)
         glyphs->add (startGlyph + i);
+    }
+    return true;
   }
 
   inline bool intersects_class (const hb_set_t *glyphs, unsigned int klass) const {
@@ -1030,7 +1057,7 @@
     if (klass == 0)
     {
       /* Match if there's any glyph that is not listed! */
-      hb_codepoint_t g = -1;
+      hb_codepoint_t g = HB_SET_VALUE_INVALID;
       if (!hb_set_next (glyphs, &g))
         return false;
       if (g < startGlyph)
@@ -1047,9 +1074,9 @@
   }
 
   protected:
-  USHORT        classFormat;            /* Format identifier--format = 1 */
+  HBUINT16      classFormat;            /* Format identifier--format = 1 */
   GlyphID       startGlyph;             /* First GlyphID of the classValueArray */
-  ArrayOf<USHORT>
+  ArrayOf<HBUINT16>
                 classValue;             /* Array of Class Values--one per GlyphID */
   public:
   DEFINE_SIZE_ARRAY (6, classValue);
@@ -1075,11 +1102,25 @@
   }
 
   template <typename set_t>
-  inline void add_class (set_t *glyphs, unsigned int klass) const {
+  inline bool add_coverage (set_t *glyphs) const {
     unsigned int count = rangeRecord.len;
     for (unsigned int i = 0; i < count; i++)
+      if (rangeRecord[i].value)
+        if (unlikely (!rangeRecord[i].add_coverage (glyphs)))
+          return false;
+    return true;
+  }
+
+  template <typename set_t>
+  inline bool add_class (set_t *glyphs, unsigned int klass) const {
+    unsigned int count = rangeRecord.len;
+    for (unsigned int i = 0; i < count; i++)
+    {
       if (rangeRecord[i].value == klass)
-        rangeRecord[i].add_coverage (glyphs);
+        if (unlikely (!rangeRecord[i].add_coverage (glyphs)))
+          return false;
+    }
+    return true;
   }
 
   inline bool intersects_class (const hb_set_t *glyphs, unsigned int klass) const {
@@ -1087,7 +1128,7 @@
     if (klass == 0)
     {
       /* Match if there's any glyph that is not listed! */
-      hb_codepoint_t g = (hb_codepoint_t) -1;
+      hb_codepoint_t g = HB_SET_VALUE_INVALID;
       for (unsigned int i = 0; i < count; i++)
       {
         if (!hb_set_next (glyphs, &g))
@@ -1096,7 +1137,7 @@
           return true;
         g = rangeRecord[i].end;
       }
-      if (g != (hb_codepoint_t) -1 && hb_set_next (glyphs, &g))
+      if (g != HB_SET_VALUE_INVALID && hb_set_next (glyphs, &g))
         return true;
       /* Fall through. */
     }
@@ -1107,7 +1148,7 @@
   }
 
   protected:
-  USHORT        classFormat;    /* Format identifier--format = 2 */
+  HBUINT16      classFormat;    /* Format identifier--format = 2 */
   SortedArrayOf<RangeRecord>
                 rangeRecord;    /* Array of glyph ranges--ordered by
                                  * Start GlyphID */
@@ -1120,8 +1161,8 @@
   inline unsigned int get_class (hb_codepoint_t glyph_id) const
   {
     switch (u.format) {
-    case 1: return u.format1.get_class(glyph_id);
-    case 2: return u.format2.get_class(glyph_id);
+    case 1: return u.format1.get_class (glyph_id);
+    case 2: return u.format2.get_class (glyph_id);
     default:return 0;
     }
   }
@@ -1137,11 +1178,25 @@
     }
   }
 
-  inline void add_class (hb_set_t *glyphs, unsigned int klass) const {
+  /* Might return false if array looks unsorted.
+   * Used for faster rejection of corrupt data. */
+  template <typename set_t>
+  inline bool add_coverage (set_t *glyphs) const {
     switch (u.format) {
-    case 1: u.format1.add_class (glyphs, klass); return;
-    case 2: u.format2.add_class (glyphs, klass); return;
-    default:return;
+    case 1: return u.format1.add_coverage (glyphs);
+    case 2: return u.format2.add_coverage (glyphs);
+    default:return false;
+    }
+  }
+
+  /* Might return false if array looks unsorted.
+   * Used for faster rejection of corrupt data. */
+  template <typename set_t>
+  inline bool add_class (set_t *glyphs, unsigned int klass) const {
+    switch (u.format) {
+    case 1: return u.format1.add_class (glyphs, klass);
+    case 2: return u.format2.add_class (glyphs, klass);
+    default:return false;
     }
   }
 
@@ -1155,7 +1210,7 @@
 
   protected:
   union {
-  USHORT                format;         /* Format identifier */
+  HBUINT16              format;         /* Format identifier */
   ClassDefFormat1       format1;
   ClassDefFormat2       format2;
   } u;
@@ -1220,10 +1275,11 @@
     const VarRegionAxis *axes = axesZ + (region_index * axisCount);
 
     float v = 1.;
-    unsigned int count = MIN (coord_len, (unsigned int) axisCount);
+    unsigned int count = axisCount;
     for (unsigned int i = 0; i < count; i++)
     {
-      float factor = axes[i].evaluate (coords[i]);
+      int coord = i < coord_len ? coords[i] : 0;
+      float factor = axes[i].evaluate (coord);
       if (factor == 0.)
         return 0.;
       v *= factor;
@@ -1240,8 +1296,8 @@
   }
 
   protected:
-  USHORT        axisCount;
-  USHORT        regionCount;
+  HBUINT16      axisCount;
+  HBUINT16      regionCount;
   VarRegionAxis axesZ[VAR];
   public:
   DEFINE_SIZE_ARRAY (4, axesZ);
@@ -1265,19 +1321,19 @@
    unsigned int count = regionIndices.len;
    unsigned int scount = shortCount;
 
-   const BYTE *bytes = &StructAfter<BYTE> (regionIndices);
-   const BYTE *row = bytes + inner * (scount + count);
+   const HBUINT8 *bytes = &StructAfter<HBUINT8> (regionIndices);
+   const HBUINT8 *row = bytes + inner * (scount + count);
 
    float delta = 0.;
    unsigned int i = 0;
 
-   const SHORT *scursor = reinterpret_cast<const SHORT *> (row);
+   const HBINT16 *scursor = reinterpret_cast<const HBINT16 *> (row);
    for (; i < scount; i++)
    {
      float scalar = regions.evaluate (regionIndices.array[i], coords, coord_count);
      delta += scalar * *scursor++;
    }
-   const INT8 *bcursor = reinterpret_cast<const INT8 *> (scursor);
+   const HBINT8 *bcursor = reinterpret_cast<const HBINT8 *> (scursor);
    for (; i < count; i++)
    {
      float scalar = regions.evaluate (regionIndices.array[i], coords, coord_count);
@@ -1293,15 +1349,15 @@
     return_trace (c->check_struct (this) &&
                   regionIndices.sanitize(c) &&
                   shortCount <= regionIndices.len &&
-                  c->check_array (&StructAfter<BYTE> (regionIndices),
+                  c->check_array (&StructAfter<HBUINT8> (regionIndices),
                                   get_row_size (), itemCount));
   }
 
   protected:
-  USHORT                itemCount;
-  USHORT                shortCount;
-  ArrayOf<USHORT>       regionIndices;
-  BYTE                  bytesX[VAR];
+  HBUINT16              itemCount;
+  HBUINT16              shortCount;
+  ArrayOf<HBUINT16>     regionIndices;
+  HBUINT8                       bytesX[VAR];
   public:
   DEFINE_SIZE_ARRAY2 (6, regionIndices, bytesX);
 };
@@ -1337,9 +1393,9 @@
   }
 
   protected:
-  USHORT                                format;
+  HBUINT16                              format;
   LOffsetTo<VarRegionList>              regions;
-  OffsetArrayOf<VarData, ULONG>         dataSets;
+  OffsetArrayOf<VarData, HBUINT32>      dataSets;
   public:
   DEFINE_SIZE_ARRAY (8, dataSets);
 };
@@ -1366,8 +1422,8 @@
   }
 
   protected:
-  USHORT        format;         /* Format identifier--format = 1 */
-  USHORT        axisIndex;
+  HBUINT16      format;         /* Format identifier--format = 1 */
+  HBUINT16      axisIndex;
   F2DOT14       filterRangeMinValue;
   F2DOT14       filterRangeMaxValue;
   public:
@@ -1396,7 +1452,7 @@
 
   protected:
   union {
-  USHORT                format;         /* Format identifier */
+  HBUINT16              format;         /* Format identifier */
   ConditionFormat1      format1;
   } u;
   public:
@@ -1421,7 +1477,7 @@
   }
 
   protected:
-  OffsetArrayOf<Condition, ULONG> conditions;
+  OffsetArrayOf<Condition, HBUINT32> conditions;
   public:
   DEFINE_SIZE_ARRAY (2, conditions);
 };
@@ -1437,7 +1493,7 @@
   }
 
   protected:
-  USHORT                featureIndex;
+  HBUINT16              featureIndex;
   LOffsetTo<Feature>    feature;
   public:
   DEFINE_SIZE_STATIC (6);
@@ -1557,8 +1613,8 @@
   inline unsigned int get_size (void) const
   {
     unsigned int f = deltaFormat;
-    if (unlikely (f < 1 || f > 3 || startSize > endSize)) return 3 * USHORT::static_size;
-    return USHORT::static_size * (4 + ((endSize - startSize) >> (4 - f)));
+    if (unlikely (f < 1 || f > 3 || startSize > endSize)) return 3 * HBUINT16::static_size;
+    return HBUINT16::static_size * (4 + ((endSize - startSize) >> (4 - f)));
   }
 
   inline bool sanitize (hb_sanitize_context_t *c) const
@@ -1603,14 +1659,14 @@
   }
 
   protected:
-  USHORT        startSize;              /* Smallest size to correct--in ppem */
-  USHORT        endSize;                /* Largest size to correct--in ppem */
-  USHORT        deltaFormat;            /* Format of DeltaValue array data: 1, 2, or 3
+  HBUINT16      startSize;              /* Smallest size to correct--in ppem */
+  HBUINT16      endSize;                /* Largest size to correct--in ppem */
+  HBUINT16      deltaFormat;            /* Format of DeltaValue array data: 1, 2, or 3
                                          * 1    Signed 2-bit value, 8 values per uint16
                                          * 2    Signed 4-bit value, 4 values per uint16
                                          * 3    Signed 8-bit value, 2 values per uint16
                                          */
-  USHORT        deltaValue[VAR];        /* Array of compressed data */
+  HBUINT16      deltaValue[VAR];        /* Array of compressed data */
   public:
   DEFINE_SIZE_ARRAY (6, deltaValue);
 };
@@ -1641,9 +1697,9 @@
   }
 
   protected:
-  USHORT        outerIndex;
-  USHORT        innerIndex;
-  USHORT        deltaFormat;    /* Format identifier for this table: 0x0x8000 */
+  HBUINT16      outerIndex;
+  HBUINT16      innerIndex;
+  HBUINT16      deltaFormat;    /* Format identifier for this table: 0x0x8000 */
   public:
   DEFINE_SIZE_STATIC (6);
 };
@@ -1651,10 +1707,10 @@
 struct DeviceHeader
 {
   protected:
-  USHORT                reserved1;
-  USHORT                reserved2;
+  HBUINT16              reserved1;
+  HBUINT16              reserved2;
   public:
-  USHORT                format;         /* Format identifier */
+  HBUINT16              format;         /* Format identifier */
   public:
   DEFINE_SIZE_STATIC (6);
 };