--- a/jdk/src/share/native/sun/font/layout/LookupProcessor.cpp	Sat Sep 14 19:23:02 2013 +0100
+++ b/jdk/src/share/native/sun/font/layout/LookupProcessor.cpp	Thu Sep 19 08:34:37 2013 -0700
@@ -138,7 +138,7 @@
 le_int32 LookupProcessor::selectLookups(const LEReferenceTo<FeatureTable> &featureTable, FeatureMask featureMask, le_int32 order, LEErrorCode &success)
 {
   le_uint16 lookupCount = featureTable.isValid()? SWAPW(featureTable->lookupCount) : 0;
-    le_int32  store = order;
+    le_uint32  store = (le_uint32)order;
 
     LEReferenceToArrayOf<le_uint16> lookupListIndexArray(featureTable, success, featureTable->lookupListIndexArray, lookupCount);
 
@@ -147,6 +147,9 @@
       if (lookupListIndex >= lookupSelectCount) {
         continue;
       }
+      if (store >= lookupOrderCount) {
+        continue;
+      }
 
       lookupSelectArray[lookupListIndex] |= featureMask;
       lookupOrderArray[store++] = lookupListIndex;
@@ -246,7 +249,7 @@
 
     if (requiredFeatureIndex != 0xFFFF) {
       requiredFeatureTable = featureListTable->getFeatureTable(featureListTable, requiredFeatureIndex, &requiredFeatureTag, success);
-      featureReferences += SWAPW(featureTable->lookupCount);
+      featureReferences += SWAPW(requiredFeatureTable->lookupCount);
     }
 
     lookupOrderArray = LE_NEW_ARRAY(le_uint16, featureReferences);
@@ -254,6 +257,7 @@
         success = LE_MEMORY_ALLOCATION_ERROR;
         return;
     }
+    lookupOrderCount = featureReferences;
 
     for (le_int32 f = 0; f < featureMapCount; f += 1) {
         FeatureMap fm = featureMap[f];