--- a/jdk/src/share/native/sun/font/layout/LookupProcessor.cpp	Wed Feb 22 15:38:24 2012 -0500
+++ b/jdk/src/share/native/sun/font/layout/LookupProcessor.cpp	Tue Feb 28 10:44:56 2012 +0400
@@ -95,6 +95,10 @@
 
         if (selectMask != 0) {
             const LookupTable *lookupTable = lookupListTable->getLookupTable(lookup);
+
+            if (!lookupTable)
+                continue;
+
             le_uint16 lookupFlags = SWAPW(lookupTable->lookupFlags);
 
             glyphIterator.reset(lookupFlags, selectMask);
@@ -136,6 +140,9 @@
     for (le_uint16 lookup = 0; lookup < lookupCount; lookup += 1) {
         le_uint16 lookupListIndex = SWAPW(featureTable->lookupListIndexArray[lookup]);
 
+        if (lookupListIndex >= lookupSelectCount)
+            continue;
+
         lookupSelectArray[lookupListIndex] |= featureMask;
         lookupOrderArray[store++] = lookupListIndex;
     }
@@ -147,7 +154,7 @@
         Offset scriptListOffset, Offset featureListOffset, Offset lookupListOffset,
         LETag scriptTag, LETag languageTag, const FeatureMap *featureMap, le_int32 featureMapCount, le_bool orderFeatures,
         LEErrorCode& success)
-    : lookupListTable(NULL), featureListTable(NULL), lookupSelectArray(NULL),
+    : lookupListTable(NULL), featureListTable(NULL), lookupSelectArray(NULL), lookupSelectCount(0),
       lookupOrderArray(NULL), lookupOrderCount(0)
 {
     const ScriptListTable *scriptListTable = NULL;
@@ -195,6 +202,8 @@
         lookupSelectArray[i] = 0;
     }
 
+    lookupSelectCount = lookupListCount;
+
     le_int32 count, order = 0;
     le_int32 featureReferences = 0;
     const FeatureTable *featureTable = NULL;
@@ -211,6 +220,10 @@
         le_uint16 featureIndex = SWAPW(langSysTable->featureIndexArray[feature]);
 
         featureTable = featureListTable->getFeatureTable(featureIndex, &featureTag);
+
+        if (!featureTable)
+            continue;
+
         featureReferences += SWAPW(featureTable->lookupCount);
     }
 

--- a/jdk/src/share/native/sun/font/layout/LookupProcessor.h	Wed Feb 22 15:38:24 2012 -0500
+++ b/jdk/src/share/native/sun/font/layout/LookupProcessor.h	Tue Feb 28 10:44:56 2012 +0400
@@ -90,6 +90,7 @@
     const FeatureListTable  *featureListTable;
 
     FeatureMask            *lookupSelectArray;
+    le_uint32              lookupSelectCount;
 
     le_uint16               *lookupOrderArray;
     le_uint32               lookupOrderCount;