# HG changeset patch
# User prr
# Date 1277403811 25200
# Node ID 357bb3ba18c401c03ec1b85568df80130c3368d7
# Parent  d77434402021cebc4c25b452db18bbfd2d7ccda1
6963285: Crash in ICU Opentype layout engine due to mismatch in character counts
Reviewed-by: bae, igor

diff --git a/src/share/native/sun/font/layout/LayoutEngine.cpp b/src/share/native/sun/font/layout/LayoutEngine.cpp
--- openjdk.orig/jdk/src/share/native/sun/font/layout/LayoutEngine.cpp
+++ openjdk/jdk/src/share/native/sun/font/layout/LayoutEngine.cpp
@@ -292,7 +292,7 @@ le_int32 LayoutEngine::characterProcessi
         outCharCount = canonGSUBTable->process(glyphStorage, rightToLeft, scriptTag,
             langSysTag, NULL, substitutionFilter, canonFeatureMap, canonFeatureMapCount, FALSE);
 
-        out = (rightToLeft? count - 1 : 0);
+        out = (rightToLeft? outCharCount - 1 : 0);
 
         outChars = LE_NEW_ARRAY(LEUnicode, outCharCount);
         for (i = 0; i < outCharCount; i += 1, out += dir) {
