root/src/sfnt.c

DEFINITIONS

1. xmalloc
2. xrealloc
3. xfree
4. sfnt_swap16_1
5. sfnt_swap32_1
6. sfnt_read_table_directory
7. sfnt_find_table
8. sfnt_read_cmap_format_0
9. sfnt_read_cmap_format_2
10. sfnt_read_cmap_format_4
11. sfnt_read_cmap_format_6
12. sfnt_read_cmap_format_8
13. sfnt_read_cmap_format_12
14. sfnt_read_24
15. sfnt_read_cmap_format_14
16. sfnt_read_cmap_table_1
17. sfnt_read_cmap_table
18. sfnt_lookup_glyph_0
19. sfnt_lookup_glyph_2
20. sfnt_bsearch_above
21. sfnt_compare_uint16
22. sfnt_lookup_glyph_4_1
23. sfnt_lookup_glyph_4
24. sfnt_lookup_glyph_6
25. sfnt_lookup_glyph_8
26. sfnt_lookup_glyph_12
27. sfnt_lookup_glyph
28. sfnt_read_head_table
29. sfnt_read_hhea_table
30. sfnt_read_loca_table_short
31. sfnt_read_loca_table_long
32. sfnt_read_maxp_table
33. sfnt_read_glyf_table
34. sfnt_map_glyf_table
35. sfnt_unmap_glyf_table
36. sfnt_read_simple_glyph
37. sfnt_read_compound_glyph
38. sfnt_read_glyph
39. sfnt_free_glyph
40. sfnt_transform_coordinates
41. sfnt_expand_compound_glyph_context
42. sfnt_round_fixed
43. sfnt_decompose_compound_glyph
44. sfnt_lerp_half
45. sfnt_decompose_glyph_1
46. sfnt_decompose_glyph_2
47. sfnt_decompose_glyph
48. sfnt_build_append
49. sfnt_multiply_divide_1
50. sfnt_count_leading_zero_bits
51. sfnt_multiply_divide_2
52. sfnt_multiply_divide
53. sfnt_large_integer_add
54. sfnt_multiply_divide_round
55. sfnt_multiply_divide_signed
56. sfnt_mul_fixed
57. sfnt_mul_fixed_round
58. sfnt_move_to_and_build
59. sfnt_line_to_and_build
60. sfnt_div_fixed
61. sfnt_ceil_fixed
62. sfnt_floor_fixed
63. sfnt_curve_is_flat
64. sfnt_curve_to_and_build_1
65. sfnt_curve_to_and_build
66. sfnt_build_glyph_outline
67. sfnt_poly_grid_ceil
68. sfnt_prepare_raster
69. sfnt_step_edge
70. sfnt_build_outline_edges
71. sfnt_edge_sort
72. sfnt_poly_edges
73. sfnt_saturate_short
74. sfnt_fill_span
75. sfnt_poly_span
76. sfnt_raster_span
77. sfnt_raster_edge
78. sfnt_raster_glyph_outline
79. sfnt_read_hmtx_table
80. sfnt_lookup_glyph_metrics
81. sfnt_scale_metrics
82. sfnt_get_scale
83. sfnt_read_name_table
84. sfnt_find_name
85. sfnt_read_meta_table
86. sfnt_find_metadata
87. sfnt_read_ttc_header
88. sfnt_read_cvt_table
89. sfnt_read_fpgm_table
90. sfnt_read_prep_table
91. sfnt_div_f26dot6
92. sfnt_mul_f26dot6
93. sfnt_mul_f2dot14
94. sfnt_mul_f26dot6_fixed
95. sfnt_floor_f26dot6
96. sfnt_ceil_f26dot6
97. sfnt_round_f26dot6
98. sfnt_init_graphics_state
99. sfnt_make_interpreter
100. sfnt_interpret_trap
101. sfnt_scale_by_freedom_vector
102. sfnt_interpret_utp
103. sfnt_save_projection_vector
104. sfnt_save_freedom_vector
105. sfnt_address_zp2
106. sfnt_address_zp1
107. sfnt_address_zp0
108. sfnt_store_zp2
109. sfnt_line_to_standard_form
110. sfnt_check_zp2
111. sfnt_check_zp0
112. sfnt_check_zp1
113. sfnt_move_zp0
114. sfnt_move_zp1
115. sfnt_move_zp2
116. sfnt_move_glyph_zone
117. sfnt_move_twilight_zone
118. sfnt_direct_move_zp2
119. sfnt_project_vector
120. sfnt_dual_project_vector
121. sfnt_interpret_fliprgoff
122. sfnt_interpret_fliprgon
123. sfnt_interpret_flippt
124. sfnt_interpret_scfs
125. sfnt_round_symmetric
126. sfnt_interpret_miap
127. sfnt_interpret_alignrp_1
128. sfnt_interpret_alignrp
129. sfnt_interpret_alignpts
130. sfnt_interpret_isect
131. sfnt_sqrt_fixed
132. sfnt_normalize_vector
133. sfnt_line_to_vector
134. sfnt_measure_distance
135. sfnt_interpret_msirp
136. sfnt_interpret_ip
137. sfnt_deltac
138. sfnt_interpret_mdap
139. sfnt_deltap
140. sfnt_interpret_call
141. sfnt_set_srounding_state
142. sfnt_skip_code
143. sfnt_interpret_unimplemented
144. sfnt_interpret_fdef
145. sfnt_interpret_idef
146. sfnt_interpret_if
147. sfnt_interpret_else
148. sfnt_round_none
149. sfnt_round_to_grid
150. sfnt_round_to_double_grid
151. sfnt_round_down_to_grid
152. sfnt_round_up_to_grid
153. sfnt_round_to_half_grid
154. sfnt_round_super
155. sfnt_round_super45
156. sfnt_project_onto_x_axis_vector
157. sfnt_project_onto_y_axis_vector
158. sfnt_dot_fix_14
159. sfnt_project_onto_any_vector
160. sfnt_dual_project_onto_any_vector
161. sfnt_move_x
162. sfnt_move_y
163. sfnt_move
164. sfnt_validate_gs
165. sfnt_set_freedom_vector
166. sfnt_set_projection_vector
167. sfnt_interpret_shz
168. sfnt_interpret_shc
169. sfnt_interpret_shp
170. sfnt_interpret_iup_1
171. sfnt_interpret_iup
172. sfnt_interpret_mirp
173. sfnt_interpret_mdrp
174. sfnt_interpret_run
175. sfnt_interpret_font_program
176. sfnt_interpret_control_value_program
177. sfnt_decompose_instructed_outline
178. sfnt_build_instructed_outline
179. sfnt_compute_phantom_points
180. sfnt_interpret_simple_glyph
181. sfnt_transform_f26dot6
182. sfnt_interpret_compound_glyph_2
183. sfnt_interpret_compound_glyph_1
184. sfnt_interpret_compound_glyph
185. sfnt_read_default_uvs_table
186. sfnt_read_nondefault_uvs_table
187. sfnt_compare_table_offsets
188. sfnt_create_uvs_context
189. sfnt_free_uvs_context
190. sfnt_compare_uvs_mapping
191. sfnt_variation_glyph_for_char
192. sfnt_map_table
193. sfnt_unmap_table
194. sfnt_read_table
195. sfnt_read_fvar_table
196. sfnt_read_gvar_table
197. sfnt_read_avar_table
198. sfnt_read_packed_points
199. sfnt_read_packed_deltas
200. sfnt_read_cvar_table
201. sfnt_init_blend
202. sfnt_free_blend
203. sfnt_normalize_blend
204. sfnt_compute_tuple_scale
205. sfnt_infer_deltas_1
206. sfnt_infer_deltas
207. sfnt_vary_simple_glyph
208. sfnt_vary_compound_glyph
209. sfnt_vary_interpreter
210. sfnt_test_move_to
211. sfnt_test_line_to
212. sfnt_test_curve_to
213. sfnt_test_get_glyph
214. sfnt_test_free_glyph
215. sfnt_test_span
216. sfnt_test_edge_ignore
217. sfnt_test_edges
218. sfnt_debug_edges
219. sfnt_test_edge
220. sfnt_x_raster
221. sfnt_test_raster
222. sfnt_make_test_interpreter
223. sfnt_run_interpreter_test
224. sfnt_generic_check
225. sfnt_check_srp0
226. sfnt_check_szp0
227. sfnt_check_sloop
228. sfnt_check_rounding
229. sfnt_check_smd
230. sfnt_check_scvtci
231. sfnt_check_sswci
232. sfnt_check_ssw
233. sfnt_check_flipon
234. sfnt_check_flipoff
235. sfnt_check_sdb
236. sfnt_check_sds
237. sfnt_check_scanctrl
238. sfnt_check_instctrl
239. sfnt_setup_debugger
240. sfnt_name_instruction
241. sfnt_draw_debugger
242. sfnt_run_hook
243. sfnt_identify_instruction
244. sfnt_verbose
245. sfnt_push_hook
246. sfnt_pop_hook
247. sfnt_test_uvs
248. main

     1 /* TrueType format font support for GNU Emacs.
     2 
     3 Copyright (C) 2023 Free Software Foundation, Inc.
     4 
     5 This file is part of GNU Emacs.
     6 
     7 GNU Emacs is free software: you can redistribute it and/or modify
     8 it under the terms of the GNU General Public License as published by
     9 the Free Software Foundation, either version 3 of the License, or (at
    10 your option) any later version.
    11 
    12 GNU Emacs is distributed in the hope that it will be useful,
    13 but WITHOUT ANY WARRANTY; without even the implied warranty of
    14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
    15 GNU General Public License for more details.
    16 
    17 You should have received a copy of the GNU General Public License
    18 along with GNU Emacs.  If not, write to the Free Software Foundation,
    19 Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.  */
    20 
    21 #include <config.h>
    22 
    23 #include "sfnt.h"
    24 
    25 #include <assert.h>
    26 #include <attribute.h>
    27 #include <byteswap.h>
    28 #include <fcntl.h>
    29 #include <intprops.h>
    30 #include <inttypes.h>
    31 #include <stdint.h>
    32 #include <stdio.h>
    33 #include <stdlib.h>
    34 #include <string.h>
    35 #include <unistd.h>
    36 #include <setjmp.h>
    37 #include <errno.h>
    38 
    39 #ifdef HAVE_MMAP
    40 #include <sys/mman.h>
    41 #endif
    42 
    43 #if defined __GNUC__ && !defined __clang__
    44 #pragma GCC diagnostic ignored "-Wstringop-overflow"
    45 #endif
    46 
    47 #ifdef TEST
    48 
    49 #include <time.h>
    50 #include <timespec.h>
    51 #include <sys/wait.h>
    52 #include <errno.h>
    53 
    54 #include <X11/Xlib.h>
    55 #include <X11/extensions/Xrender.h>
    56 
    57 static void *
    58 xmalloc (size_t size)
    59 {
    60   void *ptr;
    61 
    62   ptr = malloc (size);
    63 
    64   if (!ptr)
    65     abort ();
    66 
    67   return ptr;
    68 }
    69 
    70 static void *
    71 xrealloc (void *ptr, size_t size)
    72 {
    73   void *new_ptr;
    74 
    75   new_ptr = realloc (ptr, size);
    76 
    77   if (!new_ptr)
    78     abort ();
    79 
    80   return new_ptr;
    81 }
    82 
    83 static void
    84 xfree (void *ptr)
    85 {
    86   return free (ptr);
    87 }
    88 
    89 /* Use this for functions that are static while building in test mode,
    90    but are used outside as well.  */
    91 #define TEST_STATIC static
    92 
    93 /* Needed for tests.  */
    94 #define ARRAYELTS(arr) (sizeof (arr) / sizeof (arr)[0])
    95 
    96 #else
    97 #define TEST_STATIC
    98 #include "lisp.h"
    99 #endif
   100 
   101 #define MIN(a, b) ((a) < (b) ? (a) : (b))
   102 #define MAX(a, b) ((a) > (b) ? (a) : (b))
   103 
   104 /* This file provides generic support for reading most TrueType fonts,
   105    and some OpenType fonts with TrueType outlines, along with glyph
   106    lookup, outline decomposition, and alpha mask generation from those
   107    glyphs.  It is intended to be used on any platform where proper
   108    libraries such as FreeType are not easily available, and the native
   109    font library is too limited for Emacs to support properly.
   110 
   111    Unlike most popular libraries for handling fonts, no ``font'' or
   112    ``face'' type is provided.  Instead, routines and structure
   113    definitions for accessing and making use of individual tables in a
   114    font file are exported, which allows for flexibility in the rest of
   115    Emacs.
   116 
   117    Try not to keep this file too dependent on Emacs.  Everything Lisp
   118    related goes in sfntfont.c.  The author wants to keep using it for
   119    some other (free) software.
   120 
   121    The source of reference is the TrueType Reference Manual, published
   122    by Apple Computer, which is currently found at:
   123 
   124      https://developer.apple.com/fonts/TrueType-Reference-Manual/
   125 
   126    Apple's TrueType implementation is notably missing features
   127    provided by Microsoft's extended OpenType scaler, such as the two
   128    additional phantom points on the Y axis, and also behaves
   129    differently, especially when it comes to considering phantom points
   130    as anchors in compound glyphs.
   131 
   132    As a result, do not expect this scaler to work well with Microsoft
   133    fonts such as Arial.  */
   134 
   135 
   136 
   137 /* Mapping between sfnt table names and their identifiers.  */
   138 
   139 static uint32_t sfnt_table_names[] =
   140   {
   141     [SFNT_TABLE_CMAP] = 0x636d6170,
   142     [SFNT_TABLE_GLYF] = 0x676c7966,
   143     [SFNT_TABLE_HEAD] = 0x68656164,
   144     [SFNT_TABLE_HHEA] = 0x68686561,
   145     [SFNT_TABLE_HMTX] = 0x686d7478,
   146     [SFNT_TABLE_LOCA] = 0x6c6f6361,
   147     [SFNT_TABLE_MAXP] = 0x6d617870,
   148     [SFNT_TABLE_NAME] = 0x6e616d65,
   149     [SFNT_TABLE_META] = 0x6d657461,
   150     [SFNT_TABLE_CVT ] = 0x63767420,
   151     [SFNT_TABLE_FPGM] = 0x6670676d,
   152     [SFNT_TABLE_PREP] = 0x70726570,
   153     [SFNT_TABLE_FVAR] = 0x66766172,
   154     [SFNT_TABLE_GVAR] = 0x67766172,
   155     [SFNT_TABLE_CVAR] = 0x63766172,
   156     [SFNT_TABLE_AVAR] = 0x61766172,
   157   };
   158 
   159 /* Swap values from TrueType to system byte order.  */
   160 
   161 static void
   162 sfnt_swap16_1 (uint16_t *value)
   163 {
   164 #ifndef WORDS_BIGENDIAN
   165   *value = bswap_16 (*value);
   166 #endif
   167 }
   168 
   169 static void
   170 sfnt_swap32_1 (uint32_t *value)
   171 {
   172 #ifndef WORDS_BIGENDIAN
   173   *value = bswap_32 (*value);
   174 #endif
   175 }
   176 
   177 #define sfnt_swap16(what) (sfnt_swap16_1 ((uint16_t *) (what)))
   178 #define sfnt_swap32(what) (sfnt_swap32_1 ((uint32_t *) (what)))
   179 
   180 /* Read the table directory from the file FD.  FD must currently be at
   181    the start of the file (or an offset defined in the TTC header, if
   182    applicable), and must be seekable.  Return the table directory upon
   183    success, else NULL.
   184 
   185    Value is NULL upon failure, and the offset subtable upon success.
   186    If FD is actually a TrueType collection file, value is -1.  */
   187 
   188 TEST_STATIC struct sfnt_offset_subtable *
   189 sfnt_read_table_directory (int fd)
   190 {
   191   struct sfnt_offset_subtable *subtable;
   192   ssize_t rc;
   193   size_t offset, subtable_size;
   194   int i;
   195 
   196   subtable = xmalloc (sizeof *subtable);
   197   offset = SFNT_ENDOF (struct sfnt_offset_subtable,
   198                        range_shift, uint16_t);
   199   rc = read (fd, subtable, offset);
   200 
   201   if (rc < offset)
   202     {
   203       if (rc >= sizeof (uint32_t))
   204         {
   205           /* Detect a TTC file.  In that case, the first long will be
   206              ``ttcf''.  */
   207           sfnt_swap32 (&subtable->scaler_type);
   208 
   209           if (subtable->scaler_type == SFNT_TTC_TTCF)
   210             {
   211               xfree (subtable);
   212               return (struct sfnt_offset_subtable *) -1;
   213             }
   214         }
   215 
   216       xfree (subtable);
   217       return NULL;
   218     }
   219 
   220   sfnt_swap32 (&subtable->scaler_type);
   221 
   222   /* Bail out early if this font is actually a TrueType collection
   223      file.  */
   224 
   225   if (subtable->scaler_type == SFNT_TTC_TTCF)
   226     {
   227       xfree (subtable);
   228       return (struct sfnt_offset_subtable *) -1;
   229     }
   230 
   231   sfnt_swap16 (&subtable->num_tables);
   232   sfnt_swap16 (&subtable->search_range);
   233   sfnt_swap16 (&subtable->entry_selector);
   234   sfnt_swap16 (&subtable->range_shift);
   235 
   236   /* Figure out how many more tables have to be read, and read each
   237      one of them.  */
   238   subtable_size = (subtable->num_tables
   239                    * sizeof (struct sfnt_table_directory));
   240   subtable = xrealloc (subtable, sizeof *subtable + subtable_size);
   241   subtable->subtables
   242     = (struct sfnt_table_directory *) (subtable + 1);
   243 
   244   rc = read (fd, subtable->subtables, subtable_size);
   245 
   246   if (rc < offset)
   247     {
   248       xfree (subtable);
   249       return NULL;
   250     }
   251 
   252   /* Swap each of the subtables.  */
   253 
   254   for (i = 0; i < subtable->num_tables; ++i)
   255     {
   256       sfnt_swap32 (&subtable->subtables[i].tag);
   257       sfnt_swap32 (&subtable->subtables[i].checksum);
   258       sfnt_swap32 (&subtable->subtables[i].offset);
   259       sfnt_swap32 (&subtable->subtables[i].length);
   260     }
   261 
   262   return subtable;
   263 }
   264 
   265 /* Return a pointer to the table directory entry for TABLE in
   266    SUBTABLE, or NULL if it was not found.  */
   267 
   268 static struct sfnt_table_directory *
   269 sfnt_find_table (struct sfnt_offset_subtable *subtable,
   270                  enum sfnt_table table)
   271 {
   272   int i;
   273 
   274   for (i = 0; i < subtable->num_tables; ++i)
   275     {
   276       if (subtable->subtables[i].tag == sfnt_table_names[table])
   277         return &subtable->subtables[i];
   278     }
   279 
   280   return NULL;
   281 }
   282 
   283 
   284 
   285 /* Character mapping routines.  */
   286 
   287 /* Read a format 0 cmap subtable from FD.  HEADER has already been
   288    read.  */
   289 
   290 static struct sfnt_cmap_format_0 *
   291 sfnt_read_cmap_format_0 (int fd,
   292                          struct sfnt_cmap_encoding_subtable_data *header)
   293 {
   294   struct sfnt_cmap_format_0 *format0;
   295   ssize_t rc;
   296   size_t wanted_size;
   297 
   298   format0 = xmalloc (sizeof *format0);
   299 
   300   /* Fill in fields that have already been read.  */
   301   format0->format = header->format;
   302   format0->length = header->length;
   303 
   304   /* Read the rest.  */
   305   wanted_size = (sizeof *format0
   306                  - offsetof (struct sfnt_cmap_format_0,
   307                              language));
   308   rc = read (fd, &format0->language, wanted_size);
   309 
   310   if (rc < wanted_size)
   311     {
   312       xfree (format0);
   313       return (struct sfnt_cmap_format_0 *) -1;
   314     }
   315 
   316   /* Swap fields and return.  */
   317   sfnt_swap16 (&format0->language);
   318   return format0;
   319 }
   320 
   321 /* Read a format 2 cmap subtable from FD.  HEADER has already been
   322    read.  */
   323 
   324 static struct sfnt_cmap_format_2 *
   325 sfnt_read_cmap_format_2 (int fd,
   326                          struct sfnt_cmap_encoding_subtable_data *header)
   327 {
   328   struct sfnt_cmap_format_2 *format2;
   329   ssize_t rc;
   330   size_t min_bytes;
   331   int i, nsub;
   332 
   333   /* Reject contents that are too small.  */
   334   min_bytes = SFNT_ENDOF (struct sfnt_cmap_format_2,
   335                           sub_header_keys, uint16_t[256]);
   336   if (header->length < min_bytes)
   337     return NULL;
   338 
   339   /* Add enough bytes at the end to fit the two variable length
   340      pointers.  */
   341   format2 = xmalloc (header->length + sizeof *format2);
   342   format2->format = header->format;
   343   format2->length = header->length;
   344 
   345   /* Read the part before the variable length data.  */
   346   min_bytes -= offsetof (struct sfnt_cmap_format_2, language);
   347   rc = read (fd, &format2->language, min_bytes);
   348   if (rc < min_bytes)
   349     {
   350       xfree (format2);
   351       return (struct sfnt_cmap_format_2 *) -1;
   352     }
   353 
   354   /* Swap the fields now.  */
   355 
   356   sfnt_swap16 (&format2->language);
   357 
   358   /* At the same time, look for the largest value in sub_header_keys.
   359      That will be the number of subheaders and elements in the glyph
   360      index array.  */
   361 
   362   nsub = 0;
   363 
   364   for (i = 0; i < 256; ++i)
   365     {
   366       sfnt_swap16 (&format2->sub_header_keys[i]);
   367 
   368       if (format2->sub_header_keys[i] > nsub)
   369         nsub = format2->sub_header_keys[i];
   370     }
   371 
   372   if (!nsub)
   373     /* If there are no subheaders, then things are finished.  */
   374     return format2;
   375 
   376   /* Otherwise, read the rest of the variable length data to the end
   377      of format2.  */
   378   min_bytes = (format2->length
   379                - SFNT_ENDOF (struct sfnt_cmap_format_2,
   380                              sub_header_keys, uint16_t[256]));
   381   rc = read (fd, format2 + 1, min_bytes);
   382   if (rc < min_bytes)
   383     {
   384       xfree (format2);
   385       return (struct sfnt_cmap_format_2 *) -1;
   386     }
   387 
   388   /* Check whether or not the data is of the correct size.  */
   389   if (min_bytes < nsub * sizeof *format2->subheaders)
   390     {
   391       xfree (format2);
   392       return (struct sfnt_cmap_format_2 *) -1;
   393     }
   394 
   395   /* Point the data pointers to the right location, swap everything,
   396      and return.  */
   397 
   398   format2->subheaders
   399     = (struct sfnt_cmap_format_2_subheader *) (format2 + 1);
   400   format2->glyph_index_array
   401     = (uint16_t *) (format2->subheaders + nsub);
   402 
   403   for (i = 0; i < nsub; ++i)
   404     {
   405       sfnt_swap16 (&format2->subheaders[i].first_code);
   406       sfnt_swap16 (&format2->subheaders[i].entry_count);
   407       sfnt_swap16 (&format2->subheaders[i].id_delta);
   408       sfnt_swap16 (&format2->subheaders[i].id_range_offset);
   409     }
   410 
   411   /* Figure out how big the glyph index array is, and swap everything
   412      there.  */
   413   format2->num_glyphs
   414     = (min_bytes - nsub * sizeof *format2->subheaders) / 2;
   415 
   416   for (i = 0; i < format2->num_glyphs; ++i)
   417     sfnt_swap16 (&format2->glyph_index_array[i]);
   418 
   419   return format2;
   420 }
   421 
   422 /* Read a format 4 cmap subtable from FD.  HEADER has already been
   423    read.  */
   424 
   425 static struct sfnt_cmap_format_4 *
   426 sfnt_read_cmap_format_4 (int fd,
   427                          struct sfnt_cmap_encoding_subtable_data *header)
   428 {
   429   struct sfnt_cmap_format_4 *format4;
   430   size_t min_bytes, variable_size;
   431   ssize_t rc;
   432   size_t bytes_minus_format4;
   433   int seg_count, i;
   434 
   435   min_bytes = SFNT_ENDOF (struct sfnt_cmap_format_4,
   436                           entry_selector, uint16_t);
   437 
   438   /* Check that the length is at least min_bytes.  */
   439   if (header->length < min_bytes)
   440     return NULL;
   441 
   442   /* Allocate the format4 buffer, making it the size of the buffer
   443      itself plus that of the data.  */
   444   format4 = xmalloc (header->length + sizeof *format4);
   445 
   446   /* Copy over fields that have already been read.  */
   447   format4->format = header->format;
   448   format4->length = header->length;
   449 
   450   /* Read the initial data.  */
   451   min_bytes -= offsetof (struct sfnt_cmap_format_4, language);
   452   rc = read (fd, &format4->language, min_bytes);
   453   if (rc < min_bytes)
   454     {
   455       xfree (format4);
   456       return (struct sfnt_cmap_format_4 *) -1;
   457     }
   458 
   459   /* Swap fields that have been read.  */
   460   sfnt_swap16 (&format4->language);
   461   sfnt_swap16 (&format4->seg_count_x2);
   462   sfnt_swap16 (&format4->search_range);
   463   sfnt_swap16 (&format4->entry_selector);
   464 
   465   /* Get the number of segments to read.  */
   466   seg_count = format4->seg_count_x2 / 2;
   467 
   468   /* Now calculate whether or not the size is sufficiently large.  */
   469   bytes_minus_format4
   470     = format4->length - SFNT_ENDOF (struct sfnt_cmap_format_4,
   471                                     entry_selector, uint16_t);
   472   variable_size = (seg_count * sizeof *format4->end_code
   473                    + sizeof *format4->reserved_pad
   474                    + seg_count * sizeof *format4->start_code
   475                    + seg_count * sizeof *format4->id_delta
   476                    + seg_count * sizeof *format4->id_range_offset);
   477 
   478   if (bytes_minus_format4 < variable_size)
   479     {
   480       /* Not enough bytes to fit the entire implied table
   481          contents.  */
   482       xfree (format4);
   483       return NULL;
   484     }
   485 
   486   /* Read the rest of the bytes to the end of format4.  */
   487   rc = read (fd, format4 + 1, bytes_minus_format4);
   488   if (rc < bytes_minus_format4)
   489     {
   490       xfree (format4);
   491       return (struct sfnt_cmap_format_4 *) -1;
   492     }
   493 
   494   /* Set data pointers to the right locations.  */
   495   format4->end_code = (uint16_t *) (format4 + 1);
   496   format4->reserved_pad = format4->end_code + seg_count;
   497   format4->start_code = format4->reserved_pad + 1;
   498   format4->id_delta = (int16_t *) (format4->start_code + seg_count);
   499   format4->id_range_offset = format4->id_delta + seg_count;
   500   format4->glyph_index_array = (uint16_t *) (format4->id_range_offset
   501                                              + seg_count);
   502 
   503   /* N.B. that the number of elements in glyph_index_array is
   504      (bytes_minus_format4 - variable_size) / 2.  Swap all the
   505      data.  */
   506 
   507   sfnt_swap16 (format4->reserved_pad);
   508 
   509   for (i = 0; i < seg_count; ++i)
   510     {
   511       sfnt_swap16 (&format4->end_code[i]);
   512       sfnt_swap16 (&format4->start_code[i]);
   513       sfnt_swap16 (&format4->id_delta[i]);
   514       sfnt_swap16 (&format4->id_range_offset[i]);
   515     }
   516 
   517   format4->glyph_index_size
   518     = (bytes_minus_format4 - variable_size) / 2;
   519 
   520   for (i = 0; i < format4->glyph_index_size; ++i)
   521     sfnt_swap16 (&format4->glyph_index_array[i]);
   522 
   523   /* Done.  Return the format 4 character map.  */
   524   return format4;
   525 }
   526 
   527 /* Read a format 6 cmap subtable from FD.  HEADER has already been
   528    read.  */
   529 
   530 static struct sfnt_cmap_format_6 *
   531 sfnt_read_cmap_format_6 (int fd,
   532                          struct sfnt_cmap_encoding_subtable_data *header)
   533 {
   534   struct sfnt_cmap_format_6 *format6;
   535   size_t min_size;
   536   ssize_t rc;
   537   uint16_t i;
   538 
   539   min_size = SFNT_ENDOF (struct sfnt_cmap_format_6, entry_count,
   540                          uint16_t);
   541 
   542   /* See if header->length is big enough.  */
   543   if (header->length < min_size)
   544     return NULL;
   545 
   546   /* Allocate the buffer to hold header->size and enough for at least
   547      the glyph index array pointer.  */
   548   format6 = xmalloc (header->length + sizeof *format6);
   549 
   550   /* Fill in data that has already been read.  */
   551   format6->format = header->format;
   552   format6->length = header->length;
   553 
   554   /* Read the fixed size data.  */
   555   min_size -= offsetof (struct sfnt_cmap_format_6, language);
   556   rc = read (fd, &format6->language, min_size);
   557   if (rc < min_size)
   558     {
   559       xfree (format6);
   560       return (struct sfnt_cmap_format_6 *) -1;
   561     }
   562 
   563   /* Swap what was read.  */
   564   sfnt_swap16 (&format6->language);
   565   sfnt_swap16 (&format6->first_code);
   566   sfnt_swap16 (&format6->entry_count);
   567 
   568   /* Figure out whether or not header->length is sufficient to hold
   569      the variable length data.  */
   570   if (header->length
   571       < format6->entry_count * sizeof *format6->glyph_index_array)
   572     {
   573       xfree (format6);
   574       return NULL;
   575     }
   576 
   577   /* Read the variable length data.  */
   578   rc = read (fd, format6 + 1,
   579              (format6->entry_count
   580               * sizeof *format6->glyph_index_array));
   581   if (rc < format6->entry_count * sizeof *format6->glyph_index_array)
   582     {
   583       xfree (format6);
   584       return (struct sfnt_cmap_format_6 *) -1;
   585     }
   586 
   587   /* Set the data pointer and swap everything.  */
   588   format6->glyph_index_array = (uint16_t *) (format6 + 1);
   589   for (i = 0; i < format6->entry_count; ++i)
   590     sfnt_swap16 (&format6->glyph_index_array[i]);
   591 
   592   /* All done! */
   593   return format6;
   594 }
   595 
   596 /* Read a format 8 cmap subtable from FD.  HEADER has already been
   597    read.  */
   598 
   599 static struct sfnt_cmap_format_8 *
   600 sfnt_read_cmap_format_8 (int fd,
   601                          struct sfnt_cmap_encoding_subtable_data *header)
   602 {
   603   struct sfnt_cmap_format_8 *format8;
   604   size_t min_size, temp;
   605   ssize_t rc;
   606   uint32_t length, i;
   607 
   608   /* Read the 32-bit length field.  */
   609   if (read (fd, &length, sizeof (length)) < sizeof (length))
   610     return (struct sfnt_cmap_format_8 *) -1;
   611 
   612   /* Swap the 32-bit length field.  */
   613   sfnt_swap32 (&length);
   614 
   615   min_size = SFNT_ENDOF (struct sfnt_cmap_format_8, num_groups,
   616                          uint32_t);
   617 
   618   /* Make sure the header is at least as large as min_size.  */
   619   if (length < min_size)
   620     return NULL;
   621 
   622   /* Allocate a buffer of sufficient size.  */
   623   format8 = xmalloc (length + sizeof *format8);
   624   format8->format = header->format;
   625   format8->reserved = header->length;
   626   format8->length = length;
   627 
   628   /* Read the fixed length data.  */
   629   min_size -= offsetof (struct sfnt_cmap_format_8, language);
   630   rc = read (fd, &format8->language, min_size);
   631   if (rc < min_size)
   632     {
   633       xfree (format8);
   634       return (struct sfnt_cmap_format_8 *) -1;
   635     }
   636 
   637   /* Swap what was read.  */
   638   sfnt_swap32 (&format8->language);
   639   sfnt_swap32 (&format8->num_groups);
   640 
   641   /* See if the size is sufficient to read the variable length
   642      data.  */
   643   min_size = SFNT_ENDOF (struct sfnt_cmap_format_8, num_groups,
   644                          uint32_t);
   645 
   646   if (INT_MULTIPLY_WRAPV (format8->num_groups, sizeof *format8->groups,
   647                           &temp))
   648     {
   649       xfree (format8);
   650       return NULL;
   651     }
   652 
   653   if (INT_ADD_WRAPV (min_size, temp, &min_size))
   654     {
   655       xfree (format8);
   656       return NULL;
   657     }
   658 
   659   if (length < min_size)
   660     {
   661       xfree (format8);
   662       return NULL;
   663     }
   664 
   665   /* Now read the variable length data.  */
   666   rc = read (fd, format8 + 1, temp);
   667   if (rc < temp)
   668     {
   669       xfree (format8);
   670       return (struct sfnt_cmap_format_8 *) -1;
   671     }
   672 
   673   /* Set the pointer to the variable length data.  */
   674   format8->groups
   675     = (struct sfnt_cmap_format_8_or_12_group *) (format8 + 1);
   676 
   677   for (i = 0; i < format8->num_groups; ++i)
   678     {
   679       sfnt_swap32 (&format8->groups[i].start_char_code);
   680       sfnt_swap32 (&format8->groups[i].end_char_code);
   681       sfnt_swap32 (&format8->groups[i].start_glyph_code);
   682     }
   683 
   684   /* All done.  */
   685   return format8;
   686 }
   687 
   688 /* Read a format 12 cmap subtable from FD.  HEADER has already been
   689    read.  */
   690 
   691 static struct sfnt_cmap_format_12 *
   692 sfnt_read_cmap_format_12 (int fd,
   693                           struct sfnt_cmap_encoding_subtable_data *header)
   694 {
   695   struct sfnt_cmap_format_12 *format12;
   696   size_t min_size, temp;
   697   ssize_t rc;
   698   uint32_t length, i;
   699 
   700   /* Read the 32-bit length field.  */
   701   if (read (fd, &length, sizeof (length)) < sizeof (length))
   702     return (struct sfnt_cmap_format_12 *) -1;
   703 
   704   /* Swap the 32-bit length field.  */
   705   sfnt_swap32 (&length);
   706 
   707   min_size = SFNT_ENDOF (struct sfnt_cmap_format_12, num_groups,
   708                          uint32_t);
   709 
   710   /* Make sure the header is at least as large as min_size.  */
   711   if (length < min_size)
   712     return NULL;
   713 
   714   /* Allocate a buffer of sufficient size.  */
   715   format12 = xmalloc (length + sizeof *format12);
   716   format12->format = header->format;
   717   format12->reserved = header->length;
   718   format12->length = length;
   719 
   720   /* Read the fixed length data.  */
   721   min_size -= offsetof (struct sfnt_cmap_format_12, language);
   722   rc = read (fd, &format12->language, min_size);
   723   if (rc < min_size)
   724     {
   725       xfree (format12);
   726       return (struct sfnt_cmap_format_12 *) -1;
   727     }
   728 
   729   /* Swap what was read.  */
   730   sfnt_swap32 (&format12->language);
   731   sfnt_swap32 (&format12->num_groups);
   732 
   733   /* See if the size is sufficient to read the variable length
   734      data.  */
   735   min_size = SFNT_ENDOF (struct sfnt_cmap_format_12, num_groups,
   736                          uint32_t);
   737 
   738   if (INT_MULTIPLY_WRAPV (format12->num_groups, sizeof *format12->groups,
   739                           &temp))
   740     {
   741       xfree (format12);
   742       return NULL;
   743     }
   744 
   745   if (INT_ADD_WRAPV (min_size, temp, &min_size))
   746     {
   747       xfree (format12);
   748       return NULL;
   749     }
   750 
   751   if (length < min_size)
   752     {
   753       xfree (format12);
   754       return NULL;
   755     }
   756 
   757   /* Now read the variable length data.  */
   758   rc = read (fd, format12 + 1, temp);
   759   if (rc < temp)
   760     {
   761       xfree (format12);
   762       return (struct sfnt_cmap_format_12 *) -1;
   763     }
   764 
   765   /* Set the pointer to the variable length data.  */
   766   format12->groups
   767     = (struct sfnt_cmap_format_8_or_12_group *) (format12 + 1);
   768 
   769   for (i = 0; i < format12->num_groups; ++i)
   770     {
   771       sfnt_swap32 (&format12->groups[i].start_char_code);
   772       sfnt_swap32 (&format12->groups[i].end_char_code);
   773       sfnt_swap32 (&format12->groups[i].start_glyph_code);
   774     }
   775 
   776   /* All done.  */
   777   return format12;
   778 }
   779 
   780 /* Read a 3-byte big endian number from BYTES.  */
   781 
   782 static unsigned int
   783 sfnt_read_24 (unsigned char *bytes)
   784 {
   785   return (bytes[0] << 16u) | (bytes[1] << 8u) | bytes[2];
   786 }
   787 
   788 /* Read a format 14 cmap table from FD.  HEADER->format will be 14 and
   789    HEADER->length will be 0; the 16-bit length field is not read.
   790    OFFSET is the offset of the table's header in the font file.
   791 
   792    Only variation selector records will be read.  UVS tables will
   793    not.  */
   794 
   795 static struct sfnt_cmap_format_14 *
   796 sfnt_read_cmap_format_14 (int fd,
   797                           struct sfnt_cmap_encoding_subtable_data *header,
   798                           off_t offset)
   799 {
   800   struct sfnt_cmap_format_14 *format14;
   801   uint32_t length;
   802   uint32_t num_records;
   803   uint32_t buffer1[2];
   804   size_t size, temp;
   805   char buffer[3 + 4 + 4];
   806   int i;
   807 
   808   /* Read the length field and number of variation selector
   809      records.  */
   810 
   811   if (read (fd, buffer1, sizeof buffer1) < sizeof buffer1)
   812     return NULL;
   813 
   814   length = buffer1[0];
   815   num_records = buffer1[1];
   816 
   817   sfnt_swap32 (&length);
   818   sfnt_swap32 (&num_records);
   819 
   820   /* Now, the number of records present is known.  Allocate the format
   821      14 cmap table.  */
   822 
   823   size = sizeof *format14;
   824   if (INT_MULTIPLY_WRAPV (num_records, sizeof *format14->records,
   825                           &temp)
   826       || INT_ADD_WRAPV (size, temp, &size))
   827     return NULL;
   828 
   829   format14 = xmalloc (size);
   830 
   831   /* Fill in the data already read.  */
   832   format14->format = header->format;
   833   format14->length = length;
   834   format14->num_var_selector_records = num_records;
   835   format14->offset = offset;
   836 
   837   /* Set the pointer to the remaining record data.  */
   838   format14->records
   839     = (struct sfnt_variation_selector_record *) (format14 + 1);
   840 
   841   /* Read each variation selector record.  */
   842 
   843   for (i = 0; i < num_records; ++i)
   844     {
   845       if (read (fd, buffer, sizeof buffer) < sizeof buffer)
   846         {
   847           xfree (format14);
   848           return NULL;
   849         }
   850 
   851       /* First, read the 24 bit variation selector.  */
   852       format14->records[i].var_selector
   853         = sfnt_read_24 ((unsigned char *) buffer);
   854 
   855       /* Next, read the two unaligned longs.  */
   856       memcpy (&format14->records[i].default_uvs_offset,
   857               buffer + 3,
   858               sizeof format14->records[i].default_uvs_offset);
   859       memcpy (&format14->records[i].nondefault_uvs_offset,
   860               buffer + 7,
   861               sizeof format14->records[i].nondefault_uvs_offset);
   862 
   863       /* And swap them.  */
   864       sfnt_swap32 (&format14->records[i].default_uvs_offset);
   865       sfnt_swap32 (&format14->records[i].nondefault_uvs_offset);
   866     }
   867 
   868   /* Return the format 14 character mapping table.  */
   869   return format14;
   870 }
   871 
   872 /* Read the CMAP subtable data from a given file FD at TABLE_OFFSET
   873    bytes from DIRECTORY_OFFSET.  Return the subtable data if it is
   874    supported.  Else, value is NULL if the format is unsupported, or -1
   875    upon an IO error.  */
   876 
   877 static struct sfnt_cmap_encoding_subtable_data *
   878 sfnt_read_cmap_table_1 (int fd, uint32_t directory_offset,
   879                         uint32_t table_offset)
   880 {
   881   off_t offset;
   882   struct sfnt_cmap_encoding_subtable_data header;
   883 
   884   if (INT_ADD_WRAPV (directory_offset, table_offset, &offset))
   885     return (struct sfnt_cmap_encoding_subtable_data *) -1;
   886 
   887   if (lseek (fd, offset, SEEK_SET) == (off_t) -1)
   888     return (struct sfnt_cmap_encoding_subtable_data *) -1;
   889 
   890   if (read (fd, &header.format, sizeof header.format)
   891       < sizeof header.format)
   892     return (struct sfnt_cmap_encoding_subtable_data *) -1;
   893 
   894   sfnt_swap16 (&header.format);
   895 
   896   /* Format 14 tables are rather special: they do not have a 16-bit
   897      `length' field.  When these tables are encountered, leave reading
   898      the rest of the header to `sfnt_read_cmap_table_14'.  */
   899 
   900   if (header.format != 14)
   901     {
   902       if (read (fd, &header.length, sizeof header.length)
   903           < sizeof header.length)
   904         return (struct sfnt_cmap_encoding_subtable_data *) -1;
   905 
   906       sfnt_swap16 (&header.length);
   907     }
   908   else
   909     header.length = 0;
   910 
   911   switch (header.format)
   912     {
   913     case 0:
   914       /* If the length changes, then something has changed to the
   915          format.  */
   916       if (header.length != 262)
   917         return NULL;
   918 
   919       return ((struct sfnt_cmap_encoding_subtable_data *)
   920               sfnt_read_cmap_format_0 (fd, &header));
   921 
   922     case 2:
   923       return ((struct sfnt_cmap_encoding_subtable_data *)
   924               sfnt_read_cmap_format_2 (fd, &header));
   925 
   926     case 4:
   927       return ((struct sfnt_cmap_encoding_subtable_data *)
   928               sfnt_read_cmap_format_4 (fd, &header));
   929 
   930     case 6:
   931       return ((struct sfnt_cmap_encoding_subtable_data *)
   932               sfnt_read_cmap_format_6 (fd, &header));
   933 
   934     case 8:
   935       return ((struct sfnt_cmap_encoding_subtable_data *)
   936               sfnt_read_cmap_format_8 (fd, &header));
   937 
   938     case 12:
   939       return ((struct sfnt_cmap_encoding_subtable_data *)
   940               sfnt_read_cmap_format_12 (fd, &header));
   941 
   942     case 14:
   943       return ((struct sfnt_cmap_encoding_subtable_data *)
   944               sfnt_read_cmap_format_14 (fd, &header, offset));
   945 
   946     default:
   947       return NULL;
   948     }
   949 }
   950 
   951 /* Read the CMAP table of a given font from the file FD.  Use the
   952    table directory specified in SUBTABLE.
   953 
   954    Return the CMAP table and a list of encoding subtables in
   955    *SUBTABLES and *DATA upon success, else NULL.  If DATA is NULL, do
   956    not read the subtable data.  */
   957 
   958 TEST_STATIC struct sfnt_cmap_table *
   959 sfnt_read_cmap_table (int fd, struct sfnt_offset_subtable *subtable,
   960                       struct sfnt_cmap_encoding_subtable **subtables,
   961                       struct sfnt_cmap_encoding_subtable_data ***data)
   962 {
   963   struct sfnt_table_directory *directory;
   964   struct sfnt_cmap_table *cmap;
   965   ssize_t rc;
   966   int i, j;
   967 
   968   /* Find the CMAP table in the table directory.  */
   969   directory = sfnt_find_table (subtable, SFNT_TABLE_CMAP);
   970 
   971   if (!directory)
   972     return NULL;
   973 
   974   /* Seek to the start of the CMAP table.  */
   975   if (lseek (fd, directory->offset, SEEK_SET) == (off_t) -1)
   976     return NULL;
   977 
   978   /* Read the table header.  */
   979   cmap = xmalloc (sizeof *cmap);
   980   rc = read (fd, cmap, sizeof *cmap);
   981 
   982   if (rc < sizeof *cmap)
   983     {
   984       xfree (cmap);
   985       return NULL;
   986     }
   987 
   988   /* Swap the header data.  */
   989   sfnt_swap16 (&cmap->version);
   990   sfnt_swap16 (&cmap->num_subtables);
   991 
   992   if (cmap->version != 0)
   993     {
   994       xfree (cmap);
   995       return NULL;
   996     }
   997 
   998   *subtables = xmalloc (cmap->num_subtables
   999                         * sizeof **subtables);
  1000 
  1001 
  1002   /* First, read the common parts of each encoding subtable.  */
  1003 
  1004   for (i = 0; i < cmap->num_subtables; ++i)
  1005     {
  1006       /* Read the common part of the new subtable.  */
  1007       rc = read (fd, &(*subtables)[i], sizeof (*subtables)[i]);
  1008 
  1009       if (rc < sizeof (*subtables))
  1010         {
  1011           xfree (cmap);
  1012           xfree (*subtables);
  1013           return NULL;
  1014         }
  1015 
  1016       sfnt_swap16 (&(*subtables)[i].platform_id);
  1017       sfnt_swap16 (&(*subtables)[i].platform_specific_id);
  1018       sfnt_swap32 (&(*subtables)[i].offset);
  1019     }
  1020 
  1021   /* If data is NULL, the caller only wants the table headers.  */
  1022 
  1023   if (!data)
  1024     return cmap;
  1025 
  1026   /* Second, read each encoding subtable itself.  */
  1027   *data = xmalloc (cmap->num_subtables * sizeof *data);
  1028 
  1029   for (i = 0; i < cmap->num_subtables; ++i)
  1030     {
  1031       (*data)[i] = sfnt_read_cmap_table_1 (fd, directory->offset,
  1032                                            (*subtables)[i].offset);
  1033 
  1034       if ((*data)[i] == (void *) -1)
  1035         {
  1036           /* An IO error occurred (as opposed to the subtable format
  1037              being unsupported.)  Return now.  */
  1038 
  1039           for (j = 0; j < i; ++j)
  1040             xfree ((*data)[j]);
  1041 
  1042           xfree (*data);
  1043           xfree (*subtables);
  1044           xfree (cmap);
  1045           return NULL;
  1046         }
  1047     }
  1048 
  1049   return cmap;
  1050 }
  1051 
  1052 /* Look up the glyph corresponding to CHARACTER in the format 0 cmap
  1053    FORMAT0.  Return 0 if no glyph was found.  */
  1054 
  1055 static sfnt_glyph
  1056 sfnt_lookup_glyph_0 (sfnt_char character,
  1057                      struct sfnt_cmap_format_0 *format0)
  1058 {
  1059   if (character >= 256)
  1060     return 0;
  1061 
  1062   return format0->glyph_index_array[character];
  1063 }
  1064 
  1065 /* Look up the glyph corresponding to CHARACTER in the format 2 cmap
  1066    FORMAT2.  Return 0 if no glyph was found.  */
  1067 
  1068 static sfnt_glyph
  1069 sfnt_lookup_glyph_2 (sfnt_char character,
  1070                      struct sfnt_cmap_format_2 *format2)
  1071 {
  1072   unsigned char i, k, j;
  1073   struct sfnt_cmap_format_2_subheader *subheader;
  1074   unsigned char *slice;
  1075   uint16_t glyph;
  1076 
  1077   if (character > 65335)
  1078     return 0;
  1079 
  1080   i = character >> 16;
  1081   j = character & 0xff;
  1082   k = format2->sub_header_keys[i] / 8;
  1083 
  1084   if (k)
  1085     {
  1086       subheader = &format2->subheaders[k];
  1087 
  1088       if (subheader->first_code <= j
  1089           && j <= ((int) subheader->first_code
  1090                    + (int) subheader->entry_count))
  1091         {
  1092           /* id_range_offset is actually the number of bytes past
  1093              itself containing the uint16_t ``slice''.  It is possibly
  1094              unaligned.  */
  1095           slice = (unsigned char *) &subheader->id_range_offset;
  1096           slice += subheader->id_range_offset;
  1097           slice += (j - subheader->first_code) * sizeof (uint16_t);
  1098 
  1099           if (slice < (unsigned char *) format2->glyph_index_array
  1100               || (slice + 1
  1101                   > (unsigned char *) (format2->glyph_index_array
  1102                                        + format2->num_glyphs)))
  1103             /* The character is out of bounds.  */
  1104             return 0;
  1105 
  1106           memcpy (&glyph, slice, sizeof glyph);
  1107           return (glyph + subheader->id_delta) % 65536;
  1108         }
  1109       else
  1110         return 0;
  1111     }
  1112 
  1113   /* k is 0, so glyph_index_array[i] is the glyph.  */
  1114   return (i < format2->num_glyphs
  1115           ? format2->glyph_index_array[i]
  1116           : 0);
  1117 }
  1118 
  1119 /* Like `bsearch'.  However, return the highest element above KEY if
  1120    it could not be found.  */
  1121 
  1122 static void *
  1123 sfnt_bsearch_above (const void *key, const void *base,
  1124                     size_t nmemb, size_t size,
  1125                     int (*compar) (const void *,
  1126                                    const void *))
  1127 {
  1128   const unsigned char *bytes, *sample;
  1129   size_t low, high, mid;
  1130 
  1131   bytes = base;
  1132   low = 0;
  1133   high = nmemb - 1;
  1134 
  1135   if (!nmemb)
  1136     return NULL;
  1137 
  1138   while (low != high)
  1139     {
  1140       mid = low + (high - low) / 2;
  1141       sample = bytes + mid * size;
  1142 
  1143       if (compar (key, sample) > 0)
  1144         low = mid + 1;
  1145       else
  1146         high = mid;
  1147     }
  1148 
  1149   return (unsigned char *) bytes + low * size;
  1150 }
  1151 
  1152 /* Compare two uint16_t's.  Used to bisect through a format 4
  1153    table.  */
  1154 
  1155 static int
  1156 sfnt_compare_uint16 (const void *a, const void *b)
  1157 {
  1158   return ((int) *((uint16_t *) a)) - ((int) *((uint16_t *) b));
  1159 }
  1160 
  1161 /* Look up the glyph corresponding to CODE in the format 4 cmap
  1162    FORMAT4, using the table segment SEGMENT.  Value is 0 if no glyph
  1163    was found.  */
  1164 
  1165 static sfnt_glyph
  1166 sfnt_lookup_glyph_4_1 (uint16_t code, uint16_t segment,
  1167                        struct sfnt_cmap_format_4 *format4)
  1168 {
  1169   uint16_t *index;
  1170 
  1171   if (format4->id_range_offset[segment])
  1172     {
  1173       /* id_range_offset is not 0, so the glyph mapping depends on
  1174          it.  */
  1175       index = (uint16_t *) (&format4->id_range_offset[segment]
  1176                             + format4->id_range_offset[segment] / 2
  1177                             + (code - format4->start_code[segment]));
  1178 
  1179       /* Check that index is not out of bounds.  */
  1180       if (index >= (format4->glyph_index_array
  1181                     + format4->glyph_index_size)
  1182           || index < format4->glyph_index_array)
  1183         return 0;
  1184 
  1185       /* Return what is in index.  */
  1186       return (*index ? (format4->id_delta[segment]
  1187                         + *index) % 65536 : 0);
  1188     }
  1189 
  1190   /* Otherwise, just add id_delta.  */
  1191   return (format4->id_delta[segment] + code) % 65536;
  1192 }
  1193 
  1194 /* Look up the glyph corresponding to CHARACTER in the format 4 cmap
  1195    FORMAT4.  Return 0 if no glyph was found.  */
  1196 
  1197 static sfnt_glyph
  1198 sfnt_lookup_glyph_4 (sfnt_char character,
  1199                      struct sfnt_cmap_format_4 *format4)
  1200 {
  1201   uint16_t *segment_address;
  1202   uint16_t code, segment;
  1203   sfnt_glyph glyph;
  1204 
  1205   if (character > 65535)
  1206     return 0;
  1207 
  1208   code = character;
  1209 
  1210   /* Find the segment ending above or at CHARACTER.  */
  1211   segment_address = sfnt_bsearch_above (&code, format4->end_code,
  1212                                         format4->seg_count_x2 / 2,
  1213                                         sizeof code,
  1214                                         sfnt_compare_uint16);
  1215   segment = segment_address - format4->end_code;
  1216 
  1217   /* If the segment starts too late, return 0.  */
  1218   if (!segment_address || format4->start_code[segment] > character)
  1219     return 0;
  1220 
  1221   glyph = sfnt_lookup_glyph_4_1 (character, segment, format4);
  1222 
  1223   if (glyph)
  1224     return glyph;
  1225 
  1226   /* Droid Sans Mono has overlapping segments in its format 4 cmap
  1227      subtable where the first segment's end code is 32, while the
  1228      second segment's start code is also 32.  The TrueType Reference
  1229      Manual says that mapping should begin by searching for the first
  1230      segment whose end code is greater than or equal to the character
  1231      being indexed, but that results in the first subtable being
  1232      found, which doesn't work, while the second table does.  Try to
  1233      detect this situation and use the second table if possible.  */
  1234 
  1235   if (!glyph
  1236       /* The character being looked up is the current segment's end
  1237          code.  */
  1238       && code == format4->end_code[segment]
  1239       /* There is an additional segment.  */
  1240       && segment + 1 < format4->seg_count_x2 / 2
  1241       /* That segment's start code is the same as this segment's end
  1242          code.  */
  1243       && format4->start_code[segment + 1] == format4->end_code[segment])
  1244     /* Try the second segment.  */
  1245     return sfnt_lookup_glyph_4_1 (character, segment + 1, format4);
  1246 
  1247   /* Fail.  */
  1248   return 0;
  1249 }
  1250 
  1251 /* Look up the glyph corresponding to CHARACTER in the format 6 cmap
  1252    FORMAT6.  Return 0 if no glyph was found.  */
  1253 
  1254 static sfnt_glyph
  1255 sfnt_lookup_glyph_6 (sfnt_char character,
  1256                      struct sfnt_cmap_format_6 *format6)
  1257 {
  1258   if (character < format6->first_code
  1259       || character >= (format6->first_code
  1260                        + (int) format6->entry_count))
  1261     return 0;
  1262 
  1263   return format6->glyph_index_array[character - format6->first_code];
  1264 }
  1265 
  1266 /* Look up the glyph corresponding to CHARACTER in the format 8 cmap
  1267    FORMAT8.  Return 0 if no glyph was found.  */
  1268 
  1269 static sfnt_glyph
  1270 sfnt_lookup_glyph_8 (sfnt_char character,
  1271                      struct sfnt_cmap_format_8 *format8)
  1272 {
  1273   uint32_t i;
  1274 
  1275   if (character > 0xffffffff)
  1276     return 0;
  1277 
  1278   for (i = 0; i < format8->num_groups; ++i)
  1279     {
  1280       if (format8->groups[i].start_char_code <= character
  1281           && format8->groups[i].end_char_code >= character)
  1282         return (format8->groups[i].start_glyph_code
  1283                 + (character
  1284                    - format8->groups[i].start_char_code));
  1285     }
  1286 
  1287   return 0;
  1288 }
  1289 
  1290 /* Look up the glyph corresponding to CHARACTER in the format 12 cmap
  1291    FORMAT12.  Return 0 if no glyph was found.  */
  1292 
  1293 static sfnt_glyph
  1294 sfnt_lookup_glyph_12 (sfnt_char character,
  1295                       struct sfnt_cmap_format_12 *format12)
  1296 {
  1297   uint32_t i;
  1298 
  1299   if (character > 0xffffffff)
  1300     return 0;
  1301 
  1302   for (i = 0; i < format12->num_groups; ++i)
  1303     {
  1304       if (format12->groups[i].start_char_code <= character
  1305           && format12->groups[i].end_char_code >= character)
  1306         return (format12->groups[i].start_glyph_code
  1307                 + (character
  1308                    - format12->groups[i].start_char_code));
  1309     }
  1310 
  1311   return 0;
  1312 }
  1313 
  1314 /* Look up the glyph index corresponding to the character CHARACTER,
  1315    which must be in the correct encoding for the cmap table pointed to
  1316    by DATA.
  1317 
  1318    DATA must be either a format 0, 2, 4, 6, 8 or 12 cmap table, else
  1319    behavior is undefined.  */
  1320 
  1321 TEST_STATIC sfnt_glyph
  1322 sfnt_lookup_glyph (sfnt_char character,
  1323                    struct sfnt_cmap_encoding_subtable_data *data)
  1324 {
  1325   switch (data->format)
  1326     {
  1327     case 0:
  1328       return sfnt_lookup_glyph_0 (character,
  1329                                   (struct sfnt_cmap_format_0 *) data);
  1330 
  1331     case 2:
  1332       return sfnt_lookup_glyph_2 (character,
  1333                                   (struct sfnt_cmap_format_2 *) data);
  1334 
  1335     case 4:
  1336       return sfnt_lookup_glyph_4 (character,
  1337                                   (struct sfnt_cmap_format_4 *) data);
  1338 
  1339     case 6:
  1340       return sfnt_lookup_glyph_6 (character,
  1341                                   (struct sfnt_cmap_format_6 *) data);
  1342 
  1343     case 8:
  1344       return sfnt_lookup_glyph_8 (character,
  1345                                   (struct sfnt_cmap_format_8 *) data);
  1346 
  1347     case 12:
  1348       return sfnt_lookup_glyph_12 (character,
  1349                                    (struct sfnt_cmap_format_12 *) data);
  1350     }
  1351 
  1352   return 0;
  1353 }
  1354 
  1355 
  1356 
  1357 /* Header reading routines.  */
  1358 
  1359 /* Read the head table of a given font FD.  Use the table directory
  1360    specified in SUBTABLE.
  1361 
  1362    Return the head table upon success, else NULL.  */
  1363 
  1364 TEST_STATIC struct sfnt_head_table *
  1365 sfnt_read_head_table (int fd, struct sfnt_offset_subtable *subtable)
  1366 {
  1367   struct sfnt_table_directory *directory;
  1368   struct sfnt_head_table *head;
  1369   ssize_t rc;
  1370 
  1371   /* Find the table in the directory.  */
  1372 
  1373   directory = sfnt_find_table (subtable, SFNT_TABLE_HEAD);
  1374 
  1375   if (!directory)
  1376     return NULL;
  1377 
  1378   /* Seek to the location given in the directory.  */
  1379   if (lseek (fd, directory->offset, SEEK_SET) == (off_t) -1)
  1380     return NULL;
  1381 
  1382   /* Read the entire table.  */
  1383   head = xmalloc (sizeof *head);
  1384   rc = read (fd, head, sizeof *head);
  1385 
  1386   if (rc < sizeof *head)
  1387     {
  1388       xfree (head);
  1389       return NULL;
  1390     }
  1391 
  1392   /* Swap the header data.  */
  1393   sfnt_swap32 (&head->version);
  1394   sfnt_swap32 (&head->revision);
  1395 
  1396   if (head->version != 0x00010000)
  1397     {
  1398       xfree (head);
  1399       return NULL;
  1400     }
  1401 
  1402   /* Swap the rest of the data.  */
  1403   sfnt_swap32 (&head->checksum_adjustment);
  1404   sfnt_swap32 (&head->magic);
  1405 
  1406   if (head->magic != 0x5f0f3cf5)
  1407     {
  1408       xfree (head);
  1409       return NULL;
  1410     }
  1411 
  1412   sfnt_swap16 (&head->flags);
  1413   sfnt_swap16 (&head->units_per_em);
  1414   sfnt_swap32 (&head->created_high);
  1415   sfnt_swap32 (&head->created_low);
  1416   sfnt_swap32 (&head->modified_high);
  1417   sfnt_swap32 (&head->modified_low);
  1418   sfnt_swap16 (&head->xmin);
  1419   sfnt_swap16 (&head->xmax);
  1420   sfnt_swap16 (&head->ymin);
  1421   sfnt_swap16 (&head->ymax);
  1422   sfnt_swap16 (&head->mac_style);
  1423   sfnt_swap16 (&head->lowest_rec_ppem);
  1424   sfnt_swap16 (&head->font_direction_hint);
  1425   sfnt_swap16 (&head->index_to_loc_format);
  1426   sfnt_swap16 (&head->glyph_data_format);
  1427 
  1428   return head;
  1429 }
  1430 
  1431 /* Read the hhea table of a given font FD.  Use the table directory
  1432    specified in SUBTABLE.
  1433 
  1434    Return the head table upon success, else NULL.  */
  1435 
  1436 TEST_STATIC struct sfnt_hhea_table *
  1437 sfnt_read_hhea_table (int fd, struct sfnt_offset_subtable *subtable)
  1438 {
  1439   struct sfnt_table_directory *directory;
  1440   struct sfnt_hhea_table *hhea;
  1441   ssize_t rc;
  1442 
  1443   /* Find the table in the directory.  */
  1444 
  1445   directory = sfnt_find_table (subtable, SFNT_TABLE_HHEA);
  1446 
  1447   if (!directory)
  1448     return NULL;
  1449 
  1450   /* Check the length is right.  */
  1451   if (directory->length != sizeof *hhea)
  1452     return NULL;
  1453 
  1454   /* Seek to the location given in the directory.  */
  1455   if (lseek (fd, directory->offset, SEEK_SET) == (off_t) -1)
  1456     return NULL;
  1457 
  1458   /* Read the entire table.  */
  1459   hhea = xmalloc (sizeof *hhea);
  1460   rc = read (fd, hhea, sizeof *hhea);
  1461 
  1462   if (rc < sizeof *hhea)
  1463     {
  1464       xfree (hhea);
  1465       return NULL;
  1466     }
  1467 
  1468   /* Swap the header data.  */
  1469   sfnt_swap32 (&hhea->version);
  1470 
  1471   if (hhea->version != 0x00010000)
  1472     {
  1473       xfree (hhea);
  1474       return NULL;
  1475     }
  1476 
  1477   /* Swap the rest of the data.  */
  1478   sfnt_swap16 (&hhea->ascent);
  1479   sfnt_swap16 (&hhea->descent);
  1480   sfnt_swap16 (&hhea->line_gap);
  1481   sfnt_swap16 (&hhea->advance_width_max);
  1482   sfnt_swap16 (&hhea->min_left_side_bearing);
  1483   sfnt_swap16 (&hhea->min_right_side_bearing);
  1484   sfnt_swap16 (&hhea->x_max_extent);
  1485   sfnt_swap16 (&hhea->caret_slope_rise);
  1486   sfnt_swap16 (&hhea->caret_slope_run);
  1487   sfnt_swap16 (&hhea->reserved1);
  1488   sfnt_swap16 (&hhea->reserved2);
  1489   sfnt_swap16 (&hhea->reserved3);
  1490   sfnt_swap16 (&hhea->reserved4);
  1491   sfnt_swap16 (&hhea->metric_data_format);
  1492   sfnt_swap16 (&hhea->num_of_long_hor_metrics);
  1493 
  1494   return hhea;
  1495 }
  1496 
  1497 /* Read a short loca table from the given font FD.  Use the table
  1498    directory specified in SUBTABLE.
  1499 
  1500    Return the short table upon success, else NULL.  */
  1501 
  1502 TEST_STATIC struct sfnt_loca_table_short *
  1503 sfnt_read_loca_table_short (int fd, struct sfnt_offset_subtable *subtable)
  1504 {
  1505   struct sfnt_table_directory *directory;
  1506   struct sfnt_loca_table_short *loca;
  1507   ssize_t rc;
  1508   int i;
  1509 
  1510   /* Find the table in the directory.  */
  1511 
  1512   directory = sfnt_find_table (subtable, SFNT_TABLE_LOCA);
  1513 
  1514   if (!directory)
  1515     return NULL;
  1516 
  1517   /* Seek to the location given in the directory.  */
  1518   if (lseek (fd, directory->offset, SEEK_SET) == (off_t) -1)
  1519     return NULL;
  1520 
  1521   /* Figure out how many glyphs there are based on the length.  */
  1522   loca = xmalloc (sizeof *loca + directory->length);
  1523   loca->offsets = (uint16_t *) (loca + 1);
  1524   loca->num_offsets = directory->length / 2;
  1525 
  1526   /* Read the variable-length table data.  */
  1527   rc = read (fd, loca->offsets, directory->length);
  1528   if (rc < directory->length)
  1529     {
  1530       xfree (loca);
  1531       return NULL;
  1532     }
  1533 
  1534   /* Swap each of the offsets.  */
  1535   for (i = 0; i < loca->num_offsets; ++i)
  1536     sfnt_swap16 (&loca->offsets[i]);
  1537 
  1538   /* Return the table.  */
  1539   return loca;
  1540 }
  1541 
  1542 /* Read a long loca table from the given font FD.  Use the table
  1543    directory specified in SUBTABLE.
  1544 
  1545    Return the long table upon success, else NULL.  */
  1546 
  1547 TEST_STATIC struct sfnt_loca_table_long *
  1548 sfnt_read_loca_table_long (int fd, struct sfnt_offset_subtable *subtable)
  1549 {
  1550   struct sfnt_table_directory *directory;
  1551   struct sfnt_loca_table_long *loca;
  1552   ssize_t rc;
  1553   int i;
  1554 
  1555   /* Find the table in the directory.  */
  1556 
  1557   directory = sfnt_find_table (subtable, SFNT_TABLE_LOCA);
  1558 
  1559   if (!directory)
  1560     return NULL;
  1561 
  1562   /* Seek to the location given in the directory.  */
  1563   if (lseek (fd, directory->offset, SEEK_SET) == (off_t) -1)
  1564     return NULL;
  1565 
  1566   /* Figure out how many glyphs there are based on the length.  */
  1567   loca = xmalloc (sizeof *loca + directory->length);
  1568   loca->offsets = (uint32_t *) (loca + 1);
  1569   loca->num_offsets = directory->length / 4;
  1570 
  1571   /* Read the variable-length table data.  */
  1572   rc = read (fd, loca->offsets, directory->length);
  1573   if (rc < directory->length)
  1574     {
  1575       xfree (loca);
  1576       return NULL;
  1577     }
  1578 
  1579   /* Swap each of the offsets.  */
  1580   for (i = 0; i < loca->num_offsets; ++i)
  1581     sfnt_swap32 (&loca->offsets[i]);
  1582 
  1583   /* Return the table.  */
  1584   return loca;
  1585 }
  1586 
  1587 /* Read the maxp table from the given font FD.  Use the table
  1588    directory specified in SUBTABLE.
  1589 
  1590    Return the maxp table upon success, else NULL.  If the version is
  1591    0.5, fields past num_glyphs will not be populated.  */
  1592 
  1593 TEST_STATIC struct sfnt_maxp_table *
  1594 sfnt_read_maxp_table (int fd, struct sfnt_offset_subtable *subtable)
  1595 {
  1596   struct sfnt_table_directory *directory;
  1597   struct sfnt_maxp_table *maxp;
  1598   size_t size;
  1599   ssize_t rc;
  1600 
  1601   /* Find the table in the directory.  */
  1602 
  1603   directory = sfnt_find_table (subtable, SFNT_TABLE_MAXP);
  1604 
  1605   if (!directory)
  1606     return NULL;
  1607 
  1608   /* Seek to the location given in the directory.  */
  1609   if (lseek (fd, directory->offset, SEEK_SET) == (off_t) -1)
  1610     return NULL;
  1611 
  1612   /* If directory->length is not big enough for version 0.5, punt.  */
  1613   if (directory->length < SFNT_ENDOF (struct sfnt_maxp_table,
  1614                                       num_glyphs, uint16_t))
  1615     return NULL;
  1616 
  1617   /* Allocate the buffer to hold the data.  Then, read
  1618      directory->length or sizeof *maxp bytes into it, whichever is
  1619      smaller.  */
  1620 
  1621   maxp = xmalloc (sizeof *maxp);
  1622   size = MIN (directory->length, sizeof *maxp);
  1623   rc = read (fd, maxp, size);
  1624 
  1625   if (rc < size)
  1626     {
  1627       xfree (maxp);
  1628       return NULL;
  1629     }
  1630 
  1631   /* Now, swap version and num_glyphs.  */
  1632   sfnt_swap32 (&maxp->version);
  1633   sfnt_swap16 (&maxp->num_glyphs);
  1634 
  1635   /* Reject version 1.0 tables that are too small.  */
  1636   if (maxp->version > 0x00005000 && size < sizeof *maxp)
  1637     {
  1638       xfree (maxp);
  1639       return NULL;
  1640     }
  1641 
  1642   /* If the table is version 0.5, then this function is done.  */
  1643   if (maxp->version == 0x00005000)
  1644     return maxp;
  1645   else if (maxp->version != 0x00010000)
  1646     {
  1647       /* Reject invalid versions.  */
  1648       xfree (maxp);
  1649       return NULL;
  1650     }
  1651 
  1652   /* Otherwise, swap the rest of the fields.  */
  1653   sfnt_swap16 (&maxp->max_points);
  1654   sfnt_swap16 (&maxp->max_contours);
  1655   sfnt_swap16 (&maxp->max_composite_points);
  1656   sfnt_swap16 (&maxp->max_composite_contours);
  1657   sfnt_swap16 (&maxp->max_zones);
  1658   sfnt_swap16 (&maxp->max_twilight_points);
  1659   sfnt_swap16 (&maxp->max_storage);
  1660   sfnt_swap16 (&maxp->max_function_defs);
  1661   sfnt_swap16 (&maxp->max_instruction_defs);
  1662   sfnt_swap16 (&maxp->max_stack_elements);
  1663   sfnt_swap16 (&maxp->max_size_of_instructions);
  1664   sfnt_swap16 (&maxp->max_component_elements);
  1665   sfnt_swap16 (&maxp->max_component_depth);
  1666 
  1667   /* All done.  */
  1668   return maxp;
  1669 }
  1670 
  1671 
  1672 
  1673 /* Glyph outlining generation.  */
  1674 
  1675 /* Read a glyf table from the given font FD.  Use the table directory
  1676    specified in SUBTABLE.  The glyph data is not swapped.
  1677 
  1678    Return the glyf table upon success, else NULL.  */
  1679 
  1680 TEST_STATIC struct sfnt_glyf_table *
  1681 sfnt_read_glyf_table (int fd, struct sfnt_offset_subtable *subtable)
  1682 {
  1683   struct sfnt_table_directory *directory;
  1684   struct sfnt_glyf_table *glyf;
  1685   ssize_t rc;
  1686 
  1687   /* Find the table in the directory.  */
  1688 
  1689   directory = sfnt_find_table (subtable, SFNT_TABLE_GLYF);
  1690 
  1691   if (!directory)
  1692     return NULL;
  1693 
  1694   /* Seek to the location given in the directory.  */
  1695   if (lseek (fd, directory->offset, SEEK_SET) == (off_t) -1)
  1696     return NULL;
  1697 
  1698   /* Allocate enough to hold everything.  */
  1699   glyf = xmalloc (sizeof *glyf + directory->length);
  1700   glyf->size = directory->length;
  1701   glyf->glyphs = (unsigned char *) (glyf + 1);
  1702 
  1703   /* Read the glyph data.  */
  1704   rc = read (fd, glyf->glyphs, glyf->size);
  1705   if (rc < glyf->size)
  1706     {
  1707       xfree (glyf);
  1708       return NULL;
  1709     }
  1710 
  1711   /* Return the table.  */
  1712   return glyf;
  1713 }
  1714 
  1715 #if defined HAVE_MMAP && !defined TEST
  1716 
  1717 /* Map a glyph table from the given font FD.  Use the table directory
  1718    specified in SUBTABLE.  The glyph data is not byte-swapped.
  1719 
  1720    Value is the glyf table upon success, else NULL.
  1721    A mapped glyf table must be unmapped using `sfnt_unmap_glyf_table'.
  1722    The caller must correctly handle bus errors in between glyf->table
  1723    and glyf->size.  */
  1724 
  1725 struct sfnt_glyf_table *
  1726 sfnt_map_glyf_table (int fd, struct sfnt_offset_subtable *subtable)
  1727 {
  1728   struct sfnt_table_directory *directory;
  1729   struct sfnt_glyf_table *glyf;
  1730   void *glyphs;
  1731   size_t offset, page, map_offset;
  1732 
  1733   /* Find the table in the directory.  */
  1734 
  1735   directory = sfnt_find_table (subtable, SFNT_TABLE_GLYF);
  1736 
  1737   if (!directory)
  1738     return NULL;
  1739 
  1740   /* Now try to map the glyph data.  Make sure offset is a multiple of
  1741      the page size.  */
  1742 
  1743   page = getpagesize ();
  1744   offset = directory->offset & ~(page - 1);
  1745 
  1746   /* Figure out how much larger the mapping should be.  */
  1747   map_offset = directory->offset - offset;
  1748 
  1749   /* Do the mmap.  */
  1750   glyphs = mmap (NULL, directory->length + map_offset,
  1751                  PROT_READ, MAP_PRIVATE, fd, offset);
  1752 
  1753   if (glyphs == MAP_FAILED)
  1754     return NULL;
  1755 
  1756   /* An observation is that glyphs tend to be accessed in sequential
  1757      order and immediately after the font's glyph table is loaded.  */
  1758 
  1759 #ifdef HAVE_POSIX_MADVISE
  1760   posix_madvise (glyphs, directory->length,
  1761                  POSIX_MADV_WILLNEED);
  1762 #elif defined HAVE_MADVISE
  1763   madvise (glyphs, directory->length, MADV_WILLNEED);
  1764 #endif
  1765 
  1766   /* Allocate the glyf table.  */
  1767   glyf = xmalloc (sizeof *glyf);
  1768   glyf->size = directory->length;
  1769   glyf->glyphs = (unsigned char *) glyphs + map_offset;
  1770   glyf->start = glyphs;
  1771 
  1772   return glyf;
  1773 }
  1774 
  1775 /* Unmap the mmap'ed glyf table GLYF, then free its associated data.
  1776    Value is 0 upon success, else 1, in which case GLYF is still freed
  1777    all the same.  */
  1778 
  1779 int
  1780 sfnt_unmap_glyf_table (struct sfnt_glyf_table *glyf)
  1781 {
  1782   int rc;
  1783   size_t size;
  1784 
  1785   /* Calculate the size of the mapping.  */
  1786   size = glyf->size + (glyf->glyphs - glyf->start);
  1787 
  1788   rc = munmap (glyf->start, size);
  1789   xfree (glyf);
  1790 
  1791   return rc != 0;
  1792 }
  1793 
  1794 #endif /* HAVE_MMAP */
  1795 
  1796 /* Read the simple glyph outline from the glyph GLYPH from the
  1797    specified glyf table at the given offset.  Set GLYPH->simple to a
  1798    non-NULL value upon success, else set it to NULL.  */
  1799 
  1800 static void
  1801 sfnt_read_simple_glyph (struct sfnt_glyph *glyph,
  1802                         struct sfnt_glyf_table *glyf,
  1803                         size_t offset)
  1804 {
  1805   struct sfnt_simple_glyph *simple;
  1806   ssize_t min_size, min_size_2;
  1807   int i, number_of_points, repeat_count;
  1808   unsigned char *instructions_start;
  1809   unsigned char *flags_start, *flags_end;
  1810   unsigned char *vec_start;
  1811   int16_t delta, x, y;
  1812 
  1813   /* Calculate the minimum size of the glyph data.  This is the size
  1814      of the instruction length field followed by
  1815      glyph->number_of_contours * sizeof (uint16_t).  */
  1816 
  1817   min_size = (glyph->number_of_contours * sizeof (uint16_t)
  1818               + sizeof (uint16_t));
  1819 
  1820   /* Check that the size is big enough.  */
  1821   if (glyf->size < offset + min_size)
  1822     {
  1823       glyph->simple = NULL;
  1824       return;
  1825     }
  1826 
  1827   /* Allocate enough to read at least that.  */
  1828   simple = xmalloc (sizeof *simple + min_size);
  1829   simple->end_pts_of_contours = (uint16_t *) (simple + 1);
  1830   memcpy (simple->end_pts_of_contours, glyf->glyphs + offset,
  1831           min_size);
  1832 
  1833   /* This is not really an index into simple->end_pts_of_contours.
  1834      Rather, it is reading the first word past it.  */
  1835   simple->instruction_length
  1836     = simple->end_pts_of_contours[glyph->number_of_contours];
  1837 
  1838   /* Swap the contour end point indices and the instruction
  1839      length.  */
  1840 
  1841   for (i = 0; i < glyph->number_of_contours; ++i)
  1842     sfnt_swap16 (&simple->end_pts_of_contours[i]);
  1843 
  1844   sfnt_swap16 (&simple->instruction_length);
  1845 
  1846   /* Based on those values, calculate the maximum size of the
  1847      following data.  This is the instruction length + the last
  1848      contour point + the last contour point * uint16_t * 2.  */
  1849 
  1850   if (glyph->number_of_contours)
  1851     number_of_points
  1852       = simple->end_pts_of_contours[glyph->number_of_contours - 1] + 1;
  1853   else
  1854     number_of_points = 0;
  1855 
  1856   min_size_2 = (simple->instruction_length
  1857                 + number_of_points
  1858                 + (number_of_points
  1859                    * sizeof (uint16_t) * 2));
  1860 
  1861   /* Set simple->number_of_points.  */
  1862   simple->number_of_points = number_of_points;
  1863 
  1864   /* Make simple big enough.  */
  1865   simple = xrealloc (simple, sizeof *simple + min_size + min_size_2);
  1866   simple->end_pts_of_contours = (uint16_t *) (simple + 1);
  1867 
  1868   /* Set the instruction data pointer and other pointers.
  1869      simple->instructions comes one word past number_of_contours,
  1870      because end_pts_of_contours also contains the instruction
  1871      length.  */
  1872   simple->instructions = (uint8_t *) (simple->end_pts_of_contours
  1873                                       + glyph->number_of_contours + 1);
  1874   simple->flags = simple->instructions + simple->instruction_length;
  1875 
  1876   /* Read instructions into the glyph.  */
  1877   instructions_start = glyf->glyphs + offset + min_size;
  1878 
  1879   if (instructions_start >= glyf->glyphs + glyf->size
  1880       || (instructions_start + simple->instruction_length
  1881           >= glyf->glyphs + glyf->size))
  1882     {
  1883       glyph->simple = NULL;
  1884       xfree (simple);
  1885       return;
  1886     }
  1887 
  1888   memcpy (simple->instructions, instructions_start,
  1889           simple->instruction_length);
  1890 
  1891   /* Start reading flags.  */
  1892   flags_start = (glyf->glyphs + offset
  1893                  + min_size + simple->instruction_length);
  1894   flags_end = flags_start + number_of_points;
  1895 
  1896   if (flags_start >= glyf->glyphs + glyf->size)
  1897     {
  1898       glyph->simple = NULL;
  1899       xfree (simple);
  1900       return;
  1901     }
  1902 
  1903   i = 0;
  1904 
  1905   while (flags_start < flags_end)
  1906     {
  1907       if (i == number_of_points)
  1908         break;
  1909 
  1910       if (flags_start >= glyf->glyphs + glyf->size)
  1911         break;
  1912 
  1913       simple->flags[i++] = *flags_start;
  1914 
  1915       if (*flags_start & 010) /* REPEAT_FLAG */
  1916         {
  1917           /* The next byte specifies how many times this byte is to be
  1918              repeated.  Check that it is in range.  */
  1919 
  1920           if (flags_start + 1 >= glyf->glyphs + glyf->size)
  1921             {
  1922               glyph->simple = NULL;
  1923               xfree (simple);
  1924               return;
  1925             }
  1926 
  1927           /* Repeat the current flag until
  1928              glyph->number_of_points.  */
  1929 
  1930           repeat_count = *(flags_start + 1);
  1931 
  1932           while (i < number_of_points && repeat_count)
  1933             {
  1934               simple->flags[i++] = *flags_start;
  1935               repeat_count--;
  1936             }
  1937 
  1938           /* Skip one byte in flags_start.  */
  1939           flags_start++;
  1940         }
  1941 
  1942       flags_start++;
  1943     }
  1944 
  1945   /* If an insufficient number of flags have been read, then the
  1946      outline is invalid.  */
  1947 
  1948   if (i != number_of_points)
  1949     {
  1950       glyph->simple = NULL;
  1951       xfree (simple);
  1952       return;
  1953     }
  1954 
  1955   /* Now that the flags have been decoded, start decoding the
  1956      vectors.  */
  1957   simple->x_coordinates = (int16_t *) (simple->flags + number_of_points);
  1958   vec_start = flags_start;
  1959   i = 0;
  1960   x = 0;
  1961 
  1962   /* flags_start is now repurposed to act as a pointer to the flags
  1963      for the current vector! */
  1964   flags_start = simple->flags;
  1965 
  1966   while (i < number_of_points)
  1967     {
  1968       delta = 0;
  1969 
  1970       if ((*flags_start) & 02) /* X_SHORT_VECTOR */
  1971         {
  1972           /* The next byte is a delta to apply to the previous
  1973              value.  Make sure it is in bounds.  */
  1974 
  1975           if (vec_start + 1 >= glyf->glyphs + glyf->size)
  1976             {
  1977               glyph->simple = NULL;
  1978               xfree (simple);
  1979               return;
  1980             }
  1981 
  1982           delta = *vec_start++;
  1983 
  1984           if (!(*flags_start & 020)) /* SAME_X */
  1985             delta = -delta;
  1986         }
  1987       else if (!(*flags_start & 020)) /* SAME_X */
  1988         {
  1989           /* The next word is a delta to apply to the previous value.
  1990              Make sure it is in bounds.  */
  1991 
  1992           if (vec_start + 2 >= glyf->glyphs + glyf->size)
  1993             {
  1994               glyph->simple = NULL;
  1995               xfree (simple);
  1996               return;
  1997             }
  1998 
  1999           /* Read the unaligned word and swap it.  */
  2000           memcpy (&delta, vec_start, sizeof delta);
  2001           sfnt_swap16 (&delta);
  2002           vec_start += 2;
  2003         }
  2004 
  2005       /* Apply the delta and set the X value.  */
  2006       x += delta;
  2007       simple->x_coordinates[i++] = x;
  2008       flags_start++;
  2009     }
  2010 
  2011   /* Decode the Y vector.  flags_start is again repurposed to act as a
  2012      pointer to the flags for the current vector.  */
  2013   flags_start = simple->flags;
  2014   y = 0;
  2015   simple->y_coordinates = simple->x_coordinates + i;
  2016   i = 0;
  2017 
  2018   while (i < number_of_points)
  2019     {
  2020       delta = 0;
  2021 
  2022       if (*flags_start & 04) /* Y_SHORT_VECTOR */
  2023         {
  2024           /* The next byte is a delta to apply to the previous
  2025              value.  Make sure it is in bounds.  */
  2026 
  2027           if (vec_start + 1 >= glyf->glyphs + glyf->size)
  2028             {
  2029               glyph->simple = NULL;
  2030               xfree (simple);
  2031               return;
  2032             }
  2033 
  2034           delta = *vec_start++;
  2035 
  2036           if (!(*flags_start & 040)) /* SAME_Y */
  2037             delta = -delta;
  2038         }
  2039       else if (!(*flags_start & 040)) /* SAME_Y */
  2040         {
  2041           /* The next word is a delta to apply to the previous value.
  2042              Make sure it is in bounds.  */
  2043 
  2044           if (vec_start + 2 >= glyf->glyphs + glyf->size)
  2045             {
  2046               glyph->simple = NULL;
  2047               xfree (simple);
  2048               return;
  2049             }
  2050 
  2051           /* Read the unaligned word and swap it.  */
  2052           memcpy (&delta, vec_start, sizeof delta);
  2053           sfnt_swap16 (&delta);
  2054           vec_start += 2;
  2055         }
  2056 
  2057       /* Apply the delta and set the X value.  */
  2058       y += delta;
  2059       simple->y_coordinates[i++] = y;
  2060       flags_start++;
  2061     }
  2062 
  2063   /* All done.  */
  2064   simple->y_coordinates_end = simple->y_coordinates + i;
  2065   glyph->simple = simple;
  2066   return;
  2067 }
  2068 
  2069 /* Read the compound glyph outline from the glyph GLYPH from the
  2070    specified glyf table at the given offset.  Set GLYPH->compound to a
  2071    non-NULL value upon success, else set it to NULL.  */
  2072 
  2073 static void
  2074 sfnt_read_compound_glyph (struct sfnt_glyph *glyph,
  2075                           struct sfnt_glyf_table *glyf,
  2076                           size_t offset)
  2077 {
  2078   uint16_t flags, instruction_length, words[2], words4[4];
  2079   size_t required_bytes, num_components, i;
  2080   unsigned char *data, *instruction_base;
  2081 
  2082   /* Assume failure for now.  Figure out how many bytes have to be
  2083      allocated by reading the compound data.  */
  2084   glyph->compound = NULL;
  2085   required_bytes = 0;
  2086   num_components = 0;
  2087   data = glyf->glyphs + offset;
  2088 
  2089   /* Offset could be unaligned.  */
  2090   do
  2091     {
  2092       if (data + 2 > glyf->glyphs + glyf->size)
  2093         return;
  2094 
  2095       memcpy (&flags, data, sizeof flags);
  2096       sfnt_swap16 (&flags);
  2097       data += sizeof flags;
  2098 
  2099       /* Require at least one structure to hold this data.  */
  2100       required_bytes += sizeof (struct sfnt_compound_glyph_component);
  2101       num_components++;
  2102 
  2103       /* Skip past unused data.  */
  2104       data += 2;
  2105 
  2106       if (flags & 01) /* ARG_1_AND_2_ARE_WORDS */
  2107         data += sizeof (int16_t) * 2;
  2108       else
  2109         data += sizeof (int8_t) * 2;
  2110 
  2111       if (flags & 010) /* WE_HAVE_A_SCALE */
  2112         data += sizeof (uint16_t);
  2113       else if (flags & 0100) /* WE_HAVE_AN_X_AND_Y_SCALE */
  2114         data += sizeof (uint16_t) * 2;
  2115       else if (flags & 0200) /* WE_HAVE_A_TWO_BY_TWO */
  2116         data += sizeof (uint16_t) * 4;
  2117     }
  2118   while (flags & 040); /* MORE_COMPONENTS */
  2119 
  2120   if (flags & 0400) /* WE_HAVE_INSTRUCTIONS */
  2121     {
  2122       /* Figure out the instruction length.  */
  2123       if (data + 2 > glyf->glyphs + glyf->size)
  2124         return;
  2125 
  2126       /* Now see how much is required to hold the instruction
  2127          data.  */
  2128       memcpy (&instruction_length, data,
  2129               sizeof instruction_length);
  2130       sfnt_swap16 (&instruction_length);
  2131       required_bytes += instruction_length;
  2132       data += sizeof data + instruction_length;
  2133     }
  2134 
  2135   /* Now allocate the buffer to hold all the glyph data.  */
  2136   glyph->compound = xmalloc (sizeof *glyph->compound
  2137                              + required_bytes);
  2138   glyph->compound->components
  2139     = (struct sfnt_compound_glyph_component *) (glyph->compound + 1);
  2140   glyph->compound->num_components = num_components;
  2141 
  2142   /* Figure out where instruction data starts.  It comes after
  2143      glyph->compound->components ends.  */
  2144   instruction_base
  2145     = (unsigned char *) (glyph->compound->components
  2146                          + glyph->compound->num_components);
  2147 
  2148   /* Start reading.  */
  2149   i = 0;
  2150   data = glyf->glyphs + offset;
  2151   do
  2152     {
  2153       if (data + 4 > glyf->glyphs + glyf->size)
  2154         {
  2155           xfree (glyph->compound);
  2156           glyph->compound = NULL;
  2157           return;
  2158         }
  2159 
  2160       memcpy (&flags, data, sizeof flags);
  2161       sfnt_swap16 (&flags);
  2162       data += sizeof flags;
  2163       glyph->compound->components[i].flags = flags;
  2164 
  2165       memcpy (&glyph->compound->components[i].glyph_index,
  2166               data, sizeof glyph->compound->components[i].glyph_index);
  2167       sfnt_swap16 (&glyph->compound->components[i].glyph_index);
  2168       data += sizeof glyph->compound->components[i].glyph_index;
  2169 
  2170       if (flags & 01) /* ARG_1_AND_2_ARE_WORDS.  */
  2171         {
  2172           if (data + 4 > glyf->glyphs + glyf->size)
  2173             {
  2174               xfree (glyph->compound);
  2175               glyph->compound = NULL;
  2176               return;
  2177             }
  2178 
  2179           /* Read two words into arg1 and arg2.  */
  2180           memcpy (words, data, sizeof words);
  2181           sfnt_swap16 (&words[0]);
  2182           sfnt_swap16 (&words[1]);
  2183 
  2184           glyph->compound->components[i].argument1.c = words[0];
  2185           glyph->compound->components[i].argument2.c = words[1];
  2186           data += sizeof words;
  2187         }
  2188       else
  2189         {
  2190           if (data + 2 > glyf->glyphs + glyf->size)
  2191             {
  2192               xfree (glyph->compound);
  2193               glyph->compound = NULL;
  2194               return;
  2195             }
  2196 
  2197           /* Read two bytes into arg1 and arg2.  */
  2198           glyph->compound->components[i].argument1.a = data[0];
  2199           glyph->compound->components[i].argument2.a = data[1];
  2200           data += 2;
  2201         }
  2202 
  2203       if (flags & 010) /* WE_HAVE_A_SCALE */
  2204         {
  2205           if (data + 2 > glyf->glyphs + glyf->size)
  2206             {
  2207               xfree (glyph->compound);
  2208               glyph->compound = NULL;
  2209               return;
  2210             }
  2211 
  2212           /* Read one word into scale.  */
  2213           memcpy (&glyph->compound->components[i].u.scale, data,
  2214                   sizeof glyph->compound->components[i].u.scale);
  2215           sfnt_swap16 (&glyph->compound->components[i].u.scale);
  2216           data += sizeof glyph->compound->components[i].u.scale;
  2217         }
  2218       else if (flags & 0100) /* WE_HAVE_AN_X_AND_Y_SCALE.  */
  2219         {
  2220           if (data + 4 > glyf->glyphs + glyf->size)
  2221             {
  2222               xfree (glyph->compound);
  2223               glyph->compound = NULL;
  2224               return;
  2225             }
  2226 
  2227           /* Read two words into xscale and yscale.  */
  2228           memcpy (words, data, sizeof words);
  2229           sfnt_swap16 (&words[0]);
  2230           sfnt_swap16 (&words[1]);
  2231 
  2232           glyph->compound->components[i].u.a.xscale = words[0];
  2233           glyph->compound->components[i].u.a.yscale = words[1];
  2234           data += sizeof words;
  2235         }
  2236       else if (flags & 0200) /* WE_HAVE_A_TWO_BY_TWO */
  2237         {
  2238           if (data + 8 > glyf->glyphs + glyf->size)
  2239             {
  2240               xfree (glyph->compound);
  2241               glyph->compound = NULL;
  2242               return;
  2243             }
  2244 
  2245           /* Read 4 words into the transformation matrix.  */
  2246           memcpy (words4, data, sizeof words4);
  2247           sfnt_swap16 (&words4[0]);
  2248           sfnt_swap16 (&words4[1]);
  2249           sfnt_swap16 (&words4[2]);
  2250           sfnt_swap16 (&words4[3]);
  2251 
  2252           glyph->compound->components[i].u.b.xscale = words4[0];
  2253           glyph->compound->components[i].u.b.scale01 = words4[1];
  2254           glyph->compound->components[i].u.b.scale10 = words4[2];
  2255           glyph->compound->components[i].u.b.yscale = words4[3];
  2256           data += sizeof words4;
  2257         }
  2258 
  2259       /* Record the component flags.  */
  2260       glyph->compound->components[i].flags = flags;
  2261 
  2262       i++;
  2263     }
  2264   while (flags & 040); /* MORE_COMPONENTS */
  2265 
  2266   if (flags & 0400) /* WE_HAVE_INSTR */
  2267     {
  2268       /* Figure out the instruction length.  */
  2269       if (data + 2 > glyf->glyphs + glyf->size)
  2270         {
  2271           xfree (glyph->compound);
  2272           glyph->compound = NULL;
  2273           return;
  2274         }
  2275 
  2276       /* Now see how much is required to hold the instruction
  2277          data.  */
  2278       memcpy (&glyph->compound->instruction_length,
  2279               data,
  2280               sizeof glyph->compound->instruction_length);
  2281       sfnt_swap16 (&glyph->compound->instruction_length);
  2282       data += 2;
  2283 
  2284       /* Read the instructions.  */
  2285       glyph->compound->instructions = instruction_base;
  2286 
  2287       if (data + glyph->compound->instruction_length
  2288           > glyf->glyphs + glyf->size)
  2289         {
  2290           xfree (glyph->compound);
  2291           glyph->compound = NULL;
  2292           return;
  2293         }
  2294 
  2295       memcpy (instruction_base, data,
  2296               glyph->compound->instruction_length);
  2297     }
  2298   else
  2299     {
  2300       glyph->compound->instructions = NULL;
  2301       glyph->compound->instruction_length = 0;
  2302     }
  2303 
  2304   /* Data read successfully.  */
  2305   return;
  2306 }
  2307 
  2308 /* Read the description of the glyph GLYPH_CODE from the specified
  2309    glyf table, using the offsets of LOCA_SHORT or LOCA_LONG, depending
  2310    on which is non-NULL.  */
  2311 
  2312 TEST_STATIC struct sfnt_glyph *
  2313 sfnt_read_glyph (sfnt_glyph glyph_code,
  2314                  struct sfnt_glyf_table *glyf,
  2315                  struct sfnt_loca_table_short *loca_short,
  2316                  struct sfnt_loca_table_long *loca_long)
  2317 {
  2318   struct sfnt_glyph glyph, *memory;
  2319   size_t offset, next_offset;
  2320 
  2321   /* Check the glyph code is within bounds.  */
  2322   if (glyph_code > 65535)
  2323     return NULL;
  2324 
  2325   if (loca_short)
  2326     {
  2327       /* Check that the glyph is within bounds.  glyph_code + 1 is the
  2328          entry in the table which defines the length of the glyph.  */
  2329       if (glyph_code + 1 >= loca_short->num_offsets)
  2330         return NULL;
  2331 
  2332       offset = loca_short->offsets[glyph_code] * 2;
  2333       next_offset = loca_short->offsets[glyph_code + 1] * 2;
  2334     }
  2335   else if (loca_long)
  2336     {
  2337       if (glyph_code + 1 >= loca_long->num_offsets)
  2338         return NULL;
  2339 
  2340       offset = loca_long->offsets[glyph_code];
  2341       next_offset = loca_long->offsets[glyph_code + 1];
  2342     }
  2343   else
  2344     abort ();
  2345 
  2346   /* If offset - next_offset is 0, then the glyph is empty.  Its
  2347      horizontal advance may still be provided by the hmtx table.  */
  2348 
  2349   if (offset == next_offset)
  2350     {
  2351       glyph.number_of_contours = 0;
  2352       glyph.xmin = 0;
  2353       glyph.ymin = 0;
  2354       glyph.xmax = 0;
  2355       glyph.ymax = 0;
  2356       glyph.simple = xmalloc (sizeof *glyph.simple);
  2357       glyph.compound = NULL;
  2358       memset (glyph.simple, 0, sizeof *glyph.simple);
  2359       memory = xmalloc (sizeof *memory);
  2360       *memory = glyph;
  2361       return memory;
  2362     }
  2363 
  2364   /* Verify that GLYF is big enough to hold a glyph at OFFSET.  */
  2365   if (glyf->size < offset + SFNT_ENDOF (struct sfnt_glyph,
  2366                                         ymax, sfnt_fword))
  2367     return NULL;
  2368 
  2369   /* Copy over the glyph data.  */
  2370   memcpy (&glyph, glyf->glyphs + offset,
  2371           SFNT_ENDOF (struct sfnt_glyph,
  2372                       ymax, sfnt_fword));
  2373 
  2374   /* Swap the glyph data.  */
  2375   sfnt_swap16 (&glyph.number_of_contours);
  2376   sfnt_swap16 (&glyph.xmin);
  2377   sfnt_swap16 (&glyph.ymin);
  2378   sfnt_swap16 (&glyph.xmax);
  2379   sfnt_swap16 (&glyph.ymax);
  2380 
  2381   /* This is set later on after `sfnt_vary_X_glyph'.  */
  2382   glyph.advance_distortion = 0;
  2383   glyph.origin_distortion = 0;
  2384 
  2385   /* Figure out what needs to be read based on
  2386      glyph.number_of_contours.  */
  2387   if (glyph.number_of_contours >= 0)
  2388     {
  2389       /* Read the simple glyph.  */
  2390 
  2391       glyph.compound = NULL;
  2392       sfnt_read_simple_glyph (&glyph, glyf,
  2393                               offset + SFNT_ENDOF (struct sfnt_glyph,
  2394                                                    ymax, sfnt_fword));
  2395 
  2396       if (glyph.simple)
  2397         {
  2398           memory = xmalloc (sizeof glyph);
  2399           *memory = glyph;
  2400 
  2401           return memory;
  2402         }
  2403     }
  2404   else
  2405     {
  2406       /* Read the compound glyph.  */
  2407 
  2408       glyph.simple = NULL;
  2409       sfnt_read_compound_glyph (&glyph, glyf,
  2410                                 offset + SFNT_ENDOF (struct sfnt_glyph,
  2411                                                      ymax, sfnt_fword));
  2412 
  2413       if (glyph.compound)
  2414         {
  2415           memory = xmalloc (sizeof glyph);
  2416           *memory = glyph;
  2417 
  2418           return memory;
  2419         }
  2420     }
  2421 
  2422   return NULL;
  2423 }
  2424 
  2425 /* Free a glyph returned from sfnt_read_glyph.  GLYPH may be NULL.  */
  2426 
  2427 TEST_STATIC void
  2428 sfnt_free_glyph (struct sfnt_glyph *glyph)
  2429 {
  2430   if (!glyph)
  2431     return;
  2432 
  2433   xfree (glyph->simple);
  2434   xfree (glyph->compound);
  2435   xfree (glyph);
  2436 }
  2437 
  2438 
  2439 
  2440 /* Glyph outline decomposition.  */
  2441 
  2442 /* Apply the transform in the compound glyph component COMPONENT to
  2443    the array of points of length NUM_COORDINATES given as X and Y.
  2444 
  2445    Also, apply the fixed point offsets X_OFF and Y_OFF to each X and Y
  2446    coordinate.
  2447 
  2448    See sfnt_decompose_compound_glyph for an explanation of why offsets
  2449    might be applied here, and not while reading the subglyph
  2450    itself.  */
  2451 
  2452 static void
  2453 sfnt_transform_coordinates (struct sfnt_compound_glyph_component *component,
  2454                             sfnt_fixed *restrict x, sfnt_fixed *restrict y,
  2455                             size_t num_coordinates,
  2456                             sfnt_fixed x_off, sfnt_fixed y_off)
  2457 {
  2458   double m1, m2, m3;
  2459   double m4, m5, m6;
  2460   size_t i;
  2461 
  2462   if (component->flags & 010) /* WE_HAVE_A_SCALE */
  2463     {
  2464       for (i = 0; i < num_coordinates; ++i)
  2465         {
  2466           x[i] *= component->u.scale / 16384.0;
  2467           y[i] *= component->u.scale / 16384.0;
  2468           x[i] += x_off;
  2469           y[i] += y_off;
  2470         }
  2471     }
  2472   else if (component->flags & 0100) /* WE_HAVE_AN_X_AND_Y_SCALE */
  2473     {
  2474       for (i = 0; i < num_coordinates; ++i)
  2475         {
  2476           x[i] *= component->u.a.xscale / 16384.0;
  2477           y[i] *= component->u.a.yscale / 16384.0;
  2478           x[i] += x_off;
  2479           y[i] += y_off;
  2480         }
  2481     }
  2482   else if (component->flags & 0200) /* WE_HAVE_A_TWO_BY_TWO */
  2483     {
  2484       /* Apply the specified affine transformation.
  2485          A transform looks like:
  2486 
  2487            M1 M2 M3     X
  2488            M4 M5 M6   * Y
  2489 
  2490            =
  2491 
  2492            M1*X + M2*Y + M3*1 = X1
  2493            M4*X + M5*Y + M6*1 = Y1
  2494 
  2495          (In most transforms, there is another row at the bottom for
  2496           mathematical reasons.  Since Z1 is always 1.0, the row is
  2497           simply implied to be 0 0 1, because 0 * x + 0 * y + 1 * 1 =
  2498           1.0.  See the definition of matrix3x3 in image.c for some
  2499           more explanations about this.) */
  2500       m1 = component->u.b.xscale / 16384.0;
  2501       m2 = component->u.b.scale01 / 16384.0;
  2502       m3 = 0;
  2503       m4 = component->u.b.scale10 / 16384.0;
  2504       m5 = component->u.b.yscale / 16384.0;
  2505       m6 = 0;
  2506 
  2507       for (i = 0; i < num_coordinates; ++i)
  2508         {
  2509           x[i] = m1 * x[i] + m2 * y[i] + m3 * 1;
  2510           y[i] = m4 * x[i] + m5 * y[i] + m6 * 1;
  2511           x[i] += x_off;
  2512           y[i] += y_off;
  2513         }
  2514     }
  2515 }
  2516 
  2517 struct sfnt_compound_glyph_context
  2518 {
  2519   /* Arrays of points.  The underlying type is actually sfnt_f26dot6
  2520      when instructing a compound glyph.  */
  2521   sfnt_fixed *x_coordinates, *y_coordinates;
  2522 
  2523   /* Array of flags for the points.  */
  2524   unsigned char *flags;
  2525 
  2526   /* Number of points in that array, and the size of that array.  */
  2527   size_t num_points, points_size;
  2528 
  2529   /* Array of contour end points.  */
  2530   size_t *contour_end_points;
  2531 
  2532   /* Number of elements in and the size of that array.  */
  2533   size_t num_end_points, end_points_size;
  2534 };
  2535 
  2536 /* Extend the arrays inside the compound glyph decomposition context
  2537    CONTEXT.  NUMBER_OF_CONTOURS is the number of contours to add.
  2538    NUMBER_OF_POINTS is the number of points to add.
  2539 
  2540    Return pointers to the beginning of the extension in *X_BASE,
  2541    *Y_BASE, *FLAGS_BASE and *CONTOUR_BASE.  Value zero upon success,
  2542    and something else on failure.  */
  2543 
  2544 static int
  2545 sfnt_expand_compound_glyph_context (struct sfnt_compound_glyph_context *context,
  2546                                     size_t number_of_contours,
  2547                                     size_t number_of_points,
  2548                                     sfnt_fixed **x_base, sfnt_fixed **y_base,
  2549                                     unsigned char **flags_base,
  2550                                     size_t **contour_base)
  2551 {
  2552   size_t size_bytes;
  2553 
  2554   /* Add each field while checking for overflow.  */
  2555   if (INT_ADD_WRAPV (number_of_contours, context->num_end_points,
  2556                      &context->num_end_points))
  2557     return 1;
  2558 
  2559   if (INT_ADD_WRAPV (number_of_points, context->num_points,
  2560                      &context->num_points))
  2561     return 1;
  2562 
  2563   /* Reallocate each array to the new size if necessary.  */
  2564   if (context->points_size < context->num_points)
  2565     {
  2566       if (INT_MULTIPLY_WRAPV (context->num_points, 2,
  2567                               &context->points_size))
  2568         context->points_size = context->num_points;
  2569 
  2570       if (INT_MULTIPLY_WRAPV (context->points_size,
  2571                               sizeof *context->x_coordinates,
  2572                               &size_bytes))
  2573         return 1;
  2574 
  2575       context->x_coordinates = xrealloc (context->x_coordinates,
  2576                                          size_bytes);
  2577       context->y_coordinates = xrealloc (context->y_coordinates,
  2578                                          size_bytes);
  2579       context->flags = xrealloc (context->flags,
  2580                                  context->points_size);
  2581     }
  2582 
  2583   /* Set x_base and y_base.  */
  2584   *x_base = (context->x_coordinates
  2585              + context->num_points
  2586              - number_of_points);
  2587   *y_base = (context->y_coordinates
  2588              + context->num_points
  2589              - number_of_points);
  2590   *flags_base = (context->flags
  2591                  + context->num_points
  2592                  - number_of_points);
  2593 
  2594   if (context->end_points_size < context->num_end_points)
  2595     {
  2596       if (INT_MULTIPLY_WRAPV (context->num_end_points, 2,
  2597                               &context->end_points_size))
  2598         context->end_points_size = context->num_end_points;
  2599 
  2600       if (INT_MULTIPLY_WRAPV (context->end_points_size,
  2601                               sizeof *context->contour_end_points,
  2602                               &size_bytes))
  2603         return 1;
  2604 
  2605       context->contour_end_points
  2606         = xrealloc (context->contour_end_points,
  2607                     size_bytes);
  2608     }
  2609 
  2610   /* Set contour_base.  */
  2611   *contour_base = (context->contour_end_points
  2612                    + context->num_end_points
  2613                    - number_of_contours);
  2614   return 0;
  2615 }
  2616 
  2617 /* Round the 16.16 fixed point number NUMBER to the nearest integral
  2618    value.  */
  2619 
  2620 static int32_t
  2621 sfnt_round_fixed (int32_t number)
  2622 {
  2623   /* Add 0.5... */
  2624   number += (1 << 15);
  2625 
  2626   /* Remove the fractional.  */
  2627   return number & ~0xffff;
  2628 }
  2629 
  2630 /* Decompose GLYPH, a compound glyph, into an array of points and
  2631    contours.
  2632 
  2633    CONTEXT should be zeroed and put on the stack.  OFF_X and OFF_Y
  2634    should be zero, as should RECURSION_COUNT.  GET_GLYPH and
  2635    FREE_GLYPH, along with DCONTEXT, mean the same as in
  2636    sfnt_decompose_glyph.
  2637 
  2638    Value is 1 upon failure, else 0.  */
  2639 
  2640 static int
  2641 sfnt_decompose_compound_glyph (struct sfnt_glyph *glyph,
  2642                                struct sfnt_compound_glyph_context *context,
  2643                                sfnt_get_glyph_proc get_glyph,
  2644                                sfnt_free_glyph_proc free_glyph,
  2645                                sfnt_fixed off_x, sfnt_fixed off_y,
  2646                                int recursion_count,
  2647                                void *dcontext)
  2648 {
  2649   struct sfnt_glyph *subglyph;
  2650   int i, j, rc;
  2651   bool need_free;
  2652   struct sfnt_compound_glyph_component *component;
  2653   sfnt_fixed x, y, xtemp, ytemp;
  2654   size_t point UNINIT, point2 UNINIT, index;
  2655   uint16_t last_point, number_of_contours;
  2656   sfnt_fixed *x_base, *y_base;
  2657   size_t *contour_base;
  2658   unsigned char *flags_base;
  2659   size_t base_index, contour_start;
  2660   bool defer_offsets;
  2661 
  2662   /* Set up the base index.  This is the index from where on point
  2663      renumbering starts.
  2664 
  2665      In other words, point 0 in this glyph will be 0 + base_index,
  2666      point 1 will be 1 + base_index, and so on.  */
  2667   base_index = context->num_points;
  2668 
  2669   /* Prevent infinite loops.  Simply limit the level of nesting to the
  2670      maximum valid value of `max_component_depth', which is 16.  */
  2671 
  2672   if (recursion_count > 16)
  2673     return 1;
  2674 
  2675   for (j = 0; j < glyph->compound->num_components; ++j)
  2676     {
  2677       /* Look up the associated subglyph.  */
  2678       component = &glyph->compound->components[j];
  2679       subglyph = get_glyph (component->glyph_index,
  2680                             dcontext, &need_free);
  2681 
  2682       if (!subglyph)
  2683         return 1;
  2684 
  2685       /* Don't defer offsets.  This variable is set if the component
  2686          glyph is a compound glyph that is anchored to a previously
  2687          decomposed point, and needs its coordinates adjusted after
  2688          decomposition completes.  */
  2689       defer_offsets = false;
  2690 
  2691       /* Record the size of the point array before expansion.  This
  2692          will be the base to apply to all points coming from this
  2693          subglyph.  */
  2694       contour_start = context->num_points;
  2695 
  2696       /* Compute the offset for the component.  */
  2697       if (component->flags & 02) /* ARGS_ARE_XY_VALUES */
  2698         {
  2699           /* Component offsets are X/Y values as opposed to points
  2700              GLYPH.  */
  2701 
  2702           if (!(component->flags & 01)) /* ARG_1_AND_2_ARE_WORDS */
  2703             {
  2704               /* X and Y are signed bytes.  */
  2705               x = component->argument1.b * 65536;
  2706               y = component->argument2.b * 65536;
  2707             }
  2708           else
  2709             {
  2710               /* X and Y are signed words.  */
  2711               x = component->argument1.d * 65536;
  2712               y = component->argument2.d * 65536;
  2713             }
  2714 
  2715           /* If there is some kind of scale and component offsets are
  2716              scaled, then apply the transform to the offset.  */
  2717           if (component->flags & 04000) /* SCALED_COMPONENT_OFFSET */
  2718             sfnt_transform_coordinates (component, &x, &y, 1,
  2719                                         0, 0);
  2720 
  2721           if (component->flags & 04) /* ROUND_XY_TO_GRID */
  2722             {
  2723               x = sfnt_round_fixed (x);
  2724               y = sfnt_round_fixed (y);
  2725             }
  2726         }
  2727       else
  2728         {
  2729           /* The offset is determined by matching a point location in
  2730              a preceeding component with a point location in the
  2731              current component.  The index of the point in the
  2732              previous component can be determined by adding
  2733              component->argument1.a or component->argument1.c to
  2734              point.  argument2 contains the index of the point in the
  2735              current component.  */
  2736 
  2737           if (!(component->flags & 01)) /* ARG_1_AND_2_ARE_WORDS */
  2738             {
  2739               point = base_index + component->argument1.a;
  2740               point2 = component->argument2.a;
  2741             }
  2742           else
  2743             {
  2744               point = base_index + component->argument1.c;
  2745               point2 = component->argument2.c;
  2746             }
  2747 
  2748           /* Now, check that the anchor point specified lies inside
  2749              the glyph.  */
  2750 
  2751           if (point >= contour_start)
  2752             {
  2753               if (need_free)
  2754                 free_glyph (subglyph, dcontext);
  2755 
  2756               return 1;
  2757             }
  2758 
  2759           if (!subglyph->compound)
  2760             {
  2761               if (point2 >= subglyph->simple->number_of_points)
  2762                 {
  2763                   if (need_free)
  2764                     free_glyph (subglyph, dcontext);
  2765 
  2766                   return 1;
  2767                 }
  2768 
  2769               /* Get the points and use them to compute the offsets.  */
  2770               xtemp = context->x_coordinates[point];
  2771               ytemp = context->y_coordinates[point];
  2772               x = (xtemp - subglyph->simple->x_coordinates[point2] * 65536);
  2773               y = (ytemp - subglyph->simple->y_coordinates[point2] * 65536);
  2774             }
  2775           else
  2776             {
  2777               /* First, set offsets to 0, because it is not yet
  2778                  possible to determine the position of the anchor
  2779                  point in the child.  */
  2780               x = 0;
  2781               y = 0;
  2782 
  2783               /* Set a flag which indicates that offsets must be
  2784                  resolved from the child glyph after it is loaded, but
  2785                  before it is incorporated into the parent glyph.  */
  2786               defer_offsets = true;
  2787             }
  2788         }
  2789 
  2790       if (subglyph->simple)
  2791         {
  2792           /* Simple subglyph.  Copy over the points and contours, and
  2793              transform them.  */
  2794           if (subglyph->number_of_contours)
  2795             {
  2796               index = subglyph->number_of_contours - 1;
  2797               last_point
  2798                 = subglyph->simple->end_pts_of_contours[index];
  2799               number_of_contours = subglyph->number_of_contours;
  2800 
  2801 
  2802               /* Grow various arrays.  */
  2803               rc = sfnt_expand_compound_glyph_context (context,
  2804                                                        /* Number of
  2805                                                           new contours
  2806                                                           required.  */
  2807                                                        number_of_contours,
  2808                                                        /* Number of new
  2809                                                           points
  2810                                                           required.  */
  2811                                                        last_point + 1,
  2812                                                        &x_base,
  2813                                                        &y_base,
  2814                                                        &flags_base,
  2815                                                        &contour_base);
  2816               if (rc)
  2817                 {
  2818                   if (need_free)
  2819                     free_glyph (subglyph, dcontext);
  2820 
  2821                   return 1;
  2822                 }
  2823 
  2824               for (i = 0; i <= last_point; ++i)
  2825                 {
  2826                   x_base[i] = ((subglyph->simple->x_coordinates[i] * 65536)
  2827                                + off_x + x);
  2828                   y_base[i] = ((subglyph->simple->y_coordinates[i] * 65536)
  2829                                + off_y + y);
  2830                   flags_base[i] = subglyph->simple->flags[i];
  2831                 }
  2832 
  2833               /* Apply the transform to the points.  */
  2834               sfnt_transform_coordinates (component, x_base, y_base,
  2835                                           last_point + 1, 0, 0);
  2836 
  2837               /* Copy over the contours.  */
  2838               for (i = 0; i < number_of_contours; ++i)
  2839                 contour_base[i] = (contour_start
  2840                                    + subglyph->simple->end_pts_of_contours[i]);
  2841             }
  2842         }
  2843       else
  2844         {
  2845           /* Compound subglyph.  Decompose the glyph recursively, and
  2846              then apply the transform.  */
  2847           rc = sfnt_decompose_compound_glyph (subglyph,
  2848                                               context,
  2849                                               get_glyph,
  2850                                               free_glyph,
  2851                                               off_x + x,
  2852                                               off_y + y,
  2853                                               recursion_count + 1,
  2854                                               dcontext);
  2855 
  2856           if (rc)
  2857             {
  2858               if (need_free)
  2859                 free_glyph (subglyph, dcontext);
  2860 
  2861               return 1;
  2862             }
  2863 
  2864           /* When an anchor point is being used to translate the
  2865              glyph, and the subglyph in question is actually a
  2866              compound glyph, it is impossible to know which offset to
  2867              use until the compound subglyph has actually been
  2868              loaded.
  2869 
  2870              As a result, the offset is calculated here, using the
  2871              points in the loaded child compound glyph.  But first, X
  2872              and Y must be reset to 0, as otherwise the translation
  2873              might be applied twice if defer_offsets is not set.  */
  2874 
  2875           x = 0;
  2876           y = 0;
  2877 
  2878           if (defer_offsets)
  2879             {
  2880               /* Renumber the non renumbered point2 to point into the
  2881                  decomposed component.  */
  2882               point2 += contour_start;
  2883 
  2884               /* Next, check that the non-renumbered point being
  2885                  anchored lies inside the glyph data that was
  2886                  decomposed.  */
  2887 
  2888               if (point2 >= context->num_points)
  2889                 {
  2890                   if (need_free)
  2891                     free_glyph (subglyph, dcontext);
  2892 
  2893                   return 1;
  2894                 }
  2895 
  2896               /* Get the points and use them to compute the
  2897                  offsets.  */
  2898 
  2899               xtemp = context->x_coordinates[point];
  2900               ytemp = context->y_coordinates[point];
  2901               x = (xtemp - context->x_coordinates[point2]);
  2902               y = (ytemp - context->y_coordinates[point2]);
  2903             }
  2904 
  2905           sfnt_transform_coordinates (component,
  2906                                       context->x_coordinates + contour_start,
  2907                                       context->y_coordinates + contour_start,
  2908                                       contour_start - context->num_points,
  2909                                       x, y);
  2910         }
  2911 
  2912       if (need_free)
  2913         free_glyph (subglyph, dcontext);
  2914     }
  2915 
  2916   /* Decomposition is complete.  CONTEXT now contains the adjusted
  2917      outlines of the entire compound glyph.  */
  2918   return 0;
  2919 }
  2920 
  2921 /* Linear-interpolate to a point halfway between the points specified
  2922    by CONTROL1 and CONTROL2.  Put the result in RESULT.  */
  2923 
  2924 static void
  2925 sfnt_lerp_half (struct sfnt_point *control1, struct sfnt_point *control2,
  2926                 struct sfnt_point *result)
  2927 {
  2928   result->x = control1->x + ((control2->x - control1->x) / 2);
  2929   result->y = control1->y + ((control2->y - control1->y) / 2);
  2930 }
  2931 
  2932 /* Decompose contour data inside X, Y and FLAGS, between the indices
  2933    HERE and LAST.  Call LINE_TO, CURVE_TO and MOVE_TO as appropriate,
  2934    with DCONTEXT as an argument.  Apply SCALE to each point; SCALE
  2935    should be the factor necessary to turn points into 16.16 fixed
  2936    point.
  2937 
  2938    Value is 1 upon failure, else 0.  */
  2939 
  2940 static int
  2941 sfnt_decompose_glyph_1 (size_t here, size_t last,
  2942                         sfnt_move_to_proc move_to,
  2943                         sfnt_line_to_proc line_to,
  2944                         sfnt_curve_to_proc curve_to,
  2945                         void *dcontext,
  2946                         sfnt_fword *x,
  2947                         sfnt_fword *y, unsigned char *flags,
  2948                         int scale)
  2949 {
  2950   struct sfnt_point control1, control2, start, mid;
  2951   size_t i;
  2952 
  2953   /* The contour is empty.  */
  2954 
  2955   if (here == last)
  2956     return 1;
  2957 
  2958   /* Move the pen to the start of the contour.  Apparently some fonts
  2959      have off the curve points as the start of a contour, so when that
  2960      happens lerp between the first and last points.  */
  2961 
  2962   if (flags[here] & 01) /* On Curve */
  2963     {
  2964       control1.x = x[here] * scale;
  2965       control1.y = y[here] * scale;
  2966       start = control1;
  2967     }
  2968   else if (flags[last] & 01)
  2969     {
  2970       /* Start at the last point if it is on the curve.  Here, the
  2971          start really becomes the middle of a spline.  */
  2972       control1.x = x[last] * scale;
  2973       control1.y = y[last] * scale;
  2974       start = control1;
  2975 
  2976       /* Curve back one point early.  */
  2977       last -= 1;
  2978       here -= 1;
  2979     }
  2980   else
  2981     {
  2982       /* Lerp between the start and the end.  */
  2983       control1.x = x[here] * scale;
  2984       control1.y = y[here] * scale;
  2985       control2.x = x[last] * scale;
  2986       control2.y = y[last] * scale;
  2987       sfnt_lerp_half (&control1, &control2, &start);
  2988 
  2989       /* In either of these cases, start iterating from just here as
  2990          opposed to here + 1, since logically the contour now starts
  2991          from the last curve.  */
  2992       here -= 1;
  2993     }
  2994 
  2995   /* Move to the start.  */
  2996   move_to (start, dcontext);
  2997 
  2998   /* Now handle each point between here + 1 and last.  */
  2999 
  3000   i = here;
  3001   while (++i <= last)
  3002     {
  3003       /* If the point is on the curve, then draw a line here from the
  3004          last control point.  */
  3005 
  3006       if (flags[i] & 01)
  3007         {
  3008           control1.x = x[i] * scale;
  3009           control1.y = y[i] * scale;
  3010 
  3011           line_to (control1, dcontext);
  3012 
  3013           /* Move to the next point.  */
  3014           continue;
  3015         }
  3016 
  3017       /* Off the curve points are more interesting.  They are handled
  3018          one by one, with points in between being interpolated, until
  3019          either the last point is reached or an on-curve point is
  3020          processed.  First, load the initial control points.  */
  3021 
  3022       control1.x = x[i] * scale;
  3023       control1.y = y[i] * scale;
  3024 
  3025       while (++i <= last)
  3026         {
  3027           /* Load this point.  */
  3028           control2.x = x[i] * scale;
  3029           control2.y = y[i] * scale;
  3030 
  3031           /* If this point is on the curve, curve directly to this
  3032              point.  */
  3033 
  3034           if (flags[i] & 01)
  3035             {
  3036               curve_to (control1, control2, dcontext);
  3037               goto continue_loop;
  3038             }
  3039 
  3040           /* Calculate the point between here and the previous
  3041              point.  */
  3042           sfnt_lerp_half (&control1, &control2, &mid);
  3043 
  3044           /* Curve over there.  */
  3045           curve_to (control1, mid, dcontext);
  3046 
  3047           /* Reload the control point.  */
  3048           control1 = control2;
  3049         }
  3050 
  3051       /* Close the contour by curving back to start.  */
  3052       curve_to (control1, start, dcontext);
  3053 
  3054       /* Don't close the contour twice.  */
  3055       goto exit;
  3056 
  3057     continue_loop:
  3058       continue;
  3059     }
  3060 
  3061   /* Close the contour with a line back to start.  */
  3062   line_to (start, dcontext);
  3063 
  3064  exit:
  3065   return 0;
  3066 }
  3067 
  3068 /* Decompose contour data inside X, Y and FLAGS, between the indices
  3069    HERE and LAST.  Call LINE_TO, CURVE_TO and MOVE_TO as appropriate,
  3070    with DCONTEXT as an argument.  Apply SCALE to each point; SCALE
  3071    should be the factor necessary to turn points into 16.16 fixed
  3072    point.
  3073 
  3074    This is the version of sfnt_decompose_glyph_1 which takes
  3075    sfnt_fixed (or sfnt_f26dot6) as opposed to sfnt_fword.
  3076 
  3077    Value is 1 upon failure, else 0.  */
  3078 
  3079 static int
  3080 sfnt_decompose_glyph_2 (size_t here, size_t last,
  3081                         sfnt_move_to_proc move_to,
  3082                         sfnt_line_to_proc line_to,
  3083                         sfnt_curve_to_proc curve_to,
  3084                         void *dcontext,
  3085                         sfnt_fixed *x,
  3086                         sfnt_fixed *y, unsigned char *flags,
  3087                         int scale)
  3088 {
  3089   struct sfnt_point control1, control2, start, mid;
  3090   size_t i;
  3091 
  3092   /* The contour is empty.  */
  3093 
  3094   if (here == last)
  3095     return 1;
  3096 
  3097   /* Move the pen to the start of the contour.  Apparently some fonts
  3098      have off the curve points as the start of a contour, so when that
  3099      happens lerp between the first and last points.  */
  3100 
  3101   if (flags[here] & 01) /* On Curve */
  3102     {
  3103       control1.x = x[here] * scale;
  3104       control1.y = y[here] * scale;
  3105       start = control1;
  3106     }
  3107   else if (flags[last] & 01)
  3108     {
  3109       /* Start at the last point if it is on the curve.  Here, the
  3110          start really becomes the middle of a spline.  */
  3111       control1.x = x[last] * scale;
  3112       control1.y = y[last] * scale;
  3113       start = control1;
  3114 
  3115       /* Curve back one point early.  */
  3116       last -= 1;
  3117       here -= 1;
  3118     }
  3119   else
  3120     {
  3121       /* Lerp between the start and the end.  */
  3122       control1.x = x[here] * scale;
  3123       control1.y = y[here] * scale;
  3124       control2.x = x[last] * scale;
  3125       control2.y = y[last] * scale;
  3126       sfnt_lerp_half (&control1, &control2, &start);
  3127 
  3128       /* In either of these cases, start iterating from just here as
  3129          opposed to here + 1, since logically the contour now starts
  3130          from the last curve.  */
  3131       here -= 1;
  3132     }
  3133 
  3134   /* Move to the start.  */
  3135   move_to (start, dcontext);
  3136 
  3137   /* Now handle each point between here + 1 and last.  */
  3138 
  3139   i = here;
  3140   while (++i <= last)
  3141     {
  3142       /* If the point is on the curve, then draw a line here from the
  3143          last control point.  */
  3144 
  3145       if (flags[i] & 01)
  3146         {
  3147           control1.x = x[i] * scale;
  3148           control1.y = y[i] * scale;
  3149 
  3150           line_to (control1, dcontext);
  3151 
  3152           /* Move to the next point.  */
  3153           continue;
  3154         }
  3155 
  3156       /* Off the curve points are more interesting.  They are handled
  3157          one by one, with points in between being interpolated, until
  3158          either the last point is reached or an on-curve point is
  3159          processed.  First, load the initial control points.  */
  3160 
  3161       control1.x = x[i] * scale;
  3162       control1.y = y[i] * scale;
  3163 
  3164       while (++i <= last)
  3165         {
  3166           /* Load this point.  */
  3167           control2.x = x[i] * scale;
  3168           control2.y = y[i] * scale;
  3169 
  3170           /* If this point is on the curve, curve directly to this
  3171              point.  */
  3172 
  3173           if (flags[i] & 01)
  3174             {
  3175               curve_to (control1, control2, dcontext);
  3176               goto continue_loop;
  3177             }
  3178 
  3179           /* Calculate the point between here and the previous
  3180              point.  */
  3181           sfnt_lerp_half (&control1, &control2, &mid);
  3182 
  3183           /* Curve over there.  */
  3184           curve_to (control1, mid, dcontext);
  3185 
  3186           /* Reload the control point.  */
  3187           control1 = control2;
  3188         }
  3189 
  3190       /* Close the contour by curving back to start.  */
  3191       curve_to (control1, start, dcontext);
  3192 
  3193       /* Don't close the contour twice.  */
  3194       goto exit;
  3195 
  3196     continue_loop:
  3197       continue;
  3198     }
  3199 
  3200   /* Close the contour with a line back to start.  */
  3201   line_to (start, dcontext);
  3202 
  3203  exit:
  3204   return 0;
  3205 }
  3206 
  3207 /* Decompose GLYPH into its individual components.  Call MOVE_TO to
  3208    move to a specific location.  For each line encountered, call
  3209    LINE_TO to draw a line to that location.  For each spline
  3210    encountered, call CURVE_TO to draw the curves comprising the
  3211    spline.
  3212 
  3213    If GLYPH is compound, use GET_GLYPH to obtain subglyphs.  PROC must
  3214    return whether or not FREE_GLYPH will be called with the glyph
  3215    after sfnt_decompose_glyph is done with it.
  3216 
  3217    All functions will be called with DCONTEXT as an argument.
  3218 
  3219    The winding rule used to fill the resulting lines is described in
  3220    chapter 2 of the TrueType reference manual, under the heading
  3221    "distinguishing the inside from the outside of a glyph."
  3222 
  3223    Value is 0 upon success, or some non-zero value upon failure, which
  3224    can happen if the glyph is invalid.  */
  3225 
  3226 static int
  3227 sfnt_decompose_glyph (struct sfnt_glyph *glyph,
  3228                       sfnt_move_to_proc move_to,
  3229                       sfnt_line_to_proc line_to,
  3230                       sfnt_curve_to_proc curve_to,
  3231                       sfnt_get_glyph_proc get_glyph,
  3232                       sfnt_free_glyph_proc free_glyph,
  3233                       void *dcontext)
  3234 {
  3235   size_t here, last, n;
  3236   struct sfnt_compound_glyph_context context;
  3237 
  3238   if (glyph->simple)
  3239     {
  3240       if (!glyph->number_of_contours)
  3241         /* No contours.  Nothing needs to be decomposed.  */
  3242         return 0;
  3243 
  3244       here = 0;
  3245 
  3246       for (n = 0; n < glyph->number_of_contours; ++n)
  3247         {
  3248           /* here is the first index into the glyph's point arrays
  3249              belonging to the contour in question.  last is the index
  3250              of the last point in the contour.  */
  3251           last = glyph->simple->end_pts_of_contours[n];
  3252 
  3253           /* Make sure here and last make sense.  */
  3254 
  3255           if (here > last || last >= glyph->simple->number_of_points)
  3256             return 1;
  3257 
  3258           /* Now perform the decomposition.  */
  3259           if (sfnt_decompose_glyph_1 (here, last, move_to,
  3260                                       line_to, curve_to,
  3261                                       dcontext,
  3262                                       glyph->simple->x_coordinates,
  3263                                       glyph->simple->y_coordinates,
  3264                                       glyph->simple->flags,
  3265                                       65536))
  3266             return 1;
  3267 
  3268           /* Move forward to the start of the next contour.  */
  3269           here = last + 1;
  3270         }
  3271 
  3272       return 0;
  3273     }
  3274 
  3275   /* Decompose the specified compound glyph.  */
  3276   memset (&context, 0, sizeof context);
  3277 
  3278   if (sfnt_decompose_compound_glyph (glyph, &context,
  3279                                      get_glyph, free_glyph,
  3280                                      0, 0, 0, dcontext))
  3281     {
  3282       xfree (context.x_coordinates);
  3283       xfree (context.y_coordinates);
  3284       xfree (context.flags);
  3285       xfree (context.contour_end_points);
  3286 
  3287       return 1;
  3288     }
  3289 
  3290   /* Now, generate the outlines.  */
  3291 
  3292   if (!context.num_end_points)
  3293     /* No contours.  */
  3294     goto early;
  3295 
  3296   here = 0;
  3297 
  3298   for (n = 0; n < context.num_end_points; ++n)
  3299     {
  3300       /* here is the first index into the glyph's point arrays
  3301          belonging to the contour in question.  last is the index
  3302          of the last point in the contour.  */
  3303       last = context.contour_end_points[n];
  3304 
  3305       /* Make sure here and last make sense.  */
  3306 
  3307       if (here > last || last >= context.num_points)
  3308         goto fail;
  3309 
  3310       /* Now perform the decomposition.  */
  3311       if (sfnt_decompose_glyph_2 (here, last, move_to,
  3312                                   line_to, curve_to,
  3313                                   dcontext,
  3314                                   context.x_coordinates,
  3315                                   context.y_coordinates,
  3316                                   context.flags, 1))
  3317         goto fail;
  3318 
  3319       /* Move forward.  */
  3320       here = last + 1;
  3321     }
  3322 
  3323  early:
  3324   xfree (context.x_coordinates);
  3325   xfree (context.y_coordinates);
  3326   xfree (context.flags);
  3327   xfree (context.contour_end_points);
  3328   return 0;
  3329 
  3330  fail:
  3331   xfree (context.x_coordinates);
  3332   xfree (context.y_coordinates);
  3333   xfree (context.flags);
  3334   xfree (context.contour_end_points);
  3335   return 1;
  3336 }
  3337 
  3338 struct sfnt_build_glyph_outline_context
  3339 {
  3340   /* The outline being built.  */
  3341   struct sfnt_glyph_outline *outline;
  3342 
  3343   /* Factor to multiply positions by to get the pixel width.  */
  3344   sfnt_fixed factor;
  3345 
  3346   /* The position of the pen in 16.16 fixed point format.  */
  3347   sfnt_fixed x, y;
  3348 };
  3349 
  3350 /* Global state for sfnt_build_glyph_outline and related
  3351    functions.  */
  3352 static struct sfnt_build_glyph_outline_context build_outline_context;
  3353 
  3354 /* Append the given three words FLAGS, X, and Y to the outline
  3355    currently being built.  Value is the new pointer to outline
  3356    memory.  */
  3357 
  3358 static struct sfnt_glyph_outline *
  3359 sfnt_build_append (int flags, sfnt_fixed x, sfnt_fixed y)
  3360 {
  3361   struct sfnt_glyph_outline *outline;
  3362 
  3363   if (x == build_outline_context.x
  3364       && y == build_outline_context.y)
  3365     /* Ignore redundant motion.  */
  3366     return build_outline_context.outline;
  3367 
  3368   outline = build_outline_context.outline;
  3369   outline->outline_used++;
  3370 
  3371   /* See if the outline has to be extended.  Checking for overflow
  3372      should not be necessary.  */
  3373 
  3374   if (outline->outline_used > outline->outline_size)
  3375     {
  3376       outline->outline_size = outline->outline_used * 2;
  3377 
  3378       /* Extend the outline to some size past the new size.  */
  3379       outline = xrealloc (outline, (sizeof *outline
  3380                                     + (outline->outline_size
  3381                                        * sizeof *outline->outline)));
  3382       outline->outline
  3383         = (struct sfnt_glyph_outline_command *) (outline + 1);
  3384     }
  3385 
  3386   /* Write the outline data.  */
  3387   outline->outline[outline->outline_used - 1].flags = flags;
  3388   outline->outline[outline->outline_used - 1].x = x;
  3389   outline->outline[outline->outline_used - 1].y = y;
  3390 
  3391   /* Extend outline bounding box.  */
  3392 
  3393   if (outline->outline_used == 1)
  3394     {
  3395       /* These are the first points in the outline.  */
  3396       outline->xmin = outline->xmax = x;
  3397       outline->ymin = outline->ymax = y;
  3398     }
  3399   else
  3400     {
  3401       outline->xmin = MIN ((sfnt_fixed) x, outline->xmin);
  3402       outline->ymin = MIN ((sfnt_fixed) y, outline->ymin);
  3403       outline->xmax = MAX ((sfnt_fixed) x, outline->xmax);
  3404       outline->ymax = MAX ((sfnt_fixed) y, outline->ymax);
  3405     }
  3406 
  3407   return outline;
  3408 }
  3409 
  3410 #ifndef INT64_MAX
  3411 
  3412 /* 64 bit integer type.  */
  3413 
  3414 struct sfnt_large_integer
  3415 {
  3416   unsigned int high, low;
  3417 };
  3418 
  3419 /* Calculate (A * B), placing the result in *VALUE.  */
  3420 
  3421 static void
  3422 sfnt_multiply_divide_1 (unsigned int a, unsigned int b,
  3423                         struct sfnt_large_integer *value)
  3424 {
  3425   unsigned int lo1, hi1, lo2, hi2, lo, hi, i1, i2;
  3426 
  3427   lo1 = a & 0x0000ffffu;
  3428   hi1 = a >> 16;
  3429   lo2 = b & 0x0000ffffu;
  3430   hi2 = b >> 16;
  3431 
  3432   lo = lo1 * lo2;
  3433   i1 = lo1 * hi2;
  3434   i2 = lo2 * hi1;
  3435   hi = hi1 * hi2;
  3436 
  3437   /* Check carry overflow of i1 + i2.  */
  3438   i1 += i2;
  3439   hi += (unsigned int) (i1 < i2) << 16;
  3440 
  3441   hi += i1 >> 16;
  3442   i1  = i1 << 16;
  3443 
  3444   /* Check carry overflow of i1 + lo.  */
  3445   lo += i1;
  3446   hi += (lo < i1);
  3447 
  3448   value->low = lo;
  3449   value->high = hi;
  3450 }
  3451 
  3452 /* Count the number of most significant zero bits in N.  */
  3453 
  3454 static unsigned int
  3455 sfnt_count_leading_zero_bits (unsigned int n)
  3456 {
  3457   int shift;
  3458 
  3459   shift = 0;
  3460 
  3461   if (n & 0xffff0000ul)
  3462     {
  3463       n >>= 16;
  3464       shift += 16;
  3465     }
  3466 
  3467   if (n & 0x0000ff00ul)
  3468     {
  3469       n >>= 8;
  3470       shift += 8;
  3471     }
  3472 
  3473   if (n & 0x000000f0ul)
  3474     {
  3475       n >>= 4;
  3476       shift += 4;
  3477     }
  3478 
  3479   if (n & 0x0000000cul)
  3480     {
  3481       n >>= 2;
  3482       shift += 2;
  3483     }
  3484 
  3485   if (n & 0x00000002ul)
  3486     shift += 1;
  3487 
  3488   return shift;
  3489 }
  3490 
  3491 /* Calculate AB / C.  Value is a 32 bit unsigned integer.  */
  3492 
  3493 static unsigned int
  3494 sfnt_multiply_divide_2 (struct sfnt_large_integer *ab,
  3495                         unsigned int c)
  3496 {
  3497   unsigned int hi, lo;
  3498   int i;
  3499   unsigned int r, q; /* Remainder and quotient.  */
  3500 
  3501   hi = ab->high;
  3502   lo = ab->low;
  3503 
  3504   i = 31 - sfnt_count_leading_zero_bits (hi);
  3505   r = (hi << i) | (lo >> (32 - i));
  3506   lo <<= i;
  3507   q = r / c;
  3508   r -= q * c;
  3509   i = 32 - i;
  3510 
  3511   do
  3512     {
  3513       q <<= 1;
  3514       r = (r << 1) | (lo >> 31);
  3515       lo <<= 1;
  3516 
  3517       if (r >= c)
  3518         {
  3519           r -= c;
  3520           q |= 1;
  3521         }
  3522     }
  3523   while (--i);
  3524 
  3525   return q;
  3526 }
  3527 
  3528 #endif
  3529 
  3530 /* Calculate (A * B) / C with no rounding and return the result, using
  3531    a 64 bit integer if necessary.  */
  3532 
  3533 static unsigned int
  3534 sfnt_multiply_divide (unsigned int a, unsigned int b, unsigned int c)
  3535 {
  3536 #ifndef INT64_MAX
  3537   struct sfnt_large_integer temp;
  3538 
  3539   sfnt_multiply_divide_1 (a, b, &temp);
  3540   return sfnt_multiply_divide_2 (&temp, c);
  3541 #else
  3542   uint64_t temp;
  3543 
  3544   temp = (uint64_t) a * (uint64_t) b;
  3545   return temp / c;
  3546 #endif
  3547 }
  3548 
  3549 #ifndef INT64_MAX
  3550 
  3551 /* Add the specified unsigned 32-bit N to the large integer
  3552    INTEGER.  */
  3553 
  3554 static void
  3555 sfnt_large_integer_add (struct sfnt_large_integer *integer,
  3556                         uint32_t n)
  3557 {
  3558   struct sfnt_large_integer number;
  3559 
  3560   number.low = integer->low + n;
  3561   number.high = integer->high + (number.low
  3562                                  < integer->low);
  3563 
  3564   *integer = number;
  3565 }
  3566 
  3567 /* Calculate (A * B) / C, rounding the result with a threshold of N.
  3568    Use a 64 bit temporary.  */
  3569 
  3570 static unsigned int
  3571 sfnt_multiply_divide_round (unsigned int a, unsigned int b,
  3572                             unsigned int n, unsigned int c)
  3573 {
  3574   struct sfnt_large_integer temp;
  3575 
  3576   sfnt_multiply_divide_1 (a, b, &temp);
  3577   sfnt_large_integer_add (&temp, n);
  3578   return sfnt_multiply_divide_2 (&temp, c);
  3579 }
  3580 
  3581 #endif /* INT64_MAX */
  3582 
  3583 /* The same as sfnt_multiply_divide, but handle signed values
  3584    instead.  */
  3585 
  3586 MAYBE_UNUSED static int
  3587 sfnt_multiply_divide_signed (int a, int b, int c)
  3588 {
  3589   int sign;
  3590 
  3591   sign = 1;
  3592 
  3593   if (a < 0)
  3594     sign = -sign;
  3595 
  3596   if (b < 0)
  3597     sign = -sign;
  3598 
  3599   if (c < 0)
  3600     sign = -sign;
  3601 
  3602   return (sfnt_multiply_divide (abs (a), abs (b), abs (c))
  3603           * sign);
  3604 }
  3605 
  3606 /* Multiply the two 16.16 fixed point numbers X and Y.  Return the
  3607    result regardless of overflow.  */
  3608 
  3609 static sfnt_fixed
  3610 sfnt_mul_fixed (sfnt_fixed x, sfnt_fixed y)
  3611 {
  3612 #ifdef INT64_MAX
  3613   int64_t product;
  3614 
  3615   product = (int64_t) x * (int64_t) y;
  3616 
  3617   /* This can be done quickly with int64_t.  */
  3618   return product / (int64_t) 65536;
  3619 #else
  3620   int sign;
  3621 
  3622   sign = 1;
  3623 
  3624   if (x < 0)
  3625     sign = -sign;
  3626 
  3627   if (y < 0)
  3628     sign = -sign;
  3629 
  3630   return sfnt_multiply_divide (abs (x), abs (y),
  3631                                65536) * sign;
  3632 #endif
  3633 }
  3634 
  3635 /* Multiply the two 16.16 fixed point numbers X and Y, with rounding
  3636    of the result.  */
  3637 
  3638 static sfnt_fixed
  3639 sfnt_mul_fixed_round (sfnt_fixed x, sfnt_fixed y)
  3640 {
  3641 #ifdef INT64_MAX
  3642   int64_t product, round;
  3643 
  3644   product = (int64_t) x * (int64_t) y;
  3645   round = product < 0 ? -32768 : 32768;
  3646 
  3647   /* This can be done quickly with int64_t.  */
  3648   return (product + round) / (int64_t) 65536;
  3649 #else
  3650   int sign;
  3651 
  3652   sign = 1;
  3653 
  3654   if (x < 0)
  3655     sign = -sign;
  3656 
  3657   if (y < 0)
  3658     sign = -sign;
  3659 
  3660   return sfnt_multiply_divide_round (abs (x), abs (y),
  3661                                      32768, 65536) * sign;
  3662 #endif
  3663 }
  3664 
  3665 /* Set the pen size to the specified point and return.  POINT will be
  3666    scaled up to the pixel size.  */
  3667 
  3668 static void
  3669 sfnt_move_to_and_build (struct sfnt_point point, void *dcontext)
  3670 {
  3671   sfnt_fixed x, y;
  3672 
  3673   x = sfnt_mul_fixed (build_outline_context.factor, point.x);
  3674   y = sfnt_mul_fixed (build_outline_context.factor, point.y);
  3675 
  3676   build_outline_context.outline = sfnt_build_append (0, x, y);
  3677   build_outline_context.x = x;
  3678   build_outline_context.y = y;
  3679 }
  3680 
  3681 /* Record a line to the specified point and return.  POINT will be
  3682    scaled up to the pixel size.  */
  3683 
  3684 static void
  3685 sfnt_line_to_and_build (struct sfnt_point point, void *dcontext)
  3686 {
  3687   sfnt_fixed x, y;
  3688 
  3689   x = sfnt_mul_fixed (build_outline_context.factor, point.x);
  3690   y = sfnt_mul_fixed (build_outline_context.factor, point.y);
  3691 
  3692   build_outline_context.outline
  3693     = sfnt_build_append (SFNT_GLYPH_OUTLINE_LINETO,
  3694                          x, y);
  3695   build_outline_context.x = x;
  3696   build_outline_context.y = y;
  3697 }
  3698 
  3699 /* Divide the two 16.16 fixed point numbers X and Y.  Return the
  3700    result regardless of overflow.  */
  3701 
  3702 static sfnt_fixed
  3703 sfnt_div_fixed (sfnt_fixed x, sfnt_fixed y)
  3704 {
  3705 #ifdef INT64_MAX
  3706   int64_t result;
  3707 
  3708   result = ((int64_t) x * 65536) / y;
  3709 
  3710   return result;
  3711 #else
  3712   int sign;
  3713   unsigned int a, b;
  3714 
  3715   sign = 1;
  3716 
  3717   if (x < 0)
  3718     sign = -sign;
  3719 
  3720   if (y < 0)
  3721     sign = -sign;
  3722 
  3723   a = abs (x);
  3724   b = abs (y);
  3725 
  3726   return sfnt_multiply_divide (a, 65536, b) * sign;
  3727 #endif
  3728 }
  3729 
  3730 /* Return the ceiling value of the specified fixed point number X.  */
  3731 
  3732 static sfnt_fixed
  3733 sfnt_ceil_fixed (sfnt_fixed x)
  3734 {
  3735   return (x + 0177777) & 037777600000;
  3736 }
  3737 
  3738 /* Return the floor value of the specified fixed point number X.  */
  3739 
  3740 static sfnt_fixed
  3741 sfnt_floor_fixed (sfnt_fixed x)
  3742 {
  3743   return x & 037777600000;
  3744 }
  3745 
  3746 /* Given a curve consisting of three points CONTROL0, CONTROL1 and
  3747    ENDPOINT, return whether or not the curve is sufficiently small to
  3748    be approximated by a line between CONTROL0 and ENDPOINT.  */
  3749 
  3750 static bool
  3751 sfnt_curve_is_flat (struct sfnt_point control0,
  3752                     struct sfnt_point control1,
  3753                     struct sfnt_point endpoint)
  3754 {
  3755   struct sfnt_point g, h;
  3756 
  3757   g.x = control1.x - control0.x;
  3758   g.y = control1.y - control0.y;
  3759   h.x = endpoint.x - control0.x;
  3760   h.y = endpoint.y - control0.y;
  3761 
  3762   /* 2.0 is a constant describing the area covered at which point the
  3763      curve is considered "flat".  */
  3764   return (abs (sfnt_mul_fixed (g.x, h.y)
  3765                - sfnt_mul_fixed (g.y, h.x))
  3766           <= 0400000);
  3767 }
  3768 
  3769 /* Recursively split the splines in the bezier curve formed from
  3770    CONTROL0, CONTROL1 and ENDPOINT until the area between the curve's
  3771    two ends is small enough to be considered ``flat''.  Then, turn
  3772    those ``flat'' curves into lines.  */
  3773 
  3774 static void
  3775 sfnt_curve_to_and_build_1 (struct sfnt_point control0,
  3776                            struct sfnt_point control1,
  3777                            struct sfnt_point endpoint)
  3778 {
  3779   struct sfnt_point ab, bc, abbc;
  3780 
  3781   /* control0, control and endpoint make up the spline.  Figure out
  3782      its distance from a line.  */
  3783   if (sfnt_curve_is_flat (control0, control1, endpoint))
  3784     {
  3785       /* Draw a line to endpoint.  */
  3786       build_outline_context.outline
  3787         = sfnt_build_append (SFNT_GLYPH_OUTLINE_LINETO,
  3788                              endpoint.x, endpoint.y);
  3789       build_outline_context.x = endpoint.x;
  3790       build_outline_context.y = endpoint.y;
  3791     }
  3792   else
  3793     {
  3794       /* Calculate new control points.
  3795          Maybe apply a recursion limit here? */
  3796       sfnt_lerp_half (&control0, &control1, &ab);
  3797       sfnt_lerp_half (&control1, &endpoint, &bc);
  3798       sfnt_lerp_half (&ab, &bc, &abbc);
  3799 
  3800       /* Keep splitting until a flat enough spline results.  */
  3801       sfnt_curve_to_and_build_1 (control0, ab, abbc);
  3802 
  3803       /* Then go on with the spline between control1 and endpoint.  */
  3804       sfnt_curve_to_and_build_1 (abbc, bc, endpoint);
  3805     }
  3806 }
  3807 
  3808 /* Scale and decompose the specified bezier curve into individual
  3809    lines.  Then, record each of those lines into the outline being
  3810    built.  */
  3811 
  3812 static void
  3813 sfnt_curve_to_and_build (struct sfnt_point control,
  3814                          struct sfnt_point endpoint,
  3815                          void *dcontext)
  3816 {
  3817   struct sfnt_point control0;
  3818 
  3819   control0.x = build_outline_context.x;
  3820   control0.y = build_outline_context.y;
  3821   control.x = sfnt_mul_fixed (control.x,
  3822                               build_outline_context.factor);
  3823   control.y = sfnt_mul_fixed (control.y,
  3824                               build_outline_context.factor);
  3825   endpoint.x = sfnt_mul_fixed (endpoint.x,
  3826                                build_outline_context.factor);
  3827   endpoint.y = sfnt_mul_fixed (endpoint.y,
  3828                                build_outline_context.factor);
  3829 
  3830   sfnt_curve_to_and_build_1 (control0, control, endpoint);
  3831 }
  3832 
  3833 /* Non-reentrantly build the outline for the specified GLYPH at the
  3834    given scale factor.  Return the outline data with a refcount of 0
  3835    upon success, or NULL upon failure.
  3836 
  3837    SCALE is a scale factor that converts between em space and device
  3838    space.
  3839 
  3840    Use the unscaled glyph METRICS to determine the origin point of the
  3841    outline.
  3842 
  3843    Call GET_GLYPH and FREE_GLYPH with the specified DCONTEXT to obtain
  3844    glyphs for compound glyph subcomponents.  */
  3845 
  3846 TEST_STATIC struct sfnt_glyph_outline *
  3847 sfnt_build_glyph_outline (struct sfnt_glyph *glyph,
  3848                           sfnt_fixed scale,
  3849                           struct sfnt_glyph_metrics *metrics,
  3850                           sfnt_get_glyph_proc get_glyph,
  3851                           sfnt_free_glyph_proc free_glyph,
  3852                           void *dcontext)
  3853 {
  3854   struct sfnt_glyph_outline *outline;
  3855   int rc;
  3856   sfnt_fword origin;
  3857 
  3858   memset (&build_outline_context, 0, sizeof build_outline_context);
  3859 
  3860   /* Allocate the outline now with enough for 44 words at the end.  */
  3861   outline = xmalloc (sizeof *outline + 40 * sizeof (*outline->outline));
  3862   outline->outline_size = 40;
  3863   outline->outline_used = 0;
  3864   outline->refcount = 0;
  3865   outline->outline
  3866     = (struct sfnt_glyph_outline_command *) (outline + 1);
  3867 
  3868   /* DCONTEXT will be passed to GET_GLYPH and FREE_GLYPH, so global
  3869      variables must be used to communicate with the decomposition
  3870      functions.  */
  3871   build_outline_context.outline = outline;
  3872 
  3873   /* Clear outline bounding box.  */
  3874   outline->xmin = 0;
  3875   outline->ymin = 0;
  3876   outline->xmax = 0;
  3877   outline->ymax = 0;
  3878 
  3879   /* Set the scale factor.  */
  3880   build_outline_context.factor = scale;
  3881 
  3882   /* Decompose the outline.  */
  3883   rc = sfnt_decompose_glyph (glyph, sfnt_move_to_and_build,
  3884                              sfnt_line_to_and_build,
  3885                              sfnt_curve_to_and_build,
  3886                              get_glyph, free_glyph, dcontext);
  3887 
  3888   /* Synchronize the outline object with what might have changed
  3889      inside sfnt_decompose_glyph.  */
  3890   outline = build_outline_context.outline;
  3891 
  3892   if (rc)
  3893     {
  3894       xfree (outline);
  3895       return NULL;
  3896     }
  3897 
  3898   /* Compute the origin position.  Note that the original glyph xmin
  3899      is first used to calculate the origin point, and the origin
  3900      distortion is applied to it to get the distorted origin.  */
  3901 
  3902   origin = glyph->xmin - metrics->lbearing + glyph->origin_distortion;
  3903   outline->origin = sfnt_mul_fixed (origin, scale);
  3904 
  3905   return outline;
  3906 }
  3907 
  3908 
  3909 
  3910 /* Glyph rasterization.  The algorithm used here is fairly simple.
  3911    Each contour is decomposed into lines, which turn into a polygon.
  3912    Then, a bog standard edge filler is used to turn them into
  3913    spans.  */
  3914 
  3915 /* Coverage table.  This is a four dimensional array indiced by the Y,
  3916    then X axis fractional, shifted down to 2 bits.  */
  3917 
  3918 static const unsigned char sfnt_poly_coverage[8][9] =
  3919   {
  3920     { 0, 4, 8, 12, 16, 20, 24, 28, 32, },
  3921     { 0, 4, 8, 12, 16, 20, 24, 28, 32, },
  3922     { 0, 4, 8, 12, 16, 20, 24, 28, 32, },
  3923     { 0, 3, 7, 11, 15, 19, 23, 27, 31, },
  3924     { 0, 4, 8, 12, 16, 20, 24, 28, 32, },
  3925     { 0, 4, 8, 12, 16, 20, 24, 28, 32, },
  3926     { 0, 4, 8, 12, 16, 20, 24, 28, 32, },
  3927     { 0, 4, 8, 12, 16, 20, 24, 28, 32, },
  3928   };
  3929 
  3930 /* Return the nearest coordinate on the sample grid no less than
  3931    F.  */
  3932 
  3933 static sfnt_fixed
  3934 sfnt_poly_grid_ceil (sfnt_fixed f)
  3935 {
  3936   return (((f + (SFNT_POLY_START - 1))
  3937            & ~(SFNT_POLY_STEP - 1)) + SFNT_POLY_START);
  3938 }
  3939 
  3940 enum
  3941   {
  3942     SFNT_POLY_ALIGNMENT = 4,
  3943   };
  3944 
  3945 /* Initialize the specified RASTER in preparation for displaying spans
  3946    for OUTLINE, and set RASTER->refcount to 0.  The caller must then
  3947    set RASTER->cells to a zeroed array of size RASTER->stride *
  3948    RASTER->height, aligned to RASTER.  */
  3949 
  3950 TEST_STATIC void
  3951 sfnt_prepare_raster (struct sfnt_raster *raster,
  3952                      struct sfnt_glyph_outline *outline)
  3953 {
  3954   raster->width
  3955     = (sfnt_ceil_fixed (outline->xmax)
  3956        - sfnt_floor_fixed (outline->xmin)) / 65536;
  3957   raster->height
  3958     = (sfnt_ceil_fixed (outline->ymax)
  3959        - sfnt_floor_fixed (outline->ymin)) / 65536;
  3960   raster->refcount = 0;
  3961 
  3962   /* Align the raster to a SFNT_POLY_ALIGNMENT byte boundary.  */
  3963   raster->stride = ((raster->width
  3964                      + (SFNT_POLY_ALIGNMENT - 1))
  3965                     & ~(SFNT_POLY_ALIGNMENT - 1));
  3966 
  3967   /* Apply outline->origin.  This is 0 by convention in most fonts.
  3968      However, variable fonts typically change this as variations are
  3969      applied.  */
  3970   raster->offx = sfnt_floor_fixed (outline->xmin
  3971                                    - outline->origin) / 65536;
  3972   raster->offy = sfnt_floor_fixed (outline->ymin) / 65536;
  3973 }
  3974 
  3975 typedef void (*sfnt_edge_proc) (struct sfnt_edge *, size_t,
  3976                                 void *);
  3977 typedef void (*sfnt_span_proc) (struct sfnt_edge *, sfnt_fixed, void *);
  3978 
  3979 /* Move EDGE->x forward, assuming that the scanline has moved upwards
  3980    by SFNT_POLY_STEP.  */
  3981 
  3982 static void
  3983 sfnt_step_edge (struct sfnt_edge *edge)
  3984 {
  3985   /* Add step.  */
  3986   edge->x += edge->step_x;
  3987 }
  3988 
  3989 /* Build a list of edges for each contour in OUTLINE, applying xmin
  3990    and ymin as the offset to each edge.  Call EDGE_PROC with DCONTEXT
  3991    and the resulting edges as arguments.  It is OK to modify the edges
  3992    given to EDGE_PROC.  Align all edges to the sub-pixel grid.  */
  3993 
  3994 static void
  3995 sfnt_build_outline_edges (struct sfnt_glyph_outline *outline,
  3996                           sfnt_edge_proc edge_proc, void *dcontext)
  3997 {
  3998   struct sfnt_edge *edges;
  3999   size_t i, edge, next_vertex;
  4000   sfnt_fixed dx, dy, bot, step_x, ymin, xmin;
  4001   size_t top, bottom, y;
  4002 
  4003   edges = alloca (outline->outline_used * sizeof *edges);
  4004   edge = 0;
  4005 
  4006   /* ymin and xmin must be the same as the offset used to set offy and
  4007      offx in rasters.  */
  4008   ymin = sfnt_floor_fixed (outline->ymin);
  4009   xmin = sfnt_floor_fixed (outline->xmin);
  4010 
  4011   for (i = 0; i < outline->outline_used; ++i)
  4012     {
  4013       /* Set NEXT_VERTEX to the next point (vertex) in this contour.
  4014 
  4015          If i is past the end of the contour, then don't build edges
  4016          for this point.  */
  4017       next_vertex = i + 1;
  4018 
  4019       if (next_vertex == outline->outline_used
  4020           || !(outline->outline[next_vertex].flags
  4021                & SFNT_GLYPH_OUTLINE_LINETO))
  4022         continue;
  4023 
  4024       /* Skip past horizontal vertices.  */
  4025       if (outline->outline[next_vertex].y == outline->outline[i].y)
  4026         continue;
  4027 
  4028       /* Figure out the winding direction.  */
  4029       if (outline->outline[next_vertex].y < outline->outline[i].y)
  4030         /* Vector will cross imaginary ray from its bottom from the
  4031            left of the ray.  Winding is thus 1.  */
  4032         edges[edge].winding = 1;
  4033       else
  4034         /* Moving clockwise.  Winding is thus -1.  */
  4035         edges[edge].winding = -1;
  4036 
  4037       /* Figure out the top and bottom values of this edge.  If the
  4038          next edge is below, top is here and bot is the edge below.
  4039          If the next edge is above, then top is there and this is the
  4040          bottom.  */
  4041 
  4042       if (outline->outline[next_vertex].y < outline->outline[i].y)
  4043         {
  4044           /* End of edge is below this one (keep in mind this is a
  4045              cartesian coordinate system, so smaller values are below
  4046              larger ones.) */
  4047           top = i;
  4048           bottom = next_vertex;
  4049         }
  4050       else
  4051         {
  4052           /* End of edge is above this one.  */
  4053           bottom = i;
  4054           top = next_vertex;
  4055         }
  4056 
  4057       bot = (outline->outline[bottom].y - ymin);
  4058       edges[edge].top = (outline->outline[top].y - ymin);
  4059 
  4060       /* Record the edge.  Rasterization happens from bottom to
  4061          up, so record the X at the bottom.  */
  4062       edges[edge].x = (outline->outline[bottom].x - xmin);
  4063       dx = (outline->outline[top].x - outline->outline[bottom].x);
  4064       dy = abs (outline->outline[top].y
  4065                 - outline->outline[bottom].y);
  4066 
  4067       /* Step to first grid point.  */
  4068       y = sfnt_poly_grid_ceil (bot);
  4069 
  4070       /* If rounding would make the edge not cover any area, skip this
  4071          edge. */
  4072 
  4073       if (y >= edges[edge].top)
  4074         continue;
  4075 
  4076       /* Compute the step X.  This is how much X changes for each
  4077          increase in Y.  */
  4078 
  4079       step_x = sfnt_div_fixed (dx, dy);
  4080       edges[edge].next = NULL;
  4081 
  4082       /* Compute the step X scaled to the poly step.  */
  4083       edges[edge].step_x
  4084         = sfnt_mul_fixed (step_x, SFNT_POLY_STEP);
  4085 
  4086       /* Step to the grid point.  */
  4087       edges[edge].x += sfnt_mul_fixed (step_x, bot - y);
  4088 
  4089       /* Set the bottom position.  */
  4090       edges[edge].bottom = y;
  4091 
  4092       edge++;
  4093     }
  4094 
  4095   if (edge)
  4096     edge_proc (edges, edge, dcontext);
  4097 }
  4098 
  4099 /* Sort an array of SIZE edges to increase by bottom Y position, in
  4100    preparation for building spans.
  4101 
  4102    Insertion sort is used because there are usually not very many
  4103    edges, and anything larger would bloat up the code.  */
  4104 
  4105 static void
  4106 sfnt_edge_sort (struct sfnt_edge *edges, size_t size)
  4107 {
  4108   ssize_t i, j;
  4109   struct sfnt_edge edge;
  4110 
  4111   for (i = 1; i < size; ++i)
  4112     {
  4113       edge = edges[i];
  4114       j = i - 1;
  4115 
  4116       while (j >= 0 && (edges[j].bottom > edge.bottom))
  4117         {
  4118           edges[j + 1] = edges[j];
  4119           j--;
  4120         }
  4121 
  4122       edges[j + 1] = edge;
  4123     }
  4124 }
  4125 
  4126 /* Draw EDGES, an unsorted array of polygon edges of size SIZE.  For
  4127    each scanline, call SPAN_FUNC with a list of active edges and
  4128    coverage information, and DCONTEXT.
  4129 
  4130    Sort each edge in ascending order by the bottommost Y coordinate to
  4131    which it applies.  Start a loop on the Y coordinate, which starts
  4132    out at that of the bottommost edge.  For each iteration, add edges
  4133    that now overlap with Y, keeping them sorted by X.  Poly those
  4134    edges through SPAN_FUNC.  Then, move upwards by SFNT_POLY_STEP,
  4135    remove edges that no longer apply, and interpolate the remaining
  4136    edges' X coordinates.  Repeat until all the edges have been polyed.
  4137 
  4138    Or alternatively, think of this as such: each edge is actually a
  4139    vector from its bottom position towards its top most position.
  4140    Every time Y moves upwards, the position of each edge intersecting
  4141    with Y is interpolated and added to a list of spans along with
  4142    winding information that is then given to EDGE_FUNC.
  4143 
  4144    Anti-aliasing is performed using a coverage map for fractional
  4145    coordinates, and incrementing the Y axis by SFNT_POLY_STEP instead
  4146    of 1.  SFNT_POLY_STEP is chosen to always keep Y aligned to a grid
  4147    placed such that there are always 1 << SFNT_POLY_SHIFT positions
  4148    available for each integral pixel coordinate.  */
  4149 
  4150 static void
  4151 sfnt_poly_edges (struct sfnt_edge *edges, size_t size,
  4152                  sfnt_span_proc span_func, void *dcontext)
  4153 {
  4154   sfnt_fixed y;
  4155   size_t e;
  4156   struct sfnt_edge *active, **prev, *a, *n;
  4157 
  4158   if (!size)
  4159     return;
  4160 
  4161   /* Sort edges to ascend by Y-order.  Once again, remember: cartesian
  4162      coordinates.  */
  4163   sfnt_edge_sort (edges, size);
  4164 
  4165   /* Step down line by line.  Find active edges.  */
  4166 
  4167   y = edges[0].bottom;
  4168   active = 0;
  4169   active = NULL;
  4170   e = 0;
  4171 
  4172   for (;;)
  4173     {
  4174       /* Add in new edges keeping them sorted.  */
  4175       for (; e < size && edges[e].bottom <= y; ++e)
  4176         {
  4177           /* Find where to place this edge.  */
  4178           for (prev = &active; (a = *prev); prev = &(a->next))
  4179             {
  4180               if (a->x > edges[e].x)
  4181                 break;
  4182             }
  4183 
  4184           edges[e].next = *prev;
  4185           *prev = &edges[e];
  4186         }
  4187 
  4188       /* Draw this span at the current position.  Y axis antialiasing
  4189          is expected to be handled by SPAN_FUNC.  */
  4190       span_func (active, y, dcontext);
  4191 
  4192       /* Compute the next Y position.  */
  4193       y += SFNT_POLY_STEP;
  4194 
  4195       /* Strip out edges that no longer have effect.  */
  4196 
  4197       for (prev = &active; (a = *prev);)
  4198         {
  4199           if (a->top <= y)
  4200             *prev = a->next;
  4201           else
  4202             prev = &a->next;
  4203         }
  4204 
  4205       /* Break if all is done.  */
  4206       if (!active && e == size)
  4207         break;
  4208 
  4209       /* Step all edges.  */
  4210       for (a = active; a; a = a->next)
  4211         sfnt_step_edge (a);
  4212 
  4213       /* Resort on X axis.  */
  4214       for (prev = &active; (a = *prev) && (n = a->next);)
  4215         {
  4216           if (a->x > n->x)
  4217             {
  4218               a->next = n->next;
  4219               n->next = a;
  4220               *prev = n;
  4221               prev = &active;
  4222             }
  4223           else
  4224             prev = &a->next;
  4225         }
  4226     }
  4227 }
  4228 
  4229 /* Saturate and convert the given unsigned short value X to an
  4230    unsigned char.  */
  4231 
  4232 static unsigned char
  4233 sfnt_saturate_short (unsigned short x)
  4234 {
  4235   if (x > 255)
  4236     return 255;
  4237 
  4238   return x;
  4239 }
  4240 
  4241 /* Fill a single span of pixels between X0 and X1 at Y, a raster
  4242    coordinate, onto RASTER.  */
  4243 
  4244 static void
  4245 sfnt_fill_span (struct sfnt_raster *raster, sfnt_fixed y,
  4246                 sfnt_fixed x0, sfnt_fixed x1)
  4247 {
  4248   unsigned char *start;
  4249   const unsigned char *coverage;
  4250   sfnt_fixed left, right, end;
  4251   unsigned short w, a;
  4252   int row;
  4253 #ifndef NDEBUG
  4254   unsigned char *row_end;
  4255 #endif /* NDEBUG */
  4256 
  4257   /* Clip bounds to pixmap.  */
  4258 
  4259   if (x0 < 0)
  4260     x0 = 0;
  4261 
  4262   /* If x1 is greater than the raster width, make sure the last pixel
  4263      is filled and no more after that.  */
  4264 
  4265   if (x1 > raster->width * 65536)
  4266     x1 = raster->width * 65536;
  4267 
  4268   /* Check for empty spans.  */
  4269   if (x1 <= x0)
  4270     return;
  4271 
  4272   /* Figure out coverage based on Y axis fractional.  */
  4273   coverage = sfnt_poly_coverage[(y >> (16 - SFNT_POLY_SHIFT))
  4274                                 & SFNT_POLY_MASK];
  4275   row = y >> 16;
  4276 
  4277   /* Don't fill out of bounds rows.  */
  4278   if (row < 0 || row >= raster->height)
  4279     return;
  4280 
  4281   /* Set start, then start filling according to coverage.  left and
  4282      right are now .3.  */
  4283   left = x0 >> (16 - SFNT_POLY_SHIFT);
  4284   right = x1 >> (16 - SFNT_POLY_SHIFT);
  4285   start = raster->cells + row * raster->stride;
  4286 #ifndef NDEBUG
  4287   row_end = start + raster->width;
  4288 #endif /* NDEBUG */
  4289   start += left >> SFNT_POLY_SHIFT;
  4290 
  4291   /* If left and right actually lie in the same pixel, just fill with
  4292      the coverage of both and return.  */
  4293 
  4294   if ((left & ~SFNT_POLY_MASK) == (right & ~SFNT_POLY_MASK))
  4295     {
  4296       /* Assert that start does not exceed the end of the row.  */
  4297       assert (start <= row_end);
  4298 
  4299       w = coverage[right - left];
  4300       a = *start + w;
  4301 
  4302       *start = sfnt_saturate_short (a);
  4303       return;
  4304     }
  4305 
  4306   /* Compute coverage for first pixel, then poly.  The code from here
  4307      onwards assumes that left and right are on two different
  4308      pixels.  */
  4309 
  4310   if (left & SFNT_POLY_MASK)
  4311     {
  4312       /* Assert that start does not exceed the end of the row.  */
  4313       assert (start <= row_end);
  4314 
  4315       /* Compute the coverage for the first pixel, and move left past
  4316          it.  The coverage is a number from 1 to 7 describing how
  4317          ``partially'' covered this pixel is.  */
  4318 
  4319       end = (left + SFNT_POLY_SAMPLE - 1) & ~SFNT_POLY_MASK;
  4320       end = MIN (right, end);
  4321 
  4322       w = coverage[end - left];
  4323       a = *start + w;
  4324 
  4325       /* Now move left past.  */
  4326       left = end;
  4327       *start++ = sfnt_saturate_short (a);
  4328     }
  4329 
  4330   /* Clear coverage info for first pixel.  Compute coverage for center
  4331      pixels.  Note that SFNT_POLY_SAMPLE is used and not
  4332      SFNT_POLY_MASK, because coverage has a blank column at the
  4333      start.  */
  4334   w = coverage[SFNT_POLY_SAMPLE];
  4335 
  4336   /* Fill pixels between left and right.  */
  4337   while (left + SFNT_POLY_MASK < right)
  4338     {
  4339       /* Assert that start does not exceed the end of the row.  */
  4340       assert (start <= row_end);
  4341 
  4342       a = *start + w;
  4343       *start++ = sfnt_saturate_short (a);
  4344       left += SFNT_POLY_SAMPLE;
  4345     }
  4346 
  4347   /* Fill rightmost pixel with any partial coverage.  */
  4348 
  4349   if (right & SFNT_POLY_MASK)
  4350     {
  4351       /* Assert that start does not exceed the end of the row.  */
  4352       assert (start <= row_end);
  4353 
  4354       w = coverage[right - left];
  4355       a = *start + w;
  4356       *start = sfnt_saturate_short (a);
  4357     }
  4358 }
  4359 
  4360 /* Poly each span starting from START onto RASTER, at position Y.  Y
  4361    here is still a cartesian coordinate, where the bottom of the
  4362    raster is 0.  But that is no longer true by the time sfnt_span_fill
  4363    is called.  */
  4364 
  4365 static void
  4366 sfnt_poly_span (struct sfnt_edge *start, sfnt_fixed y,
  4367                 struct sfnt_raster *raster)
  4368 {
  4369   struct sfnt_edge *edge;
  4370   int winding;
  4371   sfnt_fixed x0, x1;
  4372 
  4373   /* Pacify -Wmaybe-uninitialized; x1 and x0 are only used when edge
  4374      != start, at which point x0 has already been set.  */
  4375   x0 = x1 = 0;
  4376 
  4377   /* Generate the X axis coverage map.  Then poly it onto RASTER.
  4378      winding on each edge determines the winding direction: when it is
  4379      positive, winding is 1.  When it is negative, winding is -1.
  4380 
  4381      Fill each consecutive stretch of spans that are inside the glyph;
  4382      otherwise, coverage will overlap for some spans, but not
  4383      others.
  4384 
  4385      The spans must be terminated with an edge that causes an
  4386      off-transition, or some spans will not be filled.  */
  4387 
  4388   winding = 0;
  4389 
  4390   for (edge = start; edge; edge = edge->next)
  4391     {
  4392       if (!winding)
  4393         {
  4394           if (edge != start && x0 != x1)
  4395             /* Draw this section of spans that are on.  */
  4396             sfnt_fill_span (raster, (raster->height << 16) - y,
  4397                             x0, x1);
  4398 
  4399           x0 = x1 = edge->x;
  4400         }
  4401       else
  4402         x1 = edge->x;
  4403 
  4404       winding += edge->winding;
  4405     }
  4406 
  4407   /* Draw the last span following the last off-transition.  */
  4408 
  4409   if (!winding && edge != start && x0 != x1)
  4410     sfnt_fill_span (raster, (raster->height << 16) - y,
  4411                     x0, x1);
  4412 }
  4413 
  4414 
  4415 
  4416 /* Main entry point for outline rasterization.  */
  4417 
  4418 /* Raster the spans between START and its end to the raster specified
  4419    as DCONTEXT.  The span's position is Y.  */
  4420 
  4421 static void
  4422 sfnt_raster_span (struct sfnt_edge *start, sfnt_fixed y,
  4423                   void *dcontext)
  4424 {
  4425   sfnt_poly_span (start, y, dcontext);
  4426 }
  4427 
  4428 /* Generate and poly each span in EDGES onto the raster specified as
  4429    DCONTEXT.  */
  4430 
  4431 static void
  4432 sfnt_raster_edge (struct sfnt_edge *edges, size_t num_edges,
  4433                   void *dcontext)
  4434 {
  4435   sfnt_poly_edges (edges, num_edges, sfnt_raster_span,
  4436                    dcontext);
  4437 }
  4438 
  4439 /* Generate an alpha mask for the glyph outline OUTLINE.  Value is the
  4440    alpha mask upon success, NULL upon failure.  */
  4441 
  4442 TEST_STATIC struct sfnt_raster *
  4443 sfnt_raster_glyph_outline (struct sfnt_glyph_outline *outline)
  4444 {
  4445   struct sfnt_raster raster, *data;
  4446 
  4447   /* Get the raster parameters.  */
  4448   sfnt_prepare_raster (&raster, outline);
  4449 
  4450   /* Allocate the raster data.  */
  4451   data = xmalloc (sizeof *data + raster.stride * raster.height);
  4452   *data = raster;
  4453   data->cells = (unsigned char *) (data + 1);
  4454   memset (data->cells, 0, raster.stride * raster.height);
  4455 
  4456   /* Generate edges for the outline, polying each array of edges to
  4457      the raster.  */
  4458   sfnt_build_outline_edges (outline, sfnt_raster_edge, data);
  4459 
  4460   /* All done.  */
  4461   return data;
  4462 }
  4463 
  4464 
  4465 
  4466 /* Glyph metrics computation.  */
  4467 
  4468 /* Read an hmtx table from the font FD, using the table directory
  4469    specified as SUBTABLE, the maxp table MAXP, and the hhea table
  4470    HHEA.
  4471 
  4472    Return NULL upon failure, and the hmtx table otherwise.
  4473    HHEA->num_of_long_hor_metrics determines the number of horizontal
  4474    metrics present, and MAXP->num_glyphs -
  4475    HHEA->num_of_long_hor_metrics determines the number of left-side
  4476    bearings present.  */
  4477 
  4478 TEST_STATIC struct sfnt_hmtx_table *
  4479 sfnt_read_hmtx_table (int fd, struct sfnt_offset_subtable *subtable,
  4480                       struct sfnt_hhea_table *hhea,
  4481                       struct sfnt_maxp_table *maxp)
  4482 {
  4483   struct sfnt_table_directory *directory;
  4484   struct sfnt_hmtx_table *hmtx;
  4485   size_t size;
  4486   ssize_t rc;
  4487   int i;
  4488 
  4489   /* Find the table in the directory.  */
  4490 
  4491   directory = sfnt_find_table (subtable, SFNT_TABLE_HMTX);
  4492 
  4493   if (!directory)
  4494     return NULL;
  4495 
  4496   /* Figure out how many bytes are required.  */
  4497   size = ((hhea->num_of_long_hor_metrics
  4498            * sizeof (struct sfnt_long_hor_metric))
  4499           + (MAX (0, ((int) maxp->num_glyphs
  4500                       - hhea->num_of_long_hor_metrics))
  4501              * sizeof (int16_t)));
  4502 
  4503   /* Check the length matches exactly.  */
  4504   if (directory->length != size)
  4505     return NULL;
  4506 
  4507   /* Seek to the location given in the directory.  */
  4508   if (lseek (fd, directory->offset, SEEK_SET) == (off_t) -1)
  4509     return NULL;
  4510 
  4511   /* Now allocate enough to hold all of that along with the table
  4512      directory structure.  */
  4513 
  4514   hmtx = xmalloc (sizeof *hmtx + size);
  4515 
  4516   /* Read into hmtx + 1.  */
  4517   rc = read (fd, hmtx + 1, size);
  4518   if (rc < size)
  4519     {
  4520       xfree (hmtx);
  4521       return NULL;
  4522     }
  4523 
  4524   /* Set pointers to data.  */
  4525   hmtx->h_metrics = (struct sfnt_long_hor_metric *) (hmtx + 1);
  4526   hmtx->left_side_bearing
  4527     = (int16_t *) (hmtx->h_metrics
  4528                    + hhea->num_of_long_hor_metrics);
  4529 
  4530   /* Swap what was read.  */
  4531 
  4532   for (i = 0; i < hhea->num_of_long_hor_metrics; ++i)
  4533     {
  4534       sfnt_swap16 (&hmtx->h_metrics[i].advance_width);
  4535       sfnt_swap16 (&hmtx->h_metrics[i].left_side_bearing);
  4536     }
  4537 
  4538   for (; i < maxp->num_glyphs; ++i)
  4539     sfnt_swap16 (&hmtx->left_side_bearing[i - hhea->num_of_long_hor_metrics]);
  4540 
  4541   /* All done.  */
  4542   return hmtx;
  4543 }
  4544 
  4545 /* Obtain glyph metrics for the glyph indiced by GLYPH at the
  4546    specified PIXEL_SIZE.  Return 0 and the metrics in *METRICS if
  4547    metrics could be found, else 1.
  4548 
  4549    If PIXEL_SIZE is -1, do not perform any scaling on the glyph
  4550    metrics; HEAD need not be specified in that case.
  4551 
  4552    HMTX, HHEA, HEAD and MAXP should be the hmtx, hhea, head, and maxp
  4553    tables of the font respectively.  */
  4554 
  4555 TEST_STATIC int
  4556 sfnt_lookup_glyph_metrics (sfnt_glyph glyph, int pixel_size,
  4557                            struct sfnt_glyph_metrics *metrics,
  4558                            struct sfnt_hmtx_table *hmtx,
  4559                            struct sfnt_hhea_table *hhea,
  4560                            struct sfnt_head_table *head,
  4561                            struct sfnt_maxp_table *maxp)
  4562 {
  4563   short lbearing;
  4564   unsigned short advance;
  4565   sfnt_fixed factor;
  4566 
  4567   if (glyph < hhea->num_of_long_hor_metrics)
  4568     {
  4569       /* There is a long entry in the hmtx table.  */
  4570       lbearing = hmtx->h_metrics[glyph].left_side_bearing;
  4571       advance = hmtx->h_metrics[glyph].advance_width;
  4572     }
  4573   else if (hhea->num_of_long_hor_metrics
  4574            && glyph < maxp->num_glyphs)
  4575     {
  4576       /* There is a short entry in the hmtx table.  */
  4577       lbearing
  4578         = hmtx->left_side_bearing[glyph
  4579                                   - hhea->num_of_long_hor_metrics];
  4580       advance
  4581         = hmtx->h_metrics[hhea->num_of_long_hor_metrics - 1].advance_width;
  4582     }
  4583   else
  4584     /* No entry corresponds to the glyph.  */
  4585     return 1;
  4586 
  4587   if (pixel_size == -1)
  4588     {
  4589       /* Return unscaled metrics in this case.  */
  4590       metrics->lbearing = lbearing;
  4591       metrics->advance = advance;
  4592       return 0;
  4593     }
  4594 
  4595   /* Now scale lbearing and advance up to the pixel size.  */
  4596   factor = sfnt_div_fixed (pixel_size, head->units_per_em);
  4597 
  4598   /* Save them.  */
  4599   metrics->lbearing = sfnt_mul_fixed (lbearing * 65536, factor);
  4600   metrics->advance = sfnt_mul_fixed (advance * 65536, factor);
  4601 
  4602   /* All done.  */
  4603   return 0;
  4604 }
  4605 
  4606 /* Scale the specified glyph metrics by FACTOR.
  4607    Set METRICS->lbearing and METRICS->advance to their current
  4608    values times factor.  */
  4609 
  4610 MAYBE_UNUSED TEST_STATIC void
  4611 sfnt_scale_metrics (struct sfnt_glyph_metrics *metrics,
  4612                     sfnt_fixed factor)
  4613 {
  4614   metrics->lbearing
  4615     = sfnt_mul_fixed (metrics->lbearing * 65536, factor);
  4616   metrics->advance
  4617     = sfnt_mul_fixed (metrics->advance * 65536, factor);
  4618 }
  4619 
  4620 /* Calculate the factor used to convert em space to device space for a
  4621    font with the specified HEAD table and PPEM value.  */
  4622 
  4623 MAYBE_UNUSED TEST_STATIC sfnt_fixed
  4624 sfnt_get_scale (struct sfnt_head_table *head, int ppem)
  4625 {
  4626   /* Figure out how to convert from font unit-space to pixel space.
  4627      To turn one unit to its corresponding pixel size given a ppem of
  4628      1, the unit must be divided by head->units_per_em.  Then, it must
  4629      be multipled by the ppem.  So,
  4630 
  4631        PIXEL = UNIT / UPEM * PPEM
  4632 
  4633      which means:
  4634 
  4635        PIXEL = UNIT * PPEM / UPEM  */
  4636 
  4637   return sfnt_div_fixed (ppem, head->units_per_em);
  4638 }
  4639 
  4640 
  4641 
  4642 /* Font style parsing.  */
  4643 
  4644 /* Read the name table from the given font FD, using the table
  4645    directory specified as SUBTABLE.  Perform validation on the offsets
  4646    in the name records.  Return NULL upon failure, else the name
  4647    table.  */
  4648 
  4649 TEST_STATIC struct sfnt_name_table *
  4650 sfnt_read_name_table (int fd, struct sfnt_offset_subtable *subtable)
  4651 {
  4652   struct sfnt_table_directory *directory;
  4653   struct sfnt_name_table *name;
  4654   size_t required;
  4655   ssize_t rc;
  4656   int i;
  4657 
  4658   /* Find the table in the directory.  */
  4659 
  4660   directory = sfnt_find_table (subtable, SFNT_TABLE_NAME);
  4661 
  4662   if (!directory)
  4663     return NULL;
  4664 
  4665   /* Seek to the location given in the directory.  */
  4666   if (lseek (fd, directory->offset, SEEK_SET) == (off_t) -1)
  4667     return NULL;
  4668 
  4669   /* Figure out the minimum that has to be read.  */
  4670   required = SFNT_ENDOF (struct sfnt_name_table,
  4671                          string_offset, uint16_t);
  4672 
  4673   if (directory->length < required)
  4674     return NULL;
  4675 
  4676   /* Allocate enough to hold the name table and variable length
  4677      data.  */
  4678   name = xmalloc (sizeof *name + directory->length);
  4679 
  4680   /* Read the fixed length data.  */
  4681   rc = read (fd, name, required);
  4682   if (rc < required)
  4683     {
  4684       xfree (name);
  4685       return NULL;
  4686     }
  4687 
  4688   /* Swap what was read.  */
  4689   sfnt_swap16 (&name->format);
  4690   sfnt_swap16 (&name->count);
  4691   sfnt_swap16 (&name->string_offset);
  4692 
  4693   /* Reject unsupported formats.  */
  4694   if (name->format)
  4695     {
  4696       xfree (name);
  4697       return NULL;
  4698     }
  4699 
  4700   /* Set the pointer to the start of the variable length data.  */
  4701   name->name_records
  4702     = (struct sfnt_name_record *) (name + 1);
  4703 
  4704   /* Check there is enough for the name records.  */
  4705   required = directory->length - required;
  4706   if (required < name->count * sizeof *name->name_records)
  4707     {
  4708       xfree (name);
  4709       return NULL;
  4710     }
  4711 
  4712   /* Read the variable length data.  First, read the name records.  */
  4713   rc = read (fd, name->name_records,
  4714              (name->count
  4715               * sizeof *name->name_records));
  4716   if (rc < (name->count
  4717             * sizeof *name->name_records))
  4718     {
  4719       xfree (name);
  4720       return NULL;
  4721     }
  4722 
  4723   /* Swap each of the name records.  */
  4724   for (i = 0; i < name->count; ++i)
  4725     {
  4726       sfnt_swap16 (&name->name_records[i].platform_id);
  4727       sfnt_swap16 (&name->name_records[i].platform_specific_id);
  4728       sfnt_swap16 (&name->name_records[i].language_id);
  4729       sfnt_swap16 (&name->name_records[i].name_id);
  4730       sfnt_swap16 (&name->name_records[i].length);
  4731       sfnt_swap16 (&name->name_records[i].offset);
  4732     }
  4733 
  4734   /* Now, read the name data.  */
  4735 
  4736   if (name->string_offset > directory->length)
  4737     {
  4738       xfree (name);
  4739       return NULL;
  4740     }
  4741 
  4742   required = directory->length - name->string_offset;
  4743 
  4744   /* It can happen that the string offset comes before the name
  4745      records, and as a result exceeds the number of bytes
  4746      previously allocated.  Extend name if that is the case.  */
  4747 
  4748   if (required > (directory->length
  4749                   - (name->count
  4750                      * sizeof *name->name_records)))
  4751     {
  4752       name = xrealloc (name, (sizeof *name
  4753                               + (name->count
  4754                                  * sizeof *name->name_records)
  4755                               + required));
  4756       name->name_records = (struct sfnt_name_record *) (name + 1);
  4757     }
  4758 
  4759   /* There is enough space past name->name_records to hold REQUIRED
  4760      bytes.  Seek to the right offset.  */
  4761 
  4762   if (lseek (fd, directory->offset + name->string_offset,
  4763              SEEK_SET) == (off_t) -1)
  4764     {
  4765       xfree (name);
  4766       return NULL;
  4767     }
  4768 
  4769   /* Read REQURIED bytes into the string data.  */
  4770   name->data = (unsigned char *) (name->name_records
  4771                                   + name->count);
  4772   rc = read (fd, name->data, required);
  4773   if (rc < required)
  4774     {
  4775       xfree (name);
  4776       return NULL;
  4777     }
  4778 
  4779   /* Now validate each of the name records.  */
  4780   for (i = 0; i < name->count; ++i)
  4781     {
  4782       if (((int) name->name_records[i].offset
  4783            + name->name_records[i].length) > required)
  4784         {
  4785           /* The name is out of bounds! */
  4786           xfree (name);
  4787           return NULL;
  4788         }
  4789     }
  4790 
  4791   /* Return the name table.  */
  4792   return name;
  4793 }
  4794 
  4795 /* Return a pointer to the name data corresponding with CODE under the
  4796    name table NAME.  Return the start of the data and the name record
  4797    under *RECORD upon success, and NULL otherwise.  */
  4798 
  4799 TEST_STATIC unsigned char *
  4800 sfnt_find_name (struct sfnt_name_table *name,
  4801                 enum sfnt_name_identifier_code code,
  4802                 struct sfnt_name_record *record)
  4803 {
  4804   int i;
  4805 
  4806   for (i = 0; i < name->count; ++i)
  4807     {
  4808       if (name->name_records[i].name_id == code)
  4809         {
  4810           /* The offsets within have already been validated.  */
  4811           *record = name->name_records[i];
  4812           return name->data + record->offset;
  4813         }
  4814     }
  4815 
  4816   return NULL;
  4817 }
  4818 
  4819 /* Read the meta table from the given font FD, using the table
  4820    directory specified as SUBTABLE.  Perform validation on the offsets
  4821    in each metadata record.  Return NULL upon failure, else the meta
  4822    table.  */
  4823 
  4824 TEST_STATIC struct sfnt_meta_table *
  4825 sfnt_read_meta_table (int fd, struct sfnt_offset_subtable *subtable)
  4826 {
  4827   struct sfnt_table_directory *directory;
  4828   struct sfnt_meta_table *meta;
  4829   size_t required, i, data_size, map_size, offset;
  4830   ssize_t rc;
  4831 
  4832   /* Find the table in the directory.  */
  4833 
  4834   directory = sfnt_find_table (subtable, SFNT_TABLE_META);
  4835 
  4836   if (!directory)
  4837     return NULL;
  4838 
  4839   /* Seek to the location given in the directory.  */
  4840   if (lseek (fd, directory->offset, SEEK_SET) == (off_t) -1)
  4841     return NULL;
  4842 
  4843   /* Figure out the minimum that has to be read.  */
  4844   required = SFNT_ENDOF (struct sfnt_meta_table,
  4845                          num_data_maps, uint32_t);
  4846 
  4847   if (directory->length < required)
  4848     return NULL;
  4849 
  4850   /* Allocate enough to hold it.  */
  4851   meta = xmalloc (sizeof *meta);
  4852 
  4853   /* Read the header.  */
  4854   rc = read (fd, meta, required);
  4855   if (rc < required)
  4856     {
  4857       xfree (meta);
  4858       return NULL;
  4859     }
  4860 
  4861   /* Swap what has been read so far.  */
  4862   sfnt_swap32 (&meta->version);
  4863   sfnt_swap32 (&meta->flags);
  4864   sfnt_swap32 (&meta->data_offset);
  4865   sfnt_swap32 (&meta->num_data_maps);
  4866 
  4867   /* Make sure the meta is supported.  */
  4868   if (meta->version != 1)
  4869     {
  4870       xfree (meta);
  4871       return NULL;
  4872     }
  4873 
  4874   /* Reallocate the table to hold sizeof *meta + meta->num_data_maps
  4875      times sizeof meta->data_maps + directory->length bytes.  This is
  4876      because it is ok for metadata to point into the data map itself,
  4877      so an unswapped copy of the whole meta contents must be
  4878      retained.  */
  4879 
  4880   if (INT_MULTIPLY_WRAPV (sizeof *meta->data_maps, meta->num_data_maps,
  4881                           &map_size)
  4882       /* Do so while checking for overflow from bad sfnt files.  */
  4883       || INT_ADD_WRAPV (map_size, sizeof *meta, &data_size)
  4884       || INT_ADD_WRAPV (data_size, directory->length, &data_size))
  4885     {
  4886       xfree (meta);
  4887       return NULL;
  4888     }
  4889 
  4890   /* Do the reallocation.  */
  4891   meta = xrealloc (meta, data_size);
  4892 
  4893   /* Check that the remaining data is big enough to hold the data
  4894      maps.  */
  4895   if (directory->length - required < map_size)
  4896     {
  4897       xfree (meta);
  4898       return NULL;
  4899     }
  4900 
  4901   /* Set pointers to data_maps and data.  */
  4902   meta->data_maps = (struct sfnt_meta_data_map *) (meta + 1);
  4903   meta->data = (unsigned char *) (meta->data_maps
  4904                                   + meta->num_data_maps);
  4905 
  4906   /* Now, seek back.  Read the entire table into meta->data.  */
  4907   if (lseek (fd, directory->offset, SEEK_SET) == (off_t) -1)
  4908     {
  4909       xfree (meta);
  4910       return NULL;
  4911     }
  4912 
  4913   rc = read (fd, meta->data, directory->length);
  4914   if (rc < directory->length)
  4915     {
  4916       xfree (meta);
  4917       return NULL;
  4918     }
  4919 
  4920   /* Copy the data maps into meta->data_maps and swap them one by
  4921      one.  */
  4922   memcpy (meta->data_maps, meta->data + required,
  4923           map_size);
  4924 
  4925   for (i = 0; i < meta->num_data_maps; ++i)
  4926     {
  4927       sfnt_swap32 (&meta->data_maps[i].tag);
  4928       sfnt_swap32 (&meta->data_maps[i].data_offset);
  4929       sfnt_swap32 (&meta->data_maps[i].data_length);
  4930 
  4931       /* Verify the data offsets.  Overflow checking is particularly
  4932          important here.  */
  4933 
  4934       if (INT_ADD_WRAPV (meta->data_maps[i].data_offset,
  4935                          meta->data_maps[i].data_length,
  4936                          &offset))
  4937         {
  4938           xfree (meta);
  4939           return NULL;
  4940         }
  4941 
  4942       if (offset > directory->length)
  4943         {
  4944           xfree (meta);
  4945           return NULL;
  4946         }
  4947     }
  4948 
  4949   /* All done.  */
  4950   return meta;
  4951 }
  4952 
  4953 /* Return a pointer to the metadata corresponding to TAG under the
  4954    meta table META.  Return the start of the data and the metadata map
  4955    under *MAP upon success, and NULL otherwise.  */
  4956 
  4957 MAYBE_UNUSED TEST_STATIC char *
  4958 sfnt_find_metadata (struct sfnt_meta_table *meta,
  4959                     enum sfnt_meta_data_tag tag,
  4960                     struct sfnt_meta_data_map *map)
  4961 {
  4962   int i;
  4963 
  4964   for (i = 0; i < meta->num_data_maps; ++i)
  4965     {
  4966       if (meta->data_maps[i].tag == tag)
  4967         {
  4968           *map = meta->data_maps[i];
  4969           return (char *) meta->data + map->data_offset;
  4970         }
  4971     }
  4972 
  4973   return NULL;
  4974 }
  4975 
  4976 
  4977 
  4978 /* TrueType collection format support.  */
  4979 
  4980 /* Read a TrueType collection header from the font file FD.
  4981    FD must currently at the start of the file.
  4982 
  4983    Value is the header upon success, else NULL.  */
  4984 
  4985 TEST_STATIC struct sfnt_ttc_header *
  4986 sfnt_read_ttc_header (int fd)
  4987 {
  4988   struct sfnt_ttc_header *ttc;
  4989   size_t size, i;
  4990   ssize_t rc;
  4991 
  4992   /* First, allocate only as much as required.  */
  4993 
  4994   ttc = xmalloc (sizeof *ttc);
  4995 
  4996   /* Read the version 1.0 data.  */
  4997 
  4998   size = SFNT_ENDOF (struct sfnt_ttc_header, num_fonts,
  4999                      uint32_t);
  5000   rc = read (fd, ttc, size);
  5001   if (rc < size)
  5002     {
  5003       xfree (ttc);
  5004       return NULL;
  5005     }
  5006 
  5007   /* Now swap what was read.  */
  5008   sfnt_swap32 (&ttc->ttctag);
  5009   sfnt_swap32 (&ttc->version);
  5010   sfnt_swap32 (&ttc->num_fonts);
  5011 
  5012   /* Verify that the tag is as expected.  */
  5013   if (ttc->ttctag != SFNT_TTC_TTCF)
  5014     {
  5015       xfree (ttc);
  5016       return NULL;
  5017     }
  5018 
  5019   /* Now, read the variable length data.  Make sure to check for
  5020      overflow.  */
  5021 
  5022   if (INT_MULTIPLY_WRAPV (ttc->num_fonts,
  5023                           sizeof *ttc->offset_table,
  5024                           &size))
  5025     {
  5026       xfree (ttc);
  5027       return NULL;
  5028     }
  5029 
  5030   ttc = xrealloc (ttc, sizeof *ttc + size);
  5031   ttc->offset_table = (uint32_t *) (ttc + 1);
  5032   rc = read (fd, ttc->offset_table, size);
  5033   if (rc < size)
  5034     {
  5035       xfree (ttc);
  5036       return NULL;
  5037     }
  5038 
  5039   /* Swap each of the offsets read.  */
  5040   for (i = 0; i < ttc->num_fonts; ++i)
  5041     sfnt_swap32 (&ttc->offset_table[i]);
  5042 
  5043   /* Now, look at the version.  If it is earlier than 2.0, then
  5044      reading is finished.  */
  5045 
  5046   if (ttc->version < 0x00020000)
  5047     return ttc;
  5048 
  5049   /* If it is 2.0 or later, then continue to read ul_dsig_tag to
  5050      ul_dsig_offset.  */
  5051 
  5052   size = (SFNT_ENDOF (struct sfnt_ttc_header, ul_dsig_offset,
  5053                       uint32_t)
  5054           - offsetof (struct sfnt_ttc_header, ul_dsig_tag));
  5055   rc = read (fd, &ttc->ul_dsig_offset, size);
  5056   if (rc < size)
  5057     {
  5058       xfree (ttc);
  5059       return NULL;
  5060     }
  5061 
  5062   /* Swap what was read.  */
  5063   sfnt_swap32 (&ttc->ul_dsig_tag);
  5064   sfnt_swap32 (&ttc->ul_dsig_length);
  5065   sfnt_swap32 (&ttc->ul_dsig_offset);
  5066 
  5067   /* All done.  */
  5068   return ttc;
  5069 }
  5070 
  5071 
  5072 
  5073 /* TrueType hinting support.
  5074 
  5075    If you do not read the code in this section in conjunction with
  5076    Apple's TrueType Reference Manual, you will get very confused!
  5077 
  5078    TrueType fonts don't provide simple hinting meta data, unlike Type
  5079    2 or CFF fonts.
  5080 
  5081    Instead, they come with a ``font program'', a bytecode program
  5082    which is executed upon loading the font, a ``control value
  5083    program'', executed upon font metrics changing, and then a ``glyph
  5084    program'' for each glyph, which is run to fit its glyph after
  5085    scaling.
  5086 
  5087    The virtual machine which runs this bytecode is arranged as such:
  5088 
  5089    Firstly, there is a set of registers known as the ``graphics
  5090    state''.  Each time the point size of a font changes, the ``control
  5091    value program'' is run to establish the default values of the
  5092    ``graphics state''.  Then, before each glyph program is run, the
  5093    ``graphics state'' is set back to the default values.
  5094 
  5095    Secondly, there is an address space which contains all instructions
  5096    being run for the current program, which is addressed by the
  5097    interpreter through its program counter and also by the
  5098    instructions which push data on to the stack.
  5099 
  5100    Thirdly, there is a single stack, from which most instructions take
  5101    their operands and store data.
  5102 
  5103    Then, there is some memory set aside for each font, the ``storage
  5104    area'', which is addressed through the RS[] and WS[] instructions,
  5105    and a ``control value table'', which is the `cvt ' table of the
  5106    font.
  5107 
  5108    And finally, there is a ``glyph zone'' which holds points from a
  5109    scaled glyph outline, and a ``twilight zone'', which holds points
  5110    used by the font program itself.  Both are addressed indirectly
  5111    through one of three ``zone pointer'' registers, and are accessible
  5112    only when a program is being run on behalf of a glyph.  */
  5113 
  5114 
  5115 
  5116 /* Functions for reading tables used by the TrueType interpreter.  */
  5117 
  5118 /* Read the cvt table (control value table) from the given font FD,
  5119    using the table directory specified as SUBTABLE.  Swap all values
  5120    in the control value table.  Return NULL upon failure, else the cvt
  5121    table.  */
  5122 
  5123 TEST_STATIC struct sfnt_cvt_table *
  5124 sfnt_read_cvt_table (int fd, struct sfnt_offset_subtable *subtable)
  5125 {
  5126   struct sfnt_table_directory *directory;
  5127   size_t required, i;
  5128   ssize_t rc;
  5129   struct sfnt_cvt_table *cvt;
  5130 
  5131   /* Find the table in the directory.  */
  5132 
  5133   directory = sfnt_find_table (subtable, SFNT_TABLE_CVT );
  5134 
  5135   if (!directory)
  5136     return NULL;
  5137 
  5138   /* Seek to the location given in the directory.  */
  5139   if (lseek (fd, directory->offset, SEEK_SET) == (off_t) -1)
  5140     return NULL;
  5141 
  5142   /* Figure out the minimum amount that has to be read.  */
  5143   if (INT_ADD_WRAPV (sizeof *cvt, directory->length, &required))
  5144     return NULL;
  5145 
  5146   /* Allocate enough for that much data.  */
  5147   cvt = xmalloc (required);
  5148 
  5149   /* Now set cvt->num_elements as appropriate, and make cvt->values
  5150      point into the values.  */
  5151   cvt->num_elements = directory->length / 2;
  5152   cvt->values = (sfnt_fword *) (cvt + 1);
  5153 
  5154   /* Read into cvt.  */
  5155   rc = read (fd, cvt->values, directory->length);
  5156   if (rc != directory->length)
  5157     {
  5158       xfree (cvt);
  5159       return NULL;
  5160     }
  5161 
  5162   /* Swap each element in the control value table.  */
  5163   for (i = 0; i < cvt->num_elements; ++i)
  5164     sfnt_swap16 (&cvt->values[i]);
  5165 
  5166   /* All done.  */
  5167   return cvt;
  5168 }
  5169 
  5170 /* Read the fpgm table from the given font FD, using the table
  5171    directory specified as SUBTABLE.  Value is NULL upon failure, else
  5172    the fpgm table.  */
  5173 
  5174 TEST_STATIC struct sfnt_fpgm_table *
  5175 sfnt_read_fpgm_table (int fd, struct sfnt_offset_subtable *subtable)
  5176 {
  5177   struct sfnt_table_directory *directory;
  5178   size_t required;
  5179   ssize_t rc;
  5180   struct sfnt_fpgm_table *fpgm;
  5181 
  5182   /* Find the table in the directory.  */
  5183 
  5184   directory = sfnt_find_table (subtable, SFNT_TABLE_FPGM);
  5185 
  5186   if (!directory)
  5187     return NULL;
  5188 
  5189   /* Seek to the location given in the directory.  */
  5190   if (lseek (fd, directory->offset, SEEK_SET) == (off_t) -1)
  5191     return NULL;
  5192 
  5193   /* Figure out the minimum amount that has to be read.  */
  5194   if (INT_ADD_WRAPV (sizeof *fpgm, directory->length, &required))
  5195     return NULL;
  5196 
  5197   /* Allocate enough for that much data.  */
  5198   fpgm = xmalloc (sizeof *fpgm + directory->length);
  5199 
  5200   /* Now set fpgm->num_instructions as appropriate, and make
  5201      fpgm->instructions point to the right place.  */
  5202 
  5203   fpgm->num_instructions = directory->length;
  5204   fpgm->instructions = (unsigned char *) (fpgm + 1);
  5205 
  5206   /* Read into fpgm.  */
  5207   rc = read (fd, fpgm->instructions, directory->length);
  5208   if (rc != directory->length)
  5209     {
  5210       xfree (fpgm);
  5211       return NULL;
  5212     }
  5213 
  5214   /* All done.  */
  5215   return fpgm;
  5216 }
  5217 
  5218 /* Read the prep table from the given font FD, using the table
  5219    directory specified as SUBTABLE.  Value is NULL upon failure, else
  5220    the prep table.  */
  5221 
  5222 TEST_STATIC struct sfnt_prep_table *
  5223 sfnt_read_prep_table (int fd, struct sfnt_offset_subtable *subtable)
  5224 {
  5225   struct sfnt_table_directory *directory;
  5226   size_t required;
  5227   ssize_t rc;
  5228   struct sfnt_prep_table *prep;
  5229 
  5230   /* Find the table in the directory.  */
  5231 
  5232   directory = sfnt_find_table (subtable, SFNT_TABLE_PREP);
  5233 
  5234   if (!directory)
  5235     return NULL;
  5236 
  5237   /* Seek to the location given in the directory.  */
  5238   if (lseek (fd, directory->offset, SEEK_SET) == (off_t) -1)
  5239     return NULL;
  5240 
  5241   /* Figure out the minimum amount that has to be read.  */
  5242   if (INT_ADD_WRAPV (sizeof *prep, directory->length, &required))
  5243     return NULL;
  5244 
  5245   /* Allocate enough for that much data.  */
  5246   prep = xmalloc (sizeof *prep + directory->length);
  5247 
  5248   /* Now set prep->num_instructions as appropriate, and make
  5249      prep->instructions point to the right place.  */
  5250 
  5251   prep->num_instructions = directory->length;
  5252   prep->instructions = (unsigned char *) (prep + 1);
  5253 
  5254   /* Read into prep.  */
  5255   rc = read (fd, prep->instructions, directory->length);
  5256   if (rc != directory->length)
  5257     {
  5258       xfree (prep);
  5259       return NULL;
  5260     }
  5261 
  5262   /* All done.  */
  5263   return prep;
  5264 }
  5265 
  5266 
  5267 
  5268 /* Interpreter execution environment.  */
  5269 
  5270 /* Divide the specified two 26.6 fixed point numbers X and Y.
  5271    Return the result.  */
  5272 
  5273 static sfnt_f26dot6
  5274 sfnt_div_f26dot6 (sfnt_f26dot6 x, sfnt_f26dot6 y)
  5275 {
  5276 #ifdef INT64_MAX
  5277   int64_t result;
  5278 
  5279   result = ((int64_t) x * 64) / y;
  5280 
  5281   return result;
  5282 #else
  5283   int sign;
  5284   unsigned int a, b;
  5285 
  5286   sign = 1;
  5287 
  5288   if (x < 0)
  5289     sign = -sign;
  5290 
  5291   if (y < 0)
  5292     sign = -sign;
  5293 
  5294   a = abs (x);
  5295   b = abs (y);
  5296 
  5297   return sfnt_multiply_divide (a, 64, b) * sign;
  5298 #endif
  5299 }
  5300 
  5301 /* Multiply the specified two 26.6 fixed point numbers A and B.
  5302    Return the result, or an undefined value upon overflow.  */
  5303 
  5304 static sfnt_f26dot6
  5305 sfnt_mul_f26dot6 (sfnt_f26dot6 a, sfnt_f26dot6 b)
  5306 {
  5307 #ifdef INT64_MAX
  5308   int64_t product;
  5309 
  5310   product = (int64_t) a * (int64_t) b;
  5311 
  5312   /* This can be done quickly with int64_t.  */
  5313   return product / (int64_t) 64;
  5314 #else
  5315   int sign;
  5316 
  5317   sign = 1;
  5318 
  5319   if (a < 0)
  5320     sign = -sign;
  5321 
  5322   if (b < 0)
  5323     sign = -sign;
  5324 
  5325   return sfnt_multiply_divide (abs (a), abs (b),
  5326                                64) * sign;
  5327 #endif
  5328 }
  5329 
  5330 /* Multiply the specified 2.14 number with another signed 32 bit
  5331    number.  Return the result as a signed 32 bit number.  */
  5332 
  5333 static int32_t
  5334 sfnt_mul_f2dot14 (sfnt_f2dot14 a, int32_t b)
  5335 {
  5336 #ifdef INT64_MAX
  5337   int64_t product;
  5338 
  5339   product = (int64_t) a * (int64_t) b;
  5340 
  5341   return product / (int64_t) 16384;
  5342 #else
  5343   int sign;
  5344 
  5345   sign = 1;
  5346 
  5347   if (a < 0)
  5348     sign = -sign;
  5349 
  5350   if (b < 0)
  5351     sign = -sign;
  5352 
  5353   return sfnt_multiply_divide (abs (a), abs (b),
  5354                                16384) * sign;
  5355 #endif
  5356 }
  5357 
  5358 /* Multiply the specified 26.6 fixed point number X by the specified
  5359    16.16 fixed point number Y with symmetric rounding.
  5360 
  5361    The 26.6 fixed point number must fit inside -32768 to 32767.ffff.
  5362    Value is otherwise undefined.  */
  5363 
  5364 static sfnt_f26dot6
  5365 sfnt_mul_f26dot6_fixed (sfnt_f26dot6 x, sfnt_fixed y)
  5366 {
  5367 #ifdef INT64_MAX
  5368   uint64_t product;
  5369   int sign;
  5370 
  5371   sign = 1;
  5372 
  5373   if (x < 0)
  5374     {
  5375       x = -x;
  5376       sign = -sign;
  5377     }
  5378 
  5379   if (y < 0)
  5380     {
  5381       y = -y;
  5382       sign = -sign;
  5383     }
  5384 
  5385   product = (uint64_t) y * (uint64_t) x;
  5386 
  5387   /* This can be done quickly with int64_t.  */
  5388   return ((int64_t) (product + 32676) / (int64_t) 65536) * sign;
  5389 #else
  5390   struct sfnt_large_integer temp;
  5391   int sign;
  5392 
  5393   sign = 1;
  5394 
  5395   if (x < 0)
  5396     sign = -sign;
  5397 
  5398   if (y < 0)
  5399     sign = -sign;
  5400 
  5401   sfnt_multiply_divide_1 (abs (x), abs (y), &temp);
  5402   sfnt_large_integer_add (&temp, 32676);
  5403   return sfnt_multiply_divide_2 (&temp, 65536) * sign;
  5404 #endif
  5405 }
  5406 
  5407 /* Return the floor of the specified 26.6 fixed point value X.  */
  5408 
  5409 static sfnt_f26dot6
  5410 sfnt_floor_f26dot6 (sfnt_f26dot6 x)
  5411 {
  5412   return x & 037777777700;
  5413 }
  5414 
  5415 /* Return the ceiling of the specified 26.6 fixed point value X.  */
  5416 
  5417 static sfnt_f26dot6
  5418 sfnt_ceil_f26dot6 (sfnt_f26dot6 x)
  5419 {
  5420   return (x + 077) & ~077;
  5421 }
  5422 
  5423 /* Return the 26.6 fixed point value X rounded to the nearest integer
  5424    value.  */
  5425 
  5426 static sfnt_f26dot6
  5427 sfnt_round_f26dot6 (sfnt_f26dot6 x)
  5428 {
  5429   /* Add 0.5.  */
  5430   x += 040;
  5431 
  5432   /* Remove the fractional.  */
  5433   return x & ~077;
  5434 }
  5435 
  5436 /* Needed by sfnt_init_graphics_state.  */
  5437 
  5438 static void sfnt_validate_gs (struct sfnt_graphics_state *);
  5439 
  5440 /* Set up default values for the interpreter graphics state.  Return
  5441    them in STATE.  */
  5442 
  5443 static void
  5444 sfnt_init_graphics_state (struct sfnt_graphics_state *state)
  5445 {
  5446   state->auto_flip = true;
  5447   state->cvt_cut_in = 0104;
  5448   state->delta_base = 9;
  5449   state->delta_shift = 3;
  5450   state->dual_projection_vector.x = 040000; /* 1.0 */
  5451   state->dual_projection_vector.y = 0;
  5452   state->freedom_vector.x = 040000; /* 1.0 */
  5453   state->freedom_vector.y = 0;
  5454   state->instruct_control = 0;
  5455   state->loop = 1;
  5456   state->minimum_distance = 0100;
  5457   state->projection_vector.x = 040000; /* 1.0 */
  5458   state->projection_vector.y = 0;
  5459   state->round_state = 1;
  5460   state->rp0 = 0;
  5461   state->rp1 = 0;
  5462   state->rp2 = 0;
  5463   state->scan_control = 0;
  5464   state->sw_cut_in = 0;
  5465   state->single_width_value = 0;
  5466   state->zp0 = 1;
  5467   state->zp1 = 1;
  5468   state->zp2 = 1;
  5469 
  5470   /* Validate the graphics state.  */
  5471   sfnt_validate_gs (state);
  5472 }
  5473 
  5474 /* Set up an interpreter to be used with a font.  Use the resource
  5475    limits specified in the MAXP table, the values specified in the
  5476    CVT, HEAD and FVAR tables, the pixel size PIXEL_SIZE, and the point
  5477    size POINT_SIZE.  CVT may be NULL, in which case the interpreter
  5478    will not have access to a control value table.
  5479 
  5480    POINT_SIZE should be PIXEL_SIZE, converted to 1/72ths of an inch.
  5481 
  5482    Value is the interpreter, with all state initialized to default
  5483    values, or NULL upon failure.  */
  5484 
  5485 TEST_STATIC struct sfnt_interpreter *
  5486 sfnt_make_interpreter (struct sfnt_maxp_table *maxp,
  5487                        struct sfnt_cvt_table *cvt,
  5488                        struct sfnt_head_table *head,
  5489                        struct sfnt_fvar_table *fvar,
  5490                        int pixel_size, int point_size)
  5491 {
  5492   size_t size, temp, i, storage_size, pad;
  5493   struct sfnt_interpreter *interpreter;
  5494 
  5495   /* Detect CFF maxp tables.  */
  5496   if (maxp->version != 0x00010000)
  5497     return NULL;
  5498 
  5499   /* Use the contents of the MAXP table to determine the size of the
  5500      interpreter structure.  */
  5501   size = sizeof (*interpreter);
  5502 
  5503   /* Add program stack.  */
  5504   if (INT_ADD_WRAPV ((maxp->max_stack_elements
  5505                       * sizeof *interpreter->stack),
  5506                      size, &size))
  5507     return NULL;
  5508 
  5509   /* Add twilight zone.  */
  5510 
  5511   if (INT_ADD_WRAPV ((maxp->max_twilight_points
  5512                       * sizeof *interpreter->twilight_x),
  5513                      size, &size))
  5514     return NULL;
  5515 
  5516   if (INT_ADD_WRAPV ((maxp->max_twilight_points
  5517                       * sizeof *interpreter->twilight_y),
  5518                      size, &size))
  5519     return NULL;
  5520 
  5521   if (INT_ADD_WRAPV ((maxp->max_twilight_points
  5522                       * sizeof *interpreter->twilight_y),
  5523                      size, &size))
  5524     return NULL;
  5525 
  5526   if (INT_ADD_WRAPV ((maxp->max_twilight_points
  5527                       * sizeof *interpreter->twilight_y),
  5528                      size, &size))
  5529     return NULL;
  5530 
  5531   /* Add the storage area.  */
  5532   storage_size = maxp->max_storage * sizeof *interpreter->storage;
  5533   if (INT_ADD_WRAPV (storage_size, size, &size))
  5534     return NULL;
  5535 
  5536   /* Add padding for the storage area.  */
  5537   pad = alignof (struct sfnt_interpreter_definition);
  5538   pad -= size & (pad - 1);
  5539   if (INT_ADD_WRAPV (pad, size, &size))
  5540     return NULL;
  5541 
  5542   /* Add function and instruction definitions.  */
  5543   if (INT_ADD_WRAPV ((((int) maxp->max_instruction_defs
  5544                        + maxp->max_function_defs)
  5545                       * sizeof *interpreter->function_defs),
  5546                      size, &size))
  5547     return NULL;
  5548 
  5549   /* Add control value table.  */
  5550 
  5551   if (cvt)
  5552     {
  5553       if (INT_MULTIPLY_WRAPV (cvt->num_elements,
  5554                               sizeof *interpreter->cvt,
  5555                               &temp)
  5556           || INT_ADD_WRAPV (temp, size, &size))
  5557         return NULL;
  5558     }
  5559 
  5560   /* Allocate the interpreter.  */
  5561   interpreter = xmalloc (size);
  5562 
  5563 #ifdef TEST
  5564   interpreter->run_hook = NULL;
  5565   interpreter->push_hook = NULL;
  5566   interpreter->pop_hook = NULL;
  5567 #endif
  5568 
  5569   /* Fill in pointers and default values.  */
  5570   interpreter->max_stack_elements = maxp->max_stack_elements;
  5571   interpreter->num_instructions = 0;
  5572   interpreter->IP = 0;
  5573   interpreter->storage_size = maxp->max_storage;
  5574   interpreter->function_defs_size = maxp->max_function_defs;
  5575   interpreter->instruction_defs_size = maxp->max_instruction_defs;
  5576   interpreter->twilight_zone_size = maxp->max_twilight_points;
  5577   interpreter->scale = 0; /* This should be set later.  */
  5578 
  5579   interpreter->stack = (uint32_t *) (interpreter + 1);
  5580   interpreter->SP = interpreter->stack;
  5581   interpreter->instructions = NULL;
  5582   interpreter->twilight_x
  5583     = (sfnt_f26dot6 *) (interpreter->stack
  5584                         + maxp->max_stack_elements);
  5585   interpreter->twilight_y = (interpreter->twilight_x
  5586                              + maxp->max_twilight_points);
  5587   interpreter->twilight_original_x = (interpreter->twilight_y
  5588                                       + maxp->max_twilight_points);
  5589   interpreter->twilight_original_y
  5590     = (interpreter->twilight_original_x
  5591        + maxp->max_twilight_points);
  5592   interpreter->glyph_zone = NULL;
  5593   interpreter->advance_width = 0;
  5594   interpreter->storage
  5595     = (uint32_t *) (interpreter->twilight_original_y
  5596                     + maxp->max_twilight_points);
  5597   interpreter->function_defs
  5598     = (struct sfnt_interpreter_definition *) (interpreter->storage
  5599                                               + maxp->max_storage);
  5600   interpreter->function_defs
  5601     = ((struct sfnt_interpreter_definition *)
  5602        ((unsigned char *) interpreter->function_defs + pad));
  5603   interpreter->instruction_defs = (interpreter->function_defs
  5604                                    + maxp->max_function_defs);
  5605   interpreter->cvt
  5606     = (sfnt_f26dot6 *) (interpreter->instruction_defs
  5607                         + maxp->max_instruction_defs);
  5608 
  5609   if (cvt)
  5610     interpreter->cvt_size = cvt->num_elements;
  5611   else
  5612     interpreter->cvt_size = 0;
  5613 
  5614   /* Now compute the scale.  Then, scale up the control value table
  5615      values.  */
  5616   interpreter->scale
  5617     = sfnt_div_fixed (pixel_size, head->units_per_em);
  5618 
  5619   /* Set the PPEM.  */
  5620   interpreter->ppem = pixel_size;
  5621   interpreter->point_size = point_size;
  5622 
  5623   /* Zero out the interpreter state from the stack to the end of the
  5624      instruction definitions.  */
  5625   memset (interpreter->stack, 0, size - sizeof *interpreter);
  5626 
  5627   /* Initialize the interpreter graphics state.  */
  5628   sfnt_init_graphics_state (&interpreter->state);
  5629 
  5630   /* Load the control value table.  */
  5631   for (i = 0; i < interpreter->cvt_size; ++i)
  5632     interpreter->cvt[i]
  5633       = sfnt_mul_f26dot6_fixed (cvt->values[i] * 64,
  5634                                 interpreter->scale);
  5635 
  5636   /* Fill in the default values for phase, period and threshold.  */
  5637   interpreter->period = 64;
  5638   interpreter->phase = 0;
  5639   interpreter->threshold = 0;
  5640 
  5641   /* Fill in the current call depth.  */
  5642   interpreter->call_depth = 0;
  5643 
  5644   /* Clear variation axes.  They will be set upon a call to
  5645      `sfnt_vary_interpreter'.  */
  5646   interpreter->n_axis = 0;
  5647   interpreter->norm_coords = NULL;
  5648 
  5649   /* Set n_axis now if a fvar table was provided.  This way, GXAXIS
  5650      pushes the correct number of values even if no blend is
  5651      provided.  */
  5652 
  5653   if (fvar)
  5654     interpreter->n_axis = fvar->axis_count;
  5655 
  5656   /* Return the interpreter.  */
  5657   return interpreter;
  5658 }
  5659 
  5660 /* These enums are used to determine why the interpreter is being
  5661    run.  They have the following meanings:
  5662 
  5663      - The interpreter is being run to interpret a font program.
  5664      - The interpreter is being run to interpret the control
  5665        value program.
  5666      - The interpreter is being run to fit a glyph.
  5667      - The interpreter is being run as part of an automated test.  */
  5668 
  5669 enum sfnt_interpreter_run_context
  5670   {
  5671     SFNT_RUN_CONTEXT_FONT_PROGRAM,
  5672     SFNT_RUN_CONTEXT_CONTROL_VALUE_PROGRAM,
  5673     SFNT_RUN_CONTEXT_GLYPH_PROGRAM,
  5674 #ifdef TEST
  5675     SFNT_RUN_CONTEXT_TEST,
  5676 #endif
  5677   };
  5678 
  5679 /* Cancel execution of the program in INTERPRETER with the specified
  5680    error REASON and reset the loop counter to 1.
  5681 
  5682    After this is called, it is probably okay to reuse INTERPRETER.
  5683    However, instructions must always be reloaded.  */
  5684 
  5685 _Noreturn static void
  5686 sfnt_interpret_trap (struct sfnt_interpreter *interpreter,
  5687                      const char *reason)
  5688 {
  5689   interpreter->trap_reason = reason;
  5690   interpreter->call_depth = 0;
  5691   interpreter->state.loop = 1;
  5692   longjmp (interpreter->trap, 1);
  5693 }
  5694 
  5695 #define STACKSIZE()                             \
  5696   (interpreter->SP - interpreter->stack)
  5697 
  5698 #define TRAP(why)                               \
  5699   sfnt_interpret_trap (interpreter, (why))
  5700 
  5701 #define MOVE(a, b, n)                           \
  5702   memmove (a, b, (n) * sizeof (uint32_t))
  5703 
  5704 #define CHECK_STACK_ELEMENTS(n)                 \
  5705   {                                             \
  5706     if ((interpreter->SP                        \
  5707          - interpreter->stack) < n)             \
  5708       TRAP ("stack underflow");                 \
  5709   }
  5710 
  5711 #define CHECK_STACK_AVAILABLE(n)                \
  5712   {                                             \
  5713     char *stack_end;                            \
  5714                                                 \
  5715     stack_end                                   \
  5716       = (char *) interpreter->twilight_x;       \
  5717     if (((char *) (interpreter->SP + (n))       \
  5718          > stack_end))                          \
  5719       TRAP ("stack overflow");                  \
  5720   }
  5721 
  5722 #define CHECK_PREP()                            \
  5723   if (!is_prep)                                 \
  5724     TRAP ("instruction executed not valid"      \
  5725           " outside control value program")     \
  5726 
  5727 #define sfnt_add(a, b)                          \
  5728   ((int) ((unsigned int) (a) + (unsigned int) (b)))
  5729 
  5730 #define sfnt_sub(a, b)                          \
  5731   ((int) ((unsigned int) (a) - (unsigned int) (b)))
  5732 
  5733 #define sfnt_mul(a, b)                          \
  5734   ((int) ((unsigned int) (a) * (unsigned int) (b)))
  5735 
  5736 
  5737 
  5738 /* Register, alu and logic instructions.  */
  5739 
  5740 #ifndef TEST
  5741 
  5742 #define POP()                                   \
  5743   (interpreter->SP == interpreter->stack        \
  5744    ? (TRAP ("stack underflow"), 0)              \
  5745    : (*(--interpreter->SP)))
  5746 
  5747 #define POP_UNCHECKED() (*(--interpreter->SP))
  5748 
  5749 #else
  5750 
  5751 #define POP()                                   \
  5752   (interpreter->SP == interpreter->stack        \
  5753    ? (TRAP ("stack underflow"), 0)              \
  5754    : ({uint32_t _value;                         \
  5755        _value = *(--interpreter->SP);           \
  5756        if (interpreter->pop_hook)               \
  5757          interpreter->pop_hook (interpreter,    \
  5758                                 _value);        \
  5759        _value;}))
  5760 
  5761 #define POP_UNCHECKED() POP ()
  5762 
  5763 #endif
  5764 
  5765 #define LOOK()                                  \
  5766   (interpreter->SP == interpreter->stack        \
  5767    ? (TRAP ("stack underflow"), 0)              \
  5768    : *(interpreter->SP - 1))
  5769 
  5770 #if !defined TEST || !0
  5771 
  5772 #define PUSH(value)                             \
  5773   {                                             \
  5774     if ((char *) (interpreter->SP + 1)          \
  5775         > (char *) interpreter->twilight_x)     \
  5776       TRAP ("stack overflow");                  \
  5777                                                 \
  5778     *interpreter->SP = (value);                 \
  5779     interpreter->SP++;                          \
  5780   }
  5781 
  5782 #define PUSH_UNCHECKED(value)                   \
  5783   {                                             \
  5784     *interpreter->SP = (value);                 \
  5785     interpreter->SP++;                          \
  5786   }
  5787 
  5788 #else /* TEST && 0 */
  5789 
  5790 #define PUSH(value)                             \
  5791   {                                             \
  5792     if ((char *) (interpreter->SP + 1)          \
  5793         > (char *) interpreter->twilight_x)     \
  5794       TRAP ("stack overflow");                  \
  5795                                                 \
  5796     if (interpreter->push_hook)                 \
  5797       interpreter->push_hook (interpreter,      \
  5798                               value);           \
  5799                                                 \
  5800     *interpreter->SP = value;                   \
  5801     interpreter->SP++;                          \
  5802   }
  5803 
  5804 #define PUSH_UNCHECKED(value) PUSH (value)
  5805 
  5806 #endif /* TEST && 0 */
  5807 
  5808 #define PUSH2_UNCHECKED(high, low)              \
  5809   {                                             \
  5810     int16_t word;                               \
  5811                                                 \
  5812     word = (((int8_t) high) << 8 | low);        \
  5813     PUSH_UNCHECKED (word);                      \
  5814   }                                             \
  5815 
  5816 #define SRP0()                                  \
  5817   {                                             \
  5818     uint32_t p;                                 \
  5819                                                 \
  5820     p = POP ();                                 \
  5821     interpreter->state.rp0 = p;                 \
  5822   }
  5823 
  5824 #define SRP1()                                  \
  5825   {                                             \
  5826     uint32_t p;                                 \
  5827                                                 \
  5828     p = POP ();                                 \
  5829     interpreter->state.rp1 = p;                 \
  5830   }
  5831 
  5832 #define SRP2()                                  \
  5833   {                                             \
  5834     uint32_t p;                                 \
  5835                                                 \
  5836     p = POP ();                                 \
  5837     interpreter->state.rp2 = p;                 \
  5838   }
  5839 
  5840 #define SZP0()                                  \
  5841   {                                             \
  5842     uint32_t zone;                              \
  5843                                                 \
  5844     zone = POP ();                              \
  5845                                                 \
  5846     if (zone > 1)                               \
  5847       TRAP ("invalid zone");                    \
  5848                                                 \
  5849     interpreter->state.zp0 = zone;              \
  5850   }
  5851 
  5852 #define SZP1()                                  \
  5853   {                                             \
  5854     uint32_t zone;                              \
  5855                                                 \
  5856     zone = POP ();                              \
  5857                                                 \
  5858     if (zone > 1)                               \
  5859       TRAP ("invalid zone");                    \
  5860                                                 \
  5861     interpreter->state.zp1 = zone;              \
  5862   }
  5863 
  5864 #define SZP2()                                  \
  5865   {                                             \
  5866     uint32_t zone;                              \
  5867                                                 \
  5868     zone = POP ();                              \
  5869                                                 \
  5870     if (zone > 1)                               \
  5871       TRAP ("invalid zone");                    \
  5872                                                 \
  5873     interpreter->state.zp2 = zone;              \
  5874   }
  5875 
  5876 #define SZPS()                                  \
  5877   {                                             \
  5878     uint32_t zone;                              \
  5879                                                 \
  5880     zone = POP ();                              \
  5881                                                 \
  5882     if (zone > 1)                               \
  5883       TRAP ("invalid zone");                    \
  5884                                                 \
  5885     interpreter->state.zp0 = zone;              \
  5886     interpreter->state.zp1 = zone;              \
  5887     interpreter->state.zp2 = zone;              \
  5888   }
  5889 
  5890 #define SLOOP()                                 \
  5891   {                                             \
  5892     uint32_t loop;                              \
  5893                                                 \
  5894     loop = POP ();                              \
  5895                                                 \
  5896     if (!loop)                                  \
  5897       TRAP ("loop set to 0");                   \
  5898                                                 \
  5899     interpreter->state.loop = loop;             \
  5900   }
  5901 
  5902 #define SMD()                                   \
  5903   {                                             \
  5904     sfnt_f26dot6 md;                            \
  5905                                                 \
  5906     md = POP ();                                \
  5907                                                 \
  5908     interpreter->state.minimum_distance = md;   \
  5909   }
  5910 
  5911 #define ELSE()                                  \
  5912   {                                             \
  5913     sfnt_interpret_else (interpreter);          \
  5914     goto skip_step;                             \
  5915   }
  5916 
  5917 #define JMPR()                                  \
  5918   {                                             \
  5919     int32_t offset;                             \
  5920                                                 \
  5921     offset = POP ();                            \
  5922                                                 \
  5923     if (interpreter->IP + offset < 0            \
  5924         || (interpreter->IP + offset            \
  5925             > interpreter->num_instructions))   \
  5926       TRAP ("JMPR out of bounds");              \
  5927                                                 \
  5928     interpreter->IP += offset;                  \
  5929     goto skip_step;                             \
  5930   }
  5931 
  5932 #define SCVTCI()                                \
  5933   {                                             \
  5934     sfnt_f26dot6 cutin;                         \
  5935                                                 \
  5936     cutin = POP ();                             \
  5937                                                 \
  5938     interpreter->state.cvt_cut_in = cutin;      \
  5939   }
  5940 
  5941 #define SSWCI()                                 \
  5942   {                                             \
  5943     sfnt_f26dot6 cutin;                         \
  5944                                                 \
  5945     cutin = POP ();                             \
  5946                                                 \
  5947     interpreter->state.sw_cut_in = cutin;       \
  5948   }
  5949 
  5950 #define SSW()                                   \
  5951   {                                             \
  5952     int32_t single_width;                       \
  5953                                                 \
  5954     single_width = POP ();                      \
  5955                                                 \
  5956     interpreter->state.single_width_value       \
  5957       = (interpreter->scale * single_width      \
  5958          / 1024);                               \
  5959   }
  5960 
  5961 #define DUP()                                   \
  5962   {                                             \
  5963     uint32_t value;                             \
  5964                                                 \
  5965     value = LOOK ();                            \
  5966     PUSH (value);                               \
  5967   }
  5968 
  5969 #define CLEAR()                                 \
  5970   {                                             \
  5971     interpreter->SP = interpreter->stack;       \
  5972   }
  5973 
  5974 #define SWAP()                                  \
  5975   {                                             \
  5976     uint32_t a, b;                              \
  5977                                                 \
  5978     a = POP ();                                 \
  5979     b = POP ();                                 \
  5980                                                 \
  5981     PUSH_UNCHECKED (a);                         \
  5982     PUSH_UNCHECKED (b);                         \
  5983   }
  5984 
  5985 #define DEPTH()                                 \
  5986   {                                             \
  5987     ptrdiff_t diff;                             \
  5988                                                 \
  5989     diff = (interpreter->SP                     \
  5990             - interpreter->stack);              \
  5991     PUSH (diff);                                \
  5992   }
  5993 
  5994 #define CINDEX()                                \
  5995   {                                             \
  5996     int32_t index;                              \
  5997                                                 \
  5998     index = POP ();                             \
  5999                                                 \
  6000     if (index <= 0 || index > STACKSIZE ())     \
  6001       TRAP ("stack overflow");                  \
  6002                                                 \
  6003     PUSH_UNCHECKED (*(interpreter->SP           \
  6004                       - index));                \
  6005   }
  6006 
  6007 #define MINDEX()                                \
  6008   {                                             \
  6009     int32_t index, what;                        \
  6010                                                 \
  6011     index = POP ();                             \
  6012                                                 \
  6013     if (index <= 0 || index > STACKSIZE ())     \
  6014       TRAP ("stack overflow");                  \
  6015                                                 \
  6016     what = *(interpreter->SP - index);          \
  6017     MOVE (interpreter->SP - index,              \
  6018           interpreter->SP - index + 1,          \
  6019           index - 1);                           \
  6020     *(interpreter->SP - 1) = what;              \
  6021   }
  6022 
  6023 #define RAW()                                   \
  6024   {                                             \
  6025     if (why != SFNT_RUN_CONTEXT_GLYPH_PROGRAM)  \
  6026       TRAP ("Read Advance Width without loaded" \
  6027             " glyph");                          \
  6028     PUSH (interpreter->advance_width);          \
  6029   }
  6030 
  6031 #define CALL()                                  \
  6032   {                                             \
  6033     uint32_t id, i;                             \
  6034     struct sfnt_interpreter_definition *def;    \
  6035                                                 \
  6036     id = POP ();                                \
  6037                                                 \
  6038     for (i = 0;                                 \
  6039          i < interpreter->function_defs_size;   \
  6040          ++i)                                   \
  6041       {                                         \
  6042         def = &interpreter->function_defs[i];   \
  6043                                                 \
  6044         if (!def->instructions)                 \
  6045           TRAP ("invalid function");            \
  6046                                                 \
  6047         if (def->opcode == id)                  \
  6048           {                                     \
  6049             sfnt_interpret_call (def,           \
  6050                                  interpreter,   \
  6051                                  why);          \
  6052             goto next_instruction;              \
  6053           }                                     \
  6054       }                                         \
  6055                                                 \
  6056     TRAP ("invalid function");                  \
  6057   }
  6058 
  6059 #define LOOPCALL()                              \
  6060   {                                             \
  6061     uint32_t id;                                \
  6062     int32_t n;                                  \
  6063     int i;                                      \
  6064     struct sfnt_interpreter_definition *def;    \
  6065                                                 \
  6066     id = POP ();                                \
  6067     n = POP ();                                 \
  6068                                                 \
  6069     if (n > 65535)                              \
  6070       TRAP ("invalid LOOPCALL count");          \
  6071                                                 \
  6072     for (i = 0;                                 \
  6073          i < interpreter->function_defs_size;   \
  6074          ++i)                                   \
  6075       {                                         \
  6076         def = &interpreter->function_defs[i];   \
  6077                                                 \
  6078         if (!def->instructions)                 \
  6079           TRAP ("invalid function");            \
  6080                                                 \
  6081         if (def->opcode == id)                  \
  6082           goto loopcall_begin;                  \
  6083       }                                         \
  6084                                                 \
  6085     TRAP ("invalid function");                  \
  6086                                                 \
  6087   loopcall_begin:                               \
  6088     if (n-- <= 0)                               \
  6089       break;                                    \
  6090                                                 \
  6091     sfnt_interpret_call (def, interpreter,      \
  6092                          why);                  \
  6093     goto loopcall_begin;                        \
  6094   }
  6095 
  6096 #define FDEF()                                  \
  6097   {                                             \
  6098     if (why == SFNT_RUN_CONTEXT_GLYPH_PROGRAM)  \
  6099       TRAP ("FDEF inside glyph program");       \
  6100                                                 \
  6101     sfnt_interpret_fdef (interpreter, POP ());  \
  6102     goto skip_step;                             \
  6103   }
  6104 
  6105 #define ENDF()                                  \
  6106   {                                             \
  6107     TRAP ("stray ENDF");                        \
  6108   }
  6109 
  6110 #define NPUSHB()                                \
  6111   {                                             \
  6112     int b, nbytes, IP;                          \
  6113     unsigned char *ip;                          \
  6114                                                 \
  6115     if ((IP = interpreter->IP + 1)              \
  6116         >= interpreter->num_instructions)       \
  6117       TRAP ("Missing arg to NPUSHB");           \
  6118                                                 \
  6119     nbytes                                      \
  6120       = interpreter->instructions[IP];          \
  6121                                                 \
  6122     if (IP + 1 + nbytes                         \
  6123         > interpreter->num_instructions)        \
  6124       TRAP ("args to NPUSHB lie outside IS");   \
  6125                                                 \
  6126     CHECK_STACK_AVAILABLE (nbytes);             \
  6127     ip = interpreter->instructions;             \
  6128     for (b = IP + 1; b < IP + 1 + nbytes; ++b)  \
  6129       PUSH_UNCHECKED (ip[b]);                   \
  6130                                                 \
  6131     interpreter->IP += nbytes + 1;              \
  6132   }
  6133 
  6134 #define NPUSHW()                                \
  6135   {                                             \
  6136     int b, nbytes, IP;                          \
  6137     unsigned char *ip;                          \
  6138                                                 \
  6139     if ((IP = interpreter->IP + 1)              \
  6140         >= interpreter->num_instructions)       \
  6141       TRAP ("Missing arg to NPUSHW");           \
  6142                                                 \
  6143     nbytes                                      \
  6144       = interpreter->instructions[IP] * 2;      \
  6145                                                 \
  6146     if (IP + 1 + nbytes                         \
  6147         > interpreter->num_instructions)        \
  6148       TRAP ("args to NPUSHW lie outside IS");   \
  6149                                                 \
  6150     CHECK_STACK_AVAILABLE (nbytes / 2);         \
  6151     ip = interpreter->instructions;             \
  6152     for (b = IP + 1; b < IP + 1 + nbytes;       \
  6153          b += 2)                                \
  6154       PUSH2_UNCHECKED (ip[b], ip[b + 1]);       \
  6155                                                 \
  6156     interpreter->IP += nbytes + 1;              \
  6157   }
  6158 
  6159 #define WS()                                    \
  6160   {                                             \
  6161     uint32_t address, value;                    \
  6162                                                 \
  6163     value = POP ();                             \
  6164     address = POP ();                           \
  6165                                                 \
  6166     if (address >= interpreter->storage_size)   \
  6167       TRAP ("invalid WS");                      \
  6168                                                 \
  6169     interpreter->storage[address] = value;      \
  6170   }
  6171 
  6172 #define RS()                                    \
  6173   {                                             \
  6174     uint32_t address, value;                    \
  6175                                                 \
  6176     address = POP ();                           \
  6177                                                 \
  6178     if (address >= interpreter->storage_size)   \
  6179       TRAP ("invalid RS");                      \
  6180                                                 \
  6181     value = interpreter->storage[address];      \
  6182     PUSH_UNCHECKED (value);                     \
  6183   }
  6184 
  6185 #define WCVTP()                                 \
  6186   {                                             \
  6187     sfnt_f26dot6 value;                         \
  6188     uint32_t location;                          \
  6189                                                 \
  6190     value = POP ();                             \
  6191     location = POP ();                          \
  6192                                                 \
  6193     if (location >= interpreter->cvt_size)      \
  6194       TRAP ("WCVTP out of bounds");             \
  6195                                                 \
  6196     interpreter->cvt[location] = value;         \
  6197   }
  6198 
  6199 #define RCVT()                                  \
  6200   {                                             \
  6201     sfnt_f26dot6 value;                         \
  6202     uint32_t location;                          \
  6203                                                 \
  6204     location = POP ();                          \
  6205                                                 \
  6206     if (location >= interpreter->cvt_size)      \
  6207       TRAP ("out of bounds RCVT");              \
  6208                                                 \
  6209     value = interpreter->cvt[location];         \
  6210     PUSH_UNCHECKED (value);                     \
  6211   }
  6212 
  6213 #define MPPEM()                                 \
  6214   {                                             \
  6215     PUSH (interpreter->ppem);                   \
  6216   }
  6217 
  6218 #define MPS()                                   \
  6219   {                                             \
  6220     PUSH (interpreter->point_size);             \
  6221   }
  6222 
  6223 #define FLIPON()                                \
  6224   {                                             \
  6225     interpreter->state.auto_flip = true;        \
  6226   }
  6227 
  6228 #define FLIPOFF()                               \
  6229   {                                             \
  6230     interpreter->state.auto_flip = false;       \
  6231   }
  6232 
  6233 #define DEBUG()                                 \
  6234   {                                             \
  6235     POP (); /* Value is ignored.  */            \
  6236   }
  6237 
  6238 #define LT()                                    \
  6239   {                                             \
  6240     int32_t e1, e2;                             \
  6241                                                 \
  6242     e2 = POP ();                                \
  6243     e1 = POP ();                                \
  6244                                                 \
  6245     PUSH_UNCHECKED (e1 < e2 ? 1 : 0);           \
  6246   }
  6247 
  6248 #define LTEQ()                                  \
  6249   {                                             \
  6250     int32_t e1, e2;                             \
  6251                                                 \
  6252     e2 = POP ();                                \
  6253     e1 = POP ();                                \
  6254                                                 \
  6255     PUSH_UNCHECKED (e1 <= e2 ? 1 : 0);          \
  6256   }
  6257 
  6258 #define GT()                                    \
  6259   {                                             \
  6260     int32_t e1, e2;                             \
  6261                                                 \
  6262     e2 = POP ();                                \
  6263     e1 = POP ();                                \
  6264                                                 \
  6265     PUSH_UNCHECKED (e1 > e2 ? 1 : 0);           \
  6266   }
  6267 
  6268 #define GTEQ()                                  \
  6269   {                                             \
  6270     int32_t e1, e2;                             \
  6271                                                 \
  6272     e2 = POP ();                                \
  6273     e1 = POP ();                                \
  6274                                                 \
  6275     PUSH_UNCHECKED (e1 >= e2 ? 1 : 0);          \
  6276   }
  6277 
  6278 #define EQ()                                    \
  6279   {                                             \
  6280     uint32_t e1, e2;                            \
  6281                                                 \
  6282     e1 = POP ();                                \
  6283     e2 = POP ();                                \
  6284                                                 \
  6285     PUSH_UNCHECKED (e1 == e2 ? 1 : 0);          \
  6286   }
  6287 
  6288 #define NEQ()                                   \
  6289   {                                             \
  6290     uint32_t e1, e2;                            \
  6291                                                 \
  6292     e1 = POP ();                                \
  6293     e2 = POP ();                                \
  6294                                                 \
  6295     PUSH_UNCHECKED (e1 != e2 ? 1 : 0);          \
  6296   }
  6297 
  6298 #define ODD()                                   \
  6299   {                                             \
  6300     sfnt_f26dot6 e1, result;                    \
  6301                                                 \
  6302     e1 = POP ();                                \
  6303     result = abs (e1);                          \
  6304                                                 \
  6305     result                                      \
  6306       = interpreter->state.round (result,       \
  6307                                   interpreter); \
  6308     PUSH_UNCHECKED (((result & 127)             \
  6309                      == 64) ? 1 : 0);           \
  6310   }
  6311 
  6312 #define EVEN()                                  \
  6313   {                                             \
  6314     sfnt_f26dot6 e1, result;                    \
  6315     uint32_t value;                             \
  6316                                                 \
  6317     e1 = POP ();                                \
  6318     result = abs (e1);                          \
  6319                                                 \
  6320     result                                      \
  6321       = interpreter->state.round (result,       \
  6322                                   interpreter); \
  6323     value = ((result & 127) == 64) ? 0 : 1;     \
  6324     PUSH_UNCHECKED (value);                     \
  6325   }
  6326 
  6327 #define IF()                                    \
  6328   {                                             \
  6329     uint32_t condition;                         \
  6330                                                 \
  6331     condition = POP ();                         \
  6332     sfnt_interpret_if (interpreter, condition); \
  6333     goto skip_step;                             \
  6334   }
  6335 
  6336 #define EIF()                                   \
  6337   {                                             \
  6338                                                 \
  6339   }
  6340 
  6341 #define AND()                                   \
  6342   {                                             \
  6343     uint32_t e1, e2;                            \
  6344                                                 \
  6345     e1 = POP ();                                \
  6346     e2 = POP ();                                \
  6347                                                 \
  6348     PUSH_UNCHECKED (e1 && e2 ? 1 : 0);          \
  6349   }
  6350 
  6351 #define OR()                                    \
  6352   {                                             \
  6353     uint32_t e1, e2;                            \
  6354                                                 \
  6355     e1 = POP ();                                \
  6356     e2 = POP ();                                \
  6357                                                 \
  6358     PUSH_UNCHECKED (e1 || e2 ? 1 : 0);          \
  6359   }
  6360 
  6361 #define NOT()                                   \
  6362   {                                             \
  6363     uint32_t e1;                                \
  6364                                                 \
  6365     e1 = POP ();                                \
  6366                                                 \
  6367     PUSH_UNCHECKED (!e1 ? 1 : 0);               \
  6368   }
  6369 
  6370 #define SDB()                                   \
  6371   {                                             \
  6372     uint32_t base;                              \
  6373                                                 \
  6374     base = POP ();                              \
  6375                                                 \
  6376     interpreter->state.delta_base = base;       \
  6377   }
  6378 
  6379 #define SDS()                                   \
  6380   {                                             \
  6381     uint32_t shift;                             \
  6382                                                 \
  6383     shift = POP ();                             \
  6384                                                 \
  6385     if (shift > 6)                              \
  6386       TRAP ("invalid delta shift");             \
  6387                                                 \
  6388     interpreter->state.delta_shift = shift;     \
  6389   }
  6390 
  6391 #define ADD()                                   \
  6392   {                                             \
  6393     sfnt_f26dot6 n1, n2;                        \
  6394                                                 \
  6395     n1 = POP ();                                \
  6396     n2 = POP ();                                \
  6397                                                 \
  6398     PUSH_UNCHECKED (sfnt_add (n1, n2));         \
  6399   }
  6400 
  6401 #define SUB()                                   \
  6402   {                                             \
  6403     sfnt_f26dot6 n2, n1;                        \
  6404                                                 \
  6405     n2 = POP ();                                \
  6406     n1 = POP ();                                \
  6407                                                 \
  6408     PUSH_UNCHECKED (sfnt_sub (n1, n2));         \
  6409   }
  6410 
  6411 #define DIV()                                   \
  6412   {                                             \
  6413     sfnt_f26dot6 n2, n1;                        \
  6414                                                 \
  6415     n2 = POP ();                                \
  6416     n1 = POP ();                                \
  6417                                                 \
  6418     if (!n2)                                    \
  6419       TRAP ("DIV by 0");                        \
  6420                                                 \
  6421     PUSH_UNCHECKED (sfnt_div_f26dot6 (n1, n2)); \
  6422   }
  6423 
  6424 #define MUL()                                   \
  6425   {                                             \
  6426     sfnt_f26dot6 n2, n1;                        \
  6427                                                 \
  6428     n2 = POP ();                                \
  6429     n1 = POP ();                                \
  6430                                                 \
  6431     PUSH_UNCHECKED (sfnt_mul_f26dot6 (n2, n1)); \
  6432   }
  6433 
  6434 #define ABS()                                   \
  6435   {                                             \
  6436     sfnt_f26dot6 n;                             \
  6437                                                 \
  6438     n = POP ();                                 \
  6439                                                 \
  6440     if (n == INT32_MIN)                         \
  6441       PUSH_UNCHECKED (0)                        \
  6442     else                                        \
  6443       PUSH_UNCHECKED (n < 0 ? -n : n)           \
  6444   }
  6445 
  6446 #define NEG()                                   \
  6447   {                                             \
  6448     sfnt_f26dot6 n;                             \
  6449                                                 \
  6450     n = POP ();                                 \
  6451                                                 \
  6452     if (n == INT32_MIN)                         \
  6453       PUSH_UNCHECKED (0)                        \
  6454     else                                        \
  6455       PUSH_UNCHECKED (-n)                       \
  6456   }
  6457 
  6458 #define FLOOR()                                 \
  6459   {                                             \
  6460     sfnt_f26dot6 n;                             \
  6461                                                 \
  6462     n = POP ();                                 \
  6463     PUSH_UNCHECKED (sfnt_floor_f26dot6 (n));    \
  6464   }
  6465 
  6466 #define CEILING()                               \
  6467   {                                             \
  6468     sfnt_f26dot6 n;                             \
  6469                                                 \
  6470     n = POP ();                                 \
  6471     PUSH_UNCHECKED (sfnt_ceil_f26dot6 (n));     \
  6472   }
  6473 
  6474 #define WCVTF()                                 \
  6475   {                                             \
  6476     int32_t value;                              \
  6477     uint32_t location;                          \
  6478                                                 \
  6479     value = POP ();                             \
  6480     location = POP ();                          \
  6481                                                 \
  6482     if (location >= interpreter->cvt_size)      \
  6483       TRAP ("WCVTF out of bounds");             \
  6484                                                 \
  6485     interpreter->cvt[location]                  \
  6486       = (interpreter->scale * value             \
  6487          / 1024);                               \
  6488   }
  6489 
  6490 #define JROT()                                  \
  6491   {                                             \
  6492     uint32_t e;                                 \
  6493     int32_t offset;                             \
  6494                                                 \
  6495     e = POP ();                                 \
  6496     offset = POP ();                            \
  6497                                                 \
  6498     if (!e)                                     \
  6499       break;                                    \
  6500                                                 \
  6501     if (interpreter->IP + offset < 0            \
  6502         || (interpreter->IP + offset            \
  6503             > interpreter->num_instructions))   \
  6504       TRAP ("JMPR out of bounds");              \
  6505                                                 \
  6506     interpreter->IP += offset;                  \
  6507     goto skip_step;                             \
  6508   }
  6509 
  6510 #define JROF()                                  \
  6511   {                                             \
  6512     uint32_t e;                                 \
  6513     int32_t offset;                             \
  6514                                                 \
  6515     e = POP ();                                 \
  6516     offset = POP ();                            \
  6517                                                 \
  6518     if (e)                                      \
  6519       break;                                    \
  6520                                                 \
  6521     if (interpreter->IP + offset < 0            \
  6522         || (interpreter->IP + offset            \
  6523             > interpreter->num_instructions))   \
  6524       TRAP ("JMPR out of bounds");              \
  6525                                                 \
  6526     interpreter->IP += offset;                  \
  6527     goto skip_step;                             \
  6528   }
  6529 
  6530 #define ILLEGAL_INSTRUCTION()                   \
  6531   {                                             \
  6532     TRAP ("MS reserved illegal instruction");   \
  6533   }
  6534 
  6535 #define SCANCTRL()                              \
  6536   {                                             \
  6537     uint32_t value;                             \
  6538                                                 \
  6539     value = POP ();                             \
  6540     interpreter->state.scan_control = value;    \
  6541   }
  6542 
  6543 /* Selector bit 8 is undocumented, but present in the Macintosh
  6544    rasterizer.  02000 is returned if there is a variation axis in
  6545    use.  */
  6546 
  6547 #define GETINFO()                               \
  6548   {                                             \
  6549     uint32_t selector, k;                       \
  6550                                                 \
  6551     selector = POP ();                          \
  6552                                                 \
  6553     k = 0;                                      \
  6554                                                 \
  6555     if (selector & 1)                           \
  6556       k |= 02;                                  \
  6557                                                 \
  6558     if (selector & 8                            \
  6559         && interpreter->norm_coords)            \
  6560       k |= 02000;                               \
  6561                                                 \
  6562     PUSH_UNCHECKED (k);                         \
  6563   }
  6564 
  6565 #define IDEF()                                  \
  6566   {                                             \
  6567     if (why == SFNT_RUN_CONTEXT_GLYPH_PROGRAM)  \
  6568       TRAP ("IDEF inside glyph program");       \
  6569                                                 \
  6570     sfnt_interpret_idef (interpreter, POP ());  \
  6571     goto skip_step;                             \
  6572   }
  6573 
  6574 #define ROLL()                                  \
  6575   {                                             \
  6576     uint32_t a, b, c;                           \
  6577                                                 \
  6578     CHECK_STACK_ELEMENTS (3);                   \
  6579                                                 \
  6580     a = POP_UNCHECKED ();                       \
  6581     b = POP_UNCHECKED ();                       \
  6582     c = POP_UNCHECKED ();                       \
  6583                                                 \
  6584     PUSH_UNCHECKED (b);                         \
  6585     PUSH_UNCHECKED (a);                         \
  6586     PUSH_UNCHECKED (c);                         \
  6587   }
  6588 
  6589 #define _MAX()                                  \
  6590   {                                             \
  6591     int32_t e1, e2;                             \
  6592                                                 \
  6593     e1 = POP ();                                \
  6594     e2 = POP ();                                \
  6595                                                 \
  6596     PUSH_UNCHECKED (MAX (e1, e2));              \
  6597   }
  6598 
  6599 #define _MIN()                                  \
  6600   {                                             \
  6601     int32_t e1, e2;                             \
  6602                                                 \
  6603     e1 = POP ();                                \
  6604     e2 = POP ();                                \
  6605                                                 \
  6606     PUSH_UNCHECKED (MIN (e1, e2));              \
  6607   }
  6608 
  6609 #define SCANTYPE()                              \
  6610   {                                             \
  6611     POP ();                                     \
  6612   }
  6613 
  6614 #define INSTCTRL()                              \
  6615   {                                             \
  6616     uint32_t s, v;                              \
  6617                                                 \
  6618     CHECK_PREP ();                              \
  6619     s = POP ();                                 \
  6620     v = POP ();                                 \
  6621                                                 \
  6622     if (!s || s > 2)                            \
  6623       break;                                    \
  6624                                                 \
  6625     interpreter->state.instruct_control         \
  6626       &= ~(1 << s);                             \
  6627                                                 \
  6628     if (v)                                      \
  6629       interpreter->state.instruct_control       \
  6630         |= (1 << s);                            \
  6631   }
  6632 
  6633 /* GXAXIS is undocumented.  It seems to return each axis in shortFrac
  6634    format.  */
  6635 
  6636 #define GXAXIS()                                \
  6637   {                                             \
  6638     uint32_t v;                                 \
  6639     int i;                                      \
  6640                                                 \
  6641     for (i = 0; i < interpreter->n_axis; ++i)   \
  6642       {                                         \
  6643         if (interpreter->norm_coords)           \
  6644           v = interpreter->norm_coords[i] / 4;  \
  6645         else                                    \
  6646           v = 0;                                \
  6647                                                 \
  6648         PUSH (v);                               \
  6649       }                                         \
  6650   }
  6651 
  6652 #define PUSHB()                                 \
  6653   {                                             \
  6654     int b, nbytes, IP;                          \
  6655     unsigned char *ip;                          \
  6656                                                 \
  6657     IP = interpreter->IP;                       \
  6658     nbytes = opcode - 0xb0 + 1;                 \
  6659                                                 \
  6660     if (IP + nbytes + 1                         \
  6661         > interpreter->num_instructions)        \
  6662       TRAP ("args to PUSHB lie outside IS");    \
  6663                                                 \
  6664     CHECK_STACK_AVAILABLE (nbytes);             \
  6665     ip = interpreter->instructions;             \
  6666     for (b = IP + 1; b < IP + nbytes + 1; ++b)  \
  6667       PUSH_UNCHECKED (ip[b]);                   \
  6668                                                 \
  6669     interpreter->IP += nbytes;                  \
  6670   }
  6671 
  6672 #define PUSHW()                                 \
  6673   {                                             \
  6674     int b, nbytes, IP;                          \
  6675     unsigned char *ip;                          \
  6676                                                 \
  6677     IP = interpreter->IP;                       \
  6678     nbytes = (opcode - 0xb8 + 1) * 2;           \
  6679                                                 \
  6680     if (IP + 1 + nbytes                         \
  6681         > interpreter->num_instructions)        \
  6682       TRAP ("args to PUSHW lie outside IS");    \
  6683                                                 \
  6684     CHECK_STACK_AVAILABLE (nbytes / 2);         \
  6685     ip = interpreter->instructions;             \
  6686     for (b = IP + 1; b < IP + nbytes + 1;       \
  6687          b += 2)                                \
  6688       PUSH2_UNCHECKED (ip[b], ip[b + 1]);       \
  6689                                                 \
  6690     interpreter->IP += nbytes;                  \
  6691   }
  6692 
  6693 
  6694 
  6695 /* Rounding instructions.  */
  6696 
  6697 #define ROUND()                                 \
  6698   {                                             \
  6699     sfnt_f26dot6 n, result;                     \
  6700                                                 \
  6701     n = POP ();                                 \
  6702     result = abs (n);                           \
  6703                                                 \
  6704     result                                      \
  6705       = interpreter->state.round (result,       \
  6706                                   interpreter); \
  6707     PUSH_UNCHECKED (n < 0 ? -result : result);  \
  6708   }
  6709 
  6710 #define NROUND()                                \
  6711   {                                             \
  6712     sfnt_f26dot6 n;                             \
  6713                                                 \
  6714     n = POP ();                                 \
  6715     PUSH_UNCHECKED (n);                         \
  6716   }
  6717 
  6718 #define ROFF()                                  \
  6719   {                                             \
  6720     interpreter->state.round_state = 5;         \
  6721     sfnt_validate_gs (&interpreter->state);     \
  6722   }
  6723 
  6724 #define RUTG()                                  \
  6725   {                                             \
  6726     interpreter->state.round_state = 4;         \
  6727     sfnt_validate_gs (&interpreter->state);     \
  6728   }
  6729 
  6730 #define RDTG()                                  \
  6731   {                                             \
  6732     interpreter->state.round_state = 3;         \
  6733     sfnt_validate_gs (&interpreter->state);     \
  6734   }
  6735 
  6736 #define RTG()                                   \
  6737   {                                             \
  6738     interpreter->state.round_state = 1;         \
  6739     sfnt_validate_gs (&interpreter->state);     \
  6740   }
  6741 
  6742 #define RTHG()                                  \
  6743   {                                             \
  6744     interpreter->state.round_state = 0;         \
  6745     sfnt_validate_gs (&interpreter->state);     \
  6746   }
  6747 
  6748 #define RTDG()                                  \
  6749   {                                             \
  6750     interpreter->state.round_state = 2;         \
  6751     sfnt_validate_gs (&interpreter->state);     \
  6752   }
  6753 
  6754 #define SROUND()                                \
  6755   {                                             \
  6756     uint32_t operand;                           \
  6757                                                 \
  6758     operand = POP ();                           \
  6759     sfnt_set_srounding_state (interpreter,      \
  6760                               operand,          \
  6761                               0x4000);          \
  6762     interpreter->state.round_state = 6;         \
  6763     sfnt_validate_gs (&interpreter->state);     \
  6764   }
  6765 
  6766 #define S45ROUND()                              \
  6767   {                                             \
  6768     uint32_t operand;                           \
  6769                                                 \
  6770     operand = POP ();                           \
  6771     sfnt_set_srounding_state (interpreter,      \
  6772                               operand,          \
  6773                               0x5a82);          \
  6774     interpreter->state.round_state = 7;         \
  6775     sfnt_validate_gs (&interpreter->state);     \
  6776   }
  6777 
  6778 
  6779 
  6780 /* CVT and point delta exception instructions.
  6781 
  6782    ``Exceptions'' can be placed directly inside the control value
  6783    table, as it is reloaded every time the point size changes.  */
  6784 
  6785 #define DELTAC1()                               \
  6786   {                                             \
  6787     uint32_t operand1, operand2, n;             \
  6788                                                 \
  6789     n = POP ();                                 \
  6790                                                 \
  6791   deltac1_start:                                \
  6792     if (!n)                                     \
  6793       break;                                    \
  6794                                                 \
  6795     operand1 = POP ();                          \
  6796     operand2 = POP ();                          \
  6797     sfnt_deltac (1, interpreter, operand1,      \
  6798                  operand2);                     \
  6799     n--;                                        \
  6800     goto deltac1_start;                         \
  6801   }
  6802 
  6803 #define DELTAC2()                               \
  6804   {                                             \
  6805     uint32_t operand1, operand2, n;             \
  6806                                                 \
  6807     n = POP ();                                 \
  6808                                                 \
  6809   deltac2_start:                                \
  6810     if (!n)                                     \
  6811       break;                                    \
  6812                                                 \
  6813     operand1 = POP ();                          \
  6814     operand2 = POP ();                          \
  6815     sfnt_deltac (2, interpreter, operand1,      \
  6816                  operand2);                     \
  6817     n--;                                        \
  6818     goto deltac2_start;                         \
  6819   }
  6820 
  6821 #define DELTAC3()                               \
  6822   {                                             \
  6823     uint32_t operand1, operand2, n;             \
  6824                                                 \
  6825     n = POP ();                                 \
  6826                                                 \
  6827   deltac3_start:                                \
  6828     if (!n)                                     \
  6829       break;                                    \
  6830                                                 \
  6831     operand1 = POP ();                          \
  6832     operand2 = POP ();                          \
  6833     sfnt_deltac (3, interpreter, operand1,      \
  6834                  operand2);                     \
  6835     n--;                                        \
  6836     goto deltac3_start;                         \
  6837   }
  6838 
  6839 #define DELTAP1()                               \
  6840   {                                             \
  6841     uint32_t n, argn, pn;                       \
  6842                                                 \
  6843     n = POP ();                                 \
  6844                                                 \
  6845   deltap1_start:                                \
  6846     if (!n)                                     \
  6847       break;                                    \
  6848                                                 \
  6849     pn = POP ();                                \
  6850     argn = POP ();                              \
  6851     sfnt_deltap (1, interpreter, argn, pn);     \
  6852     n--;                                        \
  6853     goto deltap1_start;                         \
  6854   }
  6855 
  6856 #define DELTAP2()                               \
  6857   {                                             \
  6858     uint32_t n, argn, pn;                       \
  6859                                                 \
  6860     n = POP ();                                 \
  6861                                                 \
  6862   deltap2_start:                                \
  6863     if (!n)                                     \
  6864       break;                                    \
  6865                                                 \
  6866     pn = POP ();                                \
  6867     argn = POP ();                              \
  6868     sfnt_deltap (2, interpreter, argn, pn);     \
  6869     n--;                                        \
  6870     goto deltap2_start;                         \
  6871   }
  6872 
  6873 #define DELTAP3()                               \
  6874   {                                             \
  6875     uint32_t n, argn, pn;                       \
  6876                                                 \
  6877     n = POP ();                                 \
  6878                                                 \
  6879   deltap3_start:                                \
  6880     if (!n)                                     \
  6881       break;                                    \
  6882                                                 \
  6883     pn = POP ();                                \
  6884     argn = POP ();                              \
  6885     sfnt_deltap (3, interpreter, argn, pn);     \
  6886     n--;                                        \
  6887     goto deltap3_start;                         \
  6888   }
  6889 
  6890 
  6891 
  6892 /* Anachronistic angle instructions.  */
  6893 
  6894 #define AA()                                    \
  6895   {                                             \
  6896     POP ();                                     \
  6897   }
  6898 
  6899 #define SANGW()                                 \
  6900   {                                             \
  6901     POP ();                                     \
  6902   }
  6903 
  6904 
  6905 
  6906 /* Projection and freedom vector operations.  */
  6907 
  6908 #define PROJECT(x, y)                           \
  6909   sfnt_project_vector (interpreter, x, y)
  6910 
  6911 #define DUAL_PROJECT(x, y)                      \
  6912   sfnt_dual_project_vector (interpreter, x, y)
  6913 
  6914 #define SVTCAy()                                \
  6915   {                                             \
  6916     sfnt_set_freedom_vector (interpreter,       \
  6917                              0, 040000);        \
  6918     sfnt_set_projection_vector (interpreter,    \
  6919                                 0, 040000);     \
  6920   }
  6921 
  6922 #define SVTCAx()                                \
  6923   {                                             \
  6924     sfnt_set_freedom_vector (interpreter,       \
  6925                              040000, 0);        \
  6926     sfnt_set_projection_vector (interpreter,    \
  6927                                 040000, 0);     \
  6928   }
  6929 
  6930 #define SPvTCAy()                               \
  6931   {                                             \
  6932     sfnt_set_projection_vector (interpreter,    \
  6933                                 0, 040000);     \
  6934   }
  6935 
  6936 #define SPvTCAx()                               \
  6937   {                                             \
  6938     sfnt_set_projection_vector (interpreter,    \
  6939                                 040000, 0);     \
  6940   }
  6941 
  6942 #define SFvTCAy()                               \
  6943   {                                             \
  6944     sfnt_set_freedom_vector (interpreter,       \
  6945                              0, 040000);        \
  6946   }
  6947 
  6948 #define SFvTCAx()                               \
  6949   {                                             \
  6950     sfnt_set_freedom_vector (interpreter,       \
  6951                              040000, 0);        \
  6952   }
  6953 
  6954 #define SPVTL()                                 \
  6955   {                                             \
  6956     struct sfnt_unit_vector vector;             \
  6957     uint32_t p2, p1;                            \
  6958                                                 \
  6959     p2 = POP ();                                \
  6960     p1 = POP ();                                \
  6961                                                 \
  6962     sfnt_line_to_vector (interpreter,           \
  6963                          p2, p1, &vector,       \
  6964                          opcode == 0x07,        \
  6965                          false);                \
  6966                                                 \
  6967     sfnt_save_projection_vector (interpreter,   \
  6968                                  &vector,       \
  6969                                  false);        \
  6970   }
  6971 
  6972 #define SFVTL()                                 \
  6973   {                                             \
  6974     struct sfnt_unit_vector vector;             \
  6975     uint32_t p2, p1;                            \
  6976                                                 \
  6977     p2 = POP ();                                \
  6978     p1 = POP ();                                \
  6979                                                 \
  6980     sfnt_line_to_vector (interpreter,           \
  6981                          p2, p1, &vector,       \
  6982                          opcode == 0x09,        \
  6983                          false);                \
  6984                                                 \
  6985     sfnt_save_freedom_vector (interpreter,      \
  6986                               &vector);         \
  6987   }
  6988 
  6989 #define SPVFS()                                 \
  6990   {                                             \
  6991     uint32_t y, x;                              \
  6992                                                 \
  6993     y = POP ();                                 \
  6994     x = POP ();                                 \
  6995                                                 \
  6996     sfnt_set_projection_vector (interpreter, x, \
  6997                                 y);             \
  6998   }
  6999 
  7000 #define SFVFS()                                 \
  7001   {                                             \
  7002     uint16_t y, x;                              \
  7003                                                 \
  7004     y = POP ();                                 \
  7005     x = POP ();                                 \
  7006                                                 \
  7007     sfnt_set_freedom_vector (interpreter, x,    \
  7008                              y);                \
  7009   }
  7010 
  7011 #define GPV()                                   \
  7012   {                                             \
  7013     struct sfnt_unit_vector vector;             \
  7014                                                 \
  7015     vector                                      \
  7016       = interpreter->state.projection_vector;   \
  7017                                                 \
  7018     PUSH ((uint16_t) vector.x);                 \
  7019     PUSH ((uint16_t) vector.y);                 \
  7020   }
  7021 
  7022 #define GFV()                                   \
  7023   {                                             \
  7024     struct sfnt_unit_vector vector;             \
  7025                                                 \
  7026     vector                                      \
  7027       = interpreter->state.freedom_vector;      \
  7028                                                 \
  7029     PUSH ((uint16_t) vector.x);                 \
  7030     PUSH ((uint16_t) vector.y);                 \
  7031   }
  7032 
  7033 #define SFVTPV()                                \
  7034   {                                             \
  7035     interpreter->state.freedom_vector           \
  7036       = interpreter->state.projection_vector;   \
  7037                                                 \
  7038     sfnt_validate_gs (&interpreter->state);     \
  7039   }
  7040 
  7041 #define ISECT()                                 \
  7042   {                                             \
  7043     uint32_t a0, a1, b0, b1, p;                 \
  7044                                                 \
  7045     CHECK_STACK_ELEMENTS (5);                   \
  7046                                                 \
  7047     a0 = POP_UNCHECKED ();                      \
  7048     a1 = POP_UNCHECKED ();                      \
  7049     b0 = POP_UNCHECKED ();                      \
  7050     b1 = POP_UNCHECKED ();                      \
  7051     p = POP_UNCHECKED ();                       \
  7052                                                 \
  7053     sfnt_interpret_isect (interpreter,          \
  7054                           a0, a1, b0, b1, p);   \
  7055   }
  7056 
  7057 #define ALIGNPTS()                              \
  7058   {                                             \
  7059     uint32_t p1, p2;                            \
  7060                                                 \
  7061     p1 = POP ();                                \
  7062     p2 = POP ();                                \
  7063                                                 \
  7064     sfnt_interpret_alignpts (interpreter, p1,   \
  7065                              p2);               \
  7066   }
  7067 
  7068 #define UTP()                                   \
  7069   {                                             \
  7070     uint32_t p;                                 \
  7071                                                 \
  7072     p = POP ();                                 \
  7073     sfnt_interpret_utp (interpreter, p);        \
  7074   }
  7075 
  7076 #define MDAP()                                  \
  7077   {                                             \
  7078     uint32_t p;                                 \
  7079                                                 \
  7080     p = POP ();                                 \
  7081     sfnt_interpret_mdap (interpreter, p,        \
  7082                          opcode);               \
  7083   }
  7084 
  7085 #define IUP()                                   \
  7086   {                                             \
  7087     sfnt_interpret_iup (interpreter, opcode);   \
  7088   }
  7089 
  7090 #define SHP()                                   \
  7091   {                                             \
  7092     sfnt_interpret_shp (interpreter, opcode);   \
  7093   }
  7094 
  7095 #define SHC()                                   \
  7096   {                                             \
  7097     uint32_t contour;                           \
  7098                                                 \
  7099     contour = POP ();                           \
  7100                                                 \
  7101     sfnt_interpret_shc (interpreter, contour,   \
  7102                         opcode);                \
  7103   }
  7104 
  7105 #define SHZ()                                   \
  7106   {                                             \
  7107     uint32_t e;                                 \
  7108                                                 \
  7109     e = POP ();                                 \
  7110                                                 \
  7111     if (e > 1)                                  \
  7112       TRAP ("invalid zone!");                   \
  7113                                                 \
  7114     sfnt_interpret_shz (interpreter, e,         \
  7115                         opcode);                \
  7116   }
  7117 
  7118 #define SHPIX()                                 \
  7119   {                                             \
  7120     sfnt_f26dot6 pixels, dx, dy;                \
  7121     uint32_t p;                                 \
  7122                                                 \
  7123     pixels = POP ();                            \
  7124     sfnt_scale_by_freedom_vector (interpreter,  \
  7125                                   pixels, &dx,  \
  7126                                   &dy);         \
  7127                                                 \
  7128     while (interpreter->state.loop--)           \
  7129       {                                         \
  7130         p = POP ();                             \
  7131         sfnt_direct_move_zp2 (interpreter,      \
  7132                               p, dx, dy);       \
  7133       }                                         \
  7134                                                 \
  7135     interpreter->state.loop = 1;                \
  7136   }
  7137 
  7138 #define IP()                                    \
  7139   {                                             \
  7140     sfnt_interpret_ip (interpreter);            \
  7141   }
  7142 
  7143 #define MSIRP()                                 \
  7144   {                                             \
  7145     sfnt_f26dot6 d;                             \
  7146     uint32_t p;                                 \
  7147                                                 \
  7148     d = POP ();                                 \
  7149     p = POP ();                                 \
  7150                                                 \
  7151     sfnt_interpret_msirp (interpreter, d, p,    \
  7152                           opcode);              \
  7153   }
  7154 
  7155 #define ALIGNRP()                               \
  7156   {                                             \
  7157     sfnt_interpret_alignrp (interpreter);       \
  7158   }
  7159 
  7160 #define MIAP()                                  \
  7161   {                                             \
  7162     uint32_t cvt;                               \
  7163     uint32_t p;                                 \
  7164                                                 \
  7165     cvt = POP ();                               \
  7166     p = POP ();                                 \
  7167                                                 \
  7168     sfnt_interpret_miap (interpreter, cvt, p,   \
  7169                          opcode);               \
  7170   }
  7171 
  7172 #define GC()                                    \
  7173   {                                             \
  7174     uint32_t p;                                 \
  7175     sfnt_f26dot6 x, y, value;                   \
  7176     sfnt_f26dot6 org_x, org_y;                  \
  7177                                                 \
  7178     p = POP ();                                 \
  7179                                                 \
  7180     sfnt_address_zp2 (interpreter, p, &x, &y,   \
  7181                       &org_x, &org_y);          \
  7182                                                 \
  7183     if (opcode == 0x47)                         \
  7184       value = DUAL_PROJECT (org_x, org_y);      \
  7185     else                                        \
  7186       value = PROJECT (x, y);                   \
  7187                                                 \
  7188     PUSH_UNCHECKED (value);                     \
  7189   }
  7190 
  7191 #define SCFS()                                  \
  7192   {                                             \
  7193     uint32_t p;                                 \
  7194     sfnt_f26dot6 c;                             \
  7195                                                 \
  7196     c = POP ();                                 \
  7197     p = POP ();                                 \
  7198                                                 \
  7199     sfnt_interpret_scfs (interpreter, p, c);    \
  7200   }
  7201 
  7202 #define MD()                                    \
  7203   {                                             \
  7204     uint32_t p1, p2;                            \
  7205     sfnt_f26dot6 distance;                      \
  7206                                                 \
  7207     p2 = POP ();                                \
  7208     p1 = POP ();                                \
  7209                                                 \
  7210     distance                                    \
  7211       = sfnt_measure_distance (interpreter,     \
  7212                                p1, p2,          \
  7213                                opcode);         \
  7214     PUSH_UNCHECKED (distance);                  \
  7215   }
  7216 
  7217 #define FLIPPT()                                \
  7218   {                                             \
  7219     sfnt_interpret_flippt (interpreter);        \
  7220   }
  7221 
  7222 #define FLIPRGOFF()                             \
  7223   {                                             \
  7224     uint32_t h, l;                              \
  7225                                                 \
  7226     h = POP ();                                 \
  7227     l = POP ();                                 \
  7228                                                 \
  7229     sfnt_interpret_fliprgoff (interpreter,      \
  7230                               h, l);            \
  7231   }
  7232 
  7233 #define FLIPRGON()                              \
  7234   {                                             \
  7235     uint32_t h, l;                              \
  7236                                                 \
  7237     h = POP ();                                 \
  7238     l = POP ();                                 \
  7239                                                 \
  7240     sfnt_interpret_fliprgon (interpreter,       \
  7241                              h, l);             \
  7242   }
  7243 
  7244 #define SDPVTL()                                \
  7245   {                                             \
  7246     struct sfnt_unit_vector vector;             \
  7247     uint32_t p2, p1;                            \
  7248                                                 \
  7249     p2 = POP ();                                \
  7250     p1 = POP ();                                \
  7251                                                 \
  7252     sfnt_line_to_vector (interpreter,           \
  7253                          p2, p1, &vector,       \
  7254                          opcode == 0x87,        \
  7255                          false);                \
  7256                                                 \
  7257     sfnt_save_projection_vector (interpreter,   \
  7258                                  &vector,       \
  7259                                  false);        \
  7260                                                 \
  7261     sfnt_line_to_vector (interpreter,           \
  7262                          p2, p1, &vector,       \
  7263                          opcode == 0x87,        \
  7264                          true);                 \
  7265                                                 \
  7266     sfnt_save_projection_vector (interpreter,   \
  7267                                  &vector,       \
  7268                                  true);         \
  7269   }
  7270 
  7271 #define MIRP()                                  \
  7272   {                                             \
  7273     sfnt_interpret_mirp (interpreter, opcode);  \
  7274   }
  7275 
  7276 #define MDRP()                                  \
  7277   {                                             \
  7278     sfnt_interpret_mdrp (interpreter, opcode);  \
  7279   }
  7280 
  7281 
  7282 
  7283 #define NOT_IMPLEMENTED()                       \
  7284   sfnt_interpret_unimplemented (interpreter,    \
  7285                                 opcode, why)
  7286 
  7287 
  7288 
  7289 /* Multiply the specified MAGNITUDE by the contents of INTERPRETER's
  7290    freedom vector and return the result in *DX and *DY.  */
  7291 
  7292 static void
  7293 sfnt_scale_by_freedom_vector (struct sfnt_interpreter *interpreter,
  7294                               sfnt_f26dot6 magnitude, sfnt_f26dot6 *dx,
  7295                               sfnt_f26dot6 *dy)
  7296 {
  7297   struct sfnt_unit_vector *vector;
  7298 
  7299   vector = &interpreter->state.freedom_vector;
  7300   *dx = sfnt_mul_f2dot14 (vector->x, magnitude);
  7301   *dy = sfnt_mul_f2dot14 (vector->y, magnitude);
  7302 }
  7303 
  7304 /* Interpret a UTP instruction with the point P in INTERPRETER.
  7305    Unset any ``touched'' flag inside the point P, relative to the
  7306    zone in INTERPRETER's ZP0 register.
  7307 
  7308    Trap upon encountering an out of bounds point.  */
  7309 
  7310 static void
  7311 sfnt_interpret_utp (struct sfnt_interpreter *interpreter,
  7312                     uint32_t p)
  7313 {
  7314   if (!interpreter->state.zp0)
  7315     {
  7316       if (p >= interpreter->twilight_zone_size)
  7317         TRAP ("UTP[] p lies outside twilight zone");
  7318 
  7319       /* There are no flags in the twilight zone.  */
  7320       return;
  7321     }
  7322 
  7323   if (!interpreter->glyph_zone
  7324       || p >= interpreter->glyph_zone->num_points)
  7325     TRAP ("UTP[] p lies outside glyph zone");
  7326 
  7327   interpreter->glyph_zone->flags[p] &= ~SFNT_POINT_TOUCHED_X;
  7328 }
  7329 
  7330 /* Save the specified unit VECTOR into INTERPRETER's graphics state as
  7331    both the projection and the dual projection vectors.
  7332 
  7333    If not DUAL_ONLY, set VECTOR as both the projection and dual
  7334    projection vectors.  Otherwise, only set VECTOR as the dual
  7335    projection vector.  */
  7336 
  7337 static void
  7338 sfnt_save_projection_vector (struct sfnt_interpreter *interpreter,
  7339                              struct sfnt_unit_vector *vector,
  7340                              bool dual_only)
  7341 {
  7342   if (!dual_only)
  7343     interpreter->state.projection_vector = *vector;
  7344 
  7345   interpreter->state.dual_projection_vector = *vector;
  7346 
  7347   sfnt_validate_gs (&interpreter->state);
  7348 }
  7349 
  7350 /* Save the specified unit VECTOR into INTERPRETER's graphics
  7351    state.  */
  7352 
  7353 static void
  7354 sfnt_save_freedom_vector (struct sfnt_interpreter *interpreter,
  7355                           struct sfnt_unit_vector *vector)
  7356 {
  7357   interpreter->state.freedom_vector = *vector;
  7358 
  7359   sfnt_validate_gs (&interpreter->state);
  7360 }
  7361 
  7362 /* Return the values of the point NUMBER in the zone pointed to by
  7363    INTERPRETER's ZP2 register.
  7364 
  7365    If X_ORG and Y_ORG are set, return the original values (prior to
  7366    any instruction interpretations) in those two locations.
  7367 
  7368    Trap if NUMBER is out of bounds or the zone is inaccessible.  */
  7369 
  7370 static void
  7371 sfnt_address_zp2 (struct sfnt_interpreter *interpreter,
  7372                   uint32_t number,
  7373                   sfnt_f26dot6 *x, sfnt_f26dot6 *y,
  7374                   sfnt_f26dot6 *x_org, sfnt_f26dot6 *y_org)
  7375 {
  7376   if (!interpreter->state.zp2)
  7377     {
  7378       /* Address the twilight zone.  */
  7379       if (number >= interpreter->twilight_zone_size)
  7380         TRAP ("address to ZP2 (twilight zone) out of bounds");
  7381 
  7382       *x = interpreter->twilight_x[number];
  7383       *y = interpreter->twilight_y[number];
  7384 
  7385       if (!x_org || !y_org)
  7386         return;
  7387 
  7388       /* The twilight zone is initially all zero, but initial
  7389          positions can still be changed.  */
  7390       *x_org = interpreter->twilight_original_x[number];
  7391       *y_org = interpreter->twilight_original_y[number];
  7392       return;
  7393     }
  7394 
  7395   /* Address the glyph zone.  */
  7396   if (!interpreter->glyph_zone)
  7397     TRAP ("address to ZP2 (glyph zone) points into unset"
  7398           " zone");
  7399 
  7400   if (number >= interpreter->glyph_zone->num_points)
  7401     TRAP ("address to ZP2 (glyph zone) out of bounds");
  7402 
  7403   *x = interpreter->glyph_zone->x_current[number];
  7404   *y = interpreter->glyph_zone->y_current[number];
  7405 
  7406   if (x_org && y_org)
  7407     {
  7408       *x_org = interpreter->glyph_zone->x_points[number];
  7409       *y_org = interpreter->glyph_zone->y_points[number];
  7410     }
  7411 }
  7412 
  7413 /* Return the values of the point NUMBER in the zone pointed to by
  7414    INTERPRETER's ZP1 register.
  7415 
  7416    Trap if NUMBER is out of bounds or the zone is inaccessible.  */
  7417 
  7418 static void
  7419 sfnt_address_zp1 (struct sfnt_interpreter *interpreter,
  7420                   uint32_t number,
  7421                   sfnt_f26dot6 *x, sfnt_f26dot6 *y,
  7422                   sfnt_f26dot6 *x_org, sfnt_f26dot6 *y_org)
  7423 {
  7424   if (!interpreter->state.zp1)
  7425     {
  7426       /* Address the twilight zone.  */
  7427       if (number >= interpreter->twilight_zone_size)
  7428         TRAP ("address to ZP1 (twilight zone) out of bounds");
  7429 
  7430       *x = interpreter->twilight_x[number];
  7431       *y = interpreter->twilight_y[number];
  7432 
  7433       if (!x_org || !y_org)
  7434         return;
  7435 
  7436       /* The twilight zone is initially all zero, but initial
  7437          positions can still be changed.  */
  7438       *x_org = interpreter->twilight_original_x[number];
  7439       *y_org = interpreter->twilight_original_y[number];
  7440       return;
  7441     }
  7442 
  7443   /* Address the glyph zone.  */
  7444   if (!interpreter->glyph_zone)
  7445     TRAP ("address to ZP1 (glyph zone) points into unset"
  7446           " zone");
  7447 
  7448   if (number >= interpreter->glyph_zone->num_points)
  7449     TRAP ("address to ZP1 (glyph zone) out of bounds");
  7450 
  7451   *x = interpreter->glyph_zone->x_current[number];
  7452   *y = interpreter->glyph_zone->y_current[number];
  7453 
  7454   if (x_org && y_org)
  7455     {
  7456       *x_org = interpreter->glyph_zone->x_points[number];
  7457       *y_org = interpreter->glyph_zone->y_points[number];
  7458     }
  7459 }
  7460 
  7461 /* Return the values of the point NUMBER in the zone pointed to by
  7462    INTERPRETER's ZP0 register.
  7463 
  7464    Trap if NUMBER is out of bounds or the zone is inaccessible.  */
  7465 
  7466 static void
  7467 sfnt_address_zp0 (struct sfnt_interpreter *interpreter,
  7468                   uint32_t number,
  7469                   sfnt_f26dot6 *x, sfnt_f26dot6 *y,
  7470                   sfnt_f26dot6 *x_org, sfnt_f26dot6 *y_org)
  7471 {
  7472   if (!interpreter->state.zp0)
  7473     {
  7474       /* Address the twilight zone.  */
  7475       if (number >= interpreter->twilight_zone_size)
  7476         TRAP ("address to ZP0 (twilight zone) out of bounds");
  7477 
  7478       *x = interpreter->twilight_x[number];
  7479       *y = interpreter->twilight_y[number];
  7480 
  7481       if (!x_org || !y_org)
  7482         return;
  7483 
  7484       /* The twilight zone is initially all zero, but initial
  7485          positions can still be changed.  */
  7486       *x_org = interpreter->twilight_original_x[number];
  7487       *y_org = interpreter->twilight_original_y[number];
  7488       return;
  7489     }
  7490 
  7491   /* Address the glyph zone.  */
  7492   if (!interpreter->glyph_zone)
  7493     TRAP ("address to ZP0 (glyph zone) points into unset"
  7494           " zone");
  7495 
  7496   if (number >= interpreter->glyph_zone->num_points)
  7497     TRAP ("address to ZP0 (glyph zone) out of bounds");
  7498 
  7499   *x = interpreter->glyph_zone->x_current[number];
  7500   *y = interpreter->glyph_zone->y_current[number];
  7501 
  7502   if (x_org && y_org)
  7503     {
  7504       *x_org = interpreter->glyph_zone->x_points[number];
  7505       *y_org = interpreter->glyph_zone->y_points[number];
  7506     }
  7507 }
  7508 
  7509 /* Set the point NUMBER in the zone referenced by INTERPRETER's ZP2
  7510    register to the specified X and Y.
  7511 
  7512    Apply FLAGS to NUMBER's flags in that zone.  Trap if NUMBER is out
  7513    of bounds.  */
  7514 
  7515 static void
  7516 sfnt_store_zp2 (struct sfnt_interpreter *interpreter,
  7517                 uint32_t number, sfnt_f26dot6 x, sfnt_f26dot6 y,
  7518                 int flags)
  7519 {
  7520   if (!interpreter->state.zp2)
  7521     {
  7522       /* Address the twilight zone.  */
  7523       if (number >= interpreter->twilight_zone_size)
  7524         TRAP ("address to ZP2 (twilight zone) out of bounds");
  7525 
  7526       interpreter->twilight_x[number] = x;
  7527       interpreter->twilight_y[number] = y;
  7528       return;
  7529     }
  7530 
  7531   /* Address the glyph zone.  */
  7532   if (!interpreter->glyph_zone)
  7533     TRAP ("address to ZP0 (glyph zone) points into unset"
  7534           " zone");
  7535 
  7536   if (number >= interpreter->glyph_zone->num_points)
  7537     TRAP ("address to ZP0 (glyph zone) out of bounds");
  7538 
  7539   interpreter->glyph_zone->x_current[number] = x;
  7540   interpreter->glyph_zone->y_current[number] = y;
  7541   interpreter->glyph_zone->flags[number] |= flags;
  7542 }
  7543 
  7544 #if 0
  7545 
  7546 /* Convert the line between the points X1, Y1 and X2, Y2 to standard
  7547    form.
  7548 
  7549    Return the two coefficients in *A0 and *B0, and the constant in
  7550    *C.  */
  7551 
  7552 static void
  7553 sfnt_line_to_standard_form (sfnt_f26dot6 x1, sfnt_f26dot6 y1,
  7554                             sfnt_f26dot6 x2, sfnt_f26dot6 y2,
  7555                             sfnt_f26dot6 *a, sfnt_f26dot6 *b,
  7556                             sfnt_f26dot6 *c)
  7557 {
  7558   sfnt_f26dot6 a_temp, b_temp, c_temp;
  7559 
  7560   a_temp = sfnt_sub (y2, y1);
  7561   b_temp = sfnt_sub (x1, x2);
  7562   c_temp = sfnt_sub (sfnt_mul_f26dot6 (x1, y2),
  7563                      sfnt_mul_f26dot6 (x2, y1));
  7564 
  7565   *a = a_temp;
  7566   *b = b_temp;
  7567   *c = c_temp;
  7568 }
  7569 
  7570 #endif
  7571 
  7572 /* Check that the specified POINT lies within the zone addressed by
  7573    INTERPRETER's ZP2 register.  Trap if it does not.  */
  7574 
  7575 static void
  7576 sfnt_check_zp2 (struct sfnt_interpreter *interpreter, uint32_t point)
  7577 {
  7578   if (!interpreter->state.zp2)
  7579     {
  7580       if (point >= interpreter->twilight_zone_size)
  7581         TRAP ("point lies outside twilight zone (ZP2)");
  7582     }
  7583   else if (!interpreter->glyph_zone
  7584            || point >= interpreter->glyph_zone->num_points)
  7585     TRAP ("point lies outside glyph zone (ZP2)");
  7586 }
  7587 
  7588 /* Check that the specified POINT lies within the zone addressed by
  7589    INTERPRETER's ZP0 register.  Trap if it does not.  */
  7590 
  7591 static void
  7592 sfnt_check_zp0 (struct sfnt_interpreter *interpreter, uint32_t point)
  7593 {
  7594   if (!interpreter->state.zp0)
  7595     {
  7596       if (point >= interpreter->twilight_zone_size)
  7597         TRAP ("point lies outside twilight zone (ZP0)");
  7598     }
  7599   else if (!interpreter->glyph_zone
  7600            || point >= interpreter->glyph_zone->num_points)
  7601     TRAP ("point lies outside glyph zone (ZP0)");
  7602 }
  7603 
  7604 /* Check that the specified POINT lies within the zone addressed by
  7605    INTERPRETER's ZP1 register.  Trap if it does not.  */
  7606 
  7607 static void
  7608 sfnt_check_zp1 (struct sfnt_interpreter *interpreter, uint32_t point)
  7609 {
  7610   if (!interpreter->state.zp1)
  7611     {
  7612       if (point >= interpreter->twilight_zone_size)
  7613         TRAP ("point lies outside twilight zone (ZP0)");
  7614     }
  7615   else if (!interpreter->glyph_zone
  7616            || point >= interpreter->glyph_zone->num_points)
  7617     TRAP ("point lies outside glyph zone (ZP0)");
  7618 }
  7619 
  7620 /* Move N points starting from the specified POINT in the zone
  7621    addressed by INTERPRETER's ZP0 register by the given DISTANCE along
  7622    the freedom vector.
  7623 
  7624    No checking is done to ensure that POINT lies inside the zone, or
  7625    even that the zone exists at all.  */
  7626 
  7627 static void
  7628 sfnt_move_zp0 (struct sfnt_interpreter *interpreter, uint32_t point,
  7629                size_t n, sfnt_f26dot6 distance)
  7630 {
  7631   if (!interpreter->state.zp0)
  7632     interpreter->state.move (&interpreter->twilight_x[point],
  7633                              &interpreter->twilight_y[point],
  7634                              n, interpreter, distance, NULL);
  7635   else
  7636     interpreter->state.move (&interpreter->glyph_zone->x_current[point],
  7637                              &interpreter->glyph_zone->y_current[point],
  7638                              n, interpreter, distance,
  7639                              &interpreter->glyph_zone->flags[point]);
  7640 }
  7641 
  7642 /* Move N points starting from the specified POINT in the zone
  7643    addressed by INTERPRETER's ZP1 register by the given DISTANCE along
  7644    the freedom vector.
  7645 
  7646    No checking is done to ensure that POINT lies inside the zone, or
  7647    even that the zone exists at all.  */
  7648 
  7649 static void
  7650 sfnt_move_zp1 (struct sfnt_interpreter *interpreter, uint32_t point,
  7651                size_t n, sfnt_f26dot6 distance)
  7652 {
  7653   if (!interpreter->state.zp1)
  7654     interpreter->state.move (&interpreter->twilight_x[point],
  7655                              &interpreter->twilight_y[point],
  7656                              n, interpreter, distance, NULL);
  7657   else
  7658     interpreter->state.move (&interpreter->glyph_zone->x_current[point],
  7659                              &interpreter->glyph_zone->y_current[point],
  7660                              n, interpreter, distance,
  7661                              &interpreter->glyph_zone->flags[point]);
  7662 }
  7663 
  7664 /* Move N points starting from the specified POINT in the zone
  7665    addressed by INTERPRETER's ZP2 register by the given DISTANCE along
  7666    the freedom vector.
  7667 
  7668    No checking is done to ensure that POINT lies inside the zone, or
  7669    even that the zone exists at all.  */
  7670 
  7671 static void
  7672 sfnt_move_zp2 (struct sfnt_interpreter *interpreter, uint32_t point,
  7673                size_t n, sfnt_f26dot6 distance)
  7674 {
  7675   if (!interpreter->state.zp2)
  7676     interpreter->state.move (&interpreter->twilight_x[point],
  7677                              &interpreter->twilight_y[point],
  7678                              n, interpreter, distance, NULL);
  7679   else
  7680     interpreter->state.move (&interpreter->glyph_zone->x_current[point],
  7681                              &interpreter->glyph_zone->y_current[point],
  7682                              n, interpreter, distance,
  7683                              &interpreter->glyph_zone->flags[point]);
  7684 }
  7685 
  7686 /* Move N points from the specified POINT in INTERPRETER's glyph zone
  7687    by the given DISTANCE along the freedom vector.
  7688 
  7689    Do not touch the points that are moved.
  7690 
  7691    No checking is done to ensure that POINT lies inside the zone, or
  7692    even that the zone exists at all.  */
  7693 
  7694 static void
  7695 sfnt_move_glyph_zone (struct sfnt_interpreter *interpreter, uint32_t point,
  7696                       size_t n, sfnt_f26dot6 distance)
  7697 {
  7698   interpreter->state.move (&interpreter->glyph_zone->x_current[point],
  7699                            &interpreter->glyph_zone->y_current[point],
  7700                            n, interpreter, distance, NULL);
  7701 }
  7702 
  7703 /* Move N points from the specified POINT in INTERPRETER's twilight
  7704    zone by the given DISTANCE along the freedom vector.
  7705 
  7706    Do not touch the points that are moved.
  7707 
  7708    No checking is done to ensure that POINT lies inside the zone, or
  7709    even that the zone exists at all.  */
  7710 
  7711 static void
  7712 sfnt_move_twilight_zone (struct sfnt_interpreter *interpreter, uint32_t point,
  7713                          size_t n, sfnt_f26dot6 distance)
  7714 {
  7715   interpreter->state.move (&interpreter->twilight_x[point],
  7716                            &interpreter->twilight_y[point],
  7717                            n, interpreter, distance, NULL);
  7718 }
  7719 
  7720 /* Move the point P in the zone pointed to by the ZP2 register in
  7721    INTERPRETER's graphics state by DX, and DY.
  7722 
  7723    Touch the point P in the directions of the movement.
  7724 
  7725    Check that P is valid; if not, trap.  Else, perform the move
  7726    directly without converting it from the projection vector or to the
  7727    freedom vector.  */
  7728 
  7729 static void
  7730 sfnt_direct_move_zp2 (struct sfnt_interpreter *interpreter, uint32_t p,
  7731                       sfnt_f26dot6 dx, sfnt_f26dot6 dy)
  7732 {
  7733   if (!interpreter->state.zp2)
  7734     {
  7735       if (p >= interpreter->twilight_zone_size)
  7736         TRAP ("point out of bounds");
  7737 
  7738       interpreter->twilight_x[p]
  7739         = sfnt_add (interpreter->twilight_x[p], dx);
  7740       interpreter->twilight_y[p]
  7741         = sfnt_add (interpreter->twilight_y[p], dy);
  7742     }
  7743   else
  7744     {
  7745       if (!interpreter->glyph_zone
  7746           || p >= interpreter->glyph_zone->num_points)
  7747         TRAP ("point out of bounds");
  7748 
  7749       interpreter->glyph_zone->x_current[p]
  7750         = sfnt_add (interpreter->glyph_zone->x_current[p], dx);
  7751       interpreter->glyph_zone->y_current[p]
  7752         = sfnt_add (interpreter->glyph_zone->y_current[p], dy);
  7753 
  7754       if (dx)
  7755         interpreter->glyph_zone->flags[p] |= SFNT_POINT_TOUCHED_X;
  7756 
  7757       if (dy)
  7758         interpreter->glyph_zone->flags[p] |= SFNT_POINT_TOUCHED_Y;
  7759     }
  7760 }
  7761 
  7762 /* Project the vector VX, VY onto INTERPRETER's projection vector.
  7763    Return the magnitude of the projection.  */
  7764 
  7765 static sfnt_f26dot6
  7766 sfnt_project_vector (struct sfnt_interpreter *interpreter,
  7767                      sfnt_f26dot6 vx, sfnt_f26dot6 vy)
  7768 {
  7769   return interpreter->state.project (vx, vy, interpreter);
  7770 }
  7771 
  7772 /* Project the vector VX, VY onto INTERPRETER's dual projection
  7773    vector.  Return the magnitude of the projection.  */
  7774 
  7775 static sfnt_f26dot6
  7776 sfnt_dual_project_vector (struct sfnt_interpreter *interpreter,
  7777                           sfnt_f26dot6 vx, sfnt_f26dot6 vy)
  7778 {
  7779   return interpreter->state.dual_project (vx, vy, interpreter);
  7780 }
  7781 
  7782 /* Interpret a FLIPRGOFF instruction in INTERPRTER.  Make each point
  7783    in ZP0 between L and H an off-curve point.  */
  7784 
  7785 static void
  7786 sfnt_interpret_fliprgoff (struct sfnt_interpreter *interpreter,
  7787                           uint32_t l, uint32_t h)
  7788 {
  7789   uint32_t i;
  7790 
  7791   sfnt_check_zp0 (interpreter, l);
  7792   sfnt_check_zp0 (interpreter, h);
  7793 
  7794   if (!interpreter->state.zp0)
  7795     return;
  7796 
  7797   for (i = l; i < h; ++i)
  7798     interpreter->glyph_zone->flags[i] &= ~01;
  7799 }
  7800 
  7801 /* Interpret a FLIPRGON instruction in INTERPRTER.  Make each point in
  7802    ZP0 between L and H an on-curve point.  */
  7803 
  7804 static void
  7805 sfnt_interpret_fliprgon (struct sfnt_interpreter *interpreter,
  7806                          uint32_t l, uint32_t h)
  7807 {
  7808   uint32_t i;
  7809 
  7810   sfnt_check_zp0 (interpreter, l);
  7811   sfnt_check_zp0 (interpreter, h);
  7812 
  7813   if (!interpreter->state.zp0)
  7814     return;
  7815 
  7816   for (i = l; i < h; ++i)
  7817     interpreter->glyph_zone->flags[i] |= ~01;
  7818 }
  7819 
  7820 /* Interpret a FLIPPT instruction in INTERPRETER.  For loop times, pop
  7821    a point in ZP0.  If it is an on-curve point, make it an off-curve
  7822    one, and vice versa.  */
  7823 
  7824 static void
  7825 sfnt_interpret_flippt (struct sfnt_interpreter *interpreter)
  7826 {
  7827   uint32_t point;
  7828 
  7829   while (interpreter->state.loop--)
  7830     {
  7831       point = POP ();
  7832 
  7833       /* There are no flags in the twilight zone.
  7834          But first check that the point is within bounds.  */
  7835 
  7836       sfnt_check_zp0 (interpreter, point);
  7837 
  7838       if (!interpreter->state.zp0)
  7839         continue;
  7840 
  7841       /* If POINT is on the curve, make it off the curve and vice
  7842          versa.  */
  7843 
  7844       if (interpreter->glyph_zone->flags[point] & 01)
  7845         interpreter->glyph_zone->flags[point] &= ~01;
  7846       else
  7847         interpreter->glyph_zone->flags[point] |= 01;
  7848     }
  7849 
  7850   /* Restore loop.  */
  7851   interpreter->state.loop = 1;
  7852 }
  7853 
  7854 /* Interpret an SCFS instruction.
  7855    Move P in ZP2 along the freedom vector until its projection is
  7856    equal to C.
  7857 
  7858    If ZP2 is the twilight zone, ``create'' P by setting its original
  7859    position to the projection.  */
  7860 
  7861 static void
  7862 sfnt_interpret_scfs (struct sfnt_interpreter *interpreter,
  7863                      uint32_t p, sfnt_f26dot6 c)
  7864 {
  7865   sfnt_f26dot6 x, y, distance;
  7866 
  7867   sfnt_address_zp2 (interpreter, p, &x, &y, NULL, NULL);
  7868   distance = PROJECT (x, y);
  7869   sfnt_move_zp2 (interpreter, p, 1, sfnt_sub (c, distance));
  7870 
  7871   if (!interpreter->state.zp2)
  7872     {
  7873       interpreter->twilight_original_x[p] = interpreter->twilight_x[p];
  7874       interpreter->twilight_original_y[p] = interpreter->twilight_y[p];
  7875     }
  7876 }
  7877 
  7878 /* Symmetrically round the 26.6 fixed point value X using the rounding
  7879    mode in INTERPRETER.  Return the result.  */
  7880 
  7881 static sfnt_f26dot6
  7882 sfnt_round_symmetric (struct sfnt_interpreter *interpreter, sfnt_f26dot6 x)
  7883 {
  7884   int sign;
  7885 
  7886   sign = 1;
  7887 
  7888   if (x < 0)
  7889     {
  7890       sign = -1;
  7891       x = -x;
  7892     }
  7893 
  7894   return interpreter->state.round (x, interpreter) * sign;
  7895 }
  7896 
  7897 /* Interpret an MIAP (``Move Indirect Absolute Point'') instruction
  7898    using INTERPRETER.
  7899 
  7900    Move P in ZP0 along the freedom vector until its projection on the
  7901    projection vector is equal to CVT units in the projection vector.
  7902 
  7903    Finally, set RP0 and RP1 to P.
  7904 
  7905    If ZP0 is the twilight zone, then first create that point in the
  7906    twilight zone by setting its ``original position'' to the
  7907    projection of the value.
  7908 
  7909    If OPCODE is 0x3f, then in addition check the CVT value against the
  7910    control value cut-in, and round the magnitudes of the movement.  */
  7911 
  7912 static void
  7913 sfnt_interpret_miap (struct sfnt_interpreter *interpreter,
  7914                      uint32_t cvt, uint32_t p, unsigned char opcode)
  7915 {
  7916   sfnt_f26dot6 x, y, distance, value, delta;
  7917 
  7918   /* Read the cvt value.  */
  7919 
  7920   if (cvt >= interpreter->cvt_size)
  7921     TRAP ("out of bounds read to cvt");
  7922 
  7923   value = interpreter->cvt[cvt];
  7924 
  7925   /* Now load the point.  */
  7926   sfnt_address_zp0 (interpreter, p, &x, &y, NULL, NULL);
  7927 
  7928   /* Create the twilight zone point if necessary.
  7929      Note that the value used is not rounded.  */
  7930 
  7931   if (!interpreter->state.zp0)
  7932     {
  7933       x = interpreter->twilight_x[p]
  7934         = interpreter->twilight_original_x[p]
  7935         = sfnt_mul_f2dot14 (interpreter->state.projection_vector.x,
  7936                             value);
  7937 
  7938       y = interpreter->twilight_y[p]
  7939         = interpreter->twilight_original_y[p]
  7940         = sfnt_mul_f2dot14 (interpreter->state.projection_vector.y,
  7941                             value);
  7942     }
  7943 
  7944   /* Obtain the original distance.  */
  7945   distance = sfnt_project_vector (interpreter, x, y);
  7946 
  7947   /* Round the distance and apply the cvt cut in if necessary.  */
  7948 
  7949   if (opcode == 0x3f)
  7950     {
  7951       delta = sfnt_sub (value, distance);
  7952 
  7953       if (delta < 0)
  7954         delta = -delta;
  7955 
  7956       /* If delta is more than the cvt cut in (more aptly named ``cut
  7957          out''), use the original distance.  */
  7958 
  7959       if (delta > interpreter->state.cvt_cut_in)
  7960         value = distance;
  7961 
  7962       /* Round value.  */
  7963       value = sfnt_round_symmetric (interpreter, value);
  7964     }
  7965 
  7966   /* Move the point by the distance.  */
  7967   sfnt_move_zp0 (interpreter, p, 1, sfnt_sub (value, distance));
  7968 
  7969   /* Set reference points.  */
  7970   interpreter->state.rp0 = p;
  7971   interpreter->state.rp1 = p;
  7972 }
  7973 
  7974 /* Perform a single iteration of sfnt_interpret_alignrp.  RP0X and
  7975    RP0Y should be the position of the reference point RP0 in ZP0.  */
  7976 
  7977 static void
  7978 sfnt_interpret_alignrp_1 (struct sfnt_interpreter *interpreter,
  7979                           sfnt_f26dot6 rp0x, sfnt_f26dot6 rp0y)
  7980 {
  7981   sfnt_f26dot6 distance, x, y;
  7982   uint32_t point;
  7983 
  7984   point = POP ();
  7985 
  7986   /* Load this point.  */
  7987   sfnt_address_zp1 (interpreter, point, &x, &y, NULL, NULL);
  7988 
  7989   /* Measure the distance from here to rp0.  */
  7990   distance = sfnt_project_vector (interpreter, sfnt_sub (x, rp0x),
  7991                                   sfnt_sub (y, rp0y));
  7992 
  7993   /* Move by the opposite.  */
  7994   sfnt_move_zp1 (interpreter, point, 1, -distance);
  7995 }
  7996 
  7997 /* For loop times, pop a point in ZP1 and align it to RP0 in ZP0 by
  7998    moving it along the freedom vector until its projected distance
  7999    from RP0 becomes 0.  */
  8000 
  8001 static void
  8002 sfnt_interpret_alignrp (struct sfnt_interpreter *interpreter)
  8003 {
  8004   sfnt_f26dot6 rp0x, rp0y;
  8005 
  8006   sfnt_address_zp0 (interpreter, interpreter->state.rp0,
  8007                     &rp0x, &rp0y, NULL, NULL);
  8008 
  8009   while (interpreter->state.loop--)
  8010     {
  8011       sfnt_interpret_alignrp_1 (interpreter, rp0x, rp0y);
  8012 
  8013       /* Reload RP0 if it is in the same zone as ZP1.  */
  8014       if (interpreter->state.zp0 == interpreter->state.zp1)
  8015         sfnt_address_zp0 (interpreter, interpreter->state.rp0,
  8016                           &rp0x, &rp0y, NULL, NULL);
  8017     }
  8018 
  8019   interpreter->state.loop = 1;
  8020 }
  8021 
  8022 /* Align the two points P1 and P2 relative to the projection vector.
  8023    P1 is addressed relative to ZP0, and P2 is addressed relative to
  8024    ZP1.
  8025 
  8026    Move both points along the freedom vector by half the magnitude of
  8027    the the projection of a vector formed by P1.x - P2.x, P1.y - P2.y,
  8028    upon the projection vector.  */
  8029 
  8030 static void
  8031 sfnt_interpret_alignpts (struct sfnt_interpreter *interpreter,
  8032                          uint32_t p1, uint32_t p2)
  8033 {
  8034   sfnt_f26dot6 p1x, p1y, p2x, p2y;
  8035   sfnt_f26dot6 magnitude;
  8036 
  8037   sfnt_address_zp0 (interpreter, p1, &p1x, &p1y, NULL, NULL);
  8038   sfnt_address_zp1 (interpreter, p2, &p2x, &p2y, NULL, NULL);
  8039 
  8040   magnitude = sfnt_project_vector (interpreter,
  8041                                    sfnt_sub (p1x, p2x),
  8042                                    sfnt_sub (p1y, p2y));
  8043   magnitude = magnitude / 2;
  8044 
  8045   /* Now move both points along the freedom vector.  */
  8046   sfnt_move_zp0 (interpreter, p1, 1, magnitude);
  8047   sfnt_move_zp1 (interpreter, p2, 1, -magnitude);
  8048 }
  8049 
  8050 /* Set the point P in the zone referenced in INTERPRETER's ZP2
  8051    register to the intersection between the line formed by the points
  8052    POINT_A0 to POINT_A1 in ZP0 and another line formed by POINT_B0 to
  8053    POINT_B1 in ZP1.
  8054 
  8055    Touch the point P.  */
  8056 
  8057 static void
  8058 sfnt_interpret_isect (struct sfnt_interpreter *interpreter,
  8059                       uint32_t point_a0, uint32_t point_a1,
  8060                       uint32_t point_b0, uint32_t point_b1,
  8061                       uint32_t p)
  8062 {
  8063   sfnt_f26dot6 a0x, a0y, a1x, a1y;
  8064   sfnt_f26dot6 b0x, b0y, b1x, b1y;
  8065 #if 0
  8066   sfnt_f26dot6 determinant, dx, dy;
  8067   sfnt_f26dot6 a0, b0, a1, b1;
  8068   sfnt_f26dot6 c0, c1, px, py;
  8069 #else
  8070   sfnt_f26dot6 dx, dy, dax, day, dbx, dby;
  8071   sfnt_f26dot6 discriminant, val, dot_product;
  8072   sfnt_f26dot6 px, py;
  8073 #endif
  8074 
  8075   /* Load points.  */
  8076   sfnt_address_zp0 (interpreter, point_a0, &a0x, &a0y, NULL, NULL);
  8077   sfnt_address_zp0 (interpreter, point_a1, &a1x, &a1y, NULL, NULL);
  8078   sfnt_address_zp1 (interpreter, point_b0, &b0x, &b0y, NULL, NULL);
  8079   sfnt_address_zp1 (interpreter, point_b1, &b1x, &b1y, NULL, NULL);
  8080 
  8081 #if 0
  8082   /* The system is determined from the standard form (look this up) of
  8083      both lines.
  8084 
  8085      (the variables below have no relation to C identifiers
  8086       unless otherwise specified.)
  8087 
  8088        a0*x + b0*y = c0
  8089        a1*x + b1*y = c1
  8090 
  8091      The coefficient matrix is thus
  8092 
  8093        [ a0 b0
  8094          a1 b1 ]
  8095 
  8096      the vector of constants (also just dubbed the ``column vector''
  8097      by some people)
  8098 
  8099        [ c0
  8100          c1 ]
  8101 
  8102      and the solution vector becomes
  8103 
  8104        [ x
  8105          y ]
  8106 
  8107      Since there are exactly two equations and two unknowns, Cramer's
  8108      rule applies, and there is no need for any Gaussian elimination.
  8109 
  8110      The determinant for the coefficient matrix is:
  8111 
  8112        D = a0*b1 - b0*a1
  8113 
  8114      the first and second determinants are:
  8115 
  8116        Dx = c0*b1 - a0*c1
  8117        Dy = a1*c1 - c0*b1
  8118 
  8119      and x = Dx / D, y = Dy / D.
  8120 
  8121      If the system is indeterminate, D will be 0.  */
  8122 
  8123   sfnt_line_to_standard_form (a0x, a0y, a1x, a1y,
  8124                               &a0, &b0, &c0);
  8125   sfnt_line_to_standard_form (b0x, b0y, b1x, b1y,
  8126                               &a1, &b1, &c1);
  8127 
  8128 
  8129   /* Compute determinants.  */
  8130   determinant = sfnt_sub (sfnt_mul_fixed (a0, b1),
  8131                           sfnt_mul_fixed (b0, a1));
  8132   dx = sfnt_sub (sfnt_mul_fixed (c0, b1),
  8133                  sfnt_mul_fixed (a1, c1));
  8134   dy = sfnt_sub (sfnt_mul_fixed (a0, c1),
  8135                  sfnt_mul_fixed (c0, b0));
  8136 
  8137   /* Detect degenerate cases.  */
  8138 
  8139   if (determinant == 0)
  8140     goto degenerate_case;
  8141 #else
  8142   /* The algorithm above would work with floating point, but overflows
  8143      too easily with fixed point numbers.
  8144 
  8145      Instead, use the modified vector projection algorithm found in
  8146      FreeType.  */
  8147 
  8148   dbx = sfnt_sub (b1x, b0x);
  8149   dby = sfnt_sub (b1y, b0y);
  8150   dax = sfnt_sub (a1x, a0x);
  8151   day = sfnt_sub (a1y, a0y);
  8152 
  8153   /* Compute vector cross product.  */
  8154   discriminant = sfnt_add (sfnt_mul_f26dot6 (dax, -dby),
  8155                            sfnt_mul_f26dot6 (day, dbx));
  8156   dot_product = sfnt_add (sfnt_mul_f26dot6 (dax, dbx),
  8157                           sfnt_mul_f26dot6 (day, dby));
  8158 
  8159   /* Reject any non-intersections and grazing intersections.  */
  8160   if (!(sfnt_mul (19, abs (discriminant)) > abs (dot_product)))
  8161     return;
  8162 
  8163   /* Reject any non-intersections.  */
  8164   if (!discriminant)
  8165     goto degenerate_case;
  8166 
  8167   dx = sfnt_sub (b0x, a0x);
  8168   dy = sfnt_sub (b0y, a0y);
  8169   val = sfnt_add (sfnt_mul_f26dot6 (dx, -dby),
  8170                   sfnt_mul_f26dot6 (dy, dbx));
  8171 
  8172   /* Project according to these values.  */
  8173   dx = sfnt_add (a0x, sfnt_multiply_divide_signed (val, dax,
  8174                                                    discriminant));
  8175   dy = sfnt_add (a0y, sfnt_multiply_divide_signed (val, day,
  8176                                                    discriminant));
  8177 #endif
  8178 
  8179   sfnt_store_zp2 (interpreter, p,
  8180 #if 0
  8181                   sfnt_div_fixed (dx, determinant),
  8182                   sfnt_div_fixed (dy, determinant),
  8183 #else
  8184                   dx, dy,
  8185 #endif
  8186                   SFNT_POINT_TOUCHED_BOTH);
  8187   return;
  8188 
  8189  degenerate_case:
  8190 
  8191   /* Apple says that in this case:
  8192 
  8193      Px = (a0x + a1x) / 2 + (b0x + b1x) / 2
  8194           ---------------------------------
  8195                           2
  8196      Py = (a0y + a1y) / 2 + (b0y + b1y) / 2
  8197           ---------------------------------
  8198                           2  */
  8199 
  8200   px = (sfnt_add (a0x, a1x) / 2 + sfnt_add (b0x, b1x) / 2) / 2;
  8201   py = (sfnt_add (a0y, a1y) / 2 + sfnt_add (b0y, b1y) / 2) / 2;
  8202   sfnt_store_zp2 (interpreter, p, px, py,
  8203                   SFNT_POINT_TOUCHED_BOTH);
  8204 }
  8205 
  8206 /* Compute the square root of the 16.16 fixed point number N.  */
  8207 
  8208 static sfnt_fixed
  8209 sfnt_sqrt_fixed (sfnt_fixed n)
  8210 {
  8211   int count;
  8212   unsigned int root, rem_hi, rem_lo, possible;
  8213 
  8214   root = 0;
  8215 
  8216   if (n > 0)
  8217     {
  8218       rem_hi = 0;
  8219       rem_lo = n;
  8220       count = 24;
  8221 
  8222       do
  8223         {
  8224           rem_hi = (rem_hi << 2) | (rem_lo >> 30);
  8225           rem_lo <<= 2;
  8226           root <<= 1;
  8227           possible = (root << 1) + 1;
  8228 
  8229           if (rem_hi >= possible)
  8230             {
  8231               rem_hi -= possible;
  8232               root += 1;
  8233             }
  8234         }
  8235       while (--count);
  8236     }
  8237 
  8238   return root;
  8239 }
  8240 
  8241 /* Compute a unit vector describing a vector VX, VY.  Return the value
  8242    in *VECTOR.  */
  8243 
  8244 static void
  8245 sfnt_normalize_vector (sfnt_f26dot6 vx, sfnt_f26dot6 vy,
  8246                        struct sfnt_unit_vector *vector)
  8247 {
  8248   sfnt_f26dot6 x_squared, y_squared;
  8249   sfnt_fixed n, magnitude;
  8250 
  8251   if (!vx && !vy)
  8252     {
  8253       /* If vx and vy are both zero, then just project
  8254          horizontally.  */
  8255 
  8256     fail:
  8257       vector->x = 04000;
  8258       vector->y = 0;
  8259       return;
  8260     }
  8261 
  8262   /* Scale vx and vy up if they won't at least make 1.  */
  8263 
  8264   while (!(vx < -32 || vx > 32) && !(vy < -32 || vy > 32))
  8265     {
  8266       vx = vx * 2;
  8267       vy = vy * 2;
  8268     }
  8269 
  8270   /* Compute the magnitude of this vector.  */
  8271   x_squared = sfnt_mul_f26dot6 (vx, vx);
  8272   y_squared = sfnt_mul_f26dot6 (vy, vy);
  8273 
  8274   /* x_squared and y_squared can end up too large to fit in a 16.16
  8275      fixed.  Scale both values down until they fit.  */
  8276 
  8277   while (x_squared > 0x200000 || y_squared > 0x200000
  8278          || x_squared < -0x200000 || y_squared < -0x200000)
  8279     {
  8280       x_squared /= 2;
  8281       y_squared /= 2;
  8282     }
  8283 
  8284   /* Convert to 16.16 for greater precision.  */
  8285   n = sfnt_add (x_squared, y_squared) * 1024;
  8286 
  8287   /* Get hypotenuse of the triangle from vx, 0, to 0, vy.  */
  8288   magnitude = sfnt_sqrt_fixed (n);
  8289 
  8290   /* Avoid division by zero.  */
  8291   if (!magnitude)
  8292     goto fail;
  8293 
  8294   /* Long division.. eek! */
  8295   vector->x = (sfnt_div_fixed (vx * 1024, magnitude) / 4);
  8296   vector->y = (sfnt_div_fixed (vy * 1024, magnitude) / 4);
  8297 }
  8298 
  8299 /* Compute a unit vector describing the direction of a line from the
  8300    point P2 to the point P1.  Save the result in *VECTOR.
  8301 
  8302    P2 is the address of a point in the zone specified in the ZP2
  8303    register.  P1 is the address of a point in the zone specified in
  8304    the ZP1 register.  Take the values of both registers from the
  8305    specified INTERPRETER's graphics state.
  8306 
  8307    If PERPENDICULAR, then *VECTOR will be rotated 90 degrees
  8308    counter-clockwise.  Else, *VECTOR will be parallel to the line.
  8309 
  8310    If ORIGINAL, then the coordinates used to calculate the line will
  8311    be those prior to instructing.  Otherwise, the current coordinates
  8312    will be used.  */
  8313 
  8314 static void
  8315 sfnt_line_to_vector (struct sfnt_interpreter *interpreter,
  8316                      uint32_t p2, uint32_t p1,
  8317                      struct sfnt_unit_vector *vector,
  8318                      bool perpendicular, bool original)
  8319 {
  8320   sfnt_f26dot6 x2, y2, original_x2, original_y2;
  8321   sfnt_f26dot6 x1, y1, original_x1, original_y1;
  8322   sfnt_f26dot6 a, b, temp;
  8323 
  8324   sfnt_address_zp2 (interpreter, p2, &x2, &y2, &original_x2,
  8325                     &original_y2);
  8326   sfnt_address_zp1 (interpreter, p1, &x1, &y1, &original_x1,
  8327                     &original_y1);
  8328 
  8329   /* Use original coordinates if specified.  */
  8330 
  8331   if (original)
  8332     {
  8333       x2 = original_x2;
  8334       y2 = original_y2;
  8335       x1 = original_x1;
  8336       y1 = original_y1;
  8337     }
  8338 
  8339   /* Calculate the vector between X2, Y2, and X1, Y1.  */
  8340   a = sfnt_sub (x1, x2);
  8341   b = sfnt_sub (y1, y2);
  8342 
  8343   /* Rotate counterclockwise if necessary.  */
  8344 
  8345   if (perpendicular)
  8346     {
  8347       temp = b;
  8348       b = a;
  8349       a = -temp;
  8350     }
  8351 
  8352   /* Normalize this vector, turning it into a unit vector.  */
  8353   sfnt_normalize_vector (a, b, vector);
  8354 }
  8355 
  8356 /* Measure the distance between P1 in ZP0 and P2 in ZP1,
  8357    relative to the projection or dual projection vector.
  8358 
  8359    Return the distance of P1 and P2 relative to their original
  8360    un-instructed positions should OPCODE be 0x4A, and to their
  8361    instructed positions should OPCODE be 0x49.  */
  8362 
  8363 static sfnt_f26dot6
  8364 sfnt_measure_distance (struct sfnt_interpreter *interpreter,
  8365                        uint32_t p1, uint32_t p2,
  8366                        unsigned char opcode)
  8367 {
  8368   sfnt_f26dot6 p1x, p1y, p1_original_x, p1_original_y;
  8369   sfnt_f26dot6 p2x, p2y, p2_original_x, p2_original_y;
  8370 
  8371   /* P1 is relative to ZP0 and P2 is relative to ZP1.
  8372      Apple's manual says this, Microsoft's does not.  */
  8373 
  8374   sfnt_address_zp0 (interpreter, p1, &p1x, &p1y,
  8375                     &p1_original_x, &p1_original_y);
  8376   sfnt_address_zp1 (interpreter, p2, &p2x, &p2y,
  8377                     &p2_original_x, &p2_original_y);
  8378 
  8379   if (opcode == 0x4A)
  8380     return DUAL_PROJECT (sfnt_sub (p1_original_x, p2_original_x),
  8381                          sfnt_sub (p1_original_y, p2_original_y));
  8382 
  8383   return PROJECT (sfnt_sub (p1x, p2x),
  8384                   sfnt_sub (p1y, p2y));
  8385 }
  8386 
  8387 /* Interpret an MSIRP instruction in INTERPRETER.
  8388    Take a point P, and make the distance between P in ZP1 and the
  8389    current position of RP0 in ZP0 equal to D.
  8390 
  8391    If ZP1 is the twilight zone, then create the point P by setting its
  8392    position and relative positions.
  8393 
  8394    Then, if OPCODE is equal to 0x3b, make P RP0.  */
  8395 
  8396 static void
  8397 sfnt_interpret_msirp (struct sfnt_interpreter *interpreter,
  8398                       sfnt_f26dot6 d, uint32_t p, unsigned char opcode)
  8399 {
  8400   sfnt_f26dot6 rp0x, rp0y, rp0_original_x, rp0_original_y;
  8401   sfnt_f26dot6 x, y;
  8402   sfnt_f26dot6 old_distance, temp;
  8403 
  8404   sfnt_address_zp0 (interpreter, interpreter->state.rp0,
  8405                     &rp0x, &rp0y, &rp0_original_x,
  8406                     &rp0_original_y);
  8407   sfnt_address_zp1 (interpreter, p, &x, &y, NULL, NULL);
  8408 
  8409   if (!interpreter->state.zp1)
  8410     {
  8411       /* Create this point in the twilight zone at RP0.  */
  8412 
  8413       x = interpreter->twilight_x[p] = rp0x;
  8414       y = interpreter->twilight_y[p] = rp0y;
  8415 
  8416       /* Now set the original positions to the projected difference
  8417          from rp0.  This makes sense once you think about it.  */
  8418       temp = sfnt_mul_f2dot14 (interpreter->state.projection_vector.x, d);
  8419       temp = sfnt_add (temp, rp0_original_x);
  8420       interpreter->twilight_original_x[p] = temp;
  8421 
  8422       temp = sfnt_mul_f2dot14 (interpreter->state.projection_vector.y, d);
  8423       temp = sfnt_add (temp, rp0_original_y);
  8424       interpreter->twilight_original_y[p] = temp;
  8425     }
  8426 
  8427   /* Compute the original distance.  */
  8428   old_distance = sfnt_project_vector (interpreter,
  8429                                       sfnt_sub (x, rp0x),
  8430                                       sfnt_sub (y, rp0y));
  8431 
  8432   /* Move the point.  */
  8433   sfnt_move_zp1 (interpreter, p, 1, sfnt_sub (d, old_distance));
  8434 
  8435   /* Nothing in the TrueType reference manual says directly that this
  8436      instruction should change rp1 and rp2.  However, it says this
  8437      instruction is ``very similar to the MIRP[] instruction
  8438      except...'', and FreeType seems to do this, so do it as well.  */
  8439 
  8440   interpreter->state.rp1 = interpreter->state.rp0;
  8441   interpreter->state.rp2 = p;
  8442 
  8443   if (opcode == 0x3b)
  8444     interpreter->state.rp0 = p;
  8445 }
  8446 
  8447 /* Interpret an IP instruction in INTERPRETER.  For loop times, pop a
  8448    single point in ZP2, and interpolate it so that its original
  8449    relationship to the points RP1 in ZP0 and RP2 in ZP1 as measured
  8450    along the dual projection vector continues to hold true.  */
  8451 
  8452 static void
  8453 sfnt_interpret_ip (struct sfnt_interpreter *interpreter)
  8454 {
  8455   sfnt_f26dot6 rp1x, rp1y, rp1_original_x, rp1_original_y;
  8456   sfnt_f26dot6 rp2x, rp2y, rp2_original_x, rp2_original_y;
  8457   sfnt_f26dot6 range, new_range, org_distance, cur_distance;
  8458   sfnt_f26dot6 new_distance;
  8459   uint32_t p;
  8460   sfnt_f26dot6 x, y, original_x, original_y;
  8461 
  8462   /* First load both reference points.  */
  8463   sfnt_address_zp0 (interpreter, interpreter->state.rp1,
  8464                     &rp1x, &rp1y, &rp1_original_x,
  8465                     &rp1_original_y);
  8466   sfnt_address_zp1 (interpreter, interpreter->state.rp2,
  8467                     &rp2x, &rp2y, &rp2_original_x,
  8468                     &rp2_original_y);
  8469 
  8470   /* Get the original distance between of RP1 and RP2 measured
  8471      relative to the dual projection vector.  */
  8472   range = sfnt_dual_project_vector (interpreter,
  8473                                     sfnt_sub (rp2_original_x,
  8474                                               rp1_original_x),
  8475                                     sfnt_sub (rp2_original_y,
  8476                                               rp1_original_y));
  8477 
  8478   /* Get the new distance.  */
  8479   new_range = sfnt_dual_project_vector (interpreter,
  8480                                         sfnt_sub (rp2x, rp1x),
  8481                                         sfnt_sub (rp2y, rp1y));
  8482 
  8483   while (interpreter->state.loop--)
  8484     {
  8485       p = POP ();
  8486 
  8487       /* Load this point relative to zp2.  */
  8488       sfnt_address_zp2 (interpreter, p, &x, &y, &original_x,
  8489                         &original_y);
  8490 
  8491       /* Now compute the old distance from this point to rp1.  */
  8492       org_distance
  8493         = sfnt_dual_project_vector (interpreter,
  8494                                     sfnt_sub (original_x,
  8495                                               rp1_original_x),
  8496                                     sfnt_sub (original_y,
  8497                                               rp1_original_y));
  8498 
  8499       /* And the current distance from this point to rp1, so
  8500          how much to move can be determined.  */
  8501       cur_distance
  8502         = sfnt_project_vector (interpreter,
  8503                                sfnt_sub (x, rp1x),
  8504                                sfnt_sub (y, rp1y));
  8505 
  8506       /* Finally, apply the ratio of the new distance between RP1 and
  8507          RP2 to that of the old distance between the two reference
  8508          points to org_distance, making new_distance.
  8509 
  8510          If both reference points occupy the same position on the dual
  8511          projection vector, then simply use the old distance.  */
  8512 
  8513       if (org_distance)
  8514         {
  8515           if (range)
  8516             new_distance
  8517               = sfnt_multiply_divide_signed (org_distance,
  8518                                              new_range, range);
  8519           else
  8520             new_distance = org_distance;
  8521         }
  8522       else
  8523         new_distance = 0;
  8524 
  8525       /* And move the point along the freedom vector to reflect the
  8526          change in distance.  */
  8527       sfnt_move_zp2 (interpreter, p, 1,
  8528                      sfnt_sub (new_distance, cur_distance));
  8529     }
  8530 
  8531   interpreter->state.loop = 1;
  8532 }
  8533 
  8534 /* Apply the delta specified by OPERAND to the control value table
  8535    entry at INDEX currently loaded inside INTERPRETER.
  8536 
  8537    Trap if INDEX is out of bounds.
  8538 
  8539    NUMBER is the number of the specific DELTAC instruction this delta
  8540    is being applied on behalf of.  It must be between 1 and 3.  */
  8541 
  8542 static void
  8543 sfnt_deltac (int number, struct sfnt_interpreter *interpreter,
  8544              unsigned int index, unsigned char operand)
  8545 {
  8546   int ppem, delta;
  8547 
  8548   /* Make sure INDEX is a valid cvt entry.  */
  8549 
  8550   if (index >= interpreter->cvt_size)
  8551     TRAP ("DELTACn instruction out of bounds");
  8552 
  8553   /* operand is an 8 bit number.  The most significant 4 bits
  8554      represent a specific PPEM size at which to apply the delta
  8555      specified in the low 4 bits, summed with an instruction specific
  8556      delta, and the current delta base.  */
  8557 
  8558   ppem = (operand >> 4) + interpreter->state.delta_base;
  8559 
  8560   switch (number)
  8561     {
  8562     case 1:
  8563       break;
  8564 
  8565     case 2:
  8566       ppem += 16;
  8567       break;
  8568 
  8569     case 3:
  8570       ppem += 32;
  8571       break;
  8572     }
  8573 
  8574   /* Don't apply the delta if the ppem size doesn't match.  */
  8575 
  8576   if (interpreter->ppem != ppem)
  8577     return;
  8578 
  8579   /* Now, determine the delta using the low 4 bits.  The low 4 bits
  8580      actually specify a ``magnitude'' to apply to the delta, and do
  8581      not have an encoding for the delta 0.  */
  8582 
  8583   switch (operand & 0xf)
  8584     {
  8585     case 0:
  8586       delta = -8;
  8587       break;
  8588 
  8589     case 1:
  8590       delta = -7;
  8591       break;
  8592 
  8593     case 2:
  8594       delta = -6;
  8595       break;
  8596 
  8597     case 3:
  8598       delta = -5;
  8599       break;
  8600 
  8601     case 4:
  8602       delta = -4;
  8603       break;
  8604 
  8605     case 5:
  8606       delta = -3;
  8607       break;
  8608 
  8609     case 6:
  8610       delta = -2;
  8611       break;
  8612 
  8613     case 7:
  8614       delta = -1;
  8615       break;
  8616 
  8617     case 8:
  8618       delta = 1;
  8619       break;
  8620 
  8621     case 9:
  8622       delta = 2;
  8623       break;
  8624 
  8625     case 10:
  8626       delta = 3;
  8627       break;
  8628 
  8629     case 11:
  8630       delta = 4;
  8631       break;
  8632 
  8633     case 12:
  8634       delta = 5;
  8635       break;
  8636 
  8637     case 13:
  8638       delta = 6;
  8639       break;
  8640 
  8641     case 14:
  8642       delta = 7;
  8643       break;
  8644 
  8645     case 15:
  8646       delta = 8;
  8647       break;
  8648 
  8649       /* To pacify -fanalyzer.  */
  8650     default:
  8651       abort ();
  8652     }
  8653 
  8654   /* Now, scale up the delta by the step size, which is determined by
  8655      the delta shift.  */
  8656   delta *= 1l << (6 - interpreter->state.delta_shift);
  8657 
  8658   /* Finally, apply the delta to the CVT entry.  */
  8659   interpreter->cvt[index] = sfnt_add (interpreter->cvt[index],
  8660                                       delta);
  8661 }
  8662 
  8663 /* Interpret an MDAP (Move Direct Absolute Point) instruction with the
  8664    opcode OPCODE and the operand P in INTERPRETER.
  8665 
  8666    Touch the point P (within the zone specified in zp0) in the
  8667    directions specified in the freedom vector.  Then, if OPCODE is
  8668    0x7f, round the point and move it the rounded distance along the
  8669    freedom vector.
  8670 
  8671    Finally, set the RP0 and RP1 registers to P.  */
  8672 
  8673 static void
  8674 sfnt_interpret_mdap (struct sfnt_interpreter *interpreter,
  8675                      uint32_t p, uint32_t opcode)
  8676 {
  8677   sfnt_f26dot6 here, distance, px, py;
  8678 
  8679   sfnt_address_zp0 (interpreter, p, &px, &py, NULL, NULL);
  8680 
  8681   /* Measure the current distance.  */
  8682   here = sfnt_project_vector (interpreter, px, py);
  8683 
  8684   if (opcode == 0x7f)
  8685     {
  8686       /* Measure distance, round, then move to the distance.  */
  8687       distance = sfnt_project_vector (interpreter, px, py);
  8688       distance = sfnt_round_symmetric (interpreter, distance);
  8689       distance = sfnt_sub (distance, here);
  8690     }
  8691   else
  8692     /* Don't move.  Just touch the point.  */
  8693     distance = 0;
  8694 
  8695   sfnt_move_zp0 (interpreter, p, 1, distance);
  8696 
  8697   interpreter->state.rp0 = p;
  8698   interpreter->state.rp1 = p;
  8699 }
  8700 
  8701 /* Apply the delta specified by OPERAND to the point P in ZP0
  8702    currently loaded inside INTERPRETER.
  8703 
  8704    Trap if P is out of bounds.
  8705 
  8706    NUMBER is the number of the specific DELTAP instruction this delta
  8707    is being applied on behalf of.  It must be between 1 and 3.  */
  8708 
  8709 static void
  8710 sfnt_deltap (int number, struct sfnt_interpreter *interpreter,
  8711              unsigned char operand, unsigned int index)
  8712 {
  8713   int ppem, delta;
  8714 
  8715   return;
  8716 
  8717   /* Extract the ppem from OPERAND.  The format is the same as in
  8718      sfnt_deltac.  */
  8719 
  8720   ppem = (operand >> 4) + interpreter->state.delta_base;
  8721 
  8722   switch (number)
  8723     {
  8724     case 1:
  8725       break;
  8726 
  8727     case 2:
  8728       ppem += 16;
  8729       break;
  8730 
  8731     case 3:
  8732       ppem += 32;
  8733       break;
  8734     }
  8735 
  8736   /* Don't apply the delta if the ppem size doesn't match.  */
  8737 
  8738   if (interpreter->ppem != ppem)
  8739     return;
  8740 
  8741   /* Now, determine the magnitude of the movement and find the
  8742      delta.  */
  8743 
  8744   switch (operand & 0xf)
  8745     {
  8746     case 0:
  8747       delta = -8;
  8748       break;
  8749 
  8750     case 1:
  8751       delta = -7;
  8752       break;
  8753 
  8754     case 2:
  8755       delta = -6;
  8756       break;
  8757 
  8758     case 3:
  8759       delta = -5;
  8760       break;
  8761 
  8762     case 4:
  8763       delta = -4;
  8764       break;
  8765 
  8766     case 5:
  8767       delta = -3;
  8768       break;
  8769 
  8770     case 6:
  8771       delta = -2;
  8772       break;
  8773 
  8774     case 7:
  8775       delta = -1;
  8776       break;
  8777 
  8778     case 8:
  8779       delta = 1;
  8780       break;
  8781 
  8782     case 9:
  8783       delta = 2;
  8784       break;
  8785 
  8786     case 10:
  8787       delta = 3;
  8788       break;
  8789 
  8790     case 11:
  8791       delta = 4;
  8792       break;
  8793 
  8794     case 12:
  8795       delta = 5;
  8796       break;
  8797 
  8798     case 13:
  8799       delta = 6;
  8800       break;
  8801 
  8802     case 14:
  8803       delta = 7;
  8804       break;
  8805 
  8806     case 15:
  8807       delta = 8;
  8808       break;
  8809 
  8810       /* To pacify -fanalyzer.  */
  8811     default:
  8812       abort ();
  8813     }
  8814 
  8815   /* Now, scale up the delta by the step size, which is determined by
  8816      the delta shift.  */
  8817   delta *= 1l << (6 - interpreter->state.delta_shift);
  8818 
  8819   /* Move the point.  */
  8820   sfnt_check_zp0 (interpreter, index);
  8821   sfnt_move_zp0 (interpreter, index, 1, delta);
  8822 }
  8823 
  8824 /* Needed by sfnt_interpret_call.  */
  8825 static void sfnt_interpret_run (struct sfnt_interpreter *,
  8826                                 enum sfnt_interpreter_run_context);
  8827 
  8828 /* Call DEFINITION inside INTERPRETER.
  8829 
  8830    Save INTERPRETER->IP, INTERPRETER->instructions, and
  8831    INTERPRETER->num_instructions onto the C stack.
  8832 
  8833    Then, load the instructions in DEFINITION, and run the interpreter
  8834    again with the context CONTEXT.
  8835 
  8836    Finally, restore all values.  */
  8837 
  8838 static void
  8839 sfnt_interpret_call (struct sfnt_interpreter_definition *definition,
  8840                      struct sfnt_interpreter *interpreter,
  8841                      enum sfnt_interpreter_run_context context)
  8842 {
  8843   uint16_t num_instructions;
  8844   int IP;
  8845   unsigned char *instructions;
  8846 
  8847   /* Check that no recursion is going on.  */
  8848   if (interpreter->call_depth++ >= 128)
  8849     TRAP ("CALL called CALL more than 127 times");
  8850 
  8851   /* Save the old IP, instructions and number of instructions.  */
  8852   num_instructions = interpreter->num_instructions;
  8853   IP = interpreter->IP;
  8854   instructions = interpreter->instructions;
  8855 
  8856   /* Load and run the definition.  */
  8857   interpreter->num_instructions = definition->instruction_count;
  8858   interpreter->instructions = definition->instructions;
  8859   interpreter->IP = 0;
  8860   sfnt_interpret_run (interpreter, context);
  8861 
  8862   /* Restore the old values.  */
  8863   interpreter->num_instructions = num_instructions;
  8864   interpreter->IP = IP;
  8865   interpreter->instructions = instructions;
  8866   interpreter->call_depth--;
  8867 }
  8868 
  8869 /* Set the detailed rounding state in interpreter, on behalf of either
  8870    an SROUND or S45ROUND instruction that has been given the operand
  8871    OPERAND.
  8872 
  8873    Use the specified GRID_PERIOD to determine the period.  It is is a
  8874    18.14 fixed point number, but the rounding state set will be a 26.6
  8875    fixed point number.  */
  8876 
  8877 static void
  8878 sfnt_set_srounding_state (struct sfnt_interpreter *interpreter,
  8879                           uint32_t operand, sfnt_f18dot14 grid_period)
  8880 {
  8881   sfnt_f18dot14 period, phase, threshold;
  8882 
  8883   /* The most significant 2 bits in the 8 bit OPERAND determine the
  8884      period.  */
  8885 
  8886   switch ((operand & 0xc0) >> 6)
  8887     {
  8888     case 0:
  8889       period = grid_period / 2;
  8890       break;
  8891 
  8892     case 1:
  8893       period = grid_period;
  8894       break;
  8895 
  8896     case 2:
  8897       period = grid_period * 2;
  8898       break;
  8899 
  8900     case 3:
  8901     default:
  8902       TRAP ("reserved period given to SROUND");
  8903     }
  8904 
  8905   /* The next two bits determine the phase.  */
  8906 
  8907   switch ((operand & 0x30) >> 4)
  8908     {
  8909     case 0:
  8910       phase = 0;
  8911       break;
  8912 
  8913     case 1:
  8914       phase = period / 4;
  8915       break;
  8916 
  8917     case 2:
  8918       phase = period / 2;
  8919       break;
  8920 
  8921     case 3:
  8922     default:
  8923       phase = period * 3 / 2;
  8924       break;
  8925     }
  8926 
  8927   /* And the least significant 4 bits determine the threshold.  */
  8928 
  8929   if (operand & 0x0f)
  8930     threshold = (((int) (operand & 0x0f) - 4)
  8931                  * period / 8);
  8932   else
  8933     threshold = period - 1;
  8934 
  8935   /* Now extend these values to 26.6 format and set them.  */
  8936   interpreter->period = period >> 8;
  8937   interpreter->phase = phase >> 8;
  8938   interpreter->threshold = threshold >> 8;
  8939 }
  8940 
  8941 /* Move to the next opcode in INTERPRETER's instruction stream.
  8942    Value is the opcode originally at INTERPRETER->IP.  */
  8943 
  8944 static unsigned char
  8945 sfnt_skip_code (struct sfnt_interpreter *interpreter)
  8946 {
  8947   unsigned char opcode;
  8948   int nbytes;
  8949 
  8950   if (interpreter->IP == interpreter->num_instructions)
  8951     TRAP ("IP at end of instruction stream");
  8952 
  8953   /* Load opcode at IP.  */
  8954   opcode = interpreter->instructions[interpreter->IP];
  8955 
  8956   if (opcode == 0x40 || opcode == 0x41)
  8957     {
  8958       if (interpreter->IP + 1 >= interpreter->num_instructions)
  8959         TRAP ("Missing arg to NPUSHB or NPUSHW");
  8960 
  8961       /* Figure out how many bytes or words to push.  */
  8962 
  8963       nbytes = interpreter->instructions[interpreter->IP + 1];
  8964 
  8965       if (opcode == 0x41)
  8966         nbytes *= 2;
  8967 
  8968       if (interpreter->IP + 2 + nbytes > interpreter->num_instructions)
  8969         TRAP ("args to NPUSH instruction lie outside IS");
  8970 
  8971       /* Increment IP by so much.  */
  8972       interpreter->IP += 2 + nbytes;
  8973     }
  8974   else if (opcode >= 0xb0 && opcode <= 0xb7)
  8975     {
  8976       nbytes = opcode - 0xb0 + 1;
  8977 
  8978       if (interpreter->IP + 1 + nbytes > interpreter->num_instructions)
  8979         TRAP ("args to PUSHB instruction lie outide IS");
  8980 
  8981       interpreter->IP += 1 + nbytes;
  8982     }
  8983   else if (opcode >= 0xb8 && opcode <= 0xbf)
  8984     {
  8985       nbytes = (opcode - 0xb8 + 1) * 2;
  8986 
  8987       if (interpreter->IP + 1 + nbytes > interpreter->num_instructions)
  8988         TRAP ("args to PUSHW instruction lie outide IS");
  8989 
  8990       interpreter->IP += 1 + nbytes;
  8991     }
  8992   else
  8993     interpreter->IP++;
  8994 
  8995   return opcode;
  8996 }
  8997 
  8998 /* Interpret the unimplemented operation OPCODE using INTERPRETER, and
  8999    the context WHY.  If there is no instruction definition named
  9000    OPCODE, trap.  */
  9001 
  9002 static void
  9003 sfnt_interpret_unimplemented (struct sfnt_interpreter *interpreter,
  9004                               unsigned char opcode,
  9005                               enum sfnt_interpreter_run_context why)
  9006 {
  9007   uint32_t i;
  9008   struct sfnt_interpreter_definition *def;
  9009 
  9010   for (i = 0; i < interpreter->instruction_defs_size; ++i)
  9011     {
  9012       def = &interpreter->instruction_defs[i];
  9013 
  9014       if (def->opcode == opcode)
  9015         {
  9016           if (!def->instructions)
  9017             TRAP ("** ERROR ** malformed internal instruction"
  9018                   " definition");
  9019 
  9020           sfnt_interpret_call (def, interpreter, why);
  9021           return;
  9022         }
  9023     }
  9024 
  9025   TRAP ("invalid instruction");
  9026 }
  9027 
  9028 /* Start a function definition in INTERPRETER, with the function
  9029    opcode OPCODE.  */
  9030 
  9031 static void
  9032 sfnt_interpret_fdef (struct sfnt_interpreter *interpreter,
  9033                      uint32_t opcode)
  9034 {
  9035   size_t i, num_fdefs;
  9036   int IP;
  9037   unsigned char instruction;
  9038 
  9039   IP = interpreter->IP + 1;
  9040   num_fdefs = 0;
  9041 
  9042   /* Now find an ENDF.  */
  9043 
  9044   while ((instruction = sfnt_skip_code (interpreter)) != 0x2d)
  9045     {
  9046       if (interpreter->IP >= interpreter->num_instructions)
  9047         TRAP ("missing ENDF");
  9048 
  9049       /* If this is an FDEF or IDEF instruction, increment num_fdefs.
  9050          Prohibit nested FDEFs or IDEFS.  */
  9051       if (instruction == 0x2c || instruction == 0x89)
  9052         ++num_fdefs;
  9053 
  9054       if (num_fdefs > 1)
  9055         TRAP ("IDEF or FDEF before ENDF");
  9056     }
  9057 
  9058   /* ENDF has been found.  Now save the function definition.  Try to
  9059      find an existing function definition with this opcode.  If that
  9060      fails, make i the first available function definition.  */
  9061 
  9062   for (i = 0; i < interpreter->function_defs_size; ++i)
  9063     {
  9064       if (interpreter->function_defs[i].opcode == opcode
  9065           || !interpreter->function_defs[i].instructions)
  9066         break;
  9067     }
  9068 
  9069   if (i == interpreter->function_defs_size)
  9070     TRAP ("number of fdefs exceeded maxp->max_function_defs");
  9071 
  9072   /* Save the opcode of this function definition.  */
  9073   interpreter->function_defs[i].opcode = opcode;
  9074 
  9075   /* Make sure to ignore the trailing ENDF instruction.  */
  9076   interpreter->function_defs[i].instruction_count
  9077     = interpreter->IP - IP - 1;
  9078 
  9079   /* Now save a pointer to the instructions.  */
  9080   interpreter->function_defs[i].instructions = interpreter->instructions + IP;
  9081 }
  9082 
  9083 /* Start an instruction definition in INTERPRETER, with the
  9084    instruction opcode OPCODE.  */
  9085 
  9086 static void
  9087 sfnt_interpret_idef (struct sfnt_interpreter *interpreter,
  9088                      uint32_t opcode)
  9089 {
  9090   size_t i, num_fdefs;
  9091   int IP;
  9092   unsigned char instruction;
  9093 
  9094   IP = interpreter->IP + 1;
  9095   num_fdefs = 0;
  9096 
  9097   /* Now find an ENDF.  */
  9098 
  9099   while ((instruction = sfnt_skip_code (interpreter)) != 0x2d)
  9100     {
  9101       if (interpreter->IP >= interpreter->num_instructions)
  9102         TRAP ("missing ENDF");
  9103 
  9104       /* If this is an FDEF or IDEF instruction, increment num_fdefs.
  9105          Prohibit nested FDEFs or IDEFS.  */
  9106       if (instruction == 0x2c || instruction == 0x89)
  9107         ++num_fdefs;
  9108 
  9109       if (num_fdefs > 1)
  9110         TRAP ("IDEF or FDEF before ENDF");
  9111     }
  9112 
  9113   /* ENDF has been found.  Now save the instruction definition.  Try to
  9114      find an existing instruction definition with this opcode.  If that
  9115      fails, make i the first available instruction definition.  */
  9116 
  9117   for (i = 0; i < interpreter->instruction_defs_size; ++i)
  9118     {
  9119       if (interpreter->instruction_defs[i].opcode == opcode
  9120           || !interpreter->instruction_defs[i].instructions)
  9121         break;
  9122     }
  9123 
  9124   if (i == interpreter->instruction_defs_size)
  9125     TRAP ("number of defs exceeded maxp->max_instruction_defs");
  9126 
  9127   /* Save the opcode of this instruction definition.  */
  9128   interpreter->instruction_defs[i].opcode = opcode;
  9129 
  9130   /* Make sure to ignore the trailing ENDF instruction.  */
  9131   interpreter->instruction_defs[i].instruction_count
  9132     = interpreter->IP - IP - 1;
  9133 
  9134   /* Now save a pointer to the instructions.  */
  9135   interpreter->instruction_defs[i].instructions
  9136     = interpreter->instructions + IP;
  9137 }
  9138 
  9139 /* Interpret the specified conditional at INTERPRETER->IP.
  9140    If CONDITION, evaluate this branch up until the next ELSE or ENDIF.
  9141    Else, evaluate the branch from a matching ELSE condition, if
  9142    one exists.  */
  9143 
  9144 static void
  9145 sfnt_interpret_if (struct sfnt_interpreter *interpreter,
  9146                    bool condition)
  9147 {
  9148   int nifs;
  9149   bool need_break;
  9150   unsigned char opcode;
  9151 
  9152   if (condition)
  9153     {
  9154       interpreter->IP++;
  9155       return;
  9156     }
  9157 
  9158   /* Number of ifs.  */
  9159   nifs = 0;
  9160   need_break = false;
  9161 
  9162   /* Break past the matching else condition.  */
  9163   do
  9164     {
  9165       /* Load the current opcode, then increase IP.  */
  9166       opcode = sfnt_skip_code (interpreter);
  9167 
  9168       if (interpreter->IP >= interpreter->num_instructions)
  9169         break;
  9170 
  9171       switch (opcode)
  9172         {
  9173         case 0x58: /* IF */
  9174           nifs++;
  9175           break;
  9176 
  9177         case 0x1B: /* ELSE */
  9178           if (nifs == 1)
  9179             need_break = true;
  9180 
  9181           break;
  9182 
  9183         case 0x59: /* EIF */
  9184           nifs--;
  9185           if (nifs == 0)
  9186             need_break = true;
  9187 
  9188           break;
  9189         }
  9190     }
  9191   while (!need_break);
  9192 }
  9193 
  9194 /* Interpret the specified ELSE branch at INTERPRETER->IP.
  9195    Evaluate starting from a matching ENDIF instruction.
  9196 
  9197    If IF has set INTERPRETER->IP to a code within an ELSE branch, this
  9198    will not be called.  */
  9199 
  9200 static void
  9201 sfnt_interpret_else (struct sfnt_interpreter *interpreter)
  9202 {
  9203   int nifs;
  9204   unsigned char opcode;
  9205 
  9206   /* Number of ifs.  */
  9207   nifs = 1;
  9208 
  9209   /* Break past the matching ENDIF condition.  */
  9210   do
  9211     {
  9212       /* Load the current opcode, then increase IP.  */
  9213       opcode = sfnt_skip_code (interpreter);
  9214 
  9215       if (interpreter->IP >= interpreter->num_instructions)
  9216         break;
  9217 
  9218       switch (opcode)
  9219         {
  9220         case 0x58: /* IF */
  9221           nifs++;
  9222           break;
  9223 
  9224         case 0x59: /* EIF */
  9225           nifs--;
  9226 
  9227           break;
  9228         }
  9229     }
  9230   while (nifs > 0);
  9231 }
  9232 
  9233 /* ``Add engine compensation to X''.  Since engine compensation is not
  9234    implemented here, this simply returns X.  INTERPRETER is
  9235    unused.  */
  9236 
  9237 static sfnt_f26dot6
  9238 sfnt_round_none (sfnt_f26dot6 x, struct sfnt_interpreter *interpreter)
  9239 {
  9240   return x;
  9241 }
  9242 
  9243 /* Round X to the grid after adding engine compensation.  Return the
  9244    result.  INTERPRETER is unused.  */
  9245 
  9246 static sfnt_f26dot6
  9247 sfnt_round_to_grid (sfnt_f26dot6 x, struct sfnt_interpreter *interpreter)
  9248 {
  9249   return sfnt_round_f26dot6 (x);
  9250 }
  9251 
  9252 /* Round X to the nearest half integer or integer and return the
  9253    result.  INTERPRETER is unused.  */
  9254 
  9255 static sfnt_f26dot6
  9256 sfnt_round_to_double_grid (sfnt_f26dot6 x,
  9257                            struct sfnt_interpreter *interpreter)
  9258 {
  9259   return (x + 020) & ~037;
  9260 }
  9261 
  9262 /* Take the floor of X and return the result.  INTERPRETER is
  9263    unused.  */
  9264 
  9265 static sfnt_f26dot6
  9266 sfnt_round_down_to_grid (sfnt_f26dot6 x,
  9267                          struct sfnt_interpreter *interpreter)
  9268 {
  9269   return sfnt_floor_f26dot6 (x);
  9270 }
  9271 
  9272 /* Take the ceiling of X and return the result.  INTERPRETER is
  9273    unused.  */
  9274 
  9275 static sfnt_f26dot6
  9276 sfnt_round_up_to_grid (sfnt_f26dot6 x,
  9277                        struct sfnt_interpreter *interpreter)
  9278 {
  9279   return sfnt_ceil_f26dot6 (x);
  9280 }
  9281 
  9282 /* Round X to only the nearest half integer and return the result.
  9283    INTERPRETER is unused.  */
  9284 
  9285 static sfnt_f26dot6
  9286 sfnt_round_to_half_grid (sfnt_f26dot6 x,
  9287                          struct sfnt_interpreter *interpreter)
  9288 {
  9289   return sfnt_floor_f26dot6 (x) + 32;
  9290 }
  9291 
  9292 /* Round X using the detailed rounding information ``super rounding
  9293    state'' in INTERPRETER.  Value is the result.  */
  9294 
  9295 static sfnt_f26dot6
  9296 sfnt_round_super (sfnt_f26dot6 x,
  9297                   struct sfnt_interpreter *interpreter)
  9298 {
  9299   sfnt_f26dot6 value;
  9300 
  9301   /* Compute the rounded value.  */
  9302   value = sfnt_add ((interpreter->threshold
  9303                      - interpreter->phase), x);
  9304   value = sfnt_add (value & -interpreter->period,
  9305                     interpreter->phase);
  9306 
  9307   /* Remember that since the phase is specified by font instructions,
  9308      it is possible for the sign to be changed.  In that case, return
  9309      the phase itself.  */
  9310 
  9311   return value < 0 ? interpreter->phase : value;
  9312 }
  9313 
  9314 /* Round X using the detailed rounding information ``super rounding
  9315    state'' in INTERPRETER, but suitably for values that are multiples
  9316    of the sqrt of 2.  Value is the result.  */
  9317 
  9318 static sfnt_f26dot6
  9319 sfnt_round_super45 (sfnt_f26dot6 x,
  9320                     struct sfnt_interpreter *interpreter)
  9321 {
  9322   sfnt_f26dot6 value;
  9323 
  9324   /* Compute the rounded value.  */
  9325 
  9326   value = ((sfnt_add (x, (interpreter->threshold
  9327                           - interpreter->phase))
  9328             / interpreter->period)
  9329            * interpreter->period);
  9330   value = sfnt_add (value, interpreter->phase);
  9331 
  9332   /* Remember that since the phase is specified by font instructions,
  9333      it is possible for the sign to be changed.  In that case, return
  9334      the phase itself.  */
  9335 
  9336   return value < 0 ? interpreter->phase : value;
  9337 }
  9338 
  9339 /* Project the specified vector VX and VY onto the unit vector that is
  9340    INTERPRETER's projection vector, assuming that INTERPRETER's
  9341    projection vector is on the X axis.
  9342 
  9343    Value is the magnitude of the projected vector.  */
  9344 
  9345 static sfnt_f26dot6
  9346 sfnt_project_onto_x_axis_vector (sfnt_f26dot6 vx, sfnt_f26dot6 vy,
  9347                                  struct sfnt_interpreter *interpreter)
  9348 {
  9349   return vx;
  9350 }
  9351 
  9352 /* Project the specified vector VX and VY onto the unit vector that is
  9353    INTERPRETER's projection vector, assuming that INTERPRETER's
  9354    projection vector is on the Y axis.
  9355 
  9356    Value is the magnitude of the projected vector.  */
  9357 
  9358 static sfnt_f26dot6
  9359 sfnt_project_onto_y_axis_vector (sfnt_f26dot6 vx, sfnt_f26dot6 vy,
  9360                                  struct sfnt_interpreter *interpreter)
  9361 {
  9362   return vy;
  9363 }
  9364 
  9365 /* Calculate AX * BX + AY * BY divided by 16384.  */
  9366 
  9367 static int32_t
  9368 sfnt_dot_fix_14 (int32_t ax, int32_t ay, int bx, int by)
  9369 {
  9370 #ifndef INT64_MAX
  9371   int32_t m, s, hi1, hi2, hi;
  9372   uint32_t l, lo1, lo2, lo;
  9373 
  9374 
  9375   /* Compute ax*bx as 64-bit value.  */
  9376   l = (uint32_t) ((ax & 0xffffu) * bx);
  9377   m = (ax >> 16) * bx;
  9378 
  9379   lo1 = l + ((uint32_t) m << 16);
  9380   hi1 = (m >> 16) + ((int32_t) l >> 31) + (lo1 < l);
  9381 
  9382   /* Compute ay*by as 64-bit value.  */
  9383   l = (uint32_t) ((ay & 0xffffu) * by);
  9384   m = (ay >> 16) * by;
  9385 
  9386   lo2 = l + ((uint32_t) m << 16);
  9387   hi2 = (m >> 16) + ((int32_t) l >> 31) + (lo2 < l);
  9388 
  9389   /* Add them.  */
  9390   lo = lo1 + lo2;
  9391   hi = hi1 + hi2 + (lo < lo1);
  9392 
  9393   /* Divide the result by 2^14 with rounding.  */
  9394   s = hi >> 31;
  9395   l = lo + (uint32_t) s;
  9396   hi += s + (l < lo);
  9397   lo = l;
  9398 
  9399   l = lo + 0x2000u;
  9400   hi += (l < lo);
  9401 
  9402   return (int32_t) (((uint32_t) hi << 18) | (l >> 14));
  9403 #else
  9404   int64_t xx, yy;
  9405 
  9406   xx = (int64_t) ax * bx;
  9407   yy = (int64_t) ay * by;
  9408 
  9409   xx += yy;
  9410   yy = xx >> 63;
  9411   xx += 0x2000 + yy;
  9412 
  9413   return (int32_t) (xx / (2 << 14));
  9414 #endif
  9415 }
  9416 
  9417 /* Project the specified vector VX and VY onto the unit vector that is
  9418    INTERPRETER's projection vector, making only the assumption that the
  9419    projection vector is a valid unit vector.
  9420 
  9421    Value is the magnitude of the projected vector.  */
  9422 
  9423 static sfnt_f26dot6
  9424 sfnt_project_onto_any_vector (sfnt_f26dot6 vx, sfnt_f26dot6 vy,
  9425                               struct sfnt_interpreter *interpreter)
  9426 {
  9427   return sfnt_dot_fix_14 (vx, vy,
  9428                           interpreter->state.projection_vector.x,
  9429                           interpreter->state.projection_vector.y);
  9430 }
  9431 
  9432 /* Project the specified vector VX and VY onto the unit vector that is
  9433    INTERPRETER's dual projection vector, making only the assumption
  9434    that the dual projection vector is a valid unit vector.
  9435 
  9436    The dual projection vector is a vector that is normally the
  9437    projection vector, but can be set using the original unscaled
  9438    coordinates of two points as well.
  9439 
  9440    Value is the magnitude of the projected vector.  */
  9441 
  9442 static sfnt_f26dot6
  9443 sfnt_dual_project_onto_any_vector (sfnt_f26dot6 vx, sfnt_f26dot6 vy,
  9444                                    struct sfnt_interpreter *interpreter)
  9445 {
  9446   return sfnt_dot_fix_14 (vx, vy,
  9447                           interpreter->state.dual_projection_vector.x,
  9448                           interpreter->state.dual_projection_vector.y);
  9449 }
  9450 
  9451 /* Move N points at *X, *Y by DISTANCE along INTERPRETER's freedom
  9452    vector.  Set N flags in *FLAGS where appropriate and when non-NULL.
  9453 
  9454    Assume both vectors are aligned to the X axis.  */
  9455 
  9456 static void
  9457 sfnt_move_x (sfnt_f26dot6 *restrict x, sfnt_f26dot6 *restrict y,
  9458              size_t n, struct sfnt_interpreter *interpreter,
  9459              sfnt_f26dot6 distance, unsigned char *flags)
  9460 {
  9461   while (n--)
  9462     {
  9463       *x = sfnt_add (*x, distance);
  9464       x++;
  9465 
  9466       if (flags)
  9467         *flags++ |= SFNT_POINT_TOUCHED_X;
  9468     }
  9469 }
  9470 
  9471 /* Move N points at *X, *Y by DISTANCE along INTERPRETER's freedom
  9472    vector.  Set N flags in *FLAGS where appropriate and when non-NULL.
  9473 
  9474    Assume both vectors are aligned to the Y axis.  */
  9475 
  9476 static void
  9477 sfnt_move_y (sfnt_f26dot6 *restrict x, sfnt_f26dot6 *restrict y,
  9478              size_t n, struct sfnt_interpreter *interpreter,
  9479              sfnt_f26dot6 distance, unsigned char *flags)
  9480 {
  9481   while (n--)
  9482     {
  9483       *y = sfnt_add (*y, distance);
  9484       y++;
  9485 
  9486       if (flags)
  9487         *flags++ |= SFNT_POINT_TOUCHED_Y;
  9488     }
  9489 }
  9490 
  9491 /* Move N points at *X, *Y by DISTANCE along INTERPRETER's freedom
  9492    vector.  Set N flags in *FLAGS where appropriate and when
  9493    non-NULL.  */
  9494 
  9495 static void
  9496 sfnt_move (sfnt_f26dot6 *restrict x, sfnt_f26dot6 *restrict y,
  9497            size_t n, struct sfnt_interpreter *interpreter,
  9498            sfnt_f26dot6 distance, unsigned char *flags)
  9499 {
  9500   sfnt_f26dot6 versor, k;
  9501   sfnt_f2dot14 dot_product;
  9502   size_t num;
  9503 
  9504   dot_product = interpreter->state.vector_dot_product;
  9505 
  9506   /* If the vectors are orthogonal, it is impossible to move anywhere,
  9507      so simply return.  */
  9508   if (!dot_product)
  9509     return;
  9510 
  9511   /* Not actually 26.6, but the multiply-divisions below cancel each
  9512      other out, so the result is 26.6.  */
  9513   versor = interpreter->state.freedom_vector.x;
  9514 
  9515   if (versor)
  9516     {
  9517       /* Move along X axis, converting the distance to the freedom
  9518          vector.  */
  9519       num = n;
  9520       k = sfnt_multiply_divide_signed (distance,
  9521                                        versor,
  9522                                        dot_product);
  9523 
  9524       while (num--)
  9525         {
  9526           *x = sfnt_add (*x, k);
  9527           x++;
  9528 
  9529           if (flags)
  9530             *flags++ |= SFNT_POINT_TOUCHED_X;
  9531         }
  9532     }
  9533 
  9534   versor = interpreter->state.freedom_vector.y;
  9535 
  9536   if (versor)
  9537     {
  9538       /* Move along X axis, converting the distance to the freedom
  9539          vector.  */
  9540       num = n;
  9541       k = sfnt_multiply_divide_signed (distance,
  9542                                        versor,
  9543                                        dot_product);
  9544 
  9545       while (num--)
  9546         {
  9547           *y = sfnt_add (*y, k);
  9548           y++;
  9549 
  9550           if (flags)
  9551             *flags++ |= SFNT_POINT_TOUCHED_Y;
  9552         }
  9553     }
  9554 }
  9555 
  9556 /* Validate the graphics state GS.
  9557    Establish function pointers for rounding and projection.
  9558    Establish dot product used to convert vector distances between
  9559    each other.  */
  9560 
  9561 static void
  9562 sfnt_validate_gs (struct sfnt_graphics_state *gs)
  9563 {
  9564   /* Establish the function used for rounding based on the round
  9565      state.  */
  9566 
  9567   switch (gs->round_state)
  9568     {
  9569     case 5: /* Rounding off.  */
  9570       gs->round = sfnt_round_none;
  9571       break;
  9572 
  9573     case 0: /* Round to half grid.  */
  9574       gs->round = sfnt_round_to_half_grid;
  9575       break;
  9576 
  9577     case 1: /* Round to grid.  */
  9578       gs->round = sfnt_round_to_grid;
  9579       break;
  9580 
  9581     case 2: /* Round to double grid.  */
  9582       gs->round = sfnt_round_to_double_grid;
  9583       break;
  9584 
  9585     case 4: /* Round up to grid.  */
  9586       gs->round = sfnt_round_up_to_grid;
  9587       break;
  9588 
  9589     case 3: /* Round down to grid.  */
  9590       gs->round = sfnt_round_down_to_grid;
  9591       break;
  9592 
  9593     case 6: /* Fine grained rounding.  */
  9594       gs->round = sfnt_round_super;
  9595       break;
  9596 
  9597     case 7: /* Fine grained rounding 45 degree variant.  */
  9598       gs->round = sfnt_round_super45;
  9599       break;
  9600     }
  9601 
  9602   /* Establish the function used for vector projection.
  9603      When the projection vector is an axis vector, a fast
  9604      version can be used.  */
  9605 
  9606   if (gs->projection_vector.x == 040000)
  9607     gs->project = sfnt_project_onto_x_axis_vector;
  9608   else if (gs->projection_vector.y == 040000)
  9609     gs->project = sfnt_project_onto_y_axis_vector;
  9610   else
  9611     gs->project = sfnt_project_onto_any_vector;
  9612 
  9613   /* Do the same for the dual projection vector.  */
  9614 
  9615   if (gs->dual_projection_vector.x == 040000)
  9616     gs->dual_project = sfnt_project_onto_x_axis_vector;
  9617   else if (gs->dual_projection_vector.y == 040000)
  9618     gs->dual_project = sfnt_project_onto_y_axis_vector;
  9619   else
  9620     gs->dual_project = sfnt_dual_project_onto_any_vector;
  9621 
  9622   /* Compute dot product of the freedom and projection vectors.
  9623      Handle the common case where the freedom vector is aligned
  9624      to an axis.  */
  9625 
  9626   if (gs->freedom_vector.x == 040000)
  9627     gs->vector_dot_product = gs->projection_vector.x;
  9628   else if (gs->freedom_vector.y == 040000)
  9629     gs->vector_dot_product = gs->projection_vector.y;
  9630   else
  9631     /* Actually calculate the dot product.  */
  9632     gs->vector_dot_product = ((((long) gs->projection_vector.x
  9633                                 * gs->freedom_vector.x)
  9634                                + ((long) gs->projection_vector.y
  9635                                   * gs->freedom_vector.y))
  9636                               / 16384);
  9637 
  9638   /* Now figure out which function to use to move distances.  Handle
  9639      the common case where both the freedom and projection vectors are
  9640      aligned to an axis.  */
  9641 
  9642   if (gs->freedom_vector.x == 040000
  9643       && gs->projection_vector.x == 040000)
  9644     gs->move = sfnt_move_x;
  9645   else if (gs->freedom_vector.y == 040000
  9646            && gs->projection_vector.y == 040000)
  9647     gs->move = sfnt_move_y;
  9648   else
  9649     gs->move = sfnt_move;
  9650 }
  9651 
  9652 /* Set the X and Y versors of the freedom vector of INTERPRETER's
  9653    graphics state to the specified X and Y, in 2.14 fixed point
  9654    format.  */
  9655 
  9656 static void
  9657 sfnt_set_freedom_vector (struct sfnt_interpreter *interpreter,
  9658                          sfnt_f2dot14 x, sfnt_f2dot14 y)
  9659 {
  9660   interpreter->state.freedom_vector.x = x;
  9661   interpreter->state.freedom_vector.y = y;
  9662 
  9663   sfnt_validate_gs (&interpreter->state);
  9664 }
  9665 
  9666 /* Set the X and Y versors of the projection vector of INTERPRETER's
  9667    graphics state to the specified X and Y, in 2.14 fixed point
  9668    format.  */
  9669 
  9670 static void
  9671 sfnt_set_projection_vector (struct sfnt_interpreter *interpreter,
  9672                             sfnt_f2dot14 x, sfnt_f2dot14 y)
  9673 {
  9674   interpreter->state.projection_vector.x = x;
  9675   interpreter->state.projection_vector.y = y;
  9676   interpreter->state.dual_projection_vector.x = x;
  9677   interpreter->state.dual_projection_vector.y = y;
  9678 
  9679   sfnt_validate_gs (&interpreter->state);
  9680 }
  9681 
  9682 /* Interpret an SHZ instruction with the specified OPCODE.  Like
  9683    sfnt_interpret_shc, but do the move for each point in the entire
  9684    specified ZONE.  */
  9685 
  9686 static void
  9687 sfnt_interpret_shz (struct sfnt_interpreter *interpreter,
  9688                     uint32_t zone, unsigned int opcode)
  9689 {
  9690   sfnt_f26dot6 x, y, original_x, original_y;
  9691   sfnt_f26dot6 magnitude;
  9692 
  9693   if (zone != 0 && !interpreter->glyph_zone)
  9694     /* There are no points in the glyph zone.  */
  9695     return;
  9696 
  9697   if (opcode == 0x37)
  9698     sfnt_address_zp0 (interpreter, interpreter->state.rp1,
  9699                       &x, &y, &original_x, &original_y);
  9700   else
  9701     sfnt_address_zp1 (interpreter, interpreter->state.rp2,
  9702                       &x, &y, &original_x, &original_y);
  9703 
  9704   magnitude = sfnt_project_vector (interpreter,
  9705                                    sfnt_sub (x, original_x),
  9706                                    sfnt_sub (y, original_y));
  9707 
  9708   if (zone == 0)
  9709     sfnt_move_twilight_zone (interpreter, 0,
  9710                              interpreter->twilight_zone_size,
  9711                              magnitude);
  9712   else
  9713     sfnt_move_glyph_zone (interpreter, 0,
  9714                           interpreter->glyph_zone->num_points,
  9715                           magnitude);
  9716 }
  9717 
  9718 /* Interpret an SHC instruction with the specified OPCODE and CONTOUR.
  9719    Like sfnt_interpret_shp, but do the move for each point in the
  9720    specified contour.  */
  9721 
  9722 static void
  9723 sfnt_interpret_shc (struct sfnt_interpreter *interpreter,
  9724                     uint32_t contour, unsigned int opcode)
  9725 {
  9726   sfnt_f26dot6 x, y, original_x, original_y;
  9727   sfnt_f26dot6 magnitude;
  9728   size_t start, end, n;
  9729 
  9730   if (!interpreter->glyph_zone)
  9731     TRAP ("SHC without glyph zone");
  9732 
  9733   /* Check that the contour is within bounds.  */
  9734   if (contour >= interpreter->glyph_zone->num_contours)
  9735     TRAP ("contour out of bounds");
  9736 
  9737   /* Figure out the magnitude of the change, measured from the
  9738      projection vector.  */
  9739 
  9740   if (opcode == 0x35)
  9741     sfnt_address_zp0 (interpreter, interpreter->state.rp1,
  9742                       &x, &y, &original_x, &original_y);
  9743   else
  9744     sfnt_address_zp1 (interpreter, interpreter->state.rp2,
  9745                       &x, &y, &original_x, &original_y);
  9746 
  9747   magnitude = sfnt_project_vector (interpreter,
  9748                                    sfnt_sub (x, original_x),
  9749                                    sfnt_sub (y, original_y));
  9750 
  9751   /* Now obtain the start and end of the contour.
  9752      Verify that both are valid.  */
  9753 
  9754   if (contour)
  9755     start = interpreter->glyph_zone->contour_end_points[contour - 1];
  9756   else
  9757     start = 0;
  9758 
  9759   end = interpreter->glyph_zone->contour_end_points[contour];
  9760 
  9761   if (start > end || end >= interpreter->glyph_zone->num_points)
  9762     TRAP ("invalid contour data in glyph");
  9763 
  9764   /* Compute the number of points to move.  */
  9765   n = end - start + 1;
  9766 
  9767   /* Move that many points.  */
  9768   sfnt_move_glyph_zone (interpreter, start, n, magnitude);
  9769 }
  9770 
  9771 /* Interpret an SHP instruction with the specified OPCODE.  Move a
  9772    popped point in ZP2 along the freedom vector by the distance
  9773    between a specified point from its original position, which is RP1
  9774    in ZP0 if OPCODE is 0x33, and RP2 in ZP1 if OPCODE is 0x32.
  9775 
  9776    Repeat for the number of iterations specified by a prior SLOOP
  9777    instruction.  */
  9778 
  9779 static void
  9780 sfnt_interpret_shp (struct sfnt_interpreter *interpreter,
  9781                     unsigned int opcode)
  9782 {
  9783   sfnt_f26dot6 x, y, original_x, original_y;
  9784   sfnt_f26dot6 magnitude;
  9785   uint32_t point;
  9786 
  9787   /* Figure out the magnitude of the change, measured from the
  9788      projection vector.  */
  9789 
  9790   if (opcode == 0x33)
  9791     sfnt_address_zp0 (interpreter, interpreter->state.rp1,
  9792                       &x, &y, &original_x, &original_y);
  9793   else
  9794     sfnt_address_zp1 (interpreter, interpreter->state.rp2,
  9795                       &x, &y, &original_x, &original_y);
  9796 
  9797   magnitude = sfnt_project_vector (interpreter,
  9798                                    sfnt_sub (x, original_x),
  9799                                    sfnt_sub (y, original_y));
  9800 
  9801   /* Now project it onto the freedom vector and move the point that
  9802      much for loop variable times.  */
  9803 
  9804   while (interpreter->state.loop--)
  9805     {
  9806       point = POP ();
  9807 
  9808       sfnt_check_zp2 (interpreter, point);
  9809       sfnt_move_zp2 (interpreter, point, 1, magnitude);
  9810     }
  9811 
  9812   /* Restore interpreter->state.loop to 1.  */
  9813   interpreter->state.loop = 1;
  9814 }
  9815 
  9816 #define load_point(p)                           \
  9817   (opcode == 0x31                               \
  9818    ? interpreter->glyph_zone->x_current[p]      \
  9819    : interpreter->glyph_zone->y_current[p])
  9820 
  9821 #define store_point(p, val)                             \
  9822   (opcode == 0x31                                       \
  9823    ? (interpreter->glyph_zone->x_current[p] = (val))    \
  9824    : (interpreter->glyph_zone->y_current[p] = (val)))
  9825 
  9826 #define load_original(p)                        \
  9827   (opcode == 0x31                               \
  9828    ? interpreter->glyph_zone->x_points[p]       \
  9829    : interpreter->glyph_zone->y_points[p])
  9830 
  9831 #define IUP_SINGLE_PAIR()                                               \
  9832   /* Now make touch_start the first point before, i.e. the first        \
  9833      touched point in this pair.  */                                    \
  9834                                                                         \
  9835   if (touch_start == start)                                             \
  9836     touch_start = end;                                                  \
  9837   else                                                                  \
  9838     touch_start = touch_start - 1;                                      \
  9839                                                                         \
  9840   /* Set point_min and point_max based on which glyph is at a           \
  9841      lower value.  */                                                   \
  9842                                                                         \
  9843   if (load_original (touch_start) < load_original (touch_end))          \
  9844     {                                                                   \
  9845       point_min = touch_start;                                          \
  9846       point_max = touch_end;                                            \
  9847     }                                                                   \
  9848   else                                                                  \
  9849     {                                                                   \
  9850       point_max = touch_start;                                          \
  9851       point_min = touch_end;                                            \
  9852     }                                                                   \
  9853                                                                         \
  9854   min_pos = load_point (point_min);                                     \
  9855   max_pos = load_point (point_max);                                     \
  9856                                                                         \
  9857   /* This is needed for interpolation.  */                              \
  9858   original_max_pos = load_original (point_max);                         \
  9859   original_min_pos = load_original (point_min);                         \
  9860                                                                         \
  9861   /* Now process points between touch_start and touch_end.  */          \
  9862                                                                         \
  9863   i = touch_start + 1;                                                  \
  9864                                                                         \
  9865   /* touch_start might be the last point in the contour.  */            \
  9866                                                                         \
  9867   if (i > end)                                                          \
  9868     i = start;                                                          \
  9869                                                                         \
  9870   while (i != touch_end)                                                \
  9871     {                                                                   \
  9872       /* Movement is always relative to the original position of        \
  9873          the point.  */                                                 \
  9874       position = load_original (i);                                     \
  9875                                                                         \
  9876       /* If i is in between touch_start and touch_end...  */            \
  9877       if (position >= original_min_pos                                  \
  9878           && position <= original_max_pos)                              \
  9879         {                                                               \
  9880           /* Handle the degenerate case where original_min_pos and      \
  9881              original_max_pos have not changed by placing the point in  \
  9882              the middle.  */                                            \
  9883           if (original_min_pos == original_max_pos)                     \
  9884             ratio = 077777;                                             \
  9885           else                                                          \
  9886             /* ... preserve the ratio of i between min_pos and          \
  9887                max_pos...  */                                           \
  9888             ratio = sfnt_div_fixed ((sfnt_sub (position,                \
  9889                                                original_min_pos)        \
  9890                                      * 1024),                           \
  9891                                     (sfnt_sub (original_max_pos,        \
  9892                                                original_min_pos)        \
  9893                                      * 1024));                          \
  9894                                                                         \
  9895           delta = sfnt_sub (max_pos, min_pos);                          \
  9896           delta = sfnt_mul_fixed (ratio, delta);                        \
  9897           store_point (i, sfnt_add (min_pos, delta));                   \
  9898         }                                                               \
  9899       else                                                              \
  9900         {                                                               \
  9901           /* ... otherwise, move i by how much the nearest touched      \
  9902              point moved.  */                                           \
  9903                                                                         \
  9904           if (position >= original_max_pos)                             \
  9905             delta = sfnt_sub (max_pos, original_max_pos);               \
  9906           else                                                          \
  9907             delta = sfnt_sub (min_pos, original_min_pos);               \
  9908                                                                         \
  9909           store_point (i, sfnt_add (position, delta));                  \
  9910         }                                                               \
  9911                                                                         \
  9912       if (++i > end)                                                    \
  9913         i = start;                                                      \
  9914     }                                                                   \
  9915 
  9916 /* Interpolate untouched points in the contour between and including
  9917    START and END inside INTERPRETER's glyph zone according to the
  9918    rules specified for an IUP instruction.  Perform interpolation on
  9919    the axis specified by OPCODE and MASK.  */
  9920 
  9921 static void
  9922 sfnt_interpret_iup_1 (struct sfnt_interpreter *interpreter,
  9923                       size_t start, size_t end,
  9924                       unsigned char opcode, int mask)
  9925 {
  9926   size_t point;
  9927   size_t touch_start, touch_end;
  9928   size_t first_point;
  9929   size_t point_min, point_max, i;
  9930   sfnt_f26dot6 position, min_pos, max_pos, delta, ratio;
  9931   sfnt_f26dot6 original_max_pos;
  9932   sfnt_f26dot6 original_min_pos;
  9933 
  9934   /* Find the first touched point.  If none is found, simply
  9935      return.  */
  9936 
  9937   for (point = start; point <= end; ++point)
  9938     {
  9939       if (interpreter->glyph_zone->flags[point] & mask)
  9940         goto touched;
  9941     }
  9942 
  9943   goto untouched;
  9944 
  9945  touched:
  9946 
  9947   point = start;
  9948 
  9949   /* Find the first touched point.  */
  9950   while (!(interpreter->glyph_zone->flags[point] & mask))
  9951     {
  9952       point++;
  9953 
  9954       /* There are no touched points.  */
  9955       if (point > end)
  9956         goto untouched;
  9957     }
  9958 
  9959   first_point = point;
  9960 
  9961   while (point <= end)
  9962     {
  9963       /* Find the next untouched point.  */
  9964       while (interpreter->glyph_zone->flags[point] & mask)
  9965         {
  9966           point++;
  9967 
  9968           if (point > end)
  9969             goto wraparound;
  9970         }
  9971 
  9972       /* touch_start is now the first untouched point.  */
  9973       touch_start = point;
  9974 
  9975       /* Find the next touched point.  */
  9976       while (!(interpreter->glyph_zone->flags[point] & mask))
  9977         {
  9978           point++;
  9979 
  9980           /* Move back to start if point has gone past the end of the
  9981              contour.  */
  9982           if (point > end)
  9983             goto wraparound_1;
  9984         }
  9985 
  9986       /* touch_end is now the next touched point.  */
  9987       touch_end = point;
  9988 
  9989       /* Do the interpolation.  */
  9990       IUP_SINGLE_PAIR ();
  9991     }
  9992 
  9993   goto untouched;
  9994 
  9995  wraparound:
  9996   /* This is like wraparound_1, except that no untouched points have
  9997      yet to be found.
  9998 
  9999      This means the first untouched point is start.  */
 10000   touch_start = start;
 10001 
 10002  wraparound_1:
 10003   /* If point > end, wrap around.  Here, touch_start is set
 10004      properly, so touch_end must be first_point.  */
 10005 
 10006   touch_end = first_point;
 10007   IUP_SINGLE_PAIR ();
 10008 
 10009  untouched:
 10010   /* No points were touched or all points have been considered, so
 10011      return immediately.  */
 10012   return;
 10013 }
 10014 
 10015 #undef load_point
 10016 #undef store_point
 10017 #undef load_original
 10018 
 10019 /* Interpret an IUP (``interpolate untouched points'') instruction.
 10020    INTERPRETER is the interpreter, and OPCODE is the instruction
 10021    number.  See the TrueType Reference Manual for more details.  */
 10022 
 10023 static void
 10024 sfnt_interpret_iup (struct sfnt_interpreter *interpreter,
 10025                     unsigned char opcode)
 10026 {
 10027   int mask;
 10028   size_t i, point, end, first_point;
 10029 
 10030   /* Check that the zone is the glyph zone.  */
 10031 
 10032   if (!interpreter->state.zp2)
 10033     TRAP ("trying to iup in twilight zone");
 10034 
 10035   if (!interpreter->glyph_zone)
 10036     TRAP ("iup without loaded glyph!");
 10037 
 10038   /* Figure out what axis to interpolate in based on the opcode.  */
 10039   if (opcode == 0x30)
 10040     mask = SFNT_POINT_TOUCHED_Y;
 10041   else
 10042     mask = SFNT_POINT_TOUCHED_X;
 10043 
 10044   /* Now, for each contour, interpolate untouched points.  */
 10045   point = 0;
 10046   for (i = 0; i < interpreter->glyph_zone->num_contours; ++i)
 10047     {
 10048       first_point = point;
 10049       end = interpreter->glyph_zone->contour_end_points[i];
 10050 
 10051       if (point >= interpreter->glyph_zone->num_points
 10052           || end >= interpreter->glyph_zone->num_points)
 10053         TRAP ("glyph contains out of bounds contour end point"
 10054               " data!");
 10055 
 10056       sfnt_interpret_iup_1 (interpreter, first_point, end,
 10057                             opcode, mask);
 10058       point = end + 1;
 10059 
 10060       /* Skip the subsequent phantom points, which may end up
 10061          intermixed with contours inside a compound glyph.  */
 10062 
 10063       while (point < interpreter->glyph_zone->num_points
 10064              && interpreter->glyph_zone->flags[point] & SFNT_POINT_PHANTOM)
 10065         point++;
 10066     }
 10067 }
 10068 
 10069 /* Interpret an MIRP instruction with the specified OPCODE in
 10070    INTERPRETER.  Pop a point in ZP1 and CVT index, and move the point
 10071    until its distance from RP0 in ZP0 is the same as in the control
 10072    value.  If the point lies in the twilight zone, then ``create'' it
 10073    as well.
 10074 
 10075    OPCODE contains a great many flags.
 10076    They are all described in the TrueType reference manual.  */
 10077 
 10078 static void
 10079 sfnt_interpret_mirp (struct sfnt_interpreter *interpreter,
 10080                      uint32_t opcode)
 10081 {
 10082   uint32_t n;
 10083   uint32_t p;
 10084   sfnt_f26dot6 distance, delta, temp;
 10085   sfnt_f26dot6 current_projection, original_projection;
 10086   sfnt_f26dot6 x, y, org_x, org_y;
 10087   sfnt_f26dot6 rx, ry, org_rx, org_ry;
 10088 
 10089   /* CVT index.  */
 10090   n = POP ();
 10091 
 10092   /* Point number.  */
 10093   p = POP ();
 10094 
 10095   /* Now get the distance from the CVT.  */
 10096   if (n >= interpreter->cvt_size)
 10097     TRAP ("cvt index out of bounds");
 10098 
 10099   distance = interpreter->cvt[n];
 10100 
 10101   /* Test against the single width value.  */
 10102 
 10103   delta = sfnt_sub (distance,
 10104                     interpreter->state.single_width_value);
 10105 
 10106   if (delta < 0)
 10107     delta = -delta;
 10108 
 10109   if (delta < interpreter->state.sw_cut_in)
 10110     {
 10111       /* Use the single width instead, as the CVT entry is too
 10112          small.  */
 10113 
 10114       if (distance >= 0)
 10115         distance = interpreter->state.single_width_value;
 10116       else
 10117         distance = -interpreter->state.single_width_value;
 10118     }
 10119 
 10120   /* Load the reference point.  */
 10121   sfnt_address_zp0 (interpreter, interpreter->state.rp0,
 10122                     &rx, &ry, &org_rx, &org_ry);
 10123 
 10124   /* Create the point in the twilight zone, should that be ZP1.  */
 10125 
 10126   if (!interpreter->state.zp1)
 10127     {
 10128       /* Since P hasn't been loaded yet, whether or not it is valid is
 10129          not known.  */
 10130       sfnt_check_zp1 (interpreter, p);
 10131 
 10132       interpreter->twilight_x[p] = rx;
 10133       interpreter->twilight_y[p] = ry;
 10134 
 10135       temp = sfnt_mul_f2dot14 (interpreter->state.projection_vector.x,
 10136                                distance);
 10137       temp = sfnt_add (temp, org_rx);
 10138       interpreter->twilight_original_x[p] = temp;
 10139 
 10140       temp = sfnt_mul_f2dot14 (interpreter->state.projection_vector.y,
 10141                                distance);
 10142       temp = sfnt_add (temp, org_ry);
 10143       interpreter->twilight_original_y[p] = temp;
 10144     }
 10145 
 10146   /* Load P.  */
 10147   sfnt_address_zp1 (interpreter, p, &x, &y, &org_x, &org_y);
 10148 
 10149   /* If distance would be negative and auto_flip is on, flip it.  */
 10150 
 10151   original_projection = DUAL_PROJECT (org_x - org_rx,
 10152                                       org_y - org_ry);
 10153   current_projection = PROJECT (x - rx, y - ry);
 10154 
 10155   if (interpreter->state.auto_flip)
 10156     {
 10157       if ((original_projection ^ distance) < 0)
 10158         distance = -distance;
 10159     }
 10160 
 10161   /* Flag B means look at the cvt cut in and round the
 10162      distance.  */
 10163 
 10164   if (opcode & 4)
 10165     {
 10166       delta = sfnt_sub (distance, original_projection);
 10167 
 10168       if (delta < 0)
 10169         delta = -delta;
 10170 
 10171       if (delta > interpreter->state.cvt_cut_in)
 10172         distance = original_projection;
 10173 
 10174       /* Now, round the distance.  */
 10175       distance = sfnt_round_symmetric (interpreter, distance);
 10176     }
 10177 
 10178   /* Flag C means look at the minimum distance.  */
 10179 
 10180   if (opcode & 8)
 10181     {
 10182       if (original_projection >= 0
 10183           && distance < interpreter->state.minimum_distance)
 10184         distance = interpreter->state.minimum_distance;
 10185       else if (original_projection < 0
 10186                && distance > -interpreter->state.minimum_distance)
 10187         distance = -interpreter->state.minimum_distance;
 10188     }
 10189 
 10190   /* Finally, move the point.  */
 10191   sfnt_move_zp1 (interpreter, p, 1,
 10192                  sfnt_sub (distance, current_projection));
 10193 
 10194   /* Set RP1 to RP0 and RP2 to the point.  If flag 3 is set, also make
 10195      it RP0.  */
 10196   interpreter->state.rp1 = interpreter->state.rp0;
 10197   interpreter->state.rp2 = p;
 10198 
 10199   if (opcode & 16)
 10200     interpreter->state.rp0 = p;
 10201 }
 10202 
 10203 /* Interpret an MDRP instruction with the specified OPCODE in
 10204    INTERPRETER.  Pop a point in ZP1, and move the point until its
 10205    distance from RP0 in ZP0 is the same as in the original outline.
 10206 
 10207    This is almost like MIRP[abcde].
 10208 
 10209    OPCODE contains a great many flags.
 10210    They are all described in the TrueType reference manual.  */
 10211 
 10212 static void
 10213 sfnt_interpret_mdrp (struct sfnt_interpreter *interpreter,
 10214                      uint32_t opcode)
 10215 {
 10216   uint32_t p;
 10217   sfnt_f26dot6 distance, delta;
 10218   sfnt_f26dot6 current_projection, original_projection;
 10219   sfnt_f26dot6 x, y, org_x, org_y;
 10220   sfnt_f26dot6 rx, ry, org_rx, org_ry;
 10221 
 10222   /* Point number.  */
 10223   p = POP ();
 10224 
 10225   /* Load the points.  */
 10226   sfnt_address_zp1 (interpreter, p, &x, &y, &org_x, &org_y);
 10227   sfnt_address_zp0 (interpreter, interpreter->state.rp0,
 10228                     &rx, &ry, &org_rx, &org_ry);
 10229 
 10230   distance = DUAL_PROJECT (org_x - org_rx,
 10231                            org_y - org_ry);
 10232   original_projection = distance;
 10233   current_projection = PROJECT (x - rx, y - ry);
 10234 
 10235   /* Test against the single width value.  */
 10236 
 10237   delta = sfnt_sub (distance,
 10238                     interpreter->state.single_width_value);
 10239 
 10240   if (delta < 0)
 10241     delta = -delta;
 10242 
 10243   if (delta < interpreter->state.sw_cut_in)
 10244     {
 10245       /* Use the single width instead, as the CVT entry is too
 10246          small.  */
 10247 
 10248       if (distance >= 0)
 10249         distance = interpreter->state.single_width_value;
 10250       else
 10251         distance = -interpreter->state.single_width_value;
 10252     }
 10253 
 10254   /* Flag B means look at the cvt cut in and round the
 10255      distance.  */
 10256 
 10257   if (opcode & 4)
 10258     {
 10259       delta = sfnt_sub (distance, original_projection);
 10260 
 10261       if (delta < 0)
 10262         delta = -delta;
 10263 
 10264       if (delta > interpreter->state.cvt_cut_in)
 10265         distance = original_projection;
 10266 
 10267       /* Now, round the distance.  */
 10268       distance = sfnt_round_symmetric (interpreter, distance);
 10269     }
 10270 
 10271   /* Flag C means look at the minimum distance.  */
 10272 
 10273   if (opcode & 8)
 10274     {
 10275       if (original_projection >= 0
 10276           && distance < interpreter->state.minimum_distance)
 10277         distance = interpreter->state.minimum_distance;
 10278       else if (original_projection < 0
 10279                && distance > -interpreter->state.minimum_distance)
 10280         distance = -interpreter->state.minimum_distance;
 10281     }
 10282 
 10283   /* Finally, move the point.  */
 10284   sfnt_move_zp1 (interpreter, p, 1,
 10285                  sfnt_sub (distance, current_projection));
 10286 
 10287   /* Set RP1 to RP0 and RP2 to the point.  If flag 3 is set, also make
 10288      it RP0.  */
 10289   interpreter->state.rp1 = interpreter->state.rp0;
 10290   interpreter->state.rp2 = p;
 10291 
 10292   if (opcode & 16)
 10293     interpreter->state.rp0 = p;
 10294 }
 10295 
 10296 /* Execute the program now loaded into INTERPRETER.
 10297    WHY specifies why the interpreter is being run, and is used to
 10298    control the behavior of instructions such IDEF[] and FDEF[].
 10299 
 10300    Transfer control to INTERPRETER->trap if interpretation is aborted
 10301    due to an error, and set INTERPRETER->trap_reason to a string
 10302    describing the error.
 10303 
 10304    INTERPRETER->glyph_zone should be cleared before calling this
 10305    function.  */
 10306 
 10307 static void
 10308 sfnt_interpret_run (struct sfnt_interpreter *interpreter,
 10309                     enum sfnt_interpreter_run_context why)
 10310 {
 10311   unsigned char opcode;
 10312   bool is_prep;
 10313 
 10314   /* Determine whether or not this is the control value program.  */
 10315   is_prep = (why == SFNT_RUN_CONTEXT_CONTROL_VALUE_PROGRAM);
 10316 
 10317 #ifdef TEST
 10318   /* Allow testing control value program instructions as well.  */
 10319   if (why == SFNT_RUN_CONTEXT_TEST)
 10320     is_prep = true;
 10321 #endif
 10322 
 10323   while (interpreter->IP < interpreter->num_instructions)
 10324     {
 10325       opcode = interpreter->instructions[interpreter->IP];
 10326 
 10327 #ifdef TEST
 10328       if (interpreter->run_hook)
 10329         interpreter->run_hook (interpreter);
 10330 #endif
 10331 
 10332       switch (opcode)
 10333         {
 10334         case 0x00:  /* SVTCA y  */
 10335           SVTCAy ();
 10336           break;
 10337 
 10338         case 0x01:  /* SVTCA x  */
 10339           SVTCAx ();
 10340           break;
 10341 
 10342         case 0x02:  /* SPvTCA y */
 10343           SPvTCAy ();
 10344           break;
 10345 
 10346         case 0x03:  /* SPvTCA x */
 10347           SPvTCAx ();
 10348           break;
 10349 
 10350         case 0x04:  /* SFvTCA y */
 10351           SFvTCAy ();
 10352           break;
 10353 
 10354         case 0x05:  /* SFvTCA x */
 10355           SFvTCAx ();
 10356           break;
 10357 
 10358         case 0x06: /* SPvTL // */
 10359         case 0x07: /* SPvTL +  */
 10360           SPVTL ();
 10361           break;
 10362 
 10363         case 0x08:  /* SFvTL // */
 10364         case 0x09:  /* SFvTL +  */
 10365           SFVTL ();
 10366           break;
 10367 
 10368         case 0x0A:  /* SPvFS */
 10369           SPVFS ();
 10370           break;
 10371 
 10372         case 0x0B:  /* SFvFS */
 10373           SFVFS ();
 10374           break;
 10375 
 10376         case 0x0C:  /* GPv */
 10377           GPV ();
 10378           break;
 10379 
 10380         case 0x0D:  /* GFv */
 10381           GFV ();
 10382           break;
 10383 
 10384         case 0x0E:  /* SFvTPv */
 10385           SFVTPV ();
 10386           break;
 10387 
 10388         case 0x0F:  /* ISECT  */
 10389           ISECT ();
 10390           break;
 10391 
 10392         case 0x10:  /* SRP0 */
 10393           SRP0 ();
 10394           break;
 10395 
 10396         case 0x11:  /* SRP1 */
 10397           SRP1 ();
 10398           break;
 10399 
 10400         case 0x12:  /* SRP2 */
 10401           SRP2 ();
 10402           break;
 10403 
 10404         case 0x13:  /* SZP0 */
 10405           SZP0 ();
 10406           break;
 10407 
 10408         case 0x14:  /* SZP1 */
 10409           SZP1 ();
 10410           break;
 10411 
 10412         case 0x15:  /* SZP2 */
 10413           SZP2 ();
 10414           break;
 10415 
 10416         case 0x16:  /* SZPS */
 10417           SZPS ();
 10418           break;
 10419 
 10420         case 0x17:  /* SLOOP */
 10421           SLOOP ();
 10422           break;
 10423 
 10424         case 0x18:  /* RTG */
 10425           RTG ();
 10426           break;
 10427 
 10428         case 0x19:  /* RTHG */
 10429           RTHG ();
 10430           break;
 10431 
 10432         case 0x1A:  /* SMD */
 10433           SMD ();
 10434           break;
 10435 
 10436         case 0x1B:  /* ELSE */
 10437           ELSE ();
 10438           break;
 10439 
 10440         case 0x1C:  /* JMPR */
 10441           JMPR ();
 10442           break;
 10443 
 10444         case 0x1D:  /* SCVTCI */
 10445           SCVTCI ();
 10446           break;
 10447 
 10448         case 0x1E:  /* SSWCI */
 10449           SSWCI ();
 10450           break;
 10451 
 10452         case 0x1F:  /* SSW */
 10453           SSW ();
 10454           break;
 10455 
 10456         case 0x20:  /* DUP */
 10457           DUP ();
 10458           break;
 10459 
 10460         case 0x21:  /* POP */
 10461           POP ();
 10462           break;
 10463 
 10464         case 0x22:  /* CLEAR */
 10465           CLEAR ();
 10466           break;
 10467 
 10468         case 0x23:  /* SWAP */
 10469           SWAP ();
 10470           break;
 10471 
 10472         case 0x24:  /* DEPTH */
 10473           DEPTH ();
 10474           break;
 10475 
 10476         case 0x25:  /* CINDEX */
 10477           CINDEX ();
 10478           break;
 10479 
 10480         case 0x26:  /* MINDEX */
 10481           MINDEX ();
 10482           break;
 10483 
 10484         case 0x27:  /* ALIGNPTS */
 10485           ALIGNPTS ();
 10486           break;
 10487 
 10488         case 0x28:  /* RAW */
 10489           RAW ();
 10490           break;
 10491 
 10492         case 0x29:  /* UTP */
 10493           UTP ();
 10494           break;
 10495 
 10496         case 0x2A:  /* LOOPCALL */
 10497           LOOPCALL ();
 10498           break;
 10499 
 10500         case 0x2B:  /* CALL */
 10501           CALL ();
 10502           break;
 10503 
 10504         case 0x2C:  /* FDEF */
 10505           FDEF ();
 10506           break;
 10507 
 10508         case 0x2D:  /* ENDF */
 10509           ENDF ();
 10510           break;
 10511 
 10512         case 0x2E:  /* MDAP */
 10513         case 0x2F:  /* MDAP */
 10514           MDAP ();
 10515           break;
 10516 
 10517         case 0x30:  /* IUP */
 10518         case 0x31:  /* IUP */
 10519           IUP ();
 10520           break;
 10521 
 10522         case 0x32:  /* SHP */
 10523         case 0x33:  /* SHP */
 10524           SHP ();
 10525           break;
 10526 
 10527         case 0x34:  /* SHC */
 10528         case 0x35:  /* SHC */
 10529           SHC ();
 10530           break;
 10531 
 10532         case 0x36:  /* SHZ */
 10533         case 0x37:  /* SHZ */
 10534           SHZ ();
 10535           break;
 10536 
 10537         case 0x38:  /* SHPIX */
 10538           SHPIX ();
 10539           break;
 10540 
 10541         case 0x39:  /* IP    */
 10542           IP ();
 10543           break;
 10544 
 10545         case 0x3A:  /* MSIRP */
 10546         case 0x3B:  /* MSIRP */
 10547           MSIRP ();
 10548           break;
 10549 
 10550         case 0x3C:  /* ALIGNRP */
 10551           ALIGNRP ();
 10552           break;
 10553 
 10554         case 0x3D:  /* RTDG */
 10555           RTDG ();
 10556           break;
 10557 
 10558         case 0x3E:  /* MIAP */
 10559         case 0x3F:  /* MIAP */
 10560           MIAP ();
 10561           break;
 10562 
 10563         case 0x40:  /* NPUSHB */
 10564           NPUSHB ();
 10565           break;
 10566 
 10567         case 0x41:  /* NPUSHW */
 10568           NPUSHW ();
 10569           break;
 10570 
 10571         case 0x42:  /* WS */
 10572           WS ();
 10573           break;
 10574 
 10575         case 0x43:  /* RS */
 10576           RS ();
 10577           break;
 10578 
 10579         case 0x44:  /* WCVTP */
 10580           WCVTP ();
 10581           break;
 10582 
 10583         case 0x45:  /* RCVT */
 10584           RCVT ();
 10585           break;
 10586 
 10587         case 0x46:  /* GC */
 10588         case 0x47:  /* GC */
 10589           GC ();
 10590           break;
 10591 
 10592         case 0x48:  /* SCFS */
 10593           SCFS ();
 10594           break;
 10595 
 10596         case 0x49:  /* MD */
 10597         case 0x4A:  /* MD */
 10598           MD ();
 10599           break;
 10600 
 10601         case 0x4B:  /* MPPEM */
 10602           MPPEM ();
 10603           break;
 10604 
 10605         case 0x4C:  /* MPS */
 10606           MPS ();
 10607           break;
 10608 
 10609         case 0x4D:  /* FLIPON */
 10610           FLIPON ();
 10611           break;
 10612 
 10613         case 0x4E:  /* FLIPOFF */
 10614           FLIPOFF ();
 10615           break;
 10616 
 10617         case 0x4F:  /* DEBUG */
 10618           DEBUG ();
 10619           break;
 10620 
 10621         case 0x50:  /* LT */
 10622           LT ();
 10623           break;
 10624 
 10625         case 0x51:  /* LTEQ */
 10626           LTEQ ();
 10627           break;
 10628 
 10629         case 0x52:  /* GT */
 10630           GT ();
 10631           break;
 10632 
 10633         case 0x53:  /* GTEQ */
 10634           GTEQ ();
 10635           break;
 10636 
 10637         case 0x54:  /* EQ */
 10638           EQ ();
 10639           break;
 10640 
 10641         case 0x55:  /* NEQ */
 10642           NEQ ();
 10643           break;
 10644 
 10645         case 0x56:  /* ODD */
 10646           ODD ();
 10647           break;
 10648 
 10649         case 0x57:  /* EVEN */
 10650           EVEN ();
 10651           break;
 10652 
 10653         case 0x58:  /* IF */
 10654           IF ();
 10655           break;
 10656 
 10657         case 0x59:  /* EIF */
 10658           EIF ();
 10659           break;
 10660 
 10661         case 0x5A:  /* AND */
 10662           AND ();
 10663           break;
 10664 
 10665         case 0x5B:  /* OR */
 10666           OR ();
 10667           break;
 10668 
 10669         case 0x5C:  /* NOT */
 10670           NOT ();
 10671           break;
 10672 
 10673         case 0x5D:  /* DELTAP1 */
 10674           DELTAP1 ();
 10675           break;
 10676 
 10677         case 0x5E:  /* SDB */
 10678           SDB ();
 10679           break;
 10680 
 10681         case 0x5F:  /* SDS */
 10682           SDS ();
 10683           break;
 10684 
 10685         case 0x60:  /* ADD */
 10686           ADD ();
 10687           break;
 10688 
 10689         case 0x61:  /* SUB */
 10690           SUB ();
 10691           break;
 10692 
 10693         case 0x62:  /* DIV */
 10694           DIV ();
 10695           break;
 10696 
 10697         case 0x63:  /* MUL */
 10698           MUL ();
 10699           break;
 10700 
 10701         case 0x64:  /* ABS */
 10702           ABS ();
 10703           break;
 10704 
 10705         case 0x65:  /* NEG */
 10706           NEG ();
 10707           break;
 10708 
 10709         case 0x66:  /* FLOOR */
 10710           FLOOR ();
 10711           break;
 10712 
 10713         case 0x67:  /* CEILING */
 10714           CEILING ();
 10715           break;
 10716 
 10717         case 0x68:  /* ROUND */
 10718         case 0x69:  /* ROUND */
 10719         case 0x6A:  /* ROUND */
 10720         case 0x6B:  /* ROUND */
 10721           ROUND ();
 10722           break;
 10723 
 10724         case 0x6C:  /* NROUND */
 10725         case 0x6D:  /* NROUND */
 10726         case 0x6E:  /* NRRUND */
 10727         case 0x6F:  /* NROUND */
 10728           NROUND ();
 10729           break;
 10730 
 10731         case 0x70:  /* WCVTF */
 10732           WCVTF ();
 10733           break;
 10734 
 10735         case 0x71:  /* DELTAP2 */
 10736           DELTAP2 ();
 10737           break;
 10738 
 10739         case 0x72:  /* DELTAP3 */
 10740           DELTAP3 ();
 10741           break;
 10742 
 10743         case 0x73:  /* DELTAC1 */
 10744           DELTAC1 ();
 10745           break;
 10746 
 10747         case 0x74:  /* DELTAC2 */
 10748           DELTAC2 ();
 10749           break;
 10750 
 10751         case 0x75:  /* DELTAC3 */
 10752           DELTAC3 ();
 10753           break;
 10754 
 10755         case 0x76:  /* SROUND */
 10756           SROUND ();
 10757           break;
 10758 
 10759         case 0x77:  /* S45Round */
 10760           S45ROUND ();
 10761           break;
 10762 
 10763         case 0x78:  /* JROT */
 10764           JROT ();
 10765           break;
 10766 
 10767         case 0x79:  /* JROF */
 10768           JROF ();
 10769           break;
 10770 
 10771         case 0x7A:  /* ROFF */
 10772           ROFF ();
 10773           break;
 10774 
 10775         case 0x7B:  /* ILLEGAL_INSTRUCTION */
 10776           ILLEGAL_INSTRUCTION ();
 10777           break;
 10778 
 10779         case 0x7C:  /* RUTG */
 10780           RUTG ();
 10781           break;
 10782 
 10783         case 0x7D:  /* RDTG */
 10784           RDTG ();
 10785           break;
 10786 
 10787         case 0x7E:  /* SANGW */
 10788           SANGW ();
 10789           break;
 10790 
 10791         case 0x7F:  /* AA */
 10792           AA ();
 10793           break;
 10794 
 10795         case 0x80:  /* FLIPPT */
 10796           FLIPPT ();
 10797           break;
 10798 
 10799         case 0x81:  /* FLIPRGON */
 10800           FLIPRGON ();
 10801           break;
 10802 
 10803         case 0x82:  /* FLIPRGOFF */
 10804           FLIPRGOFF ();
 10805           break;
 10806 
 10807         case 0x83:  /* RMVT */
 10808         case 0x84:  /* WMVT */
 10809           NOT_IMPLEMENTED ();
 10810           break;
 10811 
 10812         case 0x85:  /* SCANCTRL */
 10813           SCANCTRL ();
 10814           break;
 10815 
 10816         case 0x86:  /* SDPVTL */
 10817         case 0x87:  /* SDPVTL */
 10818           SDPVTL ();
 10819           break;
 10820 
 10821         case 0x88:  /* GETINFO */
 10822           GETINFO ();
 10823           break;
 10824 
 10825         case 0x89:  /* IDEF */
 10826           IDEF ();
 10827           break;
 10828 
 10829         case 0x8A:  /* ROLL */
 10830           ROLL ();
 10831           break;
 10832 
 10833         case 0x8B:  /* MAX */
 10834           _MAX ();
 10835           break;
 10836 
 10837         case 0x8C:  /* MIN */
 10838           _MIN ();
 10839           break;
 10840 
 10841           /* Scan or dropout control is not implemented.  Instead, 256
 10842              grays are used to display pixels which are partially
 10843              turned on.  */
 10844         case 0x8D:  /* SCANTYPE */
 10845           SCANTYPE ();
 10846           break;
 10847 
 10848         case 0x8E:  /* INSTCTRL */
 10849           INSTCTRL ();
 10850           break;
 10851 
 10852         case 0x8F:  /* ADJUST */
 10853         case 0x90:  /* ADJUST */
 10854           NOT_IMPLEMENTED ();
 10855           break;
 10856 
 10857         case 0x91:  /* GXAXIS */
 10858           GXAXIS ();
 10859           break;
 10860 
 10861         default:
 10862           if (opcode >= 0xE0) /* MIRP */
 10863             {
 10864               MIRP ();
 10865             }
 10866           else if (opcode >= 0xC0) /* MDRP */
 10867             {
 10868               MDRP ();
 10869             }
 10870           else if (opcode >= 0xB8) /* PUSHW */
 10871             {
 10872               PUSHW ();
 10873             }
 10874           else if (opcode >= 0xB0) /* PUSHB */
 10875             {
 10876               PUSHB ();
 10877             }
 10878           else
 10879             NOT_IMPLEMENTED ();
 10880         }
 10881 
 10882     next_instruction:
 10883       /* In the case of an NPUSHB or NPUSHW instruction,
 10884          interpreter->IP has only been increased to skip over the
 10885          extra bytes, and not the byte containing the instruction
 10886          itself.  */
 10887       interpreter->IP++;
 10888 
 10889       /* This label is used by instructions to continue without
 10890          incrementing IP.  It is used by instructions which set IP
 10891          themselves, such as ELSE, IF, FDEF, IDEF and JMPR.  */
 10892     skip_step:
 10893       continue;
 10894     }
 10895 }
 10896 
 10897 /* Execute the font program FPGM using INTERPRETER.
 10898    This must only be called once per interpreter, else behavior is
 10899    undefined.
 10900 
 10901    Value is NULL upon success, else it is a string describing the
 10902    reason for failure.
 10903 
 10904    The caller must save the graphics state after interpreting the font
 10905    program and restore it prior to instructing each glyph.  */
 10906 
 10907 TEST_STATIC const char *
 10908 sfnt_interpret_font_program (struct sfnt_interpreter *interpreter,
 10909                              struct sfnt_fpgm_table *fpgm)
 10910 {
 10911   if (setjmp (interpreter->trap))
 10912     return interpreter->trap_reason;
 10913 
 10914   /* Set up the interpreter to evaluate the font program.  */
 10915   interpreter->IP = 0;
 10916   interpreter->SP = interpreter->stack;
 10917   interpreter->instructions = fpgm->instructions;
 10918   interpreter->num_instructions = fpgm->num_instructions;
 10919   interpreter->glyph_zone = NULL;
 10920 
 10921   sfnt_interpret_run (interpreter, SFNT_RUN_CONTEXT_FONT_PROGRAM);
 10922   return NULL;
 10923 }
 10924 
 10925 /* Execute the control value program PREP using INTERPRETER.
 10926 
 10927    Return NULL and the graphics state after the execution of the
 10928    program in *STATE, or a string describing the reason for a failure
 10929    to interpret the program.
 10930 
 10931    The caller must save the graphics state after interpreting the
 10932    control value program and restore it prior to instructing each
 10933    glyph.  */
 10934 
 10935 TEST_STATIC const char *
 10936 sfnt_interpret_control_value_program (struct sfnt_interpreter *interpreter,
 10937                                       struct sfnt_prep_table *prep,
 10938                                       struct sfnt_graphics_state *state)
 10939 {
 10940   if (setjmp (interpreter->trap))
 10941     return interpreter->trap_reason;
 10942 
 10943   /* Set up the interpreter to evaluate the control value program.  */
 10944   interpreter->IP = 0;
 10945   interpreter->SP = interpreter->stack;
 10946   interpreter->instructions = prep->instructions;
 10947   interpreter->num_instructions = prep->num_instructions;
 10948   interpreter->glyph_zone = NULL;
 10949 
 10950   sfnt_interpret_run (interpreter,
 10951                       SFNT_RUN_CONTEXT_CONTROL_VALUE_PROGRAM);
 10952 
 10953   /* If instruct_control & 4, then changes to the graphics state made
 10954      in this program should be reverted.  */
 10955 
 10956   if (interpreter->state.instruct_control & 4)
 10957     sfnt_init_graphics_state (&interpreter->state);
 10958 
 10959   /* Save the graphics state upon success.  */
 10960   memcpy (state, &interpreter->state, sizeof *state);
 10961   return NULL;
 10962 }
 10963 
 10964 
 10965 
 10966 /* Glyph hinting.  The routines here perform hinting on simple and
 10967    compound glyphs.
 10968 
 10969    In order to keep the hinting mechanism separate from the rest of
 10970    the code, the routines here perform outline decomposition and
 10971    scaling separately.  It might be nice to fix that in the
 10972    future.  */
 10973 
 10974 /* Instructed glyph outline decomposition.  This is separate from
 10975    sfnt_decompose_glyph because this file should be able to be built
 10976    with instructions disabled.  */
 10977 
 10978 /* Decompose OUTLINE, an instructed outline, into its individual
 10979    components.
 10980 
 10981    Call MOVE_TO to move to a specific location.  For each line
 10982    encountered, call LINE_TO to draw a line to that location.  For
 10983    each spline encountered, call CURVE_TO to draw the curves
 10984    comprising the spline.  Call each of those functions with 16.16
 10985    fixed point coordinates.
 10986 
 10987    Call all functions with DCONTEXT as an argument.
 10988 
 10989    The winding rule used to fill the resulting lines is described in
 10990    chapter 2 of the TrueType reference manual, under the heading
 10991    "distinguishing the inside from the outside of a glyph."
 10992 
 10993    Value is 0 upon success, or some non-zero value upon failure, which
 10994    can happen if the glyph is invalid.  */
 10995 
 10996 static int
 10997 sfnt_decompose_instructed_outline (struct sfnt_instructed_outline *outline,
 10998                                    sfnt_move_to_proc move_to,
 10999                                    sfnt_line_to_proc line_to,
 11000                                    sfnt_curve_to_proc curve_to,
 11001                                    void *dcontext)
 11002 {
 11003   size_t here, last, n;
 11004 
 11005   if (!outline->num_contours)
 11006     return 0;
 11007 
 11008   here = 0;
 11009 
 11010   for (n = 0; n < outline->num_contours; ++n)
 11011     {
 11012       /* here is the first index into the glyph's point arrays
 11013          belonging to the contour in question.  last is the index
 11014          of the last point in the contour.  */
 11015       last = outline->contour_end_points[n];
 11016 
 11017       /* Make sure here and last make sense.  */
 11018 
 11019       if (here > last || last >= outline->num_points)
 11020         goto fail;
 11021 
 11022       if (sfnt_decompose_glyph_2 (here, last, move_to,
 11023                                   line_to, curve_to, dcontext,
 11024                                   outline->x_points,
 11025                                   outline->y_points,
 11026                                   outline->flags, 1024))
 11027         goto fail;
 11028 
 11029       /* Move forward to the start of the next contour.  */
 11030       here = last + 1;
 11031 
 11032       /* here may be a phantom point when outlining a compound glyph,
 11033          as they can have phantom points mixed in with contours.
 11034 
 11035          When that happens, skip past all the phantom points.  */
 11036 
 11037       while (here < outline->num_points
 11038              && outline->flags[here] & SFNT_POINT_PHANTOM)
 11039         here++;
 11040     }
 11041 
 11042   return 0;
 11043 
 11044  fail:
 11045   return 1;
 11046 }
 11047 
 11048 /* Decompose and build an outline for the specified instructed outline
 11049    INSTRUCTED.  Return the outline data with a refcount of 0 upon
 11050    success, or NULL upon failure.
 11051 
 11052    This function is not reentrant.  */
 11053 
 11054 TEST_STATIC struct sfnt_glyph_outline *
 11055 sfnt_build_instructed_outline (struct sfnt_instructed_outline *instructed)
 11056 {
 11057   struct sfnt_glyph_outline *outline;
 11058   int rc;
 11059 
 11060   memset (&build_outline_context, 0, sizeof build_outline_context);
 11061 
 11062   /* Allocate the outline now with enough for 44 words at the end.  */
 11063   outline = xmalloc (sizeof *outline + 40 * sizeof (*outline->outline));
 11064   outline->outline_size = 40;
 11065   outline->outline_used = 0;
 11066   outline->refcount = 0;
 11067   outline->outline
 11068     = (struct sfnt_glyph_outline_command *) (outline + 1);
 11069 
 11070   /* Clear outline bounding box.  */
 11071   outline->xmin = 0;
 11072   outline->ymin = 0;
 11073   outline->xmax = 0;
 11074   outline->ymax = 0;
 11075 
 11076   /* Set up the context.  */
 11077   build_outline_context.outline = outline;
 11078   build_outline_context.factor = 0177777;
 11079 
 11080   /* Start decomposing.  */
 11081   rc = sfnt_decompose_instructed_outline (instructed,
 11082                                           sfnt_move_to_and_build,
 11083                                           sfnt_line_to_and_build,
 11084                                           sfnt_curve_to_and_build,
 11085                                           NULL);
 11086 
 11087   /* Synchronize the outline object with what might have changed
 11088      inside sfnt_decompose_glyph.  */
 11089   outline = build_outline_context.outline;
 11090 
 11091   /* Finally, obtain the origin point of the glyph after it has been
 11092      instructed.  */
 11093 
 11094   if (instructed->num_points > 1)
 11095     outline->origin
 11096       = instructed->x_points[instructed->num_points - 2];
 11097   else
 11098     outline->origin = 0;
 11099 
 11100   if (rc)
 11101     {
 11102       xfree (outline);
 11103       return NULL;
 11104     }
 11105 
 11106   return outline;
 11107 }
 11108 
 11109 
 11110 
 11111 /* Compute phantom points for the specified glyph GLYPH.  Use the
 11112    unscaled metrics specified in METRICS, and the 16.16 fixed point
 11113    scale SCALE.
 11114 
 11115    Place the X and Y coordinates of the first phantom point in *X1 and
 11116    *Y1, and those of the second phantom point in *X2 and *Y2.  */
 11117 
 11118 static void
 11119 sfnt_compute_phantom_points (struct sfnt_glyph *glyph,
 11120                              struct sfnt_glyph_metrics *metrics,
 11121                              sfnt_fixed scale,
 11122                              sfnt_f26dot6 *x1, sfnt_f26dot6 *y1,
 11123                              sfnt_f26dot6 *x2, sfnt_f26dot6 *y2)
 11124 {
 11125   sfnt_fword f1, f2;
 11126 
 11127   /* Two ``phantom points'' are appended to each outline by the scaler
 11128      prior to instruction interpretation.  One of these points
 11129      represents the left-side bearing distance from xmin, while the
 11130      other represents the advance width.  Both are then used after the
 11131      hinting process to ensure that the reported glyph metrics are
 11132      consistent with the instructed outline.  */
 11133 
 11134   /* First compute both values in fwords.  */
 11135   f1 = glyph->xmin - metrics->lbearing;
 11136   f2 = f1 + metrics->advance;
 11137 
 11138   /* Apply the metrics distortion.  */
 11139   f1 += glyph->origin_distortion;
 11140   f2 += glyph->advance_distortion;
 11141 
 11142   /* Next, scale both up.  */
 11143   *x1 = sfnt_mul_f26dot6_fixed (f1 * 64, scale);
 11144   *x2 = sfnt_mul_f26dot6_fixed (f2 * 64, scale);
 11145 
 11146   /* Clear y1 and y2.  */
 11147   *y1 = 0;
 11148   *y2 = 0;
 11149 }
 11150 
 11151 /* Load the simple glyph GLYPH into the specified INTERPRETER, scaling
 11152    it up by INTERPRETER's scale, and run its glyph program if
 11153    present.  Use the unscaled metrics specified in METRICS.
 11154 
 11155    Upon success, return NULL and the resulting points and contours in
 11156    *VALUE.  Else, value is the reason interpretation failed.  */
 11157 
 11158 TEST_STATIC const char *
 11159 sfnt_interpret_simple_glyph (struct sfnt_glyph *glyph,
 11160                              struct sfnt_interpreter *interpreter,
 11161                              struct sfnt_glyph_metrics *metrics,
 11162                              struct sfnt_instructed_outline **value)
 11163 {
 11164   size_t zone_size, temp, outline_size, i;
 11165   struct sfnt_interpreter_zone *zone;
 11166   struct sfnt_interpreter_zone *volatile preserved_zone;
 11167   sfnt_f26dot6 phantom_point_1_x;
 11168   sfnt_f26dot6 phantom_point_1_y;
 11169   sfnt_f26dot6 phantom_point_2_x;
 11170   sfnt_f26dot6 phantom_point_2_y;
 11171   sfnt_f26dot6 tem;
 11172   volatile bool zone_was_allocated;
 11173   struct sfnt_instructed_outline *outline;
 11174 
 11175   zone_size = 0;
 11176   zone_was_allocated = false;
 11177 
 11178   /* Calculate the size of the zone structure.  */
 11179 
 11180   if (INT_MULTIPLY_WRAPV (glyph->simple->number_of_points + 2,
 11181                           sizeof *zone->x_points * 4,
 11182                           &temp)
 11183       || INT_ADD_WRAPV (temp, zone_size, &zone_size)
 11184       || INT_MULTIPLY_WRAPV (glyph->number_of_contours,
 11185                              sizeof *zone->contour_end_points,
 11186                              &temp)
 11187       || INT_ADD_WRAPV (temp, zone_size, &zone_size)
 11188       || INT_MULTIPLY_WRAPV (glyph->simple->number_of_points + 2,
 11189                              sizeof *zone->flags,
 11190                              &temp)
 11191       || INT_ADD_WRAPV (temp, zone_size, &zone_size)
 11192       || INT_ADD_WRAPV (sizeof *zone, zone_size, &zone_size))
 11193     return "Glyph exceeded maximum permissible size";
 11194 
 11195   /* Don't use malloc if possible.  */
 11196 
 11197   if (zone_size <= 1024 * 16)
 11198     zone = alloca (zone_size);
 11199   else
 11200     {
 11201       zone = xmalloc (zone_size);
 11202       zone_was_allocated = true;
 11203     }
 11204 
 11205   /* Now load the zone with data.  */
 11206   zone->num_points = glyph->simple->number_of_points + 2;
 11207   zone->num_contours = glyph->number_of_contours;
 11208   zone->contour_end_points = (size_t *) (zone + 1);
 11209   zone->x_points = (sfnt_f26dot6 *) (zone->contour_end_points
 11210                                      + zone->num_contours);
 11211   zone->x_current = zone->x_points + zone->num_points;
 11212   zone->y_points = zone->x_current + zone->num_points;
 11213   zone->y_current = zone->y_points + zone->num_points;
 11214   zone->flags = (unsigned char *) (zone->y_current
 11215                                    + zone->num_points);
 11216 
 11217   /* Load x_points and x_current.  */
 11218   for (i = 0; i < glyph->simple->number_of_points; ++i)
 11219     {
 11220       /* Load the fword.  */
 11221       tem = glyph->simple->x_coordinates[i];
 11222 
 11223       /* Scale that fword.  */
 11224       tem = sfnt_mul_f26dot6_fixed (tem * 64, interpreter->scale);
 11225 
 11226       /* Set x_points and x_current.  */
 11227       zone->x_points[i] = tem;
 11228       zone->x_current[i] = tem;
 11229     }
 11230 
 11231   /* Compute phantom points.  */
 11232   sfnt_compute_phantom_points (glyph, metrics, interpreter->scale,
 11233                                &phantom_point_1_x, &phantom_point_1_y,
 11234                                &phantom_point_2_x, &phantom_point_2_y);
 11235 
 11236   /* Load phantom points.  */
 11237   zone->x_points[i] = phantom_point_1_x;
 11238   zone->x_points[i + 1] = phantom_point_2_x;
 11239   zone->x_current[i] = phantom_point_1_x;
 11240   zone->x_current[i + 1] = phantom_point_2_x;
 11241 
 11242   /* Load y_points and y_current, along with flags.  */
 11243   for (i = 0; i < glyph->simple->number_of_points; ++i)
 11244     {
 11245       /* Load the fword.  */
 11246       tem = glyph->simple->y_coordinates[i];
 11247 
 11248       /* Scale that fword.  Make sure not to round Y, as this could
 11249          lead to Y spilling over to the next line.  */
 11250       tem = sfnt_mul_fixed (tem * 64, interpreter->scale);
 11251 
 11252       /* Set y_points and y_current.  */
 11253       zone->y_points[i] = tem;
 11254       zone->y_current[i] = tem;
 11255 
 11256       /* Set flags.  */
 11257       zone->flags[i] = (glyph->simple->flags[i]
 11258                         & ~SFNT_POINT_TOUCHED_BOTH);
 11259 
 11260       /* Make sure to clear the phantom points flag.  */
 11261       zone->flags[i] &= ~SFNT_POINT_PHANTOM;
 11262     }
 11263 
 11264   /* Load phantom points.  */
 11265   zone->y_points[i] = phantom_point_1_y;
 11266   zone->y_points[i + 1] = phantom_point_2_y;
 11267   zone->y_current[i] = phantom_point_1_x;
 11268   zone->y_current[i + 1] = phantom_point_2_x;
 11269 
 11270   /* Load phantom point flags.  */
 11271   zone->flags[i] = SFNT_POINT_PHANTOM;
 11272   zone->flags[i + 1] = SFNT_POINT_PHANTOM;
 11273 
 11274   /* Load contour end points.  */
 11275   for (i = 0; i < zone->num_contours; ++i)
 11276     zone->contour_end_points[i]
 11277       = glyph->simple->end_pts_of_contours[i];
 11278 
 11279   /* Load the glyph program.  */
 11280   interpreter->IP = 0;
 11281   interpreter->SP = interpreter->stack;
 11282   interpreter->instructions = glyph->simple->instructions;
 11283   interpreter->num_instructions = glyph->simple->instruction_length;
 11284   interpreter->glyph_zone = zone;
 11285 
 11286   /* Copy zone over to this volatile variable.  */
 11287   preserved_zone = zone;
 11288 
 11289   if (setjmp (interpreter->trap))
 11290     {
 11291       if (zone_was_allocated)
 11292         xfree (preserved_zone);
 11293 
 11294       interpreter->glyph_zone = NULL;
 11295       return interpreter->trap_reason;
 11296     }
 11297 
 11298   sfnt_interpret_run (interpreter, SFNT_RUN_CONTEXT_GLYPH_PROGRAM);
 11299   interpreter->glyph_zone = NULL;
 11300 
 11301   /* Move preserved_zone back to zone.  */
 11302   zone = preserved_zone;
 11303 
 11304   /* Now that the program has been run, build the scaled outline.  */
 11305 
 11306   outline_size = sizeof (*outline);
 11307   outline_size += (zone->num_contours
 11308                    * sizeof *outline->contour_end_points);
 11309   outline_size += (zone->num_points
 11310                    * sizeof *outline->x_points * 2);
 11311   outline_size += zone->num_points;
 11312 
 11313   /* Allocate the outline.  */
 11314   outline = xmalloc (outline_size);
 11315   outline->num_points = zone->num_points;
 11316   outline->num_contours = zone->num_contours;
 11317   outline->contour_end_points = (size_t *) (outline + 1);
 11318   outline->x_points = (sfnt_f26dot6 *) (outline->contour_end_points
 11319                                         + outline->num_contours);
 11320   outline->y_points = outline->x_points + outline->num_points;
 11321   outline->flags = (unsigned char *) (outline->y_points
 11322                                       + outline->num_points);
 11323 
 11324   /* Copy over the contour endpoints, points, and flags.  */
 11325   memcpy (outline->contour_end_points, zone->contour_end_points,
 11326           zone->num_contours * sizeof *outline->contour_end_points);
 11327   memcpy (outline->x_points, zone->x_current,
 11328           zone->num_points * sizeof *outline->x_points);
 11329   memcpy (outline->y_points, zone->y_current,
 11330           zone->num_points * sizeof *outline->y_points);
 11331   memcpy (outline->flags, zone->flags, zone->num_points);
 11332 
 11333   /* Free the zone if necessary.  */
 11334   if (zone_was_allocated)
 11335     xfree (zone);
 11336 
 11337   /* Return the outline and NULL.  */
 11338   *value = outline;
 11339   return NULL;
 11340 }
 11341 
 11342 /* Apply the transform in the compound glyph component COMPONENT to
 11343    the array of points of length NUM_COORDINATES given as X and Y.
 11344 
 11345    Treat X and Y as arrays of 26.6 fixed point values.
 11346 
 11347    Also, apply the 26.6 fixed point offsets X_OFF and Y_OFF to each X
 11348    and Y coordinate.
 11349 
 11350    See sfnt_decompose_compound_glyph for an explanation of why offsets
 11351    might be applied here, and not while reading the subglyph
 11352    itself.  */
 11353 
 11354 static void
 11355 sfnt_transform_f26dot6 (struct sfnt_compound_glyph_component *component,
 11356                         sfnt_f26dot6 *restrict x, sfnt_f26dot6 *restrict y,
 11357                         size_t num_coordinates,
 11358                         sfnt_f26dot6 x_off, sfnt_f26dot6 y_off)
 11359 {
 11360   double m1, m2, m3;
 11361   double m4, m5, m6;
 11362   size_t i;
 11363 
 11364   if (component->flags & 010) /* WE_HAVE_A_SCALE */
 11365     {
 11366       for (i = 0; i < num_coordinates; ++i)
 11367         {
 11368           x[i] *= component->u.scale / 16384.0;
 11369           y[i] *= component->u.scale / 16384.0;
 11370           x[i] += x_off;
 11371           y[i] += y_off;
 11372         }
 11373     }
 11374   else if (component->flags & 0100) /* WE_HAVE_AN_X_AND_Y_SCALE */
 11375     {
 11376       for (i = 0; i < num_coordinates; ++i)
 11377         {
 11378           x[i] *= component->u.a.xscale / 16384.0;
 11379           y[i] *= component->u.a.yscale / 16384.0;
 11380           x[i] += x_off;
 11381           y[i] += y_off;
 11382         }
 11383     }
 11384   else if (component->flags & 0200) /* WE_HAVE_A_TWO_BY_TWO */
 11385     {
 11386       /* Apply the specified affine transformation.
 11387          A transform looks like:
 11388 
 11389            M1 M2 M3     X
 11390            M4 M5 M6   * Y
 11391 
 11392            =
 11393 
 11394            M1*X + M2*Y + M3*1 = X1
 11395            M4*X + M5*Y + M6*1 = Y1
 11396 
 11397          (In most transforms, there is another row at the bottom for
 11398           mathematical reasons.  Since Z1 is always 1.0, the row is
 11399           simply implied to be 0 0 1, because 0 * x + 0 * y + 1 * 1 =
 11400           1.0.  See the definition of matrix3x3 in image.c for some
 11401           more explanations about this.) */
 11402       m1 = component->u.b.xscale / 16384.0;
 11403       m2 = component->u.b.scale01 / 16384.0;
 11404       m3 = 0;
 11405       m4 = component->u.b.scale10 / 16384.0;
 11406       m5 = component->u.b.yscale / 16384.0;
 11407       m6 = 0;
 11408 
 11409       for (i = 0; i < num_coordinates; ++i)
 11410         {
 11411           x[i] = m1 * x[i] + m2 * y[i] + m3 * 1;
 11412           y[i] = m4 * x[i] + m5 * y[i] + m6 * 1;
 11413           x[i] += x_off;
 11414           y[i] += y_off;
 11415         }
 11416     }
 11417 }
 11418 
 11419 /* Internal helper for sfnt_interpret_compound_glyph_3.
 11420 
 11421    Instruct the compound glyph GLYPH using INTERPRETER after all of
 11422    its components have been instructed.
 11423 
 11424    Use the unscaled METRICS to compute the phantom points of this
 11425    glyph.
 11426 
 11427    CONTEXT contains the points and contours of this compound glyph,
 11428    numbered starting from BASE_INDEX and BASE_CONTOUR respectively.
 11429 
 11430    Value is NULL upon success, or a description of the error upon
 11431    failure.  */
 11432 
 11433 static const char *
 11434 sfnt_interpret_compound_glyph_2 (struct sfnt_glyph *glyph,
 11435                                  struct sfnt_interpreter *interpreter,
 11436                                  struct sfnt_compound_glyph_context *context,
 11437                                  size_t base_index, size_t base_contour,
 11438                                  struct sfnt_glyph_metrics *metrics)
 11439 {
 11440   size_t num_points, num_contours, i;
 11441   size_t zone_size, temp;
 11442   struct sfnt_interpreter_zone *zone;
 11443   struct sfnt_interpreter_zone *volatile preserved_zone;
 11444   sfnt_f26dot6 phantom_point_1_x;
 11445   sfnt_f26dot6 phantom_point_1_y;
 11446   sfnt_f26dot6 phantom_point_2_x;
 11447   sfnt_f26dot6 phantom_point_2_y;
 11448   volatile bool zone_was_allocated;
 11449   int rc;
 11450   sfnt_f26dot6 *x_base, *y_base;
 11451   size_t *contour_base;
 11452   unsigned char *flags_base;
 11453 
 11454   /* Figure out how many points and contours there are to
 11455      instruct.  */
 11456   num_points = context->num_points - base_index;
 11457   num_contours = context->num_end_points - base_contour;
 11458 
 11459   /* Nothing to instruct! */
 11460   if (!num_points && !num_contours)
 11461     return NULL;
 11462 
 11463   /* Build the zone.  First, calculate the size of the zone
 11464      structure.  */
 11465 
 11466   zone_size = 0;
 11467   zone_was_allocated = false;
 11468 
 11469   if (INT_MULTIPLY_WRAPV (num_points + 2,
 11470                           sizeof *zone->x_points * 4,
 11471                           &temp)
 11472       || INT_ADD_WRAPV (temp, zone_size, &zone_size)
 11473       || INT_MULTIPLY_WRAPV (num_contours,
 11474                              sizeof *zone->contour_end_points,
 11475                              &temp)
 11476       || INT_ADD_WRAPV (temp, zone_size, &zone_size)
 11477       || INT_MULTIPLY_WRAPV (num_points + 2,
 11478                              sizeof *zone->flags,
 11479                              &temp)
 11480       || INT_ADD_WRAPV (temp, zone_size, &zone_size)
 11481       || INT_ADD_WRAPV (sizeof *zone, zone_size, &zone_size))
 11482     return "Glyph exceeded maximum permissible size";
 11483 
 11484   /* Don't use malloc if possible.  */
 11485 
 11486   if (zone_size <= 1024 * 16)
 11487     zone = alloca (zone_size);
 11488   else
 11489     {
 11490       zone = xmalloc (zone_size);
 11491       zone_was_allocated = true;
 11492     }
 11493 
 11494   /* Now load the zone with data.  */
 11495   zone->num_points = num_points + 2;
 11496   zone->num_contours = num_contours;
 11497   zone->contour_end_points = (size_t *) (zone + 1);
 11498   zone->x_points = (sfnt_f26dot6 *) (zone->contour_end_points
 11499                                      + zone->num_contours);
 11500   zone->x_current = zone->x_points + zone->num_points;
 11501   zone->y_points = zone->x_current + zone->num_points;
 11502   zone->y_current = zone->y_points + zone->num_points;
 11503   zone->flags = (unsigned char *) (zone->y_current
 11504                                    + zone->num_points);
 11505 
 11506   /* Copy and renumber all contour end points to start from
 11507      base_index.  */
 11508 
 11509   for (i = 0; i < zone->num_contours; ++i)
 11510     zone->contour_end_points[i]
 11511       = (context->contour_end_points[base_contour + i]
 11512          - base_index);
 11513 
 11514   /* Now copy over x_points, x_current, y_points and y_current.  */
 11515 
 11516   for (i = 0; i < num_points; ++i)
 11517     {
 11518       zone->x_current[i] = context->x_coordinates[i + base_index];
 11519       zone->x_points[i] = context->x_coordinates[i + base_index];
 11520     }
 11521 
 11522   /* Compute phantom points.  */
 11523   sfnt_compute_phantom_points (glyph, metrics, interpreter->scale,
 11524                                &phantom_point_1_x, &phantom_point_1_y,
 11525                                &phantom_point_2_x, &phantom_point_2_y);
 11526 
 11527   /* Load phantom points.  */
 11528   zone->x_points[i] = phantom_point_1_x;
 11529   zone->x_points[i + 1] = phantom_point_2_x;
 11530   zone->x_current[i] = phantom_point_1_x;
 11531   zone->x_current[i + 1] = phantom_point_2_x;
 11532 
 11533   for (i = 0; i < num_points; ++i)
 11534     {
 11535       zone->y_current[i] = context->y_coordinates[i + base_index];
 11536       zone->y_points[i] = context->y_coordinates[i + base_index];
 11537 
 11538       /* Set flags.  */
 11539       zone->flags[i] = (context->flags[i + base_index]
 11540                         & ~SFNT_POINT_TOUCHED_BOTH);
 11541     }
 11542 
 11543     /* Load phantom points.  */
 11544   zone->y_points[i] = phantom_point_1_y;
 11545   zone->y_points[i + 1] = phantom_point_2_y;
 11546   zone->y_current[i] = phantom_point_1_x;
 11547   zone->y_current[i + 1] = phantom_point_2_x;
 11548 
 11549   /* Load phantom point flags.  */
 11550   zone->flags[i] = SFNT_POINT_PHANTOM;
 11551   zone->flags[i + 1] = SFNT_POINT_PHANTOM;
 11552 
 11553   /* Load the compound glyph program.  */
 11554   interpreter->IP = 0;
 11555   interpreter->SP = interpreter->stack;
 11556   interpreter->instructions = glyph->compound->instructions;
 11557   interpreter->num_instructions = glyph->compound->instruction_length;
 11558   interpreter->glyph_zone = zone;
 11559 
 11560   /* Copy zone over to this volatile variable.  */
 11561   preserved_zone = zone;
 11562 
 11563   if (setjmp (interpreter->trap))
 11564     {
 11565       if (zone_was_allocated)
 11566         xfree (preserved_zone);
 11567 
 11568       interpreter->glyph_zone = NULL;
 11569       return interpreter->trap_reason;
 11570     }
 11571 
 11572   sfnt_interpret_run (interpreter, SFNT_RUN_CONTEXT_GLYPH_PROGRAM);
 11573   interpreter->glyph_zone = NULL;
 11574 
 11575   /* Move preserved_zone back to zone.  */
 11576   zone = preserved_zone;
 11577 
 11578   /* Now copy the instructed points back, and add the two phantom
 11579      points to the end.  */
 11580 
 11581   for (i = 0; i < num_points; ++i)
 11582     {
 11583       context->x_coordinates[base_index + i] = zone->x_current[i];
 11584       context->y_coordinates[base_index + i] = zone->y_current[i];
 11585     }
 11586 
 11587   /* Grow various arrays to fit the phantom points.  */
 11588   rc = sfnt_expand_compound_glyph_context (context, 0, 2,
 11589                                            &x_base, &y_base,
 11590                                            &flags_base,
 11591                                            &contour_base);
 11592 
 11593   if (rc)
 11594     {
 11595       if (zone_was_allocated)
 11596         xfree (zone);
 11597 
 11598       return "Failed to expand arrays for phantom points";
 11599     }
 11600 
 11601   /* Copy over the phantom points.  */
 11602   x_base[0] = zone->x_current[num_points - 2];
 11603   x_base[1] = zone->x_current[num_points - 1];
 11604   y_base[0] = zone->y_current[num_points - 2];
 11605   y_base[1] = zone->y_current[num_points - 1];
 11606   flags_base[0] = zone->flags[num_points - 2];
 11607   flags_base[1] = zone->flags[num_points - 1];
 11608 
 11609   /* Free the zone if needed.  */
 11610   if (zone_was_allocated)
 11611     xfree (zone);
 11612 
 11613   return NULL;
 11614 }
 11615 
 11616 /* Internal helper for sfnt_interpret_compound_glyph.
 11617    RECURSION_COUNT is the number of times this function has called itself.
 11618    OFF_X and OFF_Y are the offsets to apply to the glyph outline.
 11619 
 11620    METRICS are the unscaled metrics of this compound glyph.
 11621 
 11622    Other arguments mean the same as they do in
 11623    `sfnt_interpret_compound_glyph'.  Value is NULL upon success, or a
 11624    string describing the reason for failure.  */
 11625 
 11626 static const char *
 11627 sfnt_interpret_compound_glyph_1 (struct sfnt_glyph *glyph,
 11628                                  struct sfnt_interpreter *interpreter,
 11629                                  struct sfnt_graphics_state *state,
 11630                                  struct sfnt_compound_glyph_context *context,
 11631                                  sfnt_get_glyph_proc get_glyph,
 11632                                  sfnt_free_glyph_proc free_glyph,
 11633                                  struct sfnt_hmtx_table *hmtx,
 11634                                  struct sfnt_hhea_table *hhea,
 11635                                  struct sfnt_maxp_table *maxp,
 11636                                  struct sfnt_glyph_metrics *metrics,
 11637                                  sfnt_fixed off_x, sfnt_fixed off_y,
 11638                                  int recursion_count,
 11639                                  void *dcontext)
 11640 {
 11641   struct sfnt_glyph *subglyph;
 11642   int i, j, rc;
 11643   const char *error;
 11644   bool need_free;
 11645   struct sfnt_compound_glyph_component *component;
 11646   sfnt_f26dot6 x, y, xtemp, ytemp;
 11647   size_t point, point2;
 11648   size_t last_point, number_of_contours;
 11649   sfnt_f26dot6 *x_base, *y_base;
 11650   size_t *contour_base;
 11651   unsigned char *flags_base;
 11652   size_t base_index, contour_start, base_contour;
 11653   bool defer_offsets;
 11654   struct sfnt_instructed_outline *value;
 11655   struct sfnt_glyph_metrics sub_metrics;
 11656 
 11657   error = NULL;
 11658 
 11659   /* Set up the base index.  This is the index from where on point
 11660      renumbering starts.
 11661 
 11662      In other words, point 0 in this glyph will be 0 + base_index,
 11663      point 1 will be 1 + base_index, and so on.  */
 11664   base_index = context->num_points;
 11665 
 11666   /* And this is the index of the first contour in this glyph.  */
 11667   base_contour = context->num_end_points;
 11668 
 11669   /* Prevent infinite loops.  Simply limit the level of nesting to the
 11670      maximum valid value of `max_component_depth', which is 16.  */
 11671 
 11672   if (recursion_count > 16)
 11673     return "Overly deep recursion in compound glyph data";
 11674 
 11675   /* Pacify -Wmaybe-uninitialized.  */
 11676   point = point2 = 0;
 11677 
 11678   for (j = 0; j < glyph->compound->num_components; ++j)
 11679     {
 11680       /* Look up the associated subglyph.  */
 11681       component = &glyph->compound->components[j];
 11682       subglyph = get_glyph (component->glyph_index,
 11683                             dcontext, &need_free);
 11684 
 11685       if (!subglyph)
 11686         return "Failed to obtain component glyph";
 11687 
 11688       /* Don't defer offsets.  This variable is set if the component
 11689          glyph is a compound glyph that is anchored to a previously
 11690          decomposed point, and needs its coordinates adjusted after
 11691          decomposition completes.  */
 11692       defer_offsets = false;
 11693 
 11694       /* Record the size of the point array before expansion.  This
 11695          will be the base to apply to all points coming from this
 11696          subglyph.  */
 11697       contour_start = context->num_points;
 11698 
 11699       /* Compute the offset for the component.  */
 11700       if (component->flags & 02) /* ARGS_ARE_XY_VALUES */
 11701         {
 11702           /* Component offsets are X/Y values as opposed to points
 11703              GLYPH.  */
 11704 
 11705           if (!(component->flags & 01)) /* ARG_1_AND_2_ARE_WORDS */
 11706             {
 11707               /* X and Y are signed bytes.  */
 11708               x = component->argument1.b * 64;
 11709               y = component->argument2.b * 64;
 11710             }
 11711           else
 11712             {
 11713               /* X and Y are signed words.  */
 11714               x = component->argument1.d * 64;
 11715               y = component->argument2.d * 64;
 11716             }
 11717 
 11718           /* Now convert X and Y into device coordinates.  */
 11719           x = sfnt_mul_f26dot6_fixed (x, interpreter->scale);
 11720           y = sfnt_mul_f26dot6_fixed (y, interpreter->scale);
 11721 
 11722           /* If there is some kind of scale and component offsets are
 11723              scaled, then apply the transform to the offset.  */
 11724           if (component->flags & 04000) /* SCALED_COMPONENT_OFFSET */
 11725             sfnt_transform_f26dot6 (component, &x, &y, 1,
 11726                                     0, 0);
 11727 
 11728           if (component->flags & 04) /* ROUND_XY_TO_GRID */
 11729             {
 11730               x = sfnt_round_f26dot6 (x);
 11731               y = sfnt_round_f26dot6 (y);
 11732             }
 11733         }
 11734       else
 11735         {
 11736           /* The offset is determined by matching a point location in
 11737              a preceeding component with a point location in the
 11738              current component.  The index of the point in the
 11739              previous component can be determined by adding
 11740              component->argument1.a or component->argument1.c to
 11741              point.  argument2 contains the index of the point in the
 11742              current component.  */
 11743 
 11744           if (!(component->flags & 01)) /* ARG_1_AND_2_ARE_WORDS */
 11745             {
 11746               point = base_index + component->argument1.a;
 11747               point2 = component->argument2.a;
 11748             }
 11749           else
 11750             {
 11751               point = base_index + component->argument1.c;
 11752               point2 = component->argument2.c;
 11753             }
 11754 
 11755           /* Now, check that the anchor point specified lies inside
 11756              the glyph.  */
 11757 
 11758           if (point >= contour_start)
 11759             {
 11760               if (need_free)
 11761                 free_glyph (subglyph, dcontext);
 11762 
 11763               return "Invalid anchor point";
 11764             }
 11765 
 11766           if (!subglyph->compound)
 11767             {
 11768               if (point2 >= subglyph->simple->number_of_points)
 11769                 {
 11770                   if (need_free)
 11771                     free_glyph (subglyph, dcontext);
 11772 
 11773                   return "Invalid anchored point";
 11774                 }
 11775 
 11776               /* Get the points and use them to compute the offsets.  */
 11777               xtemp = context->x_coordinates[point];
 11778               ytemp = context->y_coordinates[point];
 11779               x = (xtemp - subglyph->simple->x_coordinates[point2] * 64);
 11780               y = (ytemp - subglyph->simple->y_coordinates[point2] * 64);
 11781             }
 11782           else
 11783             {
 11784               /* First, set offsets to 0, because it is not yet
 11785                  possible to determine the position of the anchor
 11786                  point in the child.  */
 11787               x = 0;
 11788               y = 0;
 11789 
 11790               /* Set a flag which indicates that offsets must be
 11791                  resolved from the child glyph after it is loaded, but
 11792                  before it is incorporated into the parent glyph.  */
 11793               defer_offsets = true;
 11794             }
 11795         }
 11796 
 11797       /* Obtain the glyph metrics.  If doing so fails, then cancel
 11798          decomposition.  */
 11799 
 11800       if (sfnt_lookup_glyph_metrics (component->glyph_index,
 11801                                      -1, &sub_metrics,
 11802                                      hmtx, hhea, NULL, maxp))
 11803         {
 11804           if (need_free)
 11805             free_glyph (subglyph, dcontext);
 11806 
 11807           return "Failed to obtain component metrics";
 11808         }
 11809 
 11810       if (subglyph->simple)
 11811         {
 11812           /* Simple subglyph.  Copy over the points and contours,
 11813              then transform and instruct them.
 11814 
 11815              Skip this step for glyphs without contours.  */
 11816 
 11817           if (subglyph->number_of_contours)
 11818             {
 11819               /* Now instruct the simple glyph, and copy it over,
 11820                  including the two phantom points at the end.  */
 11821               interpreter->state = *state;
 11822               error = sfnt_interpret_simple_glyph (subglyph, interpreter,
 11823                                                    &sub_metrics, &value);
 11824 
 11825               /* Cancel instructing if an error occurs.  */
 11826 
 11827               if (error)
 11828                 {
 11829                   if (need_free)
 11830                     free_glyph (subglyph, dcontext);
 11831 
 11832                   return error;
 11833                 }
 11834 
 11835               /* Figure out how many more points and contours are
 11836                  needed.  Here, last_point is not the end of the
 11837                  glyph's contours, as two phantom points are
 11838                  included.  */
 11839               last_point = value->num_points;
 11840               number_of_contours = value->num_contours;
 11841 
 11842               /* Grow various arrays.  */
 11843               rc = sfnt_expand_compound_glyph_context (context,
 11844                                                        /* Number of
 11845                                                           new contours
 11846                                                           required.  */
 11847                                                        number_of_contours,
 11848                                                        /* Number of new
 11849                                                           points
 11850                                                           required.  */
 11851                                                        last_point,
 11852                                                        &x_base,
 11853                                                        &y_base,
 11854                                                        &flags_base,
 11855                                                        &contour_base);
 11856               if (rc)
 11857                 {
 11858                   xfree (value);
 11859 
 11860                   if (need_free)
 11861                     free_glyph (subglyph, dcontext);
 11862 
 11863                   return "Failed to grow arrays";
 11864                 }
 11865 
 11866               /* Copy the values in VALUE into the context and free
 11867                  VALUE, including phantom points.  */
 11868 
 11869               for (i = 0; i < last_point; ++i)
 11870                 {
 11871                   x_base[i] = value->x_points[i] + off_x + x;
 11872                   y_base[i] = value->y_points[i] + off_y + y;
 11873                   flags_base[i] = value->flags[i];
 11874                 }
 11875 
 11876               /* Copy over the contours.  */
 11877               for (i = 0; i < number_of_contours; ++i)
 11878                 contour_base[i] = (contour_start
 11879                                    + value->contour_end_points[i]);
 11880 
 11881               xfree (value);
 11882 
 11883               /* Apply the transform to the points.  */
 11884               sfnt_transform_f26dot6 (component, x_base, y_base,
 11885                                       last_point, 0, 0);
 11886             }
 11887         }
 11888       else
 11889         {
 11890           /* Compound subglyph.  Decompose and instruct the glyph
 11891              recursively, and then apply the transform.  */
 11892 
 11893           error = sfnt_interpret_compound_glyph_1 (subglyph, interpreter,
 11894                                                    state,
 11895                                                    context, get_glyph,
 11896                                                    free_glyph, hmtx, hhea,
 11897                                                    maxp, &sub_metrics,
 11898                                                    off_x + x, off_y + y,
 11899                                                    recursion_count + 1,
 11900                                                    dcontext);
 11901 
 11902           if (error)
 11903             {
 11904               if (need_free)
 11905                 free_glyph (subglyph, dcontext);
 11906 
 11907               return error;
 11908             }
 11909 
 11910           /* When an anchor point is being used to translate the
 11911              glyph, and the subglyph in question is actually a
 11912              compound glyph, it is impossible to know which offset to
 11913              use until the compound subglyph has actually been
 11914              loaded.
 11915 
 11916              As a result, the offset is calculated here, using the
 11917              points in the loaded child compound glyph.  But first, X
 11918              and Y must be reset to 0, as otherwise the translation
 11919              might be applied twice if defer_offsets is not set.  */
 11920 
 11921           x = 0;
 11922           y = 0;
 11923 
 11924           if (defer_offsets)
 11925             {
 11926               /* Renumber the non renumbered point2 to point into the
 11927                  decomposed component.  */
 11928               point2 += contour_start;
 11929 
 11930               /* Next, check that the non-renumbered point being
 11931                  anchored lies inside the glyph data that was
 11932                  decomposed.  */
 11933 
 11934               if (point2 >= context->num_points)
 11935                 {
 11936                   if (need_free)
 11937                     free_glyph (subglyph, dcontext);
 11938 
 11939                   return "Invalid point2";
 11940                 }
 11941 
 11942               /* Get the points and use them to compute the
 11943                  offsets.  */
 11944 
 11945               xtemp = context->x_coordinates[point];
 11946               ytemp = context->y_coordinates[point];
 11947               x = (xtemp - context->x_coordinates[point2]);
 11948               y = (ytemp - context->y_coordinates[point2]);
 11949             }
 11950 
 11951           sfnt_transform_f26dot6 (component,
 11952                                   context->x_coordinates + contour_start,
 11953                                   context->y_coordinates + contour_start,
 11954                                   contour_start - context->num_points,
 11955                                   x, y);
 11956         }
 11957 
 11958       /* Finally, free the subglyph.  */
 11959       if (need_free)
 11960         free_glyph (subglyph, dcontext);
 11961     }
 11962 
 11963   /* Run the program for the entire compound glyph, if any.  */
 11964 
 11965   if (glyph->compound->instruction_length)
 11966     {
 11967       interpreter->state = *state;
 11968       error = sfnt_interpret_compound_glyph_2 (glyph, interpreter,
 11969                                                context, base_index,
 11970                                                base_contour,
 11971                                                metrics);
 11972     }
 11973 
 11974   return error;
 11975 }
 11976 
 11977 /* Interpret the compound glyph GLYPH using the specified INTERPRETER.
 11978    Load each component of the compound glyph GLYPH.  CONTEXT should be
 11979    a reference to a `struct sfnt_compound_glyph_context' that is on
 11980    the stack.
 11981 
 11982    Use glyph metrics specified in the HMTX, HHEA and MAXP tables, and
 11983    the unscaled metrics for GLYPH specified in METRICS.
 11984 
 11985    If the component is a simple glyph, scale and instruct it
 11986    immediately.
 11987 
 11988    If the component is a compound glyph, then load it recursively
 11989    until a predetermined recursion level is exceeded.
 11990 
 11991    Set INTERPRETER's state to STATE prior to instructing each
 11992    component.
 11993 
 11994    Load component glyphs using GET_GLYPH, which should return whether
 11995    or not FREE_GLYPH should be called with the glyph that was loaded.
 11996    Call both functions with DCONTEXT as an argument.
 11997 
 11998    Finally, append the resulting contours, run any compound glyph
 11999    program, and return the instructed outline in *VALUE.
 12000 
 12001    Value is NULL upon success, and the type of error upon failure.  */
 12002 
 12003 TEST_STATIC const char *
 12004 sfnt_interpret_compound_glyph (struct sfnt_glyph *glyph,
 12005                                struct sfnt_interpreter *interpreter,
 12006                                struct sfnt_graphics_state *state,
 12007                                sfnt_get_glyph_proc get_glyph,
 12008                                sfnt_free_glyph_proc free_glyph,
 12009                                struct sfnt_hmtx_table *hmtx,
 12010                                struct sfnt_hhea_table *hhea,
 12011                                struct sfnt_maxp_table *maxp,
 12012                                struct sfnt_glyph_metrics *metrics,
 12013                                void *dcontext,
 12014                                struct sfnt_instructed_outline **value)
 12015 {
 12016   struct sfnt_compound_glyph_context context;
 12017   const char *error;
 12018   struct sfnt_instructed_outline *outline;
 12019   size_t outline_size, temp;
 12020 
 12021   /* Set up the glyph decomposition context.  */
 12022   memset (&context, 0, sizeof context);
 12023 
 12024   /* Now start decomposing the glyph.  */
 12025   error = sfnt_interpret_compound_glyph_1 (glyph, interpreter,
 12026                                            state, &context,
 12027                                            get_glyph, free_glyph,
 12028                                            hmtx, hhea, maxp,
 12029                                            metrics, 0, 0, 0,
 12030                                            dcontext);
 12031 
 12032   /* If an error occurs, free the data in the context and return.  */
 12033 
 12034   if (error)
 12035     {
 12036       xfree (context.x_coordinates);
 12037       xfree (context.y_coordinates);
 12038       xfree (context.flags);
 12039       xfree (context.contour_end_points);
 12040       return error;
 12041     }
 12042 
 12043   /* Copy the compound glyph data into an instructed outline.  */
 12044   outline_size = sizeof (*outline);
 12045 
 12046   if (INT_MULTIPLY_WRAPV (context.num_end_points,
 12047                           sizeof *outline->contour_end_points,
 12048                           &temp)
 12049       || INT_ADD_WRAPV (outline_size, temp, &outline_size)
 12050       || INT_MULTIPLY_WRAPV (context.num_points,
 12051                              sizeof *outline->x_points * 2,
 12052                              &temp)
 12053       || INT_ADD_WRAPV (outline_size, temp, &outline_size)
 12054       || INT_ADD_WRAPV (context.num_points, outline_size,
 12055                         &outline_size))
 12056     {
 12057       xfree (context.x_coordinates);
 12058       xfree (context.y_coordinates);
 12059       xfree (context.flags);
 12060       xfree (context.contour_end_points);
 12061       return "Glyph exceeds maximum permissible size";
 12062     }
 12063 
 12064   /* Allocate the outline.  */
 12065   outline = xmalloc (outline_size);
 12066   outline->num_points = context.num_points;
 12067   outline->num_contours = context.num_end_points;
 12068   outline->contour_end_points = (size_t *) (outline + 1);
 12069   outline->x_points = (sfnt_f26dot6 *) (outline->contour_end_points
 12070                                         + outline->num_contours);
 12071   outline->y_points = outline->x_points + outline->num_points;
 12072   outline->flags = (unsigned char *) (outline->y_points
 12073                                       + outline->num_points);
 12074 
 12075   /* Copy over the contour endpoints, points, and flags.  Note that
 12076      all arrays in `context' are NULL unless num_contours is
 12077      non-zero.  */
 12078 
 12079   if (context.num_end_points)
 12080     memcpy (outline->contour_end_points, context.contour_end_points,
 12081             outline->num_contours * sizeof *outline->contour_end_points);
 12082 
 12083   if (context.num_points)
 12084     {
 12085       memcpy (outline->x_points, context.x_coordinates,
 12086               outline->num_points * sizeof *outline->x_points);
 12087       memcpy (outline->y_points, context.y_coordinates,
 12088               outline->num_points * sizeof *outline->y_points);
 12089       memcpy (outline->flags, context.flags, context.num_points);
 12090     }
 12091 
 12092   /* Free the context data.  */
 12093   xfree (context.x_coordinates);
 12094   xfree (context.y_coordinates);
 12095   xfree (context.flags);
 12096   xfree (context.contour_end_points);
 12097 
 12098   *value = outline;
 12099   return NULL;
 12100 }
 12101 
 12102 
 12103 
 12104 
 12105 /* Unicode Variation Sequence (UVS) support.
 12106 
 12107    Unicode defines a mechanism by which a two-codepoint sequence
 12108    consisting of a ``base character'' and ``variation selector'' is
 12109    able to produce a glyph that is a variant of the glyph that would
 12110    conventionally have been mapped to the ``base character''.
 12111 
 12112    TrueType describes variation selector sequences through a type of
 12113    character mapping table that is given the format 14.  The character
 12114    mapping table consists of an array of variation selectors, each of
 12115    which have a corresponding ``default UVS table'', which describes
 12116    ranges of ``base characters'' having no special variant glyphs, and
 12117    a ``non-default UVS table'', which is a map of ``base characters''
 12118    to their corresponding variant glyphs.  */
 12119 
 12120 /* Read a default UVS table from the font file FD, at the specified
 12121    OFFSET.  Value is the default UVS table upon success, else
 12122    NULL.  */
 12123 
 12124 static struct sfnt_default_uvs_table *
 12125 sfnt_read_default_uvs_table (int fd, off_t offset)
 12126 {
 12127   struct sfnt_default_uvs_table *uvs;
 12128   uint32_t num_ranges, i, j;
 12129   size_t size, temp;
 12130   char data[512];
 12131 
 12132   /* First, seek to the given offset.  */
 12133 
 12134   if (lseek (fd, offset, SEEK_SET) != offset)
 12135     return NULL;
 12136 
 12137   /* Next, read the number of ranges present.  */
 12138 
 12139   if (read (fd, &num_ranges, sizeof num_ranges) != sizeof num_ranges)
 12140     return NULL;
 12141 
 12142   /* Swap the number of ranges present.  */
 12143   sfnt_swap32 (&num_ranges);
 12144 
 12145   /* Now, allocate enough to hold the UVS table.  */
 12146 
 12147   size = sizeof *uvs;
 12148   if (INT_MULTIPLY_WRAPV (sizeof *uvs->ranges, num_ranges,
 12149                           &temp)
 12150       || INT_ADD_WRAPV (temp, size, &size))
 12151     return NULL;
 12152 
 12153   uvs = xmalloc (size);
 12154 
 12155   /* Fill in the data which was already read.  */
 12156   uvs->num_unicode_value_ranges = num_ranges;
 12157 
 12158   /* Fill in the pointer to the ranges.  */
 12159   uvs->ranges = (struct sfnt_unicode_value_range *) (uvs + 1);
 12160   i = 0;
 12161 
 12162   /* Read each default UVS range in multiples of 512 bytes.  Then,
 12163      fill in uvs->ranges.  */
 12164 
 12165   while (num_ranges)
 12166     {
 12167       size = (num_ranges > 128 ? 512 : num_ranges * 4);
 12168 
 12169       if (read (fd, data, size) != size)
 12170         {
 12171           xfree (uvs);
 12172           return NULL;
 12173         }
 12174 
 12175       for (j = 0; j < size / 4; ++j)
 12176         {
 12177           uvs->ranges[i + j].start_unicode_value
 12178             = sfnt_read_24 ((unsigned char *) data + j * 4);
 12179           uvs->ranges[i + j].additional_count = data[j * 4 + 1];
 12180         }
 12181 
 12182       i += j;
 12183       num_ranges -= size / 4;
 12184     }
 12185 
 12186   /* Return the resulting default UVS table.  */
 12187   return uvs;
 12188 }
 12189 
 12190 /* Read a non-default UVS table from the font file FD, at the
 12191    specified OFFSET.  Value is the non-default UVS table upon success,
 12192    else NULL.  */
 12193 
 12194 static struct sfnt_nondefault_uvs_table *
 12195 sfnt_read_nondefault_uvs_table (int fd, off_t offset)
 12196 {
 12197   struct sfnt_nondefault_uvs_table *uvs;
 12198   uint32_t num_mappings, i, j;
 12199   size_t size, temp;
 12200   char data[500];
 12201 
 12202   /* First, seek to the given offset.  */
 12203 
 12204   if (lseek (fd, offset, SEEK_SET) != offset)
 12205     return NULL;
 12206 
 12207   /* Next, read the number of mappings present.  */
 12208 
 12209   if (read (fd, &num_mappings, sizeof num_mappings)
 12210       != sizeof num_mappings)
 12211     return NULL;
 12212 
 12213   /* Swap the number of mappings present.  */
 12214   sfnt_swap32 (&num_mappings);
 12215 
 12216   /* Now, allocate enough to hold the UVS table.  */
 12217 
 12218   size = sizeof *uvs;
 12219   if (INT_MULTIPLY_WRAPV (sizeof *uvs->mappings, num_mappings,
 12220                           &temp)
 12221       || INT_ADD_WRAPV (temp, size, &size))
 12222     return NULL;
 12223 
 12224   uvs = xmalloc (size);
 12225 
 12226   /* Fill in the data which was already read.  */
 12227   uvs->num_uvs_mappings = num_mappings;
 12228 
 12229   /* Fill in the pointer to the mappings.  */
 12230   uvs->mappings = (struct sfnt_uvs_mapping *) (uvs + 1);
 12231 
 12232   i = 0;
 12233 
 12234   /* Read each nondefault UVS mapping in multiples of 500 bytes.
 12235      Then, fill in uvs->ranges.  */
 12236 
 12237   while (num_mappings)
 12238     {
 12239       size = (num_mappings > 100 ? 500 : num_mappings * 5);
 12240 
 12241       if (read (fd, data, size) != size)
 12242         {
 12243           xfree (uvs);
 12244           return NULL;
 12245         }
 12246 
 12247       for (j = 0; j < size / 5; ++j)
 12248         {
 12249           uvs->mappings[i + j].unicode_value
 12250             = sfnt_read_24 ((unsigned char *) data + j * 5);
 12251           memcpy (&uvs->mappings[i + j].base_character_value,
 12252                   data + j * 5 + 3,
 12253                   sizeof uvs->mappings[i + j].base_character_value);
 12254           sfnt_swap16 (&uvs->mappings[i + j].base_character_value);
 12255         }
 12256 
 12257       i += j;
 12258       num_mappings -= size / 5;
 12259     }
 12260 
 12261   /* Return the nondefault UVS table.  */
 12262   return uvs;
 12263 }
 12264 
 12265 /* Perform comparison of A and B, two table offsets.  */
 12266 
 12267 static int
 12268 sfnt_compare_table_offsets (const void *a, const void *b)
 12269 {
 12270   const struct sfnt_table_offset_rec *rec_a, *rec_b;
 12271 
 12272   rec_a = a;
 12273   rec_b = b;
 12274 
 12275   if (rec_a->offset < rec_b->offset)
 12276     return -1;
 12277   else if (rec_a->offset > rec_b->offset)
 12278     return 1;
 12279 
 12280   return 0;
 12281 }
 12282 
 12283 /* Create a variation selection context based on the format 14 cmap
 12284    subtable CMAP.
 12285 
 12286    FD is the font file to which the table belongs.
 12287 
 12288    Value is the variation selection context upon success, else NULL.
 12289    The context contains each variation selector record and their
 12290    associated default and nondefault UVS tables.  Free the context
 12291    with `sfnt_free_uvs_context'.  */
 12292 
 12293 TEST_STATIC struct sfnt_uvs_context *
 12294 sfnt_create_uvs_context (struct sfnt_cmap_format_14 *cmap, int fd)
 12295 {
 12296   struct sfnt_table_offset_rec *table_offsets, *rec, template;
 12297   size_t size, i, nmemb, j;
 12298   off_t offset;
 12299   struct sfnt_uvs_context *context;
 12300 
 12301   if (INT_MULTIPLY_WRAPV (cmap->num_var_selector_records,
 12302                           sizeof *table_offsets, &size)
 12303       || INT_MULTIPLY_WRAPV (size, 2, &size))
 12304     return NULL;
 12305 
 12306   context = NULL;
 12307 
 12308   /* First, record and sort the UVS and nondefault UVS table offsets
 12309      in ascending order.  */
 12310 
 12311   table_offsets = xmalloc (size);
 12312   memset (table_offsets, 0, size);
 12313   nmemb = cmap->num_var_selector_records * 2;
 12314   j = 0;
 12315 
 12316   for (i = 0; i < cmap->num_var_selector_records; ++i)
 12317     {
 12318       /* Note that either offset may be 0, meaning there is no such
 12319          table.  */
 12320 
 12321       if (cmap->records[i].default_uvs_offset)
 12322         {
 12323           if (INT_ADD_WRAPV (cmap->offset,
 12324                              cmap->records[i].default_uvs_offset,
 12325                              &table_offsets[j].offset))
 12326             goto bail;
 12327 
 12328           table_offsets[j++].is_nondefault_table = false;
 12329         }
 12330 
 12331       if (cmap->records[i].nondefault_uvs_offset)
 12332         {
 12333           if (INT_ADD_WRAPV (cmap->offset,
 12334                              cmap->records[i].nondefault_uvs_offset,
 12335                              &table_offsets[j].offset))
 12336             goto bail;
 12337 
 12338           table_offsets[j++].is_nondefault_table = true;
 12339         }
 12340     }
 12341 
 12342   /* Make nmemb the number of offsets actually looked up.  */
 12343   nmemb = j;
 12344 
 12345   qsort (table_offsets, nmemb, sizeof *table_offsets,
 12346          sfnt_compare_table_offsets);
 12347 
 12348   /* Now go through table_offsets, and read everything.  nmemb is the
 12349      number of elements in table_offsets[i]; it is kept up to date
 12350      when duplicate members are removed.  */
 12351   offset = -1;
 12352 
 12353   for (i = 0; i < nmemb; ++i)
 12354     {
 12355       /* Skip past duplicate tables.  */
 12356 
 12357       while (table_offsets[i].offset == offset && i < nmemb)
 12358         {
 12359           nmemb--;
 12360           table_offsets[i] = table_offsets[i + 1];
 12361         }
 12362 
 12363       /* If the last element of the array is a duplicate, break out of
 12364          the loop.  */
 12365 
 12366       if (i == nmemb)
 12367         break;
 12368 
 12369       /* Read the correct type of table depending on
 12370          table_offsets[i].is_nondefault_table.  Then skip past
 12371          duplicate tables.  Don't handle the case where two different
 12372          kind of tables share the same offset, because that is not
 12373          possible in a valid variation selector record.  */
 12374 
 12375       offset = table_offsets[i].offset;
 12376 
 12377       if (table_offsets[i].is_nondefault_table)
 12378         table_offsets[i].table
 12379           = sfnt_read_nondefault_uvs_table (fd, offset);
 12380       else
 12381         table_offsets[i].table
 12382           = sfnt_read_default_uvs_table (fd, offset);
 12383     }
 12384 
 12385   /* Now make the context.  */
 12386   context = xmalloc (sizeof *context);
 12387   context->num_records = cmap->num_var_selector_records;
 12388   context->nmemb = nmemb;
 12389   context->records = xmalloc (sizeof *context->records
 12390                               * cmap->num_var_selector_records);
 12391 
 12392   for (i = 0; i < cmap->num_var_selector_records; ++i)
 12393     {
 12394       context->records[i].selector = cmap->records[i].var_selector;
 12395 
 12396       /* Either offset may be 0, meaning no such table exists.  Also,
 12397          the code below will lose if more than one kind of table
 12398          shares the same offset, because that is impossible.  */
 12399 
 12400       if (cmap->records[i].default_uvs_offset)
 12401         {
 12402           /* Resolve the default table.  */
 12403           template.offset = (cmap->records[i].default_uvs_offset
 12404                              + cmap->offset);
 12405           rec = bsearch (&template, table_offsets,
 12406                          nmemb, sizeof *table_offsets,
 12407                          sfnt_compare_table_offsets);
 12408 
 12409           /* Make sure this record is the right type.  */
 12410           if (!rec || rec->is_nondefault_table || !rec->table)
 12411             goto bail;
 12412 
 12413           context->records[i].default_uvs = rec->table;
 12414         }
 12415       else
 12416         context->records[i].default_uvs = NULL;
 12417 
 12418       if (cmap->records[i].nondefault_uvs_offset)
 12419         {
 12420           /* Resolve the nondefault table.  */
 12421           template.offset = (cmap->records[i].nondefault_uvs_offset
 12422                              + cmap->offset);
 12423           rec = bsearch (&template, table_offsets,
 12424                          nmemb, sizeof *table_offsets,
 12425                          sfnt_compare_table_offsets);
 12426 
 12427           if (!rec)
 12428             goto bail;
 12429 
 12430           /* Make sure this record is the right type.  */
 12431           if (!rec || !rec->is_nondefault_table || !rec->table)
 12432             goto bail;
 12433 
 12434           context->records[i].nondefault_uvs = rec->table;
 12435         }
 12436       else
 12437         context->records[i].nondefault_uvs = NULL;
 12438     }
 12439 
 12440   context->tables = table_offsets;
 12441   return context;
 12442 
 12443  bail:
 12444 
 12445   if (context)
 12446     {
 12447       xfree (context->records);
 12448       xfree (context);
 12449     }
 12450 
 12451   /* Loop through and free any tables that might have been read
 12452      already.  */
 12453 
 12454   for (i = 0; i < nmemb; ++i)
 12455     xfree (table_offsets[i].table);
 12456 
 12457   xfree (table_offsets);
 12458   return NULL;
 12459 }
 12460 
 12461 /* Free the specified variation selection context C.  */
 12462 
 12463 TEST_STATIC void
 12464 sfnt_free_uvs_context (struct sfnt_uvs_context *c)
 12465 {
 12466   size_t i;
 12467 
 12468   xfree (c->records);
 12469 
 12470   for (i = 0; i < c->nmemb; ++i)
 12471     xfree (c->tables[i].table);
 12472 
 12473   xfree (c->tables);
 12474   xfree (c);
 12475 }
 12476 
 12477 /* Compare *(sfnt_char *) K to ((struct sfnt_uvs_mapping *)
 12478    V)->unicode_value appropriately for bsearch.  */
 12479 
 12480 static int
 12481 sfnt_compare_uvs_mapping (const void *k, const void *v)
 12482 {
 12483   const sfnt_char *key;
 12484   const struct sfnt_uvs_mapping *value;
 12485 
 12486   key = k;
 12487   value = v;
 12488 
 12489   if (*key < value->unicode_value)
 12490     return -1;
 12491   else if (*key == value->unicode_value)
 12492     return 0;
 12493 
 12494   return 1;
 12495 }
 12496 
 12497 /* Return the ID of a variation glyph for the character C in the
 12498    nondefault UVS mapping table UVS.
 12499 
 12500    Value is the glyph ID upon success, or 0 if there is no variation
 12501    glyph for the base character C.  */
 12502 
 12503 TEST_STATIC sfnt_glyph
 12504 sfnt_variation_glyph_for_char (struct sfnt_nondefault_uvs_table *uvs,
 12505                                sfnt_char c)
 12506 {
 12507   struct sfnt_uvs_mapping *mapping;
 12508 
 12509   mapping = bsearch (&c, uvs->mappings, uvs->num_uvs_mappings,
 12510                      sizeof *uvs->mappings,
 12511                      sfnt_compare_uvs_mapping);
 12512 
 12513   return mapping ? mapping->base_character_value : 0;
 12514 }
 12515 
 12516 
 12517 
 12518 #if defined HAVE_MMAP && !defined TEST
 12519 
 12520 /* Memory mapping support.
 12521    It useful to map OpenType layout tables prior to using them in
 12522    an external shaping engine such as HarfBuzz.  */
 12523 
 12524 /* Map a table identified by TAG into the structure *TABLE.
 12525    TAG is swapped into host byte order.
 12526 
 12527    Use the table directory SUBTABLE, which corresponds to the font
 12528    file FD.
 12529 
 12530    Return 0 upon success, and set TABLE->data to the table data,
 12531    TABLE->mapping to the start of the mapped area, TABLE->length to
 12532    the length of the table contents, and TABLE->size to the size of
 12533    the mapping.
 12534 
 12535    Return 1 upon failure.  */
 12536 
 12537 int
 12538 sfnt_map_table (int fd, struct sfnt_offset_subtable *subtable,
 12539                 uint32_t tag, struct sfnt_mapped_table *table)
 12540 {
 12541   struct sfnt_table_directory *directory;
 12542   size_t offset, page, map_offset;
 12543   void *data;
 12544   int i;
 12545 
 12546   /* Find the table in the directory.  */
 12547 
 12548   for (i = 0; i < subtable->num_tables; ++i)
 12549     {
 12550       if (subtable->subtables[i].tag == tag)
 12551         {
 12552           directory = &subtable->subtables[i];
 12553           break;
 12554         }
 12555     }
 12556 
 12557   if (i == subtable->num_tables)
 12558     return 1;
 12559 
 12560   /* Now try to map the glyph data.  Make sure offset is a multiple of
 12561      the page size.  */
 12562 
 12563   page = getpagesize ();
 12564   offset = directory->offset & ~(page - 1);
 12565 
 12566   /* Figure out how much larger the mapping should be.  */
 12567   map_offset = directory->offset - offset;
 12568 
 12569   /* Do the mmap.  */
 12570   data = mmap (NULL, directory->length + map_offset,
 12571                PROT_READ, MAP_PRIVATE, fd, offset);
 12572 
 12573   if (data == MAP_FAILED)
 12574     return 1;
 12575 
 12576   /* Fill in *TABLE.  */
 12577   table->data = (unsigned char *) data + map_offset;
 12578   table->mapping = data;
 12579   table->length = directory->length;
 12580   table->size = directory->length + map_offset;
 12581   return 0;
 12582 }
 12583 
 12584 /* Unmap the table inside *TABLE.
 12585    Value is 0 upon success, 1 otherwise.  */
 12586 
 12587 int
 12588 sfnt_unmap_table (struct sfnt_mapped_table *table)
 12589 {
 12590   return munmap (table->mapping, table->size) != 0;
 12591 }
 12592 
 12593 #endif /* HAVE_MMAP && !TEST */
 12594 
 12595 
 12596 
 12597 #ifndef TEST
 12598 
 12599 /* Reading table contents.  */
 12600 
 12601 /* Read the table with the specified TAG from the font file FD.
 12602    Return its length in *LENGTH, and its data upon success, else
 12603    NULL.  */
 12604 
 12605 void *
 12606 sfnt_read_table (int fd, struct sfnt_offset_subtable *subtable,
 12607                  uint32_t tag, size_t *length)
 12608 {
 12609   struct sfnt_table_directory *directory;
 12610   void *data;
 12611   int i;
 12612 
 12613   /* Find the table in the directory.  */
 12614 
 12615   for (i = 0; i < subtable->num_tables; ++i)
 12616     {
 12617       if (subtable->subtables[i].tag == tag)
 12618         {
 12619           directory = &subtable->subtables[i];
 12620           break;
 12621         }
 12622     }
 12623 
 12624   if (i == subtable->num_tables)
 12625     return NULL;
 12626 
 12627   /* Seek to the table.  */
 12628 
 12629   if (lseek (fd, directory->offset, SEEK_SET) != directory->offset)
 12630     return NULL;
 12631 
 12632   /* Now allocate enough to hold the data and read into it.  */
 12633 
 12634   data = xmalloc (directory->length);
 12635   if (read (fd, data, directory->length) != directory->length)
 12636     {
 12637       xfree (data);
 12638       return NULL;
 12639     }
 12640 
 12641   /* Return the length and table data.  */
 12642   *length = directory->length;
 12643   return data;
 12644 }
 12645 
 12646 #endif /* !TEST */
 12647 
 12648 
 12649 
 12650 /* Glyph variations.  Instead of defining separate fonts for each
 12651    combination of weight, width and slant (bold, condensed, italic,
 12652    etc), some fonts specify a list of ``variation axes'', each of
 12653    which determines one delta to apply to each point in every
 12654    glyph.
 12655 
 12656    This optional information is specified in the `fvar' (font
 12657    variation), `gvar' (glyph variation) and `cvar' (CVT variation)
 12658    tables in a font file.  */
 12659 
 12660 /* Read an fvar table from the given font FD.  Use the table directory
 12661    specified in SUBTABLE.
 12662 
 12663    Return the fvar table upon success, else NULL.  */
 12664 
 12665 TEST_STATIC struct sfnt_fvar_table *
 12666 sfnt_read_fvar_table (int fd, struct sfnt_offset_subtable *subtable)
 12667 {
 12668   struct sfnt_table_directory *directory;
 12669   struct sfnt_fvar_table *fvar;
 12670   ssize_t rc;
 12671   size_t min_bytes, ps_size, non_ps_size, temp, pad;
 12672   off_t offset;
 12673   int i, j;
 12674   char *buffer;
 12675   sfnt_fixed *coords;
 12676 
 12677   /* Find the table in the directory.  */
 12678 
 12679   directory = sfnt_find_table (subtable, SFNT_TABLE_FVAR);
 12680 
 12681   if (!directory)
 12682     return NULL;
 12683 
 12684   min_bytes = SFNT_ENDOF (struct sfnt_fvar_table,
 12685                           instance_size, uint16_t);
 12686 
 12687   /* Check that the length is at least min_bytes.  */
 12688   if (directory->length < min_bytes)
 12689     return NULL;
 12690 
 12691   /* Seek to the location given in the directory.  */
 12692   if (lseek (fd, directory->offset, SEEK_SET) == (off_t) -1)
 12693     return NULL;
 12694 
 12695   /* Allocate enough to hold the fvar table header.  */
 12696   fvar = xmalloc (sizeof *fvar);
 12697 
 12698   /* Read the fvar table header.  */
 12699   buffer = NULL;
 12700   rc = read (fd, fvar, min_bytes);
 12701   if (rc != min_bytes)
 12702     goto bail;
 12703 
 12704   /* Swap what was read.  */
 12705   sfnt_swap16 (&fvar->major_version);
 12706   sfnt_swap16 (&fvar->minor_version);
 12707   sfnt_swap16 (&fvar->offset_to_data);
 12708   sfnt_swap16 (&fvar->count_size_pairs);
 12709   sfnt_swap16 (&fvar->axis_count);
 12710   sfnt_swap16 (&fvar->axis_size);
 12711   sfnt_swap16 (&fvar->instance_count);
 12712   sfnt_swap16 (&fvar->instance_size);
 12713 
 12714   /* major_version should be 1, and minor_version 0.  */
 12715 
 12716   if (fvar->major_version != 1 || fvar->minor_version)
 12717     goto bail;
 12718 
 12719   /* count_size_pairs should be more than 2.  */
 12720 
 12721   if (fvar->count_size_pairs < 2)
 12722     goto bail;
 12723 
 12724   /* Don't try to read tables where the axis format differs.  */
 12725 
 12726   if (fvar->axis_size != 20)
 12727     goto bail;
 12728 
 12729   /* The instance size must either be 2 * sizeof (uint16_t) +
 12730      axisCount * sizeof (sfnt_fixed), meaning there is no PostScript
 12731      name identifier, or 3 * sizeof (uint16_t) + axisCount * sizeof
 12732      (sfnt_fixed), meaning there is.  */
 12733 
 12734   if (INT_MULTIPLY_WRAPV (fvar->axis_count, sizeof (sfnt_fixed),
 12735                           &temp)
 12736       || INT_ADD_WRAPV (2 * sizeof (uint16_t), temp, &non_ps_size))
 12737     goto bail;
 12738 
 12739   if (INT_MULTIPLY_WRAPV (fvar->axis_count, sizeof (sfnt_fixed),
 12740                           &temp)
 12741       || INT_ADD_WRAPV (3 * sizeof (uint16_t), temp, &ps_size))
 12742     goto bail;
 12743 
 12744   if (fvar->instance_size != non_ps_size
 12745       && fvar->instance_size != ps_size)
 12746     goto bail;
 12747 
 12748   /* Now compute the offset of the axis data from the start of the
 12749      font file.  */
 12750 
 12751   if (INT_ADD_WRAPV (fvar->offset_to_data, directory->offset,
 12752                      &offset))
 12753     goto bail;
 12754 
 12755   /* Seek there.  */
 12756 
 12757   if (lseek (fd, offset, SEEK_SET) != offset)
 12758     goto bail;
 12759 
 12760   min_bytes = sizeof *fvar;
 12761 
 12762   /* Now, read each axis and instance.  Calculate how much extra data
 12763      needs to be allocated for the axes and instances: this is
 12764      fvar->axis_count * sizeof (struct sfnt_variation_axis), some
 12765      padding, and finally fvar->instance_count * sizeof (struct
 12766      sfnt_instance) + sizeof (sfnt_fixed) * fvar->instance_count *
 12767      fvar->axis_count.  */
 12768 
 12769   if (INT_MULTIPLY_WRAPV (fvar->axis_count, sizeof *fvar->axis,
 12770                           &temp)
 12771       || INT_ADD_WRAPV (min_bytes, temp, &min_bytes))
 12772     goto bail;
 12773 
 12774   pad = alignof (struct sfnt_variation_axis);
 12775   pad -= min_bytes & (pad - 1);
 12776 
 12777   if (INT_ADD_WRAPV (min_bytes, pad, &min_bytes))
 12778     goto bail;
 12779 
 12780   if (INT_MULTIPLY_WRAPV (fvar->instance_count,
 12781                           sizeof *fvar->instance,
 12782                           &temp)
 12783       || INT_ADD_WRAPV (min_bytes, temp, &min_bytes))
 12784     goto bail;
 12785 
 12786   if (INT_MULTIPLY_WRAPV (fvar->instance_count,
 12787                           sizeof *fvar->instance->coords,
 12788                           &temp)
 12789       || INT_MULTIPLY_WRAPV (temp, fvar->axis_count, &temp)
 12790       || INT_ADD_WRAPV (min_bytes, temp, &min_bytes))
 12791     goto bail;
 12792 
 12793   /* Reallocate fvar.  */
 12794   fvar = xrealloc (fvar, min_bytes);
 12795 
 12796   /* Fill in offsets.  */
 12797   fvar->axis = (struct sfnt_variation_axis *) (fvar + 1);
 12798   fvar->instance
 12799     = (struct sfnt_instance *) (((char *) (fvar->axis
 12800                                            + fvar->axis_count))
 12801                                 + pad);
 12802 
 12803   /* Read axes.  */
 12804 
 12805   if (directory->length - SFNT_ENDOF (struct sfnt_fvar_table,
 12806                                       instance_size, uint16_t)
 12807       < sizeof *fvar->axis * fvar->axis_count)
 12808     goto bail;
 12809 
 12810   rc = read (fd, fvar->axis, sizeof *fvar->axis * fvar->axis_count);
 12811   if (rc != sizeof *fvar->axis * fvar->axis_count)
 12812     goto bail;
 12813 
 12814   /* Swap each axis.  */
 12815 
 12816   for (i = 0; i < fvar->axis_count; ++i)
 12817     {
 12818       sfnt_swap32 (&fvar->axis[i].axis_tag);
 12819       sfnt_swap32 (&fvar->axis[i].min_value);
 12820       sfnt_swap32 (&fvar->axis[i].default_value);
 12821       sfnt_swap32 (&fvar->axis[i].max_value);
 12822       sfnt_swap16 (&fvar->axis[i].flags);
 12823       sfnt_swap16 (&fvar->axis[i].name_id);
 12824     }
 12825 
 12826   /* Read each instance.  */
 12827 
 12828   if (fvar->instance_size < 1024 * 16)
 12829     buffer = alloca (fvar->instance_size);
 12830   else
 12831     buffer = xmalloc (fvar->instance_size);
 12832 
 12833   coords = (sfnt_fixed *) (fvar->instance + fvar->instance_count);
 12834 
 12835   for (i = 0; i < fvar->instance_count; ++i)
 12836     {
 12837       rc = read (fd, buffer, fvar->instance_size);
 12838       if (rc != fvar->instance_size)
 12839         goto bail;
 12840 
 12841       /* Fill in various fields.  */
 12842 
 12843       fvar->instance[i].name_id = *((uint16_t *) buffer);
 12844       fvar->instance[i].flags = *((uint16_t *) buffer + 1);
 12845       fvar->instance[i].ps_name_id = 0;
 12846 
 12847       sfnt_swap16 (&fvar->instance[i].name_id);
 12848       sfnt_swap16 (&fvar->instance[i].flags);
 12849 
 12850       /* Read coordinates.  */
 12851 
 12852       fvar->instance[i].coords = coords;
 12853       coords += fvar->axis_count;
 12854 
 12855       memcpy (fvar->instance[i].coords, buffer + 4,
 12856               sizeof *fvar->instance[i].coords * fvar->axis_count);
 12857 
 12858       /* Swap coordinates.  */
 12859 
 12860       for (j = 0; j < fvar->axis_count; ++j)
 12861         sfnt_swap32 (&fvar->instance[i].coords[j]);
 12862 
 12863       /* Read the PostScript name ID if necessary.  If not, set it to
 12864          nil.  */
 12865 
 12866       if (fvar->instance_size == ps_size)
 12867         {
 12868           fvar->instance[i].ps_name_id
 12869             = *(uint16_t *) (buffer + 4 + (sizeof *fvar->instance[i].coords
 12870                                            * fvar->axis_count));
 12871           sfnt_swap16 (&fvar->instance[i].ps_name_id);
 12872         }
 12873     }
 12874 
 12875   /* Free the temporary buffer.  */
 12876   if (buffer && fvar->instance_size >= 1024 * 16)
 12877     xfree (buffer);
 12878 
 12879   /* Return the fvar table.  */
 12880   return fvar;
 12881 
 12882  bail:
 12883   if (buffer && fvar->instance_size >= 1024 * 16)
 12884     xfree (buffer);
 12885 
 12886   xfree (fvar);
 12887   return NULL;
 12888 }
 12889 
 12890 
 12891 
 12892 /* Read a gvar table from the given font FD.  Use the table directory
 12893    specified in SUBTABLE.
 12894 
 12895    Return the gvar table upon success, else NULL.  */
 12896 
 12897 TEST_STATIC struct sfnt_gvar_table *
 12898 sfnt_read_gvar_table (int fd, struct sfnt_offset_subtable *subtable)
 12899 {
 12900   struct sfnt_table_directory *directory;
 12901   struct sfnt_gvar_table *gvar;
 12902   ssize_t rc;
 12903   size_t min_bytes, off_size, coordinate_size, data_size;
 12904   int i;
 12905   off_t offset;
 12906 
 12907   /* Find the table in the directory.  */
 12908 
 12909   directory = sfnt_find_table (subtable, SFNT_TABLE_GVAR);
 12910 
 12911   if (!directory)
 12912     return NULL;
 12913 
 12914   min_bytes = SFNT_ENDOF (struct sfnt_gvar_table,
 12915                           offset_to_data, uint32_t);
 12916 
 12917   /* Check that the length is at least min_bytes.  */
 12918   if (directory->length < min_bytes)
 12919     return NULL;
 12920 
 12921   /* Seek to the location given in the directory.  */
 12922   if (lseek (fd, directory->offset, SEEK_SET) == (off_t) -1)
 12923     return NULL;
 12924 
 12925   /* Allocate enough to hold the gvar table header.  */
 12926   gvar = xmalloc (sizeof *gvar);
 12927 
 12928   /* Read the gvar table header.  */
 12929   rc = read (fd, gvar, min_bytes);
 12930   if (rc != min_bytes)
 12931     goto bail;
 12932 
 12933   /* Swap what was read.  */
 12934   sfnt_swap16 (&gvar->version);
 12935   sfnt_swap16 (&gvar->reserved);
 12936   sfnt_swap16 (&gvar->axis_count);
 12937   sfnt_swap16 (&gvar->shared_coord_count);
 12938   sfnt_swap32 (&gvar->offset_to_coord);
 12939   sfnt_swap16 (&gvar->glyph_count);
 12940   sfnt_swap16 (&gvar->flags);
 12941   sfnt_swap32 (&gvar->offset_to_data);
 12942 
 12943   if (gvar->version != 1)
 12944     goto bail;
 12945 
 12946   if (gvar->offset_to_data > directory->length)
 12947     goto bail;
 12948 
 12949   /* Figure out the size required for the offset array.  Note that
 12950      there is one extra offset at the end of the array to mark the
 12951      size of the last glyph.  */
 12952 
 12953   if (gvar->flags & 1)
 12954     /* Offsets are long words.  */
 12955     off_size = sizeof (uint32_t) * (gvar->glyph_count + 1);
 12956   else
 12957     /* Offsets are words.  */
 12958     off_size = sizeof (uint16_t) * (gvar->glyph_count + 1);
 12959 
 12960   /* Now figure out the size of the shared coordinates.  */
 12961   coordinate_size = (gvar->shared_coord_count * gvar->axis_count
 12962                      * sizeof (uint16_t));
 12963 
 12964   /* And the size of the glyph variation data.  */
 12965   data_size = directory->length - gvar->offset_to_data;
 12966 
 12967   /* Wraparound.  */
 12968   if (data_size > directory->length)
 12969     goto bail;
 12970 
 12971   /* Figure out how big gvar needs to be.  */
 12972   if (INT_ADD_WRAPV (sizeof *gvar, coordinate_size, &min_bytes)
 12973       || INT_ADD_WRAPV (min_bytes, off_size, &min_bytes)
 12974       || INT_ADD_WRAPV (min_bytes, data_size, &min_bytes))
 12975     goto bail;
 12976 
 12977   /* Now allocate enough for all of this extra data.  */
 12978   gvar = xrealloc (gvar, min_bytes);
 12979 
 12980   /* Start reading offsets.  */
 12981 
 12982   if (!(gvar->flags & 1))
 12983     {
 12984       gvar->u.offset_word = (uint16_t *) (gvar + 1);
 12985       rc = read (fd, gvar->u.offset_word, off_size);
 12986       if (rc != off_size)
 12987         goto bail;
 12988 
 12989       for (i = 0; i <= gvar->glyph_count; ++i)
 12990         sfnt_swap16 (&gvar->u.offset_word[i]);
 12991     }
 12992   else
 12993     {
 12994       gvar->u.offset_long = (uint32_t *) (gvar + 1);
 12995       rc = read (fd, gvar->u.offset_long, off_size);
 12996       if (rc != off_size)
 12997         goto bail;
 12998 
 12999       for (i = 0; i <= gvar->glyph_count; ++i)
 13000         sfnt_swap32 (&gvar->u.offset_long[i]);
 13001     }
 13002 
 13003   /* Start reading shared coordinates.  */
 13004 
 13005   gvar->global_coords = ((sfnt_f2dot14 *) ((char *) gvar + off_size));
 13006 
 13007   if (gvar->shared_coord_count)
 13008     {
 13009       if (INT_ADD_WRAPV (gvar->offset_to_coord, directory->offset,
 13010                          &offset))
 13011         goto bail;
 13012 
 13013       if (lseek (fd, offset, SEEK_SET) != offset)
 13014         goto bail;
 13015 
 13016       if (read (fd, gvar->global_coords, coordinate_size)
 13017           != coordinate_size)
 13018         goto bail;
 13019 
 13020       for (i = 0; i <= coordinate_size / sizeof *gvar->global_coords; ++i)
 13021         sfnt_swap16 (&gvar->global_coords[i]);
 13022     }
 13023 
 13024   /* Finally, read the rest of the glyph variation data.  */
 13025   gvar->data_size = data_size;
 13026   gvar->glyph_variation_data
 13027     = (unsigned char *) (gvar->global_coords
 13028                          + (coordinate_size
 13029                             / sizeof *gvar->global_coords));
 13030 
 13031   if (gvar->data_size)
 13032     {
 13033       if (INT_ADD_WRAPV (gvar->offset_to_data, directory->offset,
 13034                          &offset))
 13035         goto bail;
 13036 
 13037       if (lseek (fd, offset, SEEK_SET) != offset)
 13038         goto bail;
 13039 
 13040       if (read (fd, gvar->glyph_variation_data,
 13041                 gvar->data_size) != gvar->data_size)
 13042         goto bail;
 13043     }
 13044 
 13045   /* Return the read gvar table.  */
 13046   return gvar;
 13047 
 13048  bail:
 13049   xfree (gvar);
 13050   return NULL;
 13051 }
 13052 
 13053 
 13054 
 13055 /* Read an avar table from the given font FD.  Use the table directory
 13056    specified in SUBTABLE.
 13057 
 13058    Return the avar table upon success, else NULL.  */
 13059 
 13060 TEST_STATIC struct sfnt_avar_table *
 13061 sfnt_read_avar_table (int fd, struct sfnt_offset_subtable *subtable)
 13062 {
 13063   struct sfnt_table_directory *directory;
 13064   struct sfnt_avar_table *avar;
 13065   ssize_t rc;
 13066   size_t min_size, size, i, k, j;
 13067   uint16_t *buffer;
 13068   struct sfnt_short_frac_correspondence *correspondences;
 13069 
 13070   /* Find the table in the directory.  */
 13071 
 13072   directory = sfnt_find_table (subtable, SFNT_TABLE_AVAR);
 13073 
 13074   if (!directory)
 13075     return NULL;
 13076 
 13077   min_size = SFNT_ENDOF (struct sfnt_avar_table, axis_count, uint32_t);
 13078 
 13079   /* Check that the length is at least min_size.  */
 13080   if (directory->length < min_size)
 13081     return NULL;
 13082 
 13083   /* Seek to the location given in the directory.  */
 13084   if (lseek (fd, directory->offset, SEEK_SET) == (off_t) -1)
 13085     return NULL;
 13086 
 13087   /* Allocate enough to hold the avar table header.  */
 13088   avar = xmalloc (sizeof *avar);
 13089 
 13090   /* Read the avar table header.  */
 13091   rc = read (fd, avar, min_size);
 13092   if (rc != min_size)
 13093     goto bail;
 13094 
 13095   /* Swap what was read.  */
 13096   sfnt_swap32 (&avar->version);
 13097   sfnt_swap32 (&avar->axis_count);
 13098 
 13099   if (avar->version != 0x00010000)
 13100     goto bail;
 13101 
 13102   if (avar->axis_count < 0)
 13103     goto bail;
 13104 
 13105   /* Allocate a buffer that holds the rest of the data.  */
 13106   size = directory->length - min_size;
 13107   buffer = xmalloc (size);
 13108   rc = read (fd, buffer, size);
 13109   if (rc != size)
 13110     goto bail1;
 13111 
 13112   /* Swap each word.  */
 13113   for (i = 0; i < size / sizeof *buffer; ++i)
 13114     sfnt_swap16 (&buffer[i]);
 13115 
 13116   /* Now, determine how big the resulting data needs to be.  Each
 13117      struct has a pointer field, and that should be its alignment.  */
 13118 
 13119   k = 0;
 13120   min_size = sizeof *avar;
 13121   for (i = 0; i < avar->axis_count; ++i)
 13122     {
 13123       /* Check that k remains within bounds.  */
 13124       if (k >= size / sizeof *buffer)
 13125         goto bail1;
 13126 
 13127       /* Now add one struct sfnt_short_frac_segment for each axis and
 13128          each of its correspondences.  */
 13129       if (INT_ADD_WRAPV (sizeof (struct sfnt_short_frac_segment),
 13130                          min_size, &min_size)
 13131           || INT_ADD_WRAPV (sizeof (struct sfnt_short_frac_correspondence)
 13132                             * buffer[k], min_size, &min_size))
 13133         goto bail1;
 13134 
 13135       /* Verify that words from here to buffer[1 + buffer[k] * 2], the
 13136          next pairCount field, are within bounds.  */
 13137       j = k + 1 + buffer[k] * 2;
 13138       if (j > size / sizeof *buffer)
 13139         goto bail1;
 13140 
 13141       /* Move to the next pairCount field.  */
 13142       k = j;
 13143     }
 13144 
 13145   /* Resize avar to min_size and start filling in various
 13146      pointers.  */
 13147   avar = xrealloc (avar, min_size);
 13148   avar->segments = (struct sfnt_short_frac_segment *) (avar + 1);
 13149   correspondences
 13150     = ((struct sfnt_short_frac_correspondence *) (avar->segments
 13151                                                   + avar->axis_count));
 13152 
 13153   k = 0;
 13154   for (i = 0; i < avar->axis_count; ++i)
 13155     {
 13156       avar->segments[i].pair_count = buffer[k++];
 13157       avar->segments[i].correspondence = correspondences;
 13158 
 13159       for (j = 0; j < avar->segments[i].pair_count; ++j)
 13160         {
 13161           correspondences->from_coord = buffer[k++];
 13162           correspondences->to_coord = buffer[k++];
 13163           correspondences++;
 13164         }
 13165     }
 13166 
 13167   /* Return the read avar table.  Free buffer.  */
 13168   xfree (buffer);
 13169   return avar;
 13170 
 13171  bail1:
 13172   xfree (buffer);
 13173  bail:
 13174   xfree (avar);
 13175   return NULL;
 13176 }
 13177 
 13178 
 13179 
 13180 /* Read a sequence of packed points starting from DATA.  Return the
 13181    number of points read in *NPOINTS_RETURN and the array of unpacked
 13182    points, or NULL upon failure.
 13183 
 13184    If non-NULL, set LOCATION to DATA plus the number of bytes read
 13185    upon success.
 13186 
 13187    Return (uint16_t *) -1 if there are no points at all.
 13188    In this case, deltas will apply to all points in the glyph,
 13189    and *NPOINTS_RETURN will be UINT16_MAX.
 13190 
 13191    END is one byte past the last byte in DATA.  */
 13192 
 13193 static uint16_t *
 13194 sfnt_read_packed_points (unsigned char *restrict data,
 13195                          uint16_t *npoints_return,
 13196                          unsigned char *restrict end,
 13197                          unsigned char *restrict *location)
 13198 {
 13199   int npoints;
 13200   uint16_t *points;
 13201   int i, first, control;
 13202 
 13203   points = NULL;
 13204   npoints = 0;
 13205 
 13206   if (data >= end)
 13207     return NULL;
 13208 
 13209   /* Load the control byte.  */
 13210   control = *data++;
 13211 
 13212   if (!control)
 13213     {
 13214       *npoints_return = UINT16_MAX;
 13215       *location = data;
 13216       return (uint16_t *) -1;
 13217     }
 13218 
 13219   /* Now figure out the number of points within.  */
 13220 
 13221   if (control & 0x80)
 13222     {
 13223       npoints = control & 0x7f;
 13224       npoints <<= 8;
 13225 
 13226       if (data >= end)
 13227         return NULL;
 13228 
 13229       npoints |= *data++;
 13230     }
 13231   else
 13232     npoints = control;
 13233 
 13234   /* Start reading points.  */
 13235   first = 0;
 13236   i = 0;
 13237   points = xmalloc (sizeof *points * npoints);
 13238 
 13239   while (i < npoints)
 13240     {
 13241       if (data >= end)
 13242         goto bail;
 13243 
 13244       control = *data++;
 13245 
 13246       if (control & 0x80)
 13247         {
 13248           /* Next control & 0x7f words are points.  */
 13249 
 13250           control &= 0x7f;
 13251 
 13252           while (control != -1 && i < npoints)
 13253             {
 13254               if (data >= end || data + 1 >= end)
 13255                 goto bail;
 13256 
 13257               first += *data++ << 8u;
 13258               first += *data++;
 13259               points[i] = first;
 13260               control -= 1, ++i;
 13261             }
 13262         }
 13263       else
 13264         {
 13265           /* Next control bytes are points.  */
 13266 
 13267           while (control != -1 && i < npoints)
 13268             {
 13269               if (data >= end)
 13270                 goto bail;
 13271 
 13272               first += *data++;
 13273               points[i] = first;
 13274               control -= 1, ++i;
 13275             }
 13276         }
 13277     }
 13278 
 13279   /* Return the points read.  */
 13280   *npoints_return = npoints;
 13281   *location = data;
 13282   return points;
 13283 
 13284  bail:
 13285   xfree (points);
 13286   return NULL;
 13287 }
 13288 
 13289 /* Read and return N packed deltas from DATA.  Set *DATA_RETURN to
 13290    DATA plus the number of bytes read.
 13291 
 13292    END is the end of the glyph variation data.  Value is an array of N
 13293    deltas upon success, and NULL upon failure.  */
 13294 
 13295 static sfnt_fword *
 13296 sfnt_read_packed_deltas (unsigned char *restrict data,
 13297                          unsigned char *restrict end,
 13298                          int n,
 13299                          unsigned char *restrict *data_return)
 13300 {
 13301   sfnt_fword *deltas;
 13302   int i, count;
 13303   unsigned char control;
 13304   uint16_t value;
 13305 
 13306   if (data >= end)
 13307     return NULL;
 13308 
 13309   deltas = xmalloc (sizeof *deltas * n);
 13310   i = 0;
 13311 
 13312   while (i < n)
 13313     {
 13314       if (data >= end)
 13315         goto fail;
 13316 
 13317       control = *data++;
 13318       count = control & 0x3f;
 13319 
 13320       while (count != -1 && i < n)
 13321         {
 13322           if (control & 0x80)
 13323             deltas[i++] = 0;
 13324           else if (control & 0x40)
 13325             {
 13326               if (data + 1 >= end)
 13327                 goto fail;
 13328 
 13329               value = *data++ << 8;
 13330               value |= *data++;
 13331               deltas[i++] = value;
 13332             }
 13333           else
 13334             {
 13335               if (data >= end)
 13336                 goto fail;
 13337 
 13338               deltas[i++] = (signed char) *data++;
 13339             }
 13340 
 13341           --count;
 13342         }
 13343     }
 13344 
 13345   *data_return = data;
 13346   return deltas;
 13347 
 13348  fail:
 13349   xfree (deltas);
 13350   return NULL;
 13351 }
 13352 
 13353 /* Read a cvar table from the given font FD.  Use the table directory
 13354    specified in SUBTABLE, axis information provided in the fvar table
 13355    FVAR, and CVT information provided in the cvt table CVT.
 13356 
 13357    Return the cvar table upon success, else NULL.  */
 13358 
 13359 TEST_STATIC struct sfnt_cvar_table *
 13360 sfnt_read_cvar_table (int fd, struct sfnt_offset_subtable *subtable,
 13361                       struct sfnt_fvar_table *fvar,
 13362                       struct sfnt_cvt_table *cvt)
 13363 {
 13364   struct sfnt_table_directory *directory;
 13365   struct sfnt_cvar_table *cvar;
 13366   ssize_t rc;
 13367   size_t ntuples, size;
 13368   int i, j;
 13369   sfnt_f2dot14 *coords;
 13370   uint16_t *local, *points, npoints, data_size, min_size, index;
 13371   unsigned char *buffer, *data, *end, *tuple;
 13372   ptrdiff_t data_offset;
 13373   sfnt_fword *deltas;
 13374 
 13375   /* Find the table in the directory.  */
 13376 
 13377   directory = sfnt_find_table (subtable, SFNT_TABLE_CVAR);
 13378 
 13379   if (!directory)
 13380     return NULL;
 13381 
 13382   min_size = SFNT_ENDOF (struct sfnt_cvar_table, data_offset,
 13383                          uint16_t);
 13384 
 13385   /* Check that the length is at least min_size.  */
 13386   if (directory->length < min_size)
 13387     return NULL;
 13388 
 13389   /* Seek to the location given in the directory.  */
 13390   if (lseek (fd, directory->offset, SEEK_SET) == (off_t) -1)
 13391     return NULL;
 13392 
 13393   /* Allocate enough to hold the cvar table header.  */
 13394   cvar = xmalloc (sizeof *cvar);
 13395 
 13396   /* Read the cvar table header.  */
 13397   rc = read (fd, cvar, min_size);
 13398   if (rc != min_size)
 13399     goto bail;
 13400 
 13401   /* Swap what was read.  */
 13402   sfnt_swap32 (&cvar->version);
 13403   sfnt_swap16 (&cvar->tuple_count);
 13404   sfnt_swap16 (&cvar->data_offset);
 13405 
 13406   /* Read the rest of the table.  */
 13407   size = directory->length - min_size;
 13408   buffer = xmalloc (size);
 13409   rc = read (fd, buffer, size);
 13410   if (rc != size)
 13411     goto bail;
 13412 
 13413   /* Now figure out how large cvar must be by reading the tuples.  */
 13414 
 13415   ntuples = cvar->tuple_count & 0x0fff;
 13416   data_offset = ((ptrdiff_t) cvar->data_offset
 13417                  - (ptrdiff_t) min_size);
 13418   end = buffer + size;
 13419 
 13420   if (data_offset < 0)
 13421     goto bail1;
 13422 
 13423   /* See if there are shared points, and read them if there are.  */
 13424 
 13425   data = buffer + data_offset;
 13426   tuple = buffer;
 13427   points = NULL;
 13428 
 13429   /* Initialize `npoints' to zero.  The specification doesn't say what
 13430      should happen with tuples using shared point numbers if it is not
 13431      set later on; simply assume no points at all apply to such a
 13432      tuple.  */
 13433 
 13434   npoints = 0;
 13435 
 13436   /* Initialize `size' to 0.  */
 13437   size = 0;
 13438 
 13439   if (cvar->tuple_count & 0x8000)
 13440     {
 13441       points = sfnt_read_packed_points (data, &npoints, end,
 13442                                         &tuple);
 13443       if (!points)
 13444         goto bail1;
 13445 
 13446       /* Add npoints words to the size.  If npoints is UINT16_MAX, no
 13447          coordinates will actually be allocated.  */
 13448 
 13449       if (npoints != UINT16_MAX)
 13450         size = npoints * sizeof *points;
 13451     }
 13452 
 13453   while (ntuples--)
 13454     {
 13455       data = buffer + data_offset;
 13456 
 13457       /* Read the tuple.  */
 13458       if (tuple + 3 >= end)
 13459         goto bail2;
 13460 
 13461       memcpy (&data_size, tuple, sizeof data_size);
 13462       tuple += sizeof data_size;
 13463       memcpy (&index, tuple, sizeof index);
 13464       tuple += sizeof index;
 13465       sfnt_swap16 (&data_size);
 13466       sfnt_swap16 (&index);
 13467 
 13468       /* Increment the offset to the data by the data size specified
 13469          here.  */
 13470       data_offset += data_size;
 13471 
 13472       if (index & 0x8000)
 13473         {
 13474           /* Embedded coordinates are present.  Read each coordinate
 13475              and add it to the size.  */
 13476 
 13477           if (tuple + fvar->axis_count * sizeof *coords - 1 >= end)
 13478             goto bail2;
 13479 
 13480           tuple += sizeof *coords * fvar->axis_count;
 13481           if (INT_ADD_WRAPV (size, sizeof *coords * fvar->axis_count,
 13482                              &size))
 13483             goto bail2;
 13484         }
 13485       else
 13486         /* This table is invalid, as cvar tables don't have global
 13487            coordinates.  */
 13488         goto bail2;
 13489 
 13490       /* Now read indeterminate tuples if required.  */
 13491       if (index & 0x4000)
 13492         {
 13493           tuple += fvar->axis_count * 4;
 13494           if (INT_ADD_WRAPV (size, fvar->axis_count * 4, &size))
 13495             goto bail2;
 13496         }
 13497 
 13498       /* Add one point and one delta for each CVT element.  */
 13499       if (INT_ADD_WRAPV (size, cvt->num_elements * 4, &size))
 13500         goto bail2;
 13501 
 13502       /* Now add the size of the tuple.  */
 13503       if (INT_ADD_WRAPV (size, sizeof *cvar->variation, &size))
 13504         goto bail2;
 13505     }
 13506 
 13507   if (INT_ADD_WRAPV (sizeof *cvar, size, &size))
 13508     goto bail2;
 13509 
 13510   /* Reallocate cvar.  */
 13511   cvar = xrealloc (cvar, size);
 13512   ntuples = cvar->tuple_count & 0x0fff;
 13513   cvar->variation = (struct sfnt_tuple_variation *) (cvar + 1);
 13514   coords = (sfnt_f2dot14 *) (cvar->variation + ntuples);
 13515   tuple = buffer;
 13516 
 13517   data_offset = ((ptrdiff_t) cvar->data_offset
 13518                  - (ptrdiff_t) min_size);
 13519 
 13520   /* Start reading the tuples into cvar.  */
 13521   for (i = 0; i < ntuples; ++i)
 13522     {
 13523       data = buffer + data_offset;
 13524 
 13525       /* Read the tuple.  */
 13526       if (tuple + 3 >= end)
 13527         goto bail2;
 13528 
 13529       memcpy (&data_size, tuple, sizeof data_size);
 13530       tuple += sizeof data_size;
 13531       memcpy (&index, tuple, sizeof index);
 13532       tuple += sizeof index;
 13533       sfnt_swap16 (&data_size);
 13534       sfnt_swap16 (&index);
 13535 
 13536       /* Increment the offset to the data by the data size specified
 13537          here.  */
 13538       data_offset += data_size;
 13539 
 13540       cvar->variation[i].intermediate_start = NULL;
 13541       cvar->variation[i].intermediate_end = NULL;
 13542 
 13543       if (index & 0x8000)
 13544         {
 13545           /* Embedded coordinates are present.  Read each
 13546              coordinate.  */
 13547           cvar->variation[i].coordinates = coords;
 13548 
 13549           for (j = 0; j < fvar->axis_count; ++j)
 13550             {
 13551               if (tuple + 1 >= end)
 13552                 goto bail2;
 13553 
 13554               memcpy (coords++, tuple, sizeof *coords);
 13555               tuple += sizeof *coords;
 13556               sfnt_swap16 (coords);
 13557             }
 13558         }
 13559       else
 13560         goto bail2;
 13561 
 13562       /* Now read indeterminate tuples if required.  */
 13563       if (index & 0x4000)
 13564         {
 13565           cvar->variation[i].intermediate_start = coords;
 13566 
 13567           for (j = 0; j < fvar->axis_count; ++j)
 13568             {
 13569               if (tuple + 1 >= end)
 13570                 goto bail2;
 13571 
 13572               memcpy (coords++, tuple, sizeof *coords);
 13573               tuple += sizeof *coords;
 13574               sfnt_swap16 (coords);
 13575             }
 13576 
 13577           cvar->variation[i].intermediate_end = coords;
 13578 
 13579           for (j = 0; j < fvar->axis_count; ++j)
 13580             {
 13581               if (tuple + 1 >= end)
 13582                 goto bail2;
 13583 
 13584               memcpy (coords++, tuple, sizeof *coords);
 13585               tuple += sizeof *coords;
 13586               sfnt_swap16 (coords);
 13587             }
 13588         }
 13589 
 13590       /* Finally, read private ``point'' numbers.  If this flag is not
 13591          set, use shared point numbers previously read.
 13592 
 13593          Read at most CVT->num_elements points, as that is all the
 13594          storage allocated.  */
 13595 
 13596       if (index & 0x2000)
 13597         {
 13598           local = sfnt_read_packed_points (data, &cvar->variation[i].num_points,
 13599                                            end, &data);
 13600           if (!local)
 13601             goto bail2;
 13602 
 13603           /* If points apply to all CVT indices, skip this part.  */
 13604 
 13605           if (cvar->variation[i].num_points != UINT16_MAX)
 13606             {
 13607               if (cvar->variation[i].num_points > cvt->num_elements)
 13608                 cvar->variation[i].num_points = cvt->num_elements;
 13609 
 13610               cvar->variation[i].points = (uint16_t *) coords;
 13611               for (j = 0; j < cvar->variation[i].num_points; ++j)
 13612                 *coords++ = local[j];
 13613               xfree (local);
 13614             }
 13615           else
 13616             cvar->variation[i].points = NULL;
 13617         }
 13618       else
 13619         {
 13620           /* Copy in the shared point numbers instead.  */
 13621           cvar->variation[i].num_points = npoints;
 13622 
 13623           if (npoints != UINT16_MAX)
 13624             {
 13625               if (cvar->variation[i].num_points > cvt->num_elements)
 13626                 cvar->variation[i].num_points = cvt->num_elements;
 13627 
 13628               cvar->variation[i].points = (uint16_t *) coords;
 13629               for (j = 0; j < cvar->variation[i].num_points; ++j)
 13630                 *coords++ = points[j];
 13631             }
 13632           else
 13633             cvar->variation[i].points = NULL;
 13634         }
 13635 
 13636       /* And read packed deltas.  If cvar->variation[i].num_points is
 13637          UINT16_MAX, then there is one delta for each CVT entry.
 13638          Otherwise, there are that many deltas.  */
 13639 
 13640       if (cvar->variation[i].num_points == UINT16_MAX)
 13641         {
 13642           deltas = sfnt_read_packed_deltas (data, end, cvt->num_elements,
 13643                                             &data);
 13644 
 13645           if (!deltas)
 13646             goto bail2;
 13647 
 13648           cvar->variation[i].deltas = coords;
 13649 
 13650           for (j = 0; j < cvt->num_elements; ++j)
 13651             *coords++ = deltas[j];
 13652           xfree (deltas);
 13653         }
 13654       else
 13655         {
 13656           deltas = sfnt_read_packed_deltas (data, end,
 13657                                             cvar->variation[i].num_points,
 13658                                             &data);
 13659           if (!deltas)
 13660             goto bail2;
 13661 
 13662           cvar->variation[i].deltas = coords;
 13663 
 13664           for (j = 0; j < cvar->variation[i].num_points; ++j)
 13665             *coords++ = deltas[j];
 13666           xfree (deltas);
 13667         }
 13668     }
 13669 
 13670   /* Free data and return the read cvar table.  */
 13671   if (points != (void *) -1)
 13672     xfree (points);
 13673   xfree (buffer);
 13674   return cvar;
 13675 
 13676  bail2:
 13677   if (points != (void *) -1)
 13678     xfree (points);
 13679  bail1:
 13680   xfree (buffer);
 13681  bail:
 13682   xfree (cvar);
 13683   return NULL;
 13684 }
 13685 
 13686 
 13687 
 13688 /* Initialize the specified BLEND with the given FVAR and GVAR tables.
 13689    If non-NULL, adjust normalized coordinates using the axis variation
 13690    table AVAR; similarly, adjust interpreter CVT values using CVAR, if
 13691    specified.  */
 13692 
 13693 TEST_STATIC void
 13694 sfnt_init_blend (struct sfnt_blend *blend, struct sfnt_fvar_table *fvar,
 13695                  struct sfnt_gvar_table *gvar, struct sfnt_avar_table *avar,
 13696                  struct sfnt_cvar_table *cvar)
 13697 {
 13698   size_t size;
 13699 
 13700   blend->fvar = fvar;
 13701   blend->gvar = gvar;
 13702   blend->avar = avar;
 13703   blend->cvar = cvar;
 13704 
 13705   /* Allocate a single array to hold both coords and norm_coords.  */
 13706   size = (fvar->axis_count * sizeof *blend->coords * 2);
 13707   blend->coords = xmalloc (size);
 13708   blend->norm_coords = blend->coords + fvar->axis_count;
 13709 }
 13710 
 13711 /* Free what was initialized in the specified BLEND.  */
 13712 
 13713 TEST_STATIC void
 13714 sfnt_free_blend (struct sfnt_blend *blend)
 13715 {
 13716   xfree (blend->coords);
 13717 }
 13718 
 13719 /* Normalize BLEND->fvar->axis_count coordinates in BLEND->coords and
 13720    place the result in BLEND->norm_coords.  */
 13721 
 13722 TEST_STATIC void
 13723 sfnt_normalize_blend (struct sfnt_blend *blend)
 13724 {
 13725   struct sfnt_variation_axis *axis;
 13726   int i, j;
 13727   sfnt_fixed from, coord, j0, j1, j2;
 13728   sfnt_fixed from_last, coord_last;
 13729   struct sfnt_short_frac_segment *segment;
 13730 
 13731   /* For each axis... */
 13732   for (i = 0; i < blend->fvar->axis_count; ++i)
 13733     {
 13734       /* Normalize based on [min, default, max], into [-1, 0, 1].  */
 13735       axis = &blend->fvar->axis[i];
 13736 
 13737       /* Load the current design coordinate.  */
 13738       coord = blend->coords[i];
 13739 
 13740       /* Keep it within bounds.  */
 13741 
 13742       if (coord > axis->max_value)
 13743         coord = axis->max_value;
 13744       else if (coord < axis->min_value)
 13745         coord = axis->min_value;
 13746 
 13747       if (coord > axis->default_value)
 13748         {
 13749           /* Avoid division by 0.  */
 13750           if (axis->max_value != axis->default_value)
 13751             blend->norm_coords[i]
 13752               = sfnt_div_fixed (sfnt_sub (coord, axis->default_value),
 13753                                 sfnt_sub (axis->max_value,
 13754                                           axis->default_value));
 13755           else
 13756             blend->norm_coords[i] = 0;
 13757         }
 13758       else if (coord < axis->default_value)
 13759         {
 13760           if (axis->default_value != axis->min_value)
 13761             blend->norm_coords[i]
 13762               = sfnt_div_fixed (sfnt_sub (coord, axis->default_value),
 13763                                 sfnt_sub (axis->default_value,
 13764                                           axis->min_value));
 13765           else
 13766             blend->norm_coords[i] = 0;
 13767         }
 13768       else
 13769         blend->norm_coords[i] = 0;
 13770     }
 13771 
 13772   /* Now, apply axis variations, but only if the avar table has the
 13773      right number of axes.  */
 13774 
 13775   if (blend->avar && (blend->fvar->axis_count
 13776                       == blend->avar->axis_count))
 13777     {
 13778       for (i = 0; i < blend->fvar->axis_count; ++i)
 13779         {
 13780           segment = &blend->avar->segments[i];
 13781 
 13782           /* Search for a correspondence record above the normalized
 13783              coordinate of this axis.  */
 13784 
 13785           for (j = 1; j < segment->pair_count; ++j)
 13786             {
 13787               from = segment->correspondence[j].from_coord * 4;
 13788               coord = segment->correspondence[j].to_coord * 4;
 13789 
 13790               if (blend->norm_coords[i] < from)
 13791                 {
 13792                   from_last
 13793                     = segment->correspondence[j - 1].from_coord * 4;
 13794                   coord_last
 13795                     = segment->correspondence[j - 1].to_coord * 4;
 13796 
 13797                   j0 = blend->norm_coords[i] - from_last;
 13798                   j1 = coord - coord_last;
 13799                   j2 = from - from_last;
 13800 
 13801                   blend->norm_coords[i]
 13802                     = (sfnt_multiply_divide_signed (j0, j1, j2) + coord_last);
 13803                   break;
 13804                 }
 13805             }
 13806         }
 13807     }
 13808 }
 13809 
 13810 
 13811 
 13812 struct sfnt_gvar_glyph_header
 13813 {
 13814   /* A packed field. The high 4 bits are flags and the low 12 bits are
 13815      the number of tuples for this glyph.  The number of tuples can be
 13816      any number between 1 and 4095.  */
 13817   uint16_t tuple_count;
 13818 
 13819   /* Offset from the start of the GlyphVariationData table to the
 13820      serialized data.  */
 13821   uint16_t data_offset;
 13822 };
 13823 
 13824 /* Given a BLEND containing normalized coordinates, an array of
 13825    BLEND->gvar->axis_count tuple coordinates, and, if INTERMEDIATE_P,
 13826    a range of tuple coordinates from INTERMEDIATE_START to
 13827    INTERMEDIATE_END, return the scaling factor to apply to deltas for
 13828    each corresponding point.  */
 13829 
 13830 static sfnt_fixed
 13831 sfnt_compute_tuple_scale (struct sfnt_blend *blend, bool intermediate_p,
 13832                           sfnt_f2dot14 *coords,
 13833                           sfnt_f2dot14 *intermediate_start,
 13834                           sfnt_f2dot14 *intermediate_end)
 13835 {
 13836   int i;
 13837   sfnt_fixed coord, start UNINIT, end UNINIT;
 13838   sfnt_fixed scale;
 13839 
 13840   /* scale is initially 1.0.  */
 13841   scale = 0200000;
 13842 
 13843   for (i = 0; i < blend->gvar->axis_count; ++i)
 13844     {
 13845       /* Load values for this axis, scaled up to sfnt_fixed.  */
 13846       coord = coords[i] * 4;
 13847 
 13848       /* GCC warns about start and end being used when uninitialized,
 13849          but they are used only if intermediate_p.  */
 13850 
 13851       if (intermediate_p)
 13852         {
 13853           start = intermediate_start[i] * 4;
 13854           end = intermediate_start[i] * 4;
 13855         }
 13856 
 13857       /* Ignore tuples that can be skipped.  */
 13858 
 13859       if (!coord)
 13860         continue;
 13861 
 13862       /* If the coordinate is set to 0, then deltas should not be
 13863          applied.  Return 0.  */
 13864 
 13865       if (!blend->norm_coords[i])
 13866         return 0;
 13867 
 13868       /* If no scaling need take place, continue.  */
 13869 
 13870       if (blend->norm_coords[i] == coord)
 13871         continue;
 13872 
 13873       if (!intermediate_p)
 13874         {
 13875           /* Not an intermediate tuple; if coord is less than 0 and
 13876              blend->norm_coords[i] < coord, or coord is more than 0
 13877              and blend->norm_coords[i] > coord, then it doesn't fit,
 13878              so return.  */
 13879 
 13880           if (blend->norm_coords[i] < MIN (0, coord)
 13881               || blend->norm_coords[i] > MAX (0, coord))
 13882             return 0;
 13883 
 13884           scale = sfnt_multiply_divide_signed (scale,
 13885                                                blend->norm_coords[i],
 13886                                                coord);
 13887         }
 13888       else
 13889         {
 13890           /* Otherwise, renormalize between start and end.  */
 13891 
 13892           if (blend->norm_coords[i] < start
 13893               || blend->norm_coords[i] > end)
 13894             return 0;
 13895 
 13896           if (blend->norm_coords[i] < coord)
 13897             scale = sfnt_multiply_divide (scale,
 13898                                           blend->norm_coords[i] - start,
 13899                                           coord - start);
 13900           else
 13901             scale = sfnt_multiply_divide (scale,
 13902                                           end - blend->norm_coords[i],
 13903                                           end - coord);
 13904         }
 13905     }
 13906 
 13907   return scale;
 13908 }
 13909 
 13910 /* Infer point positions for points that have been partially moved
 13911    within the contour in GLYPH denoted by START and END.  */
 13912 
 13913 static void
 13914 sfnt_infer_deltas_1 (struct sfnt_glyph *glyph, size_t start,
 13915                      size_t end, bool *touched, sfnt_fword *x,
 13916                      sfnt_fword *y)
 13917 {
 13918   size_t i, pair_start, pair_end, pair_first, j;
 13919   sfnt_fword min_pos, max_pos, position;
 13920   sfnt_fixed ratio, delta;
 13921 
 13922   pair_start = pair_first = -1;
 13923 
 13924   /* Look for pairs of touched points.  */
 13925 
 13926   for (i = start; i <= end; ++i)
 13927     {
 13928       if (!touched[i])
 13929         continue;
 13930 
 13931       if (pair_start == -1)
 13932         {
 13933           pair_first = i;
 13934           goto next;
 13935         }
 13936 
 13937       pair_end = i;
 13938 
 13939       /* pair_start to pair_end are now a pair of points, where points
 13940          in between should be interpolated.  */
 13941 
 13942       for (j = pair_start + 1; j < pair_end; ++j)
 13943         {
 13944           /* Consider the X axis.  Set min_pos and max_pos to the
 13945              smallest and greatest values along that axis.  */
 13946           min_pos = MIN (x[pair_start], x[pair_end]);
 13947           max_pos = MAX (x[pair_start], x[pair_end]);
 13948 
 13949           /* Now see if the current point lies between min and
 13950              max... */
 13951           if (x[j] >= min_pos && x[j] <= max_pos)
 13952             {
 13953               /* If min_pos and max_pos are the same, apply
 13954                  pair_start's delta if it is identical to that of
 13955                  pair_end, or apply nothing at all otherwise.  */
 13956 
 13957               if (min_pos == max_pos)
 13958                 {
 13959                   if ((glyph->simple->x_coordinates[pair_start]
 13960                        - x[pair_start])
 13961                       == (glyph->simple->x_coordinates[pair_end]
 13962                           - x[pair_end]))
 13963                     glyph->simple->x_coordinates[j]
 13964                       += (glyph->simple->x_coordinates[pair_start]
 13965                           - x[pair_start]);
 13966 
 13967                   continue;
 13968                 }
 13969 
 13970               /* Interpolate between min_pos and max_pos.  */
 13971               ratio = sfnt_div_fixed ((sfnt_sub (x[j], min_pos)
 13972                                        * 65536),
 13973                                       (sfnt_sub (max_pos, min_pos)
 13974                                        * 65536));
 13975 
 13976               /* Load the current positions of pair_start and pair_end
 13977                  along this axis.  */
 13978               min_pos = MIN (glyph->simple->x_coordinates[pair_start],
 13979                              glyph->simple->x_coordinates[pair_end]);
 13980               max_pos = MAX (glyph->simple->x_coordinates[pair_start],
 13981                              glyph->simple->x_coordinates[pair_end]);
 13982 
 13983               /* Lerp in between.  */
 13984               delta = sfnt_sub (max_pos, min_pos);
 13985               delta = sfnt_mul_fixed (ratio, delta);
 13986               glyph->simple->x_coordinates[j] = min_pos + delta;
 13987             }
 13988           else
 13989             {
 13990               /* ... otheriwse, move point j by the delta of the
 13991                  nearest touched point.  */
 13992 
 13993               if (x[j] >= max_pos)
 13994                 {
 13995                   position = MAX (glyph->simple->x_coordinates[pair_start],
 13996                                   glyph->simple->x_coordinates[pair_end]);
 13997                   delta = position - max_pos;
 13998                 }
 13999               else
 14000                 {
 14001                   position = MIN (glyph->simple->x_coordinates[pair_start],
 14002                                   glyph->simple->x_coordinates[pair_end]);
 14003                   delta = position - min_pos;
 14004                 }
 14005 
 14006               glyph->simple->x_coordinates[j] = x[j] + delta;
 14007             }
 14008 
 14009           /* Now, consider the Y axis.  */
 14010           min_pos = MIN (y[pair_start], y[pair_end]);
 14011           max_pos = MAX (y[pair_start], y[pair_end]);
 14012 
 14013           /* Now see if the current point lies between min and
 14014              max... */
 14015           if (y[j] >= min_pos && y[j] <= max_pos)
 14016             {
 14017               /* If min_pos and max_pos are the same, apply
 14018                  pair_start's delta if it is identical to that of
 14019                  pair_end, or apply nothing at all otherwise.  */
 14020 
 14021               if (min_pos == max_pos)
 14022                 {
 14023                   if ((glyph->simple->y_coordinates[pair_start]
 14024                        - y[pair_start])
 14025                       == (glyph->simple->y_coordinates[pair_end]
 14026                           - y[pair_end]))
 14027                     glyph->simple->y_coordinates[j]
 14028                       += (glyph->simple->y_coordinates[pair_start]
 14029                           - y[pair_start]);
 14030 
 14031                   continue;
 14032                 }
 14033 
 14034               /* Interpolate between min_pos and max_pos.  */
 14035               ratio = sfnt_div_fixed ((sfnt_sub (y[j], min_pos)
 14036                                        * 65536),
 14037                                       (sfnt_sub (max_pos, min_pos)
 14038                                        * 65536));
 14039 
 14040               /* Load the current positions of pair_start and pair_end
 14041                  along this axis.  */
 14042               min_pos = MIN (glyph->simple->y_coordinates[pair_start],
 14043                              glyph->simple->y_coordinates[pair_end]);
 14044               max_pos = MAX (glyph->simple->y_coordinates[pair_start],
 14045                              glyph->simple->y_coordinates[pair_end]);
 14046 
 14047               /* Lerp in between.  */
 14048               delta = sfnt_sub (max_pos, min_pos);
 14049               delta = sfnt_mul_fixed (ratio, delta);
 14050               glyph->simple->y_coordinates[j] = min_pos + delta;
 14051             }
 14052           else
 14053             {
 14054               /* ... otheriwse, move point j by the delta of the
 14055                  nearest touched point.  */
 14056 
 14057               if (y[j] >= max_pos)
 14058                 {
 14059                   position = MAX (glyph->simple->y_coordinates[pair_start],
 14060                                   glyph->simple->y_coordinates[pair_end]);
 14061                   delta = position - max_pos;
 14062                 }
 14063               else
 14064                 {
 14065                   position = MIN (glyph->simple->y_coordinates[pair_start],
 14066                                   glyph->simple->y_coordinates[pair_end]);
 14067                   delta = position - min_pos;
 14068                 }
 14069 
 14070               glyph->simple->y_coordinates[j] = y[j] + delta;
 14071             }
 14072         }
 14073 
 14074     next:
 14075       pair_start = i;
 14076     }
 14077 
 14078   /* If pair_start is set, then lerp points between it and
 14079      pair_first.  */
 14080 
 14081   if (pair_start != (size_t) -1)
 14082     {
 14083       j = pair_start + 1;
 14084 
 14085       if (j > end)
 14086         j = start;
 14087 
 14088       pair_end = pair_first;
 14089 
 14090       while (j != pair_first)
 14091         {
 14092           /* Consider the X axis.  Set min_pos and max_pos to the
 14093              smallest and greatest values along that axis.  */
 14094           min_pos = MIN (x[pair_start], x[pair_end]);
 14095           max_pos = MAX (x[pair_start], x[pair_end]);
 14096 
 14097           /* Now see if the current point lies between min and
 14098              max... */
 14099           if (x[j] >= min_pos && x[j] <= max_pos)
 14100             {
 14101               /* If min_pos and max_pos are the same, apply
 14102                  pair_start's delta if it is identical to that of
 14103                  pair_end, or apply nothing at all otherwise.  */
 14104 
 14105               if (min_pos == max_pos)
 14106                 {
 14107                   if ((glyph->simple->x_coordinates[pair_start]
 14108                        - x[pair_start])
 14109                       == (glyph->simple->x_coordinates[pair_end]
 14110                           - x[pair_end]))
 14111                     glyph->simple->x_coordinates[j]
 14112                       += (glyph->simple->x_coordinates[pair_start]
 14113                           - x[pair_start]);
 14114 
 14115                   goto next_1;
 14116                 }
 14117 
 14118               /* Interpolate between min_pos and max_pos.  */
 14119               ratio = sfnt_div_fixed ((sfnt_sub (x[j], min_pos)
 14120                                        * 65536),
 14121                                       (sfnt_sub (max_pos, min_pos)
 14122                                        * 65536));
 14123 
 14124               /* Load the current positions of pair_start and pair_end
 14125                  along this axis.  */
 14126               min_pos = MIN (glyph->simple->x_coordinates[pair_start],
 14127                              glyph->simple->x_coordinates[pair_end]);
 14128               max_pos = MAX (glyph->simple->x_coordinates[pair_start],
 14129                              glyph->simple->x_coordinates[pair_end]);
 14130 
 14131               /* Lerp in between.  */
 14132               delta = sfnt_sub (max_pos, min_pos);
 14133               delta = sfnt_mul_fixed (ratio, delta);
 14134               glyph->simple->x_coordinates[j] = min_pos + delta;
 14135             }
 14136           else
 14137             {
 14138               /* ... otheriwse, move point j by the delta of the
 14139                  nearest touched point.  */
 14140 
 14141               if (x[j] >= max_pos)
 14142                 {
 14143                   position = MAX (glyph->simple->x_coordinates[pair_start],
 14144                                   glyph->simple->x_coordinates[pair_end]);
 14145                   delta = position - max_pos;
 14146                 }
 14147               else
 14148                 {
 14149                   position = MIN (glyph->simple->x_coordinates[pair_start],
 14150                                   glyph->simple->x_coordinates[pair_end]);
 14151                   delta = position - min_pos;
 14152                 }
 14153 
 14154               glyph->simple->x_coordinates[j] = x[j] + delta;
 14155             }
 14156 
 14157           /* Now, consider the Y axis.  */
 14158           min_pos = MIN (y[pair_start], y[pair_end]);
 14159           max_pos = MAX (y[pair_start], y[pair_end]);
 14160 
 14161           /* Now see if the current point lies between min and
 14162              max... */
 14163           if (y[j] >= min_pos && y[j] <= max_pos)
 14164             {
 14165               /* If min_pos and max_pos are the same, apply
 14166                  pair_start's delta if it is identical to that of
 14167                  pair_end, or apply nothing at all otherwise.  */
 14168 
 14169               if (min_pos == max_pos)
 14170                 {
 14171                   if ((glyph->simple->y_coordinates[pair_start]
 14172                        - y[pair_start])
 14173                       == (glyph->simple->y_coordinates[pair_end]
 14174                           - y[pair_end]))
 14175                     glyph->simple->y_coordinates[j]
 14176                       += (glyph->simple->y_coordinates[pair_start]
 14177                           - y[pair_start]);
 14178 
 14179                   goto next_1;
 14180                 }
 14181 
 14182               /* Interpolate between min_pos and max_pos.  */
 14183               ratio = sfnt_div_fixed ((sfnt_sub (y[j], min_pos)
 14184                                        * 65536),
 14185                                       (sfnt_sub (max_pos, min_pos)
 14186                                        * 65536));
 14187 
 14188               /* Load the current positions of pair_start and pair_end
 14189                  along this axis.  */
 14190               min_pos = MIN (glyph->simple->y_coordinates[pair_start],
 14191                              glyph->simple->y_coordinates[pair_end]);
 14192               max_pos = MAX (glyph->simple->y_coordinates[pair_start],
 14193                              glyph->simple->y_coordinates[pair_end]);
 14194 
 14195               /* Lerp in between.  */
 14196               delta = sfnt_sub (max_pos, min_pos);
 14197               delta = sfnt_mul_fixed (ratio, delta);
 14198               glyph->simple->y_coordinates[j] = min_pos + delta;
 14199             }
 14200           else
 14201             {
 14202               /* ... otheriwse, move point j by the delta of the
 14203                  nearest touched point.  */
 14204 
 14205               if (y[j] >= max_pos)
 14206                 {
 14207                   position = MAX (glyph->simple->y_coordinates[pair_start],
 14208                                   glyph->simple->y_coordinates[pair_end]);
 14209                   delta = position - max_pos;
 14210                 }
 14211               else
 14212                 {
 14213                   position = MIN (glyph->simple->y_coordinates[pair_start],
 14214                                   glyph->simple->y_coordinates[pair_end]);
 14215                   delta = position - min_pos;
 14216                 }
 14217 
 14218               glyph->simple->y_coordinates[j] = y[j] + delta;
 14219             }
 14220 
 14221         next_1:
 14222           j++;
 14223           if (j > end)
 14224             j = start;
 14225         }
 14226     }
 14227 }
 14228 
 14229 /* Infer point positions for contours that have been partially moved
 14230    by variation.  For each contour in GLYPH, find pairs of points
 14231    which have had deltas applied.  For each such pair, interpolate
 14232    points between the first point in the pair and the second by
 14233    considering each point along every one of the two axes (X and Y)
 14234    like so:
 14235 
 14236      - For each point that lies between the first point and the last
 14237        on the axis currently being considered, interpolate its
 14238        position in that axis so that the ratio formed by its position
 14239        relative to the first and last points of the pair in the
 14240        original outline still holds.
 14241 
 14242      - For each point that lies to the left or top of the first point
 14243        on the axis being considered, use the delta of the first point.
 14244 
 14245      - And finally, for each point that lies to the right or bottom of
 14246        the last point on that axis, use the delta of the last
 14247        point.
 14248 
 14249    X and Y contain the original positions of each point.
 14250    TOUCHED contains whether or not each point within GLYPH has been
 14251    changed through variation.
 14252 
 14253    Apply the inferred deltas back to GLYPH.  */
 14254 
 14255 static void
 14256 sfnt_infer_deltas (struct sfnt_glyph *glyph, bool *touched,
 14257                    sfnt_fword *x, sfnt_fword *y)
 14258 {
 14259   size_t i;
 14260   int point, first, end;
 14261 
 14262   point = 0;
 14263   for (i = 0; i < glyph->number_of_contours; ++i)
 14264     {
 14265       first = point;
 14266       end = glyph->simple->end_pts_of_contours[i];
 14267 
 14268       /* Return if the glyph is invalid.  */
 14269 
 14270       if (first >= glyph->simple->number_of_points
 14271           || end >= glyph->simple->number_of_points
 14272           || first > end)
 14273         return;
 14274 
 14275       sfnt_infer_deltas_1 (glyph, first, end, touched, x, y);
 14276       point = end + 1;
 14277     }
 14278 }
 14279 
 14280 /* Read the glyph variation data for the specified glyph ID from
 14281    BLEND's gvar table.  Apply the offsets to each point in the
 14282    specified simple GLYPH, based on the specified BLEND.
 14283 
 14284    Value is 0 upon success, else 1.
 14285 
 14286    The glyph variation data consists of a number of elements, each of
 14287    which has its own associated point numbers and deltas, and a list
 14288    of one or two coordinates for each axis.  Each such list is
 14289    referred to as a ``tuple''.
 14290 
 14291    The deltas, one for each point, are multipled by the normalized
 14292    value of each axis and applied to those points for each tuple that
 14293    is found to be applicable.
 14294 
 14295    Each element of the glyph variation data is applicable to an axis
 14296    if its list of coordinates:
 14297 
 14298      - contains one element for each axis, and its axis has a value
 14299        between 0 and that element.
 14300 
 14301      - contains two elements for each axis, and its axis has a value
 14302        between the first element and the second.
 14303 
 14304    Return the deltas that would normally be applied to the two phantom
 14305    points describing horizontal bounds in *DISTORTION.  Do not
 14306    transform the outline to reflect adjustments to the origin
 14307    point.  */
 14308 
 14309 TEST_STATIC int
 14310 sfnt_vary_simple_glyph (struct sfnt_blend *blend, sfnt_glyph id,
 14311                         struct sfnt_glyph *glyph,
 14312                         struct sfnt_metrics_distortion *distortion)
 14313 {
 14314   uint32_t offset;
 14315   struct sfnt_gvar_glyph_header header;
 14316   uint16_t *points, npoints;
 14317   int i, ntuples, j, point_count;
 14318   unsigned char *tuple, *end, *data;
 14319   uint16_t data_size, index, *glyph_points;
 14320   sfnt_f2dot14 *restrict coords;
 14321   sfnt_f2dot14 *restrict intermediate_start;
 14322   sfnt_f2dot14 *restrict intermediate_end;
 14323   sfnt_fword *restrict dx, *restrict dy, fword;
 14324   struct sfnt_gvar_table *gvar;
 14325   uint16_t *local_points, n_local_points;
 14326   sfnt_fixed scale;
 14327   ptrdiff_t data_offset;
 14328   bool *touched;
 14329   sfnt_fword *restrict original_x, *restrict original_y;
 14330 
 14331   gvar = blend->gvar;
 14332 
 14333   if (gvar->axis_count != blend->fvar->axis_count)
 14334     return 1;
 14335 
 14336   if (gvar->glyph_count <= id)
 14337     return 1;
 14338 
 14339   if (gvar->flags & 1)
 14340     offset = gvar->u.offset_long[id];
 14341   else
 14342     offset = gvar->u.offset_word[id] * 2u;
 14343 
 14344   if (offset >= gvar->data_size)
 14345     return 1;
 14346 
 14347   end = gvar->glyph_variation_data + gvar->data_size;
 14348 
 14349   /* Start reading the header.  */
 14350 
 14351   if (offset + sizeof header > gvar->data_size)
 14352     return 1;
 14353 
 14354   /* Clear the distortion.  */
 14355   distortion->origin = 0;
 14356   distortion->advance = 0;
 14357 
 14358   memcpy (&header, gvar->glyph_variation_data + offset,
 14359           sizeof header);
 14360 
 14361   /* Swap the header.  */
 14362   sfnt_swap16 (&header.tuple_count);
 14363   sfnt_swap16 (&header.data_offset);
 14364 
 14365   /* Prepare to read each tuple.  */
 14366   ntuples = header.tuple_count & 0x0fff;
 14367 
 14368   /* Initialize the data offset.  This is incremented with each tuple
 14369      read.  */
 14370   data_offset = header.data_offset;
 14371 
 14372   /* If gvar->flags & tuples_share_point_numbers, read the shared
 14373      point numbers.  Initialize `npoints' to zero.  The specification
 14374      doesn't say what should happen with tuples using shared point
 14375      numbers if it is not set later on; simply assume no points at all
 14376      apply to such a tuple.  */
 14377 
 14378   npoints = 0;
 14379 
 14380   if (header.tuple_count & 0x8000)
 14381     {
 14382       data = gvar->glyph_variation_data + offset + data_offset;
 14383       points = sfnt_read_packed_points (data, &npoints, end,
 14384                                         &tuple);
 14385 
 14386       if (!points)
 14387         return 1;
 14388 
 14389       /* Shared point numbers are part of the data after the tuple
 14390          array.  Thus, increment data_offset by tuple - data.  `tuple'
 14391          here holds no relation to a pointer to the current part of
 14392          the tuple array that is being read later on.  */
 14393       data_offset += tuple - data;
 14394     }
 14395   else
 14396     points = NULL;
 14397 
 14398   /* Start reading each tuple.  */
 14399   tuple = gvar->glyph_variation_data + offset + sizeof header;
 14400 
 14401   if (gvar->axis_count * sizeof *coords * 3 >= 1024 * 16)
 14402     coords = xmalloc (gvar->axis_count * sizeof *coords * 3);
 14403   else
 14404     coords = alloca (gvar->axis_count * sizeof *coords * 3);
 14405 
 14406   intermediate_start = coords + gvar->axis_count;
 14407   intermediate_end = coords + gvar->axis_count;
 14408 
 14409   /* Allocate arrays of booleans and fwords to keep track of which
 14410      points have been touched.  */
 14411   touched = NULL;
 14412   original_x = NULL;
 14413   original_y = NULL;
 14414 
 14415   while (ntuples--)
 14416     {
 14417       data = gvar->glyph_variation_data + offset + data_offset;
 14418 
 14419       if (tuple + 3 >= end)
 14420         goto fail1;
 14421 
 14422       memcpy (&data_size, tuple, sizeof data_size);
 14423       tuple += sizeof data_size;
 14424       memcpy (&index, tuple, sizeof index);
 14425       tuple += sizeof index;
 14426       sfnt_swap16 (&data_size);
 14427       sfnt_swap16 (&index);
 14428 
 14429       /* Increment the offset to the data by the data size specified
 14430          here.  */
 14431       data_offset += data_size;
 14432 
 14433       if (index & 0x8000)
 14434         {
 14435           /* Embedded coordinates are present.  Read each
 14436              coordinate and add it to the tuple.  */
 14437           for (j = 0; j < gvar->axis_count; ++j)
 14438             {
 14439               if (tuple + 1 >= end)
 14440                 goto fail1;
 14441 
 14442               memcpy (&coords[j], tuple, sizeof *coords);
 14443               tuple += sizeof *coords;
 14444               sfnt_swap16 (&coords[j]);
 14445             }
 14446         }
 14447       else if ((index & 0xfff) > gvar->shared_coord_count)
 14448         /* index exceeds the number of shared tuples present.  */
 14449         goto fail1;
 14450       else
 14451         /* index points into gvar->axis_count coordinates making up
 14452            the tuple.  */
 14453         memcpy (coords, (gvar->global_coords
 14454                          + ((index & 0xfff) * gvar->axis_count)),
 14455                 gvar->axis_count * sizeof *coords);
 14456 
 14457       /* Now read indeterminate tuples if required.  */
 14458       if (index & 0x4000)
 14459         {
 14460           for (j = 0; j < gvar->axis_count; ++j)
 14461             {
 14462               if (tuple + 1 >= end)
 14463                 goto fail1;
 14464 
 14465               memcpy (&intermediate_start[j], tuple,
 14466                       sizeof *intermediate_start);
 14467               tuple += sizeof *intermediate_start;
 14468               sfnt_swap16 (&intermediate_start[j]);
 14469             }
 14470 
 14471           for (j = 0; j < gvar->axis_count; ++j)
 14472             {
 14473               if (tuple + 1 >= end)
 14474                 goto fail1;
 14475 
 14476               memcpy (&intermediate_end[j], tuple,
 14477                       sizeof *intermediate_end);
 14478               tuple += sizeof *intermediate_end;
 14479               sfnt_swap16 (&intermediate_end[j]);
 14480             }
 14481         }
 14482 
 14483       /* See whether or not the tuple applies to the current variation
 14484          configuration, and how much to scale them by.  */
 14485 
 14486       scale = sfnt_compute_tuple_scale (blend, index & 0x4000,
 14487                                         coords, intermediate_start,
 14488                                         intermediate_end);
 14489 
 14490       if (!scale)
 14491         continue;
 14492 
 14493       local_points = NULL;
 14494 
 14495       /* Finally, read private point numbers.
 14496          Set local_points to those numbers; it will be freed
 14497          once the loop ends.  */
 14498 
 14499       if (index & 0x2000)
 14500         {
 14501           local_points = sfnt_read_packed_points (data, &n_local_points,
 14502                                                   end, &data);
 14503           if (!local_points)
 14504             goto fail1;
 14505 
 14506           point_count = n_local_points;
 14507           glyph_points = local_points;
 14508         }
 14509       else
 14510         {
 14511           /* If there are no private point numbers, use global
 14512              points.  */
 14513           point_count = npoints;
 14514           glyph_points = points;
 14515         }
 14516 
 14517       /* Now, read packed deltas.  */
 14518 
 14519       dx = NULL;
 14520       dy = NULL;
 14521 
 14522       switch (point_count)
 14523         {
 14524         case UINT16_MAX:
 14525           /* Deltas are provided for all points in the glyph.
 14526              No glyph should have more than 65535 points.  */
 14527 
 14528           /* Add 4 phantom points to each end.  */
 14529           dx = sfnt_read_packed_deltas (data, end,
 14530                                         glyph->simple->number_of_points + 4,
 14531                                         &data);
 14532           dy = sfnt_read_packed_deltas (data, end,
 14533                                         glyph->simple->number_of_points + 4,
 14534                                         &data);
 14535 
 14536           if (!dx || !dy)
 14537             goto fail3;
 14538 
 14539           /* Apply each delta to the simple glyph.  */
 14540 
 14541           for (i = 0; i < glyph->simple->number_of_points; ++i)
 14542             {
 14543               fword = sfnt_mul_fixed_round (dx[i], scale);
 14544               glyph->simple->x_coordinates[i] += fword;
 14545               fword = sfnt_mul_fixed_round (dy[i], scale);
 14546               glyph->simple->y_coordinates[i] += fword;
 14547             }
 14548 
 14549           /* Apply the deltas for the two phantom points.  */
 14550           distortion->origin += sfnt_mul_fixed_round (dx[i++], scale);
 14551           distortion->advance += sfnt_mul_fixed_round (dx[i], scale);
 14552           break;
 14553 
 14554         default:
 14555           dx = sfnt_read_packed_deltas (data, end, point_count, &data);
 14556           dy = sfnt_read_packed_deltas (data, end, point_count, &data);
 14557 
 14558           if (!dx || !dy)
 14559             goto fail3;
 14560 
 14561           /* Deltas are only applied for each point number read.  */
 14562 
 14563           if (!original_x)
 14564             {
 14565               if ((glyph->simple->number_of_points
 14566                    * sizeof *touched) >= 1024 * 16)
 14567                 touched = xmalloc (sizeof *touched
 14568                                    * glyph->simple->number_of_points);
 14569               else
 14570                 touched = alloca (sizeof *touched
 14571                                   * glyph->simple->number_of_points);
 14572 
 14573               if ((sizeof *original_x * 2
 14574                    * glyph->simple->number_of_points) >= 1024 * 16)
 14575                 original_x = xmalloc (sizeof *original_x * 2
 14576                                       * glyph->simple->number_of_points);
 14577               else
 14578                 original_x = alloca (sizeof *original_x * 2
 14579                                      * glyph->simple->number_of_points);
 14580 
 14581               original_y = original_x + glyph->simple->number_of_points;
 14582               memcpy (original_x, glyph->simple->x_coordinates,
 14583                       (sizeof *original_x
 14584                        * glyph->simple->number_of_points));
 14585               memcpy (original_y, glyph->simple->y_coordinates,
 14586                       (sizeof *original_y
 14587                        * glyph->simple->number_of_points));
 14588             }
 14589 
 14590           memset (touched, 0, (sizeof *touched
 14591                                * glyph->simple->number_of_points));
 14592 
 14593           for (i = 0; i < point_count; ++i)
 14594             {
 14595               /* Apply deltas to phantom points.  */
 14596 
 14597               if (glyph_points[i] == glyph->simple->number_of_points)
 14598                 {
 14599                   distortion->origin += sfnt_mul_fixed_round (dx[i], scale);
 14600                   continue;
 14601                 }
 14602 
 14603               if (glyph_points[i] == glyph->simple->number_of_points + 1)
 14604                 {
 14605                   distortion->advance += sfnt_mul_fixed_round (dx[i], scale);
 14606                   continue;
 14607                 }
 14608 
 14609               /* Make sure the point doesn't end up out of bounds.  */
 14610               if (glyph_points[i] >= glyph->simple->number_of_points)
 14611                 continue;
 14612 
 14613               fword = sfnt_mul_fixed_round (dx[i], scale);
 14614               glyph->simple->x_coordinates[glyph_points[i]] += fword;
 14615               fword = sfnt_mul_fixed_round (dy[i], scale);
 14616               glyph->simple->y_coordinates[glyph_points[i]] += fword;
 14617               touched[glyph_points[i]] = true;
 14618             }
 14619 
 14620           sfnt_infer_deltas (glyph, touched, original_x,
 14621                              original_y);
 14622           break;
 14623         }
 14624 
 14625       xfree (dx);
 14626       xfree (dy);
 14627 
 14628       if (local_points != (uint16_t *) -1)
 14629         xfree (local_points);
 14630     }
 14631 
 14632   /* Return success.  */
 14633 
 14634   if ((glyph->simple->number_of_points
 14635        * sizeof *touched) >= 1024 * 16)
 14636     xfree (touched);
 14637 
 14638   if (gvar->axis_count * sizeof *coords * 3 >= 1024 * 16)
 14639     xfree (coords);
 14640 
 14641   if ((sizeof *original_x * 2
 14642        * glyph->simple->number_of_points) >= 1024 * 16)
 14643     xfree (original_x);
 14644 
 14645   if (points != (uint16_t *) -1)
 14646     xfree (points);
 14647 
 14648   /* Set the glyph metrics distortion as well.  */
 14649   glyph->advance_distortion = distortion->advance;
 14650   glyph->origin_distortion = distortion->origin;
 14651 
 14652   return 0;
 14653 
 14654  fail3:
 14655   xfree (dx);
 14656   xfree (dy);
 14657   xfree (local_points);
 14658  fail1:
 14659 
 14660   if ((glyph->simple->number_of_points
 14661        * sizeof *touched) >= 1024 * 16)
 14662     xfree (touched);
 14663 
 14664   if (gvar->axis_count * sizeof *coords * 3 >= 1024 * 16)
 14665     xfree (coords);
 14666 
 14667   if ((sizeof *original_x * 2
 14668        * glyph->simple->number_of_points) >= 1024 * 16)
 14669     xfree (original_x);
 14670 
 14671   if (points != (uint16_t *) -1)
 14672     xfree (points);
 14673 
 14674   return 1;
 14675 }
 14676 
 14677 /* Read the glyph variation data for the specified glyph ID from
 14678    BLEND's gvar table.  Apply the deltas specified within to each
 14679    component with offsets in the specified compound GLYPH, based on
 14680    the specified BLEND.  Return distortions to phantom points in
 14681    *DISTORTION.
 14682 
 14683    Value is 0 upon success, 1 otherwise.  */
 14684 
 14685 TEST_STATIC int
 14686 sfnt_vary_compound_glyph (struct sfnt_blend *blend, sfnt_glyph id,
 14687                           struct sfnt_glyph *glyph,
 14688                           struct sfnt_metrics_distortion *distortion)
 14689 {
 14690   uint32_t offset;
 14691   struct sfnt_gvar_glyph_header header;
 14692   uint16_t *points, npoints;
 14693   int i, ntuples, j, point_count;
 14694   unsigned char *tuple, *end, *data;
 14695   uint16_t data_size, index, *glyph_points;
 14696   sfnt_f2dot14 *restrict coords;
 14697   sfnt_f2dot14 *restrict intermediate_start;
 14698   sfnt_f2dot14 *restrict intermediate_end;
 14699   sfnt_fword *restrict dx, *restrict dy, fword, word;
 14700   struct sfnt_gvar_table *gvar;
 14701   uint16_t *local_points, n_local_points;
 14702   sfnt_fixed scale;
 14703   ptrdiff_t data_offset;
 14704   struct sfnt_compound_glyph_component *component;
 14705 
 14706   gvar = blend->gvar;
 14707 
 14708   if (gvar->axis_count != blend->fvar->axis_count)
 14709     return 1;
 14710 
 14711   if (gvar->glyph_count <= id)
 14712     return 1;
 14713 
 14714   if (gvar->flags & 1)
 14715     offset = gvar->u.offset_long[id];
 14716   else
 14717     offset = gvar->u.offset_word[id] * 2u;
 14718 
 14719   if (offset >= gvar->data_size)
 14720     return 1;
 14721 
 14722   end = gvar->glyph_variation_data + gvar->data_size;
 14723 
 14724   /* Start reading the header.  */
 14725 
 14726   if (offset + sizeof header > gvar->data_size)
 14727     return 1;
 14728 
 14729   /* Clear the distortion.  */
 14730   distortion->origin = 0;
 14731   distortion->advance = 0;
 14732 
 14733   memcpy (&header, gvar->glyph_variation_data + offset,
 14734           sizeof header);
 14735 
 14736   /* Swap the header.  */
 14737   sfnt_swap16 (&header.tuple_count);
 14738   sfnt_swap16 (&header.data_offset);
 14739 
 14740   /* Prepare to read each tuple.  */
 14741   ntuples = header.tuple_count & 0x0fff;
 14742 
 14743   /* Initialize the data offset.  This is incremented with each tuple
 14744      read.  */
 14745   data_offset = header.data_offset;
 14746 
 14747   /* If gvar->flags & tuples_share_point_numbers, read the shared
 14748      point numbers.  */
 14749 
 14750   npoints = 0;
 14751 
 14752   if (header.tuple_count & 0x8000)
 14753     {
 14754       data = gvar->glyph_variation_data + offset + data_offset;
 14755       points = sfnt_read_packed_points (data, &npoints, end,
 14756                                         &tuple);
 14757 
 14758       if (!points)
 14759         return 1;
 14760 
 14761       /* Shared point numbers are part of the data after the tuple
 14762          array.  Thus, increment data_offset by tuple - data.  `tuple'
 14763          here holds no relation to a pointer to the current part of
 14764          the tuple array that is being read later on.  */
 14765       data_offset += tuple - data;
 14766     }
 14767   else
 14768     points = NULL;
 14769 
 14770   /* Start reading each tuple.  */
 14771   tuple = gvar->glyph_variation_data + offset + sizeof header;
 14772 
 14773   if (gvar->axis_count * sizeof *coords * 3 >= 1024 * 16)
 14774     coords = xmalloc (gvar->axis_count * sizeof *coords * 3);
 14775   else
 14776     coords = alloca (gvar->axis_count * sizeof *coords * 3);
 14777 
 14778   intermediate_start = coords + gvar->axis_count;
 14779   intermediate_end = coords + gvar->axis_count;
 14780 
 14781   while (ntuples--)
 14782     {
 14783       data = gvar->glyph_variation_data + offset + data_offset;
 14784 
 14785       if (tuple + 3 >= end)
 14786         goto fail1;
 14787 
 14788       memcpy (&data_size, tuple, sizeof data_size);
 14789       tuple += sizeof data_size;
 14790       memcpy (&index, tuple, sizeof index);
 14791       tuple += sizeof index;
 14792       sfnt_swap16 (&data_size);
 14793       sfnt_swap16 (&index);
 14794 
 14795       /* Increment the offset to the data by the data size specified
 14796          here.  */
 14797       data_offset += data_size;
 14798 
 14799       if (index & 0x8000)
 14800         {
 14801           /* Embedded coordinates are present.  Read each
 14802              coordinate and add it to the tuple.  */
 14803           for (j = 0; j < gvar->axis_count; ++j)
 14804             {
 14805               if (tuple + 1 >= end)
 14806                 goto fail1;
 14807 
 14808               memcpy (&coords[j], tuple, sizeof *coords);
 14809               tuple += sizeof *coords;
 14810               sfnt_swap16 (&coords[j]);
 14811             }
 14812         }
 14813       else if ((index & 0xfff) > gvar->shared_coord_count)
 14814         /* index exceeds the number of shared tuples present.  */
 14815         goto fail1;
 14816       else
 14817         /* index points into gvar->axis_count coordinates making up
 14818            the tuple.  */
 14819         memcpy (coords, (gvar->global_coords
 14820                          + ((index & 0xfff) * gvar->axis_count)),
 14821                 gvar->axis_count * sizeof *coords);
 14822 
 14823       /* Now read indeterminate tuples if required.  */
 14824       if (index & 0x4000)
 14825         {
 14826           for (j = 0; j < gvar->axis_count; ++j)
 14827             {
 14828               if (tuple + 1 >= end)
 14829                 goto fail1;
 14830 
 14831               memcpy (&intermediate_start[j], tuple,
 14832                       sizeof *intermediate_start);
 14833               tuple += sizeof *intermediate_start;
 14834               sfnt_swap16 (&intermediate_start[j]);
 14835             }
 14836 
 14837           for (j = 0; j < gvar->axis_count; ++j)
 14838             {
 14839               if (tuple + 1 >= end)
 14840                 goto fail1;
 14841 
 14842               memcpy (&intermediate_end[j], tuple,
 14843                       sizeof *intermediate_end);
 14844               tuple += sizeof *intermediate_end;
 14845               sfnt_swap16 (&intermediate_end[j]);
 14846             }
 14847         }
 14848 
 14849       /* See whether or not the tuple applies to the current variation
 14850          configuration, and how much to scale them by.  */
 14851 
 14852       scale = sfnt_compute_tuple_scale (blend, index & 0x4000,
 14853                                         coords, intermediate_start,
 14854                                         intermediate_end);
 14855 
 14856       if (!scale)
 14857         continue;
 14858 
 14859       local_points = NULL;
 14860 
 14861       /* Finally, read private point numbers.
 14862          Set local_points to those numbers; it will be freed
 14863          once the loop ends.  */
 14864 
 14865       if (index & 0x2000)
 14866         {
 14867           local_points = sfnt_read_packed_points (data, &n_local_points,
 14868                                                   end, &data);
 14869           if (!local_points)
 14870             goto fail1;
 14871 
 14872           point_count = n_local_points;
 14873           glyph_points = local_points;
 14874         }
 14875       else
 14876         {
 14877           /* If there are no private point numbers, use global
 14878              points.  */
 14879           point_count = npoints;
 14880           glyph_points = points;
 14881         }
 14882 
 14883       /* Now, read packed deltas.  */
 14884 
 14885       dx = NULL;
 14886       dy = NULL;
 14887 
 14888       switch (point_count)
 14889         {
 14890         case UINT16_MAX:
 14891           /* Deltas are provided for all components in the glyph.  */
 14892 
 14893           /* Add 4 phantom points to each end.  */
 14894           dx = sfnt_read_packed_deltas (data, end,
 14895                                         glyph->compound->num_components + 4,
 14896                                         &data);
 14897           dy = sfnt_read_packed_deltas (data, end,
 14898                                         glyph->compound->num_components + 4,
 14899                                         &data);
 14900 
 14901           if (!dx || !dy)
 14902             goto fail3;
 14903 
 14904           /* Apply each delta to the compound glyph.  */
 14905 
 14906           for (i = 0; i < glyph->compound->num_components; ++i)
 14907             {
 14908               component = &glyph->compound->components[i];
 14909 
 14910               /* Check if the component uses deltas at all.  */
 14911               if (!(component->flags & 02))
 14912                 continue;
 14913 
 14914               /* Vary the X offset.  */
 14915 
 14916               if (!(component->flags & 01))
 14917                 word = component->argument1.b;
 14918               else
 14919                 word = component->argument1.d;
 14920 
 14921               fword = sfnt_mul_fixed_round (dx[i], scale);
 14922               component->argument1.d = word + fword;
 14923 
 14924               /* Vary the Y offset.  */
 14925 
 14926               if (!(component->flags & 01))
 14927                 word = component->argument2.b;
 14928               else
 14929                 word = component->argument2.d;
 14930 
 14931               fword = sfnt_mul_fixed_round (dy[i], scale);
 14932 
 14933               /* Set the flag that says offsets are words.  */
 14934               component->flags |= 01;
 14935               component->argument2.d = word + fword;
 14936             }
 14937 
 14938           /* Apply the deltas for the two phantom points.  */
 14939           distortion->origin += sfnt_mul_fixed_round (dx[i++], scale);
 14940           distortion->advance += sfnt_mul_fixed_round (dx[i], scale);
 14941           break;
 14942 
 14943         default:
 14944           dx = sfnt_read_packed_deltas (data, end, point_count, &data);
 14945           dy = sfnt_read_packed_deltas (data, end, point_count, &data);
 14946 
 14947           if (!dx || !dy)
 14948             goto fail3;
 14949 
 14950           /* Deltas are only applied for each point number read.  */
 14951 
 14952           for (i = 0; i < point_count; ++i)
 14953             {
 14954               /* Apply deltas to phantom points.  */
 14955 
 14956               if (glyph_points[i] == glyph->compound->num_components)
 14957                 {
 14958                   distortion->origin += sfnt_mul_fixed_round (dx[i], scale);
 14959                   continue;
 14960                 }
 14961 
 14962               if (glyph_points[i] == glyph->compound->num_components + 1)
 14963                 {
 14964                   distortion->advance += sfnt_mul_fixed_round (dx[i], scale);
 14965                   continue;
 14966                 }
 14967 
 14968               /* Make sure the point doesn't end up out of bounds.  */
 14969               if (glyph_points[i] >= glyph->compound->num_components)
 14970                 continue;
 14971 
 14972               component = &glyph->compound->components[glyph_points[i]];
 14973 
 14974               /* Check if the component uses deltas at all.  */
 14975               if (!(component->flags & 02))
 14976                 continue;
 14977 
 14978               /* Vary the X offset.  */
 14979 
 14980               if (!(component->flags & 01))
 14981                 word = component->argument1.b;
 14982               else
 14983                 word = component->argument1.d;
 14984 
 14985               fword = sfnt_mul_fixed_round (dx[i], scale);
 14986               component->argument1.d = word + fword;
 14987 
 14988               /* Vary the Y offset.  */
 14989 
 14990               if (!(component->flags & 01))
 14991                 word = component->argument2.b;
 14992               else
 14993                 word = component->argument2.d;
 14994 
 14995               fword = sfnt_mul_fixed_round (dy[i], scale);
 14996 
 14997               /* Set the flag that says offsets are words.  */
 14998               component->flags |= 01;
 14999               component->argument2.d = word + fword;
 15000             }
 15001 
 15002           break;
 15003         }
 15004 
 15005       xfree (dx);
 15006       xfree (dy);
 15007 
 15008       if (local_points != (uint16_t *) -1)
 15009         xfree (local_points);
 15010     }
 15011 
 15012   /* Return success.  */
 15013 
 15014   if (gvar->axis_count * sizeof *coords * 3 >= 1024 * 16)
 15015     xfree (coords);
 15016 
 15017   if (points != (uint16_t *) -1)
 15018     xfree (points);
 15019 
 15020   /* Set the glyph metrics distortion as well.  */
 15021   glyph->advance_distortion = distortion->advance;
 15022   glyph->origin_distortion = distortion->origin;
 15023 
 15024   return 0;
 15025 
 15026  fail3:
 15027   xfree (dx);
 15028   xfree (dy);
 15029   xfree (local_points);
 15030  fail1:
 15031 
 15032   if (gvar->axis_count * sizeof *coords * 3 >= 1024 * 16)
 15033     xfree (coords);
 15034 
 15035   if (points != (uint16_t *) -1)
 15036     xfree (points);
 15037 
 15038   return 1;
 15039 }
 15040 
 15041 /* Vary the specified INTERPRETER's control value table using the
 15042    variations in BLEND's CVT variations table, then record the blend's
 15043    normalized coordinates and axis count in the interpreter.
 15044 
 15045    The CVT table used to create INTERPRETER must be the same used
 15046    to read BLEND->cvar.  If not, behavior is undefined.  */
 15047 
 15048 TEST_STATIC void
 15049 sfnt_vary_interpreter (struct sfnt_interpreter *interpreter,
 15050                        struct sfnt_blend *blend)
 15051 {
 15052   sfnt_fixed scale;
 15053   int i;
 15054   struct sfnt_tuple_variation *variation;
 15055   size_t ndeltas, j, index;
 15056   sfnt_f26dot6 delta;
 15057 
 15058   /* Return if there's no cvar table.  */
 15059   if (!blend->cvar)
 15060     return;
 15061 
 15062   /* For each tuple in the cvar table... */
 15063   for (i = 0; i < (blend->cvar->tuple_count & 0x0fff); ++i)
 15064     {
 15065       /* See if the tuple applies.  */
 15066       variation = &blend->cvar->variation[i];
 15067       scale = sfnt_compute_tuple_scale (blend,
 15068                                         variation->intermediate_start != NULL,
 15069                                         variation->coordinates,
 15070                                         variation->intermediate_start,
 15071                                         variation->intermediate_end);
 15072       if (!scale)
 15073         continue;
 15074 
 15075       /* Figure out how many deltas there are.  If variation->points,
 15076          there are num_points deltas.  Otherwise, there are
 15077          interpreter->cvt->num_elements deltas.  */
 15078 
 15079       ndeltas = (variation->points
 15080                  ? variation->num_points
 15081                  : interpreter->cvt_size);
 15082 
 15083       for (j = 0; j < ndeltas; ++j)
 15084         {
 15085           /* Figure out which CVT entry this applies to.  */
 15086           index = variation->points ? variation->points[j] : j;
 15087 
 15088           if (index > interpreter->cvt_size)
 15089             continue;
 15090 
 15091           /* Multiply the delta by the interpreter scale factor and
 15092              then the tuple scale factor.  */
 15093           delta = sfnt_mul_f26dot6_fixed (variation->deltas[j] * 64,
 15094                                           interpreter->scale);
 15095           delta = sfnt_mul_fixed_round (delta, scale);
 15096 
 15097           /* Apply the delta to the control value table.  */
 15098           interpreter->cvt[i] += delta;
 15099         }
 15100     }
 15101 
 15102   interpreter->n_axis = blend->fvar->axis_count;
 15103   interpreter->norm_coords = blend->norm_coords;
 15104 }
 15105 
 15106 
 15107 
 15108 #ifdef TEST
 15109 
 15110 struct sfnt_test_dcontext
 15111 {
 15112   /* Context for sfnt_test_get_glyph.  */
 15113   struct sfnt_glyf_table *glyf;
 15114   struct sfnt_loca_table_short *loca_short;
 15115   struct sfnt_loca_table_long *loca_long;
 15116   struct sfnt_blend *blend;
 15117 };
 15118 
 15119 /* Global context for test functions.  Height of glyph.  */
 15120 static sfnt_fixed sfnt_test_max;
 15121 
 15122 static void
 15123 sfnt_test_move_to (struct sfnt_point point, void *dcontext)
 15124 {
 15125   printf ("move_to: %g, %g\n", sfnt_coerce_fixed (point.x),
 15126           sfnt_coerce_fixed (point.y));
 15127 }
 15128 
 15129 static void
 15130 sfnt_test_line_to (struct sfnt_point point, void *dcontext)
 15131 {
 15132   printf ("line_to: %g, %g\n", sfnt_coerce_fixed (point.x),
 15133           sfnt_coerce_fixed (point.y));
 15134 }
 15135 
 15136 static void
 15137 sfnt_test_curve_to (struct sfnt_point control,
 15138                     struct sfnt_point endpoint,
 15139                     void *dcontext)
 15140 {
 15141   printf ("curve_to: %g, %g - %g, %g\n",
 15142           sfnt_coerce_fixed (control.x),
 15143           sfnt_coerce_fixed (control.y),
 15144           sfnt_coerce_fixed (endpoint.x),
 15145           sfnt_coerce_fixed (endpoint.y));
 15146 }
 15147 
 15148 static struct sfnt_glyph *
 15149 sfnt_test_get_glyph (sfnt_glyph id, void *dcontext,
 15150                      bool *need_free)
 15151 {
 15152   struct sfnt_test_dcontext *tables;
 15153   struct sfnt_glyph *glyph;
 15154   struct sfnt_metrics_distortion distortion;
 15155 
 15156   tables = dcontext;
 15157   *need_free = true;
 15158 
 15159   glyph = sfnt_read_glyph (id, tables->glyf,
 15160                            tables->loca_short,
 15161                            tables->loca_long);
 15162 
 15163   if (tables->blend && glyph)
 15164     {
 15165       if (glyph->simple)
 15166         sfnt_vary_simple_glyph (tables->blend, id, glyph,
 15167                                 &distortion);
 15168       else
 15169         sfnt_vary_compound_glyph (tables->blend, id, glyph,
 15170                                   &distortion);
 15171     }
 15172 
 15173   return glyph;
 15174 }
 15175 
 15176 static void
 15177 sfnt_test_free_glyph (struct sfnt_glyph *glyph, void *dcontext)
 15178 {
 15179   sfnt_free_glyph (glyph);
 15180 }
 15181 
 15182 static void
 15183 sfnt_test_span (struct sfnt_edge *edge, sfnt_fixed y,
 15184                 void *dcontext)
 15185 {
 15186 #if 1
 15187   printf ("/* span at %g */\n", sfnt_coerce_fixed (y));
 15188   for (; edge; edge = edge->next)
 15189     {
 15190       if (y >= edge->bottom && y < edge->top)
 15191         printf ("ctx.fillRect (%g, %g, 1, 1); "
 15192                 "/* %g top: %g bot: %g stepx: %g winding: %d */\n",
 15193                 sfnt_coerce_fixed (edge->x),
 15194                 sfnt_coerce_fixed (sfnt_test_max - y),
 15195                 sfnt_coerce_fixed (y),
 15196                 sfnt_coerce_fixed (edge->top),
 15197                 sfnt_coerce_fixed (edge->bottom),
 15198                 sfnt_coerce_fixed (edge->step_x),
 15199                 edge->winding);
 15200       else
 15201         printf ("STRIPPED BAD SPAN!!! %g %g %"PRIi32
 15202                 " %"PRIi32" (winding: %d)\n",
 15203                 sfnt_coerce_fixed (edge->top),
 15204                 sfnt_coerce_fixed (edge->bottom),
 15205                 edge->top, y, edge->winding);
 15206     }
 15207 #elif 0
 15208   int winding;
 15209   short x, dx;
 15210 
 15211   winding = 0;
 15212   x = 0;
 15213 
 15214   for (; edge; edge = edge->next)
 15215     {
 15216       dx = (edge->x >> 16) - x;
 15217       x = edge->x >> 16;
 15218 
 15219       for (; dx > 0; --dx)
 15220         putc (winding ? '.' : ' ', stdout);
 15221 
 15222       winding = !winding;
 15223     }
 15224 
 15225   putc ('\n', stdout);
 15226 #elif 0
 15227   for (; edge; edge = edge->next)
 15228     printf ("%g-", sfnt_coerce_fixed (edge->x));
 15229   puts ("");
 15230 #endif
 15231 }
 15232 
 15233 static void
 15234 sfnt_test_edge_ignore (struct sfnt_edge *edges, size_t num_edges,
 15235                        void *dcontext)
 15236 {
 15237 
 15238 }
 15239 
 15240 /* The same debugger stuff is used here.  */
 15241 static void sfnt_setup_debugger (void);
 15242 
 15243 /* The debugger's X display.  */
 15244 static Display *display;
 15245 
 15246 /* The debugger window.  */
 15247 static Window window;
 15248 
 15249 /* The GC.  */
 15250 static GC point_gc, background_gc;
 15251 
 15252 static void
 15253 sfnt_test_edges (struct sfnt_edge *edges, size_t num_edges)
 15254 {
 15255   static sfnt_fixed y;
 15256   size_t i;
 15257 
 15258   for (i = 0; i < num_edges; ++i)
 15259     {
 15260       if (y >= edges[i].bottom && y < edges[i].top)
 15261         {
 15262           XDrawPoint (display, window, point_gc,
 15263                       edges[i].x / 65536, 100 - (y / 65536));
 15264           printf ("sfnt_test_edges: %d %d\n",
 15265                   edges[i].x / 65536, 100 - (y / 65536));
 15266         }
 15267     }
 15268 
 15269   y += SFNT_POLY_STEP;
 15270 
 15271   for (i = 0; i < num_edges; ++i)
 15272     sfnt_step_edge (&edges[i]);
 15273 }
 15274 
 15275 static void
 15276 sfnt_debug_edges (struct sfnt_edge *edges, size_t num_edges)
 15277 {
 15278   XEvent event;
 15279 
 15280   sfnt_setup_debugger ();
 15281 
 15282   while (true)
 15283     {
 15284       XNextEvent (display, &event);
 15285 
 15286       switch (event.type)
 15287         {
 15288         case KeyPress:
 15289           XDestroyWindow (display, window);
 15290           XCloseDisplay (display);
 15291           exit (0);
 15292           break;
 15293 
 15294         case Expose:
 15295 
 15296           while (true)
 15297             {
 15298               sfnt_test_edges (edges, num_edges);
 15299               XFlush (display);
 15300               usleep (50000);
 15301             }
 15302 
 15303           break;
 15304         }
 15305     }
 15306 }
 15307 
 15308 static void
 15309 sfnt_test_edge (struct sfnt_edge *edges, size_t num_edges,
 15310                 void *dcontext)
 15311 {
 15312   size_t i;
 15313 
 15314   printf ("built %zu edges\n", num_edges);
 15315 
 15316   for (i = 0; i < num_edges; ++i)
 15317     {
 15318       printf ("/* edge x, top, bot: %g, %g - %g.  winding: %d */\n"
 15319               "/* edge step_x: %g */\n",
 15320               sfnt_coerce_fixed (edges[i].x),
 15321               sfnt_coerce_fixed (edges[i].top),
 15322               sfnt_coerce_fixed (edges[i].bottom),
 15323               edges[i].winding,
 15324               sfnt_coerce_fixed (edges[i].step_x));
 15325 #ifdef TEST_VERTEX
 15326       printf ("ctx.fillRect (%g, %g, 1, 1);\n",
 15327               sfnt_coerce_fixed (edges[i].x),
 15328               sfnt_coerce_fixed (sfnt_test_max
 15329                                  - edges[i].y));
 15330 #else
 15331       printf ("ctx.fillRect (%g, %g, 1, 1);\n",
 15332               sfnt_coerce_fixed (edges[i].x),
 15333               sfnt_coerce_fixed (sfnt_test_max
 15334                                  - edges[i].bottom));
 15335 #endif
 15336     }
 15337 
 15338   if (getenv ("SFNT_DEBUG_STEP"))
 15339     {
 15340       if (!fork ())
 15341         sfnt_debug_edges (edges, num_edges);
 15342     }
 15343 
 15344   printf ("==end of edges==\n");
 15345 
 15346   sfnt_poly_edges (edges, num_edges, sfnt_test_span, NULL);
 15347 }
 15348 
 15349 static void
 15350 sfnt_x_raster (struct sfnt_raster **rasters,
 15351                int *advances,
 15352                int nrasters,
 15353                struct sfnt_hhea_table *hhea,
 15354                sfnt_fixed scale)
 15355 {
 15356   Display *display;
 15357   Window window;
 15358   Pixmap *pixmaps;
 15359   Picture *glyphs, drawable, solid;
 15360   int event_base, error_base;
 15361   int major, minor, *depths, count;
 15362   XRenderPictFormat *format, *glyph_format;
 15363   Visual *visual;
 15364   XImage image;
 15365   GC gc;
 15366   XGCValues gcvalues;
 15367   XEvent event;
 15368   XRenderColor white, black;
 15369   int i, ascent, origin, x, y;
 15370   Font font;
 15371 
 15372   if (!nrasters)
 15373     exit (0);
 15374 
 15375   display = XOpenDisplay (NULL);
 15376 
 15377   if (!display)
 15378     exit (0);
 15379 
 15380   if (!XRenderQueryExtension (display, &event_base, &error_base)
 15381       || !XRenderQueryVersion (display, &major, &minor))
 15382     exit (0);
 15383 
 15384   if (major == 0 && minor < 10)
 15385     exit (0);
 15386 
 15387   window = XCreateSimpleWindow (display, DefaultRootWindow (display),
 15388                                 0, 0, 100, 150, 0, 0,
 15389                                 WhitePixel (display,
 15390                                             DefaultScreen (display)));
 15391   XSelectInput (display, window, ExposureMask);
 15392   XMapWindow (display, window);
 15393 
 15394   visual = DefaultVisual (display, DefaultScreen (display));
 15395   format = XRenderFindVisualFormat (display, visual);
 15396 
 15397   if (!format)
 15398     exit (0);
 15399 
 15400   glyph_format = XRenderFindStandardFormat (display, PictStandardA8);
 15401   depths = XListDepths (display, DefaultScreen (display), &count);
 15402 
 15403   for (i = 0; i < count; ++i)
 15404     {
 15405       if (depths[i] == 8)
 15406         goto depth_found;
 15407     }
 15408 
 15409   exit (0);
 15410 
 15411  depth_found:
 15412 
 15413   XFree (depths);
 15414   pixmaps = alloca (sizeof *pixmaps * nrasters);
 15415   glyphs = alloca (sizeof *glyphs * nrasters);
 15416   gc = None;
 15417 
 15418   for (i = 0; i < nrasters; ++i)
 15419     {
 15420       pixmaps[i] = XCreatePixmap (display, DefaultRootWindow (display),
 15421                                   rasters[i]->width, rasters[i]->height, 8);
 15422       if (!gc)
 15423         gc = XCreateGC (display, pixmaps[i], 0, &gcvalues);
 15424 
 15425       /* Upload the raster.  */
 15426       image.width = rasters[i]->width;
 15427       image.height = rasters[i]->height;
 15428       image.xoffset = 0;
 15429       image.format = ZPixmap;
 15430       image.data = (char *) rasters[i]->cells;
 15431       image.byte_order = MSBFirst;
 15432       image.bitmap_unit = 8;
 15433       image.bitmap_bit_order = LSBFirst;
 15434       image.bitmap_pad = SFNT_POLY_ALIGNMENT * 8;
 15435       image.depth = 8;
 15436       image.bytes_per_line = rasters[i]->stride;
 15437       image.bits_per_pixel = 8;
 15438       image.red_mask = 0;
 15439       image.green_mask = 0;
 15440       image.blue_mask = 0;
 15441 
 15442       if (!XInitImage (&image))
 15443         abort ();
 15444 
 15445       XPutImage (display, pixmaps[i], gc, &image,
 15446                  0, 0, 0, 0, image.width, image.height);
 15447 
 15448       glyphs[i] = XRenderCreatePicture (display, pixmaps[i],
 15449                                         glyph_format, 0, NULL);
 15450     }
 15451 
 15452   XFreeGC (display, gc);
 15453 
 15454   font = XLoadFont (display, "6x13");
 15455 
 15456   if (!font)
 15457     exit (1);
 15458 
 15459   gcvalues.font = font;
 15460   gcvalues.foreground = BlackPixel (display, DefaultScreen (display));
 15461   gc = XCreateGC (display, window, GCForeground | GCFont, &gcvalues);
 15462 
 15463   drawable = XRenderCreatePicture (display, window, format,
 15464                                    0, NULL);
 15465   memset (&black, 0, sizeof black);
 15466   black.alpha = 65535;
 15467 
 15468   solid = XRenderCreateSolidFill (display, &black);
 15469 
 15470   while (true)
 15471     {
 15472       XNextEvent (display, &event);
 15473 
 15474       if (event.type == Expose)
 15475         {
 15476           white.red = 65535;
 15477           white.green = 65535;
 15478           white.blue = 65535;
 15479           white.alpha = 65535;
 15480 
 15481           /* Clear the background.  */
 15482           XRenderFillRectangle (display, PictOpSrc, drawable,
 15483                                 &white, 0, 0, 65535, 65535);
 15484 
 15485           /* Compute ascent line.  */
 15486           ascent = sfnt_mul_fixed (hhea->ascent * 65536,
 15487                                    scale) / 65536;
 15488 
 15489           origin = 0;
 15490 
 15491           for (i = 0; i < nrasters; ++i)
 15492             {
 15493               /* Compute the base position.  */
 15494               x = origin + rasters[i]->offx;
 15495               y = ascent - rasters[i]->height - rasters[i]->offy;
 15496 
 15497               /* Draw the solid fill with the glyph as clip mask.  */
 15498               XRenderComposite (display, PictOpOver, solid, glyphs[i],
 15499                                 drawable, 0, 0, 0, 0, x, y,
 15500                                 rasters[i]->width, rasters[i]->height);
 15501 
 15502               origin += advances[i];
 15503             }
 15504         }
 15505     }
 15506 }
 15507 
 15508 static void
 15509 sfnt_test_raster (struct sfnt_raster *raster,
 15510                   struct sfnt_hhea_table *hhea,
 15511                   sfnt_fixed scale)
 15512 {
 15513   int x, y, i;
 15514 
 15515   for (y = 0; y < raster->height; ++y)
 15516     {
 15517       for (x = 0; x < raster->width; ++x)
 15518         printf ("%3d ", (int) raster->cells[y * raster->stride + x]);
 15519       puts ("");
 15520     }
 15521 
 15522   if (hhea && getenv ("SFNT_X"))
 15523     {
 15524       i = 0;
 15525 
 15526       if (!fork ())
 15527         sfnt_x_raster (&raster, &i, 1, hhea, scale);
 15528     }
 15529 }
 15530 
 15531 
 15532 
 15533 /* Instruction execution tests.  */
 15534 
 15535 static struct sfnt_maxp_table test_interpreter_profile =
 15536   {
 15537     0x00010000,
 15538     650,
 15539     100,
 15540     100,
 15541     100,
 15542     100,
 15543     2,
 15544     100,
 15545     255,
 15546     12,
 15547     12,
 15548     100,
 15549     5000,
 15550     100,
 15551     1,
 15552   };
 15553 
 15554 static sfnt_fword test_cvt_values[] =
 15555   {
 15556     100, 100, -100, -100, 50, 50, 50, 50, 0, 0,
 15557   };
 15558 
 15559 static struct sfnt_cvt_table test_interpreter_cvt =
 15560   {
 15561     10,
 15562     test_cvt_values,
 15563   };
 15564 
 15565 static struct sfnt_head_table test_interpreter_head =
 15566   {
 15567     0x00010000,
 15568     0x00010000,
 15569     0,
 15570     0x5f0f3cf5,
 15571     0,
 15572     800,
 15573     0,
 15574     0,
 15575     0,
 15576     0,
 15577     -312,
 15578     -555,
 15579     1315,
 15580     2163,
 15581     0,
 15582     12,
 15583     0,
 15584     0,
 15585     0,
 15586   };
 15587 
 15588 static struct sfnt_interpreter *
 15589 sfnt_make_test_interpreter (void)
 15590 {
 15591   return sfnt_make_interpreter (&test_interpreter_profile,
 15592                                 &test_interpreter_cvt,
 15593                                 &test_interpreter_head,
 15594                                 NULL, 17, 17);
 15595 }
 15596 
 15597 struct sfnt_interpreter_test
 15598 {
 15599   const char *name;
 15600   unsigned char *instructions;
 15601   int num_instructions;
 15602   void *arg;
 15603   void (*check) (struct sfnt_interpreter *, void *, bool);
 15604 };
 15605 
 15606 static void
 15607 sfnt_run_interpreter_test (struct sfnt_interpreter_test *test,
 15608                            struct sfnt_interpreter *interpreter)
 15609 {
 15610   fprintf (stderr, "Testing %s: ", test->name);
 15611 
 15612   if (setjmp (interpreter->trap))
 15613     test->check (interpreter, test->arg, true);
 15614   else
 15615     {
 15616       interpreter->IP = 0;
 15617       interpreter->SP = interpreter->stack;
 15618       interpreter->instructions = test->instructions;
 15619       interpreter->num_instructions = test->num_instructions;
 15620 
 15621       sfnt_interpret_run (interpreter, SFNT_RUN_CONTEXT_TEST);
 15622       test->check (interpreter, test->arg, false);
 15623     }
 15624 }
 15625 
 15626 struct sfnt_generic_test_args
 15627 {
 15628   uint32_t *expected_stack;
 15629   int expected_stack_elements;
 15630   bool expected_trap;
 15631   int expected_IP;
 15632 };
 15633 
 15634 static void
 15635 sfnt_generic_check (struct sfnt_interpreter *interpreter,
 15636                     void *arg, bool trap)
 15637 {
 15638   struct sfnt_generic_test_args *args;
 15639   int i;
 15640 
 15641   args = arg;
 15642 
 15643   if (((interpreter->SP - interpreter->stack)
 15644        != args->expected_stack_elements))
 15645     {
 15646       fprintf (stderr,
 15647                "failed at IP %d:%d (expected %d stack elements,"
 15648                " got %td); last trap string: %s\n",
 15649                interpreter->call_depth, interpreter->IP,
 15650                args->expected_stack_elements,
 15651                interpreter->SP - interpreter->stack,
 15652                ((trap && interpreter->trap_reason)
 15653                 ? interpreter->trap_reason
 15654                 : "NULL"));
 15655 
 15656       for (i = 0; i < interpreter->SP - interpreter->stack; ++i)
 15657         fprintf (stderr, "%8d ", (int) interpreter->stack[i]);
 15658       fprintf (stderr, "\n");
 15659       return;
 15660     }
 15661 
 15662   if (memcmp (interpreter->stack, args->expected_stack,
 15663               ((char *) interpreter->SP
 15664                - (char *) interpreter->stack)))
 15665     {
 15666       fprintf (stderr, "failed (inconsistent stack elements)\n"
 15667                "machine stack ------------------------->\n");
 15668 
 15669       for (i = 0; i < args->expected_stack_elements; ++i)
 15670         fprintf (stderr, "%8d ", (int) interpreter->stack[i]);
 15671 
 15672       fprintf (stderr,
 15673                "\nexpected stack ------------------------>\n");
 15674 
 15675       for (i = 0; i < args->expected_stack_elements; ++i)
 15676         fprintf (stderr, "%8d ", (int) args->expected_stack[i]);
 15677 
 15678       fprintf (stderr, "\n");
 15679       return;
 15680     }
 15681 
 15682   if (args->expected_IP != -1
 15683       && interpreter->IP != args->expected_IP)
 15684     {
 15685       fprintf (stderr, "failed (IP is %d, not %d)\n",
 15686                interpreter->IP, args->expected_IP);
 15687       return;
 15688     }
 15689 
 15690   if (trap)
 15691     {
 15692       if (args->expected_trap)
 15693         fprintf (stderr, "passed (with trap %s)\n",
 15694                  interpreter->trap_reason);
 15695       else
 15696         fprintf (stderr, "failed (unexpected trap %s)\n",
 15697                  interpreter->trap_reason);
 15698 
 15699       return;
 15700     }
 15701 
 15702   if (args->expected_trap)
 15703     fprintf (stderr, "failed, trap not encountered\n");
 15704   else
 15705     fprintf (stderr, "passed\n");
 15706 
 15707   return;
 15708 }
 15709 
 15710 static void
 15711 sfnt_check_srp0 (struct sfnt_interpreter *interpreter,
 15712                  void *arg, bool trap)
 15713 {
 15714   if (trap)
 15715     {
 15716       fprintf (stderr, "failed (unexpected trap %s)\n",
 15717                interpreter->trap_reason);
 15718       return;
 15719     }
 15720 
 15721   if (interpreter->state.rp0 != 0)
 15722     {
 15723       fprintf (stderr, "failed, rp0 is not 0, but %d\n",
 15724                interpreter->state.rp0);
 15725       return;
 15726     }
 15727 
 15728   if (interpreter->state.rp1 != 1)
 15729     {
 15730       fprintf (stderr, "failed, rp1 is not 1, but %d\n",
 15731                interpreter->state.rp1);
 15732       return;
 15733     }
 15734 
 15735   if (interpreter->state.rp2 != 2)
 15736     {
 15737       fprintf (stderr, "failed, rp2 is not 2, but %d\n",
 15738                interpreter->state.rp2);
 15739       return;
 15740     }
 15741 
 15742   if (interpreter->SP != interpreter->stack)
 15743     {
 15744       fprintf (stderr, "failed, stack not empty\n");
 15745       return;
 15746     }
 15747 
 15748   fprintf (stderr, "passed\n");
 15749   return;
 15750 }
 15751 
 15752 static void
 15753 sfnt_check_szp0 (struct sfnt_interpreter *interpreter,
 15754                  void *arg, bool trap)
 15755 {
 15756   if (!trap)
 15757     {
 15758       fprintf (stderr, "failed, expected trap\n");
 15759       return;
 15760     }
 15761 
 15762   if (interpreter->state.zp0 != 1
 15763       || interpreter->state.zp1 != 1
 15764       || interpreter->state.zp2 != 0)
 15765     {
 15766       fprintf (stderr,
 15767                "failed, unexpected values of zone pointers: %d %d %d\n",
 15768                interpreter->state.zp0, interpreter->state.zp1,
 15769                interpreter->state.zp2);
 15770       return;
 15771     }
 15772 
 15773   if (interpreter->SP != interpreter->stack)
 15774     {
 15775       fprintf (stderr, "failed, stack not empty\n");
 15776       return;
 15777     }
 15778 
 15779   fprintf (stderr, "passed with expected trap %s\n",
 15780            interpreter->trap_reason);
 15781   return;
 15782 }
 15783 
 15784 static void
 15785 sfnt_check_sloop (struct sfnt_interpreter *interpreter,
 15786                   void *arg, bool trap)
 15787 {
 15788   if (interpreter->state.loop != 1)
 15789     {
 15790       /* The trap should've restored GS->loop to 1.  */
 15791       fprintf (stderr, "failed, GS->loop should be 1, not %d\n",
 15792                interpreter->state.loop);
 15793       return;
 15794     }
 15795 
 15796   if (!trap)
 15797     {
 15798       fprintf (stderr, "failed, expected trap\n");
 15799       return;
 15800     }
 15801 
 15802   if (interpreter->SP != interpreter->stack)
 15803     {
 15804       fprintf (stderr, "failed, stack not empty\n");
 15805       return;
 15806     }
 15807 
 15808   fprintf (stderr, "passed with expected trap %s\n",
 15809            interpreter->trap_reason);
 15810   return;
 15811 }
 15812 
 15813 struct sfnt_rounding_test_args
 15814 {
 15815   sfnt_f26dot6 value;
 15816 };
 15817 
 15818 static void
 15819 sfnt_check_rounding (struct sfnt_interpreter *interpreter,
 15820                      void *arg, bool trap)
 15821 {
 15822   sfnt_f26dot6 value;
 15823   struct sfnt_rounding_test_args *args;
 15824 
 15825   if (trap)
 15826     {
 15827       fprintf (stderr, "failed, unexpected trap: %s\n",
 15828                interpreter->trap_reason);
 15829       return;
 15830     }
 15831 
 15832   if (interpreter->SP == interpreter->stack)
 15833     {
 15834       fprintf (stderr, "failed, empty stack\n");
 15835       return;
 15836     }
 15837 
 15838   value = *(interpreter->SP - 1);
 15839   args = arg;
 15840 
 15841   if (value != args->value)
 15842     {
 15843       fprintf (stderr, "failed.  value is: %d %d, but wanted: %d %d\n",
 15844                value >> 6, value & 63, args->value >> 6,
 15845                args->value & 63);
 15846       return;
 15847     }
 15848 
 15849   fprintf (stderr, "passed, expected value %d\n", value);
 15850   return;
 15851 }
 15852 
 15853 static void
 15854 sfnt_check_smd (struct sfnt_interpreter *interpreter,
 15855                 void *arg, bool trap)
 15856 {
 15857   if (trap)
 15858     {
 15859       fprintf (stderr, "failed, unexpected trap\n");
 15860       return;
 15861     }
 15862 
 15863   if (interpreter->state.minimum_distance != 32)
 15864     {
 15865       fprintf (stderr, "failed, expected minimum distance"
 15866                " of 32, got %d\n",
 15867                interpreter->state.minimum_distance);
 15868       return;
 15869     }
 15870 
 15871   fprintf (stderr, "passed\n");
 15872   return;
 15873 }
 15874 
 15875 static void
 15876 sfnt_check_scvtci (struct sfnt_interpreter *interpreter,
 15877                    void *arg, bool trap)
 15878 {
 15879   if (trap)
 15880     {
 15881       fprintf (stderr, "failed, unexpected trap\n");
 15882       return;
 15883     }
 15884 
 15885   if (interpreter->state.cvt_cut_in != 128)
 15886     {
 15887       fprintf (stderr, "failed, expected 128, got %d\n",
 15888                interpreter->state.cvt_cut_in);
 15889       return;
 15890     }
 15891 
 15892   fprintf (stderr, "passed\n");
 15893   return;
 15894 }
 15895 
 15896 static void
 15897 sfnt_check_sswci (struct sfnt_interpreter *interpreter,
 15898                   void *arg, bool trap)
 15899 {
 15900   if (trap)
 15901     {
 15902       fprintf (stderr, "failed, unexpected trap\n");
 15903       return;
 15904     }
 15905 
 15906   if (interpreter->state.sw_cut_in != 512)
 15907     {
 15908       fprintf (stderr, "failed, expected 512, got %d\n",
 15909                interpreter->state.sw_cut_in);
 15910       return;
 15911     }
 15912 
 15913   fprintf (stderr, "passed\n");
 15914   return;
 15915 }
 15916 
 15917 static void
 15918 sfnt_check_ssw (struct sfnt_interpreter *interpreter,
 15919                 void *arg, bool trap)
 15920 {
 15921   if (trap)
 15922     {
 15923       fprintf (stderr, "failed, unexpected trap\n");
 15924       return;
 15925     }
 15926 
 15927   if (interpreter->state.single_width_value
 15928       != sfnt_mul_f26dot6_fixed (-64, interpreter->scale))
 15929     {
 15930       fprintf (stderr, "failed, got %d at scale %d,"
 15931                " expected %d\n",
 15932                interpreter->state.single_width_value,
 15933                interpreter->scale,
 15934                sfnt_mul_f26dot6_fixed (-64, interpreter->scale));
 15935       return;
 15936     }
 15937 
 15938   fprintf (stderr, "passed\n");
 15939   return;
 15940 }
 15941 
 15942 static void
 15943 sfnt_check_flipon (struct sfnt_interpreter *interpreter,
 15944                    void *arg, bool trap)
 15945 {
 15946   if (trap)
 15947     {
 15948       fprintf (stderr, "failed, unexpected trap\n");
 15949       return;
 15950     }
 15951 
 15952   if (!interpreter->state.auto_flip)
 15953     fprintf (stderr, "failed, auto flip not enabled\n");
 15954   else
 15955     fprintf (stderr, "pass\n");
 15956 
 15957   return;
 15958 }
 15959 
 15960 static void
 15961 sfnt_check_flipoff (struct sfnt_interpreter *interpreter,
 15962                     void *arg, bool trap)
 15963 {
 15964   if (trap)
 15965     {
 15966       fprintf (stderr, "failed, unexpected trap\n");
 15967       return;
 15968     }
 15969 
 15970   if (interpreter->state.auto_flip)
 15971     fprintf (stderr, "failed, auto flip not disabled\n");
 15972   else
 15973     fprintf (stderr, "pass\n");
 15974 
 15975   return;
 15976 }
 15977 
 15978 static void
 15979 sfnt_check_sdb (struct sfnt_interpreter *interpreter,
 15980                 void *arg, bool trap)
 15981 {
 15982   if (trap)
 15983     {
 15984       fprintf (stderr, "failed, unexpected trap %s\n",
 15985                interpreter->trap_reason);
 15986       return;
 15987     }
 15988 
 15989   if (interpreter->state.delta_base != 8)
 15990     fprintf (stderr, "failed, delta base is %d, not 8\n",
 15991              interpreter->state.delta_base);
 15992   else
 15993     fprintf (stderr, "pass\n");
 15994 
 15995   return;
 15996 }
 15997 
 15998 static void
 15999 sfnt_check_sds (struct sfnt_interpreter *interpreter,
 16000                 void *arg, bool trap)
 16001 {
 16002   if (trap)
 16003     {
 16004       fprintf (stderr, "failed, unexpected trap %s\n",
 16005                interpreter->trap_reason);
 16006       return;
 16007     }
 16008 
 16009   if (interpreter->state.delta_shift != 1)
 16010     fprintf (stderr, "failed, delta shift is %d, not 1\n",
 16011              interpreter->state.delta_shift);
 16012   else
 16013     fprintf (stderr, "pass\n");
 16014 
 16015   return;
 16016 }
 16017 
 16018 static void
 16019 sfnt_check_scanctrl (struct sfnt_interpreter *interpreter,
 16020                      void *arg, bool trap)
 16021 {
 16022   if (trap)
 16023     {
 16024       fprintf (stderr, "failed, unexpected trap %s\n",
 16025                interpreter->trap_reason);
 16026       return;
 16027     }
 16028 
 16029   if (interpreter->SP != interpreter->stack)
 16030     {
 16031       fprintf (stderr, "failed, expected empty stack\n");
 16032       return;
 16033     }
 16034 
 16035   if (interpreter->state.scan_control != 1)
 16036     fprintf (stderr, "failed, scan control is %d, not 1\n",
 16037              interpreter->state.scan_control);
 16038   else
 16039     fprintf (stderr, "pass\n");
 16040 
 16041   return;
 16042 }
 16043 
 16044 static void
 16045 sfnt_check_instctrl (struct sfnt_interpreter *interpreter,
 16046                      void *arg, bool trap)
 16047 {
 16048   if (trap)
 16049     {
 16050       fprintf (stderr, "failed, unexpected trap %s\n",
 16051                interpreter->trap_reason);
 16052       return;
 16053     }
 16054 
 16055   if (interpreter->SP != interpreter->stack)
 16056     {
 16057       fprintf (stderr, "failed, expected empty stack\n");
 16058       return;
 16059     }
 16060 
 16061   if (interpreter->state.instruct_control != 2)
 16062     fprintf (stderr, "failed, inst control is %d, not 2\n",
 16063              interpreter->state.instruct_control);
 16064   else
 16065     fprintf (stderr, "pass\n");
 16066 
 16067   return;
 16068 }
 16069 
 16070 static struct sfnt_generic_test_args npushb_test_args =
 16071   {
 16072     (uint32_t []) { 1U, 2U, 3U, 4U, },
 16073     4,
 16074     true,
 16075     6,
 16076   };
 16077 
 16078 static struct sfnt_generic_test_args npushw_test_args =
 16079   {
 16080     (uint32_t []) { 0x101U, 0x202U, 0x303U, 0x404U, },
 16081     4,
 16082     true,
 16083     10,
 16084   };
 16085 
 16086 static struct sfnt_generic_test_args pushb_test_args =
 16087   {
 16088     (uint32_t []) { 1U, 2U, 3U, 4U, 5U, 6U, 7U, 8U,
 16089                     1U, },
 16090     9,
 16091     true,
 16092     11,
 16093   };
 16094 
 16095 static struct sfnt_generic_test_args pushw_test_args =
 16096   {
 16097     (uint32_t []) { 0x203U, 0x204U, 0x205U, 0x206U, 0x207U, 0x208U,
 16098                     0x909U, 0x909U, (uint32_t) -1, },
 16099     9,
 16100     true,
 16101     20,
 16102   };
 16103 
 16104 static struct sfnt_generic_test_args stack_overflow_test_args =
 16105   {
 16106     (uint32_t[]) { },
 16107     0,
 16108     true,
 16109     0,
 16110   };
 16111 
 16112 static struct sfnt_generic_test_args stack_underflow_test_args =
 16113   {
 16114     /* GCC BUG, this should be []! */
 16115     (uint32_t []) { },
 16116     0,
 16117     true,
 16118     4,
 16119   };
 16120 
 16121 static struct sfnt_rounding_test_args rtg_test_args =
 16122   {
 16123     64,
 16124   };
 16125 
 16126 static struct sfnt_rounding_test_args rtg_symmetric_test_args =
 16127   {
 16128     -64,
 16129   };
 16130 
 16131 static struct sfnt_rounding_test_args rtg_1_test_args =
 16132   {
 16133     0,
 16134   };
 16135 
 16136 static struct sfnt_rounding_test_args rtg_1_symmetric_test_args =
 16137   {
 16138     0,
 16139   };
 16140 
 16141 static struct sfnt_rounding_test_args rthg_test_args =
 16142   {
 16143     32,
 16144   };
 16145 
 16146 static struct sfnt_rounding_test_args rthg_1_test_args =
 16147   {
 16148     96,
 16149   };
 16150 
 16151 static struct sfnt_rounding_test_args rtdg_test_args =
 16152   {
 16153     32,
 16154   };
 16155 
 16156 static struct sfnt_rounding_test_args rtdg_1_test_args =
 16157   {
 16158     0,
 16159   };
 16160 
 16161 static struct sfnt_rounding_test_args rtdg_2_test_args =
 16162   {
 16163     32,
 16164   };
 16165 
 16166 static struct sfnt_rounding_test_args rtdg_3_test_args =
 16167   {
 16168     64,
 16169   };
 16170 
 16171 static struct sfnt_generic_test_args else_test_args =
 16172   {
 16173     (uint32_t []) { 77U, 90U, 83U, },
 16174     3,
 16175     false,
 16176     40,
 16177   };
 16178 
 16179 static struct sfnt_generic_test_args jmpr_test_args =
 16180   {
 16181     /* What ends up on the stack?
 16182 
 16183        First, there are the three words that the first PUSHW[2]
 16184        instruction has pushed:
 16185 
 16186          0, 0xb2, -3
 16187 
 16188        After those three words are pushed, JMPR[] is called, and pops an
 16189        offset:
 16190 
 16191          -3
 16192 
 16193        so now the stack is:
 16194 
 16195          0, 0xb2
 16196 
 16197        as a result of the relative jump, IP is now at the least
 16198        significant byte of the word inside what was originally a
 16199        PUSHW[2] instruction, 0xb2, which itself is PUSHB[2]!
 16200 
 16201        As a result of that instruction, three more bytes, including
 16202        JMPR[] itself are pushed onto the stack, making it:
 16203 
 16204          0, 0xb2, 255, 253, 0x1c
 16205 
 16206        Then, execution continues as usual.  4 is pushed on to the
 16207        stack, making it:
 16208 
 16209          0, 0xb2, 255, 253, 0x1c, 4
 16210 
 16211        Another JMPR[] pops:
 16212 
 16213          4
 16214 
 16215        making the stack:
 16216 
 16217          0, 0xb2, 255, 253, 0x1c
 16218 
 16219        And skips the next three padding bytes, finally reaching a
 16220        PUSHW[0] instruction which pushes -30 onto the stack:
 16221 
 16222          0, 0xb2, 255, 253, 0x1c, -30
 16223 
 16224        and a JMPR[] instruction, which pops:
 16225 
 16226          -30
 16227 
 16228        making:
 16229 
 16230          0, 0xb2, 255, 253,
 16231 
 16232        and subsequently traps, as -30 would underflow the instruction
 16233        stream.  */
 16234     (uint32_t []) { 0, 0xb2, 255, 253, 0x1c, },
 16235     5,
 16236     true,
 16237     17,
 16238   };
 16239 
 16240 static struct sfnt_generic_test_args dup_test_args =
 16241   {
 16242     (uint32_t []) { },
 16243     0,
 16244     true,
 16245     5,
 16246   };
 16247 
 16248 static struct sfnt_generic_test_args pop_test_args =
 16249   {
 16250     (uint32_t []) { 70, 70, },
 16251     2,
 16252     false,
 16253     5,
 16254   };
 16255 
 16256 static struct sfnt_generic_test_args clear_test_args =
 16257   {
 16258     (uint32_t []) { },
 16259     0,
 16260     false,
 16261     10,
 16262   };
 16263 
 16264 static struct sfnt_generic_test_args swap_test_args =
 16265   {
 16266     (uint32_t []) { 2, 1, },
 16267     2,
 16268     false,
 16269     4,
 16270   };
 16271 
 16272 static struct sfnt_generic_test_args depth_test_args =
 16273   {
 16274     (uint32_t []) { 3, 3, 3, 3, },
 16275     4,
 16276     false,
 16277     5,
 16278   };
 16279 
 16280 static struct sfnt_generic_test_args cindex_test_args =
 16281   {
 16282     (uint32_t []) { 0, 3, 3, 4, 0, },
 16283     5,
 16284     true,
 16285     10,
 16286   };
 16287 
 16288 static struct sfnt_generic_test_args mindex_test_args =
 16289   {
 16290     (uint32_t []) { 0, 3, 7, 4, 4, },
 16291     5,
 16292     false,
 16293     10,
 16294   };
 16295 
 16296 static struct sfnt_generic_test_args raw_test_args =
 16297   {
 16298     (uint32_t []) { },
 16299     0,
 16300     true,
 16301     0,
 16302   };
 16303 
 16304 static struct sfnt_generic_test_args loopcall_test_args =
 16305   {
 16306     (uint32_t []) { 10, },
 16307     1,
 16308     false,
 16309     12,
 16310   };
 16311 
 16312 static struct sfnt_generic_test_args call_test_args =
 16313   {
 16314     (uint32_t []) { 11, },
 16315     1,
 16316     true,
 16317     2,
 16318   };
 16319 
 16320 static struct sfnt_generic_test_args fdef_test_args =
 16321   {
 16322     (uint32_t []) { },
 16323     0,
 16324     true,
 16325     4,
 16326   };
 16327 
 16328 static struct sfnt_generic_test_args fdef_1_test_args =
 16329   {
 16330     (uint32_t []) { },
 16331     0,
 16332     true,
 16333     9,
 16334   };
 16335 
 16336 static struct sfnt_generic_test_args endf_test_args =
 16337   {
 16338     (uint32_t []) {  },
 16339     0,
 16340     true,
 16341     0,
 16342   };
 16343 
 16344 static struct sfnt_generic_test_args ws_test_args =
 16345   {
 16346     (uint32_t []) { 40, },
 16347     1,
 16348     true,
 16349     10,
 16350   };
 16351 
 16352 static struct sfnt_generic_test_args rs_test_args =
 16353   {
 16354     (uint32_t []) { },
 16355     0,
 16356     true,
 16357     2,
 16358   };
 16359 
 16360 static struct sfnt_generic_test_args wcvtp_test_args =
 16361   {
 16362     (uint32_t []) { 32, },
 16363     1,
 16364     true,
 16365     10,
 16366   };
 16367 
 16368 static struct sfnt_generic_test_args rcvt_test_args =
 16369   {
 16370     (uint32_t []) { 136, },
 16371     1,
 16372     true,
 16373     5,
 16374   };
 16375 
 16376 static struct sfnt_generic_test_args mppem_test_args =
 16377   {
 16378     (uint32_t []) { 17, },
 16379     1,
 16380     false,
 16381     1,
 16382   };
 16383 
 16384 static struct sfnt_generic_test_args mps_test_args =
 16385   {
 16386     (uint32_t []) { 17, },
 16387     1,
 16388     false,
 16389     1,
 16390   };
 16391 
 16392 static struct sfnt_generic_test_args debug_test_args =
 16393   {
 16394     (uint32_t []) { },
 16395     0,
 16396     false,
 16397     3,
 16398   };
 16399 
 16400 static struct sfnt_generic_test_args lt_test_args =
 16401   {
 16402     (uint32_t []) { 1, 0, 0, },
 16403     3,
 16404     false,
 16405     12,
 16406   };
 16407 
 16408 static struct sfnt_generic_test_args lteq_test_args =
 16409   {
 16410     (uint32_t []) { 1, 0, 1, },
 16411     3,
 16412     false,
 16413     12,
 16414   };
 16415 
 16416 static struct sfnt_generic_test_args gt_test_args =
 16417   {
 16418     (uint32_t []) { 0, 1, 0, },
 16419     3,
 16420     false,
 16421     12,
 16422   };
 16423 
 16424 static struct sfnt_generic_test_args gteq_test_args =
 16425   {
 16426     (uint32_t []) { 0, 1, 1, },
 16427     3,
 16428     false,
 16429     12,
 16430   };
 16431 
 16432 static struct sfnt_generic_test_args eq_test_args =
 16433   {
 16434     (uint32_t []) { 0, 1, 0, },
 16435     3,
 16436     false,
 16437     18,
 16438   };
 16439 
 16440 static struct sfnt_generic_test_args neq_test_args =
 16441   {
 16442     (uint32_t []) { 1, 0, 1, },
 16443     3,
 16444     false,
 16445     18,
 16446   };
 16447 
 16448 static struct sfnt_generic_test_args odd_test_args =
 16449   {
 16450     (uint32_t []) { 1, 0, },
 16451     2,
 16452     false,
 16453     9,
 16454   };
 16455 
 16456 static struct sfnt_generic_test_args even_test_args =
 16457   {
 16458     (uint32_t []) { 0, 1, },
 16459     2,
 16460     false,
 16461     9,
 16462   };
 16463 
 16464 static struct sfnt_generic_test_args if_test_args =
 16465   {
 16466     (uint32_t []) { 17, 24, 1, 2, 3, 4, 5, -1, -1,
 16467                     88, 1, 3, },
 16468     12,
 16469     false,
 16470     185,
 16471   };
 16472 
 16473 static struct sfnt_generic_test_args eif_test_args =
 16474   {
 16475     (uint32_t []) { },
 16476     0,
 16477     false,
 16478     3,
 16479   };
 16480 
 16481 static struct sfnt_generic_test_args and_test_args =
 16482   {
 16483     (uint32_t []) { 0, 0, 1, 0, },
 16484     4,
 16485     false,
 16486     16,
 16487   };
 16488 
 16489 static struct sfnt_generic_test_args or_test_args =
 16490   {
 16491     (uint32_t []) { 1, 1, 1, 0, },
 16492     4,
 16493     false,
 16494     16,
 16495   };
 16496 
 16497 static struct sfnt_generic_test_args not_test_args =
 16498   {
 16499     (uint32_t []) { 0, 1, },
 16500     2,
 16501     false,
 16502     6,
 16503   };
 16504 
 16505 static struct sfnt_generic_test_args sds_test_args =
 16506   {
 16507     (uint32_t []) { },
 16508     0,
 16509     true,
 16510     5,
 16511   };
 16512 
 16513 static struct sfnt_generic_test_args add_test_args =
 16514   {
 16515     (uint32_t []) { 96, -1, },
 16516     2,
 16517     false,
 16518     10,
 16519   };
 16520 
 16521 static struct sfnt_generic_test_args sub_test_args =
 16522   {
 16523     (uint32_t []) { 64, -64, 431, },
 16524     3,
 16525     false,
 16526     14,
 16527   };
 16528 
 16529 static struct sfnt_generic_test_args div_test_args =
 16530   {
 16531     (uint32_t []) { 32, -64, },
 16532     2,
 16533     true,
 16534     15,
 16535   };
 16536 
 16537 static struct sfnt_generic_test_args mul_test_args =
 16538   {
 16539     (uint32_t []) { 255, -255, 255, },
 16540     3,
 16541     false,
 16542     16,
 16543   };
 16544 
 16545 static struct sfnt_generic_test_args abs_test_args =
 16546   {
 16547     (uint32_t []) { 1, 1, },
 16548     2,
 16549     false,
 16550     7,
 16551   };
 16552 
 16553 static struct sfnt_generic_test_args neg_test_args =
 16554   {
 16555     (uint32_t []) { 1, -1, },
 16556     2,
 16557     false,
 16558     7,
 16559   };
 16560 
 16561 static struct sfnt_generic_test_args floor_test_args =
 16562   {
 16563     (uint32_t []) { -128, -64, 0, 64, 128, },
 16564     5,
 16565     false,
 16566     17,
 16567   };
 16568 
 16569 static struct sfnt_generic_test_args ceiling_test_args =
 16570   {
 16571     (uint32_t []) { -128, -128, -64, 0, 64, 128, 128, },
 16572     7,
 16573     false,
 16574     25,
 16575   };
 16576 
 16577 static struct sfnt_generic_test_args round_test_args =
 16578   {
 16579     (uint32_t []) { },
 16580     0,
 16581     true,
 16582     0,
 16583   };
 16584 
 16585 static struct sfnt_generic_test_args nround_test_args =
 16586   {
 16587     (uint32_t []) { 63, },
 16588     1,
 16589     false,
 16590     3,
 16591   };
 16592 
 16593 static struct sfnt_generic_test_args wcvtf_test_args =
 16594   {
 16595     (uint32_t []) { (63 * 17 * 65535 / 800) >> 10, },
 16596     1,
 16597     false,
 16598     7,
 16599   };
 16600 
 16601 static struct sfnt_generic_test_args jrot_test_args =
 16602   {
 16603     (uint32_t []) { 40, 40, },
 16604     2,
 16605     false,
 16606     13,
 16607   };
 16608 
 16609 static struct sfnt_generic_test_args jrof_test_args =
 16610   {
 16611     (uint32_t []) { 4, },
 16612     1,
 16613     false,
 16614     13,
 16615   };
 16616 
 16617 static struct sfnt_generic_test_args deltac1_test_args =
 16618   {
 16619     (uint32_t []) { ((((50 * 17 * 65535) + 32767) / 800) >> 10) + 8,
 16620                     ((((50 * 17 * 65535) + 32767) / 800) >> 10) + 8, },
 16621     2,
 16622     false,
 16623     22,
 16624   };
 16625 
 16626 static struct sfnt_generic_test_args deltac2_test_args =
 16627   {
 16628     (uint32_t []) { ((((50 * 17 * 65535) + 32767) / 800) >> 10) + 8,
 16629                     ((((50 * 17 * 65535) + 32767) / 800) >> 10) + 8, },
 16630     2,
 16631     false,
 16632     22,
 16633   };
 16634 
 16635 static struct sfnt_generic_test_args deltac3_test_args =
 16636   {
 16637     (uint32_t []) { ((((50 * 17 * 65535) + 32767) / 800) >> 10) + 8,
 16638                     ((((50 * 17 * 65535) + 32767) / 800) >> 10) + 8, },
 16639     2,
 16640     false,
 16641     22,
 16642   };
 16643 
 16644 /* Macros and instructions for detailed rounding tests.  */
 16645 
 16646 /* PUSHB[0] period:phase:threshold
 16647    SROUND[] */
 16648 #define SFNT_ROUNDING_OPERAND(period, phase, threshold) \
 16649   0xb0, (((unsigned char) period << 6)                  \
 16650          | ((unsigned char) phase & 3) << 4             \
 16651          | ((unsigned char) threshold & 15)), 0x76
 16652 
 16653 /* PUSHB[0] period:phase:threshold
 16654    S45ROUND[] */
 16655 #define SFNT_ROUNDING_OPERAND_45(period, phase, threshold)      \
 16656   0xb0, (((unsigned char) period << 6)                          \
 16657          | ((unsigned char) phase & 3) << 4                     \
 16658          | ((unsigned char) threshold & 15)), 0x77
 16659 
 16660 /* PUSHB[0] value
 16661    ROUND[] */
 16662 #define SFNT_ROUND_VALUE(value) 0xb0, value, 0x68
 16663 
 16664 static unsigned char sfnt_sround_instructions[] =
 16665   {
 16666     SFNT_ROUNDING_OPERAND (0, 0, 8),
 16667     SFNT_ROUND_VALUE (15),
 16668     SFNT_ROUND_VALUE (17),
 16669     SFNT_ROUNDING_OPERAND (1, 0, 8),
 16670     SFNT_ROUND_VALUE (32),
 16671     SFNT_ROUND_VALUE (16),
 16672     SFNT_ROUNDING_OPERAND (2, 0, 8),
 16673     SFNT_ROUND_VALUE (64),
 16674     SFNT_ROUND_VALUE (63),
 16675     SFNT_ROUNDING_OPERAND (0, 1, 8),
 16676     SFNT_ROUND_VALUE (16),
 16677     SFNT_ROUND_VALUE (24),
 16678     SFNT_ROUNDING_OPERAND (0, 2, 8),
 16679     SFNT_ROUND_VALUE (20),
 16680     SFNT_ROUND_VALUE (48),
 16681     SFNT_ROUNDING_OPERAND (0, 3, 8),
 16682     SFNT_ROUND_VALUE (7),
 16683     SFNT_ROUND_VALUE (70),
 16684   };
 16685 
 16686 static uint32_t sfnt_sround_values[] =
 16687   {
 16688     /* 0, 0, 8 = RTDG; 15 rounded to the double grid and becomes 0, 17
 16689        is 32.  */
 16690     0, 32,
 16691     /* 1, 0, 8 = RTG; 32 rounded to the grid is 64, 16 is 0.  */
 16692     64, 0,
 16693     /* 2, 0, 8 = round to a grid separated by 128s.  64 is 128, 63 is
 16694        0.  */
 16695     128, 0,
 16696     /* 0, 1, 8 = round to a double grid with a phase of 8.  16 rounds
 16697        down to 8, 24 rounds up to 40.  */
 16698     8, 40,
 16699     /* 0, 2, 8 = round to a double grid with a phase of 16.  20 rounds
 16700        down to 16, 40 rounds up to 48.  */
 16701     16, 48,
 16702     /* 0, 3, 8 = round to a double grid with a phase of 48.  7 rounds
 16703        up to 16, 70 rounds up to 80.  */
 16704     16, 80,
 16705   };
 16706 
 16707 static struct sfnt_generic_test_args sround_test_args =
 16708   {
 16709     sfnt_sround_values,
 16710     ARRAYELTS (sfnt_sround_values),
 16711     false,
 16712     ARRAYELTS (sfnt_sround_instructions),
 16713   };
 16714 
 16715 static unsigned char sfnt_s45round_instructions[] =
 16716   {
 16717     SFNT_ROUNDING_OPERAND_45 (0, 0, 0),
 16718     SFNT_ROUND_VALUE (1),
 16719     SFNT_ROUND_VALUE (45),
 16720   };
 16721 
 16722 static uint32_t sfnt_s45round_values[] =
 16723   {
 16724     /* 0, 0, 0: 1 rounded to the double cubic grid becomes 45, and 46
 16725        rounded to the double cubic grid becomes 90.  */
 16726     45, 90,
 16727   };
 16728 
 16729 static struct sfnt_generic_test_args s45round_test_args =
 16730   {
 16731     sfnt_s45round_values,
 16732     ARRAYELTS (sfnt_s45round_values),
 16733     false,
 16734     ARRAYELTS (sfnt_s45round_instructions),
 16735   };
 16736 
 16737 static struct sfnt_generic_test_args rutg_test_args =
 16738   {
 16739     (uint32_t []) { 64, 64, 0, },
 16740     3,
 16741     false,
 16742     10,
 16743   };
 16744 
 16745 static struct sfnt_generic_test_args rdtg_test_args =
 16746   {
 16747     (uint32_t []) { 0, 0, 64, },
 16748     3,
 16749     false,
 16750     10,
 16751   };
 16752 
 16753 static struct sfnt_generic_test_args sangw_test_args =
 16754   {
 16755     (uint32_t []) { },
 16756     0,
 16757     false,
 16758     3,
 16759   };
 16760 
 16761 static struct sfnt_generic_test_args aa_test_args =
 16762   {
 16763     (uint32_t []) { },
 16764     0,
 16765     false,
 16766     3,
 16767   };
 16768 
 16769 static struct sfnt_generic_test_args getinfo_test_args =
 16770   {
 16771     /* Pretend to be the Macintosh System 7 scaler.
 16772 
 16773        This lets the interpreter get away with only two phantom
 16774        points, as specified in Apple's TrueType reference manual.  */
 16775     (uint32_t []) { 2, 0, },
 16776     2,
 16777     false,
 16778     6,
 16779   };
 16780 
 16781 static struct sfnt_generic_test_args idef_test_args =
 16782   {
 16783     (uint32_t []) { 1, 2, 3, },
 16784     3,
 16785     false,
 16786     11,
 16787   };
 16788 
 16789 static struct sfnt_generic_test_args roll_test_args =
 16790   {
 16791     (uint32_t []) { 1, 2, 4, 5, 3, },
 16792     5,
 16793     false,
 16794     7,
 16795   };
 16796 
 16797 static struct sfnt_generic_test_args roll_1_test_args =
 16798   {
 16799     (uint32_t []) { 1, 2, },
 16800     2,
 16801     true,
 16802     3,
 16803   };
 16804 
 16805 static struct sfnt_generic_test_args max_test_args =
 16806   {
 16807     (uint32_t []) { 70, },
 16808     1,
 16809     false,
 16810     6,
 16811   };
 16812 
 16813 static struct sfnt_generic_test_args min_test_args =
 16814   {
 16815     (uint32_t []) { -70, },
 16816     1,
 16817     false,
 16818     6,
 16819   };
 16820 
 16821 static struct sfnt_generic_test_args scantype_test_args =
 16822   {
 16823     (uint32_t []) { },
 16824     0,
 16825     false,
 16826     3,
 16827   };
 16828 
 16829 static struct sfnt_interpreter_test all_tests[] =
 16830   {
 16831     {
 16832       "NPUSHB",
 16833       /* NPUSHB[] 4 1 2 3 4
 16834          NPUSHB[] 5 1 2 3 4 */
 16835       (unsigned char []) { 0x40, 4, 1, 2, 3, 4,
 16836                            0x40, 5, 1, 2, 3, 4, },
 16837       10,
 16838       &npushb_test_args,
 16839       sfnt_generic_check,
 16840     },
 16841     {
 16842       "NPUSHW",
 16843       /* NPUSHW[] 4 0x101 0x202 0x303 0x404
 16844          NPUSHW[] 4 0x101 0x202 0x303 0x4?? */
 16845       (unsigned char []) { 0x41, 4, 1, 1, 2, 2, 3, 3, 4, 4,
 16846                            0x41, 4, 1, 1, 2, 2, 3, 3, 4, },
 16847       19,
 16848       &npushw_test_args,
 16849       sfnt_generic_check,
 16850     },
 16851     {
 16852       "PUSHB",
 16853       /* PUSHB[7] 1 2 3 4 5 6 7 8
 16854          PUSHB[0] 1
 16855          PUSHB[5] 1 2 3 4 5 ? */
 16856       (unsigned char []) { 0xb7, 1, 2, 3, 4, 5, 6, 7, 8,
 16857                            0xb0, 1,
 16858                            0xb5, 1, 2, 3, 4, 5, },
 16859       17,
 16860       &pushb_test_args,
 16861       sfnt_generic_check,
 16862     },
 16863     {
 16864       "PUSHW",
 16865       /* PUSHW[7] 2 3 2 4 2 5 2 6 2 7 2 8 9 9 9 9
 16866          PUSHW[0] 255 255 -- this should get sign-extended
 16867          PUSHW[5] 1 1 2 2 3 3 4 4 5 5 6 ? */
 16868       (unsigned char []) { 0xbf, 2, 3, 2, 4, 2, 5, 2, 6, 2, 7, 2, 8, 9, 9, 9, 9,
 16869                            0xb8, 255, 255,
 16870                            0xbc, 1, 1, 2, 2, 3, 3, 4, 4, 5, 5, 6, },
 16871       28,
 16872       &pushw_test_args,
 16873       sfnt_generic_check,
 16874     },
 16875     {
 16876       "that stack overflow is handled correctly",
 16877       /* NPUSHB[] 101 0... */
 16878       (unsigned char [103]) { 0x40, 101, },
 16879       103,
 16880       &stack_overflow_test_args,
 16881       sfnt_generic_check,
 16882     },
 16883     {
 16884       "that stack underflow is handled correctly",
 16885       /* PUSHW[0] 100 100
 16886          POP[]
 16887          POP[] */
 16888       (unsigned char []) { 0xb8, 100, 100,
 16889                            0x21,
 16890                            0x21, },
 16891       5,
 16892       &stack_underflow_test_args,
 16893       sfnt_generic_check,
 16894     },
 16895     {
 16896       "SRP0, SRP1, SRP2",
 16897       /* PUSHB[0] 0
 16898          SRP0[]
 16899          PUSHB[0] 1
 16900          SRP1[]
 16901          PUSHB[0] 2
 16902          SRP2[] */
 16903       (unsigned char []) { 0xb0, 0,
 16904                            0x10,
 16905                            0xb0, 1,
 16906                            0x11,
 16907                            0xb0, 2,
 16908                            0x12, },
 16909       9,
 16910       NULL,
 16911       sfnt_check_srp0,
 16912     },
 16913     {
 16914       "SZP0, SZP1, SZP2, SZPS",
 16915       /* PUSHB[0] 1
 16916          SZP0[]
 16917          PUSHB[0] 1
 16918          SZP1[]
 16919          PUSHB[0] 0
 16920          SZP2[]
 16921          PUSHB[0] 5
 16922          SZPS[]  */
 16923       (unsigned char []) { 0xb0, 1,
 16924                            0x13,
 16925                            0xb0, 1,
 16926                            0x14,
 16927                            0xb0, 0,
 16928                            0x15,
 16929                            0xb0, 5,
 16930                            0x16, },
 16931       12,
 16932       NULL,
 16933       sfnt_check_szp0,
 16934     },
 16935     {
 16936       "SLOOP",
 16937       /* PUSHB[0] 2
 16938          SLOOP[]
 16939          PUSHB[0] 0
 16940          SLOOP[] */
 16941       (unsigned char []) { 0xb0, 2,
 16942                            0x17,
 16943                            0xb0, 0,
 16944                            0x17, },
 16945       6,
 16946       NULL,
 16947       sfnt_check_sloop,
 16948     },
 16949     {
 16950       "RTG",
 16951       /* RTG[]
 16952          PUSHB[0] 32
 16953          ROUND[] */
 16954       (unsigned char []) { 0x18,
 16955                            0xb0, 32,
 16956                            0x68, },
 16957       4,
 16958       &rtg_test_args,
 16959       sfnt_check_rounding,
 16960     },
 16961     {
 16962       "rounding symmetry",
 16963       /* RTG[]
 16964          PUSHW[0] 255 -32
 16965          ROUND[] */
 16966       (unsigned char []) { 0x18,
 16967                            0xb8, 255, - (signed char) 32,
 16968                            0x68, },
 16969       5,
 16970       &rtg_symmetric_test_args,
 16971       sfnt_check_rounding,
 16972     },
 16973     {
 16974       "RTG to 0",
 16975       /* RTG[]
 16976          PUSHB[0] 31
 16977          ROUND[] */
 16978       (unsigned char []) { 0x18,
 16979                            0xb0, 31,
 16980                            0x68, },
 16981       4,
 16982       &rtg_1_test_args,
 16983       sfnt_check_rounding,
 16984     },
 16985     {
 16986       "rounding symmetry to 0",
 16987       /* RTG[]
 16988          PUSHB[0] 255 -31
 16989          ROUND[] */
 16990       (unsigned char []) { 0x18,
 16991                            0xb8, 255, - (signed char) 31,
 16992                            0x68, },
 16993       5,
 16994       &rtg_1_symmetric_test_args,
 16995       sfnt_check_rounding,
 16996     },
 16997     {
 16998       "RTHG",
 16999       /* RTHG[]
 17000          PUSHB[0] 0
 17001          ROUND[] */
 17002       (unsigned char []) { 0x19,
 17003                            0xb0, 0,
 17004                            0x68, },
 17005       4,
 17006       &rthg_test_args,
 17007       sfnt_check_rounding,
 17008     },
 17009     {
 17010       "RTHG to 96",
 17011       /* RTHG[]
 17012          PUSHB[0] 64
 17013          ROUND[] */
 17014       (unsigned char []) { 0x19,
 17015                            0xb0, 64,
 17016                            0x68, },
 17017       4,
 17018       &rthg_1_test_args,
 17019       sfnt_check_rounding,
 17020     },
 17021     {
 17022       "SMD",
 17023       /* PUSHB[0] 32
 17024          SMD[] */
 17025       (unsigned char []) { 0xb0, 32,
 17026                            0x1a, },
 17027       3,
 17028       NULL,
 17029       sfnt_check_smd,
 17030     },
 17031     {
 17032       "ELSE",
 17033       /* ELSE[]
 17034          ;; Lots of variable length instructions
 17035          ;; which will not be executed, like:
 17036          NPUSHW[] 3 11 22 33 44 55 66
 17037          NPUSHB[] 1 3
 17038          PUSHW[2] 1 1 2 2 3 3
 17039          PUSHB[2] 1 2 3
 17040          ;; Also test nested ifs.
 17041          PUSHW[0] 1 1
 17042          IF[]
 17043          PUSHW[0] 1 1
 17044          ELSE[]
 17045          PUSHW[0] 1 1
 17046          EIF[]
 17047          EIF[]
 17048          PUSHW[0] 1 1
 17049          ;; the actual contents of the stack.
 17050          PUSHB[2] 77 90 83 */
 17051       (unsigned char []) { 0x1b,
 17052                            0x41, 3, 11, 22, 33, 44, 55, 66,
 17053                            0x40, 1, 3,
 17054                            0xba, 1, 1, 2, 2, 3, 3,
 17055                            0xb2, 1, 2, 3,
 17056                            0xb8, 1, 1,
 17057                            0x58,
 17058                            0xb8, 1, 1,
 17059                            0x1b,
 17060                            0xb8, 1, 1,
 17061                            0x59,
 17062                            0x59,
 17063                            0xb2, 77, 90, 83, },
 17064       40,
 17065       &else_test_args,
 17066       sfnt_generic_check,
 17067     },
 17068     {
 17069       "JMPR",
 17070       /* PUSHW[2] 00 00 00 PUSHB[2] 255 253 JMPR[]
 17071          PUSHB[0] 4
 17072          JMPR[]
 17073          255 255 255
 17074          PUSHW[0] 255 -30
 17075          JMPR[] */
 17076       (unsigned char []) { 0xba, 00, 00, 00, 0xb2, 255, 253, 0x1c,
 17077                            0xb0, 4,
 17078                            0x1c,
 17079                            255, 255, 255,
 17080                            0xb8, 255, -30,
 17081                            0x1c, },
 17082       18,
 17083       &jmpr_test_args,
 17084       sfnt_generic_check,
 17085     },
 17086     {
 17087       "SCVTCI",
 17088       /* PUSHB[0] 128
 17089          SCVTCI[] */
 17090       (unsigned char []) { 0xb0, 128,
 17091                            0x1d, },
 17092       3,
 17093       NULL,
 17094       sfnt_check_scvtci,
 17095     },
 17096     {
 17097       "SSWCI",
 17098       /* PUSHW[0] 2 0 ;; 512
 17099          SSWCI[] */
 17100       (unsigned char []) { 0xb8, 2, 0,
 17101                            0x1e, },
 17102       4,
 17103       NULL,
 17104       sfnt_check_sswci,
 17105     },
 17106     {
 17107       "SSW",
 17108       /* PUSHW[0] 255 255 ; -1
 17109          SSW[] ; this should be converted to device-space */
 17110       (unsigned char []) { 0xb8, 255, 255,
 17111                            0x1f, },
 17112       4,
 17113       NULL,
 17114       sfnt_check_ssw,
 17115     },
 17116     {
 17117       "DUP",
 17118       /* PUSHB[0] 70
 17119          DUP[]
 17120          POP[]
 17121          POP[]
 17122          DUP[] */
 17123       (unsigned char []) { 0xb0, 70,
 17124                            0x20,
 17125                            0x21,
 17126                            0x21,
 17127                            0x70, },
 17128       6,
 17129       &dup_test_args,
 17130       sfnt_generic_check,
 17131     },
 17132     {
 17133       "POP",
 17134       /* PUSHB[0] 70
 17135          DUP[]
 17136          DUP[]
 17137          POP[] */
 17138       (unsigned char []) { 0xb0, 70,
 17139                            0x20,
 17140                            0x20,
 17141                            0x21, },
 17142       5,
 17143       &pop_test_args,
 17144       sfnt_generic_check,
 17145     },
 17146     {
 17147       "CLEAR",
 17148       /* PUSHB[7] 1 2 3 4 5 6 7 8
 17149          CLEAR[] */
 17150       (unsigned char []) { 0xb7, 1, 2, 3, 4, 5, 6, 7, 8,
 17151                            0x22, },
 17152       10,
 17153       &clear_test_args,
 17154       sfnt_generic_check,
 17155     },
 17156     {
 17157       "SWAP",
 17158       /* PUSHB[1] 1 2
 17159          SWAP[] */
 17160       (unsigned char []) { 0xb1, 1, 2,
 17161                            0x23, },
 17162       4,
 17163       &swap_test_args,
 17164       sfnt_generic_check,
 17165     },
 17166     {
 17167       "DEPTH",
 17168       /* PUSHB[2] 3 3 3
 17169          DEPTH[] */
 17170       (unsigned char []) { 0xb2, 3, 3, 3,
 17171                            0x24, },
 17172       5,
 17173       &depth_test_args,
 17174       sfnt_generic_check,
 17175     },
 17176     {
 17177       "CINDEX",
 17178       /* PUSHB[4] 0 3 3 4 1
 17179          CINDEX[] ; pops 1, indices 4
 17180          CINDEX[] ; pops 4, indices 0
 17181          PUSHB[0] 6
 17182          CINDEX[] ; pops 6, trap */
 17183       (unsigned char []) { 0xb4, 0, 3, 3, 4, 1,
 17184                            0x25,
 17185                            0x25,
 17186                            0xb0, 6,
 17187                            0x25, },
 17188       11,
 17189       &cindex_test_args,
 17190       sfnt_generic_check,
 17191     },
 17192     {
 17193       "MINDEX",
 17194       /* PUSHB[6] 0 3 4 7 3 4 2
 17195          MINDEX[] ; pops 2, array becomes 0 3 4 7 4 3
 17196          MINDEX[] ; pops 3, array becomes 0 3 7 4 4 */
 17197       (unsigned char []) { 0xb6, 0, 3, 4, 7, 3, 4, 2,
 17198                            0x26,
 17199                            0x26, },
 17200       10,
 17201       &mindex_test_args,
 17202       sfnt_generic_check,
 17203     },
 17204     {
 17205       "RAW",
 17206       /* RAW[] */
 17207       (unsigned char []) { 0x28, },
 17208       1,
 17209       &raw_test_args,
 17210       sfnt_generic_check,
 17211     },
 17212     {
 17213       "LOOPCALL",
 17214       /* PUSHB[1] 0 2
 17215          FDEF[]
 17216          PUSHB[0] 1
 17217          ADD[]
 17218          ENDF[]
 17219          PUSHB[1] 10 2
 17220          LOOPCALL[]  */
 17221       (unsigned char []) { 0xb1, 0, 2,
 17222                            0x2c,
 17223                            0xb0, 1,
 17224                            0x60,
 17225                            0x2d,
 17226                            0xb1, 10, 2,
 17227                            0x2a, },
 17228       12,
 17229       &loopcall_test_args,
 17230       sfnt_generic_check,
 17231     },
 17232     {
 17233       "CALL",
 17234       /* PUSHB[1] 7 2
 17235          FDEF[]
 17236          PUSHB[0] 1
 17237          ADD[]
 17238          ENDF[]
 17239          PUSHB[0] 2
 17240          CALL[]
 17241          PUSHB[0] 3
 17242          ADD[]
 17243          ;; Test that infinite recursion fails.
 17244          PUSHB[0] 3
 17245          FDEF[]
 17246          PUSHB[0] 3
 17247          CALL[]
 17248          ENDF[]
 17249          PUSHB[0] 3
 17250          CALL[] */
 17251       (unsigned char []) { 0xb1, 7, 2,
 17252                            0x2c,
 17253                            0xb0, 1,
 17254                            0x60,
 17255                            0x2d,
 17256                            0xb0, 2,
 17257                            0x2b,
 17258                            0xb0, 3,
 17259                            0x60,
 17260                            0xb0, 3,
 17261                            0x2c,
 17262                            0xb0, 3,
 17263                            0x2b,
 17264                            0x2d,
 17265                            0xb0, 3,
 17266                            0x2b, },
 17267       24,
 17268       &call_test_args,
 17269       sfnt_generic_check,
 17270     },
 17271     {
 17272       "that FDEF traps inside nested definitions",
 17273       /* PUSHB[0] 1
 17274          FDEF[]
 17275          FDEF[]
 17276          ENDF[]
 17277          ENDF[] */
 17278       (unsigned char []) { 0xb0, 1,
 17279                            0x2c,
 17280                            0x2c,
 17281                            0x2d,
 17282                            0x2d, },
 17283       6,
 17284       &fdef_test_args,
 17285       sfnt_generic_check,
 17286     },
 17287     {
 17288       "that FDEF traps upon missing ENDF",
 17289       /* PUSHB[0] 1
 17290          FDEF[]
 17291          PUSHB[3] 1 2 3 4
 17292          POP[]  */
 17293       (unsigned char []) { 0xb0, 1,
 17294                            0x2c,
 17295                            0xb3, 1, 2, 3, 4,
 17296                            0x21, },
 17297       9,
 17298       &fdef_1_test_args,
 17299       sfnt_generic_check,
 17300     },
 17301     {
 17302       "ENDF",
 17303       /* ENDF[] */
 17304       (unsigned char []) { 0x2d, },
 17305       1,
 17306       &endf_test_args,
 17307       sfnt_generic_check,
 17308     },
 17309     {
 17310       "RTDG",
 17311       /* RTDG[]
 17312          PUSHB[0] 16
 17313          ROUND[] */
 17314       (unsigned char []) { 0x3d,
 17315                            0xb0, 16,
 17316                            0x68, },
 17317       4,
 17318       &rtdg_test_args,
 17319       sfnt_check_rounding,
 17320     },
 17321     {
 17322       "RTDG down to 0",
 17323       /* RTDG[]
 17324          PUSHB[0] 15
 17325          ROUND[] */
 17326       (unsigned char []) { 0x3d,
 17327                            0xb0, 15,
 17328                            0x68, },
 17329       4,
 17330       &rtdg_1_test_args,
 17331       sfnt_check_rounding,
 17332     },
 17333     {
 17334       "RTDG down to 32",
 17335       /* RTDG[]
 17336          PUSHB[0] 47
 17337          ROUND[] */
 17338       (unsigned char []) { 0x3d,
 17339                            0xb0, 47,
 17340                            0x68, },
 17341       4,
 17342       &rtdg_2_test_args,
 17343       sfnt_check_rounding,
 17344     },
 17345     {
 17346       "RTDG up to 64",
 17347       /* RTDG[]
 17348          PUSHB[0] 48
 17349          ROUND[] */
 17350       (unsigned char []) { 0x3d,
 17351                            0xb0, 48,
 17352                            0x68, },
 17353       4,
 17354       &rtdg_3_test_args,
 17355       sfnt_check_rounding,
 17356     },
 17357     {
 17358       "WS",
 17359       /* PUSHB[1] 240 40
 17360          WS[]
 17361          PUSHB[0] 240
 17362          RS[]
 17363          PUSHB[1] 255 40
 17364          WS[] */
 17365       (unsigned char []) { 0xb1, 240, 40,
 17366                            0x42,
 17367                            0xb0, 240,
 17368                            0x43,
 17369                            0xb1, 255, 40,
 17370                            0x42, },
 17371       11,
 17372       &ws_test_args,
 17373       sfnt_generic_check,
 17374     },
 17375     {
 17376       "RS",
 17377       /* PUSHB[0] 255
 17378          RS[] */
 17379       (unsigned char []) { 0xb0, 255,
 17380                            0x43, },
 17381       3,
 17382       &rs_test_args,
 17383       sfnt_generic_check,
 17384     },
 17385     {
 17386       "WCVTP",
 17387       /* PUSHB[1] 9 32
 17388          WCVTP[]
 17389          PUSHB[0] 9
 17390          RCVT[]
 17391          PUSHB[1] 10 10
 17392          WCVTP[] */
 17393       (unsigned char []) { 0xb1, 9, 32,
 17394                            0x44,
 17395                            0xb0, 9,
 17396                            0x45,
 17397                            0xb1, 10, 10,
 17398                            0x44, },
 17399       11,
 17400       &wcvtp_test_args,
 17401       sfnt_generic_check,
 17402     },
 17403     {
 17404       "RCVT",
 17405       /* PUSHB[0] 1
 17406          RCVT[]
 17407          PUSHB[0] 10
 17408          RCVT[] */
 17409       (unsigned char []) { 0xb0, 1,
 17410                            0x45,
 17411                            0xb0, 10,
 17412                            0x45, },
 17413       6,
 17414       &rcvt_test_args,
 17415       sfnt_generic_check,
 17416     },
 17417     {
 17418       "MPPEM",
 17419       /* MPPEM[] */
 17420       (unsigned char []) { 0x4b, },
 17421       1,
 17422       &mppem_test_args,
 17423       sfnt_generic_check,
 17424     },
 17425     {
 17426       "MPS",
 17427       /* MPS[] */
 17428       (unsigned char []) { 0x4c, },
 17429       1,
 17430       &mps_test_args,
 17431       sfnt_generic_check,
 17432     },
 17433     {
 17434       "FLIPON",
 17435       /* FLIPON[] */
 17436       (unsigned char []) { 0x4d, },
 17437       1,
 17438       NULL,
 17439       sfnt_check_flipon,
 17440     },
 17441     {
 17442       "FLIPOFF",
 17443       /* FLIPOFF[] */
 17444       (unsigned char []) { 0x4e, },
 17445       1,
 17446       NULL,
 17447       sfnt_check_flipoff,
 17448     },
 17449     {
 17450       "DEBUG",
 17451       /* PUSHB[0] 1
 17452          DEBUG[] */
 17453       (unsigned char []) { 0xb0, 1,
 17454                            0x4f, },
 17455       3,
 17456       &debug_test_args,
 17457       sfnt_generic_check,
 17458     },
 17459     {
 17460       "LT",
 17461       /* PUSHB[1] 47 48
 17462          LT[]
 17463          PUSHB[1] 48 47
 17464          LT[]
 17465          PUSHB[1] 47 47
 17466          LT[] */
 17467       (unsigned char []) { 0xb1, 47, 48,
 17468                            0x50,
 17469                            0xb1, 48, 47,
 17470                            0x50,
 17471                            0xb1, 47, 47,
 17472                            0x50, },
 17473       12,
 17474       &lt_test_args,
 17475       sfnt_generic_check,
 17476     },
 17477     {
 17478       "LTEQ",
 17479       /* PUSHB[1] 47 48
 17480          LTEQ[]
 17481          PUSHB[1] 48 47
 17482          LTEQ[]
 17483          PUSHB[1] 47 47
 17484          LTEQ[] */
 17485       (unsigned char []) { 0xb1, 47, 48,
 17486                            0x51,
 17487                            0xb1, 48, 47,
 17488                            0x51,
 17489                            0xb1, 47, 47,
 17490                            0x51, },
 17491       12,
 17492       &lteq_test_args,
 17493       sfnt_generic_check,
 17494     },
 17495     {
 17496       "GT",
 17497       /* PUSHB[1] 47 48
 17498          GT[]
 17499          PUSHB[1] 48 47
 17500          GT[]
 17501          GT[1] 47 47
 17502          LTEQ[] */
 17503       (unsigned char []) { 0xb1, 47, 48,
 17504                            0x52,
 17505                            0xb1, 48, 47,
 17506                            0x52,
 17507                            0xb1, 47, 47,
 17508                            0x52, },
 17509       12,
 17510       &gt_test_args,
 17511       sfnt_generic_check,
 17512     },
 17513     {
 17514       "GTEQ",
 17515       /* PUSHB[1] 47 48
 17516          GTEQ[]
 17517          PUSHB[1] 48 47
 17518          GTEQ[]
 17519          GTEQ[1] 47 47
 17520          LTEQ[] */
 17521       (unsigned char []) { 0xb1, 47, 48,
 17522                            0x53,
 17523                            0xb1, 48, 47,
 17524                            0x53,
 17525                            0xb1, 47, 47,
 17526                            0x53, },
 17527       12,
 17528       &gteq_test_args,
 17529       sfnt_generic_check,
 17530     },
 17531     {
 17532       "EQ",
 17533       /* PUSHW[1] 255 253 255 255
 17534          EQ[]
 17535          PUSHW[1] 27 27 27 27
 17536          EQ[]
 17537          PUSHB[0] 3
 17538          PUSHW[0] 255 254
 17539          EQ[] */
 17540       (unsigned char []) { 0xb9, 255, 253, 255, 255,
 17541                            0x54,
 17542                            0xb9, 27, 27, 27, 27,
 17543                            0x54,
 17544                            0xb0, 3,
 17545                            0xb8, 255, 254,
 17546                            0x54, },
 17547       18,
 17548       &eq_test_args,
 17549       sfnt_generic_check,
 17550     },
 17551     {
 17552       "NEQ",
 17553       /* PUSHW[1] 255 253 255 255
 17554          NEQ[]
 17555          PUSHW[1] 27 27 27 27
 17556          NEQ[]
 17557          PUSHB[0] 3
 17558          PUSHW[0] 255 254
 17559          NEQ[] */
 17560       (unsigned char []) { 0xb9, 255, 253, 255, 255,
 17561                            0x55,
 17562                            0xb9, 27, 27, 27, 27,
 17563                            0x55,
 17564                            0xb0, 3,
 17565                            0xb8, 255, 254,
 17566                            0x55, },
 17567       18,
 17568       &neq_test_args,
 17569       sfnt_generic_check,
 17570     },
 17571     {
 17572       "ODD",
 17573       /* RTG[]
 17574          PUSHW[1] 255 224 ;; -32
 17575          ODD[] ;; Rounds symmetrically to -64, which is odd.
 17576          PUSHW[1] 255 159 ;; -96
 17577          ODD[] ;; Rounds symmetrically to -128, which is even.  */
 17578       (unsigned char []) { 0x18,
 17579                            0xb8, 255, 224,
 17580                            0x56,
 17581                            0xb8, 255, 159,
 17582                            0x56, },
 17583       9,
 17584       &odd_test_args,
 17585       sfnt_generic_check,
 17586     },
 17587     {
 17588       "EVEN",
 17589       /* RTG[]
 17590          PUSHW[1] 255 224 ;; -32
 17591          EVEN[] ;; Rounds symmetrically to -64, which is odd.
 17592          PUSHW[1] 255 159 ;; -96
 17593          EVEN[] ;; Rounds symmetrically to -128, which is even.  */
 17594       (unsigned char []) { 0x18,
 17595                            0xb8, 255, 224,
 17596                            0x57,
 17597                            0xb8, 255, 159,
 17598                            0x57, },
 17599       9,
 17600       &even_test_args,
 17601       sfnt_generic_check,
 17602     },
 17603     {
 17604       "IF",
 17605       /* NPUSHB[] 1 0
 17606          IF[]
 17607          PUSHW[0] 1 1
 17608          PUSHW[1] 1 1 2 2
 17609          PUSHW[2] 1 1 2 2 3 3
 17610          PUSHW[3] 1 1 2 2 3 3 4 4
 17611          PUSHW[4] 1 1 2 2 3 3 4 4 5 5
 17612          PUSHW[5] 1 1 2 2 3 3 4 4 5 5 6 6
 17613          PUSHW[6] 1 1 2 2 3 3 4 4 5 5 6 6 7 7
 17614          PUSHW[7] 1 1 2 2 3 3 4 4 5 5 6 6 7 7 8 8
 17615          PUSHB[0] 1
 17616          PUSHB[1] 2 1
 17617          PUSHB[2] 3 2 1
 17618          PUSHB[3] 4 3 2 1
 17619          PUSHB[4] 5 4 3 2 1
 17620          PUSHB[5] 6 5 4 3 2 1
 17621          PUSHB[6] 7 6 5 4 3 2 1
 17622          PUSHB[7] 8 7 6 5 4 3 2 1
 17623          DEBUG[]
 17624          IF[]
 17625          PUSHB[7] 12 12 12 12 12 12 12 12
 17626          ELSE[]
 17627          EIF[]
 17628          ELSE[]
 17629          PUSHB[1] 17 24
 17630          NPUSHB[] 5 1 2 3 4 5
 17631          NPUSHW[] 2 255 255 255 255
 17632          EIF[]
 17633 
 17634          PUSHB[0] 1
 17635          IF[]
 17636          NPUSHB[] 2 43 43
 17637          IF[]
 17638          PUSHB[0] 45
 17639          ELSE[]
 17640          PUSHB[0] 14
 17641          EIF[]
 17642          ADD[]
 17643          ELSE[]
 17644          NPUSHB[] 4 3 2 1 0
 17645          EIF[]
 17646          PUSHB[1] 1 3 */
 17647       (unsigned char []) { 0x40, 1, 0,
 17648                            0x58,
 17649                            0xb8, 1, 1,
 17650                            0xb9, 1, 1, 2, 2,
 17651                            0xba, 1, 1, 2, 2, 3, 3,
 17652                            0xbb, 1, 1, 2, 2, 3, 3, 4, 4,
 17653                            0xbc, 1, 1, 2, 2, 3, 3, 4, 4, 5, 5,
 17654                            0xbd, 1, 1, 2, 2, 3, 3, 4, 4, 5, 5, 6, 6,
 17655                            0xbe, 1, 1, 2, 2, 3, 3, 4, 4, 5, 5, 6, 6, 7, 7,
 17656                            0xbf, 1, 1, 2, 2, 3, 3, 4, 4, 5, 5, 6, 6, 7, 7, 8, 8,
 17657                            0xb0, 1,
 17658                            0xb1, 2, 1,
 17659                            0xb2, 3, 2, 1,
 17660                            0xb3, 4, 3, 2, 1,
 17661                            0xb4, 5, 4, 3, 2, 1,
 17662                            0xb5, 6, 5, 4, 3, 2, 1,
 17663                            0xb6, 7, 6, 5, 4, 3, 2, 1,
 17664                            0xb7, 8, 7, 6, 5, 4, 3, 2, 1,
 17665                            0x4f,
 17666                            0x58,
 17667                            0xb7, 12, 12, 12, 12, 12, 12, 12, 12,
 17668                            0x1b,
 17669                            0x59,
 17670                            0x1b,
 17671                            0xb1, 17, 24,
 17672                            0x40, 5, 1, 2, 3, 4, 5,
 17673                            0x41, 2, 255, 255, 255, 255,
 17674                            0x59,
 17675                            0xb0, 1,
 17676                            0x58,
 17677                            0x40, 2, 43, 43,
 17678                            0x58,
 17679                            0xb0, 45,
 17680                            0x1b,
 17681                            0xb0, 14,
 17682                            0x59,
 17683                            0x60,
 17684                            0x1b,
 17685                            0x40, 4, 3, 2, 1, 0,
 17686                            0x59,
 17687                            0xb1, 1, 3, },
 17688       185,
 17689       &if_test_args,
 17690       sfnt_generic_check,
 17691     },
 17692     {
 17693       "EIF",
 17694       /* PUSHB[0] 1
 17695          IF[]
 17696          EIF[] */
 17697       (unsigned char []) { 0xb0, 1,
 17698                            0x58,
 17699                            0x59, },
 17700       3,
 17701       &eif_test_args,
 17702       sfnt_generic_check,
 17703     },
 17704     {
 17705       "AND",
 17706       /* PUSHB[1] 0 1
 17707          AND[]
 17708          PUSHB[1] 37 0
 17709          AND[]
 17710          PUSHB[1] 40 1
 17711          AND[]
 17712          PUSHB[1] 0 0
 17713          AND[] */
 17714       (unsigned char []) { 0xb1, 0, 1,
 17715                            0x5a,
 17716                            0xb1, 37, 0,
 17717                            0x5a,
 17718                            0xb1, 40, 1,
 17719                            0x5a,
 17720                            0xb1, 0, 0,
 17721                            0x5a, },
 17722       16,
 17723       &and_test_args,
 17724       sfnt_generic_check,
 17725     },
 17726     {
 17727       "OR",
 17728       /* PUSHB[1] 0 1
 17729          OR[]
 17730          PUSHB[1] 37 0
 17731          OR[]
 17732          PUSHB[1] 40 1
 17733          OR[]
 17734          PUSHB[1] 0 0
 17735          OR[] */
 17736       (unsigned char []) { 0xb1, 0, 1,
 17737                            0x5b,
 17738                            0xb1, 37, 0,
 17739                            0x5b,
 17740                            0xb1, 40, 1,
 17741                            0x5b,
 17742                            0xb1, 0, 0,
 17743                            0x5b, },
 17744       16,
 17745       &or_test_args,
 17746       sfnt_generic_check,
 17747     },
 17748     {
 17749       "NOT",
 17750       /* PUSHB[0] 1
 17751          NOT[]
 17752          PUSHB[0] 0
 17753          NOT[] */
 17754       (unsigned char []) { 0xb0, 1,
 17755                            0x5c,
 17756                            0xb0, 0,
 17757                            0x5c, },
 17758       6,
 17759       &not_test_args,
 17760       sfnt_generic_check,
 17761     },
 17762     {
 17763       "SDB",
 17764       /* PUSHB[0] 8
 17765          SDB[] */
 17766       (unsigned char []) { 0xb0, 8,
 17767                            0x5e, },
 17768       3,
 17769       NULL,
 17770       sfnt_check_sdb,
 17771     },
 17772     {
 17773       "SDS",
 17774       /* PUSHB[0] 1
 17775          SDS[] */
 17776       (unsigned char []) { 0xb0, 1,
 17777                            0x5f, },
 17778       3,
 17779       NULL,
 17780       sfnt_check_sds,
 17781     },
 17782     {
 17783       "that SDS rejects invalid values",
 17784       /* PUSHB[0] 1,
 17785          SDS[]
 17786          PUSHB[0] 7
 17787          SDS[] */
 17788       (unsigned char []) { 0xb0, 1,
 17789                            0x5f,
 17790                            0xb0, 7,
 17791                            0x5f, },
 17792       6,
 17793       &sds_test_args,
 17794       sfnt_generic_check,
 17795     },
 17796     {
 17797       "ADD",
 17798       /* PUSHB[1] 64 32
 17799          ADD[]
 17800          PUSHW[1] 255 40 0 215 ;; -216 + 215
 17801          ADD[] */
 17802       (unsigned char []) { 0xb1, 64, 32,
 17803                            0x60,
 17804                            0xb9, 255, 40, 0, 215,
 17805                            0x60, },
 17806       10,
 17807       &add_test_args,
 17808       sfnt_generic_check,
 17809     },
 17810     {
 17811       "SUB",
 17812       /* PUSHB[1] 96 32
 17813          SUB[]
 17814          PUSHB[1] 32 96
 17815          SUB[]
 17816          PUSHW[1] 0 215 255 40 ;; 215 - -216
 17817          SUB[] */
 17818       (unsigned char []) { 0xb1, 96, 32,
 17819                            0x61,
 17820                            0xb1, 32, 96,
 17821                            0x61,
 17822                            0xb9, 0, 215, 255, 40,
 17823                            0x61, },
 17824       14,
 17825       &sub_test_args,
 17826       sfnt_generic_check,
 17827     },
 17828     {
 17829       "DIV",
 17830       /* PUSHB[1] 64 128
 17831          DIV[] ; 1 / 2 = 0.5
 17832          PUSHW[1] 0 32 255 224
 17833          DIV[] ; 0.5 / -0.5 = -1.0
 17834          PUSHW[1] 255 255 0 0
 17835          DIV[] ; -1 / 0 = trap */
 17836       (unsigned char []) { 0xb1, 64, 128,
 17837                            0x62,
 17838                            0xb9, 0, 32, 255, 224,
 17839                            0x62,
 17840                            0xb9, 255, 255, 0, 0,
 17841                            0x62, },
 17842       16,
 17843       &div_test_args,
 17844       sfnt_generic_check,
 17845     },
 17846     {
 17847       "MUL",
 17848       /* PUSHB[1] 255 64
 17849          MUL[] ; 255 * 1 = 255
 17850          PUSHW[1] 0 255 255 192
 17851          MUL[] ; 255 * -1 = -255
 17852          PUSHW[1] 255 1 255 192
 17853          MUL[] ; -255 * -1 = 255 */
 17854       (unsigned char []) { 0xb1, 255, 64,
 17855                            0x63,
 17856                            0xb9, 0, 255, 255, 192,
 17857                            0x63,
 17858                            0xb9, 255, 1, 255, 192,
 17859                            0x63, },
 17860       16,
 17861       &mul_test_args,
 17862       sfnt_generic_check,
 17863     },
 17864     {
 17865       "ABS",
 17866       /* PUSHW[0] 255 255
 17867          ABS[] ;; abs (-1) == 1
 17868          PUSHB[0] 1
 17869          ABS[] ;; abs (1) == 1 */
 17870       (unsigned char []) { 0xb8, 255, 255,
 17871                            0x64,
 17872                            0xb0, 1,
 17873                            0x64, },
 17874       7,
 17875       &abs_test_args,
 17876       sfnt_generic_check,
 17877     },
 17878     {
 17879       "NEG",
 17880       /* PUSHW[0] 255 255
 17881          NEG[] ;; neg (-1) == 1
 17882          PUSHB[0] 1
 17883          NEG[] ;; neg (1) == -1 */
 17884       (unsigned char []) { 0xb8, 255, 255,
 17885                            0x65,
 17886                            0xb0, 1,
 17887                            0x65, },
 17888       7,
 17889       &neg_test_args,
 17890       sfnt_generic_check,
 17891     },
 17892     {
 17893       "FLOOR",
 17894       /* PUSHW[0] 255 129 ; -127
 17895          FLOOR[] ; floor (-127) == -128
 17896          PUSHW[0] 255 193 ; -63
 17897          FLOOR[] ; floor (-63) == -64
 17898          PUSHB[0] 63
 17899          FLOOR[] ; floor (63) == 0
 17900          PUSHB[0] 127
 17901          FLOOR[] ; floor (127) == 64
 17902          PUSHB[0] 191
 17903          FLOOR[] ; floor (191) == 128 */
 17904       (unsigned char []) { 0xb8, 255, 129,
 17905                            0x66,
 17906                            0xb8, 255, 193,
 17907                            0x66,
 17908                            0xb0, 63,
 17909                            0x66,
 17910                            0xb0, 127,
 17911                            0x66,
 17912                            0xb0, 191,
 17913                            0x66, },
 17914       17,
 17915       &floor_test_args,
 17916       sfnt_generic_check,
 17917     },
 17918     {
 17919       "CEILING",
 17920       /* PUSHW[0] 255 128 ; -128
 17921          CEILING[] ; ceiling (-128) == -128
 17922          PUSHW[0] 255 127 ; -129
 17923          CEILING[] ; ceiling (-129) == -128
 17924          PUSHW[0] 255 191 ; -65
 17925          CEILING[] ; ceiling (-65) == -64
 17926          PUSHW[0] 255 255 ; -1
 17927          CEILING[] ; ceiling (-1) == 0
 17928          PUSHB[0] 63
 17929          CEILING[] ; ceiling (63) == 64
 17930          PUSHB[0] 65
 17931          CEILING[] ; ceiling (65) == 128
 17932          PUSHB[0] 128
 17933          CEILING[] ; ceiling (128) == 128 */
 17934       (unsigned char []) { 0xb8, 255, 128,
 17935                            0x67,
 17936                            0xb8, 255, 127,
 17937                            0x67,
 17938                            0xb8, 255, 191,
 17939                            0x67,
 17940                            0xb8, 255, 255,
 17941                            0x67,
 17942                            0xb0, 63,
 17943                            0x67,
 17944                            0xb0, 65,
 17945                            0x67,
 17946                            0xb0, 128,
 17947                            0x67, },
 17948       25,
 17949       &ceiling_test_args,
 17950       sfnt_generic_check,
 17951     },
 17952     {
 17953       "ROUND",
 17954       /* ROUND[] */
 17955       (unsigned char []) { 0x68, },
 17956       1,
 17957       &round_test_args,
 17958       sfnt_generic_check,
 17959     },
 17960     {
 17961       "NROUND",
 17962       /* PUSHB[0] 63
 17963          NROUND[] */
 17964       (unsigned char []) { 0xb0, 63,
 17965                            0x6c, },
 17966       3,
 17967       &nround_test_args,
 17968       sfnt_generic_check,
 17969     },
 17970     {
 17971       "WCVTF",
 17972       /* PUSHB[1] 1 63
 17973          WCVTF[]
 17974          PUSHB[0] 1
 17975          RCVT[] */
 17976       (unsigned char []) { 0xb1, 1, 63,
 17977                            0x70,
 17978                            0xb0, 1,
 17979                            0x45, },
 17980       7,
 17981       &wcvtf_test_args,
 17982       sfnt_generic_check,
 17983     },
 17984     {
 17985       "JROT",
 17986       /* PUSHB[1] 4 0
 17987          JROT[] ; this should not skip past the next instruction
 17988          PUSHB[1] 40 40
 17989          PUSHB[1] 3 1
 17990          JROT[] ; this should skip past the next instruction
 17991          PUSHB[0] 4 */
 17992       (unsigned char []) { 0xb1, 4, 0,
 17993                            0x78,
 17994                            0xb1, 40, 40,
 17995                            0xb1, 3, 1,
 17996                            0x78,
 17997                            0xb0, 4, },
 17998       13,
 17999       &jrot_test_args,
 18000       sfnt_generic_check,
 18001     },
 18002     {
 18003       "JROF",
 18004       /* PUSHB[1] 4 0
 18005          JROF[] ; this should skip past the next instruction
 18006          PUSHB[1] 40 40
 18007          PUSHB[1] 3 1
 18008          JROF[] ; this should not skip past the next instruction
 18009          PUSHB[0] 4 */
 18010       (unsigned char []) { 0xb1, 4, 0,
 18011                            0x79,
 18012                            0xb1, 40, 40,
 18013                            0xb1, 3, 1,
 18014                            0x79,
 18015                            0xb0, 4, },
 18016       13,
 18017       &jrof_test_args,
 18018       sfnt_generic_check,
 18019     },
 18020     {
 18021       "DELTAC1",
 18022       /* PUSHB[0] 2
 18023          SDB[] ; delta base now 2
 18024          PUSHB[0] 6
 18025          SDS[] ; delta shift now 6
 18026          PUSHB[2] 0xff 5 1 ; CVT index 5, ppem 15 + 2, magnitude 15
 18027          DELTAC1[]
 18028          PUSHB[0] 1
 18029          RCVT[] ; CVT index 5 should now be greater by 8 / 64
 18030 
 18031          PUSHB[2] 0xef 5 1 ; CVT index 5, ppem 14 + 2, magnitude 15
 18032          DELTAC1[]
 18033          PUSHB[0] 1
 18034          RCVT[] ; CVT index 5 should be unchanged */
 18035       (unsigned char []) { 0xb0, 2,
 18036                            0x5e,
 18037                            0xb0, 6,
 18038                            0x5f,
 18039                            0xb2, 255, 5, 1,
 18040                            0x73,
 18041                            0xb0, 5,
 18042                            0x45,
 18043                            0xb2, 239, 5, 1,
 18044                            0x73,
 18045                            0xb0, 5,
 18046                            0x45, },
 18047       22,
 18048       &deltac1_test_args,
 18049       sfnt_generic_check,
 18050     },
 18051     {
 18052       "DELTAC2",
 18053       /* PUSHB[0] 2
 18054          SDB[] ; delta base now 2
 18055          PUSHB[0] 6
 18056          SDS[] ; delta shift now 6
 18057          PUSHB[2] 0xff 5 1 ; CVT index 5, ppem 15 + 2 + 16, magnitude 15
 18058          DELTAC2[]
 18059          PUSHB[0] 1
 18060          RCVT[] ; CVT index 5 should be unchanged
 18061 
 18062          PUSHB[2] 0xef 5 1 ; CVT index 5, ppem 14 + 2 + 16, magnitude 15
 18063          DELTAC2[]
 18064          PUSHB[0] 1
 18065          RCVT[] ; CVT index 5 should be unchanged */
 18066       (unsigned char []) { 0xb0, 2,
 18067                            0x5e,
 18068                            0xb0, 6,
 18069                            0x5f,
 18070                            0xb2, 255, 5, 1,
 18071                            0x74,
 18072                            0xb0, 5,
 18073                            0x45,
 18074                            0xb2, 239, 5, 1,
 18075                            0x74,
 18076                            0xb0, 5,
 18077                            0x45, },
 18078       22,
 18079       &deltac2_test_args,
 18080       sfnt_generic_check,
 18081     },
 18082     {
 18083       "DELTAC3",
 18084       /* PUSHB[0] 2
 18085          SDB[] ; delta base now 2
 18086          PUSHB[0] 6
 18087          SDS[] ; delta shift now 6
 18088          PUSHB[2] 0xff 5 1 ; CVT index 5, ppem 15 + 2 + 32, magnitude 15
 18089          DELTAC3[]
 18090          PUSHB[0] 1
 18091          RCVT[] ; CVT index 5 should be unchanged
 18092 
 18093          PUSHB[2] 0xef 5 1 ; CVT index 5, ppem 14 + 2 + 32, magnitude 15
 18094          DELTAC3[]
 18095          PUSHB[0] 1
 18096          RCVT[] ; CVT index 5 should be unchanged */
 18097       (unsigned char []) { 0xb0, 2,
 18098                            0x5e,
 18099                            0xb0, 6,
 18100                            0x5f,
 18101                            0xb2, 255, 5, 1,
 18102                            0x75,
 18103                            0xb0, 5,
 18104                            0x45,
 18105                            0xb2, 239, 5, 1,
 18106                            0x75,
 18107                            0xb0, 5,
 18108                            0x45, },
 18109       22,
 18110       &deltac3_test_args,
 18111       sfnt_generic_check,
 18112     },
 18113     {
 18114       "SROUND",
 18115       sfnt_sround_instructions,
 18116       ARRAYELTS (sfnt_sround_instructions),
 18117       &sround_test_args,
 18118       sfnt_generic_check,
 18119     },
 18120     {
 18121       "S45ROUND",
 18122       sfnt_s45round_instructions,
 18123       ARRAYELTS (sfnt_s45round_instructions),
 18124       &s45round_test_args,
 18125       sfnt_generic_check,
 18126     },
 18127     {
 18128       "RUTG",
 18129       /* RUTG[]
 18130          PUSHB[0] 1
 18131          ROUND[]
 18132          PUSHB[0] 64
 18133          ROUND[]
 18134          PUSHB[0] 0
 18135          ROUND[] */
 18136       (unsigned char []) { 0x7c,
 18137                            0xb0, 1,
 18138                            0x68,
 18139                            0xb0, 64,
 18140                            0x68,
 18141                            0xb0, 0,
 18142                            0x68, },
 18143       10,
 18144       &rutg_test_args,
 18145       sfnt_generic_check,
 18146     },
 18147     {
 18148       "RDTG",
 18149       /* RUTG[]
 18150          PUSHB[0] 1
 18151          ROUND[]
 18152          PUSHB[0] 63
 18153          ROUND[]
 18154          PUSHB[0] 64
 18155          ROUND[] */
 18156       (unsigned char []) { 0x7d,
 18157                            0xb0, 1,
 18158                            0x68,
 18159                            0xb0, 63,
 18160                            0x68,
 18161                            0xb0, 64,
 18162                            0x68, },
 18163       10,
 18164       &rdtg_test_args,
 18165       sfnt_generic_check,
 18166     },
 18167     {
 18168       "SANGW",
 18169       /* PUSHB[0] 3
 18170          SANGW[] */
 18171       (unsigned char []) { 0xb0, 3,
 18172                            0x7e, },
 18173       3,
 18174       &sangw_test_args,
 18175       sfnt_generic_check,
 18176     },
 18177     {
 18178       "AA",
 18179       /* PUSHB[0] 3
 18180          AA[] */
 18181       (unsigned char []) { 0xb0, 3,
 18182                            0x7f, },
 18183       3,
 18184       &aa_test_args,
 18185       sfnt_generic_check,
 18186     },
 18187     {
 18188       "SCANCTRL",
 18189       /* PUSHB[0] 1
 18190          SCANCTRL[] */
 18191       (unsigned char []) { 0xb0, 1,
 18192                            0x85, },
 18193       3,
 18194       NULL,
 18195       sfnt_check_scanctrl,
 18196     },
 18197     {
 18198       "GETINFO",
 18199       /* PUSHB[0] 1
 18200          GETINFO[]
 18201          PUSHB[0] 6
 18202          GETINFO[] */
 18203       (unsigned char []) { 0xb0, 1,
 18204                            0x88,
 18205                            0xb0, 6,
 18206                            0x88, },
 18207       6,
 18208       &getinfo_test_args,
 18209       sfnt_generic_check,
 18210     },
 18211     {
 18212       "IDEF",
 18213       /* PUSHB[0] 0x83
 18214          IDEF[]
 18215          PUSHB[3] 1 2 3 4
 18216          POP[]
 18217          ENDF[]
 18218          0x83 */
 18219       (unsigned char []) { 0xb0, 0x83,
 18220                            0x89,
 18221                            0xb3, 1, 2, 3, 4,
 18222                            0x21,
 18223                            0x2d,
 18224                            0x83, },
 18225       11,
 18226       &idef_test_args,
 18227       sfnt_generic_check,
 18228     },
 18229     {
 18230       "ROLL",
 18231       /* PUSHB[4] 1 2 3 4 5
 18232          ROLL[] ; this should become 1 2 4 5 3 */
 18233       (unsigned char []) { 0xb4, 1, 2, 3, 4, 5,
 18234                            0x8a, },
 18235       7,
 18236       &roll_test_args,
 18237       sfnt_generic_check,
 18238     },
 18239     {
 18240       "that ROLL correctly handles underflow",
 18241       /* PUSHB[1] 1 2
 18242          ROLL[] */
 18243       (unsigned char []) { 0xb1, 1, 2,
 18244                            0x8a, },
 18245       4,
 18246       &roll_1_test_args,
 18247       sfnt_generic_check,
 18248     },
 18249     {
 18250       "MAX",
 18251       /* PUSHW[1] 0 70 255 186 ; 70, -70
 18252          MAX[] */
 18253       (unsigned char []) { 0xb9, 0, 70, 255, 186,
 18254                            0x8b, },
 18255       6,
 18256       &max_test_args,
 18257       sfnt_generic_check,
 18258     },
 18259     {
 18260       "MIN",
 18261       /* PUSHW[1] 0 70 255 186 ; 70, -70
 18262          MIN[] */
 18263       (unsigned char []) { 0xb9, 0, 70, 255, 186,
 18264                            0x8c, },
 18265       6,
 18266       &min_test_args,
 18267       sfnt_generic_check,
 18268     },
 18269     {
 18270       "SCANTYPE",
 18271       /* PUSHB[0] 0
 18272          SCANTYPE[] */
 18273       (unsigned char []) { 0xb0, 0,
 18274                            0x8d, },
 18275       3,
 18276       &scantype_test_args,
 18277       sfnt_generic_check,
 18278     },
 18279     {
 18280       "INSTCTRL",
 18281       /* PUSHB[1] 1 1
 18282          INSTCTRL[] ; (1 << 1) should now be set
 18283          PUSHB[1] 2 1
 18284          INSTCTRL[] ; (1 << 2) should now be set
 18285          PUSHB[1] 2 0
 18286          INSTCTRL[] ; (1 << 2) should no longer be set */
 18287       (unsigned char []) { 0xb1, 1, 1,
 18288                            0x8e,
 18289                            0xb1, 2, 1,
 18290                            0x8e,
 18291                            0xb1, 2, 0,
 18292                            0x8e, },
 18293       12,
 18294       NULL,
 18295       sfnt_check_instctrl,
 18296     },
 18297   };
 18298 
 18299 
 18300 
 18301 /* Instruction debugger.  */
 18302 
 18303 static void
 18304 sfnt_setup_debugger (void)
 18305 {
 18306   XGCValues gcv;
 18307   Font font;
 18308 
 18309   display = XOpenDisplay (NULL);
 18310 
 18311   if (!display)
 18312     exit (1);
 18313 
 18314   window = XCreateSimpleWindow (display, DefaultRootWindow (display),
 18315                                 0, 0, 200, 200, 0, 0,
 18316                                 WhitePixel (display,
 18317                                             DefaultScreen (display)));
 18318   XMapWindow (display, window);
 18319 
 18320   /* Select for the appropriate events.  */
 18321   XSelectInput (display, window, KeyPressMask | ExposureMask);
 18322 
 18323   /* Find an appropriate font.  */
 18324   font = XLoadFont (display, "6x13");
 18325 
 18326   if (!font)
 18327     exit (1);
 18328 
 18329   /* The debugger has been set up.  Set up the GCs for drawing points
 18330      and backgrounds.  */
 18331 
 18332   gcv.foreground = BlackPixel (display, DefaultScreen (display));
 18333   gcv.font = font;
 18334   point_gc = XCreateGC (display, window, GCForeground | GCFont,
 18335                         &gcv);
 18336   gcv.foreground = WhitePixel (display, DefaultScreen (display));
 18337   background_gc = XCreateGC (display, window, GCForeground, &gcv);
 18338 }
 18339 
 18340 static const char *
 18341 sfnt_name_instruction (unsigned char opcode)
 18342 {
 18343   static const char *const opcode_names[256] = {
 18344     "7 SVTCA y",
 18345     "7 SVTCA x",
 18346     "8 SPvTCA y",
 18347     "8 SPvTCA x",
 18348     "8 SFvTCA y",
 18349     "8 SFvTCA x",
 18350     "8 SPvTL ||",
 18351     "7 SPvTL +",
 18352     "8 SFvTL ||",
 18353     "7 SFvTL +",
 18354     "5 SPvFS",
 18355     "5 SFvFS",
 18356     "3 GPv",
 18357     "3 GFv",
 18358     "6 SFvTPv",
 18359     "5 ISECT",
 18360 
 18361     "4 SRP0",
 18362     "4 SRP1",
 18363     "4 SRP2",
 18364     "4 SZP0",
 18365     "4 SZP1",
 18366     "4 SZP2",
 18367     "4 SZPS",
 18368     "5 SLOOP",
 18369     "3 RTG",
 18370     "4 RTHG",
 18371     "3 SMD",
 18372     "4 ELSE",
 18373     "4 JMPR",
 18374     "6 SCvTCi",
 18375     "5 SSwCi",
 18376     "3 SSW",
 18377 
 18378     "3 DUP",
 18379     "3 POP",
 18380     "5 CLEAR",
 18381     "4 SWAP",
 18382     "5 DEPTH",
 18383     "6 CINDEX",
 18384     "6 MINDEX",
 18385     "8 AlignPTS",
 18386     "7 INS_$28",
 18387     "3 UTP",
 18388     "8 LOOPCALL",
 18389     "4 CALL",
 18390     "4 FDEF",
 18391     "4 ENDF",
 18392     "7 MDAP[0]",
 18393     "7 MDAP[1]",
 18394 
 18395     "6 IUP[0]",
 18396     "6 IUP[1]",
 18397     "6 SHP[0]",
 18398     "6 SHP[1]",
 18399     "6 SHC[0]",
 18400     "6 SHC[1]",
 18401     "6 SHZ[0]",
 18402     "6 SHZ[1]",
 18403     "5 SHPIX",
 18404     "2 IP",
 18405     "8 MSIRP[0]",
 18406     "8 MSIRP[1]",
 18407     "7 AlignRP",
 18408     "4 RTDG",
 18409     "7 MIAP[0]",
 18410     "7 MIAP[1]",
 18411 
 18412     "6 NPushB",
 18413     "6 NPushW",
 18414     "2 WS",
 18415     "2 RS",
 18416     "5 WCvtP",
 18417     "4 RCvt",
 18418     "5 GC[0]",
 18419     "5 GC[1]",
 18420     "4 SCFS",
 18421     "5 MD[0]",
 18422     "5 MD[1]",
 18423     "5 MPPEM",
 18424     "3 MPS",
 18425     "6 FlipON",
 18426     "7 FlipOFF",
 18427     "5 DEBUG",
 18428 
 18429     "2 LT",
 18430     "4 LTEQ",
 18431     "2 GT",
 18432     "4 GTEQ",
 18433     "2 EQ",
 18434     "3 NEQ",
 18435     "3 ODD",
 18436     "4 EVEN",
 18437     "2 IF",
 18438     "3 EIF",
 18439     "3 AND",
 18440     "2 OR",
 18441     "3 NOT",
 18442     "7 DeltaP1",
 18443     "3 SDB",
 18444     "3 SDS",
 18445 
 18446     "3 ADD",
 18447     "3 SUB",
 18448     "3 DIV",
 18449     "3 MUL",
 18450     "3 ABS",
 18451     "3 NEG",
 18452     "5 FLOOR",
 18453     "7 CEILING",
 18454     "8 ROUND[0]",
 18455     "8 ROUND[1]",
 18456     "8 ROUND[2]",
 18457     "8 ROUND[3]",
 18458     "9 NROUND[0]",
 18459     "9 NROUND[1]",
 18460     "9 NROUND[2]",
 18461     "9 NROUND[3]",
 18462 
 18463     "5 WCvtF",
 18464     "7 DeltaP2",
 18465     "7 DeltaP3",
 18466     "A DeltaCn[0]",
 18467     "A DeltaCn[1]",
 18468     "A DeltaCn[2]",
 18469     "6 SROUND",
 18470     "8 S45Round",
 18471     "4 JROT",
 18472     "4 JROF",
 18473     "4 ROFF",
 18474     "7 INS_$7B",
 18475     "4 RUTG",
 18476     "4 RDTG",
 18477     "5 SANGW",
 18478     "2 AA",
 18479 
 18480     "6 FlipPT",
 18481     "8 FlipRgON",
 18482     "9 FlipRgOFF",
 18483     "7 INS_$83",
 18484     "7 INS_$84",
 18485     "8 ScanCTRL",
 18486     "9 SDPvTL[0]",
 18487     "9 SDPvTL[1]",
 18488     "7 GetINFO",
 18489     "4 IDEF",
 18490     "4 ROLL",
 18491     "3 MAX",
 18492     "3 MIN",
 18493     "8 ScanTYPE",
 18494     "8 InstCTRL",
 18495     "7 INS_$8F",
 18496 
 18497     "7 INS_$90",
 18498     "7 GXAXIS",
 18499     "7 INS_$92",
 18500     "7 INS_$93",
 18501     "7 INS_$94",
 18502     "7 INS_$95",
 18503     "7 INS_$96",
 18504     "7 INS_$97",
 18505     "7 INS_$98",
 18506     "7 INS_$99",
 18507     "7 INS_$9A",
 18508     "7 INS_$9B",
 18509     "7 INS_$9C",
 18510     "7 INS_$9D",
 18511     "7 INS_$9E",
 18512     "7 INS_$9F",
 18513 
 18514     "7 INS_$A0",
 18515     "7 INS_$A1",
 18516     "7 INS_$A2",
 18517     "7 INS_$A3",
 18518     "7 INS_$A4",
 18519     "7 INS_$A5",
 18520     "7 INS_$A6",
 18521     "7 INS_$A7",
 18522     "7 INS_$A8",
 18523     "7 INS_$A9",
 18524     "7 INS_$AA",
 18525     "7 INS_$AB",
 18526     "7 INS_$AC",
 18527     "7 INS_$AD",
 18528     "7 INS_$AE",
 18529     "7 INS_$AF",
 18530 
 18531     "8 PushB[0]",
 18532     "8 PushB[1]",
 18533     "8 PushB[2]",
 18534     "8 PushB[3]",
 18535     "8 PushB[4]",
 18536     "8 PushB[5]",
 18537     "8 PushB[6]",
 18538     "8 PushB[7]",
 18539     "8 PushW[0]",
 18540     "8 PushW[1]",
 18541     "8 PushW[2]",
 18542     "8 PushW[3]",
 18543     "8 PushW[4]",
 18544     "8 PushW[5]",
 18545     "8 PushW[6]",
 18546     "8 PushW[7]",
 18547 
 18548     "7 MDRP[G]",
 18549     "7 MDRP[B]",
 18550     "7 MDRP[W]",
 18551     "7 MDRP[?]",
 18552     "8 MDRP[rG]",
 18553     "8 MDRP[rB]",
 18554     "8 MDRP[rW]",
 18555     "8 MDRP[r?]",
 18556     "8 MDRP[mG]",
 18557     "8 MDRP[mB]",
 18558     "8 MDRP[mW]",
 18559     "8 MDRP[m?]",
 18560     "9 MDRP[mrG]",
 18561     "9 MDRP[mrB]",
 18562     "9 MDRP[mrW]",
 18563     "9 MDRP[mr?]",
 18564 
 18565     "8 MDRP[pG]",
 18566     "8 MDRP[pB]",
 18567     "8 MDRP[pW]",
 18568     "8 MDRP[p?]",
 18569     "9 MDRP[prG]",
 18570     "9 MDRP[prB]",
 18571     "9 MDRP[prW]",
 18572     "9 MDRP[pr?]",
 18573     "9 MDRP[pmG]",
 18574     "9 MDRP[pmB]",
 18575     "9 MDRP[pmW]",
 18576     "9 MDRP[pm?]",
 18577     "A MDRP[pmrG]",
 18578     "A MDRP[pmrB]",
 18579     "A MDRP[pmrW]",
 18580     "A MDRP[pmr?]",
 18581 
 18582     "7 MIRP[G]",
 18583     "7 MIRP[B]",
 18584     "7 MIRP[W]",
 18585     "7 MIRP[?]",
 18586     "8 MIRP[rG]",
 18587     "8 MIRP[rB]",
 18588     "8 MIRP[rW]",
 18589     "8 MIRP[r?]",
 18590     "8 MIRP[mG]",
 18591     "8 MIRP[mB]",
 18592     "8 MIRP[mW]",
 18593     "8 MIRP[m?]",
 18594     "9 MIRP[mrG]",
 18595     "9 MIRP[mrB]",
 18596     "9 MIRP[mrW]",
 18597     "9 MIRP[mr?]",
 18598 
 18599     "8 MIRP[pG]",
 18600     "8 MIRP[pB]",
 18601     "8 MIRP[pW]",
 18602     "8 MIRP[p?]",
 18603     "9 MIRP[prG]",
 18604     "9 MIRP[prB]",
 18605     "9 MIRP[prW]",
 18606     "9 MIRP[pr?]",
 18607     "9 MIRP[pmG]",
 18608     "9 MIRP[pmB]",
 18609     "9 MIRP[pmW]",
 18610     "9 MIRP[pm?]",
 18611     "A MIRP[pmrG]",
 18612     "A MIRP[pmrB]",
 18613     "A MIRP[pmrW]",
 18614     "A MIRP[pmr?]"
 18615   };
 18616 
 18617   return opcode_names[opcode];
 18618 }
 18619 
 18620 static void
 18621 sfnt_draw_debugger (struct sfnt_interpreter *interpreter)
 18622 {
 18623   int x, y, i;
 18624   char buffer[80];
 18625   const char *name;
 18626   int opcode;
 18627 
 18628   sprintf (buffer, "opcode:IP:depth: 0x%x:%d:%d",
 18629            interpreter->instructions[interpreter->IP],
 18630            interpreter->IP,
 18631            interpreter->call_depth);
 18632 
 18633   /* Clear the window.  */
 18634   XFillRectangle (display, window, background_gc,
 18635                   0, 0, 65535, 65535);
 18636 
 18637   /* Draw some information about the opcode.  */
 18638   XDrawString (display, window, point_gc, 0, 13, buffer,
 18639                strlen (buffer));
 18640 
 18641   opcode = interpreter->instructions[interpreter->IP];
 18642 
 18643   sprintf (buffer, "opcode: %s",
 18644            sfnt_name_instruction (opcode));
 18645 
 18646   XDrawString (display, window, point_gc, 14, 27, buffer,
 18647                strlen (buffer));
 18648 
 18649   if (interpreter->state.project
 18650       == sfnt_project_onto_x_axis_vector)
 18651     name = "X axis";
 18652   else if (interpreter->state.project
 18653            == sfnt_project_onto_y_axis_vector)
 18654     name = "Y axis";
 18655   else
 18656     name = "Any";
 18657 
 18658   sprintf (buffer, "projection function: %s", name);
 18659 
 18660   XDrawString (display, window, point_gc, 28, 42, buffer,
 18661                strlen (buffer));
 18662 
 18663   /* Draw each point onto the window.  */
 18664   for (i = 0; i < interpreter->glyph_zone->num_points; ++i)
 18665     {
 18666       x = interpreter->glyph_zone->x_current[i] / 16;
 18667       y = (200 - interpreter->glyph_zone->y_current[i] / 16);
 18668 
 18669       XFillRectangle (display, window, point_gc, x, y, 4, 4);
 18670     }
 18671 }
 18672 
 18673 static void
 18674 sfnt_run_hook (struct sfnt_interpreter *interpreter)
 18675 {
 18676   pid_t pid;
 18677   XEvent event;
 18678 
 18679 #ifdef TEST_BREAK_AFTER
 18680   static unsigned int instructions;
 18681 
 18682   if (++instructions < TEST_BREAK_AFTER)
 18683     return;
 18684 #endif
 18685 
 18686   pid = fork ();
 18687 
 18688   if (pid == 0)
 18689     {
 18690       sfnt_setup_debugger ();
 18691 
 18692       while (true)
 18693         {
 18694           XNextEvent (display, &event);
 18695 
 18696           switch (event.type)
 18697             {
 18698             case KeyPress:
 18699               XDestroyWindow (display, window);
 18700               XCloseDisplay (display);
 18701               exit (0);
 18702               break;
 18703 
 18704             case Expose:
 18705               sfnt_draw_debugger (interpreter);
 18706               break;
 18707             }
 18708         }
 18709     }
 18710   else
 18711     {
 18712       while (waitpid (pid, NULL, 0) != pid && errno == EINTR)
 18713         /* Spin.  */;
 18714     }
 18715 }
 18716 
 18717 static struct sfnt_prep_table *exec_prep;
 18718 static struct sfnt_fpgm_table *exec_fpgm;
 18719 
 18720 static const char *
 18721 sfnt_identify_instruction (struct sfnt_interpreter *interpreter)
 18722 {
 18723   static char buffer[256];
 18724   unsigned char *where;
 18725 
 18726   where = interpreter->instructions + interpreter->IP;
 18727 
 18728   if (exec_prep
 18729       && where >= exec_prep->instructions
 18730       && where < (exec_prep->instructions
 18731                   + exec_prep->num_instructions))
 18732     {
 18733       sprintf (buffer, "prep+%td",
 18734                where - exec_prep->instructions);
 18735       return buffer;
 18736     }
 18737 
 18738   if (exec_fpgm->instructions
 18739       && where >= exec_fpgm->instructions
 18740       && where < (exec_fpgm->instructions
 18741                   + exec_fpgm->num_instructions))
 18742     {
 18743       sprintf (buffer, "fpgm+%td",
 18744                where - exec_fpgm->instructions);
 18745       return buffer;
 18746     }
 18747 
 18748   sprintf (buffer, "IP+%td", where - interpreter->instructions);
 18749   return buffer;
 18750 }
 18751 
 18752 static void
 18753 sfnt_verbose (struct sfnt_interpreter *interpreter)
 18754 {
 18755   struct sfnt_instructed_outline temp;
 18756   struct sfnt_glyph_outline *outline;
 18757   struct sfnt_raster *raster;
 18758   unsigned char opcode;
 18759   const char *name;
 18760   static unsigned int instructions;
 18761 
 18762   /* Build a temporary outline containing the values of the
 18763      interpreter's glyph zone.  */
 18764 
 18765   if (interpreter->glyph_zone)
 18766     {
 18767       temp.num_points = interpreter->glyph_zone->num_points;
 18768       temp.num_contours = interpreter->glyph_zone->num_contours;
 18769       temp.contour_end_points = interpreter->glyph_zone->contour_end_points;
 18770       temp.x_points = interpreter->glyph_zone->x_current;
 18771       temp.y_points = interpreter->glyph_zone->y_current;
 18772       temp.flags = interpreter->glyph_zone->flags;
 18773 
 18774       outline = sfnt_build_instructed_outline (&temp);
 18775 
 18776       if (!outline)
 18777         return;
 18778 
 18779       printf ("outline bounds: %g %g, %g %g\n",
 18780               sfnt_coerce_fixed (outline->xmin),
 18781               sfnt_coerce_fixed (outline->ymin),
 18782               sfnt_coerce_fixed (outline->xmax),
 18783               sfnt_coerce_fixed (outline->ymax));
 18784 
 18785       raster = sfnt_raster_glyph_outline (outline);
 18786 
 18787       if (raster)
 18788         sfnt_test_raster (raster, NULL, 0);
 18789 
 18790       xfree (outline);
 18791       xfree (raster);
 18792     }
 18793 
 18794   opcode = interpreter->instructions[interpreter->IP];
 18795   printf ("opcode, number of instructions: %s %u\n",
 18796           sfnt_name_instruction (opcode), instructions++);
 18797   printf ("instruction: %s\n",
 18798           sfnt_identify_instruction (interpreter));
 18799 
 18800   if (interpreter->state.project
 18801       == sfnt_project_onto_x_axis_vector)
 18802     name = "X axis";
 18803   else if (interpreter->state.project
 18804            == sfnt_project_onto_y_axis_vector)
 18805     name = "Y axis";
 18806   else
 18807     name = "Any";
 18808 
 18809   printf ("projection function: %s\n", name);
 18810 
 18811   printf ("proj and free vecs: %d %d %d %d\n",
 18812           interpreter->state.projection_vector.x,
 18813           interpreter->state.projection_vector.y,
 18814           interpreter->state.freedom_vector.x,
 18815           interpreter->state.freedom_vector.y);
 18816 }
 18817 
 18818 static void
 18819 sfnt_push_hook (struct sfnt_interpreter *interpreter,
 18820                 uint32_t value)
 18821 {
 18822   int32_t alternate;
 18823 
 18824   alternate = value;
 18825 
 18826   fprintf (stderr, "--> %"PRIi32"\n", alternate);
 18827 }
 18828 
 18829 static void
 18830 sfnt_pop_hook (struct sfnt_interpreter *interpreter,
 18831                uint32_t value)
 18832 {
 18833   int32_t alternate;
 18834 
 18835   alternate = value;
 18836 
 18837   fprintf (stderr, "<<- %"PRIi32"\n", alternate);
 18838 }
 18839 
 18840 
 18841 
 18842 static void
 18843 sfnt_test_uvs (int fd, struct sfnt_cmap_format_14 *format14)
 18844 {
 18845   struct sfnt_uvs_context *context;
 18846   size_t i, j;
 18847   sfnt_glyph glyph;
 18848   sfnt_char c;
 18849   struct sfnt_nondefault_uvs_table *uvs;
 18850 
 18851   context = sfnt_create_uvs_context (format14, fd);
 18852 
 18853   /* Print each variation selector and its associated ranges.  */
 18854 
 18855   if (!context)
 18856     fprintf (stderr, "failed to read uvs data\n");
 18857   else
 18858     {
 18859       fprintf (stderr, "UVS context with %zu records and %zu tables\n",
 18860                context->num_records, context->nmemb);
 18861 
 18862       for (i = 0; i < context->num_records; ++i)
 18863         {
 18864           if (!context->records[i].nondefault_uvs)
 18865             continue;
 18866 
 18867           uvs = context->records[i].nondefault_uvs;
 18868 
 18869           for (j = 0; j < uvs->num_uvs_mappings; ++j)
 18870             {
 18871               c = uvs->mappings[j].unicode_value;
 18872               glyph = sfnt_variation_glyph_for_char (uvs, c);
 18873 
 18874               if (glyph != uvs->mappings[j].base_character_value)
 18875                 abort ();
 18876 
 18877               fprintf (stderr, "   UVS: %"PRIx32" (%"PRIx32") -> %"PRIu32"\n",
 18878                        c, context->records[i].selector, glyph);
 18879             }
 18880         }
 18881 
 18882       sfnt_free_uvs_context (context);
 18883     }
 18884 }
 18885 
 18886 
 18887 
 18888 /* Main entry point.  */
 18889 
 18890 /* Simple tests that were used while developing this file.  By the
 18891    time you are reading this, they probably no longer work.
 18892 
 18893    Compile like so in this directory:
 18894 
 18895     gcc -Demacs -I. -I. -I../lib -I../lib -MMD -MF deps/.d -MP
 18896     -fno-common -Wall -Warith-conversion -Wdate-time
 18897     -Wdisabled-optimization -Wdouble-promotion -Wduplicated-cond
 18898     -Wextra -Wformat-signedness -Winit-self -Winvalid-pch -Wlogical-op
 18899     -Wmissing-declarations -Wmissing-include-dirs -Wmissing-prototypes
 18900     -Wnested-externs -Wnull-dereference -Wold-style-definition
 18901     -Wopenmp-simd -Wpacked -Wpointer-arith -Wstrict-prototypes
 18902     -Wsuggest-attribute=format -Wsuggest-final-methods
 18903     -Wsuggest-final-types -Wtrampolines -Wuninitialized
 18904     -Wunknown-pragmas -Wunused-macros -Wvariadic-macros
 18905     -Wvector-operation-performance -Wwrite-strings -Warray-bounds=2
 18906     -Wattribute-alias=2 -Wformat=2 -Wformat-truncation=2
 18907     -Wimplicit-fallthrough=5 -Wshift-overflow=2 -Wuse-after-free=3
 18908     -Wvla-larger-than=4031 -Wredundant-decls
 18909     -Wno-missing-field-initializers -Wno-override-init
 18910     -Wno-sign-compare -Wno-type-limits -Wno-unused-parameter
 18911     -Wno-format-nonliteral -Wno-bidi-chars -g3 -O0 -DTEST sfnt.c -o
 18912     sfnt ../lib/libgnu.a -lX11 -lXrender
 18913 
 18914    after gnulib has been built.  Then, run ./sfnt
 18915    /path/to/font.ttf.  */
 18916 
 18917 int
 18918 main (int argc, char **argv)
 18919 {
 18920   struct sfnt_offset_subtable *font;
 18921   struct sfnt_cmap_encoding_subtable *subtables;
 18922   struct sfnt_cmap_encoding_subtable_data **data;
 18923   struct sfnt_cmap_table *table;
 18924   int fd, i, j;
 18925   sfnt_char character;
 18926   struct sfnt_head_table *head;
 18927   struct sfnt_hhea_table *hhea;
 18928   struct sfnt_loca_table_short *loca_short;
 18929   struct sfnt_loca_table_long *loca_long;
 18930   struct sfnt_glyf_table *glyf;
 18931   struct sfnt_glyph *glyph;
 18932   sfnt_glyph code;
 18933   struct sfnt_test_dcontext dcontext;
 18934   struct sfnt_glyph_outline *outline;
 18935   struct timespec start, end, sub, sub1, sub2, sub3;
 18936   static struct sfnt_maxp_table *maxp;
 18937   struct sfnt_raster *raster;
 18938   struct sfnt_hmtx_table *hmtx;
 18939   struct sfnt_glyph_metrics metrics;
 18940   struct sfnt_name_table *name;
 18941   unsigned char *string;
 18942   struct sfnt_name_record record;
 18943   struct sfnt_meta_table *meta;
 18944   struct sfnt_ttc_header *ttc;
 18945   struct sfnt_interpreter *interpreter;
 18946   struct sfnt_cvt_table *cvt;
 18947   struct sfnt_fpgm_table *fpgm;
 18948   const char *trap;
 18949   struct sfnt_prep_table *prep;
 18950   struct sfnt_graphics_state state;
 18951   struct sfnt_instructed_outline *value;
 18952   struct sfnt_fvar_table *fvar;
 18953   struct sfnt_gvar_table *gvar;
 18954   struct sfnt_avar_table *avar;
 18955   struct sfnt_cvar_table *cvar;
 18956   sfnt_fixed scale;
 18957   char *fancy;
 18958   int *advances;
 18959   struct sfnt_raster **rasters;
 18960   size_t length;
 18961   char *axis_name;
 18962   struct sfnt_instance *instance;
 18963   struct sfnt_blend blend;
 18964   struct sfnt_metrics_distortion distortion;
 18965 
 18966   if (argc < 2)
 18967     return 1;
 18968 
 18969   instance = NULL;
 18970 
 18971   if (!strcmp (argv[1], "--check-interpreter"))
 18972     {
 18973       interpreter = sfnt_make_test_interpreter ();
 18974 
 18975       if (!interpreter)
 18976         abort ();
 18977 
 18978       for (i = 0; i < ARRAYELTS (all_tests); ++i)
 18979         sfnt_run_interpreter_test (&all_tests[i], interpreter);
 18980 
 18981       exit (0);
 18982     }
 18983 
 18984   fd = open (argv[1], O_RDONLY);
 18985 
 18986   if (fd < 1)
 18987     return 1;
 18988 
 18989   ttc = NULL;
 18990 
 18991   font = sfnt_read_table_directory (fd);
 18992 
 18993   if (font == (struct sfnt_offset_subtable *) -1)
 18994     {
 18995       if (lseek (fd, 0, SEEK_SET) != 0)
 18996         return 1;
 18997 
 18998       ttc = sfnt_read_ttc_header (fd);
 18999 
 19000       if (!ttc)
 19001         return 1;
 19002 
 19003       fprintf (stderr, "TrueType collection: %"PRIu32" fonts installed\n",
 19004                ttc->num_fonts);
 19005       fflush (stderr);
 19006 
 19007       printf ("Which font? ");
 19008       if (scanf ("%d", &i) == EOF)
 19009         return 1;
 19010 
 19011       if (i >= ttc->num_fonts || i < 0)
 19012         {
 19013           printf ("out of range\n");
 19014           return 1;
 19015         }
 19016 
 19017       if (lseek (fd, ttc->offset_table[i], SEEK_SET)
 19018           != ttc->offset_table[i])
 19019         return 1;
 19020 
 19021       font = sfnt_read_table_directory (fd);
 19022     }
 19023 
 19024   if (!font || font == (struct sfnt_offset_subtable *) -1)
 19025     {
 19026       close (fd);
 19027       return 1;
 19028     }
 19029 
 19030   for (i = 0; i < font->num_tables; ++i)
 19031     fprintf (stderr, "Found new subtable with tag %"PRIx32
 19032              " at offset %"PRIu32"\n",
 19033              font->subtables[i].tag,
 19034              font->subtables[i].offset);
 19035 
 19036   table = sfnt_read_cmap_table (fd, font, &subtables, &data);
 19037 
 19038   if (!table)
 19039     {
 19040       close (fd);
 19041       xfree (font);
 19042       return 1;
 19043     }
 19044 
 19045   fprintf (stderr, "number of subtables: %"PRIu16"\n",
 19046            table->num_subtables);
 19047 
 19048   for (i = 0; i < table->num_subtables; ++i)
 19049     {
 19050       fprintf (stderr, "Found cmap table %"PRIu32": %p\n",
 19051                subtables[i].offset, (void *) data[i]);
 19052 
 19053       if (data[i])
 19054         fprintf (stderr, "  format: %"PRIu16"\n",
 19055                  data[i]->format);
 19056     }
 19057 
 19058   if (argc >= 3 && !strcmp (argv[2], "--check-variation-selectors"))
 19059     {
 19060       /* Look for a format 14 cmap table.  */
 19061 
 19062       for (i = 0; i < table->num_subtables; ++i)
 19063         {
 19064           if (data[i]->format == 14)
 19065             {
 19066               fprintf (stderr, "format 14 subtable found\n");
 19067               sfnt_test_uvs (fd, (struct sfnt_cmap_format_14 *) data[i]);
 19068               return 0;
 19069             }
 19070         }
 19071 
 19072       return 1;
 19073     }
 19074 
 19075 #define FANCY_PPEM 12
 19076 #define EASY_PPEM  12
 19077 
 19078   interpreter = NULL;
 19079   head = sfnt_read_head_table (fd, font);
 19080   hhea = sfnt_read_hhea_table (fd, font);
 19081   glyf = sfnt_read_glyf_table (fd, font);
 19082   maxp = sfnt_read_maxp_table (fd, font);
 19083   name = sfnt_read_name_table (fd, font);
 19084   meta = sfnt_read_meta_table (fd, font);
 19085   cvt  = sfnt_read_cvt_table (fd, font);
 19086   fpgm = sfnt_read_fpgm_table (fd, font);
 19087   prep = sfnt_read_prep_table (fd, font);
 19088   fvar = sfnt_read_fvar_table (fd, font);
 19089   gvar = sfnt_read_gvar_table (fd, font);
 19090   avar = sfnt_read_avar_table (fd, font);
 19091   cvar = NULL;
 19092   hmtx = NULL;
 19093 
 19094   if (fvar && cvt)
 19095     cvar = sfnt_read_cvar_table (fd, font, fvar, cvt);
 19096 
 19097   if (cvar)
 19098     fprintf (stderr, "cvar table found\n");
 19099 
 19100   exec_prep = prep;
 19101   exec_fpgm = fpgm;
 19102   fancy = getenv ("SFNT_FANCY_TEST");
 19103 
 19104   loca_long = NULL;
 19105   loca_short = NULL;
 19106 
 19107   if (fvar)
 19108     {
 19109       fprintf (stderr, "FVAR table found!\n"
 19110                "version: %"PRIu16".%"PRIu16"\n"
 19111                "axis_count: %"PRIu16"\n"
 19112                "axis_size: %"PRIu16"\n"
 19113                "instance_count: %"PRIu16"\n"
 19114                "instance_size: %"PRIu16"\n",
 19115                fvar->major_version,
 19116                fvar->minor_version,
 19117                fvar->axis_count,
 19118                fvar->axis_size,
 19119                fvar->instance_count,
 19120                fvar->instance_size);
 19121 
 19122       for (i = 0; i < fvar->axis_count; ++i)
 19123         {
 19124           if (name)
 19125             {
 19126               axis_name
 19127                 = (char *) sfnt_find_name (name, fvar->axis[i].name_id,
 19128                                            &record);
 19129 
 19130               if (axis_name)
 19131                 fprintf (stderr, "axis no: %d; name: %.*s\n",
 19132                          i, record.length, axis_name);
 19133             }
 19134 
 19135           fprintf (stderr, "  axis: %"PRIx32" %g %g %g\n",
 19136                    fvar->axis[i].axis_tag,
 19137                    sfnt_coerce_fixed (fvar->axis[i].min_value),
 19138                    sfnt_coerce_fixed (fvar->axis[i].default_value),
 19139                    sfnt_coerce_fixed (fvar->axis[i].max_value));
 19140         }
 19141 
 19142       for (i = 0; i < fvar->instance_count; ++i)
 19143         {
 19144           if (name)
 19145             {
 19146               axis_name
 19147                 = (char *) sfnt_find_name (name, fvar->instance[i].name_id,
 19148                                            &record);
 19149 
 19150               if (axis_name)
 19151                 fprintf (stderr, "instance no: %d; name: %.*s\n",
 19152                          i, record.length, axis_name);
 19153             }
 19154         }
 19155 
 19156       if (fvar->instance_count > 1)
 19157         {
 19158           printf ("instance? ");
 19159 
 19160           if (scanf ("%d", &i) == EOF)
 19161             goto free_lab;
 19162 
 19163           if (i >= fvar->instance_count)
 19164             goto free_lab;
 19165 
 19166           if (i >= 0)
 19167             instance = &fvar->instance[i];
 19168         }
 19169     }
 19170 
 19171   if (gvar)
 19172     fprintf (stderr, "gvar table found\n");
 19173 
 19174   if (avar)
 19175     {
 19176       fprintf (stderr, "avar table found\n");
 19177 
 19178       for (i = 0; i < avar->axis_count; ++i)
 19179         {
 19180           fprintf (stderr, "axis: %d, %"PRIu16" pairs\n",
 19181                    i, avar->segments[i].pair_count);
 19182 
 19183           for (j = 0; j < avar->segments[i].pair_count; ++j)
 19184             fprintf (stderr, "pair: %g, %g\n",
 19185                      (avar->segments[i].correspondence[j].from_coord
 19186                       / 16384.0),
 19187                      (avar->segments[i].correspondence[j].to_coord
 19188                       / 16384.0));
 19189         }
 19190     }
 19191 
 19192   memset (&blend, 0, sizeof blend);
 19193 
 19194   if (instance && gvar)
 19195     {
 19196       sfnt_init_blend (&blend, fvar, gvar, avar,
 19197                        cvar);
 19198 
 19199       for (i = 0; i < fvar->axis_count; ++i)
 19200         blend.coords[i] = instance->coords[i];
 19201 
 19202       sfnt_normalize_blend (&blend);
 19203     }
 19204 
 19205   if (fancy)
 19206     {
 19207       length = strlen (fancy);
 19208       scale = sfnt_div_fixed (FANCY_PPEM, head->units_per_em);
 19209 
 19210       if (hhea && maxp)
 19211         hmtx = sfnt_read_hmtx_table (fd, font, hhea, maxp);
 19212 
 19213       if (!maxp || !head || !prep || !hmtx || !hhea
 19214           || table->num_subtables < 1)
 19215         exit (1);
 19216 
 19217       if (head->index_to_loc_format)
 19218         {
 19219           loca_long = sfnt_read_loca_table_long (fd, font);
 19220           if (!loca_long)
 19221             return 1;
 19222 
 19223           fprintf (stderr, "long loca table has %zu glyphs\n",
 19224                    loca_long->num_offsets);
 19225         }
 19226       else
 19227         {
 19228           loca_short = sfnt_read_loca_table_short (fd, font);
 19229           if (!loca_short)
 19230             return 1;
 19231 
 19232           fprintf (stderr, "short loca table has %zu glyphs\n",
 19233                    loca_short->num_offsets);
 19234         }
 19235 
 19236       interpreter = sfnt_make_interpreter (maxp, cvt, head, fvar,
 19237                                            FANCY_PPEM, FANCY_PPEM);
 19238       if (instance && gvar)
 19239         sfnt_vary_interpreter (interpreter, &blend);
 19240 
 19241       if (!interpreter)
 19242         exit (1);
 19243 
 19244       if (fpgm)
 19245         {
 19246           fprintf (stderr, "interpreting the font program, with"
 19247                    " %zu instructions\n", fpgm->num_instructions);
 19248           trap = sfnt_interpret_font_program (interpreter, fpgm);
 19249 
 19250           if (trap)
 19251             fprintf (stderr, "**TRAP**: %s\n", trap);
 19252         }
 19253 
 19254       if (prep)
 19255         {
 19256           fprintf (stderr, "interpreting the control value program, with"
 19257                    " %zu instructions\n", prep->num_instructions);
 19258           trap = sfnt_interpret_control_value_program (interpreter, prep,
 19259                                                        &state);
 19260 
 19261           if (trap)
 19262             fprintf (stderr, "**TRAP**: %s\n", trap);
 19263         }
 19264 
 19265       state = interpreter->state;
 19266 
 19267       advances = alloca (sizeof *advances * length);
 19268       rasters = alloca (sizeof *rasters * length);
 19269 
 19270       for (i = 0; i < length; ++i)
 19271         {
 19272           code = sfnt_lookup_glyph (fancy[i], data[0]);
 19273 
 19274           if (!code)
 19275             exit (2);
 19276 
 19277           glyph = sfnt_read_glyph (code, glyf, loca_short,
 19278                                    loca_long);
 19279 
 19280           if (!glyph || !glyph->simple)
 19281             exit (3);
 19282 
 19283           if (instance && gvar)
 19284             sfnt_vary_simple_glyph (&blend, code, glyph,
 19285                                     &distortion);
 19286 
 19287           if (sfnt_lookup_glyph_metrics (code, -1,
 19288                                          &metrics,
 19289                                          hmtx, hhea,
 19290                                          head, maxp))
 19291             exit (4);
 19292 
 19293           interpreter->state = state;
 19294           trap = sfnt_interpret_simple_glyph (glyph, interpreter,
 19295                                               &metrics, &value);
 19296 
 19297           if (trap)
 19298             {
 19299               fprintf (stderr, "*TRAP*: %s\n", trap);
 19300               exit (5);
 19301             }
 19302 
 19303           outline = sfnt_build_instructed_outline (value);
 19304 
 19305           if (!outline)
 19306             exit (6);
 19307 
 19308           xfree (value);
 19309 
 19310           raster = sfnt_raster_glyph_outline (outline);
 19311 
 19312           if (!raster)
 19313             exit (7);
 19314 
 19315           xfree (outline);
 19316 
 19317           rasters[i] = raster;
 19318           advances[i] = (sfnt_mul_fixed (metrics.advance, scale)
 19319                          + sfnt_mul_fixed (distortion.advance, scale));
 19320         }
 19321 
 19322       sfnt_x_raster (rasters, advances, length, hhea, scale);
 19323       exit (0);
 19324     }
 19325 
 19326   if (hhea && maxp)
 19327     hmtx = sfnt_read_hmtx_table (fd, font, hhea, maxp);
 19328 
 19329   if (maxp)
 19330     fprintf (stderr, "maxp says num glyphs is %"PRIu16"\n",
 19331              maxp->num_glyphs);
 19332 
 19333   if (name)
 19334     {
 19335       fprintf (stderr, "name table of format: %"PRIu16" count: %"
 19336                PRIu16"\n", name->format, name->count);
 19337 
 19338       string = sfnt_find_name (name, SFNT_NAME_FONT_FAMILY,
 19339                                &record);
 19340 
 19341       if (string)
 19342         fprintf (stderr, "FONT_FAMILY: %"PRIu16", %"PRIu16"\n",
 19343                  record.platform_id, record.length);
 19344     }
 19345 
 19346   if (meta)
 19347     {
 19348       fprintf (stderr, "meta table with count: %"PRIu32"\n",
 19349                meta->num_data_maps);
 19350 
 19351       for (i = 0; i < meta->num_data_maps; ++i)
 19352         fprintf (stderr, "  meta tag: %"PRIx32"\n",
 19353                  meta->data_maps[i].tag);
 19354     }
 19355 
 19356   loca_long = NULL;
 19357   loca_short = NULL;
 19358 
 19359   if (head)
 19360     {
 19361       fprintf (stderr, "HEAD table:\n"
 19362                "version: \t\t\t%g\n"
 19363                "revision: \t\t\t%g\n"
 19364                "checksum_adjustment: \t\t%"PRIu32"\n"
 19365                "magic: \t\t\t\t%"PRIx32"\n"
 19366                "flags: \t\t\t\t%"PRIx16"\n"
 19367                "units_per_em: \t\t\t%"PRIu16"\n"
 19368                "xmin, ymin, xmax, ymax: \t%d, %d, %d, %d\n"
 19369                "mac_style: \t\t\t%"PRIx16"\n"
 19370                "lowest_rec_ppem: \t\t%"PRIu16"\n"
 19371                "font_direction_hint: \t\t%"PRIi16"\n"
 19372                "index_to_loc_format: \t\t%"PRIi16"\n"
 19373                "glyph_data_format: \t\t%"PRIi16"\n",
 19374                sfnt_coerce_fixed (head->version),
 19375                sfnt_coerce_fixed (head->revision),
 19376                head->checksum_adjustment,
 19377                head->magic,
 19378                head->flags,
 19379                head->units_per_em,
 19380                (int) head->xmin,
 19381                (int) head->ymin,
 19382                (int) head->xmax,
 19383                (int) head->ymax,
 19384                head->mac_style,
 19385                head->lowest_rec_ppem,
 19386                head->font_direction_hint,
 19387                head->index_to_loc_format,
 19388                head->glyph_data_format);
 19389 
 19390       if (head->index_to_loc_format)
 19391         {
 19392           loca_long = sfnt_read_loca_table_long (fd, font);
 19393           if (!loca_long)
 19394             return 1;
 19395 
 19396           fprintf (stderr, "long loca table has %zu glyphs\n",
 19397                    loca_long->num_offsets);
 19398         }
 19399       else
 19400         {
 19401           loca_short = sfnt_read_loca_table_short (fd, font);
 19402           if (!loca_short)
 19403             return 1;
 19404 
 19405           fprintf (stderr, "short loca table has %zu glyphs\n",
 19406                    loca_short->num_offsets);
 19407         }
 19408     }
 19409 
 19410   if (hhea)
 19411     fprintf (stderr, "HHEA table:\n"
 19412              "version: \t\t\t%g\n"
 19413              "ascent, descent: \t\t%d %d\n"
 19414              "line_gap: \t\t\t%d\n"
 19415              "advance_width_max: \t\t%u\n"
 19416              "min_lsb: \t\t\t%d\n"
 19417              "min_rsb: \t\t\t%d\n"
 19418              "caret_srise: \t\t\t%d\n"
 19419              "caret_srun: \t\t\t%d\n",
 19420              sfnt_coerce_fixed (hhea->version),
 19421              (int) hhea->ascent,
 19422              (int) hhea->descent,
 19423              (int) hhea->line_gap,
 19424              (unsigned int) hhea->advance_width_max,
 19425              (int) hhea->min_left_side_bearing,
 19426              (int) hhea->min_right_side_bearing,
 19427              (int) hhea->caret_slope_rise,
 19428              (int) hhea->caret_slope_run);
 19429 
 19430   if (head && maxp && maxp->version >= 0x00010000)
 19431     {
 19432       fprintf (stderr, "creating interpreter\n"
 19433                "the size of the stack is %"PRIu16"\n"
 19434                "the size of the twilight zone is %"PRIu16"\n"
 19435                "the size of the storage area is %"PRIu16"\n"
 19436                "there are at most %"PRIu16" idefs\n"
 19437                "there are at most %"PRIu16" fdefs\n"
 19438                "the cvt is %zu fwords in length\n",
 19439                maxp->max_stack_elements,
 19440                maxp->max_twilight_points,
 19441                maxp->max_storage,
 19442                maxp->max_instruction_defs,
 19443                maxp->max_function_defs,
 19444                cvt ? cvt->num_elements : 0ul);
 19445 
 19446       interpreter = sfnt_make_interpreter (maxp, cvt, head,
 19447                                            fvar, FANCY_PPEM,
 19448                                            FANCY_PPEM);
 19449       state = interpreter->state;
 19450 
 19451       if (instance && gvar)
 19452         sfnt_vary_interpreter (interpreter, &blend);
 19453 
 19454       if (fpgm)
 19455         {
 19456           fprintf (stderr, "interpreting the font program, with"
 19457                    " %zu instructions\n", fpgm->num_instructions);
 19458 
 19459           trap = sfnt_interpret_font_program (interpreter, fpgm);
 19460 
 19461           if (trap)
 19462             fprintf (stderr, "**TRAP**: %s\n", trap);
 19463         }
 19464 
 19465       if (prep)
 19466         {
 19467           fprintf (stderr, "interpreting the control value program, with"
 19468                    " %zu instructions\n", prep->num_instructions);
 19469 
 19470           trap = sfnt_interpret_control_value_program (interpreter, prep,
 19471                                                        &state);
 19472 
 19473           if (trap)
 19474             fprintf (stderr, "**TRAP**: %s\n", trap);
 19475         }
 19476     }
 19477 
 19478   while (true)
 19479     {
 19480       printf ("table, character? ");
 19481 
 19482       if (scanf ("%d %"SCNu32"", &i, &character) == EOF)
 19483         break;
 19484 
 19485       if (i < 0 || i >= table->num_subtables)
 19486         {
 19487           printf ("table out of range\n");
 19488           continue;
 19489         }
 19490 
 19491       if (!data[i])
 19492         {
 19493           printf ("table not present\n");
 19494           continue;
 19495         }
 19496 
 19497       code = sfnt_lookup_glyph (character, data[i]);
 19498       printf ("glyph is %"PRIu32"\n", code);
 19499 
 19500       if ((loca_long || loca_short) && glyf)
 19501         {
 19502           scale = sfnt_div_fixed (EASY_PPEM, head->units_per_em);
 19503           glyph = sfnt_read_glyph (code, glyf, loca_short,
 19504                                    loca_long);
 19505 
 19506           if (glyph)
 19507             {
 19508               printf ("glyph is: %s\n",
 19509                       glyph->simple ? "simple" : "compound");
 19510 
 19511               dcontext.glyf = glyf;
 19512               dcontext.loca_short = loca_short;
 19513               dcontext.loca_long = loca_long;
 19514 
 19515               if (instance && gvar)
 19516                 dcontext.blend = &blend;
 19517               else
 19518                 dcontext.blend = NULL;
 19519 
 19520               if (glyph->simple && instance && gvar)
 19521                 {
 19522                   printf ("applying variations to simple glyph...\n");
 19523 
 19524                   clock_gettime (CLOCK_THREAD_CPUTIME_ID, &start);
 19525                   if (sfnt_vary_simple_glyph (&blend, code, glyph,
 19526                                               &distortion))
 19527                     printf ("variation failed!\n");
 19528                   clock_gettime (CLOCK_THREAD_CPUTIME_ID, &end);
 19529                   sub = timespec_sub (end, start);
 19530 
 19531                   printf ("time spent varying: %lld sec %ld nsec\n",
 19532                           (long long) sub.tv_sec, sub.tv_nsec);
 19533                   printf ("distortions: %"PRIi16", %"PRIi16"\n",
 19534                           distortion.origin, distortion.advance);
 19535                 }
 19536               else if (instance && gvar)
 19537                 {
 19538                   printf ("applying variations to compound glyph...\n");
 19539 
 19540                   if (sfnt_vary_compound_glyph (&blend, code, glyph,
 19541                                                 &distortion))
 19542                     printf ("variation failed!\n");
 19543                 }
 19544 
 19545               if (sfnt_decompose_glyph (glyph, sfnt_test_move_to,
 19546                                         sfnt_test_line_to,
 19547                                         sfnt_test_curve_to,
 19548                                         sfnt_test_get_glyph,
 19549                                         sfnt_test_free_glyph,
 19550                                         &dcontext))
 19551                 printf ("decomposition failure\n");
 19552 
 19553               if (sfnt_lookup_glyph_metrics (code, -1,
 19554                                              &metrics,
 19555                                              hmtx, hhea,
 19556                                              head, maxp))
 19557                 {
 19558                   printf ("metrics lookup failure");
 19559                   memset (&metrics, 0, sizeof metrics);
 19560                 }
 19561 
 19562               /* Time this important bit.  */
 19563               clock_gettime (CLOCK_THREAD_CPUTIME_ID, &start);
 19564               outline = sfnt_build_glyph_outline (glyph, scale,
 19565                                                   &metrics,
 19566                                                   sfnt_test_get_glyph,
 19567                                                   sfnt_test_free_glyph,
 19568                                                   &dcontext);
 19569 
 19570               clock_gettime (CLOCK_THREAD_CPUTIME_ID, &end);
 19571               sub = timespec_sub (end, start);
 19572               memset (&sub1, 0, sizeof sub1);
 19573 
 19574               if (outline)
 19575                 {
 19576                   fprintf (stderr, "outline origin, rbearing: %"
 19577                            PRIi32" %"PRIi32"\n",
 19578                            outline->origin,
 19579                            outline->ymax - outline->origin);
 19580                   sfnt_test_max = outline->ymax - outline->ymin;
 19581 
 19582                   for (i = 0; i < outline->outline_used; i++)
 19583                     printf ("ctx.%s (%g, %g) /* %g, %g */\n",
 19584                             ((outline->outline[i].flags
 19585                               & SFNT_GLYPH_OUTLINE_LINETO)
 19586                              ? "lineTo" : "moveTo"),
 19587                             sfnt_coerce_fixed (outline->outline[i].x
 19588                                                - outline->xmin),
 19589                             sfnt_coerce_fixed (sfnt_test_max
 19590                                                - (outline->outline[i].y
 19591                                                   - outline->ymin)),
 19592                             sfnt_coerce_fixed (outline->outline[i].x
 19593                                                - outline->xmin),
 19594                             sfnt_coerce_fixed (outline->outline[i].y
 19595                                                - outline->ymin));
 19596 
 19597                   clock_gettime (CLOCK_THREAD_CPUTIME_ID, &start);
 19598                   sfnt_build_outline_edges (outline, sfnt_test_edge_ignore,
 19599                                             NULL);
 19600                   clock_gettime (CLOCK_THREAD_CPUTIME_ID, &end);
 19601                   sub1 = timespec_sub (end, start);
 19602 
 19603                   sfnt_build_outline_edges (outline, sfnt_test_edge,
 19604                                             NULL);
 19605 
 19606                   raster = NULL;
 19607 
 19608                   clock_gettime (CLOCK_THREAD_CPUTIME_ID, &start);
 19609 
 19610                   for (i = 0; i < 120; ++i)
 19611                     {
 19612                       xfree (raster);
 19613                       raster = sfnt_raster_glyph_outline (outline);
 19614                     }
 19615 
 19616                   clock_gettime (CLOCK_THREAD_CPUTIME_ID, &end);
 19617                   sub2 = timespec_sub (end, start);
 19618 
 19619                   /* Print out the raster.  */
 19620                   sfnt_test_raster (raster, hhea, scale);
 19621                   printf ("raster offsets: %d, %d\n",
 19622                           raster->offx, raster->offy);
 19623 
 19624                   xfree (raster);
 19625 
 19626                   printf ("outline bounds: %g %g, %g %g\n",
 19627                           sfnt_coerce_fixed (outline->xmin),
 19628                           sfnt_coerce_fixed (outline->ymin),
 19629                           sfnt_coerce_fixed (outline->xmax),
 19630                           sfnt_coerce_fixed (outline->ymax));
 19631                 }
 19632 
 19633               if (hmtx && head)
 19634                 {
 19635                   if (!sfnt_lookup_glyph_metrics (code, EASY_PPEM,
 19636                                                   &metrics,
 19637                                                   hmtx, hhea,
 19638                                                   head, maxp))
 19639                     printf ("lbearing, advance: %g, %g\n",
 19640                             sfnt_coerce_fixed (metrics.lbearing),
 19641                             sfnt_coerce_fixed (metrics.advance));
 19642 
 19643                   if (interpreter)
 19644                     {
 19645                       if (getenv ("SFNT_DEBUG"))
 19646                         interpreter->run_hook = sfnt_run_hook;
 19647                       else if (getenv ("SFNT_VERBOSE"))
 19648                         {
 19649                           interpreter->run_hook = sfnt_verbose;
 19650                           interpreter->push_hook = sfnt_push_hook;
 19651                           interpreter->pop_hook = sfnt_pop_hook;
 19652                         }
 19653 
 19654                       if (!sfnt_lookup_glyph_metrics (code, -1,
 19655                                                       &metrics,
 19656                                                       hmtx, hhea,
 19657                                                       head, maxp))
 19658                         {
 19659                           printf ("interpreting glyph\n");
 19660                           interpreter->state = state;
 19661                           clock_gettime (CLOCK_THREAD_CPUTIME_ID, &start);
 19662                           if (glyph->simple)
 19663                             trap
 19664                               = sfnt_interpret_simple_glyph (glyph,
 19665                                                              interpreter,
 19666                                                              &metrics,
 19667                                                              &value);
 19668                           else
 19669 #define GG sfnt_test_get_glyph
 19670 #define FG sfnt_test_free_glyph
 19671                             trap
 19672                               = sfnt_interpret_compound_glyph (glyph,
 19673                                                                interpreter,
 19674                                                                &state,
 19675                                                                GG, FG,
 19676                                                                hmtx, hhea,
 19677                                                                maxp,
 19678                                                                &metrics,
 19679                                                                &dcontext,
 19680                                                                &value);
 19681 #undef GG
 19682 #undef FG
 19683                           clock_gettime (CLOCK_THREAD_CPUTIME_ID, &end);
 19684                           sub3 = timespec_sub (end, start);
 19685 
 19686                           if (trap)
 19687                             printf ("**TRAP**: %s\n", trap);
 19688                           else
 19689                             {
 19690                               printf ("rasterizing instructed outline\n");
 19691                               if (outline)
 19692                                 xfree (outline);
 19693                               outline = sfnt_build_instructed_outline (value);
 19694                               xfree (value);
 19695 
 19696                               if (outline)
 19697                                 {
 19698                                   raster = sfnt_raster_glyph_outline (outline);
 19699 
 19700                                   if (raster)
 19701                                     {
 19702                                       sfnt_test_raster (raster, hhea, scale);
 19703                                       printf ("raster offsets: %d, %d\n",
 19704                                               raster->offx, raster->offy);
 19705                                       xfree (raster);
 19706                                     }
 19707                                 }
 19708                             }
 19709 
 19710                           fprintf (stderr, "execution time: %lld sec %ld nse"
 19711                                    "c\n",
 19712                                    (long long) sub3.tv_sec, sub3.tv_nsec);
 19713                         }
 19714 
 19715                       interpreter->run_hook = NULL;
 19716                     }
 19717                 }
 19718 
 19719               printf ("time spent outlining: %lld sec %ld nsec\n",
 19720                       (long long) sub.tv_sec, sub.tv_nsec);
 19721               printf ("time spent building edges: %lld sec %ld nsec\n",
 19722                       (long long) sub1.tv_sec, sub1.tv_nsec);
 19723               printf ("time spent rasterizing: %lld sec %ld nsec\n",
 19724                       (long long) sub2.tv_sec / 120, sub2.tv_nsec / 120);
 19725 
 19726               xfree (outline);
 19727             }
 19728 
 19729           sfnt_free_glyph (glyph);
 19730         }
 19731     }
 19732 
 19733  free_lab:
 19734 
 19735   xfree (font);
 19736 
 19737   for (i = 0; i < table->num_subtables; ++i)
 19738     xfree (data[i]);
 19739 
 19740   if (instance && gvar)
 19741     sfnt_free_blend (&blend);
 19742 
 19743   xfree (table);
 19744   xfree (data);
 19745   xfree (subtables);
 19746   xfree (head);
 19747   xfree (hhea);
 19748   xfree (loca_long);
 19749   xfree (loca_short);
 19750   xfree (glyf);
 19751   xfree (maxp);
 19752   xfree (hmtx);
 19753   xfree (name);
 19754   xfree (meta);
 19755   xfree (ttc);
 19756   xfree (cvt);
 19757   xfree (fpgm);
 19758   xfree (interpreter);
 19759   xfree (prep);
 19760   xfree (fvar);
 19761   xfree (gvar);
 19762   xfree (avar);
 19763   xfree (cvar);
 19764 
 19765   return 0;
 19766 }
 19767 
 19768 #endif