Update freetype to 2.5.4.

third_party/freetype/src/truetype/ttinterp.c

 /***************************************************************************/
 /*                                                                         */
 /*  ttinterp.c                                                             */
 /*                                                                         */
 /*    TrueType bytecode interpreter (body).                                */
 /*                                                                         */
-/*  Copyright 1996-2013                                                    */
+/*  Copyright 1996-2014                                                    */
 /*  by David Turner, Robert Wilhelm, and Werner Lemberg.                   */
 /*                                                                         */
 /*  This file is part of the FreeType project, and may only be used,       */
 /*  modified, and distributed under the terms of the FreeType project      */
 /*  license, LICENSE.TXT.  By continuing to use, modify, or distribute     */
 /*  this file you indicate that you have read the license and              */
 /*  understand and accept it fully.                                        */
 /*                                                                         */
 /***************************************************************************/
 
 
 /* Greg Hitchcock from Microsoft has helped a lot in resolving unclear */
 /* issues; many thanks!                                                */
 
 
-#include "../../include/ft2build.h"
-#include "../../include/freetype/internal/ftdebug.h"
-#include "../../include/freetype/internal/ftcalc.h"
-#include "../../include/freetype/fttrigon.h"
-#include "../../include/freetype/ftsystem.h"
-#include "../../include/freetype/ftttdrv.h"
+#include <ft2build.h>
+#include FT_INTERNAL_DEBUG_H
+#include FT_INTERNAL_CALC_H
+#include FT_TRIGONOMETRY_H
+#include FT_SYSTEM_H
+#include FT_TRUETYPE_DRIVER_H
 
 #include "ttinterp.h"
 #include "tterrors.h"
 #include "ttsubpix.h"
 
 
 #ifdef TT_USE_BYTECODE_INTERPRETER
 
 
   /*************************************************************************/
@@ skipping 126 matching lines @@
 
 #define CUR_Func_move( z, p, d ) \
           CUR.func_move( EXEC_ARG_ z, p, d )
 
 #define CUR_Func_move_orig( z, p, d ) \
           CUR.func_move_orig( EXEC_ARG_ z, p, d )
 
 #define CUR_Func_round( d, c ) \
           CUR.func_round( EXEC_ARG_ d, c )
 
+#define CUR_Func_cur_ppem() \
+          CUR.func_cur_ppem( EXEC_ARG )
+
 #define CUR_Func_read_cvt( index ) \
           CUR.func_read_cvt( EXEC_ARG_ index )
 
 #define CUR_Func_write_cvt( index, val ) \
           CUR.func_write_cvt( EXEC_ARG_ index, val )
 
 #define CUR_Func_move_cvt( index, val ) \
           CUR.func_move_cvt( EXEC_ARG_ index, val )
 
 #define CURRENT_Ratio() \
           Current_Ratio( EXEC_ARG )
 
-#define CURRENT_Ppem() \
-          Current_Ppem( EXEC_ARG )
-
-#define CUR_Ppem() \
-          Cur_PPEM( EXEC_ARG )
-
 #define INS_SxVTL( a, b, c, d ) \
           Ins_SxVTL( EXEC_ARG_ a, b, c, d )
 
 #define COMPUTE_Funcs() \
           Compute_Funcs( EXEC_ARG )
 
 #define COMPUTE_Round( a ) \
           Compute_Round( EXEC_ARG_ a )
 
 #define COMPUTE_Point_Displacement( a, b, c, d ) \
@@ skipping 72 matching lines @@
   /*    `exec', and `IP').                                                 */
   /*                                                                       */
   /* <Input>                                                               */
   /*    range :: The new execution code range.                             */
   /*                                                                       */
   /*    IP    :: The new IP in the new code range.                         */
   /*                                                                       */
   /* <InOut>                                                               */
   /*    exec  :: The target execution context.                             */
   /*                                                                       */
-  /* <Return>                                                              */
-  /*    FreeType error code.  0 means success.                             */
-  /*                                                                       */
-  FT_LOCAL_DEF( FT_Error )
+  FT_LOCAL_DEF( void )
   TT_Goto_CodeRange( TT_ExecContext  exec,
                      FT_Int          range,
                      FT_Long         IP )
   {
     TT_CodeRange*  coderange;
 
 
     FT_ASSERT( range >= 1 && range <= 3 );
 
     coderange = &exec->codeRangeTable[range - 1];
 
     FT_ASSERT( coderange->base != NULL );
 
     /* NOTE: Because the last instruction of a program may be a CALL */
     /*       which will return to the first byte *after* the code    */
     /*       range, we test for IP <= Size instead of IP < Size.     */
     /*                                                               */
     FT_ASSERT( (FT_ULong)IP <= coderange->size );
 
     exec->code     = coderange->base;
     exec->codeSize = coderange->size;
     exec->IP       = IP;
     exec->curRange = range;
-
-    return FT_Err_Ok;
   }
 
 
   /*************************************************************************/
   /*                                                                       */
   /* <Function>                                                            */
   /*    TT_Set_CodeRange                                                   */
   /*                                                                       */
   /* <Description>                                                         */
   /*    Sets a code range.                                                 */
   /*                                                                       */
   /* <Input>                                                               */
   /*    range  :: The code range index.                                    */
   /*                                                                       */
   /*    base   :: The new code base.                                       */
   /*                                                                       */
   /*    length :: The range size in bytes.                                 */
   /*                                                                       */
   /* <InOut>                                                               */
   /*    exec   :: The target execution context.                            */
   /*                                                                       */
-  /* <Return>                                                              */
-  /*    FreeType error code.  0 means success.                             */
-  /*                                                                       */
-  FT_LOCAL_DEF( FT_Error )
+  FT_LOCAL_DEF( void )
   TT_Set_CodeRange( TT_ExecContext  exec,
                     FT_Int          range,
                     void*           base,
                     FT_Long         length )
   {
     FT_ASSERT( range >= 1 && range <= 3 );
 
     exec->codeRangeTable[range - 1].base = (FT_Byte*)base;
     exec->codeRangeTable[range - 1].size = length;
-
-    return FT_Err_Ok;
   }
 
 
   /*************************************************************************/
   /*                                                                       */
   /* <Function>                                                            */
   /*    TT_Clear_CodeRange                                                 */
   /*                                                                       */
   /* <Description>                                                         */
   /*    Clears a code range.                                               */
   /*                                                                       */
   /* <Input>                                                               */
   /*    range :: The code range index.                                     */
   /*                                                                       */
   /* <InOut>                                                               */
   /*    exec  :: The target execution context.                             */
   /*                                                                       */
-  /* <Return>                                                              */
-  /*    FreeType error code.  0 means success.                             */
-  /*                                                                       */
-  /* <Note>                                                                */
-  /*    Does not set the Error variable.                                   */
-  /*                                                                       */
-  FT_LOCAL_DEF( FT_Error )
+  FT_LOCAL_DEF( void )
   TT_Clear_CodeRange( TT_ExecContext  exec,
                       FT_Int          range )
   {
     FT_ASSERT( range >= 1 && range <= 3 );
 
     exec->codeRangeTable[range - 1].base = NULL;
     exec->codeRangeTable[range - 1].size = 0;
-
-    return FT_Err_Ok;
   }
 
 
   /*************************************************************************/
   /*                                                                       */
   /*                   EXECUTION CONTEXT ROUTINES                          */
   /*                                                                       */
   /*************************************************************************/
 
 
   /*************************************************************************/
   /*                                                                       */
   /* <Function>                                                            */
   /*    TT_Done_Context                                                    */
   /*                                                                       */
   /* <Description>                                                         */
   /*    Destroys a given context.                                          */
   /*                                                                       */
   /* <Input>                                                               */
   /*    exec   :: A handle to the target execution context.                */
   /*                                                                       */
   /*    memory :: A handle to the parent memory object.                    */
   /*                                                                       */
-  /* <Return>                                                              */
-  /*    FreeType error code.  0 means success.                             */
-  /*                                                                       */
   /* <Note>                                                                */
   /*    Only the glyph loader and debugger should call this function.      */
   /*                                                                       */
-  FT_LOCAL_DEF( FT_Error )
+  FT_LOCAL_DEF( void )
   TT_Done_Context( TT_ExecContext  exec )
   {
     FT_Memory  memory = exec->memory;
 
 
     /* points zone */
     exec->maxPoints   = 0;
     exec->maxContours = 0;
 
     /* free stack */
     FT_FREE( exec->stack );
     exec->stackSize = 0;
 
     /* free call stack */
     FT_FREE( exec->callStack );
     exec->callSize = 0;
     exec->callTop  = 0;
 
     /* free glyph code range */
     FT_FREE( exec->glyphIns );
     exec->glyphSize = 0;
 
     exec->size = NULL;
     exec->face = NULL;
 
     FT_FREE( exec );
-
-    return FT_Err_Ok;
   }
 
 
   /*************************************************************************/
   /*                                                                       */
   /* <Function>                                                            */
   /*    Init_Context                                                       */
   /*                                                                       */
   /* <Description>                                                         */
   /*    Initializes a context object.                                      */
@@ skipping 206 matching lines @@
   /*                                                                       */
   /* <Description>                                                         */
   /*    Saves the code ranges in a `size' object.                          */
   /*                                                                       */
   /* <Input>                                                               */
   /*    exec :: A handle to the source execution context.                  */
   /*                                                                       */
   /* <InOut>                                                               */
   /*    size :: A handle to the target size object.                        */
   /*                                                                       */
-  /* <Return>                                                              */
-  /*    FreeType error code.  0 means success.                             */
-  /*                                                                       */
   /* <Note>                                                                */
   /*    Only the glyph loader and debugger should call this function.      */
   /*                                                                       */
-  FT_LOCAL_DEF( FT_Error )
+  FT_LOCAL_DEF( void )
   TT_Save_Context( TT_ExecContext  exec,
                    TT_Size         size )
   {
     FT_Int  i;
 
 
     /* XXX: Will probably disappear soon with all the code range */
     /*      management, which is now rather obsolete.            */
     /*                                                           */
     size->num_function_defs    = exec->numFDefs;
     size->num_instruction_defs = exec->numIDefs;
 
     size->max_func = exec->maxFunc;
     size->max_ins  = exec->maxIns;
 
     for ( i = 0; i < TT_MAX_CODE_RANGES; i++ )
       size->codeRangeTable[i] = exec->codeRangeTable[i];
-
-    return FT_Err_Ok;
   }
 
 
   /*************************************************************************/
   /*                                                                       */
   /* <Function>                                                            */
   /*    TT_Run_Context                                                     */
   /*                                                                       */
   /* <Description>                                                         */
   /*    Executes one or more instructions in the execution context.        */
@@ skipping 11 matching lines @@
   /* <Return>                                                              */
   /*    TrueType error code.  0 means success.                             */
   /*                                                                       */
   /* <Note>                                                                */
   /*    Only the glyph loader and debugger should call this function.      */
   /*                                                                       */
   FT_LOCAL_DEF( FT_Error )
   TT_Run_Context( TT_ExecContext  exec,
                   FT_Bool         debug )
   {
-    FT_Error  error;
-
-
-    if ( ( error = TT_Goto_CodeRange( exec, tt_coderange_glyph, 0 ) )
-           != FT_Err_Ok )
-      return error;
+    TT_Goto_CodeRange( exec, tt_coderange_glyph, 0 );
 
     exec->zp0 = exec->pts;
     exec->zp1 = exec->pts;
     exec->zp2 = exec->pts;
 
     exec->GS.gep0 = 1;
     exec->GS.gep1 = 1;
     exec->GS.gep2 = 1;
 
     exec->GS.projVector.x = 0x4000;
@@ skipping 49 matching lines @@
     TRUE, 68, 0, 0, 9, 3,
     0, FALSE, 0, 1, 1, 1
   };
 
 
   /* documentation is in ttinterp.h */
 
   FT_EXPORT_DEF( TT_ExecContext )
   TT_New_Context( TT_Driver  driver )
   {
-    TT_ExecContext  exec;
-    FT_Memory       memory;
+    FT_Memory  memory;
 
 
+    if ( !driver )
+      goto Fail;
+
     memory = driver->root.root.memory;
-    exec   = driver->context;
 
     if ( !driver->context )
     {
-      FT_Error  error;
+      FT_Error        error;
+      TT_ExecContext  exec;
 
 
       /* allocate object */
       if ( FT_NEW( exec ) )
         goto Fail;
 
       /* initialize it; in case of error this deallocates `exec' too */
       error = Init_Context( exec, memory );
       if ( error )
         goto Fail;
@@ skipping 611 matching lines @@
     2, 3, 4, 5,  6, 7, 8, 9,  3, 5, 7, 9, 11,13,15,17,
 
     1, 1, 1, 1,  1, 1, 1, 1,  1, 1, 1, 1,  1, 1, 1, 1,
     1, 1, 1, 1,  1, 1, 1, 1,  1, 1, 1, 1,  1, 1, 1, 1,
     1, 1, 1, 1,  1, 1, 1, 1,  1, 1, 1, 1,  1, 1, 1, 1,
     1, 1, 1, 1,  1, 1, 1, 1,  1, 1, 1, 1,  1, 1, 1, 1
   };
 
 #undef PACK
 
-#if 1
 
+#ifndef FT_CONFIG_OPTION_NO_ASSEMBLER
+
+#if defined( __arm__ )                                 && \
+    ( defined( __thumb2__ ) || !defined( __thumb__ ) )
+
+#define TT_MulFix14  TT_MulFix14_arm
+
+  static FT_Int32
+  TT_MulFix14_arm( FT_Int32  a,
+                   FT_Int    b )
+  {
+    FT_Int32  t, t2;
+
+
+#if defined( __CC_ARM ) || defined( __ARMCC__ )
+
+    __asm
+    {
+      smull t2, t,  b,  a           /* (lo=t2,hi=t) = a*b */
+      mov   a,  t,  asr #31         /* a   = (hi >> 31) */
+      add   a,  a,  #0x2000         /* a  += 0x2000 */
+      adds  t2, t2, a               /* t2 += a */
+      adc   t,  t,  #0              /* t  += carry */
+      mov   a,  t2, lsr #14         /* a   = t2 >> 14 */
+      orr   a,  a,  t,  lsl #18     /* a  |= t << 18 */
+    }
+
+#elif defined( __GNUC__ )
+
+    __asm__ __volatile__ (
+      "smull  %1, %2, %4, %3\n\t"       /* (lo=%1,hi=%2) = a*b */
+      "mov    %0, %2, asr #31\n\t"      /* %0  = (hi >> 31) */
+#if defined( __clang__ ) && defined( __thumb2__ )
+      "add.w  %0, %0, #0x2000\n\t"      /* %0 += 0x2000 */
+#else
+      "add    %0, %0, #0x2000\n\t"      /* %0 += 0x2000 */
+#endif
+      "adds   %1, %1, %0\n\t"           /* %1 += %0 */
+      "adc    %2, %2, #0\n\t"           /* %2 += carry */
+      "mov    %0, %1, lsr #14\n\t"      /* %0  = %1 >> 16 */
+      "orr    %0, %0, %2, lsl #18\n\t"  /* %0 |= %2 << 16 */
+      : "=r"(a), "=&r"(t2), "=&r"(t)
+      : "r"(a), "r"(b)
+      : "cc" );
+
+#endif
+
+    return a;
+  }
+
+#endif /* __arm__ && ( __thumb2__ || !__thumb__ ) */
+
+#endif /* !FT_CONFIG_OPTION_NO_ASSEMBLER */
+
+
+#if defined( __GNUC__ )                              && \
+    ( defined( __i386__ ) || defined( __x86_64__ ) )
+
+#define TT_MulFix14  TT_MulFix14_long_long
+
+  /* Temporarily disable the warning that C90 doesn't support `long long'. */
+#if ( __GNUC__ * 100 + __GNUC_MINOR__ ) >= 406
+#pragma GCC diagnostic push
+#endif
+#pragma GCC diagnostic ignored "-Wlong-long"
+
+  /* This is declared `noinline' because inlining the function results */
+  /* in slower code.  The `pure' attribute indicates that the result   */
+  /* only depends on the parameters.                                   */
+  static __attribute__(( noinline ))
+         __attribute__(( pure )) FT_Int32
+  TT_MulFix14_long_long( FT_Int32  a,
+                         FT_Int    b )
+  {
+
+    long long  ret = (long long)a * b;
+
+    /* The following line assumes that right shifting of signed values */
+    /* will actually preserve the sign bit.  The exact behaviour is    */
+    /* undefined, but this is true on x86 and x86_64.                  */
+    long long  tmp = ret >> 63;
+
+
+    ret += 0x2000 + tmp;
+
+    return (FT_Int32)( ret >> 14 );
+  }
+
+#if ( __GNUC__ * 100 + __GNUC_MINOR__ ) >= 406
+#pragma GCC diagnostic pop
+#endif
+
+#endif /* __GNUC__ && ( __i386__ || __x86_64__ ) */
+
+
+#ifndef TT_MulFix14
+
+  /* Compute (a*b)/2^14 with maximum accuracy and rounding.  */
+  /* This is optimized to be faster than calling FT_MulFix() */
+  /* for platforms where sizeof(int) == 2.                   */
   static FT_Int32
   TT_MulFix14( FT_Int32  a,
                FT_Int    b )
   {
     FT_Int32   sign;
     FT_UInt32  ah, al, mid, lo, hi;
 
 
     sign = a ^ b;
 
@@ skipping 11 matching lines @@
     mid   = ( mid << 16 ) + ( 1 << 13 ); /* rounding */
     lo   += mid;
     if ( lo < mid )
       hi += 1;
 
     mid = ( lo >> 14 ) | ( hi << 18 );
 
     return sign >= 0 ? (FT_Int32)mid : -(FT_Int32)mid;
   }
 
-#else
-
-  /* compute (a*b)/2^14 with maximum accuracy and rounding */
-  static FT_Int32
-  TT_MulFix14( FT_Int32  a,
-               FT_Int    b )
-  {
-    FT_Int32   m, s, hi;
-    FT_UInt32  l, lo;
+#endif  /* !TT_MulFix14 */
 
 
-    /* compute ax*bx as 64-bit value */
-    l  = (FT_UInt32)( ( a & 0xFFFFU ) * b );
-    m  = ( a >> 16 ) * b;
+#if defined( __GNUC__ )        && \
+    ( defined( __i386__ )   ||    \
+      defined( __x86_64__ ) ||    \
+      defined( __arm__ )    )
 
-    lo = l + ( (FT_UInt32)m << 16 );
-    hi = ( m >> 16 ) + ( (FT_Int32)l >> 31 ) + ( lo < l );
+#define TT_DotFix14  TT_DotFix14_long_long
 
-    /* divide the result by 2^14 with rounding */
-    s   = hi >> 31;
-    l   = lo + (FT_UInt32)s;
-    hi += s + ( l < lo );
-    lo  = l;
+#if ( __GNUC__ * 100 + __GNUC_MINOR__ ) >= 406
+#pragma GCC diagnostic push
+#endif
+#pragma GCC diagnostic ignored "-Wlong-long"
 
-    l   = lo + 0x2000U;
-    hi += l < lo;
+  static __attribute__(( pure )) FT_Int32
+  TT_DotFix14_long_long( FT_Int32  ax,
+                         FT_Int32  ay,
+                         FT_Int    bx,
+                         FT_Int    by )
+  {
+    /* Temporarily disable the warning that C90 doesn't support */
+    /* `long long'.                                             */
 
-    return (FT_Int32)( ( (FT_UInt32)hi << 18 ) | ( l >> 14 ) );
+    long long  temp1 = (long long)ax * bx;
+    long long  temp2 = (long long)ay * by;
+
+
+    temp1 += temp2;
+    temp2  = temp1 >> 63;
+    temp1 += 0x2000 + temp2;
+
+    return (FT_Int32)( temp1 >> 14 );
+
   }
+
+#if ( __GNUC__ * 100 + __GNUC_MINOR__ ) >= 406
+#pragma GCC diagnostic pop
 #endif
 
+#endif /* __GNUC__ && (__arm__ || __i386__ || __x86_64__) */
+
+
+#ifndef TT_DotFix14
 
   /* compute (ax*bx+ay*by)/2^14 with maximum accuracy and rounding */
   static FT_Int32
   TT_DotFix14( FT_Int32  ax,
                FT_Int32  ay,
                FT_Int    bx,
                FT_Int    by )
   {
     FT_Int32   m, s, hi1, hi2, hi;
     FT_UInt32  l, lo1, lo2, lo;
@@ skipping 22 matching lines @@
     l   = lo + (FT_UInt32)s;
     hi += s + ( l < lo );
     lo  = l;
 
     l   = lo + 0x2000U;
     hi += ( l < lo );
 
     return (FT_Int32)( ( (FT_UInt32)hi << 18 ) | ( l >> 14 ) );
   }
 
+#endif /* TT_DotFix14 */
+
 
   /*************************************************************************/
   /*                                                                       */
   /* <Function>                                                            */
   /*    Current_Ratio                                                      */
   /*                                                                       */
   /* <Description>                                                         */
   /*    Returns the current aspect ratio scaling factor depending on the   */
   /*    projection vector's state and device resolutions.                  */
   /*                                                                       */
@@ skipping 32 matching lines @@
           y = TT_MulFix14( CUR.tt_metrics.y_ratio,
                            CUR.GS.projVector.y );
           CUR.tt_metrics.ratio = FT_Hypot( x, y );
         }
       }
     }
     return CUR.tt_metrics.ratio;
   }
 
 
-  static FT_Long
+  FT_CALLBACK_DEF( FT_Long )
   Current_Ppem( EXEC_OP )
   {
+    return CUR.tt_metrics.ppem;
+  }
+
+
+  FT_CALLBACK_DEF( FT_Long )
+  Current_Ppem_Stretched( EXEC_OP )
+  {
     return FT_MulFix( CUR.tt_metrics.ppem, CURRENT_Ratio() );
   }
 
 
   /*************************************************************************/
   /*                                                                       */
   /* Functions related to the control value table (CVT).                   */
   /*                                                                       */
   /*************************************************************************/
 
@@ skipping 318 matching lines @@
                        FT_F26Dot6  compensation )
   {
     FT_F26Dot6  val;
 
     FT_UNUSED_EXEC;
 
 
     if ( distance >= 0 )
     {
       val = distance + compensation;
-      if ( distance && val < 0 )
+      if ( val < 0 )
         val = 0;
     }
     else
     {
       val = distance - compensation;
       if ( val > 0 )
         val = 0;
     }
     return val;
   }
@@ skipping 19 matching lines @@
   Round_To_Grid( EXEC_OP_ FT_F26Dot6  distance,
                           FT_F26Dot6  compensation )
   {
     FT_F26Dot6  val;
 
     FT_UNUSED_EXEC;
 
 
     if ( distance >= 0 )
     {
-      val = distance + compensation + 32;
-      if ( distance && val > 0 )
-        val &= ~63;
-      else
+      val = FT_PIX_ROUND( distance + compensation );
+      if ( val < 0 )
         val = 0;
     }
     else
     {
       val = -FT_PIX_ROUND( compensation - distance );
       if ( val > 0 )
         val = 0;
     }
 
     return  val;
@@ skipping 21 matching lines @@
                                FT_F26Dot6  compensation )
   {
     FT_F26Dot6  val;
 
     FT_UNUSED_EXEC;
 
 
     if ( distance >= 0 )
     {
       val = FT_PIX_FLOOR( distance + compensation ) + 32;
-      if ( distance && val < 0 )
-        val = 0;
+      if ( val < 0 )
+        val = 32;
     }
     else
     {
       val = -( FT_PIX_FLOOR( compensation - distance ) + 32 );
       if ( val > 0 )
-        val = 0;
+        val = -32;
     }
 
     return val;
   }
 
 
   /*************************************************************************/
   /*                                                                       */
   /* <Function>                                                            */
   /*    Round_Down_To_Grid                                                 */
@@ skipping 13 matching lines @@
   Round_Down_To_Grid( EXEC_OP_ FT_F26Dot6  distance,
                                FT_F26Dot6  compensation )
   {
     FT_F26Dot6  val;
 
     FT_UNUSED_EXEC;
 
 
     if ( distance >= 0 )
     {
-      val = distance + compensation;
-      if ( distance && val > 0 )
-        val &= ~63;
-      else
+      val = FT_PIX_FLOOR( distance + compensation );
+      if ( val < 0 )
         val = 0;
     }
     else
     {
-      val = -( ( compensation - distance ) & -64 );
+      val = -FT_PIX_FLOOR( compensation - distance );
       if ( val > 0 )
         val = 0;
     }
 
     return val;
   }
 
 
   /*************************************************************************/
   /*                                                                       */
@@ skipping 15 matching lines @@
   Round_Up_To_Grid( EXEC_OP_ FT_F26Dot6  distance,
                              FT_F26Dot6  compensation )
   {
     FT_F26Dot6  val;
 
     FT_UNUSED_EXEC;
 
 
     if ( distance >= 0 )
     {
-      val = distance + compensation + 63;
-      if ( distance && val > 0 )
-        val &= ~63;
-      else
+      val = FT_PIX_CEIL( distance + compensation );
+      if ( val < 0 )
         val = 0;
     }
     else
     {
       val = -FT_PIX_CEIL( compensation - distance );
       if ( val > 0 )
         val = 0;
     }
 
     return val;
@@ skipping 20 matching lines @@
   Round_To_Double_Grid( EXEC_OP_ FT_F26Dot6  distance,
                                  FT_F26Dot6  compensation )
   {
     FT_F26Dot6 val;
 
     FT_UNUSED_EXEC;
 
 
     if ( distance >= 0 )
     {
-      val = distance + compensation + 16;
-      if ( distance && val > 0 )
-        val &= ~31;
-      else
+      val = FT_PAD_ROUND( distance + compensation, 32 );
+      if ( val < 0 )
         val = 0;
     }
     else
     {
       val = -FT_PAD_ROUND( compensation - distance, 32 );
       if ( val > 0 )
         val = 0;
     }
 
     return val;
@@ skipping 26 matching lines @@
   Round_Super( EXEC_OP_ FT_F26Dot6  distance,
                         FT_F26Dot6  compensation )
   {
     FT_F26Dot6  val;
 
 
     if ( distance >= 0 )
     {
       val = ( distance - CUR.phase + CUR.threshold + compensation ) &
               -CUR.period;
-      if ( distance && val < 0 )
-        val = 0;
       val += CUR.phase;
+      if ( val < 0 )
+        val = CUR.phase;
     }
     else
     {
       val = -( ( CUR.threshold - CUR.phase - distance + compensation ) &
                -CUR.period );
+      val -= CUR.phase;
       if ( val > 0 )
-        val = 0;
-      val -= CUR.phase;
+        val = -CUR.phase;
     }
 
     return val;
   }
 
 
   /*************************************************************************/
   /*                                                                       */
   /* <Function>                                                            */
   /*    Round_Super_45                                                     */
@@ skipping 17 matching lines @@
   Round_Super_45( EXEC_OP_ FT_F26Dot6  distance,
                            FT_F26Dot6  compensation )
   {
     FT_F26Dot6  val;
 
 
     if ( distance >= 0 )
     {
       val = ( ( distance - CUR.phase + CUR.threshold + compensation ) /
                 CUR.period ) * CUR.period;
-      if ( distance && val < 0 )
-        val = 0;
       val += CUR.phase;
+      if ( val < 0 )
+        val = CUR.phase;
     }
     else
     {
       val = -( ( ( CUR.threshold - CUR.phase - distance + compensation ) /
                    CUR.period ) * CUR.period );
+      val -= CUR.phase;
       if ( val > 0 )
-        val = 0;
-      val -= CUR.phase;
+        val = -CUR.phase;
     }
 
     return val;
   }
 
 
   /*************************************************************************/
   /*                                                                       */
   /* <Function>                                                            */
   /*    Compute_Round                                                      */
@@ skipping 687 matching lines @@
 
 
 #define DO_FLIPON            \
     CUR.GS.auto_flip = TRUE;
 
 
 #define DO_FLIPOFF            \
     CUR.GS.auto_flip = FALSE;
 
 
-#define DO_SDB                             \
-    CUR.GS.delta_base = (FT_Short)args[0];
+#define DO_SDB                              \
+    CUR.GS.delta_base = (FT_UShort)args[0];
 
 
-#define DO_SDS                              \
-    CUR.GS.delta_shift = (FT_Short)args[0];
+#define DO_SDS                                 \
+    if ( (FT_ULong)args[0] > 6UL )             \
+      CUR.error = FT_THROW( Bad_Argument );    \
+    else                                       \
+      CUR.GS.delta_shift = (FT_UShort)args[0];
 
 
 #define DO_MD  /* nothing */
 
 
 #define DO_MPPEM              \
-    args[0] = CURRENT_Ppem();
+    args[0] = CUR_Func_cur_ppem();
 
 
   /* Note: The pointSize should be irrelevant in a given font program; */
   /*       we thus decide to return only the ppem.                     */
 #if 0
 
 #define DO_MPS                       \
     args[0] = CUR.metrics.pointSize;
 
 #else
 
 #define DO_MPS                \
-    args[0] = CURRENT_Ppem();
+    args[0] = CUR_Func_cur_ppem();
 
 #endif /* 0 */
 
 
 #define DO_DUP         \
     args[1] = args[0];
 
 
 #define DO_CLEAR     \
     CUR.new_top = 0;
@@ skipping 25 matching lines @@
     {                                              \
       if ( CUR.pedantic_hinting )                  \
         CUR.error = FT_THROW( Invalid_Reference ); \
       args[0] = 0;                                 \
     }                                              \
     else                                           \
       args[0] = CUR.stack[CUR.args - L];           \
   }
 
 
-#define DO_JROT                                                   \
-    if ( args[1] != 0 )                                           \
-    {                                                             \
-      if ( args[0] == 0 && CUR.args == 0 )                        \
-        CUR.error = FT_THROW( Bad_Argument );                     \
-      CUR.IP += args[0];                                          \
-      if ( CUR.IP < 0                                          || \
-           ( CUR.callTop > 0                                 &&   \
-             CUR.IP > CUR.callStack[CUR.callTop - 1].Cur_End ) )  \
-        CUR.error = FT_THROW( Bad_Argument );                     \
-      CUR.step_ins = FALSE;                                       \
+#define DO_JROT                                                    \
+    if ( args[1] != 0 )                                            \
+    {                                                              \
+      if ( args[0] == 0 && CUR.args == 0 )                         \
+        CUR.error = FT_THROW( Bad_Argument );                      \
+      CUR.IP += args[0];                                           \
+      if ( CUR.IP < 0                                           || \
+           ( CUR.callTop > 0                                  &&   \
+             CUR.IP > CUR.callStack[CUR.callTop - 1].Def->end ) )  \
+        CUR.error = FT_THROW( Bad_Argument );                      \
+      CUR.step_ins = FALSE;                                        \
     }
 
 
-#define DO_JMPR                                                 \
-    if ( args[0] == 0 && CUR.args == 0 )                        \
-      CUR.error = FT_THROW( Bad_Argument );                     \
-    CUR.IP += args[0];                                          \
-    if ( CUR.IP < 0                                          || \
-         ( CUR.callTop > 0                                 &&   \
-           CUR.IP > CUR.callStack[CUR.callTop - 1].Cur_End ) )  \
-      CUR.error = FT_THROW( Bad_Argument );                     \
+#define DO_JMPR                                                  \
+    if ( args[0] == 0 && CUR.args == 0 )                         \
+      CUR.error = FT_THROW( Bad_Argument );                      \
+    CUR.IP += args[0];                                           \
+    if ( CUR.IP < 0                                           || \
+         ( CUR.callTop > 0                                  &&   \
+           CUR.IP > CUR.callStack[CUR.callTop - 1].Def->end ) )  \
+      CUR.error = FT_THROW( Bad_Argument );                      \
     CUR.step_ins = FALSE;
 
 
-#define DO_JROF                                                   \
-    if ( args[1] == 0 )                                           \
-    {                                                             \
-      if ( args[0] == 0 && CUR.args == 0 )                        \
-        CUR.error = FT_THROW( Bad_Argument );                     \
-      CUR.IP += args[0];                                          \
-      if ( CUR.IP < 0                                          || \
-           ( CUR.callTop > 0                                 &&   \
-             CUR.IP > CUR.callStack[CUR.callTop - 1].Cur_End ) )  \
-        CUR.error = FT_THROW( Bad_Argument );                     \
-      CUR.step_ins = FALSE;                                       \
+#define DO_JROF                                                    \
+    if ( args[1] == 0 )                                            \
+    {                                                              \
+      if ( args[0] == 0 && CUR.args == 0 )                         \
+        CUR.error = FT_THROW( Bad_Argument );                      \
+      CUR.IP += args[0];                                           \
+      if ( CUR.IP < 0                                           || \
+           ( CUR.callTop > 0                                  &&   \
+             CUR.IP > CUR.callStack[CUR.callTop - 1].Def->end ) )  \
+        CUR.error = FT_THROW( Bad_Argument );                      \
+      CUR.step_ins = FALSE;                                        \
     }
 
 
 #define DO_LT                        \
     args[0] = ( args[0] < args[1] );
 
 
 #define DO_LTEQ                       \
     args[0] = ( args[0] <= args[1] );
 
@@ skipping 1695 matching lines @@
 
     pRec = &CUR.callStack[CUR.callTop];
 
     pRec->Cur_Count--;
 
     CUR.step_ins = FALSE;
 
     if ( pRec->Cur_Count > 0 )
     {
       CUR.callTop++;
-      CUR.IP = pRec->Cur_Restart;
+      CUR.IP = pRec->Def->start;
     }
     else
       /* Loop through the current function */
       INS_Goto_CodeRange( pRec->Caller_Range,
                           pRec->Caller_IP );
 
     /* Exit the current call frame.                      */
 
     /* NOTE: If the last instruction of a program is a   */
     /*       CALL or LOOPCALL, the return address is     */
@@ skipping 69 matching lines @@
     {
       CUR.error = FT_THROW( Stack_Overflow );
       return;
     }
 
     pCrec = CUR.callStack + CUR.callTop;
 
     pCrec->Caller_Range = CUR.curRange;
     pCrec->Caller_IP    = CUR.IP + 1;
     pCrec->Cur_Count    = 1;
-    pCrec->Cur_Restart  = def->start;
-    pCrec->Cur_End      = def->end;
+    pCrec->Def          = def;
 
     CUR.callTop++;
 
     INS_Goto_CodeRange( def->range,
                         def->start );
 
     CUR.step_ins = FALSE;
 
     return;
 
@@ skipping 67 matching lines @@
       return;
     }
 
     if ( args[0] > 0 )
     {
       pCrec = CUR.callStack + CUR.callTop;
 
       pCrec->Caller_Range = CUR.curRange;
       pCrec->Caller_IP    = CUR.IP + 1;
       pCrec->Cur_Count    = (FT_Int)args[0];
-      pCrec->Cur_Restart  = def->start;
-      pCrec->Cur_End      = def->end;
+      pCrec->Def          = def;
 
       CUR.callTop++;
 
       INS_Goto_CodeRange( def->range, def->start );
 
       CUR.step_ins = FALSE;
     }
 
     return;
 
@@ skipping 840 matching lines @@
       else
       {
         CUR.zp2.cur[point].y += dy;
         if ( touch )
           CUR.zp2.tags[point] |= FT_CURVE_TAG_TOUCH_Y;
       }
       return;
     }
 #endif
 
-        if (CUR.zp2.cur == NULL) return; /* Security fix: Google Chris6 ufuzz109.pdf page #1 */
     if ( CUR.GS.freeVector.x != 0 )
     {
       CUR.zp2.cur[point].x += dx;
       if ( touch )
         CUR.zp2.tags[point] |= FT_CURVE_TAG_TOUCH_X;
     }
 
     if ( CUR.GS.freeVector.y != 0 )
     {
       CUR.zp2.cur[point].y += dy;
@@ skipping 145 matching lines @@
 
     if ( COMPUTE_Point_Displacement( &dx, &dy, &zp, &refp ) )
       return;
 
     /* XXX: UNDOCUMENTED! SHZ doesn't move the phantom points.     */
     /*      Twilight zone has no real contours, so use `n_points'. */
     /*      Normal zone's `n_points' includes phantoms, so must    */
     /*      use end of last contour.                               */
     if ( CUR.GS.gep2 == 0 )
       limit = (FT_UShort)CUR.zp2.n_points;
-    else if ( CUR.GS.gep2 == 1 && CUR.zp2.n_contours > 0 ) {
+    else if ( CUR.GS.gep2 == 1 && CUR.zp2.n_contours > 0 )
       limit = (FT_UShort)( CUR.zp2.contours[CUR.zp2.n_contours - 1] + 1 );
-          if (limit >= CUR.zp2.n_points)                /* XYQ 2010-10-01: security fix: validate last point index */
-                  limit = CUR.zp2.n_points - 1;
-        }
     else
       limit = 0;
 
     /* XXX: UNDOCUMENTED! SHZ doesn't touch the points */
     for ( i = 0; i < limit; i++ )
     {
       if ( zp.cur != CUR.zp2.cur || refp != i )
         MOVE_Zp2_Point( i, dx, dy, FALSE );
     }
   }
@@ skipping 546 matching lines @@
 
 #ifdef TT_CONFIG_OPTION_SUBPIXEL_HINTING
     if ( SUBPIXEL_HINTING                                  &&
          CUR.ignore_x_mode                                 &&
          CUR.GS.freeVector.x != 0                          &&
          !( CUR.sph_tweak_flags & SPH_TWEAK_NORMAL_ROUND ) )
       control_value_cutin = minimum_distance = 0;
 #endif /* TT_CONFIG_OPTION_SUBPIXEL_HINTING */
 
     /* XXX: UNDOCUMENTED! cvt[-1] = 0 always */
-        /* Security fix: Google 07_oobread4.pdf page #1, cvtEntry > CUR.cvtSize + 1 will cause array index oob. */
+
     if ( BOUNDS( point,      CUR.zp1.n_points ) ||
-         BOUNDS( cvtEntry,  CUR.cvtSize + 1 )  ||
+         BOUNDSL( cvtEntry,  CUR.cvtSize + 1 )  ||
          BOUNDS( CUR.GS.rp0, CUR.zp0.n_points ) )
     {
       if ( CUR.pedantic_hinting )
         CUR.error = FT_THROW( Invalid_Reference );
       goto Fail;
     }
 
     if ( !cvtEntry )
       cvt_dist = 0;
     else
@@ skipping 472 matching lines @@
 
 
         vec.x = FT_MulFix( CUR.zp2.orus[point].x - orus_base->x,
                            CUR.metrics.x_scale );
         vec.y = FT_MulFix( CUR.zp2.orus[point].y - orus_base->y,
                            CUR.metrics.y_scale );
 
         org_dist = CUR_fast_dualproj( &vec );
       }
 
-      cur_dist = CUR_Func_project ( &CUR.zp2.cur[point], cur_base );
+      cur_dist = CUR_Func_project( &CUR.zp2.cur[point], cur_base );
 
       if ( org_dist )
       {
         if ( old_range )
           new_dist = FT_MulDiv( org_dist, cur_range, old_range );
         else
         {
           /* This is the same as what MS does for the invalid case:  */
           /*                                                         */
           /*   delta = (Original_Pt - Original_RP1) -                */
-          /*           (Current_Pt - Current_RP1)                    */
+          /*           (Current_Pt - Current_RP1)         ;          */
           /*                                                         */
           /* In FreeType speak:                                      */
           /*                                                         */
-          /*   new_dist = cur_dist -                                 */
-          /*              org_dist - cur_dist;                       */
+          /*   delta = org_dist - cur_dist          .                */
+          /*                                                         */
+          /* We move `point' by `new_dist - cur_dist' after leaving  */
+          /* this block, thus we have                                */
+          /*                                                         */
+          /*   new_dist - cur_dist = delta                   ,       */
+          /*   new_dist - cur_dist = org_dist - cur_dist     ,       */
+          /*              new_dist = org_dist                .       */
 
-          new_dist = -org_dist;
+          new_dist = org_dist;
         }
       }
       else
         new_dist = 0;
 
       CUR_Func_move( &CUR.zp2, (FT_UShort)point, new_dist - cur_dist );
     }
 
   Fail:
     CUR.GS.loop = 1;
@@ skipping 276 matching lines @@
 
   /*************************************************************************/
   /*                                                                       */
   /* DELTAPn[]:    DELTA exceptions P1, P2, P3                             */
   /* Opcode range: 0x5D,0x71,0x72                                          */
   /* Stack:        uint32 (2 * uint32)... -->                              */
   /*                                                                       */
   static void
   Ins_DELTAP( INS_ARG )
   {
-    FT_ULong   k, nump;
+    FT_ULong   nump, k;
     FT_UShort  A;
-    FT_ULong   C;
+    FT_ULong   C, P;
     FT_Long    B;
 #ifdef TT_CONFIG_OPTION_SUBPIXEL_HINTING
     FT_UShort  B1, B2;
 
 
     if ( SUBPIXEL_HINTING                                        &&
          CUR.ignore_x_mode                                       &&
          CUR.iup_called                                          &&
          ( CUR.sph_tweak_flags & SPH_TWEAK_NO_DELTAP_AFTER_IUP ) )
       goto Fail;
@@ skipping 13 matching lines @@
           CUR.error = FT_THROW( Too_Few_Arguments );
         n = CUR.args;
       }
 
       CUR.args -= n;
       CUR.new_top = CUR.args;
       return;
     }
 #endif
 
+    P = (FT_ULong)CUR_Func_cur_ppem();
     nump = (FT_ULong)args[0];   /* some points theoretically may occur more
                                    than once, thus UShort isn't enough */
 
     for ( k = 1; k <= nump; k++ )
     {
       if ( CUR.args < 2 )
       {
         if ( CUR.pedantic_hinting )
           CUR.error = FT_THROW( Too_Few_Arguments );
         CUR.args = 0;
@@ skipping 24 matching lines @@
           C += 16;
           break;
 
         case 0x72:
           C += 32;
           break;
         }
 
         C += CUR.GS.delta_base;
 
-        if ( CURRENT_Ppem() == (FT_Long)C )
+        if ( P == C )
         {
           B = ( (FT_ULong)B & 0xF ) - 8;
           if ( B >= 0 )
             B++;
-          B = B * 64 / ( 1L << CUR.GS.delta_shift );
+          B *= 1L << ( 6 - CUR.GS.delta_shift );
 
 #ifdef TT_CONFIG_OPTION_SUBPIXEL_HINTING
 
           if ( SUBPIXEL_HINTING )
           {
             /*
              *  Allow delta move if
              *
-             *  - not using ignore_x_mode rendering
-             *  - glyph is specifically set to allow it
-             *  - glyph is composite and freedom vector is not subpixel
-             *    vector
+             *  - not using ignore_x_mode rendering,
+             *  - glyph is specifically set to allow it, or
+             *  - glyph is composite and freedom vector is not in subpixel
+             *    direction.
              */
             if ( !CUR.ignore_x_mode                                   ||
                  ( CUR.sph_tweak_flags & SPH_TWEAK_ALWAYS_DO_DELTAP ) ||
                  ( CUR.is_composite && CUR.GS.freeVector.y != 0 )     )
               CUR_Func_move( &CUR.zp0, A, B );
 
-            /* Otherwise apply subpixel hinting and */
-            /* compatibility mode rules             */
-            else if ( CUR.ignore_x_mode )
+            /* Otherwise, apply subpixel hinting and compatibility mode */
+            /* rules, always skipping deltas in subpixel direction.     */
+            else if ( CUR.ignore_x_mode && CUR.GS.freeVector.y != 0 )
             {
-              if ( CUR.GS.freeVector.y != 0 )
-                B1 = CUR.zp0.cur[A].y;
-              else
-                B1 = CUR.zp0.cur[A].x;
+              /* save the y value of the point now; compare after move */
+              B1 = (FT_UShort)CUR.zp0.cur[A].y;
 
-#if 0
-              /* Standard Subpixel Hinting: Allow y move.       */
-              /* This messes up dejavu and may not be needed... */
-              if ( !CUR.face->sph_compatibility_mode &&
-                   CUR.GS.freeVector.y != 0          )
+              /* Standard subpixel hinting: Allow y move for y-touched */
+              /* points.  This messes up DejaVu ...                    */
+              if ( !CUR.face->sph_compatibility_mode          &&
+                   ( CUR.zp0.tags[A] & FT_CURVE_TAG_TOUCH_Y ) )
                 CUR_Func_move( &CUR.zp0, A, B );
-              else
-#endif /* 0 */
 
-              /* Compatibility Mode: Allow x or y move if point touched in */
-              /* Y direction.                                              */
-              if ( CUR.face->sph_compatibility_mode                      &&
-                   !( CUR.sph_tweak_flags & SPH_TWEAK_ALWAYS_SKIP_DELTAP ) )
+              /* compatibility mode */
+              else if ( CUR.face->sph_compatibility_mode                      &&
+                        !( CUR.sph_tweak_flags & SPH_TWEAK_ALWAYS_SKIP_DELTAP ) )
               {
-                /* save the y value of the point now; compare after move */
-                B1 = CUR.zp0.cur[A].y;
-
                 if ( CUR.sph_tweak_flags & SPH_TWEAK_ROUND_NONPIXEL_Y_MOVES )
                   B = FT_PIX_ROUND( B1 + B ) - B1;
 
                 /* Allow delta move if using sph_compatibility_mode,   */
                 /* IUP has not been called, and point is touched on Y. */
                 if ( !CUR.iup_called                            &&
                      ( CUR.zp0.tags[A] & FT_CURVE_TAG_TOUCH_Y ) )
                   CUR_Func_move( &CUR.zp0, A, B );
               }
 
-              B2 = CUR.zp0.cur[A].y;
+              B2 = (FT_UShort)CUR.zp0.cur[A].y;
 
               /* Reverse this move if it results in a disallowed move */
               if ( CUR.GS.freeVector.y != 0                           &&
                    ( ( CUR.face->sph_compatibility_mode           &&
                        ( B1 & 63 ) == 0                           &&
                        ( B2 & 63 ) != 0                           ) ||
                      ( ( CUR.sph_tweak_flags                    &
                          SPH_TWEAK_SKIP_NONPIXEL_Y_MOVES_DELTAP ) &&
                        ( B1 & 63 ) != 0                           &&
                        ( B2 & 63 ) != 0                           ) ) )
@@ skipping 19 matching lines @@
   /*************************************************************************/
   /*                                                                       */
   /* DELTACn[]:    DELTA exceptions C1, C2, C3                             */
   /* Opcode range: 0x73,0x74,0x75                                          */
   /* Stack:        uint32 (2 * uint32)... -->                              */
   /*                                                                       */
   static void
   Ins_DELTAC( INS_ARG )
   {
     FT_ULong  nump, k;
-    FT_ULong  A, C;
+    FT_ULong  A, C, P;
     FT_Long   B;
 
 
 #ifdef TT_CONFIG_OPTION_UNPATENTED_HINTING
     /* Delta hinting is covered by US Patent 5159668. */
     if ( CUR.face->unpatented_hinting )
     {
       FT_Long  n = args[0] * 2;
 
 
       if ( CUR.args < n )
       {
         if ( CUR.pedantic_hinting )
           CUR.error = FT_THROW( Too_Few_Arguments );
         n = CUR.args;
       }
 
       CUR.args -= n;
       CUR.new_top = CUR.args;
       return;
     }
 #endif
 
+    P = (FT_ULong)CUR_Func_cur_ppem();
     nump = (FT_ULong)args[0];
 
     for ( k = 1; k <= nump; k++ )
     {
       if ( CUR.args < 2 )
       {
         if ( CUR.pedantic_hinting )
           CUR.error = FT_THROW( Too_Few_Arguments );
         CUR.args = 0;
         goto Fail;
@@ skipping 25 matching lines @@
           C += 16;
           break;
 
         case 0x75:
           C += 32;
           break;
         }
 
         C += CUR.GS.delta_base;
 
-        if ( CURRENT_Ppem() == (FT_Long)C )
+        if ( P == C )
         {
           B = ( (FT_ULong)B & 0xF ) - 8;
           if ( B >= 0 )
             B++;
-          B = B * 64 / ( 1L << CUR.GS.delta_shift );
+          B *= 1L << ( 6 - CUR.GS.delta_shift );
 
           CUR_Func_move_cvt( A, B );
         }
       }
     }
 
   Fail:
     CUR.new_top = CUR.args;
   }
 
@@ skipping 61 matching lines @@
     /*                              */
     if ( ( args[0] & 32 ) != 0 && CUR.grayscale )
       K |= 1 << 12;
 
 #ifdef TT_CONFIG_OPTION_SUBPIXEL_HINTING
 
     if ( SUBPIXEL_HINTING                                    &&
          CUR.ignore_x_mode                                   &&
          CUR.rasterizer_version >= TT_INTERPRETER_VERSION_35 )
     {
-      /********************************/
-      /* HINTING FOR GRAYSCALE        */
-      /* Selector Bit:  5             */
-      /* Return Bit(s): 12            */
-      /*                              */
-      if ( ( args[0] & 32 ) != 0 && CUR.grayscale_hinting )
-        K |= 1 << 12;
 
-      /********************************/
-      /* HINTING FOR SUBPIXEL         */
-      /* Selector Bit:  6             */
-      /* Return Bit(s): 13            */
-      /*                              */
-      if ( ( args[0] & 64 ) != 0        &&
-           CUR.subpixel_hinting         &&
-           CUR.rasterizer_version >= 37 )
+      if ( CUR.rasterizer_version >= 37 )
       {
-        K |= 1 << 13;
-
-        /* the stuff below is irrelevant if subpixel_hinting is not set */
+        /********************************/
+        /* HINTING FOR SUBPIXEL         */
+        /* Selector Bit:  6             */
+        /* Return Bit(s): 13            */
+        /*                              */
+        if ( ( args[0] & 64 ) != 0 && CUR.subpixel )
+          K |= 1 << 13;
 
         /********************************/
         /* COMPATIBLE WIDTHS ENABLED    */
         /* Selector Bit:  7             */
         /* Return Bit(s): 14            */
         /*                              */
         /* Functionality still needs to be added */
         if ( ( args[0] & 128 ) != 0 && CUR.compatible_widths )
           K |= 1 << 14;
 
@@ skipping 55 matching lines @@
         {
           CUR.error = FT_THROW( Stack_Overflow );
           return;
         }
 
         call = CUR.callStack + CUR.callTop++;
 
         call->Caller_Range = CUR.curRange;
         call->Caller_IP    = CUR.IP + 1;
         call->Cur_Count    = 1;
-        call->Cur_Restart  = def->start;
-        call->Cur_End      = def->end;
+        call->Def          = def;
 
         INS_Goto_CodeRange( def->range, def->start );
 
         CUR.step_ins = FALSE;
         return;
       }
     }
 
     CUR.error = FT_THROW( Invalid_Opcode );
   }
@@ skipping 333 matching lines @@
                     0x7D, /* RDTG    */
                   },
                 };
     FT_UShort  opcode_patterns   = 1;
     FT_UShort  opcode_pointer[1] = { 0 };
     FT_UShort  opcode_size[1]    = { 1 };
 #endif /* TT_CONFIG_OPTION_SUBPIXEL_HINTING */
 
 
 #ifdef TT_CONFIG_OPTION_STATIC_RASTER
+    if ( !exc )
+      return FT_THROW( Invalid_Argument );
+
     cur = *exc;
 #endif
 
 #ifdef TT_CONFIG_OPTION_SUBPIXEL_HINTING
     CUR.iup_called = FALSE;
 #endif /* TT_CONFIG_OPTION_SUBPIXEL_HINTING */
 
-    /* set CVT functions */
+    /* set PPEM and CVT functions */
     CUR.tt_metrics.ratio = 0;
     if ( CUR.metrics.x_ppem != CUR.metrics.y_ppem )
     {
       /* non-square pixels, use the stretched routines */
+      CUR.func_cur_ppem  = Current_Ppem_Stretched;
       CUR.func_read_cvt  = Read_CVT_Stretched;
       CUR.func_write_cvt = Write_CVT_Stretched;
       CUR.func_move_cvt  = Move_CVT_Stretched;
     }
     else
     {
       /* square pixels, use normal routines */
+      CUR.func_cur_ppem  = Current_Ppem;
       CUR.func_read_cvt  = Read_CVT;
       CUR.func_write_cvt = Write_CVT;
       CUR.func_move_cvt  = Move_CVT;
     }
 
     COMPUTE_Funcs();
     COMPUTE_Round( (FT_Byte)exc->GS.round_state );
 
     do
     {
@@ skipping 663 matching lines @@
                 {
                   CUR.error = FT_THROW( Invalid_Reference );
                   goto LErrorLabel_;
                 }
 
                 callrec = &CUR.callStack[CUR.callTop];
 
                 callrec->Caller_Range = CUR.curRange;
                 callrec->Caller_IP    = CUR.IP + 1;
                 callrec->Cur_Count    = 1;
-                callrec->Cur_Restart  = def->start;
-                callrec->Cur_End      = def->end;
+                callrec->Def          = def;
 
                 if ( INS_Goto_CodeRange( def->range, def->start ) == FAILURE )
                   goto LErrorLabel_;
 
                 goto LSuiteLabel_;
               }
             }
           }
 
           CUR.error = FT_THROW( Invalid_Opcode );
@@ skipping 50 matching lines @@
 
   LErrorLabel_:
 
 #ifdef TT_CONFIG_OPTION_STATIC_RASTER
     *exc = cur;
 #endif
 
     /* If any errors have occurred, function tables may be broken. */
     /* Force a re-execution of `prep' and `fpgm' tables if no      */
     /* bytecode debugger is run.                                   */
-    if ( CUR.error && !CUR.instruction_trap )
+    if ( CUR.error
+         && !CUR.instruction_trap
+         && CUR.curRange == tt_coderange_glyph )
     {
       FT_TRACE1(( "  The interpreter returned error 0x%x\n", CUR.error ));
-      exc->size->cvt_ready      = FALSE;
+      exc->size->bytecode_ready = -1;
+      exc->size->cvt_ready      = -1;
     }
 
     return CUR.error;
   }
 
 
 #endif /* TT_USE_BYTECODE_INTERPRETER */
 
 
 /* END */