[OT] Fix ReverseChainingSubst

We should make it clear that we don't want output buffer in this case,
otherwise buffer->backtrack_len() would be wrong.

src/hb-buffer-private.hh

diff --git a/src/hb-buffer-private.hh b/src/hb-buffer-private.hh
index 67a2752..c1acffd 100644
--- a/src/hb-buffer-private.hh
+++ b/src/hb-buffer-private.hh
@@ -153,6 +153,7 @@
   HB_INTERNAL void guess_properties (void);
 
   HB_INTERNAL void swap_buffers (void);
+  HB_INTERNAL void remove_output (void);
   HB_INTERNAL void clear_output (void);
   HB_INTERNAL void clear_positions (void);
 

src/hb-buffer.cc

diff --git a/src/hb-buffer.cc b/src/hb-buffer.cc
index b65beff..1eb513c 100644
--- a/src/hb-buffer.cc
+++ b/src/hb-buffer.cc
@@ -183,6 +183,19 @@
 }
 
 void
+hb_buffer_t::remove_output (void)
+{
+  if (unlikely (hb_object_is_inert (this)))
+    return;
+
+  have_output = false;
+  have_positions = false;
+
+  out_len = 0;
+  out_info = info;
+}
+
+void
 hb_buffer_t::clear_output (void)
 {
   if (unlikely (hb_object_is_inert (this)))

src/hb-ot-layout-gsub-table.hh

diff --git a/src/hb-ot-layout-gsub-table.hh b/src/hb-ot-layout-gsub-table.hh
index 90faa79..05b18cc 100644
--- a/src/hb-ot-layout-gsub-table.hh
+++ b/src/hb-ot-layout-gsub-table.hh
@@ -1343,6 +1343,7 @@
     else
     {
 	/* in-place backward substitution */
+	c->buffer->remove_output ();
 	c->buffer->idx = c->buffer->len - 1;
 	do
 	{