Fix previous commit, ouch!
diff --git a/src/hb-open-type-private.hh b/src/hb-open-type-private.hh
index 9530c28..add6846 100644
--- a/src/hb-open-type-private.hh
+++ b/src/hb-open-type-private.hh
@@ -511,6 +511,18 @@
   const Type *const_array(void) const { return CONST_ARRAY_AFTER (Type, len); }
   Type *array(void) { return ARRAY_AFTER (Type, len); }
 
+  const Type *const_sub_array (unsigned int start_offset, unsigned int *pcount /* IN/OUT */) const
+  {
+    unsigned int count = len;
+    if (HB_UNLIKELY (start_offset > count))
+      count = 0;
+    else
+      count -= start_offset;
+    count = MIN (count, *pcount);
+    *pcount = count;
+    return const_array() + start_offset;
+  }
+
   inline const Type& operator [] (unsigned int i) const
   {
     if (HB_UNLIKELY (i >= len)) return Null(Type);
diff --git a/src/hb-ot-layout-common-private.hh b/src/hb-ot-layout-common-private.hh
index 704ab19..f8749a1 100644
--- a/src/hb-ot-layout-common-private.hh
+++ b/src/hb-ot-layout-common-private.hh
@@ -74,12 +74,10 @@
 				hb_tag_t     *record_tags /* OUT */) const
   {
     if (record_count) {
-      unsigned int count = MIN (MIN (0, (unsigned int) this->len - start_offset), *record_count);
-      const Record<Type> *array = this->const_array() + start_offset;
+      const Record<Type> *array = this->const_sub_array (start_offset, record_count);
+      unsigned int count = *record_count;
       for (unsigned int i = 0; i < count; i++)
 	record_tags[i] = array[i].tag;
-
-      *record_count = this->len;
     }
     return this->len;
   }
@@ -128,12 +126,10 @@
 				   unsigned int *_indexes /* OUT */) const
   {
     if (_count) {
-      unsigned int count = MIN (MIN (0, (unsigned int) this->len - start_offset), *_count);
-      const USHORT *array = this->const_array() + start_offset;
+      const USHORT *array = this->const_sub_array (start_offset, _count);
+      unsigned int count = *_count;
       for (unsigned int i = 0; i < count; i++)
 	_indexes[i] = array[i];
-
-      *_count = this->len;
     }
     return this->len;
   }
diff --git a/src/hb-ot-layout-gdef-private.hh b/src/hb-ot-layout-gdef-private.hh
index d96bb16..9c829e2 100644
--- a/src/hb-ot-layout-gdef-private.hh
+++ b/src/hb-ot-layout-gdef-private.hh
@@ -58,12 +58,10 @@
     const AttachPoint &points = this+attachPoint[index];
 
     if (point_count) {
-      const USHORT *array = points.const_array () + start_offset;
-      unsigned int count = MIN (MIN (0, (unsigned int) points.len - start_offset), *point_count);
+      const USHORT *array = points.const_sub_array (start_offset, point_count);
+      unsigned int count = *point_count;
       for (unsigned int i = 0; i < count; i++)
 	point_array[i] = array[i];
-
-      *point_count = points.len;
     }
 
     return points.len;
@@ -198,12 +196,10 @@
 				      int *caret_array /* OUT */) const
   {
     if (caret_count) {
-      const OffsetTo<CaretValue> *array = carets.const_array () + start_offset;
-      unsigned int count = MIN (MIN (0, (unsigned int) carets.len - start_offset), *caret_count);
+      const OffsetTo<CaretValue> *array = carets.const_sub_array (start_offset, caret_count);
+      unsigned int count = *caret_count;
       for (unsigned int i = 0; i < count; i++)
 	caret_array[i] = (this+array[i]).get_caret_value (context, glyph_id);
-
-      *caret_count = carets.len;
     }
 
     return carets.len;