[otfallback] Never fallback-position a below-mark upwards

Test with WinXP times.ttf and U+05D9,U+05B5.

src/hb-ot-shape-fallback.cc

diff --git a/src/hb-ot-shape-fallback.cc b/src/hb-ot-shape-fallback.cc
index b7fd2d3..2af924e 100644
--- a/src/hb-ot-shape-fallback.cc
+++ b/src/hb-ot-shape-fallback.cc
@@ -261,6 +261,12 @@
     case HB_UNICODE_COMBINING_CLASS_ATTACHED_BELOW_LEFT:
     case HB_UNICODE_COMBINING_CLASS_ATTACHED_BELOW:
       pos.y_offset = base_extents.y_bearing + base_extents.height - mark_extents.y_bearing;
+      /* Never shift a "below" mark upwards. */
+      if ((y_gap > 0) == (pos.y_offset > 0))
+      {
+	base_extents.height -= pos.y_offset;
+	pos.y_offset = 0;
+      }
       base_extents.height += mark_extents.height;
       break;