commit fde3e4a423871463c883cb969e99c29cb6f69f6b
author Behdad Esfahbod <behdad@behdad.org> Wed Oct 29 11:23:08 2014 -0700
committer Behdad Esfahbod <behdad@behdad.org> Wed Oct 29 11:23:08 2014 -0700
tree 53b0e74edf4a9b9722624bbf40b1014ba4c8f125
parent 5a5640d8506ccfc99fd119e89e829170d1fea421

In hb_ot_collect_glyphs(), don't recurse to a lookup more than once

Otherwise, we might process a lookup thousands of times, with no
benefit.  This pathological case was hit by Noto Nastaliq Urdu Draft
in Firefox's code to determine whether space glyph is involved in
any GSUB/GPOS rules.  A test page is at http://behdad.org/urdu

See:
https://bugzilla.mozilla.org/show_bug.cgi?id=1090869

src/hb-ot-layout-gsubgpos-private.hh

diff --git a/src/hb-ot-layout-gsubgpos-private.hh b/src/hb-ot-layout-gsubgpos-private.hh
index 546ff4b..7106870 100644
--- a/src/hb-ot-layout-gsubgpos-private.hh
+++ b/src/hb-ot-layout-gsubgpos-private.hh
@@ -168,6 +168,10 @@
     if (output == hb_set_get_empty ())
       return HB_VOID;
 
+    /* Return if new lookup was recursed to before. */
+    if (recursed_lookups.has (lookup_index))
+      return HB_VOID;
+
     hb_set_t *old_before = before;
     hb_set_t *old_input  = input;
     hb_set_t *old_after  = after;
@@ -181,6 +185,8 @@
     input  = old_input;
     after  = old_after;
 
+    recursed_lookups.add (lookup_index);
+
     return HB_VOID;
   }
 
@@ -190,6 +196,7 @@
   hb_set_t *after;
   hb_set_t *output;
   recurse_func_t recurse_func;
+  hb_set_t recursed_lookups;
   unsigned int nesting_level_left;
   unsigned int debug_depth;
 
@@ -205,8 +212,16 @@
 			      after  (glyphs_after  ? glyphs_after  : hb_set_get_empty ()),
 			      output (glyphs_output ? glyphs_output : hb_set_get_empty ()),
 			      recurse_func (NULL),
+			      recursed_lookups (),
 			      nesting_level_left (nesting_level_left_),
-			      debug_depth (0) {}
+			      debug_depth (0)
+  {
+    recursed_lookups.init ();
+  }
+  ~hb_collect_glyphs_context_t (void)
+  {
+    recursed_lookups.fini ();
+  }
 
   void set_recurse_func (recurse_func_t func) { recurse_func = func; }
 };