[ENOMEM] in GSUB ChainContext subsetting check maps for allocation errors.

src/hb-ot-layout-gsubgpos.hh

@@ -2777,13 +2777,19 @@ struct ChainContextFormat2
 
     hb_map_t backtrack_klass_map;
     out->backtrackClassDef.serialize_subset (c, backtrackClassDef, this, &backtrack_klass_map);
+    if (unlikely (!c->serializer->check_success (!backtrack_klass_map.in_error ())))
+      return_trace (false);
 
     // subset inputClassDef based on glyphs survived in Coverage subsetting
     hb_map_t input_klass_map;
     out->inputClassDef.serialize_subset (c, inputClassDef, this, &input_klass_map);
+    if (unlikely (!c->serializer->check_success (!input_klass_map.in_error ())))
+      return_trace (false);
 
     hb_map_t lookahead_klass_map;
     out->lookaheadClassDef.serialize_subset (c, lookaheadClassDef, this, &lookahead_klass_map);
+    if (unlikely (!c->serializer->check_success (!lookahead_klass_map.in_error ())))
+      return_trace (false);
 
     unsigned non_zero_index = 0, index = 0;
     bool ret = true;