[OT] Fix ReverseChainingSubst

We should make it clear that we don't want output buffer in this case,
otherwise buffer->backtrack_len() would be wrong.

src/hb-buffer-private.hh

@@ -153,6 +153,7 @@ struct hb_buffer_t {
   HB_INTERNAL void guess_properties (void);
 
   HB_INTERNAL void swap_buffers (void);
+  HB_INTERNAL void remove_output (void);
   HB_INTERNAL void clear_output (void);
   HB_INTERNAL void clear_positions (void);
 

src/hb-buffer.cc

@@ -182,6 +182,19 @@ hb_buffer_t::add (hb_codepoint_t  codepoint,
   len++;
 }
 
+void
+hb_buffer_t::remove_output (void)
+{
+  if (unlikely (hb_object_is_inert (this)))
+    return;
+
+  have_output = false;
+  have_positions = false;
+
+  out_len = 0;
+  out_info = info;
+}
+
 void
 hb_buffer_t::clear_output (void)
 {

src/hb-ot-layout-gsub-table.hh

@@ -1343,6 +1343,7 @@ struct SubstLookup : Lookup
     else
     {
 	/* in-place backward substitution */
+	c->buffer->remove_output ();
 	c->buffer->idx = c->buffer->len - 1;
 	do
 	{