diff --git a/src/hb-open-type-private.hh b/src/hb-open-type-private.hh
index bb1b93021..82f92c1a3 100644
--- a/src/hb-open-type-private.hh
+++ b/src/hb-open-type-private.hh
@@ -230,7 +230,7 @@ _hb_sanitize_edit (SANITIZE_ARG_DEF,
 #define SANITIZE(X) likely ((X).sanitize (SANITIZE_ARG))
 
 #define SANITIZE_THIS(X) likely ((X).sanitize (SANITIZE_ARG, CharP(this)))
-#define SANITIZE_BASE(X,B) likely ((X).sanitize (SANITIZE_ARG, B))
+#define SANITIZE_WITH_BASE(B,X) likely ((X).sanitize (SANITIZE_ARG, (B)))
 
 #define SANITIZE_SELF() SANITIZE_MEM(this, sizeof (*this))
 
@@ -443,21 +443,24 @@ struct GenericOffsetTo : OffsetType
     if (!SANITIZE_SELF ()) return false;
     unsigned int offset = *this;
     if (unlikely (!offset)) return true;
-    return SANITIZE (StructAtOffset<Type> (*CharP(base), offset)) || neuter (SANITIZE_ARG);
+    Type &obj = StructAtOffset<Type> (*CharP(base), offset);
+    return likely (obj.sanitize (SANITIZE_ARG)) || neuter (SANITIZE_ARG);
   }
   inline bool sanitize (SANITIZE_ARG_DEF, void *base, void *base2) {
     TRACE_SANITIZE ();
     if (!SANITIZE_SELF ()) return false;
     unsigned int offset = *this;
     if (unlikely (!offset)) return true;
-    return SANITIZE_BASE (StructAtOffset<Type> (*CharP(base), offset), base2) || neuter (SANITIZE_ARG);
+    Type &obj = StructAtOffset<Type> (*CharP(base), offset);
+    return likely (obj.sanitize (SANITIZE_ARG, base2)) || neuter (SANITIZE_ARG);
   }
   inline bool sanitize (SANITIZE_ARG_DEF, void *base, unsigned int user_data) {
     TRACE_SANITIZE ();
     if (!SANITIZE_SELF ()) return false;
     unsigned int offset = *this;
     if (unlikely (!offset)) return true;
-    return SANITIZE_BASE (StructAtOffset<Type> (*CharP(base), offset), user_data) || neuter (SANITIZE_ARG);
+    Type &obj = StructAtOffset<Type> (*CharP(base), offset);
+    return likely (obj.sanitize (SANITIZE_ARG, user_data)) || neuter (SANITIZE_ARG);
   }
 
   private:
diff --git a/src/hb-ot-layout-common-private.hh b/src/hb-ot-layout-common-private.hh
index 7ecc5bdd5..1b3e27896 100644
--- a/src/hb-ot-layout-common-private.hh
+++ b/src/hb-ot-layout-common-private.hh
@@ -55,7 +55,8 @@ struct Record
 
   inline bool sanitize (SANITIZE_ARG_DEF, void *base) {
     TRACE_SANITIZE ();
-    return SANITIZE_SELF () && SANITIZE_BASE (offset, base);
+    return SANITIZE_SELF ()
+	&& SANITIZE_WITH_BASE (base, offset);
   }
 
   Tag		tag;		/* 4-byte Tag identifier */
diff --git a/src/hb-ot-layout-gpos-private.hh b/src/hb-ot-layout-gpos-private.hh
index 4fce10aa8..36345cbf2 100644
--- a/src/hb-ot-layout-gpos-private.hh
+++ b/src/hb-ot-layout-gpos-private.hh
@@ -137,10 +137,10 @@ struct ValueFormat : USHORT
     if (format & xAdvance)   values++;
     if (format & yAdvance)   values++;
 
-    if ((format & xPlaDevice) && !SANITIZE_BASE (*(OffsetTo<Device>*)values++, base)) return false;
-    if ((format & yPlaDevice) && !SANITIZE_BASE (*(OffsetTo<Device>*)values++, base)) return false;
-    if ((format & xAdvDevice) && !SANITIZE_BASE (*(OffsetTo<Device>*)values++, base)) return false;
-    if ((format & yAdvDevice) && !SANITIZE_BASE (*(OffsetTo<Device>*)values++, base)) return false;
+    if ((format & xPlaDevice) && !SANITIZE_WITH_BASE (base, *(OffsetTo<Device>*)values++)) return false;
+    if ((format & yPlaDevice) && !SANITIZE_WITH_BASE (base, *(OffsetTo<Device>*)values++)) return false;
+    if ((format & xAdvDevice) && !SANITIZE_WITH_BASE (base, *(OffsetTo<Device>*)values++)) return false;
+    if ((format & yAdvDevice) && !SANITIZE_WITH_BASE (base, *(OffsetTo<Device>*)values++)) return false;
 
     return true;
   }
@@ -360,7 +360,8 @@ struct MarkRecord
 
   inline bool sanitize (SANITIZE_ARG_DEF, void *base) {
     TRACE_SANITIZE ();
-    return SANITIZE_SELF () && SANITIZE_BASE (markAnchor, base);
+    return SANITIZE_SELF ()
+	&& SANITIZE_WITH_BASE (base, markAnchor);
   }
 
   private:
@@ -781,8 +782,8 @@ struct EntryExitRecord
 
   inline bool sanitize (SANITIZE_ARG_DEF, void *base) {
     TRACE_SANITIZE ();
-    return SANITIZE_BASE (entryAnchor, base)
-	&& SANITIZE_BASE (exitAnchor, base);
+    return SANITIZE_WITH_BASE (base, entryAnchor)
+	&& SANITIZE_WITH_BASE (base, exitAnchor);
   }
 
   OffsetTo<Anchor>