diff --git a/src/Makefile.am b/src/Makefile.am
index fbd8f6023..9632b4df6 100644
--- a/src/Makefile.am
+++ b/src/Makefile.am
@@ -195,7 +195,7 @@ libharfbuzz_subset_fuzzing_la_LINK = $(chosen_linker) $(libharfbuzz_subset_fuzzi
 libharfbuzz_subset_fuzzing_la_SOURCES = $(libharfbuzz_subset_la_SOURCES)
 libharfbuzz_subset_fuzzing_la_CPPFLAGS = $(HBCFLAGS) $(FUZZING_CPPFLAGS)
 libharfbuzz_subset_fuzzing_la_LDFLAGS = $(AM_LDFLAGS)
-libharfbuzz_subset_fuzzing_la_LIBADD = $(libharfbuzz_subset_la_LIBADD)
+libharfbuzz_subset_fuzzing_la_LIBADD = libharfbuzz-fuzzing.la
 EXTRA_libharfbuzz_subset_fuzzing_la_DEPENDENCIES = $(EXTRA_libharfbuzz_subset_la_DEPENDENCIES)
 CLEANFILES += libharfbuzz-subset-fuzzing.la
 
diff --git a/src/hb-aat-layout-kerx-table.hh b/src/hb-aat-layout-kerx-table.hh
index 3cd80acfd..6b61186a9 100644
--- a/src/hb-aat-layout-kerx-table.hh
+++ b/src/hb-aat-layout-kerx-table.hh
@@ -262,10 +262,12 @@ struct KerxSubTableFormat1
 
       if (Format1EntryT::performAction (entry))
       {
+	unsigned int tuple_count = MAX (1u, table->header.tuple_count ());
+
 	unsigned int kern_idx = Format1EntryT::kernActionIndex (entry);
 	kern_idx = Types::offsetToIndex (kern_idx, &table->machine, kernAction.arrayZ);
 	const FWORD *actions = &kernAction[kern_idx];
-	if (!c->sanitizer.check_array (actions, depth))
+	if (!c->sanitizer.check_array (actions, depth * tuple_count))
 	{
 	  depth = 0;
 	  return false;
@@ -276,8 +278,6 @@ struct KerxSubTableFormat1
 	/* From Apple 'kern' spec:
 	 * "Each pops one glyph from the kerning stack and applies the kerning value to it.
 	 * The end of the list is marked by an odd value... */
-	unsigned int tuple_count = table->header.tuple_count ();
-	tuple_count = tuple_count ? tuple_count : 1;
 	bool last = false;
 	while (!last && depth--)
 	{
diff --git a/src/hb-blob.cc b/src/hb-blob.cc
index 9271200b1..26c0d143e 100644
--- a/src/hb-blob.cc
+++ b/src/hb-blob.cc
@@ -53,18 +53,6 @@
  **/
 
 
-DEFINE_NULL_INSTANCE (hb_blob_t) =
-{
-  HB_OBJECT_HEADER_STATIC,
-
-  nullptr, /* data */
-  0, /* length */
-  HB_MEMORY_MODE_READONLY, /* mode */
-
-  nullptr, /* user_data */
-  nullptr  /* destroy */
-};
-
 /**
  * hb_blob_create: (skip)
  * @data: Pointer to blob data.
diff --git a/src/hb-blob.hh b/src/hb-blob.hh
index 1f7499fbf..802b1f07e 100644
--- a/src/hb-blob.hh
+++ b/src/hb-blob.hh
@@ -77,7 +77,30 @@ struct hb_blob_t
   void *user_data;
   hb_destroy_func_t destroy;
 };
-DECLARE_NULL_INSTANCE (hb_blob_t);
+
+
+/*
+ * hb_blob_ptr_t
+ */
+
+template <typename P>
+struct hb_blob_ptr_t
+{
+  typedef typename hb_remove_pointer<P>::value T;
+
+  inline hb_blob_ptr_t (hb_blob_t *b_ = nullptr) : b (b_) {}
+  inline hb_blob_t * operator = (hb_blob_t *b_) { return b = b_; }
+  inline const T * operator -> (void) const { return get (); }
+  inline const T & operator * (void) const { return *get (); }
+  template <typename C> inline operator const C * (void) const { return get (); }
+  inline operator const char * (void) const { return (const char *) get (); }
+  inline const T * get (void) const { return b->as<T> (); }
+  inline hb_blob_t * get_blob (void) const { return b.get_raw (); }
+  inline unsigned int get_length (void) const { return b.get ()->length; }
+  inline void destroy (void) { hb_blob_destroy (b.get ()); b = nullptr; }
+
+  hb_nonnull_ptr_t<hb_blob_t> b;
+};
 
 
 #endif /* HB_BLOB_HH */
diff --git a/src/hb-coretext.cc b/src/hb-coretext.cc
index 893a8761d..3cedb5b29 100644
--- a/src/hb-coretext.cc
+++ b/src/hb-coretext.cc
@@ -101,10 +101,10 @@ _hb_cg_font_release (void *data)
 }
 
 
-HB_SHAPER_DATA_ENSURE_DEFINE(coretext, face)
+HB_SHAPER_DATA_ENSURE_DEFINE(coretext, face);
 HB_SHAPER_DATA_ENSURE_DEFINE_WITH_CONDITION(coretext, font,
 	fabs (CTFontGetSize((CTFontRef) data) - coretext_font_size_from_ptem (font->ptem)) <= .5
-)
+);
 
 static CTFontDescriptorRef
 get_last_resort_font_desc (void)
@@ -372,29 +372,6 @@ hb_coretext_font_get_ct_font (hb_font_t *font)
 }
 
 
-
-/*
- * shaper shape_plan data
- */
-
-struct hb_coretext_shape_plan_data_t {};
-
-hb_coretext_shape_plan_data_t *
-_hb_coretext_shaper_shape_plan_data_create (hb_shape_plan_t    *shape_plan HB_UNUSED,
-					     const hb_feature_t *user_features HB_UNUSED,
-					     unsigned int        num_user_features HB_UNUSED,
-					     const int          *coords HB_UNUSED,
-					     unsigned int        num_coords HB_UNUSED)
-{
-  return (hb_coretext_shape_plan_data_t *) HB_SHAPER_DATA_SUCCEEDED;
-}
-
-void
-_hb_coretext_shaper_shape_plan_data_destroy (hb_coretext_shape_plan_data_t *data HB_UNUSED)
-{
-}
-
-
 /*
  * shaper
  */
@@ -1152,8 +1129,8 @@ fail:
  * AAT shaper
  */
 
-HB_SHAPER_DATA_ENSURE_DEFINE(coretext_aat, face)
-HB_SHAPER_DATA_ENSURE_DEFINE(coretext_aat, font)
+HB_SHAPER_DATA_ENSURE_DEFINE(coretext_aat, face);
+HB_SHAPER_DATA_ENSURE_DEFINE(coretext_aat, font);
 
 /*
  * shaper face data
@@ -1204,28 +1181,6 @@ _hb_coretext_aat_shaper_font_data_destroy (hb_coretext_aat_font_data_t *data HB_
 }
 
 
-/*
- * shaper shape_plan data
- */
-
-struct hb_coretext_aat_shape_plan_data_t {};
-
-hb_coretext_aat_shape_plan_data_t *
-_hb_coretext_aat_shaper_shape_plan_data_create (hb_shape_plan_t    *shape_plan HB_UNUSED,
-					     const hb_feature_t *user_features HB_UNUSED,
-					     unsigned int        num_user_features HB_UNUSED,
-					     const int          *coords HB_UNUSED,
-					     unsigned int        num_coords HB_UNUSED)
-{
-  return (hb_coretext_aat_shape_plan_data_t *) HB_SHAPER_DATA_SUCCEEDED;
-}
-
-void
-_hb_coretext_aat_shaper_shape_plan_data_destroy (hb_coretext_aat_shape_plan_data_t *data HB_UNUSED)
-{
-}
-
-
 /*
  * shaper
  */
diff --git a/src/hb-directwrite.cc b/src/hb-directwrite.cc
index 35197c238..b34ae6016 100644
--- a/src/hb-directwrite.cc
+++ b/src/hb-directwrite.cc
@@ -31,8 +31,8 @@
 #include "hb-directwrite.h"
 
 
-HB_SHAPER_DATA_ENSURE_DEFINE (directwrite, face)
-HB_SHAPER_DATA_ENSURE_DEFINE (directwrite, font)
+HB_SHAPER_DATA_ENSURE_DEFINE (directwrite, face);
+HB_SHAPER_DATA_ENSURE_DEFINE (directwrite, font);
 
 
 /*
@@ -256,27 +256,6 @@ _hb_directwrite_shaper_font_data_destroy (hb_directwrite_font_data_t *data)
 }
 
 
-/*
- * shaper shape_plan data
- */
-
-struct hb_directwrite_shape_plan_data_t {};
-
-hb_directwrite_shape_plan_data_t *
-_hb_directwrite_shaper_shape_plan_data_create (hb_shape_plan_t    *shape_plan HB_UNUSED,
-					       const hb_feature_t *user_features HB_UNUSED,
-					       unsigned int        num_user_features HB_UNUSED,
-					       const int          *coords HB_UNUSED,
-					       unsigned int        num_coords HB_UNUSED)
-{
-  return (hb_directwrite_shape_plan_data_t *) HB_SHAPER_DATA_SUCCEEDED;
-}
-
-void
-_hb_directwrite_shaper_shape_plan_data_destroy (hb_directwrite_shape_plan_data_t *data HB_UNUSED)
-{
-}
-
 // Most of TextAnalysis is originally written by Bas Schouten for Mozilla project
 // but now is relicensed to MIT for HarfBuzz use
 class TextAnalysis
diff --git a/src/hb-face.cc b/src/hb-face.cc
index 8e731052c..da73433cb 100644
--- a/src/hb-face.cc
+++ b/src/hb-face.cc
@@ -96,7 +96,7 @@ DEFINE_NULL_INSTANCE (hb_face_t) =
 #undef HB_SHAPER_IMPLEMENT
   },
 
-  HB_ATOMIC_PTR_INIT (nullptr), /* shape_plans */
+  /* Zero for the rest is fine. */
 };
 
 
@@ -129,7 +129,6 @@ hb_face_create_for_tables (hb_reference_table_func_t  reference_table_func,
   face->user_data = user_data;
   face->destroy = destroy;
 
-  face->upem = 0;
   face->num_glyphs = (unsigned int) -1;
 
   face->table.init0 (face);
diff --git a/src/hb-face.hh b/src/hb-face.hh
index 726f68837..5d22f4ada 100644
--- a/src/hb-face.hh
+++ b/src/hb-face.hh
@@ -54,7 +54,7 @@ struct hb_face_t
 
   struct hb_shaper_data_t shaper_data;	/* Various shaper data. */
 
-  hb_ot_face_t table;
+  hb_ot_face_t table;			/* All the face's tables. */
 
   /* Cache */
   struct plan_node_t
diff --git a/src/hb-fallback-shape.cc b/src/hb-fallback-shape.cc
index dc8536c82..40f8dad26 100644
--- a/src/hb-fallback-shape.cc
+++ b/src/hb-fallback-shape.cc
@@ -28,8 +28,8 @@
 #include "hb-shaper-impl.hh"
 
 
-HB_SHAPER_DATA_ENSURE_DEFINE(fallback, face)
-HB_SHAPER_DATA_ENSURE_DEFINE(fallback, font)
+HB_SHAPER_DATA_ENSURE_DEFINE(fallback, face);
+HB_SHAPER_DATA_ENSURE_DEFINE(fallback, font);
 
 
 /*
@@ -68,28 +68,6 @@ _hb_fallback_shaper_font_data_destroy (hb_fallback_font_data_t *data HB_UNUSED)
 }
 
 
-/*
- * shaper shape_plan data
- */
-
-struct hb_fallback_shape_plan_data_t {};
-
-hb_fallback_shape_plan_data_t *
-_hb_fallback_shaper_shape_plan_data_create (hb_shape_plan_t    *shape_plan HB_UNUSED,
-					    const hb_feature_t *user_features HB_UNUSED,
-					    unsigned int        num_user_features HB_UNUSED,
-					    const int          *coords HB_UNUSED,
-					    unsigned int        num_coords HB_UNUSED)
-{
-  return (hb_fallback_shape_plan_data_t *) HB_SHAPER_DATA_SUCCEEDED;
-}
-
-void
-_hb_fallback_shaper_shape_plan_data_destroy (hb_fallback_shape_plan_data_t *data HB_UNUSED)
-{
-}
-
-
 /*
  * shaper
  */
diff --git a/src/hb-font.cc b/src/hb-font.cc
index b24995b12..ca710a6f6 100644
--- a/src/hb-font.cc
+++ b/src/hb-font.cc
@@ -1306,7 +1306,7 @@ DEFINE_NULL_INSTANCE (hb_font_t) =
   0, /* num_coords */
   nullptr, /* coords */
 
-  const_cast<hb_font_funcs_t *> (&_hb_Null_hb_font_funcs_t), /* klass */
+  const_cast<hb_font_funcs_t *> (&_hb_Null_hb_font_funcs_t),
   nullptr, /* user_data */
   nullptr, /* destroy */
 
diff --git a/src/hb-graphite2.cc b/src/hb-graphite2.cc
index 24ee3d507..8dce81706 100644
--- a/src/hb-graphite2.cc
+++ b/src/hb-graphite2.cc
@@ -46,8 +46,8 @@
  **/
 
 
-HB_SHAPER_DATA_ENSURE_DEFINE(graphite2, face)
-HB_SHAPER_DATA_ENSURE_DEFINE(graphite2, font)
+HB_SHAPER_DATA_ENSURE_DEFINE(graphite2, face);
+HB_SHAPER_DATA_ENSURE_DEFINE(graphite2, font);
 
 
 /*
@@ -220,28 +220,6 @@ hb_graphite2_font_get_gr_font (hb_font_t *font HB_UNUSED)
 }
 
 
-/*
- * shaper shape_plan data
- */
-
-struct hb_graphite2_shape_plan_data_t {};
-
-hb_graphite2_shape_plan_data_t *
-_hb_graphite2_shaper_shape_plan_data_create (hb_shape_plan_t    *shape_plan HB_UNUSED,
-					     const hb_feature_t *user_features HB_UNUSED,
-					     unsigned int        num_user_features HB_UNUSED,
-					     const int          *coords HB_UNUSED,
-					     unsigned int        num_coords HB_UNUSED)
-{
-  return (hb_graphite2_shape_plan_data_t *) HB_SHAPER_DATA_SUCCEEDED;
-}
-
-void
-_hb_graphite2_shaper_shape_plan_data_destroy (hb_graphite2_shape_plan_data_t *data HB_UNUSED)
-{
-}
-
-
 /*
  * shaper
  */
diff --git a/src/hb-machinery.hh b/src/hb-machinery.hh
index f58050da0..9e4c16d81 100644
--- a/src/hb-machinery.hh
+++ b/src/hb-machinery.hh
@@ -110,17 +110,17 @@ static inline Type& StructAfter(TObject &X)
   static const unsigned int min_size = (size)
 
 #define DEFINE_SIZE_ARRAY(size, array) \
-  DEFINE_INSTANCE_ASSERTION (sizeof (*this) == (size) + VAR * sizeof (array[0])); \
-  DEFINE_COMPILES_ASSERTION ((void) array[0].static_size) \
+  DEFINE_INSTANCE_ASSERTION (sizeof (*this) == (size) + VAR * sizeof ((array)[0])); \
+  DEFINE_COMPILES_ASSERTION ((void) (array)[0].static_size) \
   enum { min_size = (size) }
 
 #define DEFINE_SIZE_ARRAY_SIZED(size, array) \
-	inline unsigned int get_size (void) const { return (size - array.min_size + array.get_size ()); } \
+	inline unsigned int get_size (void) const { return (size - (array).min_size + (array).get_size ()); } \
 	DEFINE_SIZE_ARRAY(size, array)
 
 #define DEFINE_SIZE_ARRAY2(size, array1, array2) \
   DEFINE_INSTANCE_ASSERTION (sizeof (*this) == (size) + sizeof (this->array1[0]) + sizeof (this->array2[0])); \
-  DEFINE_COMPILES_ASSERTION ((void) array1[0].static_size; (void) array2[0].static_size) \
+  DEFINE_COMPILES_ASSERTION ((void) (array1)[0].static_size; (void) (array2)[0].static_size) \
   static const unsigned int min_size = (size)
 
 
@@ -780,16 +780,9 @@ struct hb_lazy_loader_t : hb_data_wrapper_t<Data, WheresData>
     do_destroy (p);
   }
 
-  inline Stored * do_create (void) const
-  {
-    Stored *p = this->template call_create<Stored, Funcs> ();
-    if (unlikely (!p))
-      p = const_cast<Stored *> (Funcs::get_null ());
-    return p;
-  }
   static inline void do_destroy (Stored *p)
   {
-    if (p && p != Funcs::get_null ())
+    if (p)
       Funcs::destroy (p);
   }
 
@@ -797,18 +790,16 @@ struct hb_lazy_loader_t : hb_data_wrapper_t<Data, WheresData>
   inline const Returned & operator * (void) const { return *get (); }
   template <typename C> inline operator const C * (void) const { return get (); }
 
-  inline Data * get_data (void) const
-  {
-    return *(((Data **) this) - WheresData);
-  }
-
   inline Stored * get_stored (void) const
   {
   retry:
     Stored *p = this->instance.get ();
     if (unlikely (!p))
     {
-      p = do_create ();
+      p = this->template call_create<Stored, Funcs> ();
+      if (unlikely (!p))
+	return const_cast<Stored *> (Funcs::get_null ());
+
       if (unlikely (!this->instance.cmpexch (nullptr, p)))
       {
         do_destroy (p);
diff --git a/src/hb-open-type.hh b/src/hb-open-type.hh
index 56fa43345..14506180f 100644
--- a/src/hb-open-type.hh
+++ b/src/hb-open-type.hh
@@ -335,6 +335,8 @@ static inline Type& operator + (Base &base, OffsetTo<Type, OffsetType, has_null>
 template <typename Type>
 struct UnsizedArrayOf
 {
+  enum { item_size = Type::static_size };
+
   HB_NO_CREATE_COPY_ASSIGN_TEMPLATE (UnsizedArrayOf, Type);
 
   /* Unlikely other places, use "int i" instead of "unsigned int i" for our
@@ -435,6 +437,8 @@ struct UnsizedOffsetListOf : UnsizedOffsetArrayOf<Type, OffsetType, has_null>
 template <typename Type, typename LenType=HBUINT16>
 struct ArrayOf
 {
+  enum { item_size = Type::static_size };
+
   HB_NO_CREATE_COPY_ASSIGN_TEMPLATE2 (ArrayOf, Type, LenType);
 
   inline const Type *sub_array (unsigned int start_offset, unsigned int *pcount /* IN/OUT */) const
@@ -603,6 +607,8 @@ struct OffsetListOf : OffsetArrayOf<Type>
 template <typename Type, typename LenType=HBUINT16>
 struct HeadlessArrayOf
 {
+  enum { item_size = Type::static_size };
+
   HB_NO_CREATE_COPY_ASSIGN_TEMPLATE2 (HeadlessArrayOf, Type, LenType);
 
   inline const Type& operator [] (unsigned int i) const
@@ -801,6 +807,8 @@ struct VarSizedBinSearchHeader
 template <typename Type>
 struct VarSizedBinSearchArrayOf
 {
+  enum { item_size = Type::static_size };
+
   HB_NO_CREATE_COPY_ASSIGN_TEMPLATE (VarSizedBinSearchArrayOf, Type);
 
   inline const Type& operator [] (unsigned int i) const
diff --git a/src/hb-ot-cmap-table.hh b/src/hb-ot-cmap-table.hh
index 399c46bfc..4c24cb99c 100644
--- a/src/hb-ot-cmap-table.hh
+++ b/src/hb-ot-cmap-table.hh
@@ -636,7 +636,7 @@ struct DefaultUVS : SortedArrayOf<UnicodeValueRange, HBUINT32>
   }
 
   public:
-  DEFINE_SIZE_ARRAY (4, arrayZ);
+  DEFINE_SIZE_ARRAY (4, *this);
 };
 
 struct UVSMapping
@@ -668,7 +668,7 @@ struct NonDefaultUVS : SortedArrayOf<UVSMapping, HBUINT32>
   }
 
   public:
-  DEFINE_SIZE_ARRAY (4, arrayZ);
+  DEFINE_SIZE_ARRAY (4, *this);
 };
 
 struct VariationSelectorRecord
@@ -1014,8 +1014,7 @@ struct cmap
   {
     inline void init (hb_face_t *face)
     {
-      this->blob = hb_sanitize_context_t().reference_table<cmap> (face);
-      const cmap *table = this->blob->as<cmap> ();
+      this->table = hb_sanitize_context_t().reference_table<cmap> (face);
       bool symbol;
       this->subtable = table->find_best_subtable (&symbol);
       this->subtable_uvs = &Null(CmapSubtableFormat14);
@@ -1051,7 +1050,7 @@ struct cmap
 
     inline void fini (void)
     {
-      hb_blob_destroy (this->blob);
+      this->table.destroy ();
     }
 
     inline bool get_nominal_glyph (hb_codepoint_t  unicode,
@@ -1157,7 +1156,7 @@ struct cmap
 
     CmapSubtableFormat4::accelerator_t format4_accel;
 
-    hb_blob_t *blob;
+    hb_blob_ptr_t<cmap> table;
   };
 
   protected:
diff --git a/src/hb-ot-color-cbdt-table.hh b/src/hb-ot-color-cbdt-table.hh
index 580dc3769..47774fd8f 100644
--- a/src/hb-ot-color-cbdt-table.hh
+++ b/src/hb-ot-color-cbdt-table.hh
@@ -384,26 +384,16 @@ struct CBDT
   {
     inline void init (hb_face_t *face)
     {
+      cblc = hb_sanitize_context_t().reference_table<CBLC> (face);
+      cbdt = hb_sanitize_context_t().reference_table<CBDT> (face);
+
       upem = hb_face_get_upem (face);
-
-      cblc_blob = hb_sanitize_context_t().reference_table<CBLC> (face);
-      cbdt_blob = hb_sanitize_context_t().reference_table<CBDT> (face);
-      cbdt_len = hb_blob_get_length (cbdt_blob);
-
-      if (hb_blob_get_length (cblc_blob) == 0) {
-	cblc = nullptr;
-	cbdt = nullptr;
-	return;  /* Not a bitmap font. */
-      }
-      cblc = cblc_blob->as<CBLC> ();
-      cbdt = cbdt_blob->as<CBDT> ();
-
     }
 
     inline void fini (void)
     {
-      hb_blob_destroy (this->cblc_blob);
-      hb_blob_destroy (this->cbdt_blob);
+      this->cblc.destroy ();
+      this->cbdt.destroy ();
     }
 
     inline bool get_extents (hb_font_t *font, hb_codepoint_t glyph,
@@ -423,6 +413,7 @@ struct CBDT
 	return false;
 
       {
+	unsigned int cbdt_len = cbdt.get_length ();
 	if (unlikely (image_offset > cbdt_len || cbdt_len - image_offset < image_length))
 	  return false;
 
@@ -475,6 +466,7 @@ struct CBDT
 	return hb_blob_get_empty ();
 
       {
+	unsigned int cbdt_len = cbdt.get_length ();
 	if (unlikely (image_offset > cbdt_len || cbdt_len - image_offset < image_length))
 	  return hb_blob_get_empty ();
 
@@ -485,7 +477,7 @@ struct CBDT
 	      return hb_blob_get_empty ();
 	    const GlyphBitmapDataFormat17& glyphFormat17 =
 	      StructAtOffset<GlyphBitmapDataFormat17> (this->cbdt, image_offset);
-	    return hb_blob_create_sub_blob (cbdt_blob,
+	    return hb_blob_create_sub_blob (cbdt.get_blob (),
 					    image_offset + GlyphBitmapDataFormat17::min_size,
 					    glyphFormat17.data.len);
 	  }
@@ -494,7 +486,7 @@ struct CBDT
 	      return hb_blob_get_empty ();
 	    const GlyphBitmapDataFormat18& glyphFormat18 =
 	      StructAtOffset<GlyphBitmapDataFormat18> (this->cbdt, image_offset);
-	    return hb_blob_create_sub_blob (cbdt_blob,
+	    return hb_blob_create_sub_blob (cbdt.get_blob (),
 					    image_offset + GlyphBitmapDataFormat18::min_size,
 					    glyphFormat18.data.len);
 	  }
@@ -503,7 +495,7 @@ struct CBDT
 	      return hb_blob_get_empty ();
 	    const GlyphBitmapDataFormat19& glyphFormat19 =
 	      StructAtOffset<GlyphBitmapDataFormat19> (this->cbdt, image_offset);
-	    return hb_blob_create_sub_blob (cbdt_blob,
+	    return hb_blob_create_sub_blob (cbdt.get_blob (),
 					    image_offset + GlyphBitmapDataFormat19::min_size,
 					    glyphFormat19.data.len);
 	  }
@@ -513,16 +505,12 @@ struct CBDT
       return hb_blob_get_empty ();
     }
 
-    inline bool has_data () const
-    { return cbdt_len; }
+    inline bool has_data () const { return cbdt.get_length (); }
 
     private:
-    hb_blob_t *cblc_blob;
-    hb_blob_t *cbdt_blob;
-    hb_nonnull_ptr_t<const CBLC> cblc;
-    hb_nonnull_ptr_t<const CBDT> cbdt;
+    hb_blob_ptr_t<CBLC> cblc;
+    hb_blob_ptr_t<CBDT> cbdt;
 
-    unsigned int cbdt_len;
     unsigned int upem;
   };
 
diff --git a/src/hb-ot-color-sbix-table.hh b/src/hb-ot-color-sbix-table.hh
index 7a01d14ae..80d65022c 100644
--- a/src/hb-ot-color-sbix-table.hh
+++ b/src/hb-ot-color-sbix-table.hh
@@ -140,14 +140,13 @@ struct sbix
   {
     inline void init (hb_face_t *face)
     {
-      sbix_blob = hb_sanitize_context_t().reference_table<sbix> (face);
-      table = sbix_blob->as<sbix> ();
+      table = hb_sanitize_context_t().reference_table<sbix> (face);
       num_glyphs = face->get_num_glyphs ();
     }
 
     inline void fini (void)
     {
-      hb_blob_destroy (sbix_blob);
+      table.destroy ();
     }
 
     inline bool has_data () const
@@ -169,7 +168,7 @@ struct sbix
 				     int            *y_offset,
 				     unsigned int   *available_ppem) const
     {
-      return choose_strike (font).get_glyph_blob (glyph_id, sbix_blob,
+      return choose_strike (font).get_glyph_blob (glyph_id, table.get_blob (),
 						  HB_TAG ('p','n','g',' '),
 						  x_offset, y_offset,
 						  num_glyphs, available_ppem);
@@ -263,8 +262,7 @@ struct sbix
     }
 
     private:
-    hb_blob_t *sbix_blob;
-    hb_nonnull_ptr_t<const sbix> table;
+    hb_blob_ptr_t<sbix> table;
 
     unsigned int num_glyphs;
   };
diff --git a/src/hb-ot-color-svg-table.hh b/src/hb-ot-color-svg-table.hh
index 069c54788..bad8ef549 100644
--- a/src/hb-ot-color-svg-table.hh
+++ b/src/hb-ot-color-svg-table.hh
@@ -81,25 +81,24 @@ struct SVG
   {
     inline void init (hb_face_t *face)
     {
-      svg_blob = hb_sanitize_context_t().reference_table<SVG> (face);
-      table = svg_blob->as<SVG> ();
+      table = hb_sanitize_context_t().reference_table<SVG> (face);
     }
 
     inline void fini (void)
     {
-      hb_blob_destroy (svg_blob);
+      table.destroy ();
     }
 
     inline hb_blob_t *reference_blob_for_glyph (hb_codepoint_t glyph_id) const
     {
-      return table->get_glyph_entry (glyph_id).reference_blob (svg_blob, table->svgDocEntries);
+      return table->get_glyph_entry (glyph_id).reference_blob (table.get_blob (),
+							       table->svgDocEntries);
     }
 
     inline bool has_data () const { return table->has_data (); }
 
     private:
-    hb_blob_t *svg_blob;
-    hb_nonnull_ptr_t<const SVG> table;
+    hb_blob_ptr_t<SVG> table;
   };
 
   inline const SVGDocumentIndexEntry &get_glyph_entry (hb_codepoint_t glyph_id) const
diff --git a/src/hb-ot-glyf-table.hh b/src/hb-ot-glyf-table.hh
index 0623be892..42bb03ff8 100644
--- a/src/hb-ot-glyf-table.hh
+++ b/src/hb-ot-glyf-table.hh
@@ -246,19 +246,16 @@ struct glyf
       short_offset = 0 == head_table->indexToLocFormat;
       hb_blob_destroy (head_blob);
 
-      loca_blob = hb_sanitize_context_t().reference_table<loca> (face);
-      loca_table = loca_blob->as<loca> ();
-      glyf_blob = hb_sanitize_context_t().reference_table<glyf> (face);
-      glyf_table = glyf_blob->as<glyf> ();
+      loca_table = hb_sanitize_context_t().reference_table<loca> (face);
+      glyf_table = hb_sanitize_context_t().reference_table<glyf> (face);
 
-      num_glyphs = MAX (1u, hb_blob_get_length (loca_blob) / (short_offset ? 2 : 4)) - 1;
-      glyf_len = hb_blob_get_length (glyf_blob);
+      num_glyphs = MAX (1u, loca_table.get_length () / (short_offset ? 2 : 4)) - 1;
     }
 
     inline void fini (void)
     {
-      hb_blob_destroy (loca_blob);
-      hb_blob_destroy (glyf_blob);
+      loca_table.destroy ();
+      glyf_table.destroy ();
     }
 
     /*
@@ -388,7 +385,7 @@ struct glyf
 	*end_offset   = offsets[glyph + 1];
       }
 
-      if (*start_offset > *end_offset || *end_offset > glyf_len)
+      if (*start_offset > *end_offset || *end_offset > glyf_table.get_length ())
 	return false;
 
       return true;
@@ -476,11 +473,8 @@ struct glyf
     private:
     bool short_offset;
     unsigned int num_glyphs;
-    hb_nonnull_ptr_t<const loca> loca_table;
-    hb_nonnull_ptr_t<const glyf> glyf_table;
-    hb_blob_t *loca_blob;
-    hb_blob_t *glyf_blob;
-    unsigned int glyf_len;
+    hb_blob_ptr_t<loca> loca_table;
+    hb_blob_ptr_t<glyf> glyf_table;
   };
 
   protected:
diff --git a/src/hb-ot-hdmx-table.hh b/src/hb-ot-hdmx-table.hh
index 04511b5d0..9a5f9453e 100644
--- a/src/hb-ot-hdmx-table.hh
+++ b/src/hb-ot-hdmx-table.hh
@@ -44,15 +44,15 @@ struct DeviceRecord
   struct SubsetView
   {
     const DeviceRecord *source_device_record;
-    unsigned int size_device_record;
+    unsigned int sizeDeviceRecord;
     hb_subset_plan_t *subset_plan;
 
     inline void init(const DeviceRecord *source_device_record,
-		     unsigned int size_device_record,
+		     unsigned int sizeDeviceRecord,
 		     hb_subset_plan_t   *subset_plan)
     {
       this->source_device_record = source_device_record;
-      this->size_device_record = size_device_record;
+      this->sizeDeviceRecord = sizeDeviceRecord;
       this->subset_plan = subset_plan;
     }
 
@@ -68,7 +68,7 @@ struct DeviceRecord
 
       const HBUINT8* width = &(this->source_device_record->widthsZ[gid]);
 
-      if (width < ((const HBUINT8 *) this->source_device_record) + size_device_record)
+      if (width < ((const HBUINT8 *) this->source_device_record) + sizeDeviceRecord)
 	return width;
       else
 	return nullptr;
@@ -92,8 +92,8 @@ struct DeviceRecord
       return_trace (false);
     }
 
-    this->pixel_size.set (subset_view.source_device_record->pixel_size);
-    this->max_width.set (subset_view.source_device_record->max_width);
+    this->pixelSize.set (subset_view.source_device_record->pixelSize);
+    this->maxWidth.set (subset_view.source_device_record->maxWidth);
 
     for (unsigned int i = 0; i < subset_view.len(); i++)
     {
@@ -109,16 +109,16 @@ struct DeviceRecord
     return_trace (true);
   }
 
-  inline bool sanitize (hb_sanitize_context_t *c, unsigned int size_device_record) const
+  inline bool sanitize (hb_sanitize_context_t *c, unsigned int sizeDeviceRecord) const
   {
     TRACE_SANITIZE (this);
     return_trace (likely (c->check_struct (this) &&
-			  c->check_range (this, size_device_record)));
+			  c->check_range (this, sizeDeviceRecord)));
   }
 
-  HBUINT8			pixel_size;   /* Pixel size for following widths (as ppem). */
-  HBUINT8			max_width;    /* Maximum width. */
-  UnsizedArrayOf<HBUINT8>	widthsZ;  /* Array of widths (numGlyphs is from the 'maxp' table). */
+  HBUINT8			pixelSize;	/* Pixel size for following widths (as ppem). */
+  HBUINT8			maxWidth;	/* Maximum width. */
+  UnsizedArrayOf<HBUINT8>	widthsZ;	/* Array of widths (numGlyphs is from the 'maxp' table). */
   public:
   DEFINE_SIZE_ARRAY (2, widthsZ);
 };
@@ -130,13 +130,13 @@ struct hdmx
 
   inline unsigned int get_size (void) const
   {
-    return min_size + num_records * size_device_record;
+    return min_size + numRecords * sizeDeviceRecord;
   }
 
   inline const DeviceRecord& operator [] (unsigned int i) const
   {
-    if (unlikely (i >= num_records)) return Null(DeviceRecord);
-    return StructAtOffset<DeviceRecord> (&this->dataZ, i * size_device_record);
+    if (unlikely (i >= numRecords)) return Null(DeviceRecord);
+    return StructAtOffset<DeviceRecord> (&this->dataZ, i * sizeDeviceRecord);
   }
 
   inline bool serialize (hb_serialize_context_t *c, const hdmx *source_hdmx, hb_subset_plan_t *plan)
@@ -146,13 +146,13 @@ struct hdmx
     if (unlikely (!c->extend_min ((*this))))  return_trace (false);
 
     this->version.set (source_hdmx->version);
-    this->num_records.set (source_hdmx->num_records);
-    this->size_device_record.set (DeviceRecord::get_size (plan->glyphs.len));
+    this->numRecords.set (source_hdmx->numRecords);
+    this->sizeDeviceRecord.set (DeviceRecord::get_size (plan->glyphs.len));
 
-    for (unsigned int i = 0; i < source_hdmx->num_records; i++)
+    for (unsigned int i = 0; i < source_hdmx->numRecords; i++)
     {
       DeviceRecord::SubsetView subset_view;
-      subset_view.init (&(*source_hdmx)[i], source_hdmx->size_device_record, plan);
+      subset_view.init (&(*source_hdmx)[i], source_hdmx->sizeDeviceRecord, plan);
 
       if (!c->start_embed<DeviceRecord> ()->serialize (c, subset_view))
 	return_trace (false);
@@ -163,7 +163,7 @@ struct hdmx
 
   static inline size_t get_subsetted_size (const hdmx *source_hdmx, hb_subset_plan_t *plan)
   {
-    return min_size + source_hdmx->num_records * DeviceRecord::get_size (plan->glyphs.len);
+    return min_size + source_hdmx->numRecords * DeviceRecord::get_size (plan->glyphs.len);
   }
 
   inline bool subset (hb_subset_plan_t *plan) const
@@ -201,15 +201,15 @@ struct hdmx
   {
     TRACE_SANITIZE (this);
     return_trace (c->check_struct (this) && version == 0 &&
-		  !hb_unsigned_mul_overflows (num_records, size_device_record) &&
-		  size_device_record >= DeviceRecord::min_size &&
+		  !hb_unsigned_mul_overflows (numRecords, sizeDeviceRecord) &&
+		  sizeDeviceRecord >= DeviceRecord::min_size &&
 		  c->check_range (this, get_size()));
   }
 
   protected:
   HBUINT16			version;		/* Table version number (0) */
-  HBUINT16			num_records;		/* Number of device records. */
-  HBUINT32			size_device_record;	/* Size of a device record, 32-bit aligned. */
+  HBUINT16			numRecords;		/* Number of device records. */
+  HBUINT32			sizeDeviceRecord;	/* Size of a device record, 32-bit aligned. */
   UnsizedArrayOf<HBUINT8>	dataZ;			/* Array of device records. */
   public:
   DEFINE_SIZE_ARRAY (8, dataZ);
diff --git a/src/hb-ot-hmtx-table.hh b/src/hb-ot-hmtx-table.hh
index f898a0336..20948edbf 100644
--- a/src/hb-ot-hmtx-table.hh
+++ b/src/hb-ot-hmtx-table.hh
@@ -113,7 +113,7 @@ struct hmtxvmtx
     DEBUG_MSG(SUBSET, nullptr, "%c%c%c%c in src has %d advances, %d lsbs", HB_UNTAG(T::tableTag), _mtx.num_advances, _mtx.num_metrics - _mtx.num_advances);
     DEBUG_MSG(SUBSET, nullptr, "%c%c%c%c in dest has %d advances, %d lsbs, %u bytes", HB_UNTAG(T::tableTag), num_advances, gids.len - num_advances, (unsigned int) dest_sz);
 
-    const char *source_table = hb_blob_get_data (_mtx.blob, nullptr);
+    const char *source_table = hb_blob_get_data (_mtx.table.get_blob (), nullptr);
     // Copy everything over
     LongMetric * old_metrics = (LongMetric *) source_table;
     FWORD *lsbs = (FWORD *) (old_metrics + _mtx.num_advances);
@@ -221,10 +221,10 @@ struct hmtxvmtx
 
       has_font_extents = got_font_extents;
 
-      blob = hb_sanitize_context_t().reference_table<hmtxvmtx> (face, T::tableTag);
+      table = hb_sanitize_context_t().reference_table<hmtxvmtx> (face, T::tableTag);
 
       /* Cap num_metrics() and num_advances() based on table length. */
-      unsigned int len = hb_blob_get_length (blob);
+      unsigned int len = table.get_length ();
       if (unlikely (num_advances * 4 > len))
 	num_advances = len / 4;
       num_metrics = num_advances + (len - 4 * num_advances) / 2;
@@ -234,19 +234,17 @@ struct hmtxvmtx
       if (unlikely (!num_advances))
       {
 	num_metrics = num_advances = 0;
-	hb_blob_destroy (blob);
-	blob = hb_blob_get_empty ();
+	table.destroy ();
+	table = hb_blob_get_empty ();
       }
-      table = blob->as<hmtxvmtx> ();
 
-      var_blob = hb_sanitize_context_t().reference_table<HVARVVAR> (face, T::variationsTag);
-      var_table = var_blob->as<HVARVVAR> ();
+      var_table = hb_sanitize_context_t().reference_table<HVARVVAR> (face, T::variationsTag);
     }
 
     inline void fini (void)
     {
-      hb_blob_destroy (blob);
-      hb_blob_destroy (var_blob);
+      table.destroy ();
+      var_table.destroy ();
     }
 
     /* TODO Add variations version. */
@@ -301,10 +299,8 @@ struct hmtxvmtx
     unsigned int default_advance;
 
     private:
-    const hmtxvmtx *table;
-    hb_blob_t *blob;
-    const HVARVVAR *var_table;
-    hb_blob_t *var_blob;
+    hb_blob_ptr_t<hmtxvmtx> table;
+    hb_blob_ptr_t<HVARVVAR> var_table;
   };
 
   protected:
diff --git a/src/hb-ot-layout-gdef-table.hh b/src/hb-ot-layout-gdef-table.hh
index af7e5a833..e6804e6b5 100644
--- a/src/hb-ot-layout-gdef-table.hh
+++ b/src/hb-ot-layout-gdef-table.hh
@@ -412,11 +412,10 @@ struct GDEF
 
     inline void fini (void)
     {
-      hb_blob_destroy (this->blob);
+      this->table.destroy ();
     }
 
-    hb_blob_t *blob;
-    hb_nonnull_ptr_t<const GDEF> table;
+    hb_blob_ptr_t<GDEF> table;
   };
 
   inline unsigned int get_size (void) const
diff --git a/src/hb-ot-layout-gpos-table.hh b/src/hb-ot-layout-gpos-table.hh
index fc74af47a..cf735c301 100644
--- a/src/hb-ot-layout-gpos-table.hh
+++ b/src/hb-ot-layout-gpos-table.hh
@@ -53,7 +53,7 @@ enum attach_type_t {
 
 typedef HBUINT16 Value;
 
-typedef Value ValueRecord[VAR];
+typedef UnsizedArrayOf<Value> ValueRecord;
 
 struct ValueFormat : HBUINT16
 {
@@ -879,7 +879,7 @@ struct PairPosFormat2
     unsigned int stride = len1 + len2;
     unsigned int record_size = valueFormat1.get_size () + valueFormat2.get_size ();
     unsigned int count = (unsigned int) class1Count * (unsigned int) class2Count;
-    return_trace (c->check_array (values, count, record_size) &&
+    return_trace (c->check_array ((const void *) values, count, record_size) &&
 		  valueFormat1.sanitize_values_stride_unsafe (c, this, &values[0], count, stride) &&
 		  valueFormat2.sanitize_values_stride_unsafe (c, this, &values[len1], count, stride));
   }
diff --git a/src/hb-ot-layout-gsubgpos.hh b/src/hb-ot-layout-gsubgpos.hh
index eccbcf420..1335601a3 100644
--- a/src/hb-ot-layout-gsubgpos.hh
+++ b/src/hb-ot-layout-gsubgpos.hh
@@ -2752,8 +2752,7 @@ struct GSUBGPOS
   {
     inline void init (hb_face_t *face)
     {
-      this->blob = hb_sanitize_context_t().reference_table<T> (face);
-      table = this->blob->template as<T> ();
+      this->table = hb_sanitize_context_t().reference_table<T> (face);
 
       this->lookup_count = table->get_lookup_count ();
 
@@ -2770,11 +2769,10 @@ struct GSUBGPOS
       for (unsigned int i = 0; i < this->lookup_count; i++)
 	this->accels[i].fini ();
       free (this->accels);
-      hb_blob_destroy (this->blob);
+      this->table.destroy ();
     }
 
-    hb_blob_t *blob;
-    hb_nonnull_ptr_t<const T> table;
+    hb_blob_ptr_t<T> table;
     unsigned int lookup_count;
     hb_ot_layout_lookup_accelerator_t *accels;
   };
diff --git a/src/hb-ot-layout.cc b/src/hb-ot-layout.cc
index 33bf03c13..ec2421e3f 100644
--- a/src/hb-ot-layout.cc
+++ b/src/hb-ot-layout.cc
@@ -194,17 +194,15 @@ _hb_ot_blacklist_gdef (unsigned int gdef_len,
 void
 OT::GDEF::accelerator_t::init (hb_face_t *face)
 {
-  this->blob = hb_sanitize_context_t().reference_table<GDEF> (face);
+  this->table = hb_sanitize_context_t().reference_table<GDEF> (face);
 
-  if (unlikely (_hb_ot_blacklist_gdef (this->blob->length,
-				       face->table.GSUB->blob->length,
-				       face->table.GPOS->blob->length)))
+  if (unlikely (_hb_ot_blacklist_gdef (this->table.get_length (),
+				       face->table.GSUB->table.get_length (),
+				       face->table.GPOS->table.get_length ())))
   {
-    hb_blob_destroy (this->blob);
-    this->blob = hb_blob_get_empty ();
+    hb_blob_destroy (this->table.get_blob ());
+    this->table = hb_blob_get_empty ();
   }
-
-  table = this->blob->as<GDEF> ();
 }
 
 static void
@@ -1060,9 +1058,8 @@ hb_ot_layout_lookups_substitute_closure (hb_face_t      *face,
       for (unsigned int i = 0; i < gsub.get_lookup_count (); i++)
         gsub.get_lookup (i).closure (&c, i);
     }
-    iteration_count++;
-  } while (iteration_count <= HB_CLOSURE_MAX_STAGES
-           && glyphs_length != glyphs->get_population ());
+  } while (iteration_count++ <= HB_CLOSURE_MAX_STAGES &&
+	   glyphs_length != glyphs->get_population ());
 }
 
 /*
diff --git a/src/hb-ot-name-table.hh b/src/hb-ot-name-table.hh
index f1e785f19..ab07b7196 100644
--- a/src/hb-ot-name-table.hh
+++ b/src/hb-ot-name-table.hh
@@ -179,11 +179,10 @@ struct name
   {
     inline void init (hb_face_t *face)
     {
-      this->blob = hb_sanitize_context_t().reference_table<name> (face);
-      this->table = this->blob->as<name> ();
-      assert (this->blob->length >= this->table->stringOffset);
+      this->table = hb_sanitize_context_t().reference_table<name> (face);
+      assert (this->table.get_length () >= this->table->stringOffset);
       this->pool = (this->table+this->table->stringOffset).arrayZ;
-      this->pool_len = this->blob->length - this->table->stringOffset;
+      this->pool_len = this->table.get_length () - this->table->stringOffset;
       const hb_array_t<const NameRecord> all_names (this->table->nameRecordZ.arrayZ,
 						    this->table->count);
 
@@ -221,7 +220,7 @@ struct name
     inline void fini (void)
     {
       this->names.fini ();
-      hb_blob_destroy (this->blob);
+      this->table.destroy ();
     }
 
     inline int get_index (hb_ot_name_id_t   name_id,
@@ -253,11 +252,10 @@ struct name
     }
 
     private:
-    hb_blob_t *blob;
     const void *pool;
     unsigned int pool_len;
     public:
-    hb_nonnull_ptr_t<const name> table;
+    hb_blob_ptr_t<name> table;
     hb_vector_t<hb_ot_name_entry_t> names;
   };
 
diff --git a/src/hb-ot-post-table.hh b/src/hb-ot-post-table.hh
index 77eef3f5c..557fefada 100644
--- a/src/hb-ot-post-table.hh
+++ b/src/hb-ot-post-table.hh
@@ -101,9 +101,8 @@ struct post
     {
       index_to_offset.init ();
 
-      blob = hb_sanitize_context_t().reference_table<post> (face);
-      const post *table = blob->as<post> ();
-      unsigned int table_length = blob->length;
+      table = hb_sanitize_context_t().reference_table<post> (face);
+      unsigned int table_length = table.get_length ();
 
       version = table->version.to_int ();
       if (version != 0x00020000)
@@ -114,7 +113,7 @@ struct post
       glyphNameIndex = &v2.glyphNameIndex;
       pool = &StructAfter<uint8_t> (v2.glyphNameIndex);
 
-      const uint8_t *end = (uint8_t *) table + table_length;
+      const uint8_t *end = (const uint8_t *) (const void *) table + table_length;
       for (const uint8_t *data = pool;
 	   index_to_offset.len < 65535 && data < end && data + *data < end;
 	   data += 1 + *data)
@@ -124,7 +123,7 @@ struct post
     {
       index_to_offset.fini ();
       free (gids_sorted_by_name.get ());
-      hb_blob_destroy (blob);
+      table.destroy ();
     }
 
     inline bool get_glyph_name (hb_codepoint_t glyph,
@@ -244,7 +243,7 @@ struct post
     }
 
     private:
-    hb_blob_t *blob;
+    hb_blob_ptr_t<post> table;
     uint32_t version;
     const ArrayOf<HBUINT16> *glyphNameIndex;
     hb_vector_t<uint32_t, 1> index_to_offset;
diff --git a/src/hb-ot-shape-complex-arabic-fallback.hh b/src/hb-ot-shape-complex-arabic-fallback.hh
index eeb2da85f..0fb3793e2 100644
--- a/src/hb-ot-shape-complex-arabic-fallback.hh
+++ b/src/hb-ot-shape-complex-arabic-fallback.hh
@@ -212,8 +212,11 @@ struct arabic_fallback_plan_t
 
 struct ManifestLookup
 {
+  public:
   OT::Tag tag;
   OT::OffsetTo<OT::SubstLookup> lookupOffset;
+  public:
+  DEFINE_SIZE_STATIC (6);
 };
 typedef OT::ArrayOf<ManifestLookup> Manifest;
 
diff --git a/src/hb-ot-shape.cc b/src/hb-ot-shape.cc
index 99d6b9d40..44cf39078 100644
--- a/src/hb-ot-shape.cc
+++ b/src/hb-ot-shape.cc
@@ -27,7 +27,6 @@
  */
 
 #define HB_SHAPER ot
-#define hb_ot_shape_plan_data_t hb_ot_shape_plan_t
 #include "hb-shaper-impl.hh"
 
 #include "hb-ot-shape.hh"
@@ -52,6 +51,12 @@
  **/
 
 
+static void
+hb_ot_shape_collect_features (hb_ot_shape_planner_t          *planner,
+			      const hb_segment_properties_t  *props,
+			      const hb_feature_t             *user_features,
+			      unsigned int                    num_user_features);
+
 static bool
 _hb_apply_morx (hb_face_t *face)
 {
@@ -89,7 +94,7 @@ hb_ot_shape_planner_t::compile (hb_ot_shape_plan_t &plan,
   plan.dnom_mask = plan.map.get_1_mask (HB_TAG ('d','n','o','m'));
   plan.has_frac = plan.frac_mask || (plan.numr_mask && plan.dnom_mask);
   plan.rtlm_mask = plan.map.get_1_mask (HB_TAG ('r','t','l','m'));
-  hb_tag_t kern_tag = HB_DIRECTION_IS_HORIZONTAL (plan.props.direction) ?
+  hb_tag_t kern_tag = HB_DIRECTION_IS_HORIZONTAL (props.direction) ?
 		      HB_TAG ('k','e','r','n') : HB_TAG ('v','k','r','n');
   plan.kern_mask = plan.map.get_mask (kern_tag);
   plan.trak_mask = plan.map.get_mask (HB_TAG ('t','r','a','k'));
@@ -142,6 +147,43 @@ hb_ot_shape_planner_t::compile (hb_ot_shape_plan_t &plan,
   plan.apply_trak = plan.requested_tracking && hb_aat_layout_has_tracking (face);
 }
 
+bool
+hb_ot_shape_plan_t::init0 (hb_shape_plan_t    *shape_plan,
+			   const hb_feature_t *user_features,
+			   unsigned int        num_user_features,
+			   const int          *coords,
+			   unsigned int        num_coords)
+{
+  map.init ();
+  aat_map.init ();
+
+  hb_ot_shape_planner_t planner (shape_plan);
+
+  hb_ot_shape_collect_features (&planner, &shape_plan->props,
+				user_features, num_user_features);
+
+  planner.compile (*this, coords, num_coords);
+
+  if (shaper->data_create)
+  {
+    data = shaper->data_create (this);
+    if (unlikely (!data))
+      return false;
+  }
+
+  return true;
+}
+
+void
+hb_ot_shape_plan_t::fini (void)
+{
+  if (shaper->data_destroy)
+    shaper->data_destroy (const_cast<void *> (data));
+
+  map.fini ();
+  aat_map.fini ();
+}
+
 
 static const hb_ot_map_feature_t
 common_features[] =
@@ -255,7 +297,7 @@ hb_ot_shape_collect_features (hb_ot_shape_planner_t          *planner,
  * shaper face data
  */
 
-HB_SHAPER_DATA_ENSURE_DEFINE(ot, face)
+HB_SHAPER_DATA_ENSURE_DEFINE(ot, face);
 
 struct hb_ot_face_data_t {};
 
@@ -275,7 +317,7 @@ _hb_ot_shaper_face_data_destroy (hb_ot_face_data_t *data)
  * shaper font data
  */
 
-HB_SHAPER_DATA_ENSURE_DEFINE(ot, font)
+HB_SHAPER_DATA_ENSURE_DEFINE(ot, font);
 
 struct hb_ot_font_data_t {};
 
@@ -291,54 +333,6 @@ _hb_ot_shaper_font_data_destroy (hb_ot_font_data_t *data HB_UNUSED)
 }
 
 
-/*
- * shaper shape_plan data
- */
-
-hb_ot_shape_plan_data_t *
-_hb_ot_shaper_shape_plan_data_create (hb_shape_plan_t    *shape_plan,
-				      const hb_feature_t *user_features,
-				      unsigned int        num_user_features,
-				      const int          *coords,
-				      unsigned int        num_coords)
-{
-  hb_ot_shape_plan_t *plan = (hb_ot_shape_plan_t *) calloc (1, sizeof (hb_ot_shape_plan_t));
-  if (unlikely (!plan))
-    return nullptr;
-
-  plan->init ();
-
-  hb_ot_shape_planner_t planner (shape_plan);
-
-  hb_ot_shape_collect_features (&planner, &shape_plan->props,
-				user_features, num_user_features);
-
-  planner.compile (*plan, coords, num_coords);
-
-  if (plan->shaper->data_create) {
-    plan->data = plan->shaper->data_create (plan);
-    if (unlikely (!plan->data))
-    {
-      free (plan);
-      return nullptr;
-    }
-  }
-
-  return plan;
-}
-
-void
-_hb_ot_shaper_shape_plan_data_destroy (hb_ot_shape_plan_data_t *plan)
-{
-  if (plan->shaper->data_destroy)
-    plan->shaper->data_destroy (const_cast<void *> (plan->data));
-
-  plan->fini ();
-
-  free (plan);
-}
-
-
 /*
  * shaper
  */
@@ -978,7 +972,7 @@ _hb_ot_shape (hb_shape_plan_t    *shape_plan,
 	      const hb_feature_t *features,
 	      unsigned int        num_features)
 {
-  hb_ot_shape_context_t c = {HB_SHAPER_DATA_GET (shape_plan), font, font->face, buffer, features, num_features};
+  hb_ot_shape_context_t c = {&shape_plan->ot, font, font->face, buffer, features, num_features};
   hb_ot_shape_internal (&c);
 
   return true;
@@ -995,8 +989,7 @@ hb_ot_shape_plan_collect_lookups (hb_shape_plan_t *shape_plan,
 				  hb_tag_t         table_tag,
 				  hb_set_t        *lookup_indexes /* OUT */)
 {
-  /* XXX Does the first part always succeed? */
-  HB_SHAPER_DATA_GET (shape_plan)->collect_lookups (table_tag, lookup_indexes);
+  shape_plan->ot.collect_lookups (table_tag, lookup_indexes);
 }
 
 
diff --git a/src/hb-ot-shape.hh b/src/hb-ot-shape.hh
index 655e28d6d..049830a66 100644
--- a/src/hb-ot-shape.hh
+++ b/src/hb-ot-shape.hh
@@ -31,8 +31,6 @@
 
 #include "hb-ot-map.hh"
 #include "hb-aat-map.hh"
-#include "hb-shape-plan.hh"
-
 
 
 struct hb_ot_shape_plan_t
@@ -75,18 +73,17 @@ struct hb_ot_shape_plan_t
   inline void substitute (hb_font_t *font, hb_buffer_t *buffer) const { map.substitute (this, font, buffer); }
   inline void position (hb_font_t *font, hb_buffer_t *buffer) const { map.position (this, font, buffer); }
 
-  void init (void)
-  {
-    memset (this, 0, sizeof (*this));
-    map.init ();
-    aat_map.init ();
-  }
-  void fini (void) {
-    map.fini ();
-    aat_map.fini ();
-  }
+  HB_INTERNAL bool init0 (hb_shape_plan_t    *shape_plan,
+			  const hb_feature_t *user_features,
+			  unsigned int        num_user_features,
+			  const int          *coords,
+			  unsigned int        num_coords);
+
+  HB_INTERNAL void fini (void);
 };
 
+struct hb_shape_plan_t;
+
 struct hb_ot_shape_planner_t
 {
   /* In the order that they are filled in. */
diff --git a/src/hb-ot-var-avar-table.hh b/src/hb-ot-var-avar-table.hh
index d100ca21e..c2b110a21 100644
--- a/src/hb-ot-var-avar-table.hh
+++ b/src/hb-ot-var-avar-table.hh
@@ -94,7 +94,7 @@ struct SegmentMaps : ArrayOf<AxisValueMap>
   }
 
   public:
-  DEFINE_SIZE_ARRAY (2, arrayZ);
+  DEFINE_SIZE_ARRAY (2, *this);
 };
 
 struct avar
@@ -109,7 +109,7 @@ struct avar
 		    c->check_struct (this))))
       return_trace (false);
 
-    const SegmentMaps *map = axisSegmentMapsZ.arrayZ;
+    const SegmentMaps *map = &firstAxisSegmentMaps;
     unsigned int count = axisCount;
     for (unsigned int i = 0; i < count; i++)
     {
@@ -125,7 +125,7 @@ struct avar
   {
     unsigned int count = MIN<unsigned int> (coords_length, axisCount);
 
-    const SegmentMaps *map = axisSegmentMapsZ.arrayZ;
+    const SegmentMaps *map = &firstAxisSegmentMaps;
     for (unsigned int i = 0; i < count; i++)
     {
       coords[i] = map->map (coords[i]);
@@ -140,8 +140,7 @@ struct avar
   HBUINT16	axisCount;	/* The number of variation axes in the font. This
 				 * must be the same number as axisCount in the
 				 * 'fvar' table. */
-  UnsizedArrayOf<SegmentMaps>
-		axisSegmentMapsZ;
+  SegmentMaps   firstAxisSegmentMaps;
 
   public:
   DEFINE_SIZE_MIN (8);
diff --git a/src/hb-shape-plan.cc b/src/hb-shape-plan.cc
index f2f210196..2a2e0e39c 100644
--- a/src/hb-shape-plan.cc
+++ b/src/hb-shape-plan.cc
@@ -64,11 +64,6 @@ hb_shape_plan_plan (hb_shape_plan_t    *shape_plan,
 	HB_STMT_START { \
 	  if (hb_##shaper##_shaper_face_data_ensure (shape_plan->face_unsafe)) \
 	  { \
-	    /* XXX-MT-bug What happened to *ensure*ing this?!!!! */ \
-	    HB_SHAPER_DATA (shaper, shape_plan).set_relaxed ( \
-	      HB_SHAPER_DATA_CREATE_FUNC (shaper, shape_plan) (shape_plan, \
-							       user_features, num_user_features, \
-							       coords, num_coords)); \
 	    shape_plan->shaper_func = _hb_##shaper##_shape; \
 	    shape_plan->shaper_name = #shaper; \
 	    return; \
@@ -103,30 +98,6 @@ hb_shape_plan_plan (hb_shape_plan_t    *shape_plan,
  * hb_shape_plan_t
  */
 
-DEFINE_NULL_INSTANCE (hb_shape_plan_t) =
-{
-  HB_OBJECT_HEADER_STATIC,
-
-  true, /* default_shaper_list */
-  nullptr, /* face */
-  HB_SEGMENT_PROPERTIES_DEFAULT, /* props */
-
-  nullptr, /* shaper_func */
-  nullptr, /* shaper_name */
-
-  nullptr, /* user_features */
-  0,    /* num_user_featurs */
-
-  nullptr, /* coords */
-  0,    /* num_coords */
-
-  {
-#define HB_SHAPER_IMPLEMENT(shaper) HB_ATOMIC_PTR_INIT (HB_SHAPER_DATA_INVALID),
-#include "hb-shaper-list.hh"
-#undef HB_SHAPER_IMPLEMENT
-  },
-};
-
 
 /**
  * hb_shape_plan_create: (Xconstructor)
@@ -175,28 +146,22 @@ hb_shape_plan_create2 (hb_face_t                     *face,
   hb_feature_t *features = nullptr;
   int *coords = nullptr;
 
-  if (unlikely (!face))
-    face = hb_face_get_empty ();
   if (unlikely (!props))
-    return hb_shape_plan_get_empty ();
+    goto bail;
   if (num_user_features && !(features = (hb_feature_t *) calloc (num_user_features, sizeof (hb_feature_t))))
-    return hb_shape_plan_get_empty ();
+    goto bail;
   if (num_coords && !(coords = (int *) calloc (num_coords, sizeof (int))))
-  {
-    free (features);
-    return hb_shape_plan_get_empty ();
-  }
+    goto bail;
   if (!(shape_plan = hb_object_create<hb_shape_plan_t> ()))
-  {
-    free (coords);
-    free (features);
-    return hb_shape_plan_get_empty ();
-  }
+    goto bail;
 
   assert (props->direction != HB_DIRECTION_INVALID);
 
+  if (unlikely (!face))
+    face = hb_face_get_empty ();
   hb_face_make_immutable (face);
-  shape_plan->default_shaper_list = !shaper_list;
+
+  shape_plan->custom_shaper_list = shaper_list;
   shape_plan->face_unsafe = face;
   shape_plan->props = *props;
   shape_plan->num_user_features = num_user_features;
@@ -213,7 +178,19 @@ hb_shape_plan_create2 (hb_face_t                     *face,
 		      coords, num_coords,
 		      shaper_list);
 
+  if (unlikely (!shape_plan->ot.init0 (shape_plan,
+				       user_features,
+				       num_user_features,
+				       coords,
+				       num_coords)))
+    goto bail;
+
   return shape_plan;
+
+bail:
+  free (coords);
+  free (features);
+  return hb_shape_plan_get_empty ();
 }
 
 /**
@@ -260,9 +237,7 @@ hb_shape_plan_destroy (hb_shape_plan_t *shape_plan)
 {
   if (!hb_object_destroy (shape_plan)) return;
 
-#define HB_SHAPER_IMPLEMENT(shaper) HB_SHAPER_DATA_DESTROY(shaper, shape_plan);
-#include "hb-shaper-list.hh"
-#undef HB_SHAPER_IMPLEMENT
+  shape_plan->ot.fini ();
 
   free (shape_plan->user_features);
   free (shape_plan->coords);
@@ -354,8 +329,7 @@ hb_shape_plan_execute (hb_shape_plan_t    *shape_plan,
 
 #define HB_SHAPER_EXECUTE(shaper) \
 	HB_STMT_START { \
-	  return HB_SHAPER_DATA (shaper, shape_plan).get () && \
-		 hb_##shaper##_shaper_font_data_ensure (font) && \
+	  return hb_##shaper##_shaper_font_data_ensure (font) && \
 		 _hb_##shaper##_shape (shape_plan, font, buffer, features, num_features); \
 	} HB_STMT_END
 
@@ -382,7 +356,7 @@ static unsigned int
 hb_shape_plan_hash (const hb_shape_plan_t *shape_plan)
 {
   return hb_segment_properties_hash (&shape_plan->props) +
-	 shape_plan->default_shaper_list ? 0 : (intptr_t) shape_plan->shaper_func;
+	 shape_plan->custom_shaper_list ? (intptr_t) shape_plan->shaper_func : 0;
 }
 #endif
 
@@ -436,7 +410,7 @@ hb_shape_plan_matches (const hb_shape_plan_t          *shape_plan,
   return hb_segment_properties_equal (&shape_plan->props, &proposal->props) &&
 	 hb_shape_plan_user_features_match (shape_plan, proposal) &&
 	 hb_shape_plan_coords_match (shape_plan, proposal) &&
-	 ((shape_plan->default_shaper_list && !proposal->shaper_list) ||
+	 ((!shape_plan->custom_shaper_list && !proposal->shaper_list) ||
 	  (shape_plan->shaper_func == proposal->shaper_func));
 }
 
@@ -507,6 +481,8 @@ hb_shape_plan_create_cached2 (hb_face_t                     *face,
     shaper_list,
     user_features,
     num_user_features,
+    coords,
+    num_coords,
     nullptr
   };
 
diff --git a/src/hb-shape-plan.hh b/src/hb-shape-plan.hh
index 403c3ebdf..eaa84fd4b 100644
--- a/src/hb-shape-plan.hh
+++ b/src/hb-shape-plan.hh
@@ -29,14 +29,15 @@
 
 #include "hb.hh"
 #include "hb-shaper.hh"
+#include "hb-ot-shape.hh"
 
 
 struct hb_shape_plan_t
 {
   hb_object_header_t header;
 
-  hb_bool_t default_shaper_list;
   hb_face_t *face_unsafe; /* We don't carry a reference to face. */
+  bool custom_shaper_list;
   hb_segment_properties_t props;
 
   hb_shape_func_t *shaper_func;
@@ -48,9 +49,8 @@ struct hb_shape_plan_t
   int *coords;
   unsigned int num_coords;
 
-  struct hb_shaper_data_t shaper_data;
+  hb_ot_shape_plan_t ot;
 };
-DECLARE_NULL_INSTANCE (hb_shape_plan_t);
 
 #define HB_SHAPER_DATA_CREATE_FUNC_EXTRA_ARGS \
 	, const hb_feature_t *user_features \
diff --git a/src/hb-shaper.hh b/src/hb-shaper.hh
index 361165e4f..e3be4119a 100644
--- a/src/hb-shaper.hh
+++ b/src/hb-shaper.hh
@@ -119,7 +119,8 @@ HB_SHAPER_DATA_ENSURE_FUNC(shaper, object) (hb_##object##_t *object) \
     } \
   } \
   return data != nullptr && (void *) data != HB_SHAPER_DATA_INVALID; \
-}
+} \
+static_assert (true, "") /* Require semicolon. */
 
 
 /* For embedding in face / font / ... */
diff --git a/src/hb-uniscribe.cc b/src/hb-uniscribe.cc
index e77825b34..dc82d6b7f 100644
--- a/src/hb-uniscribe.cc
+++ b/src/hb-uniscribe.cc
@@ -314,8 +314,8 @@ struct range_record_t {
   unsigned int index_last;  /* == end - 1 */
 };
 
-HB_SHAPER_DATA_ENSURE_DEFINE(uniscribe, face)
-HB_SHAPER_DATA_ENSURE_DEFINE(uniscribe, font)
+HB_SHAPER_DATA_ENSURE_DEFINE(uniscribe, face);
+HB_SHAPER_DATA_ENSURE_DEFINE(uniscribe, font);
 
 
 /*
@@ -600,28 +600,6 @@ hb_uniscribe_font_get_hfont (hb_font_t *font)
 }
 
 
-/*
- * shaper shape_plan data
- */
-
-struct hb_uniscribe_shape_plan_data_t {};
-
-hb_uniscribe_shape_plan_data_t *
-_hb_uniscribe_shaper_shape_plan_data_create (hb_shape_plan_t    *shape_plan HB_UNUSED,
-					     const hb_feature_t *user_features HB_UNUSED,
-					     unsigned int        num_user_features HB_UNUSED,
-					     const int          *coords HB_UNUSED,
-					     unsigned int        num_coords HB_UNUSED)
-{
-  return (hb_uniscribe_shape_plan_data_t *) HB_SHAPER_DATA_SUCCEEDED;
-}
-
-void
-_hb_uniscribe_shaper_shape_plan_data_destroy (hb_uniscribe_shape_plan_data_t *data HB_UNUSED)
-{
-}
-
-
 /*
  * shaper
  */
diff --git a/test/fuzzing/Makefile.am b/test/fuzzing/Makefile.am
index 54178ff43..ed67eee8c 100644
--- a/test/fuzzing/Makefile.am
+++ b/test/fuzzing/Makefile.am
@@ -7,11 +7,13 @@ DISTCLEANFILES =
 MAINTAINERCLEANFILES =
 
 # Convenience targets:
-lib:
+lib-only:
 	@$(MAKE) $(AM_MAKEFLAGS) -C $(top_builddir)/src fuzzing
+lib: lib-only
+	@$(MAKE) $(AM_MAKEFLAGS) $(check_PROGRAMS)
 
-$(top_builddir)/src/libharfbuzz-fuzzing.la: lib
-$(top_builddir)/src/libharfbuzz-subset-fuzzing.la: lib
+$(top_builddir)/src/libharfbuzz-fuzzing.la: lib-only
+$(top_builddir)/src/libharfbuzz-subset-fuzzing.la: lib-only
 
 EXTRA_DIST += \
 	README \
@@ -47,7 +49,7 @@ hb_shape_fuzzer_CPPFLAGS = \
 	$(AM_CPPFLAGS) \
 	$(NULL)
 hb_shape_fuzzer_DEPENDENCIES = \
-	lib \
+	$(top_builddir)/src/libharfbuzz-fuzzing.la
 	$(NULL)
 
 hb_subset_fuzzer_SOURCES = \
@@ -62,7 +64,7 @@ hb_subset_fuzzer_CPPFLAGS = \
 	$(AM_CPPFLAGS) \
 	$(NULL)
 hb_subset_fuzzer_DEPENDENCIES = \
-	lib \
+	$(top_builddir)/src/libharfbuzz-subset-fuzzing.la
 	$(NULL)
 
 check:
diff --git a/test/fuzzing/fonts/clusterfuzz-testcase-minimized-hb-shape-fuzzer-5629524117553152 b/test/fuzzing/fonts/clusterfuzz-testcase-minimized-hb-shape-fuzzer-5629524117553152
new file mode 100644
index 000000000..01ca51737
Binary files /dev/null and b/test/fuzzing/fonts/clusterfuzz-testcase-minimized-hb-shape-fuzzer-5629524117553152 differ