[otlayout] Guard against use of ReverseChain through Context

src/hb-ot-layout-gsub-table.hh

@@ -1037,7 +1037,9 @@ struct ReverseChainSingleSubstFormat1
 			 1))
     {
       c->replace_glyph_inplace (substitute[index]);
-      c->buffer->idx--; /* Reverse! */
+      /* Note: We DON'T decrease buffer->idx.  The main loop does it
+       * for us.  This is useful for preventing surprises if someone
+       * calls us through a Context lookup. */
       return TRACE_RETURN (true);
     }
 

src/hb-ot-layout.cc

@@ -867,8 +867,8 @@ apply_string (OT::hb_apply_context_t *c,
 	  (c->buffer->cur().mask & c->lookup_mask) &&
 	  apply_once (c, lookup))
 	ret = true;
-      else
-	c->buffer->idx--;
+      /* The reverse lookup doesn't "advance" cursor (for good reason). */
+      c->buffer->idx--;
 
     }
     while ((int) c->buffer->idx >= 0);