diff --git a/src/hb-open-file-private.hh b/src/hb-open-file-private.hh
index 4e4494d35..b58e26b67 100644
--- a/src/hb-open-file-private.hh
+++ b/src/hb-open-file-private.hh
@@ -165,7 +165,7 @@ struct TTCHeader
 
   inline bool sanitize (hb_sanitize_context_t *context) {
     TRACE_SANITIZE ();
-    if (!SANITIZE (u.header.version)) return false;
+    if (!u.header.version.sanitize (context)) return false;
     switch (u.header.version) {
     case 2: /* version 2 is compatible with version 1 */
     case 1: return u.version1->sanitize (context);
@@ -227,7 +227,7 @@ struct OpenTypeFontFile
 
   inline bool sanitize (hb_sanitize_context_t *context) {
     TRACE_SANITIZE ();
-    if (!SANITIZE (u.tag)) return false;
+    if (!u.tag.sanitize (context)) return false;
     switch (u.tag) {
     case CFFTag:	/* All the non-collection tags */
     case TrueTag:
diff --git a/src/hb-open-type-private.hh b/src/hb-open-type-private.hh
index 499754f87..82c23c6a9 100644
--- a/src/hb-open-type-private.hh
+++ b/src/hb-open-type-private.hh
@@ -238,8 +238,6 @@ struct hb_sanitize_context_t
 };
 
 
-#define SANITIZE(X) likely ((X).sanitize (context))
-
 #define SANITIZE_SELF() likely(context->check_range (this, sizeof (*this)))
 
 
@@ -522,7 +520,7 @@ struct GenericArrayOf
      * other structs. */
     unsigned int count = len;
     for (unsigned int i = 0; i < count; i++)
-      if (!SANITIZE (array()[i]))
+      if (array()[i].sanitize (context))
         return false;
     return true;
   }
@@ -635,7 +633,7 @@ struct HeadlessArrayOf
     unsigned int count = len ? len - 1 : 0;
     Type *a = array();
     for (unsigned int i = 0; i < count; i++)
-      if (!SANITIZE (a[i]))
+      if (!a[i].sanitize (context))
         return false;
     return true;
   }
diff --git a/src/hb-ot-layout-common-private.hh b/src/hb-ot-layout-common-private.hh
index 1a4be0f70..0ff3dd670 100644
--- a/src/hb-ot-layout-common-private.hh
+++ b/src/hb-ot-layout-common-private.hh
@@ -167,7 +167,7 @@ struct LangSys
   inline bool sanitize (hb_sanitize_context_t *context) {
     TRACE_SANITIZE ();
     return SANITIZE_SELF ()
-	&& SANITIZE (featureIndex);
+	&& featureIndex.sanitize (context);
   }
 
   Offset	lookupOrder;	/* = Null (reserved for an offset to a
@@ -236,7 +236,7 @@ struct Feature
   inline bool sanitize (hb_sanitize_context_t *context) {
     TRACE_SANITIZE ();
     return SANITIZE_SELF ()
-	&& SANITIZE (lookupIndex);
+	&& lookupIndex.sanitize (context);
   }
 
   /* LONGTERMTODO: implement get_feature_parameters() */
@@ -292,7 +292,7 @@ struct Lookup
     if (unlikely (lookupFlag & LookupFlag::UseMarkFilteringSet))
     {
       USHORT &markFilteringSet = StructAfter<USHORT> (subTable);
-      if (!SANITIZE (markFilteringSet)) return false;
+      if (!markFilteringSet.sanitize (context)) return false;
     }
     return true;
   }
@@ -336,7 +336,7 @@ struct CoverageFormat1
 
   inline bool sanitize (hb_sanitize_context_t *context) {
     TRACE_SANITIZE ();
-    return SANITIZE (glyphArray);
+    return glyphArray.sanitize (context);
   }
 
   private:
@@ -395,7 +395,7 @@ struct CoverageFormat2
 
   inline bool sanitize (hb_sanitize_context_t *context) {
     TRACE_SANITIZE ();
-    return SANITIZE (rangeRecord);
+    return rangeRecord.sanitize (context);
   }
 
   private:
@@ -422,7 +422,7 @@ struct Coverage
 
   inline bool sanitize (hb_sanitize_context_t *context) {
     TRACE_SANITIZE ();
-    if (!SANITIZE (u.format)) return false;
+    if (!u.format.sanitize (context)) return false;
     switch (u.format) {
     case 1: return u.format1->sanitize (context);
     case 2: return u.format2->sanitize (context);
@@ -458,7 +458,7 @@ struct ClassDefFormat1
   inline bool sanitize (hb_sanitize_context_t *context) {
     TRACE_SANITIZE ();
     return SANITIZE_SELF ()
-	&& SANITIZE (classValue);
+	&& classValue.sanitize (context);
   }
 
   USHORT	classFormat;		/* Format identifier--format = 1 */
@@ -516,7 +516,7 @@ struct ClassDefFormat2
 
   inline bool sanitize (hb_sanitize_context_t *context) {
     TRACE_SANITIZE ();
-    return SANITIZE (rangeRecord);
+    return rangeRecord.sanitize (context);
   }
 
   USHORT	classFormat;	/* Format identifier--format = 2 */
@@ -541,7 +541,7 @@ struct ClassDef
 
   inline bool sanitize (hb_sanitize_context_t *context) {
     TRACE_SANITIZE ();
-    if (!SANITIZE (u.format)) return false;
+    if (!u.format.sanitize (context)) return false;
     switch (u.format) {
     case 1: return u.format1->sanitize (context);
     case 2: return u.format2->sanitize (context);
diff --git a/src/hb-ot-layout-gdef-private.hh b/src/hb-ot-layout-gdef-private.hh
index 9be16a351..76b3ffc26 100644
--- a/src/hb-ot-layout-gdef-private.hh
+++ b/src/hb-ot-layout-gdef-private.hh
@@ -176,7 +176,7 @@ struct CaretValue
 
   inline bool sanitize (hb_sanitize_context_t *context) {
     TRACE_SANITIZE ();
-    if (!SANITIZE (u.format)) return false;
+    if (!u.format.sanitize (context)) return false;
     switch (u.format) {
     case 1: return u.format1->sanitize (context);
     case 2: return u.format2->sanitize (context);
@@ -291,7 +291,7 @@ struct MarkGlyphSets
 
   inline bool sanitize (hb_sanitize_context_t *context) {
     TRACE_SANITIZE ();
-    if (!SANITIZE (u.format)) return false;
+    if (!u.format.sanitize (context)) return false;
     switch (u.format) {
     case 1: return u.format1->sanitize (context);
     default:return true;
@@ -351,7 +351,7 @@ struct GDEF
 
   inline bool sanitize (hb_sanitize_context_t *context) {
     TRACE_SANITIZE ();
-    return SANITIZE (version) && likely (version.major == 1)
+    return version.sanitize (context) && likely (version.major == 1)
 	&& glyphClassDef.sanitize (context, this)
 	&& attachList.sanitize (context, this)
 	&& ligCaretList.sanitize (context, this)
diff --git a/src/hb-ot-layout-gpos-private.hh b/src/hb-ot-layout-gpos-private.hh
index 3f67b146e..95d9353c6 100644
--- a/src/hb-ot-layout-gpos-private.hh
+++ b/src/hb-ot-layout-gpos-private.hh
@@ -318,7 +318,7 @@ struct Anchor
 
   inline bool sanitize (hb_sanitize_context_t *context) {
     TRACE_SANITIZE ();
-    if (!SANITIZE (u.format)) return false;
+    if (!u.format.sanitize (context)) return false;
     switch (u.format) {
     case 1: return u.format1->sanitize (context);
     case 2: return u.format2->sanitize (context);
@@ -526,7 +526,7 @@ struct SinglePos
 
   inline bool sanitize (hb_sanitize_context_t *context) {
     TRACE_SANITIZE ();
-    if (!SANITIZE (u.format)) return false;
+    if (!u.format.sanitize (context)) return false;
     switch (u.format) {
     case 1: return u.format1->sanitize (context);
     case 2: return u.format2->sanitize (context);
@@ -776,7 +776,7 @@ struct PairPos
 
   inline bool sanitize (hb_sanitize_context_t *context) {
     TRACE_SANITIZE ();
-    if (!SANITIZE (u.format)) return false;
+    if (!u.format.sanitize (context)) return false;
     switch (u.format) {
     case 1: return u.format1->sanitize (context);
     case 2: return u.format2->sanitize (context);
@@ -1027,7 +1027,7 @@ struct CursivePos
 
   inline bool sanitize (hb_sanitize_context_t *context) {
     TRACE_SANITIZE ();
-    if (!SANITIZE (u.format)) return false;
+    if (!u.format.sanitize (context)) return false;
     switch (u.format) {
     case 1: return u.format1->sanitize (context);
     default:return true;
@@ -1125,7 +1125,7 @@ struct MarkBasePos
 
   inline bool sanitize (hb_sanitize_context_t *context) {
     TRACE_SANITIZE ();
-    if (!SANITIZE (u.format)) return false;
+    if (!u.format.sanitize (context)) return false;
     switch (u.format) {
     case 1: return u.format1->sanitize (context);
     default:return true;
@@ -1250,7 +1250,7 @@ struct MarkLigPos
 
   inline bool sanitize (hb_sanitize_context_t *context) {
     TRACE_SANITIZE ();
-    if (!SANITIZE (u.format)) return false;
+    if (!u.format.sanitize (context)) return false;
     switch (u.format) {
     case 1: return u.format1->sanitize (context);
     default:return true;
@@ -1354,7 +1354,7 @@ struct MarkMarkPos
 
   inline bool sanitize (hb_sanitize_context_t *context) {
     TRACE_SANITIZE ();
-    if (!SANITIZE (u.format)) return false;
+    if (!u.format.sanitize (context)) return false;
     switch (u.format) {
     case 1: return u.format1->sanitize (context);
     default:return true;
@@ -1455,7 +1455,7 @@ struct PosLookupSubTable
 
   inline bool sanitize (hb_sanitize_context_t *context) {
     TRACE_SANITIZE ();
-    if (!SANITIZE (u.format)) return false;
+    if (!u.format.sanitize (context)) return false;
     switch (u.format) {
     case Single:		return u.single->sanitize (context);
     case Pair:			return u.pair->sanitize (context);
@@ -1604,7 +1604,7 @@ inline bool ExtensionPos::sanitize (hb_sanitize_context_t *context)
   if (unlikely (!Extension::sanitize (context))) return false;
   unsigned int offset = get_offset ();
   if (unlikely (!offset)) return true;
-  return SANITIZE (StructAtOffset<PosLookupSubTable> (*this, offset));
+  return StructAtOffset<PosLookupSubTable> (*this, offset).sanitize (context);
 }
 
 static inline bool position_lookup (hb_apply_context_t *context, unsigned int lookup_index)
diff --git a/src/hb-ot-layout-gsub-private.hh b/src/hb-ot-layout-gsub-private.hh
index 461e9a920..558540927 100644
--- a/src/hb-ot-layout-gsub-private.hh
+++ b/src/hb-ot-layout-gsub-private.hh
@@ -61,7 +61,7 @@ struct SingleSubstFormat1
   inline bool sanitize (hb_sanitize_context_t *context) {
     TRACE_SANITIZE ();
     return coverage.sanitize (context, this)
-	&& SANITIZE (deltaGlyphID);
+	&& deltaGlyphID.sanitize (context);
   }
 
   private:
@@ -104,7 +104,7 @@ struct SingleSubstFormat2
   inline bool sanitize (hb_sanitize_context_t *context) {
     TRACE_SANITIZE ();
     return coverage.sanitize (context, this)
-	&& SANITIZE (substitute);
+	&& substitute.sanitize (context);
   }
 
   private:
@@ -136,7 +136,7 @@ struct SingleSubst
 
   inline bool sanitize (hb_sanitize_context_t *context) {
     TRACE_SANITIZE ();
-    if (!SANITIZE (u.format)) return false;
+    if (!u.format.sanitize (context)) return false;
     switch (u.format) {
     case 1: return u.format1->sanitize (context);
     case 2: return u.format2->sanitize (context);
@@ -186,7 +186,7 @@ struct Sequence
   public:
   inline bool sanitize (hb_sanitize_context_t *context) {
     TRACE_SANITIZE ();
-    return SANITIZE (substitute);
+    return substitute.sanitize (context);
   }
 
   private:
@@ -246,7 +246,7 @@ struct MultipleSubst
 
   inline bool sanitize (hb_sanitize_context_t *context) {
     TRACE_SANITIZE ();
-    if (!SANITIZE (u.format)) return false;
+    if (!u.format.sanitize (context)) return false;
     switch (u.format) {
     case 1: return u.format1->sanitize (context);
     default:return true;
@@ -342,7 +342,7 @@ struct AlternateSubst
 
   inline bool sanitize (hb_sanitize_context_t *context) {
     TRACE_SANITIZE ();
-    if (!SANITIZE (u.format)) return false;
+    if (!u.format.sanitize (context)) return false;
     switch (u.format) {
     case 1: return u.format1->sanitize (context);
     default:return true;
@@ -428,8 +428,8 @@ struct Ligature
   public:
   inline bool sanitize (hb_sanitize_context_t *context) {
     TRACE_SANITIZE ();
-    return SANITIZE (ligGlyph)
-        && SANITIZE (component);
+    return ligGlyph.sanitize (context)
+        && component.sanitize (context);
   }
 
   private:
@@ -526,7 +526,7 @@ struct LigatureSubst
 
   inline bool sanitize (hb_sanitize_context_t *context) {
     TRACE_SANITIZE ();
-    if (!SANITIZE (u.format)) return false;
+    if (!u.format.sanitize (context)) return false;
     switch (u.format) {
     case 1: return u.format1->sanitize (context);
     default:return true;
@@ -633,7 +633,7 @@ struct ReverseChainSingleSubstFormat1
     if (!lookahead.sanitize (context, this))
       return false;
     ArrayOf<GlyphID> &substitute = StructAfter<ArrayOf<GlyphID> > (lookahead);
-    return SANITIZE (substitute);
+    return substitute.sanitize (context);
   }
 
   private:
@@ -671,7 +671,7 @@ struct ReverseChainSingleSubst
 
   inline bool sanitize (hb_sanitize_context_t *context) {
     TRACE_SANITIZE ();
-    if (!SANITIZE (u.format)) return false;
+    if (!u.format.sanitize (context)) return false;
     switch (u.format) {
     case 1: return u.format1->sanitize (context);
     default:return true;
@@ -724,7 +724,7 @@ struct SubstLookupSubTable
 
   inline bool sanitize (hb_sanitize_context_t *context) {
     TRACE_SANITIZE ();
-    if (!SANITIZE (u.format)) return false;
+    if (!u.format.sanitize (context)) return false;
     switch (u.format) {
     case Single:		return u.single->sanitize (context);
     case Multiple:		return u.multiple->sanitize (context);
@@ -908,7 +908,7 @@ inline bool ExtensionSubst::sanitize (hb_sanitize_context_t *context)
   if (unlikely (!Extension::sanitize (context))) return false;
   unsigned int offset = get_offset ();
   if (unlikely (!offset)) return true;
-  return SANITIZE (StructAtOffset<SubstLookupSubTable> (*this, offset));
+  return StructAtOffset<SubstLookupSubTable> (*this, offset).sanitize (context);
 }
 
 inline bool ExtensionSubst::is_reverse (void) const
diff --git a/src/hb-ot-layout-gsubgpos-private.hh b/src/hb-ot-layout-gsubgpos-private.hh
index 86d64055c..9f2ab4ace 100644
--- a/src/hb-ot-layout-gsubgpos-private.hh
+++ b/src/hb-ot-layout-gsubgpos-private.hh
@@ -287,8 +287,8 @@ struct Rule
   public:
   inline bool sanitize (hb_sanitize_context_t *context) {
     TRACE_SANITIZE ();
-    return SANITIZE (inputCount)
-	&& SANITIZE (lookupCount)
+    return inputCount.sanitize (context)
+	&& lookupCount.sanitize (context)
 	&& context->check_range (input,
 				 input[0].get_size () * inputCount
 				 + lookupRecordX[0].get_size () * lookupCount);
@@ -481,7 +481,7 @@ struct Context
 
   inline bool sanitize (hb_sanitize_context_t *context) {
     TRACE_SANITIZE ();
-    if (!SANITIZE (u.format)) return false;
+    if (!u.format.sanitize (context)) return false;
     switch (u.format) {
     case 1: return u.format1->sanitize (context);
     case 2: return u.format2->sanitize (context);
@@ -566,13 +566,13 @@ struct ChainRule
   public:
   inline bool sanitize (hb_sanitize_context_t *context) {
     TRACE_SANITIZE ();
-    if (!SANITIZE (backtrack)) return false;
+    if (!backtrack.sanitize (context)) return false;
     HeadlessArrayOf<USHORT> &input = StructAfter<HeadlessArrayOf<USHORT> > (backtrack);
-    if (!SANITIZE (input)) return false;
+    if (!input.sanitize (context)) return false;
     ArrayOf<USHORT> &lookahead = StructAfter<ArrayOf<USHORT> > (input);
-    if (!SANITIZE (lookahead)) return false;
+    if (!lookahead.sanitize (context)) return false;
     ArrayOf<LookupRecord> &lookup = StructAfter<ArrayOf<LookupRecord> > (lookahead);
-    return SANITIZE (lookup);
+    return lookup.sanitize (context);
   }
 
   private:
@@ -756,7 +756,7 @@ struct ChainContextFormat3
     OffsetArrayOf<Coverage> &lookahead = StructAfter<OffsetArrayOf<Coverage> > (input);
     if (!lookahead.sanitize (context, this)) return false;
     ArrayOf<LookupRecord> &lookup = StructAfter<ArrayOf<LookupRecord> > (lookahead);
-    return SANITIZE (lookup);
+    return lookup.sanitize (context);
   }
 
   private:
@@ -795,7 +795,7 @@ struct ChainContext
 
   inline bool sanitize (hb_sanitize_context_t *context) {
     TRACE_SANITIZE ();
-    if (!SANITIZE (u.format)) return false;
+    if (!u.format.sanitize (context)) return false;
     switch (u.format) {
     case 1: return u.format1->sanitize (context);
     case 2: return u.format2->sanitize (context);
@@ -856,7 +856,7 @@ struct Extension
 
   inline bool sanitize (hb_sanitize_context_t *context) {
     TRACE_SANITIZE ();
-    if (!SANITIZE (u.format)) return false;
+    if (!u.format.sanitize (context)) return false;
     switch (u.format) {
     case 1: return u.format1->sanitize (context);
     default:return true;
@@ -913,7 +913,7 @@ struct GSUBGPOS
 
   inline bool sanitize (hb_sanitize_context_t *context) {
     TRACE_SANITIZE ();
-    return SANITIZE (version) && likely (version.major == 1)
+    return version.sanitize (context) && likely (version.major == 1)
 	&& scriptList.sanitize (context, this)
 	&& featureList.sanitize (context, this)
 	&& lookupList.sanitize (context, this);