diff --git a/src/hb-cff-interp-common.hh b/src/hb-cff-interp-common.hh
index cd5552dbb..24b7daf55 100644
--- a/src/hb-cff-interp-common.hh
+++ b/src/hb-cff-interp-common.hh
@@ -494,7 +494,7 @@ struct Stack
   inline const ELEM& peek (void)
   {
     if (likely (count > 0))
-      return elements[count];
+      return elements[count-1];
     else
       return Null(ELEM);
   }
diff --git a/src/hb-cff-interp-cs-common.hh b/src/hb-cff-interp-cs-common.hh
index ec3eae40f..ab9aa0028 100644
--- a/src/hb-cff-interp-cs-common.hh
+++ b/src/hb-cff-interp-cs-common.hh
@@ -372,19 +372,6 @@ struct CSOpSet : OpSet<ARG>
     OPSET::flush_args_and_op (op, env, param);
   }
 
-  static inline bool is_subr_op (OpCode op)
-  {
-    switch (op)
-    {
-      case OpCode_callsubr:
-      case OpCode_callgsubr:
-      case OpCode_return:
-        return true;
-      default:
-        return false;
-    }
-  }
-
   protected:
   typedef OpSet<ARG>  SUPER;
 };
diff --git a/src/hb-cff2-interp-cs.hh b/src/hb-cff2-interp-cs.hh
index 5a564bcf7..2a68da8d9 100644
--- a/src/hb-cff2-interp-cs.hh
+++ b/src/hb-cff2-interp-cs.hh
@@ -90,7 +90,7 @@ struct CFF2CSInterpEnv : CSInterpEnv<BlendArg, CFF2Subrs>
 
   inline bool fetch_op (OpCode &op)
   {
-    if (unlikely (this->substr.avail ()))
+    if (this->substr.avail ())
       return SUPER::fetch_op (op);
 
     /* make up return or endchar op */
@@ -129,8 +129,9 @@ struct CFF2CSOpSet : CSOpSet<BlendArg, OPSET, CFF2CSInterpEnv, PARAM, PATH>
       case OpCode_callsubr:
       case OpCode_callgsubr:
         /* a subroutine number shoudln't be a blended value */
-        return (!env.argStack.peek ().blended () &&
-                SUPER::process_op (op, env, param));
+        if (unlikely (env.argStack.peek ().blended ()))
+          return false;
+        return SUPER::process_op (op, env, param);
 
       case OpCode_blendcs:
         return OPSET::process_blend (env, param);