From 82484b05ca7a51dec6f3f9e9b0d7967823d7657f Mon Sep 17 00:00:00 2001
From: Jonathan Kew <jfkthame@gmail.com>
Date: Mon, 11 Jun 2018 20:55:14 -0700
Subject: [PATCH] [hb-set] Don't shrink vectors until after processing their
 contents.

Fixes #1054.
---
 src/hb-set-private.hh | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/src/hb-set-private.hh b/src/hb-set-private.hh
index ed753e68a..ccd4d8df5 100644
--- a/src/hb-set-private.hh
+++ b/src/hb-set-private.hh
@@ -424,7 +424,7 @@ struct hb_set_t
     unsigned int nb = other->pages.len;
     unsigned int next_page = na;
 
-    unsigned int count = 0;
+    unsigned int count = 0, newCount = 0;
     unsigned int a = 0, b = 0;
     for (; a < na && b < nb; )
     {
@@ -452,8 +452,10 @@ struct hb_set_t
     if (Op::passthru_right)
       count += nb - b;
 
-    if (!resize (count))
-      return;
+    if (count > pages.len)
+      if (!resize (count))
+        return;
+    newCount = count;
 
     /* Process in-place backward. */
     a = na;
@@ -506,6 +508,8 @@ struct hb_set_t
 	page_at (count).v = other->page_at (b).v;
       }
     assert (!count);
+    if (pages.len > newCount)
+      resize (newCount);
   }
 
   inline void union_ (const hb_set_t *other)