From 98aaecd3978c4389741789657d3fcacc8d1686d0 Mon Sep 17 00:00:00 2001
From: Garret Rieger <grieger@google.com>
Date: Wed, 1 Jun 2022 21:01:16 +0000
Subject: [PATCH] [subset] fix data race touching Crap() in cff subsetting.

---
 src/hb-ot-cff1-table.hh           | 3 ++-
 src/hb-subset-cff-common.hh       | 3 ++-
 test/threads/hb-subset-threads.cc | 2 +-
 3 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/src/hb-ot-cff1-table.hh b/src/hb-ot-cff1-table.hh
index 43046d829..ce97182e1 100644
--- a/src/hb-ot-cff1-table.hh
+++ b/src/hb-ot-cff1-table.hh
@@ -1138,7 +1138,8 @@ struct cff1
 	  cff1_top_dict_interp_env_t env (fontDictStr);
 	  cff1_font_dict_interpreter_t font_interp (env);
 	  font = fontDicts.push ();
-	  if (unlikely (font == &Crap (cff1_font_dict_values_t))) { fini (); return; }
+	  if (unlikely (fontDicts.in_error ())) { fini (); return; }
+
 	  font->init ();
 	  if (unlikely (!font_interp.interpret (*font))) { fini (); return; }
 	  PRIVDICTVAL *priv = &privateDicts[i];
diff --git a/src/hb-subset-cff-common.hh b/src/hb-subset-cff-common.hh
index ae155b4e3..bb9f27eec 100644
--- a/src/hb-subset-cff-common.hh
+++ b/src/hb-subset-cff-common.hh
@@ -44,7 +44,8 @@ struct str_encoder_t
 
   void encode_byte (unsigned char b)
   {
-    if (unlikely (buff.push (b) == &Crap (unsigned char)))
+    buff.push (b);
+    if (unlikely (buff.in_error ()))
       set_error ();
   }
 
diff --git a/test/threads/hb-subset-threads.cc b/test/threads/hb-subset-threads.cc
index 80bcd2b5c..9d86d8d51 100644
--- a/test/threads/hb-subset-threads.cc
+++ b/test/threads/hb-subset-threads.cc
@@ -159,7 +159,7 @@ int main(int argc, char** argv)
 
   if (argc > 4)
   {
-    num_tests = (argc - 3) / 2;
+    num_tests = argc - 3;
     tests = (test_input_t *) calloc (num_tests, sizeof (test_input_t));
     for (unsigned i = 0; i < num_tests; i++)
     {