diff --git a/src/hb-aat-layout-common-private.hh b/src/hb-aat-layout-common-private.hh
index b1165e9bf..538615f76 100644
--- a/src/hb-aat-layout-common-private.hh
+++ b/src/hb-aat-layout-common-private.hh
@@ -704,13 +704,23 @@ struct hb_aat_apply_context_t :
   hb_font_t *font;
   hb_face_t *face;
   hb_buffer_t *buffer;
-  const char *end;
+  hb_sanitize_context_t sanitizer;
 
-  hb_aat_apply_context_t (hb_font_t *font_,
-			  hb_buffer_t *buffer_,
-			  const char *end_) :
-			font (font_), face (font->face), buffer (buffer_),
-			end (end_) {}
+  inline hb_aat_apply_context_t (hb_font_t *font_,
+				 hb_buffer_t *buffer_,
+				 hb_blob_t *table) :
+		font (font_), face (font->face), buffer (buffer_),
+		sanitizer ()
+  {
+    sanitizer.init (table);
+    sanitizer.num_glyphs = face->get_num_glyphs ();
+    sanitizer.start_processing ();
+  }
+
+  inline ~hb_aat_apply_context_t (void)
+  {
+    sanitizer.end_processing ();
+  }
 };
 
 
diff --git a/src/hb-aat-layout.cc b/src/hb-aat-layout.cc
index 465aec642..d882fa166 100644
--- a/src/hb-aat-layout.cc
+++ b/src/hb-aat-layout.cc
@@ -37,19 +37,19 @@
  */
 
 static inline const AAT::morx&
-_get_morx (hb_face_t *face, unsigned int *length = nullptr)
+_get_morx (hb_face_t *face, hb_blob_t **blob = nullptr)
 {
   if (unlikely (!hb_ot_shaper_face_data_ensure (face)))
   {
-    if (length)
-      *length = 0;
+    if (blob)
+      *blob = hb_blob_get_empty ();
     return OT::Null(AAT::morx);
   }
   hb_ot_layout_t * layout = hb_ot_layout_from_face (face);
   /* XXX this doesn't call set_num_glyphs on sanitizer. */
   const AAT::morx& morx = *(layout->morx.get ());
-  if (length)
-    *length = hb_blob_get_length (layout->morx.blob);
+  if (blob)
+    *blob = layout->morx.blob;
   return morx;
 }
 
@@ -70,9 +70,9 @@ _hb_aat_layout_create (hb_face_t *face)
 void
 hb_aat_layout_substitute (hb_font_t *font, hb_buffer_t *buffer)
 {
-  unsigned int length;
-  const AAT::morx& morx = _get_morx (font->face, &length);
+  hb_blob_t *blob;
+  const AAT::morx& morx = _get_morx (font->face, &blob);
 
-  AAT::hb_aat_apply_context_t c (font, buffer, (const char *) &morx + length);
+  AAT::hb_aat_apply_context_t c (font, buffer, blob);
   morx.apply (&c);
 }