gnu: icecat: Update bundled graphite2 to 1.3.5 for security fixes.

* gnu/packages/patches/icecat-update-graphite2.patch: New file.
* gnu-system.am (dist_patch_DATA): Add it.
* gnu/packages/gnuzilla.scm (icecat)[source]: Add patch.  Add TODO
  comment about using the system graphite2 in the future.

2 files changed, 9992 insertions, 1 deletions

diff --git a/gnu/packages/gnuzilla.scm b/gnu/packages/gnuzilla.scm
index 2ddad9afe2..1d3ebe8c8e 100644
--- a/gnu/packages/gnuzilla.scm
+++ b/gnu/packages/gnuzilla.scm
@@ -289,7 +289,8 @@ standards.")
         "0bd4k5cwr8ynscaxffvj2x3kgky3dmjq0qhpcb931l98bh0103lx"))
       (patches (map search-patch
                     '("icecat-avoid-bundled-includes.patch"
-                      "icecat-re-enable-DHE-cipher-suites.patch")))
+                      "icecat-re-enable-DHE-cipher-suites.patch"
+                      "icecat-update-graphite2.patch")))
       (modules '((guix build utils)))
       (snippet
        '(begin
@@ -318,6 +319,8 @@ standards.")
                       ;; TODO: Use system harfbuzz.  Waiting for:
                       ;; <https://bugzilla.mozilla.org/show_bug.cgi?id=847568>
                       ;;
+                      ;; TODO: Use system graphite2.
+                      ;;
                       "modules/freetype2"
                       "modules/zlib"
                       "modules/libbz2"
diff --git a/gnu/packages/patches/icecat-update-graphite2.patch b/gnu/packages/patches/icecat-update-graphite2.patch
new file mode 100644
index 0000000000..af2c47bef7
--- /dev/null
+++ b/gnu/packages/patches/icecat-update-graphite2.patch
@@ -0,0 +1,9988 @@
+Copied from upstream:
+https://hg.mozilla.org/releases/mozilla-esr38/raw-rev/ed4d2ce6046b
+
+# HG changeset patch
+# User Jonathan Kew <jkew@mozilla.com>
+# Date 1455126706 0
+# Node ID ed4d2ce6046b20287fd13c548dd3982fe1a24875
+# Parent  78d3632feb7b6f6046025352630bd4f5365f3106
+Bug 1246093 - Update graphite2 library to latest release on esr38. r=me,a=sledru+lizzard
+
+diff --git a/gfx/graphite2/COPYING b/gfx/graphite2/COPYING
+new file mode 100644
+--- /dev/null
++++ b/gfx/graphite2/COPYING
+@@ -0,0 +1,26 @@
++/*  GRAPHITE2 LICENSING
++
++    Copyright 2010, SIL International
++    All rights reserved.
++
++    This library is free software; you can redistribute it and/or modify
++    it under the terms of the GNU Lesser General Public License as published
++    by the Free Software Foundation; either version 2.1 of License, or
++    (at your option) any later version.
++
++    This program is distributed in the hope that it will be useful,
++    but WITHOUT ANY WARRANTY; without even the implied warranty of
++    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++    Lesser General Public License for more details.
++
++    You should also have received a copy of the GNU Lesser General Public
++    License along with this library in the file named "LICENSE".
++    If not, write to the Free Software Foundation, 51 Franklin Street, 
++    Suite 500, Boston, MA 02110-1335, USA or visit their web page on the 
++    internet at http://www.fsf.org/licenses/lgpl.html.
++
++    Alternatively, you may use this library under the terms of the Mozilla
++    Public License (http://mozilla.org/MPL) or under the GNU General Public
++    License, as published by the Free Sofware Foundation; either version
++    2 of the license or (at your option) any later version.
++*/
+diff --git a/gfx/graphite2/LICENSE b/gfx/graphite2/LICENSE
+new file mode 100644
+--- /dev/null
++++ b/gfx/graphite2/LICENSE
+@@ -0,0 +1,510 @@
++
++                  GNU LESSER GENERAL PUBLIC LICENSE
++                       Version 2.1, February 1999
++
++ Copyright (C) 1991, 1999 Free Software Foundation, Inc.
++	51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
++ Everyone is permitted to copy and distribute verbatim copies
++ of this license document, but changing it is not allowed.
++
++[This is the first released version of the Lesser GPL.  It also counts
++ as the successor of the GNU Library Public License, version 2, hence
++ the version number 2.1.]
++
++                            Preamble
++
++  The licenses for most software are designed to take away your
++freedom to share and change it.  By contrast, the GNU General Public
++Licenses are intended to guarantee your freedom to share and change
++free software--to make sure the software is free for all its users.
++
++  This license, the Lesser General Public License, applies to some
++specially designated software packages--typically libraries--of the
++Free Software Foundation and other authors who decide to use it.  You
++can use it too, but we suggest you first think carefully about whether
++this license or the ordinary General Public License is the better
++strategy to use in any particular case, based on the explanations
++below.
++
++  When we speak of free software, we are referring to freedom of use,
++not price.  Our General Public Licenses are designed to make sure that
++you have the freedom to distribute copies of free software (and charge
++for this service if you wish); that you receive source code or can get
++it if you want it; that you can change the software and use pieces of
++it in new free programs; and that you are informed that you can do
++these things.
++
++  To protect your rights, we need to make restrictions that forbid
++distributors to deny you these rights or to ask you to surrender these
++rights.  These restrictions translate to certain responsibilities for
++you if you distribute copies of the library or if you modify it.
++
++  For example, if you distribute copies of the library, whether gratis
++or for a fee, you must give the recipients all the rights that we gave
++you.  You must make sure that they, too, receive or can get the source
++code.  If you link other code with the library, you must provide
++complete object files to the recipients, so that they can relink them
++with the library after making changes to the library and recompiling
++it.  And you must show them these terms so they know their rights.
++
++  We protect your rights with a two-step method: (1) we copyright the
++library, and (2) we offer you this license, which gives you legal
++permission to copy, distribute and/or modify the library.
++
++  To protect each distributor, we want to make it very clear that
++there is no warranty for the free library.  Also, if the library is
++modified by someone else and passed on, the recipients should know
++that what they have is not the original version, so that the original
++author's reputation will not be affected by problems that might be
++introduced by others.
++
++  Finally, software patents pose a constant threat to the existence of
++any free program.  We wish to make sure that a company cannot
++effectively restrict the users of a free program by obtaining a
++restrictive license from a patent holder.  Therefore, we insist that
++any patent license obtained for a version of the library must be
++consistent with the full freedom of use specified in this license.
++
++  Most GNU software, including some libraries, is covered by the
++ordinary GNU General Public License.  This license, the GNU Lesser
++General Public License, applies to certain designated libraries, and
++is quite different from the ordinary General Public License.  We use
++this license for certain libraries in order to permit linking those
++libraries into non-free programs.
++
++  When a program is linked with a library, whether statically or using
++a shared library, the combination of the two is legally speaking a
++combined work, a derivative of the original library.  The ordinary
++General Public License therefore permits such linking only if the
++entire combination fits its criteria of freedom.  The Lesser General
++Public License permits more lax criteria for linking other code with
++the library.
++
++  We call this license the "Lesser" General Public License because it
++does Less to protect the user's freedom than the ordinary General
++Public License.  It also provides other free software developers Less
++of an advantage over competing non-free programs.  These disadvantages
++are the reason we use the ordinary General Public License for many
++libraries.  However, the Lesser license provides advantages in certain
++special circumstances.
++
++  For example, on rare occasions, there may be a special need to
++encourage the widest possible use of a certain library, so that it
++becomes a de-facto standard.  To achieve this, non-free programs must
++be allowed to use the library.  A more frequent case is that a free
++library does the same job as widely used non-free libraries.  In this
++case, there is little to gain by limiting the free library to free
++software only, so we use the Lesser General Public License.
++
++  In other cases, permission to use a particular library in non-free
++programs enables a greater number of people to use a large body of
++free software.  For example, permission to use the GNU C Library in
++non-free programs enables many more people to use the whole GNU
++operating system, as well as its variant, the GNU/Linux operating
++system.
++
++  Although the Lesser General Public License is Less protective of the
++users' freedom, it does ensure that the user of a program that is
++linked with the Library has the freedom and the wherewithal to run
++that program using a modified version of the Library.
++
++  The precise terms and conditions for copying, distribution and
++modification follow.  Pay close attention to the difference between a
++"work based on the library" and a "work that uses the library".  The
++former contains code derived from the library, whereas the latter must
++be combined with the library in order to run.
++
++                  GNU LESSER GENERAL PUBLIC LICENSE
++   TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
++
++  0. This License Agreement applies to any software library or other
++program which contains a notice placed by the copyright holder or
++other authorized party saying it may be distributed under the terms of
++this Lesser General Public License (also called "this License").
++Each licensee is addressed as "you".
++
++  A "library" means a collection of software functions and/or data
++prepared so as to be conveniently linked with application programs
++(which use some of those functions and data) to form executables.
++
++  The "Library", below, refers to any such software library or work
++which has been distributed under these terms.  A "work based on the
++Library" means either the Library or any derivative work under
++copyright law: that is to say, a work containing the Library or a
++portion of it, either verbatim or with modifications and/or translated
++straightforwardly into another language.  (Hereinafter, translation is
++included without limitation in the term "modification".)
++
++  "Source code" for a work means the preferred form of the work for
++making modifications to it.  For a library, complete source code means
++all the source code for all modules it contains, plus any associated
++interface definition files, plus the scripts used to control
++compilation and installation of the library.
++
++  Activities other than copying, distribution and modification are not
++covered by this License; they are outside its scope.  The act of
++running a program using the Library is not restricted, and output from
++such a program is covered only if its contents constitute a work based
++on the Library (independent of the use of the Library in a tool for
++writing it).  Whether that is true depends on what the Library does
++and what the program that uses the Library does.
++
++  1. You may copy and distribute verbatim copies of the Library's
++complete source code as you receive it, in any medium, provided that
++you conspicuously and appropriately publish on each copy an
++appropriate copyright notice and disclaimer of warranty; keep intact
++all the notices that refer to this License and to the absence of any
++warranty; and distribute a copy of this License along with the
++Library.
++
++  You may charge a fee for the physical act of transferring a copy,
++and you may at your option offer warranty protection in exchange for a
++fee.
++
++  2. You may modify your copy or copies of the Library or any portion
++of it, thus forming a work based on the Library, and copy and
++distribute such modifications or work under the terms of Section 1
++above, provided that you also meet all of these conditions:
++
++    a) The modified work must itself be a software library.
++
++    b) You must cause the files modified to carry prominent notices
++    stating that you changed the files and the date of any change.
++
++    c) You must cause the whole of the work to be licensed at no
++    charge to all third parties under the terms of this License.
++
++    d) If a facility in the modified Library refers to a function or a
++    table of data to be supplied by an application program that uses
++    the facility, other than as an argument passed when the facility
++    is invoked, then you must make a good faith effort to ensure that,
++    in the event an application does not supply such function or
++    table, the facility still operates, and performs whatever part of
++    its purpose remains meaningful.
++
++    (For example, a function in a library to compute square roots has
++    a purpose that is entirely well-defined independent of the
++    application.  Therefore, Subsection 2d requires that any
++    application-supplied function or table used by this function must
++    be optional: if the application does not supply it, the square
++    root function must still compute square roots.)
++
++These requirements apply to the modified work as a whole.  If
++identifiable sections of that work are not derived from the Library,
++and can be reasonably considered independent and separate works in
++themselves, then this License, and its terms, do not apply to those
++sections when you distribute them as separate works.  But when you
++distribute the same sections as part of a whole which is a work based
++on the Library, the distribution of the whole must be on the terms of
++this License, whose permissions for other licensees extend to the
++entire whole, and thus to each and every part regardless of who wrote
++it.
++
++Thus, it is not the intent of this section to claim rights or contest
++your rights to work written entirely by you; rather, the intent is to
++exercise the right to control the distribution of derivative or
++collective works based on the Library.
++
++In addition, mere aggregation of another work not based on the Library
++with the Library (or with a work based on the Library) on a volume of
++a storage or distribution medium does not bring the other work under
++the scope of this License.
++
++  3. You may opt to apply the terms of the ordinary GNU General Public
++License instead of this License to a given copy of the Library.  To do
++this, you must alter all the notices that refer to this License, so
++that they refer to the ordinary GNU General Public License, version 2,
++instead of to this License.  (If a newer version than version 2 of the
++ordinary GNU General Public License has appeared, then you can specify
++that version instead if you wish.)  Do not make any other change in
++these notices.
++
++  Once this change is made in a given copy, it is irreversible for
++that copy, so the ordinary GNU General Public License applies to all
++subsequent copies and derivative works made from that copy.
++
++  This option is useful when you wish to copy part of the code of
++the Library into a program that is not a library.
++
++  4. You may copy and distribute the Library (or a portion or
++derivative of it, under Section 2) in object code or executable form
++under the terms of Sections 1 and 2 above provided that you accompany
++it with the complete corresponding machine-readable source code, which
++must be distributed under the terms of Sections 1 and 2 above on a
++medium customarily used for software interchange.
++
++  If distribution of object code is made by offering access to copy
++from a designated place, then offering equivalent access to copy the
++source code from the same place satisfies the requirement to
++distribute the source code, even though third parties are not
++compelled to copy the source along with the object code.
++
++  5. A program that contains no derivative of any portion of the
++Library, but is designed to work with the Library by being compiled or
++linked with it, is called a "work that uses the Library".  Such a
++work, in isolation, is not a derivative work of the Library, and
++therefore falls outside the scope of this License.
++
++  However, linking a "work that uses the Library" with the Library
++creates an executable that is a derivative of the Library (because it
++contains portions of the Library), rather than a "work that uses the
++library".  The executable is therefore covered by this License.
++Section 6 states terms for distribution of such executables.
++
++  When a "work that uses the Library" uses material from a header file
++that is part of the Library, the object code for the work may be a
++derivative work of the Library even though the source code is not.
++Whether this is true is especially significant if the work can be
++linked without the Library, or if the work is itself a library.  The
++threshold for this to be true is not precisely defined by law.
++
++  If such an object file uses only numerical parameters, data
++structure layouts and accessors, and small macros and small inline
++functions (ten lines or less in length), then the use of the object
++file is unrestricted, regardless of whether it is legally a derivative
++work.  (Executables containing this object code plus portions of the
++Library will still fall under Section 6.)
++
++  Otherwise, if the work is a derivative of the Library, you may
++distribute the object code for the work under the terms of Section 6.
++Any executables containing that work also fall under Section 6,
++whether or not they are linked directly with the Library itself.
++
++  6. As an exception to the Sections above, you may also combine or
++link a "work that uses the Library" with the Library to produce a
++work containing portions of the Library, and distribute that work
++under terms of your choice, provided that the terms permit
++modification of the work for the customer's own use and reverse
++engineering for debugging such modifications.
++
++  You must give prominent notice with each copy of the work that the
++Library is used in it and that the Library and its use are covered by
++this License.  You must supply a copy of this License.  If the work
++during execution displays copyright notices, you must include the
++copyright notice for the Library among them, as well as a reference
++directing the user to the copy of this License.  Also, you must do one
++of these things:
++
++    a) Accompany the work with the complete corresponding
++    machine-readable source code for the Library including whatever
++    changes were used in the work (which must be distributed under
++    Sections 1 and 2 above); and, if the work is an executable linked
++    with the Library, with the complete machine-readable "work that
++    uses the Library", as object code and/or source code, so that the
++    user can modify the Library and then relink to produce a modified
++    executable containing the modified Library.  (It is understood
++    that the user who changes the contents of definitions files in the
++    Library will not necessarily be able to recompile the application
++    to use the modified definitions.)
++
++    b) Use a suitable shared library mechanism for linking with the
++    Library.  A suitable mechanism is one that (1) uses at run time a
++    copy of the library already present on the user's computer system,
++    rather than copying library functions into the executable, and (2)
++    will operate properly with a modified version of the library, if
++    the user installs one, as long as the modified version is
++    interface-compatible with the version that the work was made with.
++
++    c) Accompany the work with a written offer, valid for at least
++    three years, to give the same user the materials specified in
++    Subsection 6a, above, for a charge no more than the cost of
++    performing this distribution.
++
++    d) If distribution of the work is made by offering access to copy
++    from a designated place, offer equivalent access to copy the above
++    specified materials from the same place.
++
++    e) Verify that the user has already received a copy of these
++    materials or that you have already sent this user a copy.
++
++  For an executable, the required form of the "work that uses the
++Library" must include any data and utility programs needed for
++reproducing the executable from it.  However, as a special exception,
++the materials to be distributed need not include anything that is
++normally distributed (in either source or binary form) with the major
++components (compiler, kernel, and so on) of the operating system on
++which the executable runs, unless that component itself accompanies
++the executable.
++
++  It may happen that this requirement contradicts the license
++restrictions of other proprietary libraries that do not normally
++accompany the operating system.  Such a contradiction means you cannot
++use both them and the Library together in an executable that you
++distribute.
++
++  7. You may place library facilities that are a work based on the
++Library side-by-side in a single library together with other library
++facilities not covered by this License, and distribute such a combined
++library, provided that the separate distribution of the work based on
++the Library and of the other library facilities is otherwise
++permitted, and provided that you do these two things:
++
++    a) Accompany the combined library with a copy of the same work
++    based on the Library, uncombined with any other library
++    facilities.  This must be distributed under the terms of the
++    Sections above.
++
++    b) Give prominent notice with the combined library of the fact
++    that part of it is a work based on the Library, and explaining
++    where to find the accompanying uncombined form of the same work.
++
++  8. You may not copy, modify, sublicense, link with, or distribute
++the Library except as expressly provided under this License.  Any
++attempt otherwise to copy, modify, sublicense, link with, or
++distribute the Library is void, and will automatically terminate your
++rights under this License.  However, parties who have received copies,
++or rights, from you under this License will not have their licenses
++terminated so long as such parties remain in full compliance.
++
++  9. You are not required to accept this License, since you have not
++signed it.  However, nothing else grants you permission to modify or
++distribute the Library or its derivative works.  These actions are
++prohibited by law if you do not accept this License.  Therefore, by
++modifying or distributing the Library (or any work based on the
++Library), you indicate your acceptance of this License to do so, and
++all its terms and conditions for copying, distributing or modifying
++the Library or works based on it.
++
++  10. Each time you redistribute the Library (or any work based on the
++Library), the recipient automatically receives a license from the
++original licensor to copy, distribute, link with or modify the Library
++subject to these terms and conditions.  You may not impose any further
++restrictions on the recipients' exercise of the rights granted herein.
++You are not responsible for enforcing compliance by third parties with
++this License.
++
++  11. If, as a consequence of a court judgment or allegation of patent
++infringement or for any other reason (not limited to patent issues),
++conditions are imposed on you (whether by court order, agreement or
++otherwise) that contradict the conditions of this License, they do not
++excuse you from the conditions of this License.  If you cannot
++distribute so as to satisfy simultaneously your obligations under this
++License and any other pertinent obligations, then as a consequence you
++may not distribute the Library at all.  For example, if a patent
++license would not permit royalty-free redistribution of the Library by
++all those who receive copies directly or indirectly through you, then
++the only way you could satisfy both it and this License would be to
++refrain entirely from distribution of the Library.
++
++If any portion of this section is held invalid or unenforceable under
++any particular circumstance, the balance of the section is intended to
++apply, and the section as a whole is intended to apply in other
++circumstances.
++
++It is not the purpose of this section to induce you to infringe any
++patents or other property right claims or to contest validity of any
++such claims; this section has the sole purpose of protecting the
++integrity of the free software distribution system which is
++implemented by public license practices.  Many people have made
++generous contributions to the wide range of software distributed
++through that system in reliance on consistent application of that
++system; it is up to the author/donor to decide if he or she is willing
++to distribute software through any other system and a licensee cannot
++impose that choice.
++
++This section is intended to make thoroughly clear what is believed to
++be a consequence of the rest of this License.
++
++  12. If the distribution and/or use of the Library is restricted in
++certain countries either by patents or by copyrighted interfaces, the
++original copyright holder who places the Library under this License
++may add an explicit geographical distribution limitation excluding those
++countries, so that distribution is permitted only in or among
++countries not thus excluded.  In such case, this License incorporates
++the limitation as if written in the body of this License.
++
++  13. The Free Software Foundation may publish revised and/or new
++versions of the Lesser General Public License from time to time.
++Such new versions will be similar in spirit to the present version,
++but may differ in detail to address new problems or concerns.
++
++Each version is given a distinguishing version number.  If the Library
++specifies a version number of this License which applies to it and
++"any later version", you have the option of following the terms and
++conditions either of that version or of any later version published by
++the Free Software Foundation.  If the Library does not specify a
++license version number, you may choose any version ever published by
++the Free Software Foundation.
++
++  14. If you wish to incorporate parts of the Library into other free
++programs whose distribution conditions are incompatible with these,
++write to the author to ask for permission.  For software which is
++copyrighted by the Free Software Foundation, write to the Free
++Software Foundation; we sometimes make exceptions for this.  Our
++decision will be guided by the two goals of preserving the free status
++of all derivatives of our free software and of promoting the sharing
++and reuse of software generally.
++
++                            NO WARRANTY
++
++  15. BECAUSE THE LIBRARY IS LICENSED FREE OF CHARGE, THERE IS NO
++WARRANTY FOR THE LIBRARY, TO THE EXTENT PERMITTED BY APPLICABLE LAW.
++EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR
++OTHER PARTIES PROVIDE THE LIBRARY "AS IS" WITHOUT WARRANTY OF ANY
++KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE
++IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
++PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE
++LIBRARY IS WITH YOU.  SHOULD THE LIBRARY PROVE DEFECTIVE, YOU ASSUME
++THE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
++
++  16. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN
++WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY
++AND/OR REDISTRIBUTE THE LIBRARY AS PERMITTED ABOVE, BE LIABLE TO YOU
++FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR
++CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE
++LIBRARY (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING
++RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A
++FAILURE OF THE LIBRARY TO OPERATE WITH ANY OTHER SOFTWARE), EVEN IF
++SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH
++DAMAGES.
++
++                     END OF TERMS AND CONDITIONS
++
++           How to Apply These Terms to Your New Libraries
++
++  If you develop a new library, and you want it to be of the greatest
++possible use to the public, we recommend making it free software that
++everyone can redistribute and change.  You can do so by permitting
++redistribution under these terms (or, alternatively, under the terms
++of the ordinary General Public License).
++
++  To apply these terms, attach the following notices to the library.
++It is safest to attach them to the start of each source file to most
++effectively convey the exclusion of warranty; and each file should
++have at least the "copyright" line and a pointer to where the full
++notice is found.
++
++
++    <one line to give the library's name and a brief idea of what it does.>
++    Copyright (C) <year>  <name of author>
++
++    This library is free software; you can redistribute it and/or
++    modify it under the terms of the GNU Lesser General Public
++    License as published by the Free Software Foundation; either
++    version 2.1 of the License, or (at your option) any later version.
++
++    This library is distributed in the hope that it will be useful,
++    but WITHOUT ANY WARRANTY; without even the implied warranty of
++    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++    Lesser General Public License for more details.
++
++    You should have received a copy of the GNU Lesser General Public
++    License along with this library; if not, write to the Free Software
++    Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
++
++Also add information on how to contact you by electronic and paper mail.
++
++You should also get your employer (if you work as a programmer) or
++your school, if any, to sign a "copyright disclaimer" for the library,
++if necessary.  Here is a sample; alter the names:
++
++  Yoyodyne, Inc., hereby disclaims all copyright interest in the
++  library `Frob' (a library for tweaking knobs) written by James
++  Random Hacker.
++
++  <signature of Ty Coon>, 1 April 1990
++  Ty Coon, President of Vice
++
++That's all there is to it!
++
++
+diff --git a/gfx/graphite2/README.md b/gfx/graphite2/README.md
+new file mode 100644
+--- /dev/null
++++ b/gfx/graphite2/README.md
+@@ -0,0 +1,32 @@
++# Graphite engine
++
++## What is Graphite?
++
++Graphite is a system that can be used to create “smart fonts” capable of displaying writing systems with various complex behaviors. A smart font contains not only letter shapes but also additional instructions indicating how to combine and position the letters in complex ways.
++
++Graphite was primarily developed to provide the flexibility needed for minority languages which often need to be written according to slightly different rules than well-known languages that use the same script.
++
++Examples of complex script behaviors Graphite can handle include:
++
++* contextual shaping
++* ligatures
++* reordering
++* split glyphs
++* bidirectionality
++* stacking diacritics
++* complex positioning
++* shape aware kerning
++* automatic diacritic collision avoidance
++
++See [examples of scripts with complex rendering](http://scripts.sil.org/CmplxRndExamples).
++
++## Graphite system overview
++The Graphite system consists of:
++
++* A rule-based programming language [Graphite Description Language](http://scripts.sil.org/cms/scripts/page.php?site_id=projects&item_id=graphite_devFont#gdl) (GDL) that can be used to describe the behavior of a writing system
++* A compiler for that language
++* A rendering engine that can serve as the layout component of a text-processing application
++
++Graphite renders TrueType fonts that have been extended by means of compiling a GDL program.
++
++Further technical information is available on the [Graphite technical overview](http://scripts.sil.org/cms/scripts/page.php?site_id=projects&item_id=graphite_techAbout) page.
+diff --git a/gfx/graphite2/README.mozilla b/gfx/graphite2/README.mozilla
+--- a/gfx/graphite2/README.mozilla
++++ b/gfx/graphite2/README.mozilla
+@@ -1,6 +1,7 @@
+-This directory contains the Graphite2 library from http://hg.palaso.org/graphitedev
+-
+-Current version derived from upstream changeset 1efd96aeade9
+-
++This directory contains the Graphite2 library release 1.3.5 from
++https://github.com/silnrsi/graphite/releases/download/1.3.5/graphite2-minimal-1.3.5.tgz
+ See gfx/graphite2/moz-gr-update.sh for update procedure.
+ 
++Also includes two post-1.3.5 fixes:
++a8b3ac2aed0eb132cd80efe7de88f8153e73c829
++e569e28d83491fedb31b9220493f3c07f6ec6d80
+diff --git a/gfx/graphite2/include/graphite2/Font.h b/gfx/graphite2/include/graphite2/Font.h
+--- a/gfx/graphite2/include/graphite2/Font.h
++++ b/gfx/graphite2/include/graphite2/Font.h
+@@ -24,18 +24,18 @@
+     General Public License, as published by the Free Software Foundation,
+     either version 2 of the License or (at your option) any later version.
+ */
+ #pragma once
+ 
+ #include "graphite2/Types.h"
+ 
+ #define GR2_VERSION_MAJOR   1
+-#define GR2_VERSION_MINOR   2
+-#define GR2_VERSION_BUGFIX  4
++#define GR2_VERSION_MINOR   3
++#define GR2_VERSION_BUGFIX  5
+ 
+ #ifdef __cplusplus
+ extern "C"
+ {
+ #endif
+ 
+ typedef struct gr_face          gr_face;
+ typedef struct gr_font          gr_font;
+diff --git a/gfx/graphite2/include/graphite2/Segment.h b/gfx/graphite2/include/graphite2/Segment.h
+--- a/gfx/graphite2/include/graphite2/Segment.h
++++ b/gfx/graphite2/include/graphite2/Segment.h
+@@ -115,35 +115,68 @@ enum gr_attrCode {
+     gr_slatJStretch,        
+     /// Amount this slot can shrink (not implemented)
+     gr_slatJShrink,         
+     /// Granularity by which this slot can stretch or shrink (not implemented)
+     gr_slatJStep,           
+     /// Justification weight for this glyph (not implemented)
+     gr_slatJWeight,         
+     /// Amount this slot mush shrink or stretch in design units
+-    gr_slatJWidth,          
++    gr_slatJWidth = 29,
+     /// SubSegment split point
+     gr_slatSegSplit = gr_slatJStretch + 29,
+     /// User defined attribute, see subattr for user attr number
+     gr_slatUserDefn,
+     /// Bidi level
+-    gr_slatBidiLevel,
++    gr_slatBidiLevel = 56,
++    /// Collision flags
++    gr_slatColFlags,
++    /// Collision constraint rectangle left (bl.x)
++    gr_slatColLimitblx,
++    /// Collision constraint rectangle lower (bl.y)
++    gr_slatColLimitbly,
++    /// Collision constraint rectangle right (tr.x)
++    gr_slatColLimittrx,
++    /// Collision constraint rectangle upper (tr.y)
++    gr_slatColLimittry,
++    /// Collision shift x
++    gr_slatColShiftx,
++    /// Collision shift y
++    gr_slatColShifty,
++    /// Collision margin
++    gr_slatColMargin,
++    /// Margin cost weight
++    gr_slatColMarginWt,
++    // Additional glyph that excludes movement near this one:
++    gr_slatColExclGlyph,
++    gr_slatColExclOffx,
++    gr_slatColExclOffy,
++    // Collision sequence enforcing attributes:
++    gr_slatSeqClass,
++    gr_slatSeqProxClass,
++    gr_slatSeqOrder,
++    gr_slatSeqAboveXoff,
++    gr_slatSeqAboveWt,
++    gr_slatSeqBelowXlim,
++    gr_slatSeqBelowWt,
++    gr_slatSeqValignHt,
++    gr_slatSeqValignWt,
+                             
+     /// not implemented
+     gr_slatMax,             
+     /// not implemented
+     gr_slatNoEffect = gr_slatMax + 1    
+ };
+ 
+ enum gr_bidirtl {
+     /// Underlying paragraph direction is RTL
+     gr_rtl = 1,
+     /// Set this to not run the bidi pass internally, even if the font asks for it.
+-    /// This presumes that the segment is in a single direction.
++    /// This presumes that the segment is in a single direction. Most of the time
++    /// this bit should be set unless you know you are passing full paragraphs of text.
+     gr_nobidi = 2,
+     /// Disable auto mirroring for rtl text
+     gr_nomirror = 4
+ };
+ 
+ typedef struct gr_char_info     gr_char_info;
+ typedef struct gr_segment       gr_segment;
+ typedef struct gr_slot          gr_slot;
+diff --git a/gfx/graphite2/include/graphite2/Types.h b/gfx/graphite2/include/graphite2/Types.h
+--- a/gfx/graphite2/include/graphite2/Types.h
++++ b/gfx/graphite2/include/graphite2/Types.h
+@@ -53,17 +53,20 @@ enum gr_encform {
+   #else
+     #if defined __GNUC__
+       #define GR2_API    __attribute__((dllimport))
+     #else
+       #define GR2_API    __declspec(dllimport)
+     #endif
+   #endif
+   #define GR2_LOCAL
++#elif __GNUC__ >= 4
++  #if defined GRAPHITE2_STATIC
++    #define GR2_API      __attribute__ ((visibility("hidden")))
++  #else
++    #define GR2_API      __attribute__ ((visibility("default")))
++  #endif
++  #define GR2_LOCAL      __attribute__ ((visibility("hidden")))
+ #else
+-  #if __GNUC__ >= 4
+-    #define GR2_API      __attribute__ ((visibility("default")))
+-    #define GR2_LOCAL       __attribute__ ((visibility("hidden")))
+-  #else
+-    #define GR2_API
+-    #define GR2_LOCAL
+-  #endif
++  #define GR2_API
++  #define GR2_LOCAL
+ #endif
++
+diff --git a/gfx/graphite2/moz-gr-update.sh b/gfx/graphite2/moz-gr-update.sh
+--- a/gfx/graphite2/moz-gr-update.sh
++++ b/gfx/graphite2/moz-gr-update.sh
+@@ -1,35 +1,49 @@
+ #!/bin/bash
+ 
+ # Script used to update the Graphite2 library in the mozilla source tree
+ 
+ # This script lives in gfx/graphite2, along with the library source,
+ # but must be run from the top level of the mozilla-central tree.
+ 
+-# It expects to find a checkout of the graphite2 tree in a directory "graphitedev"
+-# alongside the current mozilla tree that is to be updated.
+-# Expect error messages from the copy commands if this is not found!
++# Run as
++#
++#    ./gfx/graphite2/moz-gr-update.sh RELEASE
++#
++# where RELEASE is the graphite2 release to be used, e.g. "1.3.4".
+ 
+-# copy the source and headers
+-cp -R ../graphitedev/src/* gfx/graphite2/src
+-cp ../graphitedev/include/graphite2/* gfx/graphite2/include/graphite2
++RELEASE=$1
+ 
+-# record the upstream changeset that was used
+-CHANGESET=$(cd ../graphitedev/ && hg log | head -n 1 | cut -d : -f 1,3 | sed -e 's/:/ /')
+-echo "This directory contains the Graphite2 library from http://hg.palaso.org/graphitedev\n" > gfx/graphite2/README.mozilla
+-echo "Current version derived from upstream" $CHANGESET >> gfx/graphite2/README.mozilla
+-echo "\nSee" $0 "for update procedure.\n" >> gfx/graphite2/README.mozilla
++if [ "x$RELEASE" == "x" ]
++then
++    echo "Must provide the version number to be used."
++    exit 1
++fi
++
++TARBALL="https://github.com/silnrsi/graphite/releases/download/$RELEASE/graphite2-minimal-$RELEASE.tgz"
++
++foo=`basename $0`
++TMPFILE=`mktemp -t ${foo}` || exit 1
++
++curl -L "$TARBALL" -o "$TMPFILE"
++tar -x -z -C gfx/graphite2/ --strip-components 1 -f "$TMPFILE" || exit 1
++rm "$TMPFILE"
++
++echo "This directory contains the Graphite2 library release $RELEASE from" > gfx/graphite2/README.mozilla
++echo "$TARBALL" >> gfx/graphite2/README.mozilla
++echo ""
++echo "See" $0 "for update procedure." >> gfx/graphite2/README.mozilla
+ 
+ # fix up includes because of bug 721839 (cstdio) and bug 803066 (Windows.h)
+-find gfx/graphite2/ -name "*.cpp" -exec perl -p -i -e "s/<cstdio>/<stdio.h>/;s/Windows.h/windows.h/;" {} \;
+-find gfx/graphite2/ -name "*.h" -exec perl -p -i -e "s/<cstdio>/<stdio.h>/;s/Windows.h/windows.h/;" {} \;
++#find gfx/graphite2/ -name "*.cpp" -exec perl -p -i -e "s/<cstdio>/<stdio.h>/;s/Windows.h/windows.h/;" {} \;
++#find gfx/graphite2/ -name "*.h" -exec perl -p -i -e "s/<cstdio>/<stdio.h>/;s/Windows.h/windows.h/;" {} \;
+ 
+ # summarize what's been touched
+-echo Updated to $CHANGESET.
++echo Updated to $RELEASE.
+ echo Here is what changed in the gfx/graphite2 directory:
+ echo
+ 
+ hg stat gfx/graphite2
+ 
+ echo
+ echo If gfx/graphite2/src/files.mk has changed, please make corresponding
+ echo changes to gfx/graphite2/src/moz.build
+diff --git a/gfx/graphite2/src/CMakeLists.txt b/gfx/graphite2/src/CMakeLists.txt
+--- a/gfx/graphite2/src/CMakeLists.txt
++++ b/gfx/graphite2/src/CMakeLists.txt
+@@ -69,29 +69,31 @@ add_library(graphite2 SHARED
+     ${GRAPHITE2_VM_TYPE}_machine.cpp
+     gr_char_info.cpp
+     gr_features.cpp
+     gr_face.cpp
+     gr_font.cpp
+     gr_logging.cpp
+     gr_segment.cpp
+     gr_slot.cpp
+-    Bidi.cpp
+     CachedFace.cpp
+     CmapCache.cpp
+     Code.cpp
++    Collider.cpp
++    Decompressor.cpp
+     Face.cpp
+     FeatureMap.cpp
+     Font.cpp
+     GlyphFace.cpp
+     GlyphCache.cpp
++    Intervals.cpp
+     Justifier.cpp
+     NameTable.cpp
+     Pass.cpp
+-    Rule.cpp
++    Position.cpp
+     Segment.cpp
+     Silf.cpp
+     Slot.cpp
+     Sparse.cpp
+     TtfUtil.cpp
+     UtfCodec.cpp
+     ${FILEFACE}
+     ${SEGCACHE}
+@@ -99,27 +101,28 @@ add_library(graphite2 SHARED
+ 
+ set_target_properties(graphite2 PROPERTIES  PUBLIC_HEADER "${GRAPHITE_HEADERS}"
+                                             SOVERSION ${GRAPHITE_SO_VERSION}
+                                             VERSION ${GRAPHITE_VERSION}
+                                             LT_VERSION_CURRENT ${GRAPHITE_API_CURRENT}
+                                             LT_VERSION_REVISION ${GRAPHITE_API_REVISION}
+                                             LT_VERSION_AGE ${GRAPHITE_API_AGE})
+ 
+-if (${CMAKE_BUILD_TYPE} STREQUAL "ClangASN")
+-    set(GRAPHITE_LINK_FLAGS "-fsanitize=address")
+-else (${CMAKE_BUILD_TYPE} STREQUAL "ClangASN")
+-    set(GRAPHITE_LINK_FLAGS "")
+-endif (${CMAKE_BUILD_TYPE} STREQUAL "ClangASN")
+-
+ if  (${CMAKE_SYSTEM_NAME} STREQUAL "Linux")
+     set_target_properties(graphite2 PROPERTIES 
+         COMPILE_FLAGS   "-Wall -Wextra -Wno-unknown-pragmas -Wendif-labels -Wshadow -Wctor-dtor-privacy -Wnon-virtual-dtor -fno-rtti -fno-exceptions -fvisibility=hidden -fvisibility-inlines-hidden -fno-stack-protector"
+         LINK_FLAGS      "-nodefaultlibs ${GRAPHITE_LINK_FLAGS}" 
+         LINKER_LANGUAGE C)
++    if (CMAKE_COMPILER_IS_GNUCXX)
++        add_definitions(-Wdouble-promotion)
++    endif (CMAKE_COMPILER_IS_GNUCXX)
++    message(STATUS "Compiler ID is: ${CMAKE_CXX_COMPILER_ID}")
++    if (${CMAKE_CXX_COMPILER_ID} STREQUAL "Clang")
++        add_definitions(-Wimplicit-fallthrough)
++    endif (${CMAKE_CXX_COMPILER_ID} STREQUAL "Clang")
+     if (${CMAKE_CXX_COMPILER} MATCHES  ".*mingw.*")
+         target_link_libraries(graphite2 kernel32 msvcr90 mingw32 gcc user32)
+     else (${CMAKE_CXX_COMPILER} MATCHES  ".*mingw.*")
+         if (GRAPHITE2_ASAN)
+             target_link_libraries(graphite2 c gcc_s)
+         else (GRAPHITE2_ASAN)
+             target_link_libraries(graphite2 c gcc)
+         endif (GRAPHITE2_ASAN)
+@@ -127,17 +130,17 @@ if  (${CMAKE_SYSTEM_NAME} STREQUAL "Linu
+         nolib_test(stdc++ $<TARGET_SONAME_FILE:graphite2>)
+     endif (${CMAKE_CXX_COMPILER} MATCHES  ".*mingw.*")
+     set(CMAKE_CXX_IMPLICIT_LINK_LIBRARIES "")
+     CREATE_LIBTOOL_FILE(graphite2 "/lib${LIB_SUFFIX}")
+ endif (${CMAKE_SYSTEM_NAME} STREQUAL "Linux")
+ 
+ if  (${CMAKE_SYSTEM_NAME} STREQUAL "Darwin")
+     set_target_properties(graphite2 PROPERTIES 
+-        COMPILE_FLAGS   "-Wall -Wextra -Wno-unknown-pragmas -Wendif-labels -Wshadow -Wno-ctor-dtor-privacy -Wno-non-virtual-dtor -fno-rtti -fno-exceptions -fvisibility=hidden -fvisibility-inlines-hidden -fno-stack-protector"
++        COMPILE_FLAGS   "-Wall -Wextra -Wno-unknown-pragmas -Wimplicit-fallthrough -Wendif-labels -Wshadow -Wno-ctor-dtor-privacy -Wno-non-virtual-dtor -fno-rtti -fno-exceptions -fvisibility=hidden -fvisibility-inlines-hidden -fno-stack-protector"
+         LINK_FLAGS      "-nodefaultlibs" 
+         LINKER_LANGUAGE C)
+     target_link_libraries(graphite2 c)
+     include(Graphite)
+     nolib_test(stdc++ $<TARGET_SONAME_FILE:graphite2>)
+     set(CMAKE_CXX_IMPLICIT_LINK_LIBRARIES "")
+     CREATE_LIBTOOL_FILE(graphite2 "/lib${LIB_SUFFIX}")
+ endif (${CMAKE_SYSTEM_NAME} STREQUAL "Darwin")
+diff --git a/gfx/graphite2/src/CmapCache.cpp b/gfx/graphite2/src/CmapCache.cpp
+--- a/gfx/graphite2/src/CmapCache.cpp
++++ b/gfx/graphite2/src/CmapCache.cpp
+@@ -33,31 +33,31 @@ of the License or (at your option) any l
+ 
+ 
+ using namespace graphite2;
+ 
+ const void * bmp_subtable(const Face::Table & cmap)
+ {
+     const void * stbl;
+     if (!cmap.size()) return 0;
+-    if (TtfUtil::CheckCmapSubtable4(stbl = TtfUtil::FindCmapSubtable(cmap, 3, 1, cmap.size()))
+-     || TtfUtil::CheckCmapSubtable4(stbl = TtfUtil::FindCmapSubtable(cmap, 0, 3, cmap.size()))
+-     || TtfUtil::CheckCmapSubtable4(stbl = TtfUtil::FindCmapSubtable(cmap, 0, 2, cmap.size()))
+-     || TtfUtil::CheckCmapSubtable4(stbl = TtfUtil::FindCmapSubtable(cmap, 0, 1, cmap.size()))
+-     || TtfUtil::CheckCmapSubtable4(stbl = TtfUtil::FindCmapSubtable(cmap, 0, 0, cmap.size())))
++    if (TtfUtil::CheckCmapSubtable4(stbl = TtfUtil::FindCmapSubtable(cmap, 3, 1, cmap.size()), cmap.size())
++     || TtfUtil::CheckCmapSubtable4(stbl = TtfUtil::FindCmapSubtable(cmap, 0, 3, cmap.size()), cmap.size())
++     || TtfUtil::CheckCmapSubtable4(stbl = TtfUtil::FindCmapSubtable(cmap, 0, 2, cmap.size()), cmap.size())
++     || TtfUtil::CheckCmapSubtable4(stbl = TtfUtil::FindCmapSubtable(cmap, 0, 1, cmap.size()), cmap.size())
++     || TtfUtil::CheckCmapSubtable4(stbl = TtfUtil::FindCmapSubtable(cmap, 0, 0, cmap.size()), cmap.size()))
+         return stbl;
+     return 0;
+ }
+ 
+ const void * smp_subtable(const Face::Table & cmap)
+ {
+     const void * stbl;
+     if (!cmap.size()) return 0;
+-    if (TtfUtil::CheckCmapSubtable12(stbl = TtfUtil::FindCmapSubtable(cmap, 3, 10, cmap.size()))
+-     || TtfUtil::CheckCmapSubtable12(stbl = TtfUtil::FindCmapSubtable(cmap, 0, 4, cmap.size())))
++    if (TtfUtil::CheckCmapSubtable12(stbl = TtfUtil::FindCmapSubtable(cmap, 3, 10, cmap.size()), cmap.size())
++     || TtfUtil::CheckCmapSubtable12(stbl = TtfUtil::FindCmapSubtable(cmap, 0, 4, cmap.size()), cmap.size()))
+         return stbl;
+     return 0;
+ }
+ 
+ template <unsigned int (*NextCodePoint)(const void *, unsigned int, int *),
+           uint16 (*LookupCodePoint)(const void *, unsigned int, int)>
+ bool cache_subtable(uint16 * blocks[], const void * cst, const unsigned int limit)
+ {
+diff --git a/gfx/graphite2/src/Code.cpp b/gfx/graphite2/src/Code.cpp
+--- a/gfx/graphite2/src/Code.cpp
++++ b/gfx/graphite2/src/Code.cpp
+@@ -37,17 +37,17 @@ of the License or (at your option) any l
+ #include "inc/Code.h"
+ #include "inc/Face.h"
+ #include "inc/GlyphFace.h"
+ #include "inc/GlyphCache.h"
+ #include "inc/Machine.h"
+ #include "inc/Rule.h"
+ #include "inc/Silf.h"
+ 
+-#include <stdio.h>
++#include <cstdio>
+ 
+ #ifdef NDEBUG
+ #ifdef __GNUC__
+ #pragma GCC diagnostic ignored "-Wunused-parameter"
+ #endif
+ #endif
+ 
+ 
+@@ -84,112 +84,119 @@ public:
+     struct limits;
+     struct analysis
+     {
+         uint8     slotref;
+         context   contexts[256];
+         byte      max_ref;
+         
+         analysis() : slotref(0), max_ref(0) {};
+-        void set_ref(int index) throw();
++        void set_ref(int index, bool incinsert=false) throw();
++        void set_noref(int index) throw();
+         void set_changed(int index) throw();
+ 
+     };
+     
+-    decoder(const limits & lims, Code &code) throw();
++    decoder(limits & lims, Code &code, enum passtype pt) throw();
+     
+     bool        load(const byte * bc_begin, const byte * bc_end);
+     void        apply_analysis(instr * const code, instr * code_end);
+     byte        max_ref() { return _analysis.max_ref; }
+     int         pre_context() const { return _pre_context; }
+     
+ private:
+     opcode      fetch_opcode(const byte * bc);
+     void        analyse_opcode(const opcode, const int8 * const dp) throw();
+     bool        emit_opcode(opcode opc, const byte * & bc);
+     bool        validate_opcode(const opcode opc, const byte * const bc);
+     bool        valid_upto(const uint16 limit, const uint16 x) const throw();
++    bool        test_context() const throw();
+     void        failure(const status_t s) const throw() { _code.failure(s); }
+     
+     Code              & _code;
+     int                 _pre_context;
+     uint16              _rule_length;
+     instr             * _instr;
+     byte              * _data;
+-    const limits      & _max;
++    limits            & _max;
+     analysis            _analysis;
++    enum passtype       _passtype;
++    int                 _stack_depth;
++    bool                _in_ctxt_item;
+ };
+ 
+ 
+ struct Machine::Code::decoder::limits
+ {
+-  const byte * const bytecode;
++  const byte       * bytecode;
+   const uint8        pre_context;
+   const uint16       rule_length,
+                      classes,
+                      glyf_attrs,
+                      features;
+   const byte         attrid[gr_slatMax];
+ };
+    
+-inline Machine::Code::decoder::decoder(const limits & lims, Code &code) throw()
++inline Machine::Code::decoder::decoder(limits & lims, Code &code, enum passtype pt) throw()
+ : _code(code),
+   _pre_context(code._constraint ? 0 : lims.pre_context), 
+   _rule_length(code._constraint ? 1 : lims.rule_length), 
+-  _instr(code._code), _data(code._data), _max(lims)
++  _instr(code._code), _data(code._data), _max(lims), _passtype(pt),
++  _stack_depth(0),
++  _in_ctxt_item(false)
+ { }
+     
+ 
+ 
+ Machine::Code::Code(bool is_constraint, const byte * bytecode_begin, const byte * const bytecode_end,
+-           uint8 pre_context, uint16 rule_length, const Silf & silf, const Face & face)
++           uint8 pre_context, uint16 rule_length, const Silf & silf, const Face & face,
++           enum passtype pt, byte * * const _out)
+  :  _code(0), _data(0), _data_size(0), _instr_count(0), _max_ref(0), _status(loaded),
+-    _constraint(is_constraint), _modify(false), _delete(false), _own(true)
++    _constraint(is_constraint), _modify(false), _delete(false), _own(_out==0)
+ {
+ #ifdef GRAPHITE2_TELEMETRY
+     telemetry::category _code_cat(face.tele.code);
+ #endif
+     assert(bytecode_begin != 0);
+     if (bytecode_begin == bytecode_end)
+     {
+-      ::new (this) Code();
++      // ::new (this) Code();
+       return;
+     }
+     assert(bytecode_end > bytecode_begin);
+     const opcode_t *    op_to_fn = Machine::getOpcodeTable();
+     
+-    // Allocate code and dat target buffers, these sizes are a worst case 
++    // Allocate code and data target buffers, these sizes are a worst case
+     // estimate.  Once we know their real sizes the we'll shrink them.
+-    _code = static_cast<instr *>(malloc((bytecode_end - bytecode_begin)
+-                                             * sizeof(instr)));
+-    _data = static_cast<byte *>(malloc((bytecode_end - bytecode_begin)
+-                                             * sizeof(byte)));
++    if (_out)   _code = reinterpret_cast<instr *>(*_out);
++    else        _code = static_cast<instr *>(malloc(estimateCodeDataOut(bytecode_end-bytecode_begin)));
++    _data = reinterpret_cast<byte *>(_code + (bytecode_end - bytecode_begin));
+     
+     if (!_code || !_data) {
+         failure(alloc_failed);
+         return;
+     }
+     
+-    const decoder::limits lims = {
++    decoder::limits lims = {
+         bytecode_end,
+         pre_context,
+         rule_length,
+         silf.numClasses(),
+         face.glyphs().numAttrs(),
+         face.numFeatures(), 
+         {1,1,1,1,1,1,1,1, 
+          1,1,1,1,1,1,1,255,
+          1,1,1,1,1,1,1,1, 
+          1,1,1,1,1,1,0,0, 
+          0,0,0,0,0,0,0,0, 
+          0,0,0,0,0,0,0,0, 
+          0,0,0,0,0,0,0, silf.numUser()}
+     };
+     
+-    decoder dec(lims, *this);
++    decoder dec(lims, *this, pt);
+     if(!dec.load(bytecode_begin, bytecode_end))
+        return;
+     
+     // Is this an empty program?
+     if (_instr_count == 0)
+     {
+       release_buffers();
+       ::new (this) Code();
+@@ -204,20 +211,25 @@ Machine::Code::Code(bool is_constraint, 
+ 
+     assert((_constraint && immutable()) || !_constraint);
+     dec.apply_analysis(_code, _code + _instr_count);
+     _max_ref = dec.max_ref();
+     
+     // Now we know exactly how much code and data the program really needs
+     // realloc the buffers to exactly the right size so we don't waste any 
+     // memory.
+-    assert((bytecode_end - bytecode_begin) >= std::ptrdiff_t(_instr_count));
+-    assert((bytecode_end - bytecode_begin) >= std::ptrdiff_t(_data_size));
+-    _code = static_cast<instr *>(realloc(_code, (_instr_count+1)*sizeof(instr)));
+-    _data = static_cast<byte *>(realloc(_data, _data_size*sizeof(byte)));
++    assert((bytecode_end - bytecode_begin) >= ptrdiff_t(_instr_count));
++    assert((bytecode_end - bytecode_begin) >= ptrdiff_t(_data_size));
++    memmove(_code + (_instr_count+1), _data, _data_size*sizeof(byte));
++    size_t const total_sz = ((_instr_count+1) + (_data_size + sizeof(instr)-1)/sizeof(instr))*sizeof(instr);
++    if (_out)
++        *_out += total_sz;
++    else
++        _code = static_cast<instr *>(realloc(_code, total_sz));
++   _data = reinterpret_cast<byte *>(_code + (_instr_count+1));
+ 
+     if (!_code)
+     {
+         failure(alloc_failed);
+         return;
+     }
+ 
+     // Make this RET_ZERO, we should never reach this but just in case ...
+@@ -232,16 +244,17 @@ Machine::Code::~Code() throw ()
+ {
+     if (_own)
+         release_buffers();
+ }
+ 
+ 
+ bool Machine::Code::decoder::load(const byte * bc, const byte * bc_end)
+ {
++    _max.bytecode = bc_end;
+     while (bc < bc_end)
+     {
+         const opcode opc = fetch_opcode(bc++);
+         if (opc == vm::MAX_OPCODE)
+             return false;
+         
+         analyse_opcode(opc, reinterpret_cast<const int8 *>(bc));
+         
+@@ -261,141 +274,194 @@ opcode Machine::Code::decoder::fetch_opc
+ 
+     // Do some basic sanity checks based on what we know about the opcode
+     if (!validate_opcode(opc, bc))  return MAX_OPCODE;
+ 
+     // And check it's arguments as far as possible
+     switch (opc)
+     {
+         case NOP :
++            break;
+         case PUSH_BYTE :
+         case PUSH_BYTEU :
+         case PUSH_SHORT :
+         case PUSH_SHORTU :
+         case PUSH_LONG :
++            ++_stack_depth;
++            break;
+         case ADD :
+         case SUB :
+         case MUL :
+         case DIV :
+         case MIN_ :
+         case MAX_ :
+-        case NEG :
+-        case TRUNC8 :
+-        case TRUNC16 :
+-        case COND :
+         case AND :
+         case OR :
+-        case NOT :
+         case EQUAL :
+         case NOT_EQ :
+         case LESS :
+         case GTR :
+         case LESS_EQ :
+         case GTR_EQ :
++        case BITOR :
++        case BITAND :
++            if (--_stack_depth <= 0)
++                failure(underfull_stack);
++            break;
++        case NEG :
++        case TRUNC8 :
++        case TRUNC16 :
++        case NOT :
++        case BITNOT :
++        case BITSET :
++            if (_stack_depth <= 0)
++                failure(underfull_stack);
++            break;
++        case COND :
++            _stack_depth -= 2;
++            if (_stack_depth <= 0)
++                failure(underfull_stack);
+             break;
+         case NEXT :
+         case NEXT_N :           // runtime checked
+         case COPY_NEXT :
++            test_context();
+             ++_pre_context;
+             break;
+         case PUT_GLYPH_8BIT_OBS :
+             valid_upto(_max.classes, bc[0]);
++            test_context();
+             break;
+         case PUT_SUBS_8BIT_OBS :
+             valid_upto(_rule_length, _pre_context + int8(bc[0]));
+             valid_upto(_max.classes, bc[1]);
+             valid_upto(_max.classes, bc[2]);
++            test_context();
+             break;
+         case PUT_COPY :
+             valid_upto(_rule_length, _pre_context + int8(bc[0]));
++            test_context();
+             break;
+         case INSERT :
+-            --_pre_context;
++            if (_passtype >= PASS_TYPE_POSITIONING)
++                failure(invalid_opcode);
++            else
++                --_pre_context;
+             break;
+         case DELETE :
++            if (_passtype >= PASS_TYPE_POSITIONING)
++                failure(invalid_opcode);
++            test_context();
+             break;
+         case ASSOC :
+             for (uint8 num = bc[0]; num; --num)
+                 valid_upto(_rule_length, _pre_context + int8(bc[num]));
++            test_context();
+             break;
+         case CNTXT_ITEM :
+             valid_upto(_max.rule_length, _max.pre_context + int8(bc[0]));
+-            if (bc + 2 + bc[1] >= _max.bytecode)  failure(jump_past_end);
+-            if (_pre_context != 0)                failure(nested_context_item);
++            if (bc + 2 + bc[1] >= _max.bytecode)    failure(jump_past_end);
++            if (_in_ctxt_item)                      failure(nested_context_item);
+             break;
+         case ATTR_SET :
+         case ATTR_ADD :
+         case ATTR_SUB :
+         case ATTR_SET_SLOT :
++            if (--_stack_depth < 0)
++                failure(underfull_stack);
+             valid_upto(gr_slatMax, bc[0]);
++            test_context();
+             break;
+         case IATTR_SET_SLOT :
++            if (--_stack_depth < 0)
++                failure(underfull_stack);
+             if (valid_upto(gr_slatMax, bc[0]))
+                 valid_upto(_max.attrid[bc[0]], bc[1]);
++            test_context();
+             break;
+         case PUSH_SLOT_ATTR :
++            ++_stack_depth;
+             valid_upto(gr_slatMax, bc[0]);
+             valid_upto(_rule_length, _pre_context + int8(bc[1]));
+             break;
+         case PUSH_GLYPH_ATTR_OBS :
++            ++_stack_depth;
+             valid_upto(_max.glyf_attrs, bc[0]);
+             valid_upto(_rule_length, _pre_context + int8(bc[1]));
+             break;
+         case PUSH_GLYPH_METRIC :
++            ++_stack_depth;
+             valid_upto(kgmetDescent, bc[0]);
+             valid_upto(_rule_length, _pre_context + int8(bc[1]));
+             // level: dp[2] no check necessary
+             break;
+         case PUSH_FEAT :
++            ++_stack_depth;
+             valid_upto(_max.features, bc[0]);
+             valid_upto(_rule_length, _pre_context + int8(bc[1]));
+             break;
+         case PUSH_ATT_TO_GATTR_OBS :
++            ++_stack_depth;
+             valid_upto(_max.glyf_attrs, bc[0]);
+             valid_upto(_rule_length, _pre_context + int8(bc[1]));
+             break;
+         case PUSH_ATT_TO_GLYPH_METRIC :
++            ++_stack_depth;
+             valid_upto(kgmetDescent, bc[0]);
+             valid_upto(_rule_length, _pre_context + int8(bc[1]));
+             // level: dp[2] no check necessary
+             break;
+         case PUSH_ISLOT_ATTR :
++            ++_stack_depth;
+             if (valid_upto(gr_slatMax, bc[0]))
+             {
+                 valid_upto(_rule_length, _pre_context + int8(bc[1]));
+                 valid_upto(_max.attrid[bc[0]], bc[2]);
+             }
+             break;
+         case PUSH_IGLYPH_ATTR :// not implemented
++            ++_stack_depth;
++            break;
+         case POP_RET :
++            if (--_stack_depth < 0)
++                failure(underfull_stack);
++            GR_FALLTHROUGH;
++            // no break
+         case RET_ZERO :
+         case RET_TRUE :
+             break;
+         case IATTR_SET :
+         case IATTR_ADD :
+         case IATTR_SUB :
++            if (--_stack_depth < 0)
++                failure(underfull_stack);
+             if (valid_upto(gr_slatMax, bc[0]))
+                 valid_upto(_max.attrid[bc[0]], bc[1]);
++            test_context();
+             break;
+         case PUSH_PROC_STATE :  // dummy: dp[0] no check necessary
+         case PUSH_VERSION :
++            ++_stack_depth;
+             break;
+         case PUT_SUBS :
+             valid_upto(_rule_length, _pre_context + int8(bc[0]));
+             valid_upto(_max.classes, uint16(bc[1]<< 8) | bc[2]);
+             valid_upto(_max.classes, uint16(bc[3]<< 8) | bc[4]);
++            test_context();
+             break;
+         case PUT_SUBS2 :        // not implemented
+         case PUT_SUBS3 :        // not implemented
+             break;
+         case PUT_GLYPH :
+             valid_upto(_max.classes, uint16(bc[0]<< 8) | bc[1]);
++            test_context();
+             break;
+         case PUSH_GLYPH_ATTR :
+         case PUSH_ATT_TO_GLYPH_ATTR :
++            ++_stack_depth;
+             valid_upto(_max.glyf_attrs, uint16(bc[0]<< 8) | bc[1]);
+             valid_upto(_rule_length, _pre_context + int8(bc[2]));
+             break;
+         default:
+             failure(invalid_opcode);
+             break;
+     }
+ 
+@@ -410,62 +476,77 @@ void Machine::Code::decoder::analyse_opc
+   switch (opc)
+   {
+     case DELETE :
+       _code._delete = true;
+       break;
+     case PUT_GLYPH_8BIT_OBS :
+     case PUT_GLYPH :
+       _code._modify = true;
+-      _analysis.set_changed(_analysis.slotref);
++      _analysis.set_changed(0);
++      break;
++    case ATTR_SET :
++    case ATTR_ADD :
++    case ATTR_SET_SLOT :
++    case IATTR_SET_SLOT :
++    case IATTR_SET :
++    case IATTR_ADD :
++    case IATTR_SUB :
++      _analysis.set_noref(0);
+       break;
+     case NEXT :
+     case COPY_NEXT :
+       if (!_analysis.contexts[_analysis.slotref].flags.inserted)
+         ++_analysis.slotref;
+       _analysis.contexts[_analysis.slotref] = context(_code._instr_count+1);
+-      if (_analysis.slotref > _analysis.max_ref) _analysis.max_ref = _analysis.slotref;
++      // if (_analysis.slotref > _analysis.max_ref) _analysis.max_ref = _analysis.slotref;
+       break;
+     case INSERT :
+       _analysis.contexts[_analysis.slotref].flags.inserted = true;
+       _code._modify = true;
+       break;
+     case PUT_SUBS_8BIT_OBS :    // slotref on 1st parameter
+     case PUT_SUBS : 
+       _code._modify = true;
+-      _analysis.set_changed(_analysis.slotref);
++      _analysis.set_changed(0);
++      GR_FALLTHROUGH;
+       // no break
+     case PUT_COPY :
+     {
+-      if (arg[0] != 0) { _analysis.set_changed(_analysis.slotref); _code._modify = true; }
++      if (arg[0] != 0) { _analysis.set_changed(0); _code._modify = true; }
+       if (arg[0] <= 0 && -arg[0] <= _analysis.slotref - _analysis.contexts[_analysis.slotref].flags.inserted)
+-        _analysis.set_ref(_analysis.slotref + arg[0] - _analysis.contexts[_analysis.slotref].flags.inserted);
+-      else if (_analysis.slotref + arg[0] > _analysis.max_ref) _analysis.max_ref = _analysis.slotref + arg[0];
++        _analysis.set_ref(arg[0], true);
++      else if (arg[0] > 0)
++        _analysis.set_ref(arg[0], true);
+       break;
+     }
+     case PUSH_ATT_TO_GATTR_OBS : // slotref on 2nd parameter
+         if (_code._constraint) return;
++        GR_FALLTHROUGH;
+         // no break
+     case PUSH_GLYPH_ATTR_OBS :
+     case PUSH_SLOT_ATTR :
+     case PUSH_GLYPH_METRIC :
+     case PUSH_ATT_TO_GLYPH_METRIC :
+     case PUSH_ISLOT_ATTR :
+     case PUSH_FEAT :
+       if (arg[1] <= 0 && -arg[1] <= _analysis.slotref - _analysis.contexts[_analysis.slotref].flags.inserted)
+-        _analysis.set_ref(_analysis.slotref + arg[1] - _analysis.contexts[_analysis.slotref].flags.inserted);
+-      else if (_analysis.slotref + arg[1] > _analysis.max_ref) _analysis.max_ref = _analysis.slotref + arg[1];
++        _analysis.set_ref(arg[1], true);
++      else if (arg[1] > 0)
++        _analysis.set_ref(arg[1], true);
+       break;
+     case PUSH_ATT_TO_GLYPH_ATTR :
+         if (_code._constraint) return;
++        GR_FALLTHROUGH;
+         // no break
+     case PUSH_GLYPH_ATTR :
+       if (arg[2] <= 0 && -arg[2] <= _analysis.slotref - _analysis.contexts[_analysis.slotref].flags.inserted)
+-        _analysis.set_ref(_analysis.slotref + arg[2] - _analysis.contexts[_analysis.slotref].flags.inserted);
+-      else if (_analysis.slotref + arg[2] > _analysis.max_ref) _analysis.max_ref = _analysis.slotref + arg[2];
++        _analysis.set_ref(arg[2], true);
++      else if (arg[2] > 0)
++        _analysis.set_ref(arg[2], true);
+       break;
+     case ASSOC :                // slotrefs in varargs
+       break;
+     default:
+         break;
+   }
+ }
+ 
+@@ -494,32 +575,41 @@ bool Machine::Code::decoder::emit_opcode
+         _code._data_size += param_sz;
+     }
+     
+     // recursively decode a context item so we can split the skip into 
+     // instruction and data portions.
+     if (opc == CNTXT_ITEM)
+     {
+         assert(_pre_context == 0);
++        _in_ctxt_item = true;
+         _pre_context = _max.pre_context + int8(_data[-2]);
+         _rule_length = _max.rule_length;
+ 
+         const size_t ctxt_start = _code._instr_count;
+         byte & instr_skip = _data[-1];
+         byte & data_skip  = *_data++;
+         ++_code._data_size;
++        const byte *curr_end = _max.bytecode;
+ 
+         if (load(bc, bc + instr_skip))
+         {
+             bc += instr_skip;
+             data_skip  = instr_skip - (_code._instr_count - ctxt_start);
+             instr_skip = _code._instr_count - ctxt_start;
++            _max.bytecode = curr_end;
+ 
+             _rule_length = 1;
+             _pre_context = 0;
++            _in_ctxt_item = false;
++        }
++        else
++        {
++            _pre_context = 0;
++            return false;
+         }
+     }
+     
+     return bool(_code);
+ }
+ 
+ 
+ void Machine::Code::decoder::apply_analysis(instr * const code, instr * code_end)
+@@ -533,87 +623,115 @@ void Machine::Code::decoder::apply_analy
+     {
+         if (!c->flags.referenced || !c->flags.changed) continue;
+         
+         instr * const tip = code + c->codeRef + tempcount;        
+         memmove(tip+1, tip, (code_end - tip) * sizeof(instr));
+         *tip = temp_copy;
+         ++code_end;
+         ++tempcount;
++        _code._delete = true;
+     }
+     
+     _code._instr_count = code_end - code;
+ }
+ 
+ 
+ inline
+ bool Machine::Code::decoder::validate_opcode(const opcode opc, const byte * const bc)
+ {
+     if (opc >= MAX_OPCODE)
+     {
+         failure(invalid_opcode);
+         return false;
+     }
+     const opcode_t & op = Machine::getOpcodeTable()[opc];
++    if (op.param_sz == VARARGS && bc >= _max.bytecode)
++    {
++        failure(arguments_exhausted);
++        return false;
++    }
+     const size_t param_sz = op.param_sz == VARARGS ? bc[0] + 1 : op.param_sz;
+-    if (bc + param_sz > _max.bytecode)
++    if (bc - 1 + param_sz >= _max.bytecode)
+     {
+         failure(arguments_exhausted);
+         return false;
+     }
+     return true;
+ }
+ 
+ 
+ bool Machine::Code::decoder::valid_upto(const uint16 limit, const uint16 x) const throw()
+ {
+     const bool t = x < limit;
+     if (!t) failure(out_of_range_data);
+     return t;
+ }
+ 
++bool Machine::Code::decoder::test_context() const throw()
++{
++    if (_pre_context >= _rule_length)
++    {
++        failure(out_of_range_data);
++        return false;
++    }
++    return true;
++}
+ 
+ inline 
+ void Machine::Code::failure(const status_t s) throw() {
+     release_buffers();
+     _status = s;
+ }
+ 
+ 
+ inline
+-void Machine::Code::decoder::analysis::set_ref(const int index) throw() {
+-    contexts[index].flags.referenced = true;
+-    if (index > max_ref) max_ref = index;
++void Machine::Code::decoder::analysis::set_ref(int index, bool incinsert) throw() {
++    if (incinsert && contexts[slotref].flags.inserted) --index;
++    if (index + slotref < 0) return;
++    contexts[index + slotref].flags.referenced = true;
++    if ((index > 0 || !contexts[index + slotref].flags.inserted) && index + slotref > max_ref) max_ref = index + slotref;
+ }
+ 
+ 
+ inline
+-void Machine::Code::decoder::analysis::set_changed(const int index) throw() {
+-    contexts[index].flags.changed = true;
+-    if (index > max_ref) max_ref = index;
++void Machine::Code::decoder::analysis::set_noref(int index) throw() {
++    if (contexts[slotref].flags.inserted) --index;
++    if (index + slotref < 0) return;
++    if ((index > 0 || !contexts[index + slotref].flags.inserted) && index + slotref > max_ref) max_ref = index + slotref;
++}
++
++
++inline
++void Machine::Code::decoder::analysis::set_changed(int index) throw() {
++    if (contexts[slotref].flags.inserted) --index;
++    if (index + slotref < 0) return;
++    contexts[index + slotref].flags.changed = true;
++    if ((index > 0 || !contexts[index + slotref].flags.inserted) && index + slotref > max_ref) max_ref = index + slotref;
+ }
+ 
+ 
+ void Machine::Code::release_buffers() throw()
+ {
+-    free(_code);
+-    free(_data);
++    if (_own)
++        free(_code);
+     _code = 0;
+     _data = 0;
+     _own  = false;
+ }
+ 
+ 
+ int32 Machine::Code::run(Machine & m, slotref * & map) const
+ {
+-    assert(_own);
++//    assert(_own);
+     assert(*this);          // Check we are actually runnable
+ 
+-    if (m.slotMap().size() <= size_t(_max_ref + m.slotMap().context()))
++    if (m.slotMap().size() <= size_t(_max_ref + m.slotMap().context())
++        || m.slotMap()[_max_ref + m.slotMap().context()] == 0)
+     {
+         m._status = Machine::slot_offset_out_bounds;
+-//        return (m.slotMap().end() - map);
+         return 1;
++//        return m.run(_code, _data, map);
+     }
+ 
+     return  m.run(_code, _data, map);
+ }
+ 
+diff --git a/gfx/graphite2/src/Collider.cpp b/gfx/graphite2/src/Collider.cpp
+new file mode 100644
+--- /dev/null
++++ b/gfx/graphite2/src/Collider.cpp
+@@ -0,0 +1,1088 @@
++/*  GRAPHITE2 LICENSING
++
++    Copyright 2010, SIL International
++    All rights reserved.
++
++    This library is free software; you can redistribute it and/or modify
++    it under the terms of the GNU Lesser General Public License as published
++    by the Free Software Foundation; either version 2.1 of License, or
++    (at your option) any later version.
++
++    This program is distributed in the hope that it will be useful,
++    but WITHOUT ANY WARRANTY; without even the implied warranty of
++    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++    Lesser General Public License for more details.
++
++    You should also have received a copy of the GNU Lesser General Public
++    License along with this library in the file named "LICENSE".
++    If not, write to the Free Software Foundation, 51 Franklin Street, 
++    Suite 500, Boston, MA 02110-1335, USA or visit their web page on the 
++    internet at http://www.fsf.org/licenses/lgpl.html.
++
++Alternatively, the contents of this file may be used under the terms of the
++Mozilla Public License (http://mozilla.org/MPL) or the GNU General Public
++License, as published by the Free Software Foundation, either version 2
++of the License or (at your option) any later version.
++*/
++#include <algorithm>
++#include <limits>
++#include <math.h>
++#include <string>
++#include <functional>
++#include "inc/Collider.h"
++#include "inc/Segment.h"
++#include "inc/Slot.h"
++#include "inc/GlyphCache.h"
++#include "inc/Sparse.h"
++
++#define ISQRT2 0.707106781f
++
++// Possible rounding error for subbox boundaries: 0.016 = 1/64 = 1/256 * 4 
++// (values in font range from 0..256)
++// #define SUBBOX_RND_ERR 0.016
++
++using namespace graphite2;
++
++////    SHIFT-COLLIDER    ////
++
++// Initialize the Collider to hold the basic movement limits for the
++// target slot, the one we are focusing on fixing.
++bool ShiftCollider::initSlot(Segment *seg, Slot *aSlot, const Rect &limit, float margin, float marginWeight,
++    const Position &currShift, const Position &currOffset, int dir, GR_MAYBE_UNUSED json * const dbgout)
++{
++    int i;
++    float mx, mn;
++    float a, shift;
++    const GlyphCache &gc = seg->getFace()->glyphs();
++    unsigned short gid = aSlot->gid();
++    if (!gc.check(gid))
++        return false;
++    const BBox &bb = gc.getBoundingBBox(gid);
++    const SlantBox &sb = gc.getBoundingSlantBox(gid);
++    //float sx = aSlot->origin().x + currShift.x;
++    //float sy = aSlot->origin().y + currShift.y;
++    if (currOffset.x != 0.f || currOffset.y != 0.f)
++        _limit = Rect(limit.bl - currOffset, limit.tr - currOffset);
++    else
++        _limit = limit;
++    // For a ShiftCollider, these indices indicate which vector we are moving by:
++    // each _ranges represents absolute space with respect to the origin of the slot. Thus take into account true origins but subtract the vmin for the slot
++    for (i = 0; i < 4; ++i)
++    {
++        switch (i) {
++            case 0 :	// x direction
++                mn = _limit.bl.x + currOffset.x;
++                mx = _limit.tr.x + currOffset.x;
++                _len[i] = bb.xa - bb.xi;
++                a = currOffset.y + currShift.y;
++                _ranges[i].initialise<XY>(mn, mx, margin, marginWeight, a);
++                break;
++            case 1 :	// y direction
++                mn = _limit.bl.y + currOffset.y;
++                mx = _limit.tr.y + currOffset.y;
++                _len[i] = bb.ya - bb.yi;
++                a = currOffset.x + currShift.x;
++                _ranges[i].initialise<XY>(mn, mx, margin, marginWeight, a);
++                break;
++            case 2 :	// sum (negatively sloped diagonal boundaries)
++                // pick closest x,y limit boundaries in s direction
++                shift = currOffset.x + currOffset.y + currShift.x + currShift.y;
++                mn = -2 * min(currShift.x - _limit.bl.x, currShift.y - _limit.bl.y) + shift;
++                mx = 2 * min(_limit.tr.x - currShift.x, _limit.tr.y - currShift.y) + shift;
++                _len[i] = sb.sa - sb.si;
++                a = currOffset.x - currOffset.y + currShift.x - currShift.y;
++                _ranges[i].initialise<SD>(mn, mx, margin / ISQRT2, marginWeight, a);
++                break;
++            case 3 :	// diff (positively sloped diagonal boundaries)
++                // pick closest x,y limit boundaries in d direction
++                shift = currOffset.x - currOffset.y + currShift.x - currShift.y;
++                mn = -2 * min(currShift.x - _limit.bl.x, _limit.tr.y - currShift.y) + shift;
++                mx = 2 * min(_limit.tr.x - currShift.x, currShift.y - _limit.bl.y) + shift;
++                _len[i] = sb.da - sb.di;
++                a = currOffset.x + currOffset.y + currShift.x + currShift.y;
++                _ranges[i].initialise<SD>(mn, mx, margin / ISQRT2, marginWeight, a);
++                break;
++        }
++    }
++
++	_target = aSlot;
++    if ((dir & 1) == 0)
++    {
++        // For LTR, switch and negate x limits.
++        _limit.bl.x = -1 * limit.tr.x;
++        //_limit.tr.x = -1 * limit.bl.x;
++    }
++    _currOffset = currOffset;
++    _currShift = currShift;
++    _origin = aSlot->origin() - currOffset;     // the original anchor position of the glyph
++
++	_margin = margin;
++	_marginWt = marginWeight;
++    
++    SlotCollision *c = seg->collisionInfo(aSlot);
++    _seqClass = c->seqClass();
++	_seqProxClass = c->seqProxClass();
++    _seqOrder = c->seqOrder();
++    return true;
++}
++
++template <class O>
++float sdm(float vi, float va, float mx, float my, O op)
++{
++    float res = 2 * mx - vi;
++    if (op(res, vi + 2 * my))
++    {
++        res = va + 2 * my;
++        if (op(res, 2 * mx - va))
++            res = mx + my;
++    }
++    return res;
++}
++
++// Mark an area with a cost that can vary along the x or y axis. The region is expressed in terms of the centre of the target glyph in each axis
++void ShiftCollider::addBox_slope(bool isx, const Rect &box, const BBox &bb, const SlantBox &sb, const Position &org, float weight, float m, bool minright, int axis)
++{
++    float a, c;
++    switch (axis) {
++        case 0 :
++             if (box.bl.y < org.y + bb.ya && box.tr.y > org.y + bb.yi && box.width() > 0)
++            {
++                a = org.y + 0.5f * (bb.yi + bb.ya);
++                c = 0.5f * (bb.xi + bb.xa);
++                if (isx)
++                    _ranges[axis].weighted<XY>(box.bl.x - c, box.tr.x - c, weight, a, m,
++                                                (minright ? box.tr.x : box.bl.x) - c, a, 0, false);
++                else
++                    _ranges[axis].weighted<XY>(box.bl.x - c, box.tr.x - c, weight, a, 0, 0, org.y,
++                                                m * (a * a + sqr((minright ? box.tr.y : box.bl.y) - 0.5f * (bb.yi + bb.ya))), false);
++            }
++            break;
++        case 1 :
++            if (box.bl.x < org.x + bb.xa && box.tr.x > org.x + bb.xi && box.height() > 0)
++            {
++                a = org.x + 0.5f * (bb.xi + bb.xa);
++                c = 0.5f * (bb.yi + bb.ya);
++                if (isx)
++                    _ranges[axis].weighted<XY>(box.bl.y - c, box.tr.y - c, weight, a, 0, 0, org.x,
++                                                m * (a * a + sqr((minright ? box.tr.x : box.bl.x) - 0.5f * (bb.xi + bb.xa))), false);
++                else
++                    _ranges[axis].weighted<XY>(box.bl.y - c, box.tr.y - c, weight, a, m, 
++                                                (minright ? box.tr.y : box.bl.y) - c, a, 0, false);
++            }
++            break;
++        case 2 :
++            if (box.bl.x - box.tr.y < org.x - org.y + sb.da && box.tr.x - box.bl.y > org.x - org.y + sb.di)
++            {
++                float d = org.x - org.y + 0.5f * (sb.di + sb.da);
++                c = 0.5f * (sb.si + sb.sa);
++                float smax = min(2 * box.tr.x - d, 2 * box.tr.y + d);
++                float smin = max(2 * box.bl.x - d, 2 * box.bl.y + d);
++                if (smin > smax) return;
++                float si;
++                a = d;
++                if (isx)
++                    si = 2 * (minright ? box.tr.x : box.bl.x) - a;
++                else
++                    si = 2 * (minright ? box.tr.y : box.bl.y) + a;
++                _ranges[axis].weighted<SD>(smin - c, smax - c, weight / 2, a, m / 2, si, 0, 0, isx);
++            }
++            break;
++        case 3 :
++            if (box.bl.x + box.bl.y < org.x + org.y + sb.sa && box.tr.x + box.tr.y > org.x + org.y + sb.si)
++            {
++                float s = org.x + org.y + 0.5f * (sb.si + sb.sa);
++                c = 0.5f * (sb.di + sb.da);
++                float dmax = min(2 * box.tr.x - s, s - 2 * box.bl.y);
++                float dmin = max(2 * box.bl.x - s, s - 2 * box.tr.y);
++                if (dmin > dmax) return;
++                float di;
++                a = s;
++                if (isx)
++                    di = 2 * (minright ? box.tr.x : box.bl.x) - a;
++                else
++                    di = 2 * (minright ? box.tr.y : box.bl.y) + a;
++                _ranges[axis].weighted<SD>(dmin - c, dmax - c, weight / 2, a, m / 2, di, 0, 0, !isx);
++            }
++            break;
++        default :
++            break;
++    }
++    return;
++}
++
++// Mark an area with an absolute cost, making it completely inaccessible.
++inline void ShiftCollider::removeBox(const Rect &box, const BBox &bb, const SlantBox &sb, const Position &org, int axis)
++{
++    float c;
++    switch (axis) {
++        case 0 :
++            if (box.bl.y < org.y + bb.ya && box.tr.y > org.y + bb.yi && box.width() > 0)
++            {
++                c = 0.5f * (bb.xi + bb.xa);
++                _ranges[axis].exclude(box.bl.x - c, box.tr.x - c);
++            }
++            break;
++        case 1 :
++            if (box.bl.x < org.x + bb.xa && box.tr.x > org.x + bb.xi && box.height() > 0)
++            {
++                c = 0.5f * (bb.yi + bb.ya);
++                _ranges[axis].exclude(box.bl.y - c, box.tr.y - c);
++            }
++            break;
++        case 2 :
++            if (box.bl.x - box.tr.y < org.x - org.y + sb.da && box.tr.x - box.bl.y > org.x - org.y + sb.di 
++                && box.width() > 0 && box.height() > 0)
++            {
++                float di = org.x - org.y + sb.di;
++                float da = org.x - org.y + sb.da;
++                float smax = sdm(di, da, box.tr.x, box.tr.y, std::greater<float>());
++                float smin = sdm(da, di, box.bl.x, box.bl.y, std::less<float>());
++                c = 0.5f * (sb.si + sb.sa);
++                _ranges[axis].exclude(smin - c, smax - c);
++            }
++            break;
++        case 3 :
++            if (box.bl.x + box.bl.y < org.x + org.y + sb.sa && box.tr.x + box.tr.y > org.x + org.y + sb.si 
++                && box.width() > 0 && box.height() > 0)
++            {
++                float si = org.x + org.y + sb.si;
++                float sa = org.x + org.y + sb.sa;
++                float dmax = sdm(si, sa, box.tr.x, -box.bl.y, std::greater<float>());
++                float dmin = sdm(sa, si, box.bl.x, -box.tr.y, std::less<float>());
++                c = 0.5f * (sb.di + sb.da);
++                _ranges[axis].exclude(dmin - c, dmax - c);
++            }
++            break;
++        default :
++            break;
++    }
++    return;
++}
++
++// Adjust the movement limits for the target to avoid having it collide
++// with the given neighbor slot. Also determine if there is in fact a collision
++// between the target and the given slot.
++bool ShiftCollider::mergeSlot(Segment *seg, Slot *slot, const Position &currShift,
++		bool isAfter,  // slot is logically after _target
++		bool sameCluster, bool &hasCol, bool isExclusion,
++        GR_MAYBE_UNUSED json * const dbgout )
++{
++    bool isCol = false;
++    const float sx = slot->origin().x - _origin.x + currShift.x;
++    const float sy = slot->origin().y - _origin.y + currShift.y;
++    const float sd = sx - sy;
++    const float ss = sx + sy;
++    float vmin, vmax;
++    float omin, omax, otmin, otmax;
++    float cmin, cmax;   // target limits
++    float torg;
++    const GlyphCache &gc = seg->getFace()->glyphs();
++    const unsigned short gid = slot->gid();
++    if (!gc.check(gid))
++        return false;
++    const BBox &bb = gc.getBoundingBBox(gid);
++
++    SlotCollision * cslot = seg->collisionInfo(slot);
++    int orderFlags = 0;
++    bool sameClass = _seqProxClass == 0 && cslot->seqClass() == _seqClass;
++    if (sameCluster && _seqClass 
++        && (sameClass || (_seqProxClass != 0 && cslot->seqClass() == _seqProxClass)))
++		// Force the target glyph to be in the specified direction from the slot we're testing.
++        orderFlags = _seqOrder;
++
++    // short circuit if only interested in direct collision and we are out of range
++    if (orderFlags || (sx + bb.xa + _margin >= _limit.bl.x && sx + bb.xi - _margin <= _limit.tr.x)
++                    || (sy + bb.ya + _margin >= _limit.bl.y && sy + bb.yi - _margin <= _limit.tr.y))
++
++    {
++        const float tx = _currOffset.x + _currShift.x;
++        const float ty = _currOffset.y + _currShift.y;
++        const float td = tx - ty;
++        const float ts = tx + ty;
++        const SlantBox &sb = gc.getBoundingSlantBox(gid);
++        const unsigned short tgid = _target->gid();
++        const BBox &tbb = gc.getBoundingBBox(tgid);
++        const SlantBox &tsb = gc.getBoundingSlantBox(tgid);
++        float seq_above_wt = cslot->seqAboveWt();
++        float seq_below_wt = cslot->seqBelowWt();
++        float seq_valign_wt = cslot->seqValignWt();
++        // if isAfter, invert orderFlags for diagonal orders.
++        if (isAfter)
++        {
++            // invert appropriate bits
++            orderFlags ^= (sameClass ? 0x3F : 0x3);
++            // consider 2 bits at a time, non overlapping. If both bits set, clear them
++            orderFlags = orderFlags ^ ((((orderFlags >> 1) & orderFlags) & 0x15) * 3);
++        }
++
++#if !defined GRAPHITE2_NTRACING
++        if (dbgout)
++            dbgout->setenv(0, slot);
++#endif
++
++        // Process main bounding octabox.
++        for (int i = 0; i < 4; ++i)
++        {
++            switch (i) {
++                case 0 :	// x direction
++                    vmin = max(max(bb.xi - tbb.xa + sx, sb.di - tsb.da + ty + sd), sb.si - tsb.sa - ty + ss);
++                    vmax = min(min(bb.xa - tbb.xi + sx, sb.da - tsb.di + ty + sd), sb.sa - tsb.si - ty + ss);
++                    otmin = tbb.yi + ty;
++                    otmax = tbb.ya + ty;
++                    omin = bb.yi + sy;
++                    omax = bb.ya + sy;
++                    torg = _currOffset.x;
++                    cmin = _limit.bl.x + torg;
++                    cmax = _limit.tr.x - tbb.xi + tbb.xa + torg;
++                    break;
++                case 1 :	// y direction
++                    vmin = max(max(bb.yi - tbb.ya + sy, tsb.di - sb.da + tx - sd), sb.si - tsb.sa - tx + ss);
++                    vmax = min(min(bb.ya - tbb.yi + sy, tsb.da - sb.di + tx - sd), sb.sa - tsb.si - tx + ss);
++                    otmin = tbb.xi + tx;
++                    otmax = tbb.xa + tx;
++                    omin = bb.xi + sx;
++                    omax = bb.xa + sx;
++                    torg = _currOffset.y;
++                    cmin = _limit.bl.y + torg;
++                    cmax = _limit.tr.y - tbb.yi + tbb.ya + torg;
++                    break;
++                case 2 :    // sum - moving along the positively-sloped vector, so the boundaries are the
++                            // negatively-sloped boundaries.
++                    vmin = max(max(sb.si - tsb.sa + ss, 2 * (bb.yi - tbb.ya + sy) + td), 2 * (bb.xi - tbb.xa + sx) - td);
++                    vmax = min(min(sb.sa - tsb.si + ss, 2 * (bb.ya - tbb.yi + sy) + td), 2 * (bb.xa - tbb.xi + sx) - td);
++                    otmin = tsb.di + td;
++                    otmax = tsb.da + td;
++                    omin = sb.di + sd;
++                    omax = sb.da + sd;
++                    torg = _currOffset.x + _currOffset.y;
++                    cmin = _limit.bl.x + _limit.bl.y + torg;
++                    cmax = _limit.tr.x + _limit.tr.y - tsb.si + tsb.sa + torg;
++                    break;
++                case 3 :    // diff - moving along the negatively-sloped vector, so the boundaries are the
++                            // positively-sloped boundaries.
++                    vmin = max(max(sb.di - tsb.da + sd, 2 * (bb.xi - tbb.xa + sx) - ts), -2 * (bb.ya - tbb.yi + sy) + ts);
++                    vmax = min(min(sb.da - tsb.di + sd, 2 * (bb.xa - tbb.xi + sx) - ts), -2 * (bb.yi - tbb.ya + sy) + ts);
++                    otmin = tsb.si + ts;
++                    otmax = tsb.sa + ts;
++                    omin = sb.si + ss;
++                    omax = sb.sa + ss;
++                    torg = _currOffset.x - _currOffset.y;
++                    cmin = _limit.bl.x - _limit.tr.y + torg;
++                    cmax = _limit.tr.x - _limit.bl.y - tsb.di + tsb.da + torg;
++                    break;
++                default :
++                    continue;
++            }
++            
++#if !defined GRAPHITE2_NTRACING
++            if (dbgout)
++                dbgout->setenv(1, reinterpret_cast<void *>(-1));
++#define DBGTAG(x) if (dbgout) dbgout->setenv(1, reinterpret_cast<void *>(-x));
++#else
++#define DBGTAG(x)
++#endif
++
++            if (orderFlags)
++            {
++                Position org(tx, ty);
++                float xminf = _limit.bl.x + _currOffset.x + tbb.xi;
++                float xpinf = _limit.tr.x + _currOffset.x + tbb.xa;
++                float ypinf = _limit.tr.y + _currOffset.y + tbb.ya;
++                float yminf = _limit.bl.y + _currOffset.y + tbb.yi;
++                switch (orderFlags) {
++                    case SlotCollision::SEQ_ORDER_RIGHTUP :
++                    {
++                        float r1Xedge = cslot->seqAboveXoff() + 0.5f * (bb.xi + bb.xa) + sx;
++                        float r3Xedge = cslot->seqBelowXlim() + bb.xa + sx + 0.5f * (tbb.xa - tbb.xi);
++                        float r2Yedge = 0.5f * (bb.yi + bb.ya) + sy;
++                        
++                        // DBGTAG(1x) means the regions are up and right
++                        // region 1
++                        DBGTAG(11)
++                        addBox_slope(true, Rect(Position(xminf, r2Yedge), Position(r1Xedge, ypinf)),
++                                        tbb, tsb, org, 0, seq_above_wt, true, i);
++                        // region 2
++                        DBGTAG(12)
++                        removeBox(Rect(Position(xminf, yminf), Position(r3Xedge, r2Yedge)), tbb, tsb, org, i);
++                        // region 3, which end is zero is irrelevant since m weight is 0
++                        DBGTAG(13)
++                        addBox_slope(true, Rect(Position(r3Xedge, yminf), Position(xpinf, r2Yedge - cslot->seqValignHt())),
++                                        tbb, tsb, org, seq_below_wt, 0, true, i);
++                        // region 4
++                        DBGTAG(14)
++                        addBox_slope(false, Rect(Position(sx + bb.xi, r2Yedge), Position(xpinf, r2Yedge + cslot->seqValignHt())),
++                                        tbb, tsb, org, 0, seq_valign_wt, true, i);
++                        // region 5
++                        DBGTAG(15)
++                        addBox_slope(false, Rect(Position(sx + bb.xi, r2Yedge - cslot->seqValignHt()), Position(xpinf, r2Yedge)),
++                                        tbb, tsb, org, seq_below_wt, seq_valign_wt, false, i);
++                        break;
++                    }
++                    case SlotCollision::SEQ_ORDER_LEFTDOWN :
++                    {
++                        float r1Xedge = 0.5f * (bb.xi + bb.xa) + cslot->seqAboveXoff() + sx;
++                        float r3Xedge = bb.xi - cslot->seqBelowXlim() + sx - 0.5f * (tbb.xa - tbb.xi);
++                        float r2Yedge = 0.5f * (bb.yi + bb.ya) + sy;
++                        // DBGTAG(2x) means the regions are up and right
++                        // region 1
++                        DBGTAG(21)
++                        addBox_slope(true, Rect(Position(r1Xedge, yminf), Position(xpinf, r2Yedge)),
++                                        tbb, tsb, org, 0, seq_above_wt, false, i);
++                        // region 2
++                        DBGTAG(22)
++                        removeBox(Rect(Position(r3Xedge, r2Yedge), Position(xpinf, ypinf)), tbb, tsb, org, i);
++                        // region 3
++                        DBGTAG(23)
++                        addBox_slope(true, Rect(Position(xminf, r2Yedge - cslot->seqValignHt()), Position(r3Xedge, ypinf)),
++                                        tbb, tsb, org, seq_below_wt, 0, false, i);
++                        // region 4
++                        DBGTAG(24)
++                        addBox_slope(false, Rect(Position(xminf, r2Yedge), Position(sx + bb.xa, r2Yedge + cslot->seqValignHt())),
++                                        tbb, tsb, org, 0, seq_valign_wt, true, i);
++                        // region 5
++                        DBGTAG(25)
++                        addBox_slope(false, Rect(Position(xminf, r2Yedge - cslot->seqValignHt()),
++                                        Position(sx + bb.xa, r2Yedge)), tbb, tsb, org, seq_below_wt, seq_valign_wt, false, i);
++                        break;
++                    }
++                    case SlotCollision::SEQ_ORDER_NOABOVE : // enforce neighboring glyph being above
++                        DBGTAG(31);
++                        removeBox(Rect(Position(bb.xi - tbb.xa + sx, sy + bb.ya), 
++                                        Position(bb.xa - tbb.xi + sx, ypinf)), tbb, tsb, org, i);
++                        break;
++                    case SlotCollision::SEQ_ORDER_NOBELOW :	// enforce neighboring glyph being below
++                        DBGTAG(32);
++                        removeBox(Rect(Position(bb.xi - tbb.xa + sx, yminf),
++                                        Position(bb.xa - tbb.xi + sx, sy + bb.yi)), tbb, tsb, org, i);
++                        break;
++                    case SlotCollision::SEQ_ORDER_NOLEFT :  // enforce neighboring glyph being to the left
++                        DBGTAG(33)
++                        removeBox(Rect(Position(xminf, bb.yi - tbb.ya + sy),
++                                        Position(bb.xi - tbb.xa + sx, bb.ya - tbb.yi + sy)), tbb, tsb, org, i);
++                        break;
++                    case SlotCollision::SEQ_ORDER_NORIGHT : // enforce neighboring glyph being to the right
++                        DBGTAG(34)
++                        removeBox(Rect(Position(bb.xa - tbb.xi + sx, bb.yi - tbb.ya + sy),
++                                        Position(xpinf, bb.ya - tbb.yi + sy)), tbb, tsb, org, i);
++                        break;
++                    default :
++                        break;
++                }
++            }
++
++            if (vmax < cmin - _margin || vmin > cmax + _margin || omax < otmin - _margin || omin > otmax + _margin)
++                continue;
++
++            // Process sub-boxes that are defined for this glyph.
++            // We only need to do this if there was in fact a collision with the main octabox.
++            uint8 numsub = gc.numSubBounds(gid);
++            if (numsub > 0)
++            {
++                bool anyhits = false;
++                for (int j = 0; j < numsub; ++j)
++                {
++                    const BBox &sbb = gc.getSubBoundingBBox(gid, j);
++                    const SlantBox &ssb = gc.getSubBoundingSlantBox(gid, j);
++                    switch (i) {
++                        case 0 :    // x
++                            vmin = max(max(sbb.xi-tbb.xa+sx, ssb.di-tsb.da+sd+ty), ssb.si-tsb.sa+ss-ty);
++                            vmax = min(min(sbb.xa-tbb.xi+sx, ssb.da-tsb.di+sd+ty), ssb.sa-tsb.si+ss-ty);
++                            omin = sbb.yi + sy;
++                            omax = sbb.ya + sy;
++                            break;
++                        case 1 :    // y
++                            vmin = max(max(sbb.yi-tbb.ya+sy, tsb.di-ssb.da-sd+tx), ssb.si-tsb.sa+ss-tx);
++                            vmax = min(min(sbb.ya-tbb.yi+sy, tsb.da-ssb.di-sd+tx), ssb.sa-tsb.si+ss-tx);
++                            omin = sbb.xi + sx;
++                            omax = sbb.xa + sx;
++                            break;
++                        case 2 :    // sum
++                            vmin = max(max(ssb.si-tsb.sa+ss, 2*(sbb.yi-tbb.ya+sy)+td), 2*(sbb.xi-tbb.xa+sx)-td);
++                            vmax = min(min(ssb.sa-tsb.si+ss, 2*(sbb.ya-tbb.yi+sy)+td), 2*(sbb.xa-tbb.xi+sx)-td);
++                            omin = ssb.di + sd;
++                            omax = ssb.da + sd;
++                            break;
++                        case 3 :    // diff
++                            vmin = max(max(ssb.di-tsb.da+sd, 2*(sbb.xi-tbb.xa+sx)-ts), -2*(sbb.ya-tbb.yi+sy)+ts);
++                            vmax = min(min(ssb.da-tsb.di+sd, 2*(sbb.xa-tbb.xi+sx)-ts), -2*(sbb.yi-tbb.ya+sy)+ts);
++                            omin = ssb.si + ss;
++                            omax = ssb.sa + ss;
++                            break;
++                    }
++                    if (vmax < cmin - _margin || vmin > cmax + _margin || omax < otmin - _margin || omin > otmax + _margin)
++                        continue;
++
++#if !defined GRAPHITE2_NTRACING
++                    if (dbgout)
++                        dbgout->setenv(1, reinterpret_cast<void *>(j));
++#endif
++                    if (omin > otmax)
++                        _ranges[i].weightedAxis(i, vmin - _margin, vmax + _margin, 0, 0, 0, 0, 0,
++                                                sqr(_margin - omin + otmax) * _marginWt, false);
++                    else if (omax < otmin)
++                        _ranges[i].weightedAxis(i, vmin - _margin, vmax + _margin, 0, 0, 0, 0, 0,
++                                                sqr(_margin - otmin + omax) * _marginWt, false);
++                    else
++                        _ranges[i].exclude_with_margins(vmin, vmax, i);
++                    anyhits = true;
++                }
++                if (anyhits)
++                    isCol = true;
++            }
++            else // no sub-boxes
++            {
++#if !defined GRAPHITE2_NTRACING
++                    if (dbgout)
++                        dbgout->setenv(1, reinterpret_cast<void *>(-1));
++#endif
++                isCol = true;
++                if (omin > otmax)
++                    _ranges[i].weightedAxis(i, vmin - _margin, vmax + _margin, 0, 0, 0, 0, 0,
++                                            sqr(_margin - omin + otmax) * _marginWt, false);
++                else if (omax < otmin)
++                    _ranges[i].weightedAxis(i, vmin - _margin, vmax + _margin, 0, 0, 0, 0, 0,
++                                            sqr(_margin - otmin + omax) * _marginWt, false);
++                else
++                    _ranges[i].exclude_with_margins(vmin, vmax, i);
++
++            }
++        }
++    }
++    bool res = true;
++    if (cslot->exclGlyph() > 0 && gc.check(cslot->exclGlyph()) && !isExclusion)
++    {
++        // Set up the bogus slot representing the exclusion glyph.
++        Slot *exclSlot = seg->newSlot();
++        exclSlot->setGlyph(seg, cslot->exclGlyph());
++        Position exclOrigin(slot->origin() + cslot->exclOffset());
++        exclSlot->origin(exclOrigin);
++        res &= mergeSlot(seg, exclSlot, currShift, isAfter, sameCluster, isCol, true, dbgout );
++        seg->freeSlot(exclSlot);
++    }
++    hasCol |= isCol;
++    return res;
++    
++}   // end of ShiftCollider::mergeSlot
++
++
++// Figure out where to move the target glyph to, and return the amount to shift by.
++Position ShiftCollider::resolve(GR_MAYBE_UNUSED Segment *seg, bool &isCol, GR_MAYBE_UNUSED json * const dbgout)
++{
++    float tbase;
++    float totalCost = (float)(std::numeric_limits<float>::max() / 2);
++    Position resultPos = Position(0, 0);
++#if !defined GRAPHITE2_NTRACING
++	int bestAxis = -1;
++    if (dbgout)
++    {
++		outputJsonDbgStartSlot(dbgout, seg);
++        *dbgout << "vectors" << json::array;
++    }
++#endif
++    isCol = true;
++    for (int i = 0; i < 4; ++i)
++    {
++        float bestCost = -1;
++        float bestPos;
++        // Calculate the margin depending on whether we are moving diagonally or not:
++        switch (i) {
++            case 0 :	// x direction
++                tbase = _currOffset.x;
++                break;
++            case 1 :	// y direction
++                tbase = _currOffset.y;
++                break;
++            case 2 :	// sum (negatively-sloped diagonals)
++                tbase = _currOffset.x + _currOffset.y;
++                break;
++            case 3 :	// diff (positively-sloped diagonals)
++                tbase = _currOffset.x - _currOffset.y;
++                break;
++        }
++        Position testp;
++        bestPos = _ranges[i].closest(0, bestCost) - tbase;     // Get the best relative position
++#if !defined GRAPHITE2_NTRACING
++        if (dbgout)
++            outputJsonDbgOneVector(dbgout, seg, i, tbase, bestCost, bestPos) ;
++#endif
++        if (bestCost >= 0.0f)
++        {
++            isCol = false;
++            switch (i) {
++                case 0 : testp = Position(bestPos, _currShift.y); break;
++                case 1 : testp = Position(_currShift.x, bestPos); break;
++                case 2 : testp = Position(0.5f * (_currShift.x - _currShift.y + bestPos), 0.5f * (_currShift.y - _currShift.x + bestPos)); break;
++                case 3 : testp = Position(0.5f * (_currShift.x + _currShift.y + bestPos), 0.5f * (_currShift.x + _currShift.y - bestPos)); break;
++            }
++            if (bestCost < totalCost - 0.01f)
++            {
++                totalCost = bestCost;
++                resultPos = testp;
++#if !defined GRAPHITE2_NTRACING
++                bestAxis = i;
++#endif
++            }
++        }
++    }  // end of loop over 4 directions
++
++#if !defined GRAPHITE2_NTRACING
++    if (dbgout)
++        outputJsonDbgEndSlot(dbgout, resultPos, bestAxis, isCol);
++#endif
++
++    return resultPos;
++
++}   // end of ShiftCollider::resolve
++
++
++#if !defined GRAPHITE2_NTRACING
++
++void ShiftCollider::outputJsonDbg(json * const dbgout, Segment *seg, int axis)
++{
++    int axisMax = axis;
++    if (axis < 0) // output all axes
++    {
++        *dbgout << "gid" << _target->gid()
++            << "limit" << _limit
++            << "target" << json::object
++                << "origin" << _target->origin()
++                << "margin" << _margin
++                << "bbox" << seg->theGlyphBBoxTemporary(_target->gid())
++                << "slantbox" << seg->getFace()->glyphs().slant(_target->gid())
++                << json::close; // target object
++        *dbgout << "ranges" << json::array;
++        axis = 0;
++        axisMax = 3;
++    }
++    for (int iAxis = axis; iAxis <= axisMax; ++iAxis)
++    {
++        *dbgout << json::flat << json::array << _ranges[iAxis].position();
++        for (Zones::const_iterator s = _ranges[iAxis].begin(), e = _ranges[iAxis].end(); s != e; ++s)
++            *dbgout << json::flat << json::array 
++                        << Position(s->x, s->xm) << s->sm << s->smx << s->c
++                    << json::close;
++        *dbgout << json::close;
++    }
++    if (axis < axisMax) // looped through the _ranges array for all axes
++        *dbgout << json::close; // ranges array
++}
++
++void ShiftCollider::outputJsonDbgStartSlot(json * const dbgout, Segment *seg)
++{
++        *dbgout << json::object // slot - not closed till the end of the caller method
++                << "slot" << objectid(dslot(seg, _target))
++				<< "gid" << _target->gid()
++                << "limit" << _limit
++                << "target" << json::object
++                    << "origin" << _origin
++                    << "currShift" << _currShift
++                    << "currOffset" << seg->collisionInfo(_target)->offset()
++                    << "bbox" << seg->theGlyphBBoxTemporary(_target->gid())
++                    << "slantBox" << seg->getFace()->glyphs().slant(_target->gid())
++                    << "fix" << "shift";
++        *dbgout     << json::close; // target object
++}
++
++void ShiftCollider::outputJsonDbgEndSlot(GR_MAYBE_UNUSED json * const dbgout,
++	 Position resultPos, int bestAxis, bool isCol)
++{
++    *dbgout << json::close // vectors array
++    << "result" << resultPos
++	//<< "scraping" << _scraping[bestAxis]
++	<< "bestAxis" << bestAxis
++    << "stillBad" << isCol
++    << json::close; // slot object
++}
++
++void ShiftCollider::outputJsonDbgOneVector(json * const dbgout, Segment *seg, int axis,
++	float tleft, float bestCost, float bestVal) 
++{
++	const char * label;
++	switch (axis)
++	{
++		case 0:	label = "x";			break;
++		case 1:	label = "y";			break;
++		case 2:	label = "sum (NE-SW)";	break;
++		case 3:	label = "diff (NW-SE)";	break;
++		default: label = "???";			break;
++	}
++
++	*dbgout << json::object // vector
++		<< "direction" << label
++		<< "targetMin" << tleft;
++            
++	outputJsonDbgRemovals(dbgout, axis, seg);
++    	
++    *dbgout << "ranges";
++    outputJsonDbg(dbgout, seg, axis);
++
++    *dbgout << "bestCost" << bestCost
++        << "bestVal" << bestVal + tleft
++        << json::close; // vectors object
++}
++
++void ShiftCollider::outputJsonDbgRemovals(json * const dbgout, int axis, Segment *seg)
++{
++    *dbgout << "removals" << json::array;
++    _ranges[axis].jsonDbgOut(seg);
++    *dbgout << json::close; // removals array
++}
++
++#endif // !defined GRAPHITE2_NTRACING
++
++
++////    KERN-COLLIDER    ////
++
++inline
++static float localmax (float al, float au, float bl, float bu, float x)
++{
++    if (al < bl)
++    { if (au < bu) return au < x ? au : x; }
++    else if (au > bu) return bl < x ? bl : x;
++    return x;
++}
++
++inline
++static float localmin(float al, float au, float bl, float bu, float x)
++{
++    if (bl > al)
++    { if (bu > au) return bl > x ? bl : x; }
++    else if (au > bu) return al > x ? al : x;
++    return x;        
++}
++
++// Return the given edge of the glyph at height y, taking any slant box into account.
++static float get_edge(Segment *seg, const Slot *s, const Position &shift, float y, float width, bool isRight)
++{
++    const GlyphCache &gc = seg->getFace()->glyphs();
++    unsigned short gid = s->gid();
++    float sx = s->origin().x + shift.x;
++    float sy = s->origin().y + shift.y;
++    uint8 numsub = gc.numSubBounds(gid);
++    float res = isRight ? (float)-1e38 : (float)1e38;
++
++    if (numsub > 0)
++    {
++        for (int i = 0; i < numsub; ++i)
++        {
++            const BBox &sbb = gc.getSubBoundingBBox(gid, i);
++            const SlantBox &ssb = gc.getSubBoundingSlantBox(gid, i);
++            if (sy + sbb.yi > y + width / 2 || sy + sbb.ya < y - width / 2)
++                continue;
++            if (isRight)
++            {
++                float x = sx + sbb.xa;
++                if (x > res)
++                {
++                    float td = sx - sy + ssb.da + y;
++                    float ts = sx + sy + ssb.sa - y;
++                    x = localmax(td - width / 2, td + width / 2,  ts - width / 2, ts + width / 2, x);
++                    if (x > res)
++                        res = x;
++                }
++            }
++            else
++            {
++                float x = sx + sbb.xi;
++                if (x < res)
++                {
++                    float td = sx - sy + ssb.di + y;
++                    float ts = sx + sy + ssb.si - y;
++                    x = localmin(td - width / 2, td + width / 2, ts - width / 2, ts + width / 2, x);
++                    if (x < res)
++                        res = x;
++                }
++            }
++        }
++    }
++    else
++    {
++        const BBox &bb = gc.getBoundingBBox(gid);
++        const SlantBox &sb = gc.getBoundingSlantBox(gid);
++        float td = sx - sy + y;
++        float ts = sx + sy - y;
++        if (isRight)
++            res = localmax(td + sb.da - width / 2, td + sb.da + width / 2, ts + sb.sa - width / 2, ts + sb.sa + width / 2, sx + bb.xa);
++        else
++            res = localmin(td + sb.di - width / 2, td + sb.di + width / 2, ts + sb.si - width / 2, ts + sb.si + width / 2, sx + bb.xi);
++    }
++    return res;
++}
++
++
++bool KernCollider::initSlot(Segment *seg, Slot *aSlot, const Rect &limit, float margin,
++    const Position &currShift, const Position &offsetPrev, int dir,
++    float ymin, float ymax, GR_MAYBE_UNUSED json * const dbgout)
++{
++    const GlyphCache &gc = seg->getFace()->glyphs();
++    const Slot *base = aSlot;
++    // const Slot *last = aSlot;
++    const Slot *s;
++    int numSlices;
++    while (base->attachedTo())
++        base = base->attachedTo();
++    if (margin < 10) margin = 10;
++
++    _limit = limit;
++    _offsetPrev = offsetPrev; // kern from a previous pass
++    
++    // Calculate the height of the glyph and how many horizontal slices to use.
++    if (_maxy >= 1e37f)
++    {
++        _maxy = ymax;
++        _miny = ymin;
++        _sliceWidth = margin / 1.5f;
++        numSlices = int((_maxy - _miny + 2) / (_sliceWidth / 1.5f) + 1.f);  // +2 helps with rounding errors
++        _edges.clear();
++        _edges.insert(_edges.begin(), numSlices, (dir & 1) ? 1e38f : -1e38f);
++        _xbound = (dir & 1) ? (float)1e38f : (float)-1e38f;
++    }
++    else if (_maxy != ymax || _miny != ymin)
++    {
++        if (_miny != ymin)
++        {
++            numSlices = int((ymin - _miny) / _sliceWidth - 1);
++            _miny += numSlices * _sliceWidth;
++            if (numSlices < 0)
++                _edges.insert(_edges.begin(), -numSlices, (dir & 1) ? 1e38f : -1e38f);
++            else if ((unsigned)numSlices < _edges.size())    // this shouldn't fire since we always grow the range
++            {
++                Vector<float>::iterator e = _edges.begin();
++                while (numSlices--)
++                    ++e;
++                _edges.erase(_edges.begin(), e);
++            }
++        }
++        if (_maxy != ymax)
++        {
++            numSlices = int((ymax - _miny) / _sliceWidth + 1);
++            _maxy = numSlices * _sliceWidth + _miny;
++            if (numSlices > (int)_edges.size())
++                _edges.insert(_edges.end(), numSlices - _edges.size(), (dir & 1) ? 1e38f : -1e38f);
++            else if (numSlices < (int)_edges.size())   // this shouldn't fire since we always grow the range
++            {
++                while ((int)_edges.size() > numSlices)
++                    _edges.pop_back();
++            }
++        }
++    }
++    numSlices = _edges.size();
++
++#if !defined GRAPHITE2_NTRACING
++    // Debugging
++    _seg = seg;
++    _slotNear.clear();
++    _slotNear.insert(_slotNear.begin(), numSlices, NULL);
++    _nearEdges.clear();
++    _nearEdges.insert(_nearEdges.begin(), numSlices, (dir & 1) ? -1e38f : +1e38f);
++#endif
++    
++    // Determine the trailing edge of each slice (ie, left edge for a RTL glyph).
++    for (s = base; s; s = s->nextInCluster(s))
++    {
++        SlotCollision *c = seg->collisionInfo(s);
++        if (!gc.check(s->gid()))
++            return false;
++        const BBox &bs = gc.getBoundingBBox(s->gid());
++        float x = s->origin().x + c->shift().x + ((dir & 1) ? bs.xi : bs.xa);
++        // Loop over slices.
++        // Note smin might not be zero if glyph s is not at the bottom of the cluster; similarly for smax.
++        float toffset = c->shift().y - _miny + 1 + s->origin().y;
++        int smin = max(0, int((bs.yi + toffset) / _sliceWidth));
++        int smax = min(numSlices - 1, int((bs.ya + toffset) / _sliceWidth + 1));
++        for (int i = smin; i <= smax; ++i)
++        {
++            float t;
++            float y = _miny - 1 + (i + .5f) * _sliceWidth; // vertical center of slice
++            if ((dir & 1) && x < _edges[i])
++            {
++                t = get_edge(seg, s, c->shift(), y, _sliceWidth, false);
++                if (t < _edges[i])
++                {
++                    _edges[i] = t;
++                    if (t < _xbound)
++                        _xbound = t;
++                }
++            }
++            else if (!(dir & 1) && x > _edges[i])
++            {
++                t = get_edge(seg, s, c->shift(), y, _sliceWidth, true);
++                if (t > _edges[i])
++                {
++                    _edges[i] = t;
++                    if (t > _xbound)
++                        _xbound = t;
++                }
++            }
++        }
++    }
++    _mingap = (float)1e38;
++    _target = aSlot;
++    _margin = margin;
++    _currShift = currShift;
++    return true;
++}   // end of KernCollider::initSlot
++
++
++// Determine how much the target slot needs to kern away from the given slot.
++// In other words, merge information from given slot's position with what the target slot knows
++// about how it can kern.
++// Return false if we know there is no collision, true if we think there might be one.
++bool KernCollider::mergeSlot(Segment *seg, Slot *slot, const Position &currShift, float currSpace, int dir, GR_MAYBE_UNUSED json * const dbgout)
++{
++    int rtl = (dir & 1) * 2 - 1;
++    if (!seg->getFace()->glyphs().check(slot->gid()))
++        return false;
++    const Rect &bb = seg->theGlyphBBoxTemporary(slot->gid());
++    const float sx = slot->origin().x + currShift.x;
++    float x = sx + (rtl > 0 ? bb.tr.x : bb.bl.x);
++    // this isn't going to reduce _mingap so skip
++    if ((rtl > 0 && x < _xbound - _mingap - currSpace) || (rtl <= 0 && x > _xbound + _mingap + currSpace))
++        return false;
++
++    const float sy = slot->origin().y + currShift.y;
++    int smin = max(0, int((bb.bl.y + (1 - _miny + sy)) / _sliceWidth + 1));
++    int smax = min((int)_edges.size() - 1, int((bb.tr.y + (1 - _miny + sy)) / _sliceWidth + 1));
++    bool collides = false;
++
++    for (int i = smin; i <= smax; ++i)
++    {
++        float t;
++        float y = (float)(_miny - 1 + (i + .5f) * _sliceWidth);  // vertical center of slice
++        if (x * rtl > _edges[i] * rtl - _mingap - currSpace)
++        {
++            // 2 * currSpace to account for the space that is already separating them and the space we want to add
++            float m = get_edge(seg, slot, currShift, y, _sliceWidth, rtl > 0) + 2 * rtl * currSpace;
++            t = rtl * (_edges[i] - m);
++            // Check slices above and below (if any).
++            if (i < (int)_edges.size() - 1) t = min(t, rtl * (_edges[i+1] - m));
++            if (i > 0) t = min(t, rtl * (_edges[i-1] - m));
++            // _mingap is positive to shrink
++            if (t < _mingap)
++            {
++                _mingap = t;
++                collides = true;
++            }
++#if !defined GRAPHITE2_NTRACING
++            // Debugging - remember the closest neighboring edge for this slice.
++            if (rtl * m > rtl * _nearEdges[i])
++            {
++                _slotNear[i] = slot;
++                _nearEdges[i] = m;
++            }
++#endif
++        }
++    }
++    return collides;   // note that true is not a necessarily reliable value
++    
++}   // end of KernCollider::mergeSlot
++
++
++// Return the amount to kern by.
++Position KernCollider::resolve(GR_MAYBE_UNUSED Segment *seg, GR_MAYBE_UNUSED Slot *slot,
++        int dir, float margin, GR_MAYBE_UNUSED json * const dbgout)
++{
++    float resultNeeded = (1 - 2 * (dir & 1)) * (_mingap - margin);
++    float result = min(_limit.tr.x - _offsetPrev.x, max(resultNeeded, _limit.bl.x - _offsetPrev.x));
++
++#if !defined GRAPHITE2_NTRACING
++    if (dbgout)
++    {
++        *dbgout << json::object // slot
++                << "slot" << objectid(dslot(seg, _target))
++				<< "gid" << _target->gid()
++                << "margin" << _margin
++                << "limit" << _limit
++                << "miny" << _miny
++                << "maxy" << _maxy
++                << "slicewidth" << _sliceWidth
++                << "target" << json::object
++                    << "origin" << _target->origin()
++                    //<< "currShift" << _currShift
++                    << "offsetPrev" << _offsetPrev
++                    << "bbox" << seg->theGlyphBBoxTemporary(_target->gid())
++                    << "slantBox" << seg->getFace()->glyphs().slant(_target->gid())
++                    << "fix" << "kern"
++                    << json::close; // target object
++        
++        *dbgout << "slices" << json::array;
++        for (int is = 0; is < (int)_edges.size(); is++)
++        {
++            *dbgout << json::flat << json::object 
++                << "i" << is 
++                << "targetEdge" << _edges[is]
++                << "neighbor" << objectid(dslot(seg, _slotNear[is]))
++                << "nearEdge" << _nearEdges[is] 
++                << json::close;
++        }
++        *dbgout << json::close; // slices array
++            
++        *dbgout
++            << "xbound" << _xbound
++            << "minGap" << _mingap
++            << "needed" << resultNeeded
++            << "result" << result
++            << "stillBad" << (result != resultNeeded)
++            << json::close; // slot object
++    }
++#endif
++
++    return Position(result, 0.);
++    
++}   // end of KernCollider::resolve
++
++void KernCollider::shift(const Position &mv, int dir)
++{
++    for (Vector<float>::iterator e = _edges.begin(); e != _edges.end(); ++e)
++        *e += mv.x;
++    _xbound += (1 - 2 * (dir & 1)) * mv.x;
++}
++
++////    SLOT-COLLISION    ////
++
++// Initialize the collision attributes for the given slot.
++SlotCollision::SlotCollision(Segment *seg, Slot *slot)
++{
++    initFromSlot(seg, slot);
++}
++
++void SlotCollision::initFromSlot(Segment *seg, Slot *slot)
++{
++    // Initialize slot attributes from glyph attributes.
++	// The order here must match the order in the grcompiler code, 
++	// GrcSymbolTable::AssignInternalGlyphAttrIDs.
++    uint16 gid = slot->gid();
++    uint16 aCol = seg->silf()->aCollision(); // flags attr ID
++    const GlyphFace * glyphFace = seg->getFace()->glyphs().glyphSafe(gid);
++    if (!glyphFace)
++        return;
++    const sparse &p = glyphFace->attrs();
++    _flags = p[aCol];
++    _limit = Rect(Position(p[aCol+1], p[aCol+2]),
++                  Position(p[aCol+3], p[aCol+4]));
++    _margin = p[aCol+5];
++    _marginWt = p[aCol+6];
++
++    _seqClass = p[aCol+7];
++	_seqProxClass = p[aCol+8];
++    _seqOrder = p[aCol+9];
++	_seqAboveXoff = p[aCol+10];
++	_seqAboveWt = p[aCol+11];
++	_seqBelowXlim = p[aCol+12];
++	_seqBelowWt = p[aCol+13];
++	_seqValignHt = p[aCol+14];
++	_seqValignWt = p[aCol+15];    
++
++    // These attributes do not have corresponding glyph attribute:
++    _exclGlyph = 0;
++    _exclOffset = Position(0, 0);
++}
++
++float SlotCollision::getKern(int dir) const
++{
++    if ((_flags & SlotCollision::COLL_KERN) != 0)
++        return float(_shift.x * ((dir & 1) ? -1 : 1));
++    else
++    	return 0;
++}
++
+diff --git a/gfx/graphite2/src/Decompressor.cpp b/gfx/graphite2/src/Decompressor.cpp
+new file mode 100644
+--- /dev/null
++++ b/gfx/graphite2/src/Decompressor.cpp
+@@ -0,0 +1,113 @@
++/*  GRAPHITE2 LICENSING
++
++    Copyright 2015, SIL International
++    All rights reserved.
++
++    This library is free software; you can redistribute it and/or modify
++    it under the terms of the GNU Lesser General Public License as published
++    by the Free Software Foundation; either version 2.1 of License, or
++    (at your option) any later version.
++
++    This program is distributed in the hope that it will be useful,
++    but WITHOUT ANY WARRANTY; without even the implied warranty of
++    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++    Lesser General Public License for more details.
++
++    You should also have received a copy of the GNU Lesser General Public
++    License along with this library in the file named "LICENSE".
++    If not, write to the Free Software Foundation, 51 Franklin Street, 
++    Suite 500, Boston, MA 02110-1335, USA or visit their web page on the 
++    internet at http://www.fsf.org/licenses/lgpl.html.
++
++Alternatively, the contents of this file may be used under the terms of the
++Mozilla Public License (http://mozilla.org/MPL) or the GNU General Public
++License, as published by the Free Software Foundation, either version 2
++of the License or (at your option) any later version.
++*/
++#include <cassert>
++
++#include "inc/Decompressor.h"
++#include "inc/Compression.h"
++
++using namespace lz4;
++
++namespace {
++
++inline
++u32 read_literal(u8 const * &s, u8 const * const e, u32 l) {
++    if (l == 15 && s != e)
++    {
++        u8 b = 0;
++        do { l += b = *s++; } while(b==0xff && s != e);
++    }
++    return l;
++}
++
++bool read_sequence(u8 const * &src, u8 const * const end, u8 const * &literal, u32 & literal_len, u32 & match_len, u32 & match_dist)
++{
++    u8 const token = *src++;
++    
++    literal_len = read_literal(src, end, token >> 4);
++    literal = src;
++    src += literal_len;
++    
++    if (src > end - 2)
++        return false;
++    
++    match_dist  = *src++;
++    match_dist |= *src++ << 8;
++    match_len = read_literal(src, end, token & 0xf);
++    
++    return src <= end-5;
++}
++
++}
++
++int lz4::decompress(void const *in, size_t in_size, void *out, size_t out_size)
++{
++    if (out_size <= in_size || in_size < sizeof(unsigned long)+1)
++        return -1;
++    
++    u8 const *       src     = static_cast<u8 const *>(in),
++             *       literal = 0,
++             * const src_end = src + in_size;
++
++    u8 *       dst     = static_cast<u8*>(out),
++       * const dst_end = dst + out_size;
++    
++    u32 literal_len = 0,
++        match_len = 0,
++        match_dist = 0;
++    
++    while (read_sequence(src, src_end, literal, literal_len, match_len, match_dist))
++    {
++        if (literal_len != 0)
++        {
++            // Copy in literal. At this point the last full sequence must be at
++            // least MINMATCH + 5 from the end of the output buffer.
++            if (dst + align(literal_len) > dst_end - (MINMATCH+5))
++                return -1;
++            dst = overrun_copy(dst, literal, literal_len);
++        }
++        
++        // Copy, possibly repeating, match from earlier in the
++        //  decoded output.
++        u8 const * const pcpy = dst - match_dist;
++        if (pcpy < static_cast<u8*>(out)
++                  || dst + match_len + MINMATCH > dst_end - 5)
++            return -1;
++        if (dst > pcpy+sizeof(unsigned long) 
++            && dst + align(match_len + MINMATCH) <= dst_end)
++            dst = overrun_copy(dst, pcpy, match_len + MINMATCH);
++        else 
++            dst = safe_copy(dst, pcpy, match_len + MINMATCH);
++    }
++    
++    if (literal + literal_len > src_end
++              || dst + literal_len > dst_end)
++        return -1;
++    dst = fast_copy(dst, literal, literal_len);
++    
++    return dst - (u8*)out;
++}
++
+diff --git a/gfx/graphite2/src/Face.cpp b/gfx/graphite2/src/Face.cpp
+--- a/gfx/graphite2/src/Face.cpp
++++ b/gfx/graphite2/src/Face.cpp
+@@ -23,28 +23,39 @@ Alternatively, the contents of this file
+ Mozilla Public License (http://mozilla.org/MPL) or the GNU General Public
+ License, as published by the Free Software Foundation, either version 2
+ of the License or (at your option) any later version.
+ */
+ #include <cstring>
+ #include "graphite2/Segment.h"
+ #include "inc/CmapCache.h"
+ #include "inc/debug.h"
++#include "inc/Decompressor.h"
+ #include "inc/Endian.h"
+ #include "inc/Face.h"
+ #include "inc/FileFace.h"
+ #include "inc/GlyphFace.h"
+ #include "inc/json.h"
+ #include "inc/SegCacheStore.h"
+ #include "inc/Segment.h"
+ #include "inc/NameTable.h"
+ #include "inc/Error.h"
+ 
+ using namespace graphite2;
+ 
++namespace
++{
++enum compression
++{
++    NONE,
++    LZ4
++};
++
++}
++
+ Face::Face(const void* appFaceHandle/*non-NULL*/, const gr_face_ops & ops)
+ : m_appFaceHandle(appFaceHandle),
+   m_pFileFace(NULL),
+   m_pGlyphFaceCache(NULL),
+   m_cmap(NULL),
+   m_pNames(NULL),
+   m_logger(NULL),
+   m_error(0), m_errcntxt(0),
+@@ -79,55 +90,59 @@ float Face::default_glyph_advance(const 
+ 
+ bool Face::readGlyphs(uint32 faceOptions)
+ {
+     Error e;
+ #ifdef GRAPHITE2_TELEMETRY
+     telemetry::category _glyph_cat(tele.glyph);
+ #endif
+     error_context(EC_READGLYPHS);
++    m_pGlyphFaceCache = new GlyphCache(*this, faceOptions);
++
++    if (e.test(!m_pGlyphFaceCache, E_OUTOFMEM)
++        || e.test(m_pGlyphFaceCache->numGlyphs() == 0, E_NOGLYPHS)
++        || e.test(m_pGlyphFaceCache->unitsPerEm() == 0, E_BADUPEM))
++    {
++        return error(e);
++    }
++
+     if (faceOptions & gr_face_cacheCmap)
+         m_cmap = new CachedCmap(*this);
+     else
+         m_cmap = new DirectCmap(*this);
+-
+-    m_pGlyphFaceCache = new GlyphCache(*this, faceOptions);
+-    if (e.test(!m_pGlyphFaceCache, E_OUTOFMEM)
+-        || e.test(m_pGlyphFaceCache->numGlyphs() == 0, E_NOGLYPHS)
+-        || e.test(m_pGlyphFaceCache->unitsPerEm() == 0, E_BADUPEM)
+-        || e.test(!m_cmap, E_OUTOFMEM) || e.test(!*m_cmap, E_BADCMAP))
+-    {
++    if (e.test(!m_cmap, E_OUTOFMEM) || e.test(!*m_cmap, E_BADCMAP))
+         return error(e);
+-    }
+ 
+     if (faceOptions & gr_face_preloadGlyphs)
+         nameTable();        // preload the name table along with the glyphs.
+ 
+     return true;
+ }
+ 
+ bool Face::readGraphite(const Table & silf)
+ {
+ #ifdef GRAPHITE2_TELEMETRY
+     telemetry::category _silf_cat(tele.silf);
+ #endif
+     Error e;
+     error_context(EC_READSILF);
+     const byte * p = silf;
+-    if (e.test(!p, E_NOSILF)) return error(e);
++    if (e.test(!p, E_NOSILF) || e.test(silf.size() < 20, E_BADSIZE)) return error(e);
+ 
+     const uint32 version = be::read<uint32>(p);
+     if (e.test(version < 0x00020000, E_TOOOLD)) return error(e);
+     if (version >= 0x00030000)
+         be::skip<uint32>(p);        // compilerVersion
+     m_numSilf = be::read<uint16>(p);
++
+     be::skip<uint16>(p);            // reserved
+ 
+     bool havePasses = false;
+     m_silfs = new Silf[m_numSilf];
++    if (e.test(!m_silfs, E_OUTOFMEM)) return error(e);
+     for (int i = 0; i < m_numSilf; i++)
+     {
+         error_context(EC_ASILF + (i << 8));
+         const uint32 offset = be::read<uint32>(p),
+                      next   = i == m_numSilf - 1 ? silf.size() : be::peek<uint32>(p);
+         if (e.test(next > silf.size() || offset >= next, E_BADSIZE))
+             return error(e);
+ 
+@@ -153,29 +168,38 @@ bool Face::runGraphite(Segment *seg, con
+     if (dbgout)
+     {
+         *dbgout << json::object
+                     << "id"         << objectid(seg)
+                     << "passes"     << json::array;
+     }
+ #endif
+ 
+-    bool res = aSilf->runGraphite(seg, 0, aSilf->justificationPass(), true);
++//    if ((seg->dir() & 1) != aSilf->dir())
++//        seg->reverseSlots();
++    if ((seg->dir() & 3) == 3 && aSilf->bidiPass() == 0xFF)
++        seg->doMirror(aSilf->aMirror());
++    bool res = aSilf->runGraphite(seg, 0, aSilf->positionPass(), true);
+     if (res)
+-        res = aSilf->runGraphite(seg, aSilf->positionPass(), aSilf->numPasses(), false);
++    {
++        seg->associateChars(0, seg->charInfoCount());
++        if (aSilf->flags() & 0x20)
++            res &= seg->initCollisions();
++        res &= aSilf->runGraphite(seg, aSilf->positionPass(), aSilf->numPasses(), false);
++    }
+ 
+ #if !defined GRAPHITE2_NTRACING
+     if (dbgout)
+ {
++        seg->positionSlots(0, 0, 0, aSilf->dir());
+         *dbgout             << json::item
+                             << json::close // Close up the passes array
+                 << "output" << json::array;
+         for(Slot * s = seg->first(); s; s = s->next())
+             *dbgout     << dslot(seg, s);
+-        seg->finalise(0);                   // Call this here to fix up charinfo back indexes.
+         *dbgout         << json::close
+                 << "advance" << seg->advance()
+                 << "chars"   << json::array;
+         for(size_t i = 0, n = seg->charInfoCount(); i != n; ++i)
+             *dbgout     << json::flat << *seg->charinfo(i);
+         *dbgout         << json::close  // Close up the chars array
+                     << json::close;     // Close up the segment object
+     }
+@@ -208,17 +232,19 @@ uint16 Face::findPseudo(uint32 uid) cons
+ }
+ 
+ uint16 Face::getGlyphMetric(uint16 gid, uint8 metric) const
+ {
+     switch (metrics(metric))
+     {
+         case kgmetAscent : return m_ascent;
+         case kgmetDescent : return m_descent;
+-        default: return glyphs().glyph(gid)->getMetric(metric);
++        default: 
++            if (gid >= glyphs().numGlyphs()) return 0;
++            return glyphs().glyph(gid)->getMetric(metric);
+     }
+ }
+ 
+ void Face::takeFileFace(FileFace* pFileFace GR_MAYBE_UNUSED/*takes ownership*/)
+ {
+ #ifndef GRAPHITE2_NFILEFACE
+     if (m_pFileFace==pFileFace)
+       return;
+@@ -240,30 +266,100 @@ NameTable * Face::nameTable() const
+ uint16 Face::languageForLocale(const char * locale) const
+ {
+     nameTable();
+     if (m_pNames)
+         return m_pNames->getLanguageId(locale);
+     return 0;
+ }
+ 
+-Face::Table::Table(const Face & face, const Tag n) throw()
+-: _f(&face)
++
++
++Face::Table::Table(const Face & face, const Tag n, uint32 version) throw()
++: _f(&face), _compressed(false)
+ {
+     size_t sz = 0;
+-    _p = reinterpret_cast<const byte *>((*_f->m_ops.get_table)(_f->m_appFaceHandle, n, &sz));
++    _p = static_cast<const byte *>((*_f->m_ops.get_table)(_f->m_appFaceHandle, n, &sz));
+     _sz = uint32(sz);
++
+     if (!TtfUtil::CheckTable(n, _p, _sz))
+     {
+         this->~Table();     // Make sure we release the table buffer even if the table filed it's checks
+-        _p = 0; _sz = 0;
++        return;
+     }
++
++    if (be::peek<uint32>(_p) >= version)
++        decompress();
++}
++
++void Face::Table::releaseBuffers()
++{
++    if (_compressed)
++        free(const_cast<byte *>(_p));
++    else if (_p && _f->m_ops.release_table)
++        (*_f->m_ops.release_table)(_f->m_appFaceHandle, _p);
++    _p = 0; _sz = 0;
+ }
+ 
+ Face::Table & Face::Table::operator = (const Table & rhs) throw()
+ {
+     if (_p == rhs._p)   return *this;
+ 
+     this->~Table();
+     new (this) Table(rhs);
+     return *this;
+ }
+ 
++Error Face::Table::decompress()
++{
++    Error e;
++    if (e.test(_sz < 5 * sizeof(uint32), E_BADSIZE))
++        return e;
++    byte * uncompressed_table = 0;
++    size_t uncompressed_size = 0;
++
++    const byte * p = _p;
++    const uint32 version = be::read<uint32>(p);    // Table version number.
++
++    // The scheme is in the top 5 bits of the 1st uint32.
++    const uint32 hdr = be::read<uint32>(p);
++    switch(compression(hdr >> 27))
++    {
++    case NONE: return e;
++
++    case LZ4:
++    {
++        uncompressed_size  = hdr & 0x07ffffff;
++        uncompressed_table = gralloc<byte>(uncompressed_size);
++        if (!e.test(!uncompressed_table, E_OUTOFMEM))
++            // coverity[forward_null : FALSE] - uncompressed_table has been checked so can't be null
++            // coverity[checked_return : FALSE] - we test e later
++            e.test(lz4::decompress(p, _sz - 2*sizeof(uint32), uncompressed_table, uncompressed_size) != signed(uncompressed_size), E_SHRINKERFAILED);
++        break;
++    }
++
++    default:
++        e.error(E_BADSCHEME);
++    };
++
++    // Check the uncompressed version number against the original.
++    if (!e)
++        // coverity[forward_null : FALSE] - uncompressed_table has already been tested so can't be null
++        // coverity[checked_return : FALSE] - we test e later
++        e.test(be::peek<uint32>(uncompressed_table) != version, E_SHRINKERFAILED);
++
++    // Tell the provider to release the compressed form since were replacing
++    //   it anyway.
++    releaseBuffers();
++
++    if (e)
++    {
++        free(uncompressed_table);
++        uncompressed_table = 0;
++        uncompressed_size  = 0;
++    }
++
++    _p = uncompressed_table;
++    _sz = uncompressed_size;
++    _compressed = true;
++
++    return e;
++}
+diff --git a/gfx/graphite2/src/FeatureMap.cpp b/gfx/graphite2/src/FeatureMap.cpp
+--- a/gfx/graphite2/src/FeatureMap.cpp
++++ b/gfx/graphite2/src/FeatureMap.cpp
+@@ -126,60 +126,61 @@ bool FeatureMap::readFeats(const Face & 
+     unsigned short bits = 0;     //to cause overflow on first Feature
+ 
+     for (int i = 0, ie = m_numFeats; i != ie; i++)
+     {
+         const uint32    label   = version < 0x00020000 ? be::read<uint16>(p) : be::read<uint32>(p);
+         const uint16    num_settings = be::read<uint16>(p);
+         if (version >= 0x00020000)
+             be::skip<uint16>(p);
+-        const byte * const feat_setts = feat_start + be::read<uint32>(p);
++        const uint32    settings_offset = be::read<uint32>(p);
+         const uint16    flags  = be::read<uint16>(p),
+                         uiName = be::read<uint16>(p);
+ 
+-        if (feat_setts + num_settings * FEATURE_SETTING_SIZE > feat_end)
++        if (settings_offset > size_t(feat_end - feat_start) 
++            || settings_offset + num_settings * FEATURE_SETTING_SIZE > size_t(feat_end - feat_start))
+         {
+             free(defVals);
+             return false;
+         }
+ 
+         FeatureSetting *uiSet;
+         uint32 maxVal;
+         if (num_settings != 0)
+         {
+             uiSet = gralloc<FeatureSetting>(num_settings);
+             if (!uiSet)
+             {
+                 free(defVals);
+                 return false;
+             }
+-            maxVal = readFeatureSettings(feat_setts, uiSet, num_settings);
++            maxVal = readFeatureSettings(feat_start + settings_offset, uiSet, num_settings);
+             defVals[i] = uiSet[0].value();
+         }
+         else
+         {
+             uiSet = 0;
+             maxVal = 0xffffffff;
+             defVals[i] = 0;
+         }
+ 
+         ::new (m_feats + i) FeatureRef (face, bits, maxVal,
+                                        label, uiName, flags,
+                                        uiSet, num_settings);
+     }
+-    m_defaultFeatures = new Features(bits/(sizeof(uint32)*8) + 1, *this);
++    new (&m_defaultFeatures) Features(bits/(sizeof(uint32)*8) + 1, *this);
+     m_pNamedFeats = new NameAndFeatureRef[m_numFeats];
+-    if (!m_defaultFeatures || !m_pNamedFeats)
++    if (!m_pNamedFeats)
+     {
+         free(defVals);
+         return false;
+     }
+     for (int i = 0; i < m_numFeats; ++i)
+     {
+-        m_feats[i].applyValToFeature(defVals[i], *m_defaultFeatures);
++        m_feats[i].applyValToFeature(defVals[i], m_defaultFeatures);
+         m_pNamedFeats[i] = m_feats+i;
+     }
+     
+     free(defVals);
+ 
+     qsort(m_pNamedFeats, m_numFeats, sizeof(NameAndFeatureRef), &cmpNameAndFeatures);
+ 
+     return true;
+@@ -209,17 +210,17 @@ bool SillMap::readSill(const Face & face
+     if (sill.size() < m_numLanguages * 8U + 12) return false;
+ 
+     for (int i = 0; i < m_numLanguages; i++)
+     {
+         uint32 langid = be::read<uint32>(p);
+         uint16 numSettings = be::read<uint16>(p);
+         uint16 offset = be::read<uint16>(p);
+         if (offset + 8U * numSettings > sill.size() && numSettings > 0) return false;
+-        Features* feats = new Features(*m_FeatureMap.m_defaultFeatures);
++        Features* feats = new Features(m_FeatureMap.m_defaultFeatures);
+         if (!feats) return false;
+         const byte *pLSet = sill + offset;
+ 
+         // Apply langauge specific settings
+         for (int j = 0; j < numSettings; j++)
+         {
+             uint32 name = be::read<uint32>(pLSet);
+             uint16 val = be::read<uint16>(pLSet);
+@@ -245,17 +246,17 @@ Features* SillMap::cloneFeatures(uint32 
+         // the number of languages in a font is usually small e.g. 8 in Doulos
+         // so this loop is not very expensive
+         for (uint16 i = 0; i < m_numLanguages; i++)
+         {
+             if (m_langFeats[i].m_lang == langname)
+                 return new Features(*m_langFeats[i].m_pFeatures);
+         }
+     }
+-    return new Features (*m_FeatureMap.m_defaultFeatures);
++    return new Features (m_FeatureMap.m_defaultFeatures);
+ }
+ 
+ 
+ 
+ const FeatureRef *FeatureMap::findFeatureRef(uint32 name) const
+ {
+     NameAndFeatureRef *it;
+     
+diff --git a/gfx/graphite2/src/FileFace.cpp b/gfx/graphite2/src/FileFace.cpp
+--- a/gfx/graphite2/src/FileFace.cpp
++++ b/gfx/graphite2/src/FileFace.cpp
+@@ -55,18 +55,22 @@ FileFace::FileFace(const char *filename)
+         if (fread(_header_tbl, 1, tbl_len, _file) != tbl_len) return;
+         if (!TtfUtil::CheckHeader(_header_tbl)) return;
+     }
+ 
+     // Get the table directory
+     if (!TtfUtil::GetTableDirInfo(_header_tbl, tbl_offset, tbl_len)) return;
+     _table_dir = (TtfUtil::Sfnt::OffsetSubTable::Entry*)gralloc<char>(tbl_len);
+     if (fseek(_file, tbl_offset, SEEK_SET)) return;
+-    if (_table_dir)
+-        if (fread(_table_dir, 1, tbl_len, _file) != tbl_len) return;
++    if (_table_dir && fread(_table_dir, 1, tbl_len, _file) != tbl_len)
++    {
++        free(_table_dir);
++        _table_dir = NULL;
++    }
++    return;
+ }
+ 
+ FileFace::~FileFace()
+ {
+     free(_table_dir);
+     free(_header_tbl);
+     if (_file)
+         fclose(_file);
+@@ -78,17 +82,17 @@ const void *FileFace::get_table_fn(const
+     if (appFaceHandle == 0)     return 0;
+     const FileFace & file_face = *static_cast<const FileFace *>(appFaceHandle);
+ 
+     void *tbl;
+     size_t tbl_offset, tbl_len;
+     if (!TtfUtil::GetTableInfo(name, file_face._header_tbl, file_face._table_dir, tbl_offset, tbl_len))
+         return 0;
+ 
+-    if (tbl_offset + tbl_len > file_face._file_len
++    if (tbl_offset > file_face._file_len || tbl_len > file_face._file_len - tbl_offset
+             || fseek(file_face._file, tbl_offset, SEEK_SET) != 0)
+         return 0;
+ 
+     tbl = malloc(tbl_len);
+     if (fread(tbl, 1, tbl_len, file_face._file) != tbl_len)
+     {
+         free(tbl);
+         return 0;
+diff --git a/gfx/graphite2/src/GlyphCache.cpp b/gfx/graphite2/src/GlyphCache.cpp
+--- a/gfx/graphite2/src/GlyphCache.cpp
++++ b/gfx/graphite2/src/GlyphCache.cpp
+@@ -26,16 +26,17 @@ of the License or (at your option) any l
+ */
+ #include "graphite2/Font.h"
+ 
+ #include "inc/Main.h"
+ #include "inc/Face.h"     //for the tags
+ #include "inc/GlyphCache.h"
+ #include "inc/GlyphFace.h"
+ #include "inc/Endian.h"
++#include "inc/bits.h"
+ 
+ using namespace graphite2;
+ 
+ namespace
+ {
+     // Iterator over version 1 or 2 glat entries which consist of a series of
+     //    +-+-+-+-+-+-+-+-+-+-+                +-+-+-+-+-+-+-+-+-+-+-+-+
+     // v1 |k|n|v1 |v2 |...|vN |     or    v2   | k | n |v1 |v2 |...|vN |
+@@ -56,99 +57,127 @@ namespace
+             if (_n == run()) advance_entry();
+             return *this;
+         }
+         _glat_iterator<W>   operator ++ (int)   { _glat_iterator<W> tmp(*this); operator++(); return tmp; }
+ 
+         // This is strictly a >= operator. A true == operator could be
+         // implemented that test for overlap but it would be more expensive a
+         // test.
+-        bool operator == (const _glat_iterator<W> & rhs) { return _v >= rhs._e; }
++        bool operator == (const _glat_iterator<W> & rhs) { return _v >= rhs._e - 1; }
+         bool operator != (const _glat_iterator<W> & rhs) { return !operator==(rhs); }
+ 
+         value_type          operator * () const {
+             return value_type(key(), be::peek<uint16>(_v));
+         }
+ 
+     protected:
+         const byte     * _e, * _v;
+-        ptrdiff_t        _n;
++        size_t        _n;
+     };
+ 
+     typedef _glat_iterator<uint8>   glat_iterator;
+     typedef _glat_iterator<uint16>  glat2_iterator;
+ }
+ 
++const SlantBox SlantBox::empty = {0,0,0,0};
++
+ 
+ class GlyphCache::Loader
+ {
+ public:
+     Loader(const Face & face, const bool dumb_font);    //return result indicates success. Do not use if failed.
+ 
+     operator bool () const throw();
+     unsigned short int units_per_em() const throw();
+     unsigned short int num_glyphs() const throw();
+     unsigned short int num_attrs() const throw();
++    bool has_boxes() const throw();
+ 
+-    const GlyphFace * read_glyph(unsigned short gid, GlyphFace &) const throw();
++    const GlyphFace * read_glyph(unsigned short gid, GlyphFace &, int *numsubs) const throw();
++    GlyphBox * read_box(uint16 gid, GlyphBox *curr, const GlyphFace & face) const throw();
+ 
+     CLASS_NEW_DELETE;
+ private:
+     Face::Table _head,
+                 _hhea,
+                 _hmtx,
+                 _glyf,
+                 _loca,
+                 m_pGlat,
+                 m_pGloc;
+ 
+     bool            _long_fmt;
++    bool            _has_boxes;
+     unsigned short  _num_glyphs_graphics,        //i.e. boundary box and advance
+                     _num_glyphs_attributes,
+                     _num_attrs;                    // number of glyph attributes per glyph
+ };
+ 
+ 
+ 
+ GlyphCache::GlyphCache(const Face & face, const uint32 face_options)
+ : _glyph_loader(new Loader(face, bool(face_options & gr_face_dumbRendering))),
+   _glyphs(_glyph_loader && *_glyph_loader ? grzeroalloc<const GlyphFace *>(_glyph_loader->num_glyphs()) : 0),
++  _boxes(_glyph_loader && _glyph_loader->has_boxes() ? grzeroalloc<GlyphBox *>(_glyph_loader->num_glyphs()) : 0),
+   _num_glyphs(_glyphs ? _glyph_loader->num_glyphs() : 0),
+   _num_attrs(_glyphs ? _glyph_loader->num_attrs() : 0),
+   _upem(_glyphs ? _glyph_loader->units_per_em() : 0)
+ {
+     if ((face_options & gr_face_preloadGlyphs) && _glyph_loader && _glyphs)
+     {
++        int numsubs = 0;
+         GlyphFace * const glyphs = new GlyphFace [_num_glyphs];
+         if (!glyphs)
+             return;
+ 
+         // The 0 glyph is definately required.
+-        _glyphs[0] = _glyph_loader->read_glyph(0, glyphs[0]);
++        _glyphs[0] = _glyph_loader->read_glyph(0, glyphs[0], &numsubs);
+ 
+         // glyphs[0] has the same address as the glyphs array just allocated,
+         //  thus assigning the &glyphs[0] to _glyphs[0] means _glyphs[0] points
+         //  to the entire array.
+         const GlyphFace * loaded = _glyphs[0];
+         for (uint16 gid = 1; loaded && gid != _num_glyphs; ++gid)
+-            _glyphs[gid] = loaded = _glyph_loader->read_glyph(gid, glyphs[gid]);
++            _glyphs[gid] = loaded = _glyph_loader->read_glyph(gid, glyphs[gid], &numsubs);
+ 
+         if (!loaded)
+         {
+             _glyphs[0] = 0;
+             delete [] glyphs;
+         }
++        else if (numsubs > 0)
++        {
++            GlyphBox * boxes = (GlyphBox *)gralloc<char>(_num_glyphs * sizeof(GlyphBox) + numsubs * 8 * sizeof(float));
++            GlyphBox * currbox = boxes;
++
++            for (uint16 gid = 0; currbox && gid != _num_glyphs; ++gid)
++            {
++                _boxes[gid] = currbox;
++                currbox = _glyph_loader->read_box(gid, currbox, *_glyphs[gid]);
++            }
++            if (!currbox)
++            {
++                free(boxes);
++                _boxes[0] = 0;
++            }
++        }
+         delete _glyph_loader;
+         _glyph_loader = 0;
+     }
+ 
+     if (_glyphs && glyph(0) == 0)
+     {
+         free(_glyphs);
+         _glyphs = 0;
++        if (_boxes)
++        {
++            free(_boxes);
++            _boxes = 0;
++        }
+         _num_glyphs = _num_attrs = _upem = 0;
+     }
+ }
+ 
+ 
+ GlyphCache::~GlyphCache()
+ {
+     if (_glyphs)
+@@ -158,91 +187,130 @@ GlyphCache::~GlyphCache()
+             const GlyphFace *  * g = _glyphs;
+             for(unsigned short n = _num_glyphs; n; --n, ++g)
+                 delete *g;
+         }
+         else
+             delete [] _glyphs[0];
+         free(_glyphs);
+     }
++    if (_boxes)
++    {
++        if (_glyph_loader)
++        {
++            GlyphBox *  * g = _boxes;
++            for (uint16 n = _num_glyphs; n; --n, ++g)
++                free(*g);
++        }
++        else
++            free(_boxes[0]);
++        free(_boxes);
++    }
+     delete _glyph_loader;
+ }
+ 
+ const GlyphFace *GlyphCache::glyph(unsigned short glyphid) const      //result may be changed by subsequent call with a different glyphid
+ { 
+     const GlyphFace * & p = _glyphs[glyphid];
+     if (p == 0 && _glyph_loader)
+     {
++        int numsubs = 0;
+         GlyphFace * g = new GlyphFace();
+-        if (g)  p = _glyph_loader->read_glyph(glyphid, *g);
++        if (g)  p = _glyph_loader->read_glyph(glyphid, *g, &numsubs);
+         if (!p)
+         {
+             delete g;
+             return *_glyphs;
+         }
++        if (_boxes)
++        {
++            _boxes[glyphid] = (GlyphBox *)gralloc<char>(sizeof(GlyphBox) + 8 * numsubs * sizeof(float));
++            if (!_glyph_loader->read_box(glyphid, _boxes[glyphid], *_glyphs[glyphid]))
++            {
++                free(_boxes[glyphid]);
++                _boxes[glyphid] = 0;
++            }
++        }
+     }
+     return p;
+ }
+ 
+ 
+ 
+ GlyphCache::Loader::Loader(const Face & face, const bool dumb_font)
+ : _head(face, Tag::head),
+   _hhea(face, Tag::hhea),
+   _hmtx(face, Tag::hmtx),
+   _glyf(face, Tag::glyf),
+   _loca(face, Tag::loca),
+   _long_fmt(false),
++  _has_boxes(false),
+   _num_glyphs_graphics(0),
+   _num_glyphs_attributes(0),
+   _num_attrs(0)
+ {
+     if (!operator bool())
+         return;
+ 
+     const Face::Table maxp = Face::Table(face, Tag::maxp);
+     if (!maxp) { _head = Face::Table(); return; }
+ 
+     _num_glyphs_graphics = TtfUtil::GlyphCount(maxp);
+     // This will fail if the number of glyphs is wildly out of range.
+-    if (_glyf && TtfUtil::LocaLookup(_num_glyphs_graphics-1, _loca, _loca.size(), _head) == size_t(-1))
++    if (_glyf && TtfUtil::LocaLookup(_num_glyphs_graphics-1, _loca, _loca.size(), _head) == size_t(-2))
+     {
+         _head = Face::Table();
+         return;
+     }
+ 
+     if (!dumb_font)
+     {
+-        if ((m_pGlat = Face::Table(face, Tag::Glat)) == NULL
++        if ((m_pGlat = Face::Table(face, Tag::Glat, 0x00030000)) == NULL
+             || (m_pGloc = Face::Table(face, Tag::Gloc)) == NULL
+             || m_pGloc.size() < 6)
+         {
+             _head = Face::Table();
+             return;
+         }
+         const byte    * p = m_pGloc;
+-        const int       version = be::read<uint32>(p);
++        int       version = be::read<uint32>(p);
+         const uint16    flags = be::read<uint16>(p);
+         _num_attrs = be::read<uint16>(p);
+         // We can accurately calculate the number of attributed glyphs by
+         //  subtracting the length of the attribids array (numAttribs long if present)
+         //  and dividing by either 2 or 4 depending on shor or lonf format
+         _long_fmt              = flags & 1;
+-        _num_glyphs_attributes = (m_pGloc.size()
++        int tmpnumgattrs       = (m_pGloc.size()
+                                    - (p - m_pGloc)
+                                    - sizeof(uint16)*(flags & 0x2 ? _num_attrs : 0))
+                                        / (_long_fmt ? sizeof(uint32) : sizeof(uint16)) - 1;
+ 
+-        if (version != 0x00010000
++        if (version >= 0x00020000 || tmpnumgattrs < 0 || tmpnumgattrs > 65535
+             || _num_attrs == 0 || _num_attrs > 0x3000  // is this hard limit appropriate?
+-            || _num_glyphs_graphics > _num_glyphs_attributes)
++            || _num_glyphs_graphics > tmpnumgattrs)
+         {
+             _head = Face::Table();
+             return;
+         }
++
++        _num_glyphs_attributes = static_cast<unsigned short>(tmpnumgattrs);
++        p = m_pGlat;
++        version = be::read<uint32>(p);
++        if (version >= 0x00040000)       // reject Glat tables that are too new
++        {
++            _head = Face::Table();
++            return;
++        }
++        else if (version >= 0x00030000)
++        {
++            unsigned int glatflags = be::read<uint32>(p);
++            _has_boxes = glatflags & 1;
++            // delete this once the compiler is fixed
++            _has_boxes = true;
++        }
+     }
+ }
+ 
+ inline
+ GlyphCache::Loader::operator bool () const throw()
+ {
+     return _head && _hhea && _hmtx && !(bool(_glyf) != bool(_loca));
+ }
+@@ -260,34 +328,44 @@ unsigned short int GlyphCache::Loader::n
+ }
+ 
+ inline
+ unsigned short int GlyphCache::Loader::num_attrs() const throw()
+ {
+     return _num_attrs;
+ }
+ 
+-const GlyphFace * GlyphCache::Loader::read_glyph(unsigned short glyphid, GlyphFace & glyph) const throw()
++inline
++bool GlyphCache::Loader::has_boxes () const throw()
++{
++    return _has_boxes;
++}
++
++const GlyphFace * GlyphCache::Loader::read_glyph(unsigned short glyphid, GlyphFace & glyph, int *numsubs) const throw()
+ {
+     Rect        bbox;
+     Position    advance;
+ 
+     if (glyphid < _num_glyphs_graphics)
+     {
+         int nLsb;
+         unsigned int nAdvWid;
+         if (_glyf)
+         {
+             int xMin, yMin, xMax, yMax;
+             size_t locidx = TtfUtil::LocaLookup(glyphid, _loca, _loca.size(), _head);
+             void *pGlyph = TtfUtil::GlyfLookup(_glyf, locidx, _glyf.size());
+ 
+             if (pGlyph && TtfUtil::GlyfBox(pGlyph, xMin, yMin, xMax, yMax))
++            {
++                if ((xMin > xMax) || (yMin > yMax))
++                    return 0;
+                 bbox = Rect(Position(static_cast<float>(xMin), static_cast<float>(yMin)),
+                     Position(static_cast<float>(xMax), static_cast<float>(yMax)));
++            }
+         }
+         if (TtfUtil::HorMetrics(glyphid, _hmtx, _hmtx.size(), _hhea, nLsb, nAdvWid))
+             advance = Position(static_cast<float>(nAdvWid), 0);
+     }
+ 
+     if (glyphid < _num_glyphs_attributes)
+     {
+         const byte * gloc = m_pGloc;
+@@ -307,35 +385,95 @@ const GlyphFace * GlyphCache::Loader::re
+             glocs = be::read<uint16>(gloc);
+             gloce = be::peek<uint16>(gloc);
+         }
+ 
+         if (glocs >= m_pGlat.size() || gloce > m_pGlat.size())
+             return 0;
+ 
+         const uint32 glat_version = be::peek<uint32>(m_pGlat);
++        if (glat_version == 0x00030000)
++        {
++            const byte * p = m_pGlat + glocs;
++            uint16 bmap = be::read<uint16>(p);
++            int num = bit_set_count((uint32)bmap);
++            if (numsubs) *numsubs += num;
++            glocs += 6 + 8 * num;
++            if (glocs > gloce)
++                return 0;
++        }
+         if (glat_version < 0x00020000)
+         {
+             if (gloce - glocs < 2*sizeof(byte)+sizeof(uint16)
+                 || gloce - glocs > _num_attrs*(2*sizeof(byte)+sizeof(uint16)))
+-            {
+-                return 0;
+-            }
+-
++                    return 0;
+             new (&glyph) GlyphFace(bbox, advance, glat_iterator(m_pGlat + glocs), glat_iterator(m_pGlat + gloce));
+         }
+         else
+         {
+-            if (gloce - glocs < 3*sizeof(uint16)
+-                || gloce - glocs > _num_attrs*3*sizeof(uint16))
+-            {
+-                return 0;
+-            }
+-
++            if (gloce - glocs < 3*sizeof(uint16)        // can a glyph have no attributes? why not?
++                || gloce - glocs > _num_attrs*3*sizeof(uint16)
++                || glocs > m_pGlat.size() - 2*sizeof(uint16))
++                    return 0;
+             new (&glyph) GlyphFace(bbox, advance, glat2_iterator(m_pGlat + glocs), glat2_iterator(m_pGlat + gloce));
+         }
+-
+         if (!glyph.attrs() || glyph.attrs().capacity() > _num_attrs)
+             return 0;
+     }
+-
+     return &glyph;
+ }
++
++inline float scale_to(uint8 t, float zmin, float zmax)
++{
++    return (zmin + t * (zmax - zmin) / 255);
++}
++
++Rect readbox(Rect &b, uint8 zxmin, uint8 zymin, uint8 zxmax, uint8 zymax)
++{
++    return Rect(Position(scale_to(zxmin, b.bl.x, b.tr.x), scale_to(zymin, b.bl.y, b.tr.y)),
++                Position(scale_to(zxmax, b.bl.x, b.tr.x), scale_to(zymax, b.bl.y, b.tr.y)));
++}
++
++GlyphBox * GlyphCache::Loader::read_box(uint16 gid, GlyphBox *curr, const GlyphFace & glyph) const throw()
++{
++    if (gid >= _num_glyphs_attributes) return 0;
++
++    const byte * gloc = m_pGloc;
++    size_t      glocs = 0, gloce = 0;
++
++    be::skip<uint32>(gloc);
++    be::skip<uint16>(gloc,2);
++    if (_long_fmt)
++    {
++        be::skip<uint32>(gloc, gid);
++        glocs = be::read<uint32>(gloc);
++        gloce = be::peek<uint32>(gloc);
++    }
++    else
++    {
++        be::skip<uint16>(gloc, gid);
++        glocs = be::read<uint16>(gloc);
++        gloce = be::peek<uint16>(gloc);
++    }
++
++    if (glocs >= m_pGlat.size() || gloce > m_pGlat.size())
++        return 0;
++
++    const byte * p = m_pGlat + glocs;
++    uint16 bmap = be::read<uint16>(p);
++    int num = bit_set_count((uint32)bmap);
++
++    Rect bbox = glyph.theBBox();
++    Rect diamax(Position(bbox.bl.x + bbox.bl.y, bbox.bl.x - bbox.tr.y),
++                Position(bbox.tr.x + bbox.tr.y, bbox.tr.x - bbox.bl.y));
++    Rect diabound = readbox(diamax, p[0], p[2], p[1], p[3]);
++    ::new (curr) GlyphBox(num, bmap, &diabound);
++    be::skip<uint8>(p, 4);
++
++    for (int i = 0; i < num * 2; ++i)
++    {
++        Rect box = readbox((i & 1) ? diamax : bbox, p[0], p[2], p[1], p[3]);
++        curr->addSubBox(i >> 1, i & 1, &box);
++        be::skip<uint8>(p, 4);
++    } 
++    return (GlyphBox *)((char *)(curr) + sizeof(GlyphBox) + 2 * num * sizeof(Rect));
++}
++
+diff --git a/gfx/graphite2/src/Intervals.cpp b/gfx/graphite2/src/Intervals.cpp
+new file mode 100644
+--- /dev/null
++++ b/gfx/graphite2/src/Intervals.cpp
+@@ -0,0 +1,294 @@
++/*  GRAPHITE2 LICENSING
++
++    Copyright 2010, SIL International
++    All rights reserved.
++
++    This library is free software; you can redistribute it and/or modify
++    it under the terms of the GNU Lesser General Public License as published
++    by the Free Software Foundation; either version 2.1 of License, or
++    (at your option) any later version.
++
++    This program is distributed in the hope that it will be useful,
++    but WITHOUT ANY WARRANTY; without even the implied warranty of
++    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++    Lesser General Public License for more details.
++
++    You should also have received a copy of the GNU Lesser General Public
++    License along with this library in the file named "LICENSE".
++    If not, write to the Free Software Foundation, 51 Franklin Street, 
++    Suite 500, Boston, MA 02110-1335, USA or visit their web page on the 
++    internet at http://www.fsf.org/licenses/lgpl.html.
++
++Alternatively, the contents of this file may be used under the terms of the
++Mozilla Public License (http://mozilla.org/MPL) or the GNU General Public
++License, as published by the Free Software Foundation, either version 2
++of the License or (at your option) any later version.
++*/
++#include <algorithm>
++#include <cmath>
++#include <limits>
++
++#include "inc/Intervals.h"
++#include "inc/Segment.h"
++#include "inc/Slot.h"
++#include "inc/debug.h"
++#include "inc/bits.h"
++
++using namespace graphite2;
++
++#include <cmath>
++
++inline
++Zones::Exclusion  Zones::Exclusion::split_at(float p) {
++    Exclusion r(*this);
++    r.xm = x = p;
++    return r;
++}
++
++inline
++void Zones::Exclusion::left_trim(float p) {
++    x = p;
++}
++
++inline
++Zones::Exclusion & Zones::Exclusion::operator += (Exclusion const & rhs) {
++    c += rhs.c; sm += rhs.sm; smx += rhs.smx; open = false;
++    return *this;
++}
++
++inline
++uint8 Zones::Exclusion::outcode(float val) const {
++    float p = val;
++    return ((p >= xm) << 1) | (p < x);
++}
++
++void Zones::exclude_with_margins(float xmin, float xmax, int axis) {
++    remove(xmin, xmax);
++    weightedAxis(axis, xmin-_margin_len, xmin, 0, 0, _margin_weight, xmin-_margin_len, 0, 0, false);
++    weightedAxis(axis, xmax, xmax+_margin_len, 0, 0, _margin_weight, xmax+_margin_len, 0, 0, false);
++}
++
++namespace
++{
++
++inline
++bool separated(float a, float b) {
++    return a != b;
++    //return std::fabs(a-b) > std::numeric_limits<float>::epsilon(); // std::epsilon may not work. but 0.5 fails exising 64 bit tests
++    //return std::fabs(a-b) > 0.5f;
++}
++
++}
++
++void Zones::insert(Exclusion e)
++{
++#if !defined GRAPHITE2_NTRACING
++    addDebug(&e);
++#endif
++    e.x = max(e.x, _pos);
++    e.xm = min(e.xm, _posm);
++    if (e.x >= e.xm) return;
++
++    for (iterator i = _exclusions.begin(), ie = _exclusions.end(); i != ie && e.x < e.xm; ++i)
++    {
++        const uint8 oca = e.outcode(i->x),
++                    ocb = e.outcode(i->xm);
++        if ((oca & ocb) != 0) continue;
++
++        switch (oca ^ ocb)  // What kind of overlap?
++        {
++        case 0:     // e completely covers i
++            // split e at i.x into e1,e2
++            // split e2 at i.mx into e2,e3
++            // drop e1 ,i+e2, e=e3
++            *i += e;
++            e.left_trim(i->xm);
++            break;
++        case 1:     // e overlaps on the rhs of i
++            // split i at e->x into i1,i2
++            // split e at i.mx into e1,e2
++            // trim i1, insert i2+e1, e=e2
++            if (!separated(i->xm, e.x)) break;
++            if (separated(i->x,e.x))   { i = _exclusions.insert(i,i->split_at(e.x)); ++i; }
++            *i += e;
++            e.left_trim(i->xm);
++            break;
++        case 2:     // e overlaps on the lhs of i
++            // split e at i->x into e1,e2
++            // split i at e.mx into i1,i2
++            // drop e1, insert e2+i1, trim i2
++            if (!separated(e.xm, i->x)) return;
++            if (separated(e.xm, i->xm)) i = _exclusions.insert(i,i->split_at(e.xm));
++            *i += e;
++            return;
++        case 3:     // i completely covers e
++            // split i at e.x into i1,i2
++            // split i2 at e.mx into i2,i3
++            // insert i1, insert e+i2
++            if (separated(e.xm, i->xm)) i = _exclusions.insert(i,i->split_at(e.xm));
++            i = _exclusions.insert(i, i->split_at(e.x));
++            *++i += e;
++            return;
++        }
++
++        ie = _exclusions.end();
++    }
++}
++
++
++void Zones::remove(float x, float xm)
++{
++#if !defined GRAPHITE2_NTRACING
++    removeDebug(x, xm);
++#endif
++    x = max(x, _pos);
++    xm = min(xm, _posm);
++    if (x >= xm) return;
++
++    for (iterator i = _exclusions.begin(), ie = _exclusions.end(); i != ie; ++i)
++    {
++        const uint8 oca = i->outcode(x),
++                    ocb = i->outcode(xm);
++        if ((oca & ocb) != 0)   continue;
++
++        switch (oca ^ ocb)  // What kind of overlap?
++        {
++        case 0:     // i completely covers e
++            if (separated(i->x, x))  { i = _exclusions.insert(i,i->split_at(x)); ++i; }
++            GR_FALLTHROUGH;
++            // no break
++        case 1:     // i overlaps on the rhs of e
++            i->left_trim(xm);
++            return;
++        case 2:     // i overlaps on the lhs of e
++            i->xm = x;
++            if (separated(i->x, i->xm)) break;
++            GR_FALLTHROUGH;
++            // no break
++        case 3:     // e completely covers i
++            i = _exclusions.erase(i);
++            --i;
++            break;
++        }
++
++        ie = _exclusions.end();
++    }
++}
++
++
++Zones::const_iterator Zones::find_exclusion_under(float x) const
++{
++    int l = 0, h = _exclusions.size();
++
++    while (l < h)
++    {
++        int const p = (l+h) >> 1;
++        switch (_exclusions[p].outcode(x))
++        {
++        case 0 : return _exclusions.begin()+p;
++        case 1 : h = p; break;
++        case 2 : 
++        case 3 : l = p+1; break;
++        }
++    }
++
++    return _exclusions.begin()+l;
++}
++
++
++float Zones::closest(float origin, float & cost) const
++{
++    float best_c = std::numeric_limits<float>::max(),
++          best_x = 0;
++
++    const const_iterator start = find_exclusion_under(origin);
++
++    // Forward scan looking for lowest cost
++    for (const_iterator i = start, ie = _exclusions.end(); i != ie; ++i)
++        if (i->track_cost(best_c, best_x, origin)) break;
++
++    // Backward scan looking for lowest cost
++    //  We start from the exclusion to the immediate left of start since we've
++    //  already tested start with the right most scan above.
++    for (const_iterator i = start-1, ie = _exclusions.begin()-1; i != ie; --i)
++        if (i->track_cost(best_c, best_x, origin)) break;
++
++    cost = (best_c == std::numeric_limits<float>::max() ? -1 : best_c);
++    return best_x;
++}
++
++
++// Cost and test position functions
++
++bool Zones::Exclusion::track_cost(float & best_cost, float & best_pos, float origin) const {
++    const float p = test_position(origin),
++                localc = cost(p - origin);
++    if (open && localc > best_cost) return true;
++
++    if (localc < best_cost)
++    {
++        best_cost = localc;
++        best_pos = p;
++    }
++    return false;
++}
++
++inline
++float Zones::Exclusion::cost(float p) const {
++    return (sm * p - 2 * smx) * p + c;
++}
++
++
++float Zones::Exclusion::test_position(float origin) const {
++    if (sm < 0)
++    {
++        // sigh, test both ends and perhaps the middle too!
++        float res = x;
++        float cl = cost(x);
++        if (x < origin && xm > origin)
++        {
++            float co = cost(origin);
++            if (co < cl)
++            {
++                cl = co;
++                res = origin;
++            }
++        }
++        float cr = cost(xm);
++        return cl > cr ? xm : res;
++    }
++    else
++    {
++        float zerox = smx / sm + origin;
++        if (zerox < x) return x;
++        else if (zerox > xm) return xm;
++        else return zerox;
++    }
++}
++
++
++#if !defined GRAPHITE2_NTRACING
++
++void Zones::jsonDbgOut(Segment *seg) const {
++
++    if (_dbg)
++    {
++        for (Zones::idebugs s = dbgs_begin(), e = dbgs_end(); s != e; ++s)
++        {
++            *_dbg << json::flat << json::array
++                << objectid(dslot(seg, (Slot *)(s->_env[0])))
++                << reinterpret_cast<ptrdiff_t>(s->_env[1]);
++            if (s->_isdel)
++                *_dbg << "remove" << Position(s->_excl.x, s->_excl.xm);
++            else
++                *_dbg << "exclude" << json::flat << json::array
++                    << s->_excl.x << s->_excl.xm 
++                    << s->_excl.sm << s->_excl.smx << s->_excl.c
++                    << json::close;
++            *_dbg << json::close;
++        }
++    }
++}
++
++#endif
++
+diff --git a/gfx/graphite2/src/Justifier.cpp b/gfx/graphite2/src/Justifier.cpp
+--- a/gfx/graphite2/src/Justifier.cpp
++++ b/gfx/graphite2/src/Justifier.cpp
+@@ -26,17 +26,17 @@ of the License or (at your option) any l
+ */
+ 
+ #include "inc/Segment.h"
+ #include "graphite2/Font.h"
+ #include "inc/debug.h"
+ #include "inc/CharInfo.h"
+ #include "inc/Slot.h"
+ #include "inc/Main.h"
+-#include <math.h>
++#include <cmath>
+ 
+ using namespace graphite2;
+ 
+ class JustifyTotal {
+ public:
+     JustifyTotal() : m_numGlyphs(0), m_tStretch(0), m_tShrink(0), m_tStep(0), m_tWeight(0) {}
+     void accumulate(Slot *s, Segment *seg, int level);
+     int weight() const { return m_tWeight; }
+@@ -55,37 +55,44 @@ void JustifyTotal::accumulate(Slot *s, S
+ {
+     ++m_numGlyphs;
+     m_tStretch += s->getJustify(seg, level, 0);
+     m_tShrink += s->getJustify(seg, level, 1);
+     m_tStep += s->getJustify(seg, level, 2);
+     m_tWeight += s->getJustify(seg, level, 3);
+ }
+ 
+-float Segment::justify(Slot *pSlot, const Font *font, float width, GR_MAYBE_UNUSED justFlags flags, Slot *pFirst, Slot *pLast)
++float Segment::justify(Slot *pSlot, const Font *font, float width, GR_MAYBE_UNUSED justFlags jflags, Slot *pFirst, Slot *pLast)
+ {
+     Slot *s, *end;
+     float currWidth = 0.0;
+     const float scale = font ? font->scale() : 1.0f;
+     Position res;
+ 
+     if (width < 0 && !(silf()->flags()))
+         return width;
+ 
++    if ((m_dir & 1) != m_silf->dir() && m_silf->bidiPass() != m_silf->numPasses())
++    {
++        reverseSlots();
++        s = pFirst;
++        pFirst = pLast;
++        pLast = s;
++    }
+     if (!pFirst) pFirst = pSlot;
+     while (!pFirst->isBase()) pFirst = pFirst->attachedTo();
+     if (!pLast) pLast = last();
+     while (!pLast->isBase()) pLast = pLast->attachedTo();
+     const float base = pFirst->origin().x / scale;
+     width = width / scale;
+-    if ((flags & gr_justEndInline) == 0)
++    if ((jflags & gr_justEndInline) == 0)
+     {
+         do {
+             Rect bbox = theGlyphBBoxTemporary(pLast->glyph());
+-            if (bbox.bl.x != 0. || bbox.bl.y != 0. || bbox.tr.x != 0. || bbox.tr.y == 0.)
++            if (bbox.bl.x != 0.f || bbox.bl.y != 0.f || bbox.tr.x != 0.f || bbox.tr.y == 0.f)
+                 break;
+             pLast = pLast->prev();
+         } while (pLast != pFirst);
+     }
+ 
+     end = pLast->nextSibling();
+     pFirst = pFirst->nextSibling();
+ 
+@@ -111,28 +118,27 @@ float Segment::justify(Slot *pSlot, cons
+                 s->setJustify(this, 0, 3, 1);
+                 s->setJustify(this, 0, 2, 1);
+                 s->setJustify(this, 0, 0, -1);
+             }
+         }
+         ++numLevels;
+     }
+ 
+-    JustifyTotal *stats = new JustifyTotal[numLevels];
+-    if (!stats) return -1.0;
++    Vector<JustifyTotal> stats(numLevels);
+     for (s = pFirst; s != end; s = s->nextSibling())
+     {
+         float w = s->origin().x / scale + s->advance() - base;
+         if (w > currWidth) currWidth = w;
+         for (int j = 0; j < numLevels; ++j)
+             stats[j].accumulate(s, this, j);
+         s->just(0);
+     }
+ 
+-    for (int i = (width < 0.0) ? -1 : numLevels - 1; i >= 0; --i)
++    for (int i = (width < 0.0f) ? -1 : numLevels - 1; i >= 0; --i)
+     {
+         float diff;
+         float error = 0.;
+         float diffpw;
+         int tWeight = stats[i].weight();
+ 
+         do {
+             error = 0.;
+@@ -154,29 +160,29 @@ float Segment::justify(Slot *pSlot, cons
+                 }
+                 else
+                 {
+                     float max = uint16(s->getJustify(this, i, 1));
+                     if (i == 0) max += s->just();
+                     if (-pref > max) pref = -max;
+                     else tWeight += w;
+                 }
+-                int actual = step ? int(pref / step) * step : int(pref);
++                int actual = int(pref / step) * step;
+ 
+                 if (actual)
+                 {
+                     error += diffpw * w - actual;
+                     if (i == 0)
+                         s->just(s->just() + actual);
+                     else
+                         s->setJustify(this, i, 4, actual);
+                 }
+             }
+             currWidth += diff - error;
+-        } while (i == 0 && int(abs(error)) > 0 && tWeight);
++        } while (i == 0 && int(std::abs(error)) > 0 && tWeight);
+     }
+ 
+     Slot *oldFirst = m_first;
+     Slot *oldLast = m_last;
+     if (silf()->flags() & 1)
+     {
+         m_first = pSlot = addLineEnd(pSlot);
+         m_last = pLast = addLineEnd(end);
+@@ -192,41 +198,44 @@ float Segment::justify(Slot *pSlot, cons
+ #if !defined GRAPHITE2_NTRACING
+     json * const dbgout = m_face->logger();
+     if (dbgout)
+         *dbgout << json::object
+                     << "justifies"  << objectid(this)
+                     << "passes"     << json::array;
+ #endif
+ 
+-    if (m_silf->justificationPass() != m_silf->positionPass() && (width >= 0. || (silf()->flags() & 1)))
++    if (m_silf->justificationPass() != m_silf->positionPass() && (width >= 0.f || (silf()->flags() & 1)))
+         m_silf->runGraphite(this, m_silf->justificationPass(), m_silf->positionPass());
+ 
+ #if !defined GRAPHITE2_NTRACING
+     if (dbgout)
+     {
+         *dbgout     << json::item << json::close; // Close up the passes array
+-        positionSlots(NULL, pSlot, pLast);
++        positionSlots(NULL, pSlot, pLast, m_dir);
+         Slot *lEnd = pLast->nextSibling();
+         *dbgout << "output" << json::array;
+         for(Slot * t = pSlot; t != lEnd; t = t->next())
+             *dbgout     << dslot(this, t);
+         *dbgout         << json::close << json::close;
+     }
+ #endif
+ 
+-    res = positionSlots(font, pSlot, pLast);
++    res = positionSlots(font, pSlot, pLast, m_dir);
+ 
+     if (silf()->flags() & 1)
+     {
+         delLineEnd(m_first);
+         delLineEnd(m_last);
+     }
+     m_first = oldFirst;
+     m_last = oldLast;
++
++    if ((m_dir & 1) != m_silf->dir() && m_silf->bidiPass() != m_silf->numPasses())
++        reverseSlots();
+     return res.x;
+ }
+ 
+ Slot *Segment::addLineEnd(Slot *nSlot)
+ {
+     Slot *eSlot = newSlot();
+     if (!eSlot) return NULL;
+     const uint16 gid = silf()->endLineGlyphid();
+diff --git a/gfx/graphite2/src/Pass.cpp b/gfx/graphite2/src/Pass.cpp
+--- a/gfx/graphite2/src/Pass.cpp
++++ b/gfx/graphite2/src/Pass.cpp
+@@ -26,91 +26,120 @@ of the License or (at your option) any l
+ */
+ #include "inc/Main.h"
+ #include "inc/debug.h"
+ #include "inc/Endian.h"
+ #include "inc/Pass.h"
+ #include <cstring>
+ #include <cstdlib>
+ #include <cassert>
++#include <cmath>
+ #include "inc/Segment.h"
+ #include "inc/Code.h"
+ #include "inc/Rule.h"
+ #include "inc/Error.h"
++#include "inc/Collider.h"
+ 
+ using namespace graphite2;
+ using vm::Machine;
+ typedef Machine::Code  Code;
+ 
++enum KernCollison
++{
++    None       = 0,
++    CrossSpace = 1,
++    InWord     = 2,
++    reserved   = 3
++};
+ 
+ Pass::Pass()
+ : m_silf(0),
+   m_cols(0),
+   m_rules(0),
+   m_ruleMap(0),
+   m_startStates(0),
+   m_transitions(0),
+   m_states(0),
+-  m_flags(0),
++  m_codes(0),
++  m_progs(0),
++  m_numCollRuns(0),
++  m_kernColls(0),
+   m_iMaxLoop(0),
+   m_numGlyphs(0),
+   m_numRules(0),
+   m_numStates(0),
+   m_numTransition(0),
+   m_numSuccess(0),
++  m_successStart(0),
+   m_numColumns(0),
+   m_minPreCtxt(0),
+-  m_maxPreCtxt(0)
++  m_maxPreCtxt(0),
++  m_colThreshold(0),
++  m_isReverseDir(false)
+ {
+ }
+ 
+ Pass::~Pass()
+ {
+     free(m_cols);
+     free(m_startStates);
+     free(m_transitions);
+     free(m_states);
+     free(m_ruleMap);
+ 
+-    delete [] m_rules;
++    if (m_rules) delete [] m_rules;
++    if (m_codes) delete [] m_codes;
++    free(m_progs);
+ }
+ 
+-bool Pass::readPass(const byte * const pass_start, size_t pass_length, size_t subtable_base, GR_MAYBE_UNUSED Face & face, Error &e)
++bool Pass::readPass(const byte * const pass_start, size_t pass_length, size_t subtable_base,
++        GR_MAYBE_UNUSED Face & face, passtype pt, GR_MAYBE_UNUSED uint32 version, Error &e)
+ {
+-    const byte *                p = pass_start,
+-               * const pass_end   = p + pass_length;
++    const byte * p              = pass_start,
++               * const pass_end = p + pass_length;
+     size_t numRanges;
+ 
+     if (e.test(pass_length < 40, E_BADPASSLENGTH)) return face.error(e); 
+     // Read in basic values
+-    m_flags = be::read<byte>(p);
++    const byte flags = be::read<byte>(p);
++    if (e.test((flags & 0x1f) && 
++            (pt < PASS_TYPE_POSITIONING || !m_silf->aCollision() || !face.glyphs().hasBoxes()),
++            E_BADCOLLISIONPASS))
++        return face.error(e);
++    m_numCollRuns = flags & 0x7;
++    m_kernColls   = (flags >> 3) & 0x3;
++    m_isReverseDir = (flags >> 5) & 0x1;
+     m_iMaxLoop = be::read<byte>(p);
++    if (m_iMaxLoop < 1) m_iMaxLoop = 1;
+     be::skip<byte>(p,2); // skip maxContext & maxBackup
+     m_numRules = be::read<uint16>(p);
++    if (e.test(!m_numRules && m_numCollRuns == 0, E_BADEMPTYPASS)) return face.error(e);
+     be::skip<uint16>(p);   // fsmOffset - not sure why we would want this
+     const byte * const pcCode = pass_start + be::read<uint32>(p) - subtable_base,
+                * const rcCode = pass_start + be::read<uint32>(p) - subtable_base,
+                * const aCode  = pass_start + be::read<uint32>(p) - subtable_base;
+     be::skip<uint32>(p);
+     m_numStates = be::read<uint16>(p);
+     m_numTransition = be::read<uint16>(p);
+     m_numSuccess = be::read<uint16>(p);
+     m_numColumns = be::read<uint16>(p);
+     numRanges = be::read<uint16>(p);
+     be::skip<uint16>(p, 3); // skip searchRange, entrySelector & rangeShift.
+     assert(p - pass_start == 40);
+     // Perform some sanity checks.
+     if ( e.test(m_numTransition > m_numStates, E_BADNUMTRANS)
+             || e.test(m_numSuccess > m_numStates, E_BADNUMSUCCESS)
+             || e.test(m_numSuccess + m_numTransition < m_numStates, E_BADNUMSTATES)
+-            || e.test(numRanges == 0, E_NORANGES))
++            || e.test(m_numRules && numRanges == 0, E_NORANGES)
++            || e.test(m_numColumns > 0x7FFF, E_BADNUMCOLUMNS))
+         return face.error(e);
+ 
+     m_successStart = m_numStates - m_numSuccess;
+-    if (e.test(p + numRanges * 6 - 4 > pass_end, E_BADPASSLENGTH)) return face.error(e);
++    // test for beyond end - 1 to account for reading uint16
++    if (e.test(p + numRanges * 6 - 2 > pass_end, E_BADPASSLENGTH)) return face.error(e);
+     m_numGlyphs = be::peek<uint16>(p + numRanges * 6 - 4) + 1;
+     // Calculate the start of various arrays.
+     const byte * const ranges = p;
+     be::skip<uint16>(p, numRanges*3);
+     const byte * const o_rule_map = p;
+     be::skip<uint16>(p, m_numSuccess + 1);
+ 
+     // More sanity checks
+@@ -126,108 +155,141 @@ bool Pass::readPass(const byte * const p
+     m_maxPreCtxt = be::read<uint8>(p);
+     if (e.test(m_minPreCtxt > m_maxPreCtxt, E_BADCTXTLENBOUNDS)) return face.error(e);
+     const byte * const start_states = p;
+     be::skip<int16>(p, m_maxPreCtxt - m_minPreCtxt + 1);
+     const uint16 * const sort_keys = reinterpret_cast<const uint16 *>(p);
+     be::skip<uint16>(p, m_numRules);
+     const byte * const precontext = p;
+     be::skip<byte>(p, m_numRules);
+-    be::skip<byte>(p);     // skip reserved byte
+ 
+-    if (e.test(p + sizeof(uint16) > pass_end, E_BADCTXTLENS)) return face.error(e);
++    if (e.test(p + sizeof(uint16) + sizeof(uint8) > pass_end, E_BADCTXTLENS)) return face.error(e);
++    m_colThreshold = be::read<uint8>(p);
++    if (m_colThreshold == 0) m_colThreshold = 10;       // A default
+     const size_t pass_constraint_len = be::read<uint16>(p);
++
+     const uint16 * const o_constraint = reinterpret_cast<const uint16 *>(p);
+     be::skip<uint16>(p, m_numRules + 1);
+     const uint16 * const o_actions = reinterpret_cast<const uint16 *>(p);
+     be::skip<uint16>(p, m_numRules + 1);
+     const byte * const states = p;
++    if (e.test(p + 2u*m_numTransition*m_numColumns >= pass_end, E_BADPASSLENGTH)) return face.error(e);
+     be::skip<int16>(p, m_numTransition*m_numColumns);
+-    be::skip<byte>(p);          // skip reserved byte
+-    if (e.test(p != pcCode, E_BADPASSCCODEPTR) || e.test(p >= pass_end, E_BADPASSLENGTH)) return face.error(e);
++    be::skip<uint8>(p);
++    if (e.test(p != pcCode, E_BADPASSCCODEPTR)) return face.error(e);
+     be::skip<byte>(p, pass_constraint_len);
+-    if (e.test(p != rcCode, E_BADRULECCODEPTR) || e.test(p >= pass_end, E_BADPASSLENGTH)
++    if (e.test(p != rcCode, E_BADRULECCODEPTR)
+         || e.test(size_t(rcCode - pcCode) != pass_constraint_len, E_BADCCODELEN)) return face.error(e);
+     be::skip<byte>(p, be::peek<uint16>(o_constraint + m_numRules));
+-    if (e.test(p != aCode, E_BADACTIONCODEPTR) || e.test(p >= pass_end, E_BADPASSLENGTH)) return face.error(e);
++    if (e.test(p != aCode, E_BADACTIONCODEPTR)) return face.error(e);
+     be::skip<byte>(p, be::peek<uint16>(o_actions + m_numRules));
+ 
+     // We should be at the end or within the pass
+     if (e.test(p > pass_end, E_BADPASSLENGTH)) return face.error(e);
+ 
+     // Load the pass constraint if there is one.
+     if (pass_constraint_len)
+     {
+         face.error_context(face.error_context() + 1);
+         m_cPConstraint = vm::Machine::Code(true, pcCode, pcCode + pass_constraint_len, 
+-                                  precontext[0], be::peek<uint16>(sort_keys), *m_silf, face);
++                                  precontext[0], be::peek<uint16>(sort_keys), *m_silf, face, PASS_TYPE_UNKNOWN);
+         if (e.test(!m_cPConstraint, E_OUTOFMEM)
+-                || e.test(m_cPConstraint.status(), m_cPConstraint.status() + E_CODEFAILURE))
++                || e.test(!m_cPConstraint, m_cPConstraint.status() + E_CODEFAILURE))
+             return face.error(e);
+         face.error_context(face.error_context() - 1);
+     }
+-    if (!readRanges(ranges, numRanges, e)) return face.error(e);
+-    if (!readRules(rule_map, numEntries,  precontext, sort_keys,
+-                   o_constraint, rcCode, o_actions, aCode, face, e)) return false;
++    if (m_numRules)
++    {
++        if (!readRanges(ranges, numRanges, e)) return face.error(e);
++        if (!readRules(rule_map, numEntries,  precontext, sort_keys,
++                   o_constraint, rcCode, o_actions, aCode, face, pt, e)) return false;
++    }
+ #ifdef GRAPHITE2_TELEMETRY
+     telemetry::category _states_cat(face.tele.states);
+ #endif
+-    return readStates(start_states, states, o_rule_map, face, e);
++    return m_numRules ? readStates(start_states, states, o_rule_map, face, e) : true;
+ }
+ 
+ 
+ bool Pass::readRules(const byte * rule_map, const size_t num_entries,
+                      const byte *precontext, const uint16 * sort_key,
+                      const uint16 * o_constraint, const byte *rc_data,
+                      const uint16 * o_action,     const byte * ac_data,
+-                     Face & face, Error &e)
++                     Face & face, passtype pt, Error &e)
+ {
+     const byte * const ac_data_end = ac_data + be::peek<uint16>(o_action + m_numRules);
+     const byte * const rc_data_end = rc_data + be::peek<uint16>(o_constraint + m_numRules);
+ 
+-    if (e.test(!(m_rules = new Rule [m_numRules]), E_OUTOFMEM)) return face.error(e);
+     precontext += m_numRules;
+     sort_key   += m_numRules;
+     o_constraint += m_numRules;
+     o_action += m_numRules;
+ 
+     // Load rules.
+     const byte * ac_begin = 0, * rc_begin = 0,
+                * ac_end = ac_data + be::peek<uint16>(o_action),
+                * rc_end = rc_data + be::peek<uint16>(o_constraint);
++
++    // Allocate pools
++    m_rules = new Rule [m_numRules];
++    m_codes = new Code [m_numRules*2];
++    const size_t prog_pool_sz = vm::Machine::Code::estimateCodeDataOut(ac_end - ac_data + rc_end - rc_data);
++    m_progs = gralloc<byte>(prog_pool_sz);
++    byte * prog_pool_free = m_progs,
++         * prog_pool_end  = m_progs + prog_pool_sz;
++    if (e.test(!(m_rules && m_codes && m_progs), E_OUTOFMEM)) return face.error(e);
++
+     Rule * r = m_rules + m_numRules - 1;
+     for (size_t n = m_numRules; n; --n, --r, ac_end = ac_begin, rc_end = rc_begin)
+     {
+         face.error_context((face.error_context() & 0xFFFF00) + EC_ARULE + ((n - 1) << 24));
+         r->preContext = *--precontext;
+         r->sort       = be::peek<uint16>(--sort_key);
+ #ifndef NDEBUG
+         r->rule_idx   = n - 1;
+ #endif
+         if (r->sort > 63 || r->preContext >= r->sort || r->preContext > m_maxPreCtxt || r->preContext < m_minPreCtxt)
+             return false;
+         ac_begin      = ac_data + be::peek<uint16>(--o_action);
+         --o_constraint;
+         rc_begin      = be::peek<uint16>(o_constraint) ? rc_data + be::peek<uint16>(o_constraint) : rc_end;
+ 
+         if (ac_begin > ac_end || ac_begin > ac_data_end || ac_end > ac_data_end
+-                || rc_begin > rc_end || rc_begin > rc_data_end || rc_end > rc_data_end)
++                || rc_begin > rc_end || rc_begin > rc_data_end || rc_end > rc_data_end
++                || vm::Machine::Code::estimateCodeDataOut(ac_end - ac_begin + rc_end - rc_begin) > size_t(prog_pool_end - prog_pool_free))
+             return false;
+-        r->action     = new vm::Machine::Code(false, ac_begin, ac_end, r->preContext, r->sort, *m_silf, face);
+-        r->constraint = new vm::Machine::Code(true,  rc_begin, rc_end, r->preContext, r->sort, *m_silf, face);
++        r->action     = new (m_codes+n*2-2) vm::Machine::Code(false, ac_begin, ac_end, r->preContext, r->sort, *m_silf, face, pt, &prog_pool_free);
++        r->constraint = new (m_codes+n*2-1) vm::Machine::Code(true,  rc_begin, rc_end, r->preContext, r->sort, *m_silf, face, pt, &prog_pool_free);
+ 
+         if (e.test(!r->action || !r->constraint, E_OUTOFMEM)
+                 || e.test(r->action->status() != Code::loaded, r->action->status() + E_CODEFAILURE)
+                 || e.test(r->constraint->status() != Code::loaded, r->constraint->status() + E_CODEFAILURE)
+                 || e.test(!r->constraint->immutable(), E_MUTABLECCODE))
+             return face.error(e);
+     }
+ 
++    byte * moved_progs = static_cast<byte *>(realloc(m_progs, prog_pool_free - m_progs));
++    if (e.test(!moved_progs, E_OUTOFMEM))
++    {
++        if (prog_pool_free - m_progs == 0) m_progs = 0;
++        return face.error(e);
++    }
++
++    if (moved_progs != m_progs)
++    {
++        for (Code * c = m_codes, * const ce = c + m_numRules*2; c != ce; ++c)
++        {
++            c->externalProgramMoved(moved_progs - m_progs);
++        }
++        m_progs = moved_progs;
++    }
++
+     // Load the rule entries map
+     face.error_context((face.error_context() & 0xFFFF00) + EC_APASS);
++    //TODO: Coverty: 1315804: FORWARD_NULL
+     RuleEntry * re = m_ruleMap = gralloc<RuleEntry>(num_entries);
+     if (e.test(!re, E_OUTOFMEM)) return face.error(e);
+     for (size_t n = num_entries; n; --n, ++re)
+     {
+         const ptrdiff_t rn = be::read<uint16>(rule_map);
+         if (e.test(rn >= m_numRules, E_BADRULENUM))  return face.error(e);
+         re->rule = m_rules + rn;
+     }
+@@ -320,43 +382,69 @@ bool Pass::readRanges(const byte * range
+ 
+         if (e.test(ci != ci_end, E_BADRANGE))
+             return false;
+     }
+     return true;
+ }
+ 
+ 
+-void Pass::runGraphite(Machine & m, FiniteStateMachine & fsm) const
++bool Pass::runGraphite(vm::Machine & m, FiniteStateMachine & fsm, bool reverse) const
+ {
+     Slot *s = m.slotMap().segment.first();
+-    if (!s || !testPassConstraint(m)) return;
+-    Slot *currHigh = s->next();
++    if (!s || !testPassConstraint(m)) return true;
++    if (reverse)
++    {
++        m.slotMap().segment.reverseSlots();
++        s = m.slotMap().segment.first();
++    }
++    if (m_numRules)
++    {
++        Slot *currHigh = s->next();
+ 
+ #if !defined GRAPHITE2_NTRACING
+-    if (fsm.dbgout)  *fsm.dbgout << "rules" << json::array;
+-    json::closer rules_array_closer(fsm.dbgout);
++        if (fsm.dbgout)  *fsm.dbgout << "rules" << json::array;
++        json::closer rules_array_closer(fsm.dbgout);
+ #endif
+ 
+-    m.slotMap().highwater(currHigh);
+-    int lc = m_iMaxLoop;
+-    do
++        m.slotMap().highwater(currHigh);
++        int lc = m_iMaxLoop;
++        do
++        {
++            findNDoRule(s, m, fsm);
++            if (s && (s == m.slotMap().highwater() || m.slotMap().highpassed() || --lc == 0)) {
++                if (!lc)
++                    s = m.slotMap().highwater();
++                lc = m_iMaxLoop;
++                if (s)
++                    m.slotMap().highwater(s->next());
++            }
++        } while (s);
++    }
++    //TODO: Use enums for flags
++    const bool collisions = m_numCollRuns || m_kernColls;
++
++    if (!collisions || !m.slotMap().segment.hasCollisionInfo())
++        return true;
++
++    if (m_numCollRuns)
+     {
+-        findNDoRule(s, m, fsm);
+-        if (s && (m.slotMap().highpassed() || s == m.slotMap().highwater() || --lc == 0)) {
+-            if (!lc)
+-            {
+-//              if (dbgout) *dbgout << json::item << json::flat << rule_event(-1, s, 1);
+-                s = m.slotMap().highwater();
+-            }
+-            lc = m_iMaxLoop;
+-            if (s)
+-                m.slotMap().highwater(s->next());
++        if (!(m.slotMap().segment.flags() & Segment::SEG_INITCOLLISIONS))
++        {
++            m.slotMap().segment.positionSlots(0, 0, 0, m.slotMap().dir(), true);
++//            m.slotMap().segment.flags(m.slotMap().segment.flags() | Segment::SEG_INITCOLLISIONS);
+         }
+-    } while (s);
++        if (!collisionShift(&m.slotMap().segment, m.slotMap().dir(), fsm.dbgout))
++            return false;
++    }
++    if ((m_kernColls) && !collisionKern(&m.slotMap().segment, m.slotMap().dir(), fsm.dbgout))
++        return false;
++    if (collisions && !collisionFinish(&m.slotMap().segment, fsm.dbgout))
++        return false;
++    return true;
+ }
+ 
+ bool Pass::runFSM(FiniteStateMachine& fsm, Slot * slot) const
+ {
+     fsm.reset(slot, m_maxPreCtxt);
+     if (fsm.slots.context() < m_minPreCtxt)
+         return false;
+ 
+@@ -419,18 +507,18 @@ void Pass::findNDoRule(Slot * & slot, Ma
+         {
+             if (fsm.rules.size() != 0)
+             {
+                 *fsm.dbgout << json::item << json::object;
+                 dumpRuleEventConsidered(fsm, *r);
+                 if (r != re)
+                 {
+                     const int adv = doAction(r->rule->action, slot, m);
+-                    dumpRuleEventOutput(fsm, *r->rule, slot);
+-                    if (r->rule->action->deletes()) fsm.slots.collectGarbage();
++                    dumpRuleEventOutput(fsm, m, *r->rule, slot);
++                    if (r->rule->action->deletes()) fsm.slots.collectGarbage(slot);
+                     adjustSlot(adv, slot, fsm.slots);
+                     *fsm.dbgout << "cursor" << objectid(dslot(&fsm.slots.segment, slot))
+                             << json::close; // Close RuelEvent object
+ 
+                     return;
+                 }
+                 else
+                 {
+@@ -442,47 +530,49 @@ void Pass::findNDoRule(Slot * & slot, Ma
+             }
+         }
+         else
+ #endif
+         {
+             if (r != re)
+             {
+                 const int adv = doAction(r->rule->action, slot, m);
+-                if (r->rule->action->deletes()) fsm.slots.collectGarbage();
++                if (r->rule->action->deletes()) fsm.slots.collectGarbage(slot);
+                 adjustSlot(adv, slot, fsm.slots);
+                 return;
+             }
+         }
+     }
+ 
+     slot = slot->next();
++    return;
+ }
+ 
+ #if !defined GRAPHITE2_NTRACING
+ 
+ void Pass::dumpRuleEventConsidered(const FiniteStateMachine & fsm, const RuleEntry & re) const
+ {
+     *fsm.dbgout << "considered" << json::array;
+     for (const RuleEntry *r = fsm.rules.begin(); r != &re; ++r)
+     {
+-        if (r->rule->preContext > fsm.slots.context())  continue;
+-    *fsm.dbgout << json::flat << json::object
+-                    << "id"     << r->rule - m_rules
++        if (r->rule->preContext > fsm.slots.context())
++            continue;
++        *fsm.dbgout << json::flat << json::object
++                    << "id" << r->rule - m_rules
+                     << "failed" << true
+                     << "input" << json::flat << json::object
+                         << "start" << objectid(dslot(&fsm.slots.segment, input_slot(fsm.slots, -r->rule->preContext)))
+                         << "length" << r->rule->sort
+                         << json::close  // close "input"
+                     << json::close; // close Rule object
+     }
+ }
+ 
+ 
+-void Pass::dumpRuleEventOutput(const FiniteStateMachine & fsm, const Rule & r, Slot * const last_slot) const
++void Pass::dumpRuleEventOutput(const FiniteStateMachine & fsm, Machine & m, const Rule & r, Slot * const last_slot) const
+ {
+     *fsm.dbgout     << json::item << json::flat << json::object
+                         << "id"     << &r - m_rules
+                         << "failed" << false
+                         << "input" << json::flat << json::object
+                             << "start" << objectid(dslot(&fsm.slots.segment, input_slot(fsm.slots, 0)))
+                             << "length" << r.sort - r.preContext
+                             << json::close // close "input"
+@@ -490,17 +580,17 @@ void Pass::dumpRuleEventOutput(const Fin
+                 << json::close // close considered array
+                 << "output" << json::object
+                     << "range" << json::flat << json::object
+                         << "start"  << objectid(dslot(&fsm.slots.segment, input_slot(fsm.slots, 0)))
+                         << "end"    << objectid(dslot(&fsm.slots.segment, last_slot))
+                     << json::close // close "input"
+                     << "slots"  << json::array;
+     const Position rsb_prepos = last_slot ? last_slot->origin() : fsm.slots.segment.advance();
+-    fsm.slots.segment.positionSlots(0);
++    fsm.slots.segment.positionSlots(0, 0, 0, m.slotMap().dir());
+ 
+     for(Slot * slot = output_slot(fsm.slots, 0); slot != last_slot; slot = slot->next())
+         *fsm.dbgout     << dslot(&fsm.slots.segment, slot);
+     *fsm.dbgout         << json::close  // close "slots"
+                     << "postshift"  << (last_slot ? last_slot->origin() : fsm.slots.segment.advance()) - rsb_prepos
+                 << json::close;         // close "output" object
+ 
+ }
+@@ -546,22 +636,26 @@ bool Pass::testConstraint(const Rule & r
+         if (!ret || m.status() != Machine::finished)
+             return false;
+     }
+ 
+     return true;
+ }
+ 
+ 
+-void SlotMap::collectGarbage()
++void SlotMap::collectGarbage(Slot * &aSlot)
+ {
+     for(Slot **s = begin(), *const *const se = end() - 1; s != se; ++s) {
+         Slot *& slot = *s;
+         if(slot->isDeleted() || slot->isCopied())
++        {
++            if (slot == aSlot)
++                aSlot = slot->prev() ? slot->prev() : slot->next();
+             segment.freeSlot(slot);
++        }
+     }
+ }
+ 
+ 
+ 
+ int Pass::doAction(const Code *codeptr, Slot * & slot_out, vm::Machine & m) const
+ {
+     assert(codeptr);
+@@ -581,40 +675,412 @@ int Pass::doAction(const Code *codeptr, 
+ 
+     slot_out = *map;
+     return ret;
+ }
+ 
+ 
+ void Pass::adjustSlot(int delta, Slot * & slot_out, SlotMap & smap) const
+ {
+-    if (delta < 0)
++    if (!slot_out)
+     {
+-        if (!slot_out)
++        if (smap.highpassed() || slot_out == smap.highwater())
+         {
+             slot_out = smap.segment.last();
+             ++delta;
+-            if (smap.highpassed() && !smap.highwater())
++            if (!smap.highwater())
+                 smap.highpassed(false);
+         }
++        else
++        {
++            slot_out = smap.segment.first();
++            --delta;
++        }
++    }
++    if (delta < 0)
++    {
+         while (++delta <= 0 && slot_out)
+         {
+             if (smap.highpassed() && smap.highwater() == slot_out)
+                 smap.highpassed(false);
+             slot_out = slot_out->prev();
+         }
+     }
+     else if (delta > 0)
+     {
+-        if (!slot_out)
+-        {
+-            slot_out = smap.segment.first();
+-            --delta;
+-        }
+         while (--delta >= 0 && slot_out)
+         {
+             slot_out = slot_out->next();
+             if (slot_out == smap.highwater() && slot_out)
+                 smap.highpassed(true);
+         }
+     }
+ }
+ 
++bool Pass::collisionShift(Segment *seg, int dir, json * const dbgout) const
++{
++    ShiftCollider shiftcoll(dbgout);
++    // bool isfirst = true;
++    bool hasCollisions = false;
++    Slot *start = seg->first();      // turn on collision fixing for the first slot
++    Slot *end = NULL;
++    bool moved = false;
++
++#if !defined GRAPHITE2_NTRACING
++    if (dbgout)
++        *dbgout << "collisions" << json::array
++            << json::flat << json::object << "num-loops" << m_numCollRuns << json::close;
++#endif
++
++    while (start)
++    {
++#if !defined GRAPHITE2_NTRACING
++        if (dbgout)  *dbgout << json::object << "phase" << "1" << "moves" << json::array;
++#endif
++        hasCollisions = false;
++        end = NULL;
++        // phase 1 : position shiftable glyphs, ignoring kernable glyphs
++        for (Slot *s = start; s; s = s->next())
++        {
++            const SlotCollision * c = seg->collisionInfo(s);
++            if (start && (c->flags() & (SlotCollision::COLL_FIX | SlotCollision::COLL_KERN)) == SlotCollision::COLL_FIX
++                      && !resolveCollisions(seg, s, start, shiftcoll, false, dir, moved, hasCollisions, dbgout))
++                return false;
++            if (s != start && (c->flags() & SlotCollision::COLL_END))
++            {
++                end = s->next();
++                break;
++            }
++        }
++
++#if !defined GRAPHITE2_NTRACING
++        if (dbgout)
++            *dbgout << json::close << json::close; // phase-1
++#endif
++
++        // phase 2 : loop until happy. 
++        for (int i = 0; i < m_numCollRuns - 1; ++i)
++        {
++            if (hasCollisions || moved)
++            {
++
++#if !defined GRAPHITE2_NTRACING
++                if (dbgout)
++                    *dbgout << json::object << "phase" << "2a" << "loop" << i << "moves" << json::array;
++#endif
++                // phase 2a : if any shiftable glyphs are in collision, iterate backwards,
++                // fixing them and ignoring other non-collided glyphs. Note that this handles ONLY
++                // glyphs that are actually in collision from phases 1 or 2b, and working backwards
++                // has the intended effect of breaking logjams.
++                if (hasCollisions)
++                {
++                    hasCollisions = false;
++                    #if 0
++                    moved = true;
++                    for (Slot *s = start; s != end; s = s->next())
++                    {
++                        SlotCollision * c = seg->collisionInfo(s);
++                        c->setShift(Position(0, 0));
++                    }
++                    #endif
++                    Slot *lend = end ? end->prev() : seg->last();
++                    Slot *lstart = start->prev();
++                    for (Slot *s = lend; s != lstart; s = s->prev())
++                    {
++                        SlotCollision * c = seg->collisionInfo(s);
++                        if (start && (c->flags() & (SlotCollision::COLL_FIX | SlotCollision::COLL_KERN | SlotCollision::COLL_ISCOL))
++                                        == (SlotCollision::COLL_FIX | SlotCollision::COLL_ISCOL)) // ONLY if this glyph is still colliding
++                        {
++                            if (!resolveCollisions(seg, s, lend, shiftcoll, true, dir, moved, hasCollisions, dbgout))
++                                return false;
++                            c->setFlags(c->flags() | SlotCollision::COLL_TEMPLOCK);
++                        }
++                    }
++                }
++
++#if !defined GRAPHITE2_NTRACING
++                if (dbgout)
++                    *dbgout << json::close << json::close // phase 2a
++                        << json::object << "phase" << "2b" << "loop" << i << "moves" << json::array;
++#endif
++
++                // phase 2b : redo basic diacritic positioning pass for ALL glyphs. Each successive loop adjusts 
++                // glyphs from their current adjusted position, which has the effect of gradually minimizing the  
++                // resulting adjustment; ie, the final result will be gradually closer to the original location.  
++                // Also it allows more flexibility in the final adjustment, since it is moving along the  
++                // possible 8 vectors from successively different starting locations.
++                if (moved)
++                {
++                    moved = false;
++                    for (Slot *s = start; s != end; s = s->next())
++                    {
++                        SlotCollision * c = seg->collisionInfo(s);
++                        if (start && (c->flags() & (SlotCollision::COLL_FIX | SlotCollision::COLL_TEMPLOCK
++                                                        | SlotCollision::COLL_KERN)) == SlotCollision::COLL_FIX
++                                  && !resolveCollisions(seg, s, start, shiftcoll, false, dir, moved, hasCollisions, dbgout))
++                            return false;
++                        else if (c->flags() & SlotCollision::COLL_TEMPLOCK)
++                            c->setFlags(c->flags() & ~SlotCollision::COLL_TEMPLOCK);
++                    }
++                }
++        //      if (!hasCollisions) // no, don't leave yet because phase 2b will continue to improve things
++        //          break;
++#if !defined GRAPHITE2_NTRACING
++                if (dbgout)
++                    *dbgout << json::close << json::close; // phase 2
++#endif
++            }
++        }
++        if (!end)
++            break;
++        start = NULL;
++        for (Slot *s = end->prev(); s; s = s->next())
++        {
++            if (seg->collisionInfo(s)->flags() & SlotCollision::COLL_START)
++            {
++                start = s;
++                break;
++            }
++        }
++    }
++    return true;
++}
++
++bool Pass::collisionKern(Segment *seg, int dir, json * const dbgout) const
++{
++    KernCollider kerncoll(dbgout);
++    Slot *start = seg->first();
++    float ymin = 1e38f;
++    float ymax = -1e38f;
++    const GlyphCache &gc = seg->getFace()->glyphs();
++
++    // phase 3 : handle kerning of clusters
++#if !defined GRAPHITE2_NTRACING
++    if (dbgout)
++        *dbgout << json::object << "phase" << "3" << "moves" << json::array;
++#endif
++
++    for (Slot *s = seg->first(); s; s = s->next())
++    {
++        if (!gc.check(s->gid()))
++            return false;
++        const SlotCollision * c = seg->collisionInfo(s);
++        const Rect &bbox = seg->theGlyphBBoxTemporary(s->gid());
++        float y = s->origin().y + c->shift().y;
++        ymax = max(y + bbox.tr.y, ymax);
++        ymin = min(y + bbox.bl.y, ymin);
++        if (start && (c->flags() & (SlotCollision::COLL_KERN | SlotCollision::COLL_FIX))
++                        == (SlotCollision::COLL_KERN | SlotCollision::COLL_FIX))
++            resolveKern(seg, s, start, kerncoll, dir, ymin, ymax, dbgout);
++        if (c->flags() & SlotCollision::COLL_END)
++            start = NULL;
++        if (c->flags() & SlotCollision::COLL_START)
++            start = s;
++    }
++
++#if !defined GRAPHITE2_NTRACING
++    if (dbgout)
++        *dbgout << json::close << json::close; // phase 3
++#endif
++    return true;
++}
++
++bool Pass::collisionFinish(Segment *seg, GR_MAYBE_UNUSED json * const dbgout) const
++{
++    for (Slot *s = seg->first(); s; s = s->next())
++    {
++        SlotCollision *c = seg->collisionInfo(s);
++        if (c->shift().x != 0 || c->shift().y != 0)
++        {
++            const Position newOffset = c->shift();
++            const Position nullPosition(0, 0);
++            c->setOffset(newOffset + c->offset());
++            c->setShift(nullPosition);
++        }
++    }
++//    seg->positionSlots();
++
++#if !defined GRAPHITE2_NTRACING
++        if (dbgout)
++            *dbgout << json::close;
++#endif
++    return true;
++}
++
++// Can slot s be kerned, or is it attached to something that can be kerned?
++static bool inKernCluster(Segment *seg, Slot *s)
++{
++    SlotCollision *c = seg->collisionInfo(s);
++    if (c->flags() & SlotCollision::COLL_KERN /** && c->flags() & SlotCollision::COLL_FIX **/ )
++        return true;
++    while (s->attachedTo())
++    {
++        s = s->attachedTo();
++        c = seg->collisionInfo(s);
++        if (c->flags() & SlotCollision::COLL_KERN /** && c->flags() & SlotCollision::COLL_FIX **/ )
++            return true;
++    }
++    return false;
++}
++
++// Fix collisions for the given slot.
++// Return true if everything was fixed, false if there are still collisions remaining.
++// isRev means be we are processing backwards.
++bool Pass::resolveCollisions(Segment *seg, Slot *slotFix, Slot *start,
++        ShiftCollider &coll, GR_MAYBE_UNUSED bool isRev, int dir, bool &moved, bool &hasCol,
++        json * const dbgout) const
++{
++    Slot * nbor;  // neighboring slot
++    SlotCollision *cFix = seg->collisionInfo(slotFix);
++    if (!coll.initSlot(seg, slotFix, cFix->limit(), cFix->margin(), cFix->marginWt(),
++            cFix->shift(), cFix->offset(), dir, dbgout))
++        return false;
++    bool collides = false;
++    // When we're processing forward, ignore kernable glyphs that preceed the target glyph.
++    // When processing backward, don't ignore these until we pass slotFix.
++    bool ignoreForKern = !isRev;
++    bool rtl = dir & 1;
++    Slot *base = slotFix;
++    while (base->attachedTo())
++        base = base->attachedTo();
++    Position zero(0., 0.);
++    
++    // Look for collisions with the neighboring glyphs.
++    for (nbor = start; nbor; nbor = isRev ? nbor->prev() : nbor->next())
++    {
++        SlotCollision *cNbor = seg->collisionInfo(nbor);
++        bool sameCluster = nbor->isChildOf(base);
++        if (nbor != slotFix         // don't process if this is the slot of interest
++                      && !(cNbor->flags() & SlotCollision::COLL_IGNORE)    // don't process if ignoring
++                      && (nbor == base || sameCluster       // process if in the same cluster as slotFix
++                            || !inKernCluster(seg, nbor)    // or this cluster is not to be kerned
++                            || (rtl ^ ignoreForKern))       // or it comes before(ltr) or after(rtl)
++                      && (!isRev    // if processing forwards then good to merge otherwise only:
++                            || !(cNbor->flags() & SlotCollision::COLL_FIX)     // merge in immovable stuff
++                            || ((cNbor->flags() & SlotCollision::COLL_KERN) && !sameCluster)     // ignore other kernable clusters
++                            || (cNbor->flags() & SlotCollision::COLL_ISCOL))   // test against other collided glyphs
++                      && !coll.mergeSlot(seg, nbor, cNbor->shift(), !ignoreForKern, sameCluster, collides, false, dbgout))
++            return false;
++        else if (nbor == slotFix)
++            // Switching sides of this glyph - if we were ignoring kernable stuff before, don't anymore.
++            ignoreForKern = !ignoreForKern;
++            
++        if (nbor != start && (cNbor->flags() & (isRev ? SlotCollision::COLL_START : SlotCollision::COLL_END)))
++            break;
++    }
++    bool isCol = false;
++    if (collides || cFix->shift().x != 0.f || cFix->shift().y != 0.f)
++    {
++        Position shift = coll.resolve(seg, isCol, dbgout);
++        // isCol has been set to true if a collision remains.
++        if (std::fabs(shift.x) < 1e38f && std::fabs(shift.y) < 1e38f)
++        {
++            if (sqr(shift.x-cFix->shift().x) + sqr(shift.y-cFix->shift().y) >= m_colThreshold * m_colThreshold)
++                moved = true;
++            cFix->setShift(shift);
++            if (slotFix->firstChild())
++            {
++                Rect bbox;
++                Position here = slotFix->origin() + shift;
++                float clusterMin = here.x;
++                slotFix->firstChild()->finalise(seg, NULL, here, bbox, 0, clusterMin, rtl, false);
++            }
++        }
++    }
++    else
++    {
++        // This glyph is not colliding with anything.
++#if !defined GRAPHITE2_NTRACING
++        if (dbgout)
++        {
++            *dbgout << json::object 
++                            << "missed" << objectid(dslot(seg, slotFix));
++            coll.outputJsonDbg(dbgout, seg, -1);
++            *dbgout << json::close;
++        }
++#endif
++    }
++
++    // Set the is-collision flag bit.
++    if (isCol)
++    { cFix->setFlags(cFix->flags() | SlotCollision::COLL_ISCOL | SlotCollision::COLL_KNOWN); }
++    else
++    { cFix->setFlags((cFix->flags() & ~SlotCollision::COLL_ISCOL) | SlotCollision::COLL_KNOWN); }
++    hasCol |= isCol;
++    return true;
++}
++
++float Pass::resolveKern(Segment *seg, Slot *slotFix, GR_MAYBE_UNUSED Slot *start, KernCollider &coll, int dir,
++    float &ymin, float &ymax, json *const dbgout) const
++{
++    Slot *nbor; // neighboring slot
++    float currSpace = 0.;
++    bool collides = false;
++    unsigned int space_count = 0;
++    Slot *base = slotFix;
++    while (base->attachedTo())
++        base = base->attachedTo();
++    SlotCollision *cFix = seg->collisionInfo(base);
++    const GlyphCache &gc = seg->getFace()->glyphs();
++
++    if (base != slotFix)
++    {
++        cFix->setFlags(cFix->flags() | SlotCollision::COLL_KERN | SlotCollision::COLL_FIX);
++        return 0;
++    }
++    bool seenEnd = (cFix->flags() & SlotCollision::COLL_END) != 0;
++    bool isInit = false;
++
++    for (nbor = slotFix->next(); nbor; nbor = nbor->next())
++    {
++        if (nbor->isChildOf(base))
++            continue;
++        if (!gc.check(nbor->gid()))
++            return 0.;
++        const Rect &bb = seg->theGlyphBBoxTemporary(nbor->gid());
++        SlotCollision *cNbor = seg->collisionInfo(nbor);
++        if (bb.bl.y == 0.f && bb.tr.y == 0.f)
++        {
++            if (m_kernColls == InWord)
++                break;
++            // Add space for a space glyph.
++            currSpace += nbor->advance();
++            ++space_count;
++        }
++        else
++        {
++            space_count = 0; 
++            float y = nbor->origin().y + cNbor->shift().y;
++            ymax = max(y + bb.tr.y, ymax);
++            ymin = min(y + bb.bl.y, ymin);
++            if (nbor != slotFix && !(cNbor->flags() & SlotCollision::COLL_IGNORE))
++            {
++                seenEnd = true;
++                if (!isInit)
++                {
++                    if (!coll.initSlot(seg, slotFix, cFix->limit(), cFix->margin(),
++                                    cFix->shift(), cFix->offset(), dir, ymin, ymax, dbgout))
++                        return 0.;
++                    isInit = true;
++                }
++                collides |= coll.mergeSlot(seg, nbor, cNbor->shift(), currSpace, dir, dbgout);
++            }
++        }
++        if (cNbor->flags() & SlotCollision::COLL_END)
++        {
++            if (seenEnd && space_count < 2)
++                break;
++            else
++                seenEnd = true;
++        }
++    }
++    if (collides)
++    {
++        Position mv = coll.resolve(seg, slotFix, dir, cFix->margin(), dbgout);
++        coll.shift(mv, dir);
++        Position delta = slotFix->advancePos() + mv - cFix->shift();
++        slotFix->advance(delta);
++        cFix->setShift(mv);
++        return mv.x;
++    }
++    return 0.;
++}
++
+diff --git a/gfx/graphite2/src/Position.cpp b/gfx/graphite2/src/Position.cpp
+new file mode 100644
+--- /dev/null
++++ b/gfx/graphite2/src/Position.cpp
+@@ -0,0 +1,98 @@
++/*  GRAPHITE2 LICENSING
++
++    Copyright 2010, SIL International
++    All rights reserved.
++
++    This library is free software; you can redistribute it and/or modify
++    it under the terms of the GNU Lesser General Public License as published
++    by the Free Software Foundation; either version 2.1 of License, or
++    (at your option) any later version.
++
++    This program is distributed in the hope that it will be useful,
++    but WITHOUT ANY WARRANTY; without even the implied warranty of
++    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++    Lesser General Public License for more details.
++
++    You should also have received a copy of the GNU Lesser General Public
++    License along with this library in the file named "LICENSE".
++    If not, write to the Free Software Foundation, 51 Franklin Street, 
++    Suite 500, Boston, MA 02110-1335, USA or visit their web page on the 
++    internet at http://www.fsf.org/licenses/lgpl.html.
++
++Alternatively, the contents of this file may be used under the terms of the
++Mozilla Public License (http://mozilla.org/MPL) or the GNU General Public
++License, as published by the Free Software Foundation, either version 2
++of the License or (at your option) any later version.
++*/
++#include "inc/Position.h"
++#include <cmath>
++
++using namespace graphite2;
++
++bool Rect::hitTest(Rect &other)
++{
++    if (bl.x > other.tr.x) return false;
++    if (tr.x < other.bl.x) return false;
++    if (bl.y > other.tr.y) return false;
++    if (tr.y < other.bl.y) return false;
++    return true;
++}
++
++Position Rect::overlap(Position &offset, Rect &other, Position &othero)
++{
++    float ax = (bl.x + offset.x) - (other.tr.x + othero.x);
++    float ay = (bl.y + offset.y) - (other.tr.y + othero.y);
++    float bx = (other.bl.x + othero.x) - (tr.x + offset.x);
++    float by = (other.bl.y + othero.y) - (tr.y + offset.y);
++    return Position((ax > bx ? ax : bx), (ay > by ? ay : by));
++}
++
++float boundmin(float move, float lim1, float lim2, float &error)
++{
++    // error is always positive for easy comparison
++    if (move < lim1 && move < lim2)
++    { error = 0.; return move; }
++    else if (lim1 < lim2)
++    { error = std::fabs(move - lim1); return lim1; }
++    else
++    { error = std::fabs(move - lim2); return lim2; }
++}
++
++#if 0
++Position Rect::constrainedAvoid(Position &offset, Rect &box, Rect &sdbox, Position &other, Rect &obox, Rect &osdbox)
++{
++    // a = max, i = min, s = sum, d = diff
++    float eax, eay, eix, eiy, eas, eis, ead, eid;
++    float beste = INF;
++    Position res;
++    // calculate the movements in each direction and the error (amount of remaining overlap)
++    // first param is movement, second and third are movement over the constraining box
++    float ax = boundmin(obox.tr.x + other.x - box.bl.x - offset.x + 1, tr.x - offset.x, INF, &eax);
++    float ay = boundmin(obox.tr.y + other.y - box.bl.y - offset.y + 1, tr.y - offset.y, INF, &eay);
++    float ix = boundmin(obox.bl.x + other.x - box.tr.x - offset.x + 1, bl.x - offset.x, INF, &eix);
++    float iy = boundmin(obox.bl.y + other.y - box.tr.y - offset.y + 1, bl.y - offset.y, INF, &eiy);
++    float as = boundmin(ISQRT2 * (osdbox.tr.x + other.x + other.y - sdbox.bl.x - offset.x - offset.y) + 1, tr.x - offset.x, tr.y - offset.y, &eas);
++    float is = boundmin(ISQRT2 * (osdbox.bl.x + other.x + other.y - sdbox.tr.x - offset.x - offset.y) + 1, bl.x - offset.x, bl.y - offset.y, &eis);
++    float ad = boundmin(ISQRT2 * (osdbox.tr.y + other.x - other.y - sdbox.bl.y - offset.x + offset.y) + 1, tr.y - offset.y, tr.x - offset.x, &ead);
++    float id = boundmin(ISQRT2 * (osdbox.bl.y + other.x - other.y - sdbox.tr.y - offset.x + offset.y) + 1, bl.y - offset.y, bl.x - offset.x, &eid);
++
++    if (eax < beste)
++    { res = Position(ax, 0); beste = eax; }
++    if (eay < beste)
++    { res = Position(0, ay); beste = eay; }
++    if (eix < beste)
++    { res = Position(ix, 0); beste = eix; }
++    if (eiy < beste)
++    { res = Position(0, iy); beste = eiy; }
++    if (SQRT2 * (eas) < beste)
++    { res = Position(as, ad); beste = SQRT2 * (eas); }
++    if (SQRT2 * (eis) < beste)
++    { res = Position(is, is); beste = SQRT2 * (eis); }
++    if (SQRT2 * (ead) < beste)
++    { res = Position(ad, ad); beste = SQRT2 * (ead); }
++    if (SQRT2 * (eid) < beste)
++    { res = Position(id, id); beste = SQRT2 * (eid); }
++    return res;
++}
++#endif
++
+diff --git a/gfx/graphite2/src/SegCache.cpp b/gfx/graphite2/src/SegCache.cpp
+--- a/gfx/graphite2/src/SegCache.cpp
++++ b/gfx/graphite2/src/SegCache.cpp
+@@ -35,17 +35,17 @@ of the License or (at your option) any l
+ 
+ 
+ using namespace graphite2;
+ 
+ #ifndef GRAPHITE2_NSEGCACHE
+ 
+ SegCache::SegCache(const SegCacheStore * store, const Features & feats)
+ : m_prefixLength(ePrefixLength),
+-  m_maxCachedSegLength(eMaxSpliceSize),
++//  m_maxCachedSegLength(eMaxSpliceSize),
+   m_segmentCount(0),
+   m_features(feats),
+   m_totalAccessCount(0l), m_totalMisses(0l),
+   m_purgeFactor(1.0f / (ePurgeFactor * store->maxSegmentCount()))
+ {
+     m_prefixes.raw = grzeroalloc<void*>(store->maxCmapGid() + 2);
+     m_prefixes.range[SEG_CACHE_MIN_INDEX] = SEG_CACHE_UNSET_INDEX;
+     m_prefixes.range[SEG_CACHE_MAX_INDEX] = SEG_CACHE_UNSET_INDEX;
+@@ -79,17 +79,17 @@ SegCache::~SegCache()
+ {
+     assert(m_prefixes.raw == NULL);
+ }
+ 
+ SegCacheEntry* SegCache::cache(SegCacheStore * store, const uint16* cmapGlyphs, size_t length, Segment * seg, size_t charOffset)
+ {
+     uint16 pos = 0;
+     if (!length) return NULL;
+-    assert(length < m_maxCachedSegLength);
++//    assert(length < m_maxCachedSegLength);
+     SegCachePrefixArray pArray = m_prefixes;
+     while (pos + 1 < m_prefixLength)
+     {
+         uint16 gid = (pos < length)? cmapGlyphs[pos] : 0;
+         if (!pArray.array[gid].raw)
+         {
+             pArray.array[gid].raw = grzeroalloc<void*>(store->maxCmapGid() + 2);
+             if (!pArray.array[gid].raw)
+diff --git a/gfx/graphite2/src/Segment.cpp b/gfx/graphite2/src/Segment.cpp
+--- a/gfx/graphite2/src/Segment.cpp
++++ b/gfx/graphite2/src/Segment.cpp
+@@ -31,48 +31,53 @@ of the License or (at your option) any l
+ #include "inc/bits.h"
+ #include "inc/Segment.h"
+ #include "graphite2/Font.h"
+ #include "inc/CharInfo.h"
+ #include "inc/debug.h"
+ #include "inc/Slot.h"
+ #include "inc/Main.h"
+ #include "inc/CmapCache.h"
+-#include "inc/Bidi.h"
++#include "inc/Collider.h"
+ #include "graphite2/Segment.h"
+ 
+ 
+ using namespace graphite2;
+ 
+ Segment::Segment(unsigned int numchars, const Face* face, uint32 script, int textDir)
+ : m_freeSlots(NULL),
+   m_freeJustifies(NULL),
+   m_charinfo(new CharInfo[numchars]),
++  m_collisions(NULL),
+   m_face(face),
+   m_silf(face->chooseSilf(script)),
+   m_first(NULL),
+   m_last(NULL),
+   m_bufSize(numchars + 10),
+   m_numGlyphs(numchars),
+   m_numCharinfo(numchars),
+   m_passBits(m_silf->aPassBits() ? -1 : 0),
+   m_defaultOriginal(0),
+-  m_dir(textDir)
++  m_dir(textDir),
++  m_flags(((m_silf->flags() & 0x20) != 0) << 1)
+ {
+     freeSlot(newSlot());
+     m_bufSize = log_binary(numchars)+1;
+ }
+ 
+ Segment::~Segment()
+ {
+     for (SlotRope::iterator i = m_slots.begin(); i != m_slots.end(); ++i)
+         free(*i);
+-    for (AttributeRope::iterator j = m_userAttrs.begin(); j != m_userAttrs.end(); ++j)
+-        free(*j);
++    for (AttributeRope::iterator i = m_userAttrs.begin(); i != m_userAttrs.end(); ++i)
++        free(*i);
++    for (JustifyRope::iterator i = m_justifies.begin(); i != m_justifies.end(); ++i)
++        free(*i);
+     delete[] m_charinfo;
++    free(m_collisions);
+ }
+ 
+ #ifndef GRAPHITE2_NSEGCACHE
+ SegmentScopeState Segment::setScope(Slot * firstSlot, Slot * lastSlot, size_t subLength)
+ {
+     SegmentScopeState state;
+     state.numGlyphsOutsideScope = m_numGlyphs - subLength;
+     state.realFirstSlot = m_first;
+@@ -159,28 +164,35 @@ void Segment::appendSlot(int id, int cid
+         m_passBits &= theGlyph->attrs()[m_silf->aPassBits()] 
+                     | (m_silf->numPasses() > 16 ? (theGlyph->attrs()[m_silf->aPassBits() + 1] << 16) : 0);
+ }
+ 
+ Slot *Segment::newSlot()
+ {
+     if (!m_freeSlots)
+     {
++        // check that the segment doesn't grow indefinintely
++        if (m_numGlyphs > m_numCharinfo * MAX_SEG_GROWTH_FACTOR)
++            return NULL;
+         int numUser = m_silf->numUser();
+ #if !defined GRAPHITE2_NTRACING
+         if (m_face->logger()) ++numUser;
+ #endif
+         Slot *newSlots = grzeroalloc<Slot>(m_bufSize);
+-        int16 *newAttrs = grzeroalloc<int16>(numUser * m_bufSize);
+-        if (!newSlots || !newAttrs) return NULL;
++        int16 *newAttrs = grzeroalloc<int16>(m_bufSize * numUser);
++        if (!newSlots || !newAttrs)
++        {
++            free(newSlots);
++            free(newAttrs);
++            return NULL;
++        }
+         for (size_t i = 0; i < m_bufSize; i++)
+         {
++            ::new (newSlots + i) Slot(newAttrs + i * numUser);
+             newSlots[i].next(newSlots + i + 1);
+-            newSlots[i].userAttrs(newAttrs + i * numUser);
+-            newSlots[i].setBidiClass(-1);
+         }
+         newSlots[m_bufSize - 1].next(NULL);
+         newSlots[0].next(NULL);
+         m_slots.push_back(newSlots);
+         m_userAttrs.push_back(newAttrs);
+         m_freeSlots = (m_bufSize > 1)? newSlots + 1 : NULL;
+         return newSlots;
+     }
+@@ -197,17 +209,17 @@ void Segment::freeSlot(Slot *aSlot)
+     if (aSlot->attachedTo())
+         aSlot->attachedTo()->removeChild(aSlot);
+     while (aSlot->firstChild())
+     {
+         aSlot->firstChild()->attachTo(NULL);
+         aSlot->removeChild(aSlot->firstChild());
+     }
+     // reset the slot incase it is reused
+-    ::new (aSlot) Slot;
++    ::new (aSlot) Slot(aSlot->userAttrs());
+     memset(aSlot->userAttrs(), 0, m_silf->numUser() * sizeof(int16));
+     // Update generation counter for debug
+ #if !defined GRAPHITE2_NTRACING
+     if (m_face->logger())
+         ++aSlot->userAttrs()[m_silf->numUser()];
+ #endif
+     // update next pointer
+     if (!m_freeSlots)
+@@ -301,16 +313,71 @@ void Segment::splice(size_t offset, size
+         slot->set(*srcSlot, offset, m_silf->numUser(), m_silf->numJustLevels(), numChars);
+         if (srcSlot->attachedTo())  slot->attachTo(indexmap[srcSlot->attachedTo()->index()]);
+         if (srcSlot->nextSibling()) slot->m_sibling = indexmap[srcSlot->nextSibling()->index()];
+         if (srcSlot->firstChild())  slot->m_child = indexmap[srcSlot->firstChild()->index()];
+     }
+ }
+ #endif // GRAPHITE2_NSEGCACHE
+ 
++// reverse the slots but keep diacritics in their same position after their bases
++void Segment::reverseSlots()
++{
++    m_dir = m_dir ^ 64;                 // invert the reverse flag
++    if (m_first == m_last) return;      // skip 0 or 1 glyph runs
++
++    Slot *t = 0;
++    Slot *curr = m_first;
++    Slot *tlast;
++    Slot *tfirst;
++    Slot *out = 0;
++
++    while (curr && getSlotBidiClass(curr) == 16)
++        curr = curr->next();
++    if (!curr) return;
++    tfirst = curr->prev();
++    tlast = curr;
++
++    while (curr)
++    {
++        if (getSlotBidiClass(curr) == 16)
++        {
++            Slot *d = curr->next();
++            while (d && getSlotBidiClass(d) == 16)
++                d = d->next();
++
++            d = d ? d->prev() : m_last;
++            Slot *p = out->next();    // one after the diacritics. out can't be null
++            if (p)
++                p->prev(d);
++            else
++                tlast = d;
++            t = d->next();
++            d->next(p);
++            curr->prev(out);
++            out->next(curr);
++        }
++        else    // will always fire first time round the loop
++        {
++            if (out)
++                out->prev(curr);
++            t = curr->next();
++            curr->next(out);
++            out = curr;
++        }
++        curr = t;
++    }
++    out->prev(tfirst);
++    if (tfirst)
++        tfirst->next(out);
++    else
++        m_first = out;
++    m_last = tlast;
++}
++
+ void Segment::linkClusters(Slot *s, Slot * end)
+ {
+     end = end->next();
+ 
+     for (; s != end && !s->isBase(); s = s->next());
+     Slot * ls = s;
+ 
+     if (m_dir & 1)
+@@ -330,39 +397,47 @@ void Segment::linkClusters(Slot *s, Slot
+             if (!s->isBase())   continue;
+ 
+             ls->sibling(s);
+             ls = s;
+         }
+     }
+ }
+ 
+-Position Segment::positionSlots(const Font *font, Slot * iStart, Slot * iEnd)
++Position Segment::positionSlots(const Font *font, Slot * iStart, Slot * iEnd, bool isRtl, bool isFinal)
+ {
+     Position currpos(0., 0.);
+     float clusterMin = 0.;
+     Rect bbox;
+ 
++    if (currdir() != isRtl)
++    {
++        Slot *temp;
++        reverseSlots();
++        temp = iStart;
++        iStart = iEnd;
++        iEnd = temp;
++    }
+     if (!iStart)    iStart = m_first;
+     if (!iEnd)      iEnd   = m_last;
+ 
+-    if (m_dir & 1)
++    if (isRtl)
+     {
+         for (Slot * s = iEnd, * const end = iStart->prev(); s && s != end; s = s->prev())
+         {
+             if (s->isBase())
+-                currpos = s->finalise(this, font, currpos, bbox, 0, clusterMin = currpos.x);
++                currpos = s->finalise(this, font, currpos, bbox, 0, clusterMin = currpos.x, isRtl, isFinal);
+         }
+     }
+     else
+     {
+         for (Slot * s = iStart, * const end = iEnd->next(); s && s != end; s = s->next())
+         {
+             if (s->isBase())
+-                currpos = s->finalise(this, font, currpos, bbox, 0, clusterMin = currpos.x);
++                currpos = s->finalise(this, font, currpos, bbox, 0, clusterMin = currpos.x, isRtl, isFinal);
+         }
+     }
+     return currpos;
+ }
+ 
+ 
+ void Segment::associateChars(int offset, int numChars)
+ {
+@@ -429,66 +504,28 @@ bool Segment::read_text(const Face *face
+     {
+     case gr_utf8:   process_utf_data(*this, *face, addFeatures(*pFeats), utf8::const_iterator(pStart), nChars); break;
+     case gr_utf16:  process_utf_data(*this, *face, addFeatures(*pFeats), utf16::const_iterator(pStart), nChars); break;
+     case gr_utf32:  process_utf_data(*this, *face, addFeatures(*pFeats), utf32::const_iterator(pStart), nChars); break;
+     }
+     return true;
+ }
+ 
+-void Segment::prepare_pos(const Font * /*font*/)
++void Segment::doMirror(uint16 aMirror)
+ {
+-    // copy key changeable metrics into slot (if any);
+-}
+-
+-Slot *process_bidi(Slot *start, int level, int prelevel, int &nextLevel, int dirover, int isol, int &cisol, int &isolerr, int &embederr, int init, Segment *seg, uint8 aMirror, BracketPairStack &stack);
+-void resolveImplicit(Slot *s, Segment *seg, uint8 aMirror);
+-void resolveWhitespace(int baseLevel, Slot *s);
+-Slot *resolveOrder(Slot * & s, const bool reordered, const int level = 0);
+-
+-void Segment::bidiPass(uint8 aBidi, int paradir, uint8 aMirror)
+-{
+-    if (slotCount() == 0)
+-        return;
+-
+-    Slot *s;
+-    int baseLevel = paradir ? 1 : 0;
+-    unsigned int bmask = 0;
+-    unsigned int ssize = 0;
+-    for (s = first(); s; s = s->next())
++    Slot * s;
++    for (s = m_first; s; s = s->next())
+     {
+-        if (s->getBidiClass() == -1)
+-        {
+-            unsigned int bAttr = glyphAttr(s->gid(), aBidi);
+-            s->setBidiClass((bAttr <= 22) * bAttr);
+-        }
+-        bmask |= (1 << s->getBidiClass());
+-        s->setBidiLevel(baseLevel);
+-        if (glyphAttr(s->gid(), aMirror) && s->getBidiClass() == 21)
+-            ++ssize;
+-    }
+-
+-    BracketPairStack bstack(ssize);
+-    if (bmask & (paradir ? 0x2E7892 : 0x2E789C))
+-    {
+-        // O(8N) algorithm, with no working data beyond what is needed for processParens
+-        int nextLevel = paradir;
+-        int e, i, c;
+-        process_bidi(first(), baseLevel, paradir, nextLevel, 0, 0, c = 0, i = 0, e = 0, 1, this, aMirror, bstack);
+-        resolveImplicit(first(), this, aMirror);
+-        resolveWhitespace(baseLevel, last());
+-        s = resolveOrder(s = first(), baseLevel != 0);
+-        if (s)
+-        {
+-            first(s); last(s->prev());
+-            s->prev()->next(0); s->prev(0);
+-        }
+-    }
+-    else if (!(dir() & 4) && baseLevel && aMirror)
+-    {
+-        for (s = first(); s; s = s->next())
+-        {
+-            unsigned short g = glyphAttr(s->gid(), aMirror);
+-            if (g) s->setGlyph(this, g);
+-        }
++        unsigned short g = glyphAttr(s->gid(), aMirror);
++        if (g && (!(dir() & 4) || !glyphAttr(s->gid(), aMirror + 1)))
++            s->setGlyph(this, g);
+     }
+ }
+ 
++bool Segment::initCollisions()
++{
++    m_collisions = grzeroalloc<SlotCollision>(slotCount());
++    if (!m_collisions) return false;
++
++    for (Slot *p = m_first; p; p = p->next())
++        ::new (collisionInfo(p)) SlotCollision(this, p);
++    return true;
++}
+diff --git a/gfx/graphite2/src/Silf.cpp b/gfx/graphite2/src/Silf.cpp
+--- a/gfx/graphite2/src/Silf.cpp
++++ b/gfx/graphite2/src/Silf.cpp
+@@ -46,23 +46,25 @@ Silf::Silf() throw()
+   m_justs(0),
+   m_numPasses(0),
+   m_numJusts(0),
+   m_sPass(0),
+   m_pPass(0),
+   m_jPass(0),
+   m_bPass(0),
+   m_flags(0),
++  m_dir(0),
+   m_aPseudo(0),
+   m_aBreak(0),
+   m_aUser(0),
+   m_aBidi(0),
+   m_aMirror(0),
+   m_aPassBits(0),
+   m_iMaxComp(0),
++  m_aCollision(0),
+   m_aLig(0),
+   m_numPseudo(0),
+   m_nClass(0),
+   m_nLinear(0),
+   m_gEndLine(0)
+ {
+     memset(&m_silfinfo, 0, sizeof m_silfinfo);
+ }
+@@ -88,16 +90,20 @@ void Silf::releaseBuffers() throw()
+ 
+ 
+ bool Silf::readGraphite(const byte * const silf_start, size_t lSilf, Face& face, uint32 version)
+ {
+     const byte * p = silf_start,
+                * const silf_end = p + lSilf;
+     Error e;
+ 
++    if (e.test(version >= 0x00060000, E_BADSILFVERSION))
++    {
++        releaseBuffers(); return face.error(e);
++    }
+     if (version >= 0x00030000)
+     {
+         if (e.test(lSilf < 28, E_BADSIZE)) { releaseBuffers(); return face.error(e); }
+         be::skip<int32>(p);    // ruleVersion
+         be::skip<uint16>(p,2); // passOffset & pseudosOffset
+     }
+     else if (e.test(lSilf < 20, E_BADSIZE)) { releaseBuffers(); return face.error(e); }
+     const uint16 maxGlyph = be::read<uint16>(p);
+@@ -132,73 +138,88 @@ bool Silf::readGraphite(const byte * con
+         for (uint8 i = 0; i < m_numJusts; i++)
+         {
+             ::new(m_justs + i) Justinfo(p[0], p[1], p[2], p[3]);
+             be::skip<byte>(p,8);
+         }
+     }
+ 
+     if (e.test(p + sizeof(uint16) + sizeof(uint8)*8 >= silf_end, E_BADENDJUSTS)) { releaseBuffers(); return face.error(e); }
+-    m_aLig      = be::read<uint16>(p);
+-    m_aUser     = be::read<uint8>(p);
+-    m_iMaxComp  = be::read<uint8>(p);
+-    be::skip<byte>(p,5);                        // direction and 4 reserved bytes
++    m_aLig       = be::read<uint16>(p);
++    m_aUser      = be::read<uint8>(p);
++    m_iMaxComp   = be::read<uint8>(p);
++    m_dir        = be::read<uint8>(p) - 1;
++    m_aCollision = be::read<uint8>(p);
++    be::skip<byte>(p,3);
+     be::skip<uint16>(p, be::read<uint8>(p));    // don't need critical features yet
+     be::skip<byte>(p);                          // reserved
+     if (e.test(p >= silf_end, E_BADCRITFEATURES))   { releaseBuffers(); return face.error(e); }
+     be::skip<uint32>(p, be::read<uint8>(p));    // don't use scriptTag array.
+     if (e.test(p + sizeof(uint16) + sizeof(uint32) >= silf_end, E_BADSCRIPTTAGS)) { releaseBuffers(); return face.error(e); }
+     m_gEndLine  = be::read<uint16>(p);          // lbGID
+     const byte * o_passes = p,
+                * const passes_start = silf_start + be::read<uint32>(p);
+ 
+     const size_t num_attrs = face.glyphs().numAttrs();
+     if (e.test(m_aPseudo   >= num_attrs, E_BADAPSEUDO)
+         || e.test(m_aBreak >= num_attrs, E_BADABREAK)
+         || e.test(m_aBidi  >= num_attrs, E_BADABIDI)
+         || e.test(m_aMirror>= num_attrs, E_BADAMIRROR)
++        || e.test(m_aCollision && m_aCollision >= num_attrs - 5, E_BADACOLLISION)
+         || e.test(m_numPasses > 128, E_BADNUMPASSES) || e.test(passes_start >= silf_end, E_BADPASSESSTART)
+         || e.test(m_pPass < m_sPass, E_BADPASSBOUND) || e.test(m_pPass > m_numPasses, E_BADPPASS) || e.test(m_sPass > m_numPasses, E_BADSPASS)
+         || e.test(m_jPass < m_pPass, E_BADJPASSBOUND) || e.test(m_jPass > m_numPasses, E_BADJPASS)
+         || e.test((m_bPass != 0xFF && (m_bPass < m_jPass || m_bPass > m_numPasses)), E_BADBPASS)
+         || e.test(m_aLig > 127, E_BADALIG))
+     {
+         releaseBuffers();
+         return face.error(e);
+     }
+     be::skip<uint32>(p, m_numPasses);
+     if (e.test(p + sizeof(uint16) >= passes_start, E_BADPASSESSTART)) { releaseBuffers(); return face.error(e); }
+     m_numPseudo = be::read<uint16>(p);
+     be::skip<uint16>(p, 3); // searchPseudo, pseudoSelector, pseudoShift
+-    if (e.test(p + m_numPseudo*(sizeof(uint32) + sizeof(uint16)) >= passes_start, E_BADNUMPSEUDO))
++    m_pseudos = new Pseudo[m_numPseudo];
++    if (e.test(p + m_numPseudo*(sizeof(uint32) + sizeof(uint16)) >= passes_start, E_BADNUMPSEUDO)
++        || e.test(!m_pseudos, E_OUTOFMEM))
+     {
+         releaseBuffers(); return face.error(e);
+     }
+-    m_pseudos = new Pseudo[m_numPseudo];
+     for (int i = 0; i < m_numPseudo; i++)
+     {
+         m_pseudos[i].uid = be::read<uint32>(p);
+         m_pseudos[i].gid = be::read<uint16>(p);
+     }
+ 
+     const size_t clen = readClassMap(p, passes_start - p, version, e);
+-    if (e || e.test(p + clen > passes_start, E_BADPASSESSTART)) { releaseBuffers(); return face.error(e); }
++    m_passes = new Pass[m_numPasses];
++    if (e || e.test(p + clen > passes_start, E_BADPASSESSTART)
++          || e.test(!m_passes, E_OUTOFMEM))
++    { releaseBuffers(); return face.error(e); }
+ 
+-    m_passes = new Pass[m_numPasses];
+     for (size_t i = 0; i < m_numPasses; ++i)
+     {
+         const byte * const pass_start = silf_start + be::read<uint32>(o_passes),
+                    * const pass_end = silf_start + be::peek<uint32>(o_passes);
+         face.error_context((face.error_context() & 0xFF00) + EC_ASILF + (i << 16));
+-        if (e.test(pass_start > pass_end, E_BADPASSSTART) || e.test(pass_end > silf_end, E_BADPASSEND)) {
++        if (e.test(pass_start > pass_end, E_BADPASSSTART) 
++                || e.test(pass_start < passes_start, E_BADPASSSTART)
++                || e.test(pass_end > silf_end, E_BADPASSEND)) {
+             releaseBuffers(); return face.error(e);
+         }
+ 
++        enum passtype pt = PASS_TYPE_UNKNOWN;
++        if (i >= m_jPass) pt = PASS_TYPE_JUSTIFICATION;
++        else if (i >= m_pPass) pt = PASS_TYPE_POSITIONING;
++        else if (i >= m_sPass) pt = PASS_TYPE_SUBSTITUTE;
++        else pt = PASS_TYPE_LINEBREAK;
++
+         m_passes[i].init(this);
+-        if (!m_passes[i].readPass(pass_start, pass_end - pass_start, pass_start - silf_start, face, e))
++        if (!m_passes[i].readPass(pass_start, pass_end - pass_start, pass_start - silf_start, face, pt,
++            version, e))
+         {
+             releaseBuffers();
+             return false;
+         }
+     }
+ 
+     // fill in gr_faceinfo
+     m_silfinfo.upem = face.glyphs().unitsPerEm();
+@@ -246,35 +267,38 @@ size_t Silf::readClassMap(const byte *p,
+     uint32 max_off;
+     if (version >= 0x00040000)
+         max_off = readClassOffsets<uint32>(p, data_len, e);
+     else
+         max_off = readClassOffsets<uint16>(p, data_len, e);
+ 
+     if (max_off == ERROROFFSET) return ERROROFFSET;
+ 
++    if (e.test((int)max_off < m_nLinear + (m_nClass - m_nLinear) * 6, E_CLASSESTOOBIG))
++        return ERROROFFSET;
++
+     // Check the linear offsets are sane, these must be monotonically increasing.
+     for (const uint32 *o = m_classOffsets, * const o_end = o + m_nLinear; o != o_end; ++o)
+         if (e.test(o[0] > o[1], E_BADCLASSOFFSET))
+             return ERROROFFSET;
+ 
+     // Fortunately the class data is all uint16s so we can decode these now
+     m_classData = gralloc<uint16>(max_off);
+     if (e.test(!m_classData, E_OUTOFMEM)) return ERROROFFSET;
+     for (uint16 *d = m_classData, * const d_end = d + max_off; d != d_end; ++d)
+         *d = be::read<uint16>(p);
+ 
+     // Check the lookup class invariants for each non-linear class
+     for (const uint32 *o = m_classOffsets + m_nLinear, * const o_end = m_classOffsets + m_nClass; o != o_end; ++o)
+     {
+         const uint16 * lookup = m_classData + *o;
+-        if (e.test(*o > max_off - 4, E_HIGHCLASSOFFSET)                        // LookupClass doesn't stretch over max_off
++        if (e.test(*o + 4 > max_off, E_HIGHCLASSOFFSET)                        // LookupClass doesn't stretch over max_off
+          || e.test(lookup[0] == 0                                                   // A LookupClass with no looks is a suspicious thing ...
+-                    || lookup[0] > (max_off - *o - 4)/2                             // numIDs lookup pairs fits within (start of LookupClass' lookups array, max_off]
+-                    || lookup[3] != lookup[0] - lookup[1], E_BADCLASSLOOKUPINFO))   // rangeShift:   numIDs  - searchRange
++                    || lookup[0] * 2 + *o + 4 > max_off                             // numIDs lookup pairs fits within (start of LookupClass' lookups array, max_off]
++                    || lookup[3] + lookup[1] != lookup[0], E_BADCLASSLOOKUPINFO))   // rangeShift:   numIDs  - searchRange
+             return ERROROFFSET;
+     }
+ 
+     return max_off;
+ }
+ 
+ uint16 Silf::findPseudo(uint32 uid) const
+ {
+@@ -285,17 +309,17 @@ uint16 Silf::findPseudo(uint32 uid) cons
+ 
+ uint16 Silf::findClassIndex(uint16 cid, uint16 gid) const
+ {
+     if (cid > m_nClass) return -1;
+ 
+     const uint16 * cls = m_classData + m_classOffsets[cid];
+     if (cid < m_nLinear)        // output class being used for input, shouldn't happen
+     {
+-        for (unsigned int i = 0, n = m_classOffsets[cid + 1]; i < n; ++i, ++cls)
++        for (unsigned int i = 0, n = m_classOffsets[cid + 1] - m_classOffsets[cid]; i < n; ++i, ++cls)
+             if (*cls == gid) return i;
+         return -1;
+     }
+     else
+     {
+         const uint16 *  min = cls + 4,      // lookups array
+                      *  max = min + cls[0]*2; // lookups aray is numIDs (cls[0]) uint16 pairs long
+         do
+@@ -326,90 +350,82 @@ uint16 Silf::getClassGlyph(uint16 cid, u
+     }
+     return 0;
+ }
+ 
+ 
+ bool Silf::runGraphite(Segment *seg, uint8 firstPass, uint8 lastPass, int dobidi) const
+ {
+     assert(seg != 0);
+-    SlotMap            map(*seg);
++    SlotMap            map(*seg, m_dir);
+     FiniteStateMachine fsm(map, seg->getFace()->logger());
+     vm::Machine        m(map);
+     unsigned int       initSize = seg->slotCount();
+     uint8              lbidi = m_bPass;
+ #if !defined GRAPHITE2_NTRACING
+     json * const dbgout = seg->getFace()->logger();
+ #endif
+ 
+     if (lastPass == 0)
+     {
+         if (firstPass == lastPass && lbidi == 0xFF)
+             return true;
+         lastPass = m_numPasses;
+     }
+-    if (firstPass <= lbidi && lastPass >= lbidi && dobidi)
++    if ((firstPass < lbidi || (dobidi && firstPass == lbidi)) && (lastPass >= lbidi || (dobidi && lastPass + 1 == lbidi)))
+         lastPass++;
+     else
+         lbidi = 0xFF;
+ 
+     for (size_t i = firstPass; i < lastPass; ++i)
+     {
+         // bidi and mirroring
+         if (i == lbidi)
+         {
+ #if !defined GRAPHITE2_NTRACING
+             if (dbgout)
+             {
+                 *dbgout << json::item << json::object
+                             << "id"     << -1
+                             << "slots"  << json::array;
+-                seg->positionSlots(0);
++                seg->positionSlots(0, 0, 0, m_dir);
+                 for(Slot * s = seg->first(); s; s = s->next())
+                     *dbgout     << dslot(seg, s);
+                 *dbgout         << json::close
+                             << "rules"  << json::array << json::close
+                             << json::close;
+             }
+ #endif
+-
+-            if (!(seg->dir() & 2))
+-                seg->bidiPass(m_aBidi, seg->dir() & 1, m_aMirror);
+-            else if (m_aMirror)
+-            {
+-                Slot * s;
+-                for (s = seg->first(); s; s = s->next())
+-                {
+-                    unsigned short g = seg->glyphAttr(s->gid(), m_aMirror);
+-                    if (g && (!(seg->dir() & 4) || !seg->glyphAttr(s->gid(), m_aMirror + 1)))
+-                        s->setGlyph(seg, g);
+-                }
+-            }
++            if (seg->currdir() != (m_dir & 1))
++                seg->reverseSlots();
++            if (m_aMirror && (seg->dir() & 3) == 3)
++                seg->doMirror(m_aMirror);
+         --i;
++        lbidi = lastPass;
+         --lastPass;
+-        lbidi = 0xFF;
+         continue;
+         }
+ 
+ #if !defined GRAPHITE2_NTRACING
+         if (dbgout)
+         {
+             *dbgout << json::item << json::object
+                         << "id"     << i+1
+                         << "slots"  << json::array;
+-            seg->positionSlots(0);
++            seg->positionSlots(0, 0, 0, m_dir);
+             for(Slot * s = seg->first(); s; s = s->next())
+                 *dbgout     << dslot(seg, s);
+             *dbgout         << json::close;
+         }
+ #endif
+ 
+         // test whether to reorder, prepare for positioning
+-        if (i >= 32 || (seg->passBits() & (1 << i)) == 0)
+-            m_passes[i].runGraphite(m, fsm);
++        bool reverse = (lbidi == 0xFF) && (seg->currdir() != ((m_dir & 1) ^ m_passes[i].reverseDir()));
++        if ((i >= 32 || (seg->passBits() & (1 << i)) == 0 || m_passes[i].collisionLoops())
++                && !m_passes[i].runGraphite(m, fsm, reverse))
++            return false;
+         // only subsitution passes can change segment length, cached subsegments are short for their text
+         if (m.status() != vm::Machine::finished
+-            || (i < m_pPass && (seg->slotCount() > initSize * MAX_SEG_GROWTH_FACTOR
+-            || (seg->slotCount() && seg->slotCount() * MAX_SEG_GROWTH_FACTOR < initSize))))
++            || (seg->slotCount() && seg->slotCount() * MAX_SEG_GROWTH_FACTOR < initSize))
+             return false;
+     }
+     return true;
+ }
+diff --git a/gfx/graphite2/src/Slot.cpp b/gfx/graphite2/src/Slot.cpp
+--- a/gfx/graphite2/src/Slot.cpp
++++ b/gfx/graphite2/src/Slot.cpp
+@@ -24,34 +24,34 @@ Mozilla Public License (http://mozilla.o
+ License, as published by the Free Software Foundation, either version 2
+ of the License or (at your option) any later version.
+ */
+ #include "inc/Segment.h"
+ #include "inc/Slot.h"
+ #include "inc/Silf.h"
+ #include "inc/CharInfo.h"
+ #include "inc/Rule.h"
++#include "inc/Collider.h"
+ 
+ 
+ using namespace graphite2;
+ 
+-Slot::Slot() :
++Slot::Slot(int16 *user_attrs) :
+     m_next(NULL), m_prev(NULL),
+     m_glyphid(0), m_realglyphid(0), m_original(0), m_before(0), m_after(0),
+     m_index(0), m_parent(NULL), m_child(NULL), m_sibling(NULL),
+     m_position(0, 0), m_shift(0, 0), m_advance(0, 0),
+     m_attach(0, 0), m_with(0, 0), m_just(0.),
+-    m_flags(0), m_attLevel(0), m_bidiCls(-1), m_bidiLevel(0), m_justs(NULL)
+-    // Do not set m_userAttr since it is set *before* new is called since this
+-    // is used as a positional new to reset the GrSlot
++    m_flags(0), m_attLevel(0), m_bidiCls(-1), m_bidiLevel(0), 
++    m_userAttr(user_attrs), m_justs(NULL)
+ {
+ }
+ 
+ // take care, this does not copy any of the GrSlot pointer fields
+-void Slot::set(const Slot & orig, int charOffset, size_t numUserAttr, size_t justLevels, size_t numChars)
++void Slot::set(const Slot & orig, int charOffset, size_t sizeAttr, size_t justLevels, size_t numChars)
+ {
+     // leave m_next and m_prev unchanged
+     m_glyphid = orig.m_glyphid;
+     m_realglyphid = orig.m_realglyphid;
+     m_original = orig.m_original + charOffset;
+     if (charOffset + int(orig.m_before) < 0)
+         m_before = 0;
+     else
+@@ -68,95 +68,104 @@ void Slot::set(const Slot & orig, int ch
+     m_advance = orig.m_advance;
+     m_attach = orig.m_attach;
+     m_with = orig.m_with;
+     m_flags = orig.m_flags;
+     m_attLevel = orig.m_attLevel;
+     m_bidiCls = orig.m_bidiCls;
+     m_bidiLevel = orig.m_bidiLevel;
+     if (m_userAttr && orig.m_userAttr)
+-        memcpy(m_userAttr, orig.m_userAttr, numUserAttr * sizeof(*m_userAttr));
++        memcpy(m_userAttr, orig.m_userAttr, sizeAttr * sizeof(*m_userAttr));
+     if (m_justs && orig.m_justs)
+         memcpy(m_justs, orig.m_justs, SlotJustify::size_of(justLevels));
+ }
+ 
+ void Slot::update(int /*numGrSlots*/, int numCharInfo, Position &relpos)
+ {
+     m_before += numCharInfo;
+     m_after += numCharInfo;
+     m_position = m_position + relpos;
+ }
+ 
+-Position Slot::finalise(const Segment *seg, const Font *font, Position & base, Rect & bbox, uint8 attrLevel, float & clusterMin)
++Position Slot::finalise(const Segment *seg, const Font *font, Position & base, Rect & bbox, uint8 attrLevel, float & clusterMin, bool rtl, bool isFinal)
+ {
++    SlotCollision *coll = NULL;
+     if (attrLevel && m_attLevel > attrLevel) return Position(0, 0);
+-    float scale = 1.0;
+-    Position shift(m_shift.x * ((seg->dir() & 1) * -2 + 1) + m_just, m_shift.y);
++    float scale = font ? font->scale() : 1.0f;
++    Position shift(m_shift.x * (rtl * -2 + 1) + m_just, m_shift.y);
+     float tAdvance = m_advance.x + m_just;
++    if (isFinal && (coll = seg->collisionInfo(this)))
++    {
++        const Position &collshift = coll->offset();
++        if (!(coll->flags() & SlotCollision::COLL_KERN) || rtl)
++            shift = shift + collshift;
++    }
+     const GlyphFace * glyphFace = seg->getFace()->glyphs().glyphSafe(glyph());
+     if (font)
+     {
+         scale = font->scale();
+         shift *= scale;
+         if (font->isHinted() && glyphFace)
+-            tAdvance = (m_advance.x - glyphFace->theAdvance().x + m_just) * scale + font->advance(m_glyphid);
++            tAdvance = (m_advance.x - glyphFace->theAdvance().x + m_just) * scale + font->advance(glyph());
+         else
+             tAdvance *= scale;
+     }    
+     Position res;
+ 
+     m_position = base + shift;
+     if (!m_parent)
+     {
+         res = base + Position(tAdvance, m_advance.y * scale);
+-        clusterMin = base.x;
++        clusterMin = m_position.x;
+     }
+     else
+     {
+         float tAdv;
+         m_position += (m_attach - m_with) * scale;
+-        tAdv = m_advance.x >= 0.5 ? m_position.x + tAdvance - shift.x : 0.f;
++        tAdv = m_advance.x >= 0.5f ? m_position.x + tAdvance - shift.x : 0.f;
+         res = Position(tAdv, 0);
+-        if ((m_advance.x >= 0.5 || m_position.x < 0) && m_position.x < clusterMin) clusterMin = m_position.x;
++        if ((m_advance.x >= 0.5f || m_position.x < 0) && m_position.x < clusterMin) clusterMin = m_position.x;
+     }
+ 
+     if (glyphFace)
+     {
+         Rect ourBbox = glyphFace->theBBox() * scale + m_position;
+         bbox = bbox.widen(ourBbox);
+     }
+ 
+     if (m_child && m_child != this && m_child->attachedTo() == this)
+     {
+-        Position tRes = m_child->finalise(seg, font, m_position, bbox, attrLevel, clusterMin);
+-        if ((!m_parent || m_advance.x >= 0.5) && tRes.x > res.x) res = tRes;
++        Position tRes = m_child->finalise(seg, font, m_position, bbox, attrLevel, clusterMin, rtl, isFinal);
++        if ((!m_parent || m_advance.x >= 0.5f) && tRes.x > res.x) res = tRes;
+     }
+ 
+     if (m_parent && m_sibling && m_sibling != this && m_sibling->attachedTo() == m_parent)
+     {
+-        Position tRes = m_sibling->finalise(seg, font, base, bbox, attrLevel, clusterMin);
++        Position tRes = m_sibling->finalise(seg, font, base, bbox, attrLevel, clusterMin, rtl, isFinal);
+         if (tRes.x > res.x) res = tRes;
+     }
+     
+     if (!m_parent && clusterMin < base.x)
+     {
+-        Position adj = Position(base.x - clusterMin, 0.);
++        Position adj = Position(m_position.x - clusterMin, 0.);
+         res += adj;
+         m_position += adj;
+         if (m_child) m_child->floodShift(adj);
+     }
+     return res;
+ }
+ 
+-int32 Slot::clusterMetric(const Segment *seg, uint8 metric, uint8 attrLevel)
++int32 Slot::clusterMetric(const Segment *seg, uint8 metric, uint8 attrLevel, bool rtl)
+ {
+     Position base;
++    if (glyph() >= seg->getFace()->glyphs().numGlyphs())
++        return 0;
+     Rect bbox = seg->theGlyphBBoxTemporary(glyph());
+     float clusterMin = 0.;
+-    Position res = finalise(seg, NULL, base, bbox, attrLevel, clusterMin);
++    Position res = finalise(seg, NULL, base, bbox, attrLevel, clusterMin, rtl, false);
+ 
+     switch (metrics(metric))
+     {
+     case kgmetLsb :
+         return static_cast<uint32>(bbox.bl.x);
+     case kgmetRsb :
+         return static_cast<uint32>(res.x - bbox.tr.x);
+     case kgmetBbTop :
+@@ -175,19 +184,20 @@ int32 Slot::clusterMetric(const Segment 
+         return static_cast<uint32>(res.x);
+     case kgmetAdvHeight :
+         return static_cast<uint32>(res.y);
+     default :
+         return 0;
+     }
+ }
+ 
++#define SLOTGETCOLATTR(x) { SlotCollision *c = seg->collisionInfo(this); return c ? int(c-> x) : 0; }
++
+ int Slot::getAttr(const Segment *seg, attrCode ind, uint8 subindex) const
+ {
+-    if (!this) return 0;
+     if (ind == gr_slatUserDefnV1)
+     {
+         ind = gr_slatUserDefn;
+         subindex = 0;
+     }
+     else if (ind >= gr_slatJStretch && ind < gr_slatJStretch + 20 && ind != gr_slatJWidth)
+     {
+         int indx = ind - gr_slatJStretch;
+@@ -205,37 +215,66 @@ int Slot::getAttr(const Segment *seg, at
+     case gr_slatAttYOff :   return 0;
+     case gr_slatAttWithX :  return int(m_with.x);
+     case gr_slatAttWithY :  return int(m_with.y);
+     case gr_slatAttWithXOff:
+     case gr_slatAttWithYOff:return 0;
+     case gr_slatAttLevel :  return m_attLevel;
+     case gr_slatBreak :     return seg->charinfo(m_original)->breakWeight();
+     case gr_slatCompRef :   return 0;
+-    case gr_slatDir :       if (m_bidiCls == -1)
+-                                const_cast<Slot *>(this)->setBidiClass(seg->glyphAttr(gid(), seg->silf()->aBidi()));
+-                            return m_bidiCls;
++    case gr_slatDir :       return seg->dir() & 1;
+     case gr_slatInsert :    return isInsertBefore();
+     case gr_slatPosX :      return int(m_position.x); // but need to calculate it
+     case gr_slatPosY :      return int(m_position.y);
+     case gr_slatShiftX :    return int(m_shift.x);
+     case gr_slatShiftY :    return int(m_shift.y);
+     case gr_slatMeasureSol: return -1; // err what's this?
+     case gr_slatMeasureEol: return -1;
+     case gr_slatJWidth:     return int(m_just);
+     case gr_slatUserDefn :  return m_userAttr[subindex];
+     case gr_slatSegSplit :  return seg->charinfo(m_original)->flags() & 3;
+     case gr_slatBidiLevel:  return m_bidiLevel;
+-    default :               return 0;
++    case gr_slatColFlags :		{ SlotCollision *c = seg->collisionInfo(this); return c ? c->flags() : 0; }
++    case gr_slatColLimitblx :	SLOTGETCOLATTR(limit().bl.x)
++    case gr_slatColLimitbly :	SLOTGETCOLATTR(limit().bl.y)
++    case gr_slatColLimittrx :	SLOTGETCOLATTR(limit().tr.x)
++    case gr_slatColLimittry :	SLOTGETCOLATTR(limit().tr.y)
++    case gr_slatColShiftx :		SLOTGETCOLATTR(offset().x)
++    case gr_slatColShifty :		SLOTGETCOLATTR(offset().y)
++    case gr_slatColMargin :		SLOTGETCOLATTR(margin())
++    case gr_slatColMarginWt :	SLOTGETCOLATTR(marginWt())
++    case gr_slatColExclGlyph :	SLOTGETCOLATTR(exclGlyph())
++    case gr_slatColExclOffx :	SLOTGETCOLATTR(exclOffset().x)
++    case gr_slatColExclOffy :	SLOTGETCOLATTR(exclOffset().y)
++    case gr_slatSeqClass :		SLOTGETCOLATTR(seqClass())
++	case gr_slatSeqProxClass :	SLOTGETCOLATTR(seqProxClass())
++    case gr_slatSeqOrder :		SLOTGETCOLATTR(seqOrder())
++    case gr_slatSeqAboveXoff :	SLOTGETCOLATTR(seqAboveXoff())
++    case gr_slatSeqAboveWt :	SLOTGETCOLATTR(seqAboveWt())
++    case gr_slatSeqBelowXlim :	SLOTGETCOLATTR(seqBelowXlim())
++    case gr_slatSeqBelowWt :	SLOTGETCOLATTR(seqBelowWt())
++    case gr_slatSeqValignHt :	SLOTGETCOLATTR(seqValignHt())
++    case gr_slatSeqValignWt :	SLOTGETCOLATTR(seqValignWt())
++    default : return 0;
+     }
+ }
+ 
++#define SLOTCOLSETATTR(x) { \
++        SlotCollision *c = seg->collisionInfo(this); \
++        if (c) { c-> x ; c->setFlags(c->flags() & ~SlotCollision::COLL_KNOWN); } \
++        break; }
++#define SLOTCOLSETCOMPLEXATTR(t, y, x) { \
++        SlotCollision *c = seg->collisionInfo(this); \
++        if (c) { \
++        const t &s = c-> y; \
++        c-> x ; c->setFlags(c->flags() & ~SlotCollision::COLL_KNOWN); } \
++        break; }
++
+ void Slot::setAttr(Segment *seg, attrCode ind, uint8 subindex, int16 value, const SlotMap & map)
+ {
+-    if (!this) return;
+     if (ind == gr_slatUserDefnV1)
+     {
+         ind = gr_slatUserDefn;
+         subindex = 0;
+     }
+     else if (ind >= gr_slatJStretch && ind < gr_slatJStretch + 20 && ind != gr_slatJWidth)
+     {
+         int indx = ind - gr_slatJStretch;
+@@ -247,22 +286,22 @@ void Slot::setAttr(Segment *seg, attrCod
+     case gr_slatAdvX :  m_advance.x = value; break;
+     case gr_slatAdvY :  m_advance.y = value; break;
+     case gr_slatAttTo :
+     {
+         const uint16 idx = uint16(value);
+         if (idx < map.size() && map[idx])
+         {
+             Slot *other = map[idx];
+-            if (other == this) break;
++            if (other == this || other == m_parent) break;
+             if (m_parent) m_parent->removeChild(this);
+-            if (other->child(this))
++            if (!other->isChildOf(this) && other->child(this))
+             {
+                 attachTo(other);
+-                if (((seg->dir() & 1) != 0) ^ (idx > subindex))
++                if ((map.dir() != 0) ^ (idx > subindex))
+                     m_with = Position(advance(), 0);
+                 else        // normal match to previous root
+                     m_attach = Position(other->advance(), 0);
+             }
+         }
+         break;
+     }
+     case gr_slatAttX :          m_attach.x = value; break;
+@@ -275,29 +314,52 @@ void Slot::setAttr(Segment *seg, attrCod
+     case gr_slatAttWithYOff :   break;
+     case gr_slatAttLevel :
+         m_attLevel = byte(value);
+         break;
+     case gr_slatBreak :
+         seg->charinfo(m_original)->breakWeight(value);
+         break;
+     case gr_slatCompRef :   break;      // not sure what to do here
+-    case gr_slatDir :       m_bidiCls = value; break;
++    case gr_slatDir : break;
+     case gr_slatInsert :
+         markInsertBefore(value? true : false);
+         break;
+     case gr_slatPosX :      break; // can't set these here
+     case gr_slatPosY :      break;
+     case gr_slatShiftX :    m_shift.x = value; break;
+     case gr_slatShiftY :    m_shift.y = value; break;
+     case gr_slatMeasureSol :    break;
+     case gr_slatMeasureEol :    break;
+     case gr_slatJWidth :    just(value); break;
+     case gr_slatSegSplit :  seg->charinfo(m_original)->addflags(value & 3); break;
+     case gr_slatUserDefn :  m_userAttr[subindex] = value; break;
++    case gr_slatColFlags :  {
++        SlotCollision *c = seg->collisionInfo(this);
++        if (c)
++            c->setFlags(value);
++        break; }
++    case gr_slatColLimitblx :	SLOTCOLSETCOMPLEXATTR(Rect, limit(), setLimit(Rect(Position(value, s.bl.y), s.tr)))
++    case gr_slatColLimitbly :	SLOTCOLSETCOMPLEXATTR(Rect, limit(), setLimit(Rect(Position(s.bl.x, value), s.tr)))
++    case gr_slatColLimittrx :	SLOTCOLSETCOMPLEXATTR(Rect, limit(), setLimit(Rect(s.bl, Position(value, s.tr.y))))
++    case gr_slatColLimittry :	SLOTCOLSETCOMPLEXATTR(Rect, limit(), setLimit(Rect(s.bl, Position(s.tr.x, value))))
++    case gr_slatColMargin :		SLOTCOLSETATTR(setMargin(value))
++    case gr_slatColMarginWt :	SLOTCOLSETATTR(setMarginWt(value))
++    case gr_slatColExclGlyph :	SLOTCOLSETATTR(setExclGlyph(value))
++    case gr_slatColExclOffx :	SLOTCOLSETCOMPLEXATTR(Position, exclOffset(), setExclOffset(Position(value, s.y)))
++    case gr_slatColExclOffy :	SLOTCOLSETCOMPLEXATTR(Position, exclOffset(), setExclOffset(Position(s.x, value)))
++    case gr_slatSeqClass :		SLOTCOLSETATTR(setSeqClass(value))
++	case gr_slatSeqProxClass :	SLOTCOLSETATTR(setSeqProxClass(value))
++    case gr_slatSeqOrder :		SLOTCOLSETATTR(setSeqOrder(value))
++    case gr_slatSeqAboveXoff :	SLOTCOLSETATTR(setSeqAboveXoff(value))
++    case gr_slatSeqAboveWt :	SLOTCOLSETATTR(setSeqAboveWt(value))
++    case gr_slatSeqBelowXlim :	SLOTCOLSETATTR(setSeqBelowXlim(value))
++    case gr_slatSeqBelowWt :	SLOTCOLSETATTR(setSeqBelowWt(value))
++    case gr_slatSeqValignHt :	SLOTCOLSETATTR(setSeqValignHt(value))
++    case gr_slatSeqValignWt :	SLOTCOLSETATTR(setSeqValignWt(value))
+     default :
+         break;
+     }
+ }
+ 
+ int Slot::getJustify(const Segment *seg, uint8 level, uint8 subindex) const
+ {
+     if (level && level >= seg->silf()->numJustLevels()) return 0;
+@@ -369,46 +431,54 @@ bool Slot::removeChild(Slot *ap)
+ }
+ 
+ bool Slot::removeSibling(Slot *ap)
+ {
+     if (this == ap || !m_sibling) return false;
+     else if (ap == m_sibling)
+     {
+         m_sibling = m_sibling->nextSibling();
++        ap->sibling(NULL);
+         return true;
+     }
+     else
+         return m_sibling->removeSibling(ap);
+     return true;
+ }
+ 
+ void Slot::setGlyph(Segment *seg, uint16 glyphid, const GlyphFace * theGlyph)
+ {
+     m_glyphid = glyphid;
++    m_bidiCls = -1;
+     if (!theGlyph)
+     {
+         theGlyph = seg->getFace()->glyphs().glyphSafe(glyphid);
+         if (!theGlyph)
+         {
+             m_realglyphid = 0;
+             m_advance = Position(0.,0.);
+             return;
+         }
+     }
+     m_realglyphid = theGlyph->attrs()[seg->silf()->aPseudo()];
++    if (m_realglyphid > seg->getFace()->glyphs().numGlyphs())
++        m_realglyphid = 0;
+     const GlyphFace *aGlyph = theGlyph;
+     if (m_realglyphid)
+     {
+         aGlyph = seg->getFace()->glyphs().glyphSafe(m_realglyphid);
+         if (!aGlyph) aGlyph = theGlyph;
+     }
+     m_advance = Position(aGlyph->theAdvance().x, 0.);
+     if (seg->silf()->aPassBits())
++    {
+         seg->mergePassBits(theGlyph->attrs()[seg->silf()->aPassBits()]);
++        if (seg->silf()->numPasses() > 16)
++            seg->mergePassBits(theGlyph->attrs()[seg->silf()->aPassBits()+1] << 16);
++    }
+ }
+ 
+ void Slot::floodShift(Position adj)
+ {
+     m_position += adj;
+     if (m_child) m_child->floodShift(adj);
+     if (m_sibling) m_sibling->floodShift(adj);
+ }
+@@ -420,8 +490,35 @@ void SlotJustify::LoadSlot(const Slot *s
+         Justinfo *justs = seg->silf()->justAttrs() + i;
+         int16 *v = values + i * NUMJUSTPARAMS;
+         v[0] = seg->glyphAttr(s->gid(), justs->attrStretch());
+         v[1] = seg->glyphAttr(s->gid(), justs->attrShrink());
+         v[2] = seg->glyphAttr(s->gid(), justs->attrStep());
+         v[3] = seg->glyphAttr(s->gid(), justs->attrWeight());
+     }
+ }
++
++Slot * Slot::nextInCluster(const Slot *s) const
++{
++    Slot *base;
++    if (s->firstChild())
++        return s->firstChild();
++    else if (s->nextSibling())
++        return s->nextSibling();
++    while ((base = s->attachedTo()))
++    {
++        // if (base->firstChild() == s && base->nextSibling())
++        if (base->nextSibling())
++            return base->nextSibling();
++        s = base;
++    }
++    return NULL;
++}
++
++bool Slot::isChildOf(const Slot *base) const
++{
++    if (m_parent == base)
++        return true;
++    else if (!m_parent)
++        return false;
++    else
++        return m_parent->isChildOf(base);
++}
+diff --git a/gfx/graphite2/src/Sparse.cpp b/gfx/graphite2/src/Sparse.cpp
+--- a/gfx/graphite2/src/Sparse.cpp
++++ b/gfx/graphite2/src/Sparse.cpp
+@@ -25,17 +25,17 @@ License, as published by the Free Softwa
+ of the License or (at your option) any later version.
+ */
+ #include <cassert>
+ #include "inc/Sparse.h"
+ #include "inc/bits.h"
+ 
+ using namespace graphite2;
+ 
+-sparse::chunk sparse::empty_chunk = {0,0};
++const sparse::chunk sparse::empty_chunk = {0,0};
+ 
+ sparse::~sparse() throw()
+ {
+     if (m_array.map == &empty_chunk) return;
+     free(m_array.values);
+ }
+ 
+ 
+diff --git a/gfx/graphite2/src/TtfUtil.cpp b/gfx/graphite2/src/TtfUtil.cpp
+--- a/gfx/graphite2/src/TtfUtil.cpp
++++ b/gfx/graphite2/src/TtfUtil.cpp
+@@ -57,18 +57,20 @@ Description
+     Forward declarations
+ ***********************************************************************************************/
+ 
+ /***********************************************************************************************
+     Local Constants and static variables
+ ***********************************************************************************************/
+ namespace 
+ {
++#ifdef ALL_TTFUTILS
+     // max number of components allowed in composite glyphs
+     const int kMaxGlyphComponents = 8;
++#endif
+ 
+     template <int R, typename T>
+     inline float fixed_to_float(const T f) {
+         return float(f)/float(2^R);
+     }
+ 
+ /*----------------------------------------------------------------------------------------------
+     Table of standard Postscript glyph names. From Martin Hosken. Disagress with ttfdump.exe
+@@ -222,69 +224,79 @@ bool GetTableInfo(const Tag TableTag, co
+ /*----------------------------------------------------------------------------------------------
+     Check the specified table. Tests depend on the table type.
+     Return true if successful, false otherwise.
+ ----------------------------------------------------------------------------------------------*/
+ bool CheckTable(const Tag TableId, const void * pTable, size_t lTableSize)
+ {
+     using namespace Sfnt;
+     
+-    if (pTable == 0) return false;
++    if (pTable == 0 || lTableSize < 4) return false;
+ 
+     switch(TableId)
+     {
+     case Tag::cmap: // cmap
+     {
+         const Sfnt::CharacterCodeMap * const pCmap 
+             = reinterpret_cast<const Sfnt::CharacterCodeMap *>(pTable);
++        if (lTableSize < sizeof(Sfnt::CharacterCodeMap))
++            return false;
+         return be::swap(pCmap->version) == 0;
+     }
+ 
+     case Tag::head: // head
+     {
+         const Sfnt::FontHeader * const pHead 
+             = reinterpret_cast<const Sfnt::FontHeader *>(pTable);
++        if (lTableSize < sizeof(Sfnt::FontHeader))
++            return false;
+         bool r = be::swap(pHead->version) == OneFix
+             && be::swap(pHead->magic_number) == FontHeader::MagicNumber
+             && be::swap(pHead->glyph_data_format)
+                     == FontHeader::GlypDataFormat 
+             && (be::swap(pHead->index_to_loc_format)
+                     == FontHeader::ShortIndexLocFormat 
+                 || be::swap(pHead->index_to_loc_format)
+                     == FontHeader::LongIndexLocFormat) 
+             && sizeof(FontHeader) <= lTableSize;
+         return r;
+     }
+ 
+     case Tag::post: // post
+     {
+         const Sfnt::PostScriptGlyphName * const pPost 
+             = reinterpret_cast<const Sfnt::PostScriptGlyphName *>(pTable);
++        if (lTableSize < sizeof(Sfnt::PostScriptGlyphName))
++            return false;
+         const fixed format = be::swap(pPost->format);
+         bool r = format == PostScriptGlyphName::Format1 
+             || format == PostScriptGlyphName::Format2 
+             || format == PostScriptGlyphName::Format3 
+             || format == PostScriptGlyphName::Format25;
+         return r;
+     }
+ 
+     case Tag::hhea: // hhea
+     {
+         const Sfnt::HorizontalHeader * pHhea = 
+             reinterpret_cast<const Sfnt::HorizontalHeader *>(pTable);
++        if (lTableSize < sizeof(Sfnt::HorizontalHeader))
++            return false;
+         bool r = be::swap(pHhea->version) == OneFix
+             && be::swap(pHhea->metric_data_format) == 0
+             && sizeof (Sfnt::HorizontalHeader) <= lTableSize;
+         return r;
+     }
+ 
+     case Tag::maxp: // maxp
+     {
+         const Sfnt::MaximumProfile * pMaxp = 
+             reinterpret_cast<const Sfnt::MaximumProfile *>(pTable);
++        if (lTableSize < sizeof(Sfnt::MaximumProfile))
++            return false;
+         bool r = be::swap(pMaxp->version) == OneFix
+             && sizeof(Sfnt::MaximumProfile) <= lTableSize;
+         return r;
+     }
+ 
+     case Tag::OS_2: // OS/2
+     {
+         const Sfnt::Compatibility * pOs2 
+@@ -319,16 +331,18 @@ bool CheckTable(const Tag TableId, const
+             return false;
+         break;
+     }
+ 
+     case Tag::name:
+     {
+         const Sfnt::FontNames * pName 
+             = reinterpret_cast<const Sfnt::FontNames *>(pTable);
++        if (lTableSize < sizeof(Sfnt::FontNames))
++            return false;
+         return be::swap(pName->format) == 0;
+     }
+ 
+     default:
+         break;
+     }
+ 
+     return true;
+@@ -791,27 +805,27 @@ bool HorMetrics(gid16 nGlyphId, const vo
+         reinterpret_cast<const Sfnt::HorizontalMetric *>(pHmtx);
+ 
+     const Sfnt::HorizontalHeader * phhea = 
+         reinterpret_cast<const Sfnt::HorizontalHeader *>(pHhea);
+ 
+     size_t cLongHorMetrics = be::swap(phhea->num_long_hor_metrics);
+     if (nGlyphId < cLongHorMetrics) 
+     {   // glyph id is acceptable
+-        if (nGlyphId * sizeof(Sfnt::HorizontalMetric) >= lHmtxSize) return false;
++        if ((nGlyphId + 1) * sizeof(Sfnt::HorizontalMetric) > lHmtxSize) return false;
+         nAdvWid = be::swap(phmtx[nGlyphId].advance_width);
+         nLsb = be::swap(phmtx[nGlyphId].left_side_bearing);
+     }
+     else
+     {
+         // guard against bad glyph id
+         size_t lLsbOffset = sizeof(Sfnt::HorizontalMetric) * cLongHorMetrics +
+             sizeof(int16) * (nGlyphId - cLongHorMetrics); // offset in bytes
+         // We test like this as LsbOffset is an offset not a length.
+-        if (lLsbOffset > lHmtxSize - sizeof(int16))
++        if (lLsbOffset >= lHmtxSize - sizeof(int16) || cLongHorMetrics == 0)
+         {
+             nLsb = 0;
+             return false;
+         }
+         nAdvWid = be::swap(phmtx[cLongHorMetrics - 1].advance_width);
+         nLsb = be::peek<int16>(reinterpret_cast<const byte *>(phmtx) + lLsbOffset);
+     }
+ 
+@@ -833,31 +847,33 @@ const void * FindCmapSubtable(const void
+     {
+         if (be::swap(pTable->encoding[i].platform_id) == nPlatformId &&
+                 (nEncodingId == -1 || be::swap(pTable->encoding[i].platform_specific_id) == nEncodingId))
+         {
+             uint32 offset = be::swap(pTable->encoding[i].offset);
+             const uint8 * pRtn = reinterpret_cast<const uint8 *>(pCmap) + offset;
+             if (length)
+             {
+-                if (offset > length) return NULL;
++                if (offset > length - 2) return NULL;
+                 uint16 format = be::read<uint16>(pRtn);
+                 if (format == 4)
+                 {
++                    if (offset > length - 4) return NULL;
+                     uint16 subTableLength = be::peek<uint16>(pRtn);
+                     if (i + 1 == csuPlatforms)
+                     {
+                         if (subTableLength > length - offset)
+                             return NULL;
+                     }
+                     else if (subTableLength > be::swap(pTable->encoding[i+1].offset))
+                         return NULL;
+                 }
+                 if (format == 12)
+                 {
++                    if (offset > length - 6) return NULL;
+                     uint32 subTableLength = be::peek<uint32>(pRtn);
+                     if (i + 1 == csuPlatforms)
+                     {
+                         if (subTableLength > length - offset)
+                             return NULL;
+                     }
+                     else if (subTableLength > be::swap(pTable->encoding[i+1].offset))
+                         return NULL;
+@@ -868,48 +884,80 @@ const void * FindCmapSubtable(const void
+     }
+ 
+     return 0;
+ }
+ 
+ /*----------------------------------------------------------------------------------------------
+     Check the Microsoft Unicode subtable for expected values
+ ----------------------------------------------------------------------------------------------*/
+-bool CheckCmapSubtable4(const void * pCmapSubtable4)
++bool CheckCmapSubtable4(const void * pCmapSubtable4, size_t table_len /*, unsigned int maxgid*/)
+ {
+     if (!pCmapSubtable4) return false;
+     const Sfnt::CmapSubTable * pTable = reinterpret_cast<const Sfnt::CmapSubTable *>(pCmapSubtable4);
+-    // Bob H says ome freeware TT fonts have version 1 (eg, CALIGULA.TTF) 
++    // Bob H say some freeware TT fonts have version 1 (eg, CALIGULA.TTF) 
+     // so don't check subtable version. 21 Mar 2002 spec changes version to language.
+     if (be::swap(pTable->format) != 4) return false;
+     const Sfnt::CmapSubTableFormat4 * pTable4 = reinterpret_cast<const Sfnt::CmapSubTableFormat4 *>(pCmapSubtable4);
+     uint16 length = be::swap(pTable4->length);
++    if (length > table_len)
++        return false;
+     if (length < sizeof(Sfnt::CmapSubTableFormat4))
+         return false;
+     uint16 nRanges = be::swap(pTable4->seg_count_x2) >> 1;
+     if (length < sizeof(Sfnt::CmapSubTableFormat4) + 4 * nRanges * sizeof(uint16))
+         return false;
+     // check last range is properly terminated
+     uint16 chEnd = be::peek<uint16>(pTable4->end_code + nRanges - 1);
+-    return (chEnd == 0xFFFF);
++    if (chEnd != 0xFFFF)
++        return false;
++#if 0
++    int lastend = -1;
++    for (int i = 0; i < nRanges; ++i)
++    {
++        uint16 end = be::peek<uint16>(pTable4->end_code + i);
++        uint16 start = be::peek<uint16>(pTable4->end_code + nRanges + 1 + i);
++        int16 delta = be::peek<int16>(pTable4->end_code + 2*nRanges + 1 + i);
++        uint16 offset = be::peek<uint16>(pTable4->end_code + 3*nRanges + 1 + i);
++        if (lastend >= end || lastend >= start)
++            return false;
++        if (offset)
++        {
++            const uint16 *gstart = pTable4->end_code + 3*nRanges + 1 + i + (offset >> 1);
++            const uint16 *gend = gstart + end - start;
++            if ((char *)gend >= (char *)pCmapSubtable4 + length)
++                return false;
++            while (gstart <= gend)
++            {
++                uint16 g = be::peek<uint16>(gstart++);
++                if (g && ((g + delta) & 0xFFFF) > maxgid)
++                    return false;
++            }
++        }
++        else if (((delta + end) & 0xFFFF) > maxgid)
++            return false;
++        lastend = end;
++    }
++#endif
++    return true;
+ }
+ 
+ /*----------------------------------------------------------------------------------------------
+     Return the Glyph ID for the given Unicode ID in the Microsoft Unicode subtable.
+     (Actually this code only depends on subtable being format 4.)
+     Return 0 if the Unicode ID is not in the subtable.
+ ----------------------------------------------------------------------------------------------*/
+ gid16 CmapSubtable4Lookup(const void * pCmapSubtabel4, unsigned int nUnicodeId, int rangeKey)
+ {
+     const Sfnt::CmapSubTableFormat4 * pTable = reinterpret_cast<const Sfnt::CmapSubTableFormat4 *>(pCmapSubtabel4);
+ 
+     uint16 nSeg = be::swap(pTable->seg_count_x2) >> 1;
+   
+     uint16 n;
+-        const uint16 * pLeft, * pMid;
++    const uint16 * pLeft, * pMid;
+     uint16 cMid, chStart, chEnd;
+ 
+     if (rangeKey)
+     {
+         pMid = &(pTable->end_code[rangeKey]);
+         chEnd = be::peek<uint16>(pMid);
+     }
+     else
+@@ -1027,29 +1075,41 @@ unsigned int CmapSubtable4NextCodepoint(
+     if (pRangeKey)
+         *pRangeKey = iRange + 1;
+     return be::peek<uint16>(pStartCode + iRange + 1);
+ }
+ 
+ /*----------------------------------------------------------------------------------------------
+     Check the Microsoft UCS-4 subtable for expected values.
+ ----------------------------------------------------------------------------------------------*/
+-bool CheckCmapSubtable12(const void *pCmapSubtable12)
++bool CheckCmapSubtable12(const void *pCmapSubtable12, size_t table_len /*, unsigned int maxgid*/)
+ {
+     if (!pCmapSubtable12)  return false;
+     const Sfnt::CmapSubTable * pTable = reinterpret_cast<const Sfnt::CmapSubTable *>(pCmapSubtable12);
+     if (be::swap(pTable->format) != 12)
+         return false;
+     const Sfnt::CmapSubTableFormat12 * pTable12 = reinterpret_cast<const Sfnt::CmapSubTableFormat12 *>(pCmapSubtable12);
+     uint32 length = be::swap(pTable12->length);
++    if (length > table_len)
++        return false;
+     if (length < sizeof(Sfnt::CmapSubTableFormat12))
+         return false;
+-    
+-    return (length == (sizeof(Sfnt::CmapSubTableFormat12) + (be::swap(pTable12->num_groups) - 1)
+-        * sizeof(uint32) * 3));
++    uint32 num_groups = be::swap(pTable12->num_groups);
++    if (length != (sizeof(Sfnt::CmapSubTableFormat12) + (num_groups - 1) * sizeof(uint32) * 3))
++        return false;
++#if 0
++    for (unsigned int i = 0; i < num_groups; ++i)
++    {
++        if (be::swap(pTable12->group[i].end_char_code)  - be::swap(pTable12->group[i].start_char_code) + be::swap(pTable12->group[i].start_glyph_id) > maxgid)
++            return false;
++        if (i > 0 && be::swap(pTable12->group[i].start_char_code) <= be::swap(pTable12->group[i-1].end_char_code))
++            return false;
++    }
++#endif
++    return true;
+ }
+ 
+ /*----------------------------------------------------------------------------------------------
+     Return the Glyph ID for the given Unicode ID in the Microsoft UCS-4 subtable.
+     (Actually this code only depends on subtable being format 12.)
+     Return 0 if the Unicode ID is not in the subtable.
+ ----------------------------------------------------------------------------------------------*/
+ gid16 CmapSubtable12Lookup(const void * pCmap310, unsigned int uUnicodeId, int rangeKey)
+@@ -1140,49 +1200,53 @@ unsigned int CmapSubtable12NextCodepoint
+     Technically this method should return an unsigned long but it is unlikely the offset will
+         exceed 2^31.
+ ----------------------------------------------------------------------------------------------*/
+ size_t LocaLookup(gid16 nGlyphId, 
+         const void * pLoca, size_t lLocaSize, 
+         const void * pHead) // throw (std::out_of_range)
+ {
+     const Sfnt::FontHeader * pTable = reinterpret_cast<const Sfnt::FontHeader *>(pHead);
++    size_t res = -2;
+ 
+     // CheckTable verifies the index_to_loc_format is valid
+     if (be::swap(pTable->index_to_loc_format) == Sfnt::FontHeader::ShortIndexLocFormat)
+     { // loca entries are two bytes and have been divided by two
+-        if (nGlyphId < (lLocaSize >> 1) - 1) // allow sentinel value to be accessed
++        if (lLocaSize > 1 && nGlyphId + 1u < lLocaSize >> 1) // allow sentinel value to be accessed
+         {
+             const uint16 * pShortTable = reinterpret_cast<const uint16 *>(pLoca);
+-            return (be::peek<uint16>(pShortTable + nGlyphId) << 1);
++            res = be::peek<uint16>(pShortTable + nGlyphId) << 1;
++            if (res == static_cast<size_t>(be::peek<uint16>(pShortTable + nGlyphId + 1) << 1))
++                return -1;
+         }
+     }
+-    
+-    if (be::swap(pTable->index_to_loc_format) == Sfnt::FontHeader::LongIndexLocFormat)
++    else if (be::swap(pTable->index_to_loc_format) == Sfnt::FontHeader::LongIndexLocFormat)
+     { // loca entries are four bytes
+-        if (nGlyphId < (lLocaSize >> 2) - 1)
++        if (lLocaSize > 3 && nGlyphId + 1u < lLocaSize >> 2)
+         {
+             const uint32 * pLongTable = reinterpret_cast<const uint32 *>(pLoca);
+-            return be::peek<uint32>(pLongTable + nGlyphId);
++            res = be::peek<uint32>(pLongTable + nGlyphId);
++            if (res == static_cast<size_t>(be::peek<uint32>(pLongTable + nGlyphId + 1)))
++                return -1;
+         }
+     }
+ 
+     // only get here if glyph id was bad
+-    return -1;
++    return res;
+     //throw std::out_of_range("glyph id out of range for font");
+ }
+ 
+ /*----------------------------------------------------------------------------------------------
+     Return a pointer into the glyf table based on the given offset (from LocaLookup).
+     Return NULL on error.
+ ----------------------------------------------------------------------------------------------*/
+ void * GlyfLookup(const void * pGlyf, size_t nGlyfOffset, size_t nTableLen)
+ {
+     const uint8 * pByte = reinterpret_cast<const uint8 *>(pGlyf);
+-        if (nGlyfOffset == size_t(-1) || nGlyfOffset >= nTableLen)
++        if (nGlyfOffset + pByte < pByte || nGlyfOffset + sizeof(Sfnt::Glyph) >= nTableLen)
+             return NULL;
+     return const_cast<uint8 *>(pByte + nGlyfOffset);
+ }
+ 
+ /*----------------------------------------------------------------------------------------------
+     Get the bounding box coordinates for a simple glyf entry (non-composite).
+     Return true if successful, false otherwise.
+ ----------------------------------------------------------------------------------------------*/
+@@ -1784,17 +1848,16 @@ bool GlyfContourEndPoints(gid16 nGlyphId
+     cnPoints - count of points from largest end point obtained from GlyfContourEndPoints
+     prgnX & prgnY - should point to buffers large enough to hold cnPoints integers
+         The ranges are parallel so that coordinates for point(n) are found at offset n in 
+         both ranges. These points are in absolute coordinates.
+     prgfOnCurve - should point to a buffer a large enough to hold cnPoints bytes (bool)
+         This range is parallel to the prgnX & prgnY
+     Return true if successful, false otherwise. On false, all points may be INT_MIN
+         False may indicate a white space glyph, a multi-level composite, or a corrupt font
+-    // TODO: doesn't support composite glyphs whose components are themselves components
+         It's not clear from the TTF spec when the transforms should be applied. Should the 
+         transform be done before or after attachment point calcs? (current code - before) 
+         Should the transform be applied to other offsets? (currently - no; however commented 
+         out code is in place so that if CompoundGlyph::UnscaledOffset on the MS rasterizer is 
+         clear (typical) then yes, and if CompoundGlyph::ScaledOffset on the Apple rasterizer is 
+         clear (typical?) then no). See GetComponentTransform.
+         It's also unclear where point numbering with attachment poinst starts 
+         (currently - first point number is relative to whole glyph, second point number is 
+diff --git a/gfx/graphite2/src/call_machine.cpp b/gfx/graphite2/src/call_machine.cpp
+--- a/gfx/graphite2/src/call_machine.cpp
++++ b/gfx/graphite2/src/call_machine.cpp
+@@ -65,57 +65,60 @@ using namespace graphite2;
+ using namespace vm;
+ 
+ struct regbank  {
+     slotref         is;
+     slotref *       map;
+     SlotMap       & smap;
+     slotref * const map_base;
+     const instr * & ip;
++    uint8           direction;
+     int8            flags;
+ };
+ 
+ typedef bool        (* ip_t)(registers);
+ 
+ // Pull in the opcode definitions
+ // We pull these into a private namespace so these otherwise common names dont
+ // pollute the toplevel namespace.
+ namespace {
+ #define smap    reg.smap
+ #define seg     smap.segment
+ #define is      reg.is
+ #define ip      reg.ip
+ #define map     reg.map
+ #define mapb    reg.map_base
+ #define flags   reg.flags
++#define dir     reg.direction
+ 
+ #include "inc/opcodes.h"
+ 
+ #undef smap
+ #undef seg
+ #undef is
+ #undef ip
+ #undef map
+ #undef mapb
+ #undef flags
++#undef dir
+ }
+ 
+ Machine::stack_t  Machine::run(const instr   * program,
+                                const byte    * data,
+                                slotref     * & map)
+ 
+ {
+     assert(program != 0);
+ 
+     // Declare virtual machine registers
+     const instr   * ip = program-1;
+     const byte    * dp = data;
+     stack_t       * sp = _stack + Machine::STACK_GUARD,
+             * const sb = sp;
+-    regbank         reg = {*map, map, _map, _map.begin()+_map.context(), ip, 0};
++    regbank         reg = {*map, map, _map, _map.begin()+_map.context(), ip, _map.dir(), 0};
+ 
+     // Run the program        
+     while ((reinterpret_cast<ip_t>(*++ip))(dp, sp, sb, reg)) {}
+     const stack_t ret = sp == _stack+STACK_GUARD+1 ? *sp-- : 0;
+ 
+     check_final_stack(sp);
+     map = reg.map;
+     *map = reg.is;
+diff --git a/gfx/graphite2/src/direct_machine.cpp b/gfx/graphite2/src/direct_machine.cpp
+--- a/gfx/graphite2/src/direct_machine.cpp
++++ b/gfx/graphite2/src/direct_machine.cpp
+@@ -56,16 +56,17 @@ using namespace vm;
+ 
+ namespace {
+ 
+ const void * direct_run(const bool          get_table_mode,
+                         const instr       * program,
+                         const byte        * data,
+                         Machine::stack_t  * stack,
+                         slotref         * & __map,
++                        uint8                _dir,
+                         SlotMap           * __smap=0)
+ {
+     // We need to define and return to opcode table from within this function 
+     // other inorder to take the addresses of the instruction bodies.
+     #include "inc/opcode_table.h"
+     if (get_table_mode)
+         return opcode_table;
+ 
+@@ -74,16 +75,17 @@ const void * direct_run(const bool      
+     const byte        * dp = data;
+     Machine::stack_t  * sp = stack + Machine::STACK_GUARD,
+                 * const sb = sp;
+     SlotMap         & smap = *__smap;
+     Segment          & seg = smap.segment;
+     slotref             is = *__map,
+                      * map = __map,
+               * const mapb = smap.begin()+smap.context();
++    uint8            dir = _dir;
+     int8             flags = 0;
+     
+     // start the program
+     goto **ip;
+ 
+     // Pull in the opcode definitions
+     #include "inc/opcodes.h"
+     
+@@ -104,14 +106,14 @@ const opcode_t * Machine::getOpcodeTable
+ 
+ Machine::stack_t  Machine::run(const instr   * program,
+                                const byte    * data,
+                                slotref     * & is)
+ {
+     assert(program != 0);
+     
+     const stack_t *sp = static_cast<const stack_t *>(
+-                direct_run(false, program, data, _stack, is, &_map));
++                direct_run(false, program, data, _stack, is, _map.dir(), &_map));
+     const stack_t ret = sp == _stack+STACK_GUARD+1 ? *sp-- : 0;
+     check_final_stack(sp);
+     return ret;
+ }
+ 
+diff --git a/gfx/graphite2/src/files.mk b/gfx/graphite2/src/files.mk
+--- a/gfx/graphite2/src/files.mk
++++ b/gfx/graphite2/src/files.mk
+@@ -42,29 +42,32 @@
+     $($(_NS)_BASE)/src/gr_char_info.cpp \
+     $($(_NS)_BASE)/src/gr_face.cpp \
+     $($(_NS)_BASE)/src/gr_features.cpp \
+     $($(_NS)_BASE)/src/gr_font.cpp \
+     $($(_NS)_BASE)/src/gr_logging.cpp \
+     $($(_NS)_BASE)/src/gr_segment.cpp \
+     $($(_NS)_BASE)/src/gr_slot.cpp \
+     $($(_NS)_BASE)/src/json.cpp \
+-    $($(_NS)_BASE)/src/Bidi.cpp \
+     $($(_NS)_BASE)/src/CachedFace.cpp \
+     $($(_NS)_BASE)/src/CmapCache.cpp \
+     $($(_NS)_BASE)/src/Code.cpp \
++    $($(_NS)_BASE)/src/Collider.cpp \
++    $($(_NS)_BASE)/src/Decompressor.cpp \
+     $($(_NS)_BASE)/src/Face.cpp \
+     $($(_NS)_BASE)/src/FeatureMap.cpp \
+     $($(_NS)_BASE)/src/FileFace.cpp \
+     $($(_NS)_BASE)/src/Font.cpp \
+     $($(_NS)_BASE)/src/GlyphCache.cpp \
+     $($(_NS)_BASE)/src/GlyphFace.cpp \
++    $($(_NS)_BASE)/src/Intervals.cpp \
+     $($(_NS)_BASE)/src/Justifier.cpp \
+     $($(_NS)_BASE)/src/NameTable.cpp \
+     $($(_NS)_BASE)/src/Pass.cpp \
++    $($(_NS)_BASE)/src/Position.cpp \
+     $($(_NS)_BASE)/src/SegCache.cpp \
+     $($(_NS)_BASE)/src/SegCacheEntry.cpp \
+     $($(_NS)_BASE)/src/SegCacheStore.cpp \
+     $($(_NS)_BASE)/src/Segment.cpp \
+     $($(_NS)_BASE)/src/Silf.cpp \
+     $($(_NS)_BASE)/src/Slot.cpp \
+     $($(_NS)_BASE)/src/Sparse.cpp \
+     $($(_NS)_BASE)/src/TtfUtil.cpp \
+@@ -73,25 +76,29 @@
+ $(_NS)_PRIVATE_HEADERS = \
+     $($(_NS)_BASE)/src/inc/bits.h \
+     $($(_NS)_BASE)/src/inc/debug.h \
+     $($(_NS)_BASE)/src/inc/json.h \
+     $($(_NS)_BASE)/src/inc/CachedFace.h \
+     $($(_NS)_BASE)/src/inc/CharInfo.h \
+     $($(_NS)_BASE)/src/inc/CmapCache.h \
+     $($(_NS)_BASE)/src/inc/Code.h \
++    $($(_NS)_BASE)/src/inc/Collider.h \
++    $($(_NS)_BASE)/src/inc/Compression.h \
++    $($(_NS)_BASE)/src/inc/Decompressor.h \
+     $($(_NS)_BASE)/src/inc/Endian.h \
+     $($(_NS)_BASE)/src/inc/Error.h \
+     $($(_NS)_BASE)/src/inc/Face.h \
+     $($(_NS)_BASE)/src/inc/FeatureMap.h \
+     $($(_NS)_BASE)/src/inc/FeatureVal.h \
+     $($(_NS)_BASE)/src/inc/FileFace.h \
+     $($(_NS)_BASE)/src/inc/Font.h \
+     $($(_NS)_BASE)/src/inc/GlyphCache.h \
+     $($(_NS)_BASE)/src/inc/GlyphFace.h \
++    $($(_NS)_BASE)/src/inc/Intervals.h \
+     $($(_NS)_BASE)/src/inc/List.h \
+     $($(_NS)_BASE)/src/inc/locale2lcid.h \
+     $($(_NS)_BASE)/src/inc/Machine.h \
+     $($(_NS)_BASE)/src/inc/Main.h \
+     $($(_NS)_BASE)/src/inc/NameTable.h \
+     $($(_NS)_BASE)/src/inc/opcode_table.h \
+     $($(_NS)_BASE)/src/inc/opcodes.h \
+     $($(_NS)_BASE)/src/inc/Pass.h \
+diff --git a/gfx/graphite2/src/gr_face.cpp b/gfx/graphite2/src/gr_face.cpp
+--- a/gfx/graphite2/src/gr_face.cpp
++++ b/gfx/graphite2/src/gr_face.cpp
+@@ -41,17 +41,17 @@ extern json *global_log;
+ 
+ namespace
+ {
+     bool load_face(Face & face, unsigned int options)
+     {
+ #ifdef GRAPHITE2_TELEMETRY
+         telemetry::category _misc_cat(face.tele.misc);
+ #endif
+-        Face::Table silf(face, Tag::Silf);
++        Face::Table silf(face, Tag::Silf, 0x00050000);
+         if (silf)   options &= ~gr_face_dumbRendering;
+         else if (!(options &  gr_face_dumbRendering))
+             return false;
+ 
+         if (!face.readGlyphs(options))
+             return false;
+ 
+         if (silf)
+diff --git a/gfx/graphite2/src/gr_logging.cpp b/gfx/graphite2/src/gr_logging.cpp
+--- a/gfx/graphite2/src/gr_logging.cpp
++++ b/gfx/graphite2/src/gr_logging.cpp
+@@ -19,24 +19,25 @@
+     Suite 500, Boston, MA 02110-1335, USA or visit their web page on the 
+     internet at http://www.fsf.org/licenses/lgpl.html.
+ 
+ Alternatively, the contents of this file may be used under the terms of the
+ Mozilla Public License (http://mozilla.org/MPL) or the GNU General Public
+ License, as published by the Free Software Foundation, either version 2
+ of the License or (at your option) any later version.
+ */
+-#include <stdio.h>
++#include <cstdio>
+ 
+ #include "graphite2/Log.h"
+ #include "inc/debug.h"
+ #include "inc/CharInfo.h"
+ #include "inc/Slot.h"
+ #include "inc/Segment.h"
+ #include "inc/json.h"
++#include "inc/Collider.h"
+ 
+ #if defined _WIN32
+ #include "windows.h"
+ #endif
+ 
+ using namespace graphite2;
+ 
+ #if !defined GRAPHITE2_NTRACING
+@@ -179,16 +180,17 @@ json & graphite2::operator << (json & j,
+ 
+ 
+ json & graphite2::operator << (json & j, const dslot & ds) throw()
+ {
+     assert(ds.first);
+     assert(ds.second);
+     const Segment & seg = *ds.first;
+     const Slot & s = *ds.second;
++    const SlotCollision *cslot = seg.collisionInfo(ds.second);
+ 
+     j << json::object
+         << "id"             << objectid(ds)
+         << "gid"            << s.gid()
+         << "charinfo" << json::flat << json::object
+             << "original"       << s.original()
+             << "before"         << s.before()
+             << "after"          << s.after()
+@@ -215,16 +217,38 @@ json & graphite2::operator << (json & j,
+         j   << json::close;
+     if (s.firstChild())
+     {
+         j   << "children" << json::flat << json::array;
+         for (const Slot *c = s.firstChild(); c; c = c->nextSibling())
+             j   << objectid(dslot(&seg, c));
+         j       << json::close;
+     }
++    if (cslot)
++    {
++		// Note: the reason for using Positions to lump together related attributes is to make the 
++		// JSON output slightly more compact.
++        j << "collision" << json::flat << json::object
++//              << "shift" << cslot->shift() -- not used pass level, only within the collision routine itself
++              << "offset" << cslot->offset()
++              << "limit" << cslot->limit()
++              << "flags" << cslot->flags()
++              << "margin" << Position(cslot->margin(), cslot->marginWt())
++              << "exclude" << cslot->exclGlyph()
++              << "excludeoffset" << cslot->exclOffset();
++		if (cslot->seqOrder() != 0)
++		{
++			j << "seqclass" << Position(cslot->seqClass(), cslot->seqProxClass())
++				<< "seqorder" << cslot->seqOrder()
++				<< "seqabove" << Position(cslot->seqAboveXoff(), cslot->seqAboveWt())
++				<< "seqbelow" << Position(cslot->seqBelowXlim(), cslot->seqBelowWt())
++				<< "seqvalign" << Position(cslot->seqValignHt(), cslot->seqValignWt());
++		}
++        j << json::close;
++    }
+     return j << json::close;
+ }
+ 
+ 
+ graphite2::objectid::objectid(const dslot & ds) throw()
+ {
+     const Slot * const p = ds.second;
+     uint32 s = reinterpret_cast<size_t>(p);
+diff --git a/gfx/graphite2/src/gr_segment.cpp b/gfx/graphite2/src/gr_segment.cpp
+--- a/gfx/graphite2/src/gr_segment.cpp
++++ b/gfx/graphite2/src/gr_segment.cpp
+@@ -43,21 +43,17 @@ namespace
+       Segment* pRes=new Segment(nChars, face, script, dir);
+ 
+       
+       if (!pRes->read_text(face, pFeats, enc, pStart, nChars) || !pRes->runGraphite())
+       {
+         delete pRes;
+         return NULL;
+       }
+-      // run the line break passes
+-      // run the substitution passes
+-      pRes->prepare_pos(font);
+-      // run the positioning passes
+-      pRes->finalise(font);
++      pRes->finalise(font, true);
+ 
+       return static_cast<gr_segment*>(pRes);
+   }
+ 
+ 
+ }
+ 
+ 
+diff --git a/gfx/graphite2/src/gr_slot.cpp b/gfx/graphite2/src/gr_slot.cpp
+--- a/gfx/graphite2/src/gr_slot.cpp
++++ b/gfx/graphite2/src/gr_slot.cpp
+@@ -98,21 +98,21 @@ float gr_slot_advance_X(const gr_slot* p
+         if (face && font->isHinted())
+             res = (res - face->glyphs().glyph(p->gid())->theAdvance().x) * scale + font->advance(p->gid());
+         else
+             res = res * scale;
+     }
+     return res;
+ }
+ 
+-float gr_slot_advance_Y(const gr_slot *p/*not NULL*/, const gr_face *face, const gr_font *font)
++float gr_slot_advance_Y(const gr_slot *p/*not NULL*/, GR_MAYBE_UNUSED const gr_face *face, const gr_font *font)
+ {
+     assert(p);
+     float res = p->advancePos().y;
+-    if (font && (face || !face))
++    if (font)
+         return res * font->scale();
+     else
+         return res;
+ }
+         
+ int gr_slot_before(const gr_slot* p/*not NULL*/)
+ {
+     assert(p);
+diff --git a/gfx/graphite2/src/inc/Code.h b/gfx/graphite2/src/inc/Code.h
+--- a/gfx/graphite2/src/inc/Code.h
++++ b/gfx/graphite2/src/inc/Code.h
+@@ -36,32 +36,41 @@ of the License or (at your option) any l
+ #include "inc/Main.h"
+ #include "inc/Machine.h"
+ 
+ namespace graphite2 {
+ 
+ class Silf;
+ class Face;
+ 
++enum passtype {
++    PASS_TYPE_UNKNOWN = 0,
++    PASS_TYPE_LINEBREAK,
++    PASS_TYPE_SUBSTITUTE,
++    PASS_TYPE_POSITIONING,
++    PASS_TYPE_JUSTIFICATION
++};
++
+ namespace vm {
+ 
+ class Machine::Code
+ {
+ public:
+     enum status_t 
+     {
+         loaded,
+         alloc_failed, 
+         invalid_opcode, 
+         unimplemented_opcode_used,
+         out_of_range_data,
+         jump_past_end,
+         arguments_exhausted,
+         missing_return,
+-        nested_context_item
++        nested_context_item,
++        underfull_stack
+     };
+ 
+ private:
+     class decoder;
+ 
+     instr *     _code;
+     byte  *     _data;
+     size_t      _data_size,
+@@ -72,40 +81,51 @@ private:
+                 _modify,
+                 _delete;
+     mutable bool _own;
+ 
+     void release_buffers() throw ();
+     void failure(const status_t) throw();
+ 
+ public:
++    static size_t estimateCodeDataOut(size_t num_bytecodes);
++
+     Code() throw();
+     Code(bool is_constraint, const byte * bytecode_begin, const byte * const bytecode_end,
+-         uint8 pre_context, uint16 rule_length, const Silf &, const Face &);
++         uint8 pre_context, uint16 rule_length, const Silf &, const Face &,
++         enum passtype pt, byte * * const _out = 0);
+     Code(const Machine::Code &) throw();
+     ~Code() throw();
+     
+     Code & operator=(const Code &rhs) throw();
+-    operator bool () const throw();
+-    status_t      status() const throw();
+-    bool          constraint() const throw();
+-    size_t        dataSize() const throw();
+-    size_t        instructionCount() const throw();
+-    bool          immutable() const throw();
+-    bool          deletes() const throw();
+-    size_t        maxRef() const throw();
++    operator bool () const throw()                  { return _code && status() == loaded; }
++    status_t      status() const throw()            { return _status; }
++    bool          constraint() const throw()        { return _constraint; }
++    size_t        dataSize() const throw()          { return _data_size; }
++    size_t        instructionCount() const throw()  { return _instr_count; }
++    bool          immutable() const throw()         { return !(_delete || _modify); }
++    bool          deletes() const throw()           { return _delete; }
++    size_t        maxRef() const throw()            { return _max_ref; }
++    void          externalProgramMoved(ptrdiff_t) throw();
+ 
+     int32 run(Machine &m, slotref * & map) const;
+     
+     CLASS_NEW_DELETE;
+ };
+ 
++inline
++size_t  Machine::Code::estimateCodeDataOut(size_t n_bc)
++{
++    return n_bc * (sizeof(instr)+sizeof(byte));
++}
++
++
+ inline Machine::Code::Code() throw()
+ : _code(0), _data(0), _data_size(0), _instr_count(0), _max_ref(0),
+-  _status(loaded), _constraint(false), _modify(false),_delete(false),
++  _status(loaded), _constraint(false), _modify(false), _delete(false),
+   _own(false)
+ {
+ }
+ 
+ inline Machine::Code::Code(const Machine::Code &obj) throw ()
+  :  _code(obj._code), 
+     _data(obj._data), 
+     _data_size(obj._data_size), 
+@@ -131,45 +151,19 @@ inline Machine::Code & Machine::Code::op
+     _constraint  = rhs._constraint;
+     _modify      = rhs._modify;
+     _delete      = rhs._delete;
+     _own         = rhs._own; 
+     rhs._own = false;
+     return *this;
+ }
+ 
+-inline Machine::Code::operator bool () const throw () {
+-    return _code && status() == loaded;
+-}
+-
+-inline Machine::Code::status_t Machine::Code::status() const throw() {
+-    return _status;
+-}
+-
+-inline bool Machine::Code::constraint() const throw() {
+-    return _constraint;
+-}
+-
+-inline size_t Machine::Code::dataSize() const throw() {
+-    return _data_size;
+-}
+-
+-inline size_t Machine::Code::instructionCount() const throw() {
+-    return _instr_count;
+-}
+-
+-inline bool Machine::Code::immutable() const throw()
++inline void Machine::Code::externalProgramMoved(ptrdiff_t dist) throw()
+ {
+-  return !(_delete || _modify);
+-}
+-
+-inline bool Machine::Code::deletes() const throw()
+-{
+-  return _delete;
+-}
+-
+-inline size_t Machine::Code::maxRef() const throw()
+-{
+-    return _max_ref;
++    if (_code && !_own)
++    {
++        _code += dist / sizeof(instr);
++        _data += dist;
++    }
+ }
+ 
+ } // namespace vm
+ } // namespace graphite2
+diff --git a/gfx/graphite2/src/inc/Collider.h b/gfx/graphite2/src/inc/Collider.h
+new file mode 100644
+--- /dev/null
++++ b/gfx/graphite2/src/inc/Collider.h
+@@ -0,0 +1,242 @@
++/*  GRAPHITE2 LICENSING
++
++    Copyright 2010, SIL International
++    All rights reserved.
++
++    This library is free software; you can redistribute it and/or modify
++    it under the terms of the GNU Lesser General Public License as published
++    by the Free Software Foundation; either version 2.1 of License, or
++    (at your option) any later version.
++
++    This program is distributed in the hope that it will be useful,
++    but WITHOUT ANY WARRANTY; without even the implied warranty of
++    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++    Lesser General Public License for more details.
++
++    You should also have received a copy of the GNU Lesser General Public
++    License along with this library in the file named "LICENSE".
++    If not, write to the Free Software Foundation, 51 Franklin Street, 
++    Suite 500, Boston, MA 02110-1335, USA or visit their web page on the 
++    internet at http://www.fsf.org/licenses/lgpl.html.
++
++Alternatively, the contents of this file may be used under the terms of the
++Mozilla Public License (http://mozilla.org/MPL) or the GNU General Public
++License, as published by the Free Software Foundation, either version 2
++of the License or (at your option) any later version.
++*/
++#pragma once
++
++#include "inc/List.h"
++#include "inc/Position.h"
++#include "inc/Intervals.h"
++#include "inc/debug.h"
++
++namespace graphite2 {
++
++class json;
++class Slot;
++class Segment;
++
++#define SLOTCOLSETUINTPROP(x, y) uint16 x() const { return _ ##x; } void y (uint16 v) { _ ##x = v; }
++#define SLOTCOLSETINTPROP(x, y) int16 x() const { return _ ##x; } void y (int16 v) { _ ##x = v; }
++#define SLOTCOLSETPOSITIONPROP(x, y) const Position &x() const { return _ ##x; } void y (const Position &v) { _ ##x = v; }
++
++// Slot attributes related to collision-fixing
++class SlotCollision
++{
++public:
++    enum {
++    //  COLL_TESTONLY = 0,  // default - test other glyphs for collision with this one, but don't move this one
++        COLL_FIX = 1,       // fix collisions involving this glyph
++        COLL_IGNORE = 2,    // ignore this glyph altogether
++        COLL_START = 4,     // start of range of possible collisions
++        COLL_END = 8,       // end of range of possible collisions
++        COLL_KERN = 16,     // collisions with this glyph are fixed by adding kerning space after it
++        COLL_ISCOL = 32,    // this glyph has a collision
++        COLL_KNOWN = 64,    // we've figured out what's happening with this glyph
++        COLL_TEMPLOCK = 128,    // Lock glyphs that have been given priority positioning
++        ////COLL_JUMPABLE = 128,    // moving glyphs may jump this stationary glyph in any direction - DELETE
++        ////COLL_OVERLAP = 256,    // use maxoverlap to restrict - DELETE
++    };
++    
++    // Behavior for the collision.order attribute. To GDL this is an enum, to us it's a bitfield, with only 1 bit set
++    // Allows for easier inversion.
++    enum {
++        SEQ_ORDER_LEFTDOWN = 1,
++        SEQ_ORDER_RIGHTUP = 2,
++        SEQ_ORDER_NOABOVE = 4,
++        SEQ_ORDER_NOBELOW = 8,
++        SEQ_ORDER_NOLEFT = 16,
++        SEQ_ORDER_NORIGHT = 32
++    };
++    
++    SlotCollision(Segment *seg, Slot *slot);
++    void initFromSlot(Segment *seg, Slot *slot);
++    
++    const Rect &limit() const { return _limit; }
++    void setLimit(const Rect &r) { _limit = r; }
++    SLOTCOLSETPOSITIONPROP(shift, setShift)
++    SLOTCOLSETPOSITIONPROP(offset, setOffset)
++    SLOTCOLSETPOSITIONPROP(exclOffset, setExclOffset)
++    SLOTCOLSETUINTPROP(margin, setMargin)
++    SLOTCOLSETUINTPROP(marginWt, setMarginWt)
++    SLOTCOLSETUINTPROP(flags, setFlags)
++    SLOTCOLSETUINTPROP(exclGlyph, setExclGlyph)
++    SLOTCOLSETUINTPROP(seqClass, setSeqClass)
++    SLOTCOLSETUINTPROP(seqProxClass, setSeqProxClass)
++    SLOTCOLSETUINTPROP(seqOrder, setSeqOrder)
++    SLOTCOLSETINTPROP(seqAboveXoff, setSeqAboveXoff)
++    SLOTCOLSETUINTPROP(seqAboveWt, setSeqAboveWt)
++    SLOTCOLSETINTPROP(seqBelowXlim, setSeqBelowXlim)
++    SLOTCOLSETUINTPROP(seqBelowWt, setSeqBelowWt)
++    SLOTCOLSETUINTPROP(seqValignHt, setSeqValignHt)
++    SLOTCOLSETUINTPROP(seqValignWt, setSeqValignWt)
++
++    float getKern(int dir) const;
++    
++private:
++    Rect        _limit;
++    Position    _shift;     // adjustment within the given pass
++    Position    _offset;    // total adjustment for collisions
++    Position    _exclOffset;
++    uint16		_margin;
++    uint16		_marginWt;
++    uint16		_flags;
++    uint16		_exclGlyph;
++    uint16		_seqClass;
++	uint16		_seqProxClass;
++    uint16		_seqOrder;
++    int16		_seqAboveXoff;
++    uint16		_seqAboveWt;
++    int16		_seqBelowXlim;
++    uint16		_seqBelowWt;
++    uint16		_seqValignHt;
++    uint16		_seqValignWt;
++	
++};  // end of class SlotColllision
++
++struct BBox;
++struct SlantBox;
++
++class ShiftCollider
++{
++public:
++    typedef std::pair<float, float> fpair;
++    typedef Vector<fpair> vfpairs;
++    typedef vfpairs::iterator ivfpairs;
++
++    ShiftCollider(json *dbgout);
++    ~ShiftCollider() throw() { };
++
++    bool initSlot(Segment *seg, Slot *aSlot, const Rect &constraint,
++                float margin, float marginMin, const Position &currShift,
++                const Position &currOffset, int dir, GR_MAYBE_UNUSED json * const dbgout);
++    bool mergeSlot(Segment *seg, Slot *slot, const Position &currShift, bool isAfter, 
++                bool sameCluster, bool &hasCol, bool isExclusion, GR_MAYBE_UNUSED json * const dbgout);
++    Position resolve(Segment *seg, bool &isCol, GR_MAYBE_UNUSED json * const dbgout);
++    void addBox_slope(bool isx, const Rect &box, const BBox &bb, const SlantBox &sb, const Position &org, float weight, float m, bool minright, int mode);
++    void removeBox(const Rect &box, const BBox &bb, const SlantBox &sb, const Position &org, int mode);
++    const Position &origin() const { return _origin; }
++
++#if !defined GRAPHITE2_NTRACING
++	void outputJsonDbg(json * const dbgout, Segment *seg, int axis);
++	void outputJsonDbgStartSlot(json * const dbgout, Segment *seg);
++	void outputJsonDbgEndSlot(json * const dbgout, Position resultPos, int bestAxis, bool isCol);
++	void outputJsonDbgOneVector(json * const dbgout, Segment *seg, int axis, float tleft, float bestCost, float bestVal);
++	void outputJsonDbgRawRanges(json * const dbgout, int axis);
++	void outputJsonDbgRemovals(json * const dbgout, int axis, Segment *seg);
++#endif
++
++    CLASS_NEW_DELETE;
++
++protected:
++    Zones _ranges[4];   // possible movements in 4 directions (horizontally, vertically, diagonally);
++    Slot *  _target;    // the glyph to fix
++    Rect    _limit;
++    Position _currShift;
++    Position _currOffset;
++    Position _origin;   // Base for all relative calculations
++    float   _margin;
++	float	_marginWt;
++    float   _len[4];
++    uint16  _seqClass;
++	uint16	_seqProxClass;
++    uint16  _seqOrder;
++    
++	//bool _scraping[4];
++
++};	// end of class ShiftCollider
++
++inline
++ShiftCollider::ShiftCollider(GR_MAYBE_UNUSED json *dbgout)
++: _target(0),
++  _margin(0.0),
++  _marginWt(0.0),
++  _seqClass(0),
++  _seqProxClass(0),
++  _seqOrder(0)
++{
++#if !defined GRAPHITE2_NTRACING
++    for (int i = 0; i < 4; ++i)
++        _ranges[i].setdebug(dbgout);
++#endif
++}
++
++class KernCollider
++{
++public:
++    KernCollider(json *dbg);
++    ~KernCollider() throw() { };
++    bool initSlot(Segment *seg, Slot *aSlot, const Rect &constraint, float margin,
++            const Position &currShift, const Position &offsetPrev, int dir,
++            float ymin, float ymax, json * const dbgout);
++    bool mergeSlot(Segment *seg, Slot *slot, const Position &currShift, float currSpace, int dir, json * const dbgout);
++    Position resolve(Segment *seg, Slot *slot, int dir, float margin, json * const dbgout);
++    void shift(const Position &mv, int dir);
++
++    CLASS_NEW_DELETE;
++
++private:
++    Slot *  _target;        // the glyph to fix
++    Rect    _limit;
++    float   _margin;
++    Position _offsetPrev;   // kern from a previous pass
++    Position _currShift;    // NOT USED??
++    float _miny;	        // y-coordinates offset by global slot position
++    float _maxy;
++    Vector<float> _edges;   // edges of horizontal slices
++    float _sliceWidth;      // width of each slice
++    float _mingap;
++    float _xbound;        // max or min edge
++
++#if !defined GRAPHITE2_NTRACING    
++    // Debugging
++    Segment * _seg;
++    Vector<float> _nearEdges; // closest potential collision in each slice
++    Vector<Slot*> _slotNear;
++#endif
++};	// end of class KernCollider
++
++
++inline
++float sqr(float x) {
++    return x * x;
++}
++
++inline
++KernCollider::KernCollider(GR_MAYBE_UNUSED json *dbg)
++: _target(0),
++  _margin(0.0f),
++  _miny(-1e38f),
++  _maxy(1e38f),
++  _sliceWidth(0.0f),
++  _mingap(0.0f),
++  _xbound(0.0)
++{
++#if !defined GRAPHITE2_NTRACING
++    _seg = 0;
++#endif
++};
++
++};  // end of namespace graphite2
++
+diff --git a/gfx/graphite2/src/inc/Compression.h b/gfx/graphite2/src/inc/Compression.h
+new file mode 100644
+--- /dev/null
++++ b/gfx/graphite2/src/inc/Compression.h
+@@ -0,0 +1,103 @@
++/*  GRAPHITE2 LICENSING
++
++    Copyright 2015, SIL International
++    All rights reserved.
++
++    This library is free software; you can redistribute it and/or modify
++    it under the terms of the GNU Lesser General Public License as published
++    by the Free Software Foundation; either version 2.1 of License, or
++    (at your option) any later version.
++
++    This program is distributed in the hope that it will be useful,
++    but WITHOUT ANY WARRANTY; without even the implied warranty of
++    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++    Lesser General Public License for more details.
++
++    You should also have received a copy of the GNU Lesser General Public
++    License along with this library in the file named "LICENSE".
++    If not, write to the Free Software Foundation, 51 Franklin Street, 
++    Suite 500, Boston, MA 02110-1335, USA or visit their web page on the 
++    internet at http://www.fsf.org/licenses/lgpl.html.
++
++Alternatively, the contents of this file may be used under the terms of the
++Mozilla Public License (http://mozilla.org/MPL) or the GNU General Public
++License, as published by the Free Software Foundation, either version 2
++of the License or (at your option) any later version.
++*/
++
++#pragma once
++
++#include <cassert>
++#include <cstddef>
++#include <cstring>
++
++namespace
++{
++
++#if defined(_MSC_VER)
++typedef unsigned __int8 u8;
++typedef unsigned __int16 u16;
++typedef unsigned __int32 u32;
++typedef unsigned __int64 u64;
++#else
++#include <stdint.h>
++typedef uint8_t u8;
++typedef uint16_t u16;
++typedef uint32_t u32;
++typedef uint64_t u64;
++#endif
++
++ptrdiff_t const     MINMATCH  = 4;
++
++template<int S>
++inline 
++void unaligned_copy(void * d, void const * s) {
++  ::memcpy(d, s, S);
++}
++
++inline
++size_t align(size_t p) {
++    return (p + sizeof(unsigned long)-1) & ~(sizeof(unsigned long)-1);
++}
++
++inline 
++u8 * safe_copy(u8 * d, u8 const * s, size_t n) {
++    while (n--) *d++ = *s++;
++    return d;
++}
++
++inline
++u8 * overrun_copy(u8 * d, u8 const * s, size_t n) {
++    size_t const WS = sizeof(unsigned long);
++    u8 const * e = s + n;
++    do 
++    {
++        unaligned_copy<WS>(d, s);
++        d += WS;
++        s += WS;
++    }
++    while (s < e);
++    d-=(s-e);
++    
++    return d;
++}
++
++
++inline
++u8 * fast_copy(u8 * d, u8 const * s, size_t n) {
++    size_t const WS = sizeof(unsigned long);
++    size_t wn = n/WS;
++    while (wn--) 
++    {
++        unaligned_copy<WS>(d, s);
++        d += WS;
++        s += WS;
++    }
++    n &= WS-1;
++    return safe_copy(d, s, n);
++}
++
++
++} // end of anonymous namespace
++
++
+diff --git a/gfx/graphite2/src/inc/Decompressor.h b/gfx/graphite2/src/inc/Decompressor.h
+new file mode 100644
+--- /dev/null
++++ b/gfx/graphite2/src/inc/Decompressor.h
+@@ -0,0 +1,56 @@
++/*  GRAPHITE2 LICENSING
++
++    Copyright 2015, SIL International
++    All rights reserved.
++
++    This library is free software; you can redistribute it and/or modify
++    it under the terms of the GNU Lesser General Public License as published
++    by the Free Software Foundation; either version 2.1 of License, or
++    (at your option) any later version.
++
++    This program is distributed in the hope that it will be useful,
++    but WITHOUT ANY WARRANTY; without even the implied warranty of
++    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++    Lesser General Public License for more details.
++
++    You should also have received a copy of the GNU Lesser General Public
++    License along with this library in the file named "LICENSE".
++    If not, write to the Free Software Foundation, 51 Franklin Street, 
++    Suite 500, Boston, MA 02110-1335, USA or visit their web page on the 
++    internet at http://www.fsf.org/licenses/lgpl.html.
++
++Alternatively, the contents of this file may be used under the terms of the
++Mozilla Public License (http://mozilla.org/MPL) or the GNU General Public
++License, as published by the Free Software Foundation, either version 2
++of the License or (at your option) any later version.
++*/
++
++#pragma once
++
++#include <cstddef>
++
++namespace lz4
++{
++
++// decompress an LZ4 block
++// Parameters:
++//      @in         -   Input buffer containing an LZ4 block.
++//      @in_size    -   Size of the input LZ4 block in bytes.
++//      @out        -   Output buffer to hold decompressed results.
++//      @out_size   -   The size of the buffer pointed to by @out.
++// Invariants:
++//      @in         -   This buffer must be at least 1 machine word in length,
++//                      regardless of the actual LZ4 block size.
++//      @in_size    -   This must be at least 4 and must also be <= to the
++//                      allocated buffer @in.
++//      @out        -   This must be bigger than the input buffer and at least
++//                      13 bytes.
++//      @out_size   -   Must always be big enough to hold the expected size.
++// Return:
++//      -1          -  Decompression failed.
++//      size        -  Actual number of bytes decompressed.
++int decompress(void const *in, size_t in_size, void *out, size_t out_size);
++
++} // end of namespace shrinker
++
++
+diff --git a/gfx/graphite2/src/inc/Error.h b/gfx/graphite2/src/inc/Error.h
+--- a/gfx/graphite2/src/inc/Error.h
++++ b/gfx/graphite2/src/inc/Error.h
+@@ -106,22 +106,30 @@ enum errors {
+     E_BADRULECCODEPTR = 45, // The rule constraint code position does not align with where the forward reference says it should be
+     E_BADCCODELEN = 46,     // Bad rule/pass constraint code length
+     E_BADACTIONCODEPTR = 47,    // The action code position does not align with where the forward reference says it should be
+     E_MUTABLECCODE = 48,    // Constraint code edits slots. It shouldn't.
+     E_BADSTATE = 49,        // Bad state transition referencing an illegal state
+     E_BADRULEMAPPING = 50,  // The structure of the rule mapping is bad
+     E_BADRANGE = 51,        // Bad column range structure including a glyph in more than one column
+     E_BADRULENUM = 52,      // A reference to a rule is out of range (too high)
++    E_BADACOLLISION = 53,   // Bad Silf table collision attribute number (too high)
++    E_BADEMPTYPASS = 54,    // Can't have empty passes (no rules) except for collision passes
++    E_BADSILFVERSION = 55,  // The Silf table has a bad version (probably too high)
++    E_BADCOLLISIONPASS = 56,    // Collision flags set on a non positioning pass
++    E_BADNUMCOLUMNS = 57,   // Arbitrarily limit number of columns in fsm
+ // Code errors
+     E_CODEFAILURE = 60,     // Base code error. The following subcodes must align with Machine::Code::status_t in Code.h
+-        E_CODEALLOC = 61,       // Out of memory
+-        E_INVALIDOPCODE = 62,   // Invalid op code
+-        E_UNIMPOPCODE = 63,     // Unimplemented op code encountered
+-        E_OUTOFRANGECODE = 64,  // Code argument out of range
+-        E_BADJUMPCODE = 65,     // Code jumps past end of op codes
+-        E_CODEBADARGS = 66,     // Code arguments exhausted
+-        E_CODENORETURN = 67,    // Missing return type op code at end of code
+-        E_CODENESTEDCTXT = 68   // Nested context encountered in code
++    E_CODEALLOC = 61,       // Out of memory
++    E_INVALIDOPCODE = 62,   // Invalid op code
++    E_UNIMPOPCODE = 63,     // Unimplemented op code encountered
++    E_OUTOFRANGECODE = 64,  // Code argument out of range
++    E_BADJUMPCODE = 65,     // Code jumps past end of op codes
++    E_CODEBADARGS = 66,     // Code arguments exhausted
++    E_CODENORETURN = 67,    // Missing return type op code at end of code
++    E_CODENESTEDCTXT = 68,   // Nested context encountered in code
++// Compression errors
++    E_BADSCHEME = 69,
++    E_SHRINKERFAILED = 70,
+ };
+ 
+ }
+ 
+diff --git a/gfx/graphite2/src/inc/Face.h b/gfx/graphite2/src/inc/Face.h
+--- a/gfx/graphite2/src/inc/Face.h
++++ b/gfx/graphite2/src/inc/Face.h
+@@ -21,33 +21,34 @@
+ 
+ Alternatively, the contents of this file may be used under the terms of the
+ Mozilla Public License (http://mozilla.org/MPL) or the GNU General Public
+ License, as published by the Free Software Foundation, either version 2
+ of the License or (at your option) any later version.
+ */
+ #pragma once
+ 
+-#include <stdio.h>
++#include <cstdio>
+ 
+ #include "graphite2/Font.h"
+ 
+ #include "inc/Main.h"
+ #include "inc/FeatureMap.h"
+ #include "inc/TtfUtil.h"
+ #include "inc/Silf.h"
+ #include "inc/Error.h"
+ 
+ namespace graphite2 {
+ 
+ class Cmap;
+ class FileFace;
+ class GlyphCache;
+ class NameTable;
+ class json;
++class Font;
+ 
+ 
+ using TtfUtil::Tag;
+ 
+ // These are the actual tags, as distinct from the consecutive IDs in TtfUtil.h
+ 
+ class Face
+ {
+@@ -165,47 +166,51 @@ json * Face::logger() const throw()
+ 
+ 
+ 
+ class Face::Table
+ {
+     const Face *            _f;
+     mutable const byte *    _p;
+     uint32                  _sz;
++    bool                    _compressed;
++
++    Error decompress();
++
++    void releaseBuffers();
+ 
+ public:
+     Table() throw();
+-    Table(const Face & face, const Tag n) throw();
++    Table(const Face & face, const Tag n, uint32 version=0xffffffff) throw();
+     Table(const Table & rhs) throw();
+     ~Table() throw();
+ 
+     operator const byte * () const throw();
+ 
+     Table & operator = (const Table & rhs) throw();
+     size_t  size() const throw();
+ };
+ 
+ inline
+ Face::Table::Table() throw()
+-: _f(0), _p(0), _sz(0)
++: _f(0), _p(0), _sz(0), _compressed(false)
+ {
+ }
+ 
+ inline
+ Face::Table::Table(const Table & rhs) throw()
+-: _f(rhs._f), _p(rhs._p), _sz(rhs._sz)
++: _f(rhs._f), _p(rhs._p), _sz(rhs._sz), _compressed(rhs._compressed)
+ {
+     rhs._p = 0;
+ }
+ 
+ inline
+ Face::Table::~Table() throw()
+ {
+-    if (_p && _f->m_ops.release_table)
+-        (*_f->m_ops.release_table)(_f->m_appFaceHandle, _p);
++    releaseBuffers();
+ }
+ 
+ inline
+ Face::Table::operator const byte * () const throw()
+ {
+     return _p;
+ }
+ 
+diff --git a/gfx/graphite2/src/inc/FeatureMap.h b/gfx/graphite2/src/inc/FeatureMap.h
+--- a/gfx/graphite2/src/inc/FeatureMap.h
++++ b/gfx/graphite2/src/inc/FeatureMap.h
+@@ -51,17 +51,17 @@ private:
+ };
+ 
+ class FeatureRef
+ {
+     typedef uint32      chunk_t;
+     static const uint8  SIZEOF_CHUNK = sizeof(chunk_t)*8;
+ 
+ public:
+-    FeatureRef() : m_nameValues(0) {}
++    FeatureRef();
+     FeatureRef(const Face & face, unsigned short & bits_offset, uint32 max_val,
+                uint32 name, uint16 uiName, uint16 flags,
+                FeatureSetting *settings, uint16 num_set) throw();
+     ~FeatureRef() throw();
+ 
+     bool applyValToFeature(uint32 val, Features& pDest) const; //defined in GrFaceImp.h
+     void maskFeature(Features & pDest) const {
+     if (m_index < pDest.size())                 //defensive
+@@ -94,16 +94,26 @@ private:
+     byte    m_bits,             // how many bits to shift the value into place
+             m_index;            // index into the array to find the ulong to mask
+ 
+ private:        //unimplemented
+     FeatureRef& operator=(const FeatureRef&);
+ };
+ 
+ 
++inline
++FeatureRef::FeatureRef()
++: m_pFace(0), m_nameValues(0),
++  m_mask(0), m_max(0), m_id(0),
++  m_nameid(0), m_flags(0), m_numSet(0),
++  m_bits(0), m_index(0)
++{
++}
++
++
+ class NameAndFeatureRef
+ {
+   public:
+     NameAndFeatureRef(uint32 name = 0) : m_name(name) , m_pFRef(NULL){}
+     NameAndFeatureRef(const FeatureRef* p/*not NULL*/) : m_name(p->getId()), m_pFRef(p) {}
+ 
+     bool operator<(const NameAndFeatureRef& rhs) const //orders by m_name
+         {   return m_name<rhs.m_name; }
+@@ -112,35 +122,34 @@ class NameAndFeatureRef
+  
+     uint32 m_name;
+     const FeatureRef* m_pFRef;
+ };
+ 
+ class FeatureMap
+ {
+ public:
+-    FeatureMap() : m_numFeats(0), m_feats(NULL), m_pNamedFeats(NULL),
+-        m_defaultFeatures(NULL) {}
+-    ~FeatureMap() { delete [] m_feats; delete[] m_pNamedFeats; delete m_defaultFeatures; }
++    FeatureMap() : m_numFeats(0), m_feats(NULL), m_pNamedFeats(NULL) {}
++    ~FeatureMap() { delete [] m_feats; delete[] m_pNamedFeats; }
+ 
+     bool readFeats(const Face & face);
+     const FeatureRef *findFeatureRef(uint32 name) const;
+     FeatureRef *feature(uint16 index) const { return m_feats + index; }
+     //GrFeatureRef *featureRef(byte index) { return index < m_numFeats ? m_feats + index : NULL; }
+     const FeatureRef *featureRef(byte index) const { return index < m_numFeats ? m_feats + index : NULL; }
+     FeatureVal* cloneFeatures(uint32 langname/*0 means default*/) const;      //call destroy_Features when done.
+     uint16 numFeats() const { return m_numFeats; };
+     CLASS_NEW_DELETE
+ private:
+ friend class SillMap;
+     uint16 m_numFeats;
+ 
+     FeatureRef *m_feats;
+     NameAndFeatureRef* m_pNamedFeats;   //owned
+-    FeatureVal* m_defaultFeatures;        //owned
++    FeatureVal m_defaultFeatures;        //owned
+     
+ private:        //defensive on m_feats, m_pNamedFeats, and m_defaultFeatures
+     FeatureMap(const FeatureMap&);
+     FeatureMap& operator=(const FeatureMap&);
+ };
+ 
+ 
+ class SillMap
+diff --git a/gfx/graphite2/src/inc/FileFace.h b/gfx/graphite2/src/inc/FileFace.h
+--- a/gfx/graphite2/src/inc/FileFace.h
++++ b/gfx/graphite2/src/inc/FileFace.h
+@@ -27,17 +27,17 @@ of the License or (at your option) any l
+ #pragma once
+ 
+ //#include "inc/FeatureMap.h"
+ //#include "inc/GlyphsCache.h"
+ //#include "inc/Silf.h"
+ 
+ #ifndef GRAPHITE2_NFILEFACE
+ 
+-#include <stdio.h>
++#include <cstdio>
+ #include <cassert>
+ 
+ #include "graphite2/Font.h"
+ 
+ #include "inc/Main.h"
+ #include "inc/TtfTypes.h"
+ #include "inc/TtfUtil.h"
+ 
+diff --git a/gfx/graphite2/src/inc/GlyphCache.h b/gfx/graphite2/src/inc/GlyphCache.h
+--- a/gfx/graphite2/src/inc/GlyphCache.h
++++ b/gfx/graphite2/src/inc/GlyphCache.h
+@@ -24,24 +24,73 @@ Mozilla Public License (http://mozilla.o
+ License, as published by the Free Software Foundation, either version 2
+ of the License or (at your option) any later version.
+ */
+ #pragma once
+ 
+ 
+ #include "graphite2/Font.h"
+ #include "inc/Main.h"
++#include "inc/Position.h"
++#include "inc/GlyphFace.h"
+ 
+ namespace graphite2 {
+ 
+ class Face;
+ class FeatureVal;
+-class GlyphFace;
+ class Segment;
+ 
++
++struct SlantBox
++{
++    static const SlantBox empty;
++
++//    SlantBox(float psi = 0., float pdi = 0., float psa = 0., float pda = 0.) : si(psi), di(pdi), sa(psa), da(pda) {};
++    float width() const { return sa - si; }
++    float height() const { return da - di; }
++    float si; // min
++    float di; // min
++    float sa; // max
++    float da; // max
++};
++
++
++struct BBox
++{
++    BBox(float pxi = 0, float pyi = 0., float pxa = 0., float pya = 0.) : xi(pxi), yi(pyi), xa(pxa), ya(pya) {};
++    float width() const { return xa - xi; }
++    float height() const { return ya - yi; }
++    float xi; // min
++    float yi; // min
++    float xa; // max
++    float ya; // max
++};
++
++
++class GlyphBox
++{
++    GlyphBox(const GlyphBox &);
++    GlyphBox & operator = (const GlyphBox &);
++
++public:
++    GlyphBox(uint8 numsubs, unsigned short bitmap, Rect *slanted) : _num(numsubs), _bitmap(bitmap), _slant(*slanted) {}; 
++
++    void addSubBox(int subindex, int boundary, Rect *val) { _subs[subindex * 2 + boundary] = *val; }
++    Rect &subVal(int subindex, int boundary) { return _subs[subindex * 2 + boundary]; }
++    const Rect &slant() const { return _slant; }
++    uint8 num() const { return _num; }
++    const Rect *subs() const { return _subs; }
++
++private:
++    uint8   _num;
++    unsigned short  _bitmap;
++    Rect    _slant;
++    Rect    _subs[1];
++};
++
+ class GlyphCache
+ {
+     class Loader;
+ 
+     GlyphCache(const GlyphCache&);
+     GlyphCache& operator=(const GlyphCache&);
+ 
+ public:
+@@ -49,22 +98,34 @@ public:
+     ~GlyphCache();
+ 
+     unsigned short  numGlyphs() const throw();
+     unsigned short  numAttrs() const throw();
+     unsigned short  unitsPerEm() const throw();
+ 
+     const GlyphFace *glyph(unsigned short glyphid) const;      //result may be changed by subsequent call with a different glyphid
+     const GlyphFace *glyphSafe(unsigned short glyphid) const;
++    float            getBoundingMetric(unsigned short glyphid, uint8 metric) const;
++    uint8            numSubBounds(unsigned short glyphid) const;
++    float            getSubBoundingMetric(unsigned short glyphid, uint8 subindex, uint8 metric) const;
++    const Rect &     slant(unsigned short glyphid) const { return _boxes[glyphid] ? _boxes[glyphid]->slant() : _empty_slant_box; }
++    const SlantBox & getBoundingSlantBox(unsigned short glyphid) const;
++    const BBox &     getBoundingBBox(unsigned short glyphid) const;
++    const SlantBox & getSubBoundingSlantBox(unsigned short glyphid, uint8 subindex) const;
++    const BBox &     getSubBoundingBBox(unsigned short glyphid, uint8 subindex) const;
++    bool             check(unsigned short glyphid) const;
++    bool             hasBoxes() const { return _boxes != 0; }
+ 
+     CLASS_NEW_DELETE;
+     
+ private:
++    const Rect            _empty_slant_box;
+     const Loader        * _glyph_loader;
+     const GlyphFace *   * _glyphs;
++    GlyphBox        *   * _boxes;
+     unsigned short        _num_glyphs,
+                           _num_attrs,
+                           _upem;
+ };
+ 
+ inline
+ unsigned short GlyphCache::numGlyphs() const throw()
+ {
+@@ -79,14 +140,84 @@ unsigned short GlyphCache::numAttrs() co
+ 
+ inline
+ unsigned short  GlyphCache::unitsPerEm() const throw()
+ {
+     return _upem;
+ }
+ 
+ inline
++bool GlyphCache::check(unsigned short glyphid) const
++{
++    return _boxes && glyphid < _num_glyphs;
++}
++
++inline
+ const GlyphFace *GlyphCache::glyphSafe(unsigned short glyphid) const
+ {
+     return glyphid < _num_glyphs ? glyph(glyphid) : NULL;
+ }
+ 
++inline
++float GlyphCache::getBoundingMetric(unsigned short glyphid, uint8 metric) const
++{
++    if (glyphid >= _num_glyphs) return 0.;
++    switch (metric) {
++        case 0: return (float)(glyph(glyphid)->theBBox().bl.x);                          // x_min
++        case 1: return (float)(glyph(glyphid)->theBBox().bl.y);                          // y_min
++        case 2: return (float)(glyph(glyphid)->theBBox().tr.x);                          // x_max
++        case 3: return (float)(glyph(glyphid)->theBBox().tr.y);                          // y_max
++        case 4: return (float)(_boxes[glyphid] ? _boxes[glyphid]->slant().bl.x : 0.f);    // sum_min
++        case 5: return (float)(_boxes[glyphid] ? _boxes[glyphid]->slant().bl.y : 0.f);    // diff_min
++        case 6: return (float)(_boxes[glyphid] ? _boxes[glyphid]->slant().tr.x : 0.f);    // sum_max
++        case 7: return (float)(_boxes[glyphid] ? _boxes[glyphid]->slant().tr.y : 0.f);    // diff_max
++        default: return 0.;
++    }
++}
++
++inline const SlantBox &GlyphCache::getBoundingSlantBox(unsigned short glyphid) const
++{
++    return _boxes[glyphid] ? *(SlantBox *)(&(_boxes[glyphid]->slant())) : SlantBox::empty;
++}
++
++inline const BBox &GlyphCache::getBoundingBBox(unsigned short glyphid) const
++{
++    return *(BBox *)(&(glyph(glyphid)->theBBox()));
++}
++
++inline
++float GlyphCache::getSubBoundingMetric(unsigned short glyphid, uint8 subindex, uint8 metric) const
++{
++    GlyphBox *b = _boxes[glyphid];
++    if (b == NULL || subindex >= b->num()) return 0;
++
++    switch (metric) {
++        case 0: return b->subVal(subindex, 0).bl.x;
++        case 1: return b->subVal(subindex, 0).bl.y;
++        case 2: return b->subVal(subindex, 0).tr.x;
++        case 3: return b->subVal(subindex, 0).tr.y;
++        case 4: return b->subVal(subindex, 1).bl.x;
++        case 5: return b->subVal(subindex, 1).bl.y;
++        case 6: return b->subVal(subindex, 1).tr.x;
++        case 7: return b->subVal(subindex, 1).tr.y;
++        default: return 0.;
++    }
++}
++
++inline const SlantBox &GlyphCache::getSubBoundingSlantBox(unsigned short glyphid, uint8 subindex) const
++{
++    GlyphBox *b = _boxes[glyphid];
++    return *(SlantBox *)(b->subs() + 2 * subindex + 1);
++}
++
++inline const BBox &GlyphCache::getSubBoundingBBox(unsigned short glyphid, uint8 subindex) const
++{
++    GlyphBox *b = _boxes[glyphid];
++    return *(BBox *)(b->subs() + 2 * subindex);
++}
++
++inline
++uint8 GlyphCache::numSubBounds(unsigned short glyphid) const
++{
++    return _boxes[glyphid] ? _boxes[glyphid]->num() : 0;
++}
++
+ } // namespace graphite2
+diff --git a/gfx/graphite2/src/inc/Intervals.h b/gfx/graphite2/src/inc/Intervals.h
+new file mode 100644
+--- /dev/null
++++ b/gfx/graphite2/src/inc/Intervals.h
+@@ -0,0 +1,234 @@
++/*  GRAPHITE2 LICENSING
++
++    Copyright 2010, SIL International
++    All rights reserved.
++
++    This library is free software; you can redistribute it and/or modify
++    it under the terms of the GNU Lesser General Public License as published
++    by the Free Software Foundation; either version 2.1 of License, or
++    (at your option) any later version.
++
++    This program is distributed in the hope that it will be useful,
++    but WITHOUT ANY WARRANTY; without even the implied warranty of
++    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++    Lesser General Public License for more details.
++
++    You should also have received a copy of the GNU Lesser General Public
++    License along with this library in the file named "LICENSE".
++    If not, write to the Free Software Foundation, 51 Franklin Street, 
++    Suite 500, Boston, MA 02110-1335, USA or visit their web page on the 
++    internet at http://www.fsf.org/licenses/lgpl.html.
++
++Alternatively, the contents of this file may be used under the terms of the
++Mozilla Public License (http://mozilla.org/MPL) or the GNU General Public
++License, as published by the Free Software Foundation, either version 2
++of the License or (at your option) any later version.
++*/
++#pragma once
++
++#include <utility>
++
++#include "inc/Main.h"
++#include "inc/List.h"
++#include "inc/json.h"
++#include "inc/Position.h"
++
++// An IntervalSet represents the possible movement of a given glyph in a given direction
++// (horizontally, vertically, or diagonally).
++// A vector is needed to represent disjoint ranges, eg, -300..-150, 20..200, 500..750.
++// Each pair represents the min/max of a sub-range.
++
++namespace graphite2 {
++
++class Segment;
++
++enum zones_t {SD, XY};
++
++class Zones
++{
++    struct Exclusion
++    {
++        template<zones_t O>
++        static Exclusion weighted(float xmin, float xmax, float f, float a0,
++                float m, float xi, float ai, float c, bool nega);
++
++        float   x,  // x position
++                xm, // xmax position
++                c,  // constant + sum(MiXi^2)
++                sm, // sum(Mi)
++                smx; // sum(MiXi)
++        bool    open;
++
++        Exclusion(float x, float w, float smi, float smxi, float c);
++        Exclusion & operator += (Exclusion const & rhs);
++        uint8 outcode(float p) const;
++
++        Exclusion   split_at(float p);
++        void        left_trim(float p);
++
++        bool        track_cost(float & cost, float & x, float origin) const;
++
++    private:
++        float test_position(float origin) const;
++        float cost(float x) const;
++     };
++
++    typedef Vector<Exclusion>                   exclusions;
++
++    typedef exclusions::iterator                iterator;
++    typedef Exclusion *                         pointer;
++    typedef Exclusion &                         reference;
++    typedef std::reverse_iterator<iterator>     reverse_iterator;
++
++public:
++    typedef exclusions::const_iterator              const_iterator;
++    typedef Exclusion const *                       const_pointer;
++    typedef Exclusion const &                       const_reference;
++    typedef std::reverse_iterator<const_iterator>   const_reverse_iterator;
++
++#if !defined GRAPHITE2_NTRACING
++    struct Debug
++    {
++        Exclusion       _excl;
++        bool            _isdel;
++        Vector<void *>  _env;
++
++        Debug(Exclusion *e, bool isdel, json *dbg) : _excl(*e), _isdel(isdel), _env(dbg->getenvs()) { };
++    };
++
++    typedef Vector<Debug>                       debugs;
++    typedef debugs::const_iterator                    idebugs;
++    void addDebug(Exclusion *e);
++    void removeDebug(float pos, float posm);
++    void setdebug(json *dbgout) { _dbg = dbgout; }
++    idebugs dbgs_begin() const { return _dbgs.begin(); }
++    idebugs dbgs_end() const { return _dbgs.end(); }
++    void jsonDbgOut(Segment *seg) const;
++    Position position() const { return Position(_pos, _posm); }
++#endif
++
++    Zones();
++    template<zones_t O>
++    void initialise(float xmin, float xmax, float margin_len, float margin_weight, float ao);
++
++    void exclude(float xmin, float xmax);
++    void exclude_with_margins(float xmin, float xmax, int axis);
++
++    template<zones_t O>
++    void weighted(float xmin, float xmax, float f, float a0, float mi, float xi, float ai, float c, bool nega);
++    void weightedAxis(int axis, float xmin, float xmax, float f, float a0, float mi, float xi, float ai, float c, bool nega);
++
++    float closest( float origin, float &cost) const;
++
++    const_iterator begin() const { return _exclusions.begin(); }
++    const_iterator end() const { return _exclusions.end(); }
++
++private:
++    exclusions  _exclusions;
++#if !defined GRAPHITE2_NTRACING
++    json      * _dbg;
++    debugs      _dbgs;
++#endif
++    float       _margin_len,
++                _margin_weight,
++                _pos,
++                _posm;
++
++    void            insert(Exclusion e);
++    void            remove(float x, float xm);
++    const_iterator  find_exclusion_under(float x) const;
++};
++
++
++inline
++Zones::Zones()
++: _margin_len(0), _margin_weight(0), _pos(0), _posm(0)
++{
++#if !defined GRAPHITE2_NTRACING
++    _dbg = 0;
++#endif
++    _exclusions.reserve(8);
++}
++
++inline
++Zones::Exclusion::Exclusion(float x_, float xm_, float smi, float smxi, float c_)
++: x(x_), xm(xm_), c(c_), sm(smi), smx(smxi), open(false)
++{ }
++
++template<zones_t O>
++inline
++void Zones::initialise(float xmin, float xmax, float margin_len,
++        float margin_weight, float a0)
++{
++    _margin_len = margin_len;
++    _margin_weight = margin_weight;
++    _pos = xmin;
++    _posm = xmax;
++    _exclusions.clear();
++    _exclusions.push_back(Exclusion::weighted<O>(xmin, xmax, 1, a0, 0, 0, 0, 0, false));
++    _exclusions.front().open = true;
++#if !defined GRAPHITE2_NTRACING
++    _dbgs.clear();
++#endif
++}
++
++inline
++void Zones::exclude(float xmin, float xmax) {
++    remove(xmin, xmax);
++}
++
++template<zones_t O>
++inline
++void Zones::weighted(float xmin, float xmax, float f, float a0,
++        float m, float xi, float ai, float c, bool nega) {
++    insert(Exclusion::weighted<O>(xmin, xmax, f, a0, m, xi, ai, c, nega));
++}
++
++inline
++void Zones::weightedAxis(int axis, float xmin, float xmax, float f, float a0,
++        float m, float xi, float ai, float c, bool nega) {
++    if (axis < 2)
++        weighted<XY>(xmin, xmax, f, a0, m, xi, ai, c, nega);
++    else
++        weighted<SD>(xmin, xmax, f, a0, m, xi, ai, c, nega);
++}
++
++#if !defined GRAPHITE2_NTRACING
++inline
++void Zones::addDebug(Exclusion *e) {
++    if (_dbg)
++        _dbgs.push_back(Debug(e, false, _dbg));
++}
++
++inline
++void Zones::removeDebug(float pos, float posm) {
++    if (_dbg)
++    {
++        Exclusion e(pos, posm, 0, 0, 0);
++        _dbgs.push_back(Debug(&e, true, _dbg));
++    }
++}
++#endif
++
++template<>
++inline
++Zones::Exclusion Zones::Exclusion::weighted<XY>(float xmin, float xmax, float f, float a0,
++        float m, float xi, GR_MAYBE_UNUSED float ai, float c, GR_MAYBE_UNUSED bool nega) {
++    return Exclusion(xmin, xmax,
++            m + f,
++            m * xi, 
++            m * xi * xi + f * a0 * a0 + c);
++}
++
++template<>
++inline
++Zones::Exclusion Zones::Exclusion::weighted<SD>(float xmin, float xmax, float f, float a0,
++        float m, float xi, float ai,float c, bool nega) {
++    float xia = nega ? xi - ai : xi + ai;
++    return Exclusion(xmin, xmax, 
++            0.25f * (m + 2.f * f), 
++            0.25f * m * xia, 
++            0.25f * (m * xia * xia + 2.f * f * a0 * a0) + c);
++}
++
++} // end of namespace graphite2
+diff --git a/gfx/graphite2/src/inc/List.h b/gfx/graphite2/src/inc/List.h
+--- a/gfx/graphite2/src/inc/List.h
++++ b/gfx/graphite2/src/inc/List.h
+@@ -65,29 +65,30 @@ public:
+     iterator            end()           { return m_last; }
+     const_iterator      end() const     { return m_last; }
+     
+     bool                empty() const   { return m_first == m_last; }
+     size_t              size() const    { return m_last - m_first; }
+     size_t              capacity() const{ return m_end - m_first; }
+     
+     void                reserve(size_t n);
++    void                resize(size_t n, const T & v = T());
+     
+     reference           front()         { assert(size() > 0); return *begin(); }
+     const_reference     front() const   { assert(size() > 0); return *begin(); }
+     reference           back()          { assert(size() > 0); return *(end()-1); }
+     const_reference     back() const    { assert(size() > 0); return *(end()-1); }
+     
+     Vector<T>         & operator = (const Vector<T> & rhs) { assign(rhs.begin(), rhs.end()); return *this; }
+     reference           operator [] (size_t n)          { assert(size() > n); return m_first[n]; }
+     const_reference     operator [] (size_t n) const    { assert(size() > n); return m_first[n]; }
+     
+     void                assign(size_t n, const T& u)    { clear(); insert(begin(), n, u); }
+     void                assign(const_iterator first, const_iterator last)      { clear(); insert(begin(), first, last); }
+-    iterator            insert(iterator p, const T & x) { p = _insert_default(p, 1); *p = x; return p; }
++    iterator            insert(iterator p, const T & x) { p = _insert_default(p, 1); new (p) T(x); return p; }
+     void                insert(iterator p, size_t n, const T & x);
+     void                insert(iterator p, const_iterator first, const_iterator last);
+     void                pop_back()              { assert(size() > 0); --m_last; }
+     void                push_back(const T &v)   { if (m_last == m_end) reserve(size()+1); new (m_last++) T(v); }
+ 
+     void                clear()                 { erase(begin(), end()); }
+     iterator            erase(iterator p)       { return erase(p, p+1); }
+     iterator            erase(iterator first, iterator last);
+@@ -99,28 +100,37 @@ private:
+ template <typename T>
+ inline 
+ void Vector<T>::reserve(size_t n)
+ {
+     if (n > capacity()) 
+     {
+         const ptrdiff_t sz = size();
+         m_first = static_cast<T*>(realloc(m_first, n*sizeof(T)));
++        if (!m_first)   std::abort();
+         m_last  = m_first + sz;
+         m_end   = m_first + n;
+     }
+ }
+ 
++template <typename T>
++inline
++void Vector<T>::resize(size_t n, const T & v) {
++    const ptrdiff_t d = n-size();
++    if (d < 0)      erase(end()+d, end());
++    else if (d > 0) insert(end(), d, v);
++}
++
+ template<typename T> 
+ inline 
+ typename Vector<T>::iterator Vector<T>::_insert_default(iterator p, size_t n)
+ {
+     assert(begin() <= p && p <= end());
+     const ptrdiff_t i = p - begin();
+-    reserve((size() + n + 7) >> 3 << 3);
++    reserve(((size() + n + 7) >> 3) << 3);
+     p = begin() + i;
+     // Move tail if there is one
+     if (p != end()) memmove(p + n, p, distance(p,end())*sizeof(T));
+     m_last += n;
+     return p;
+ }
+ 
+ template<typename T> 
+diff --git a/gfx/graphite2/src/inc/Machine.h b/gfx/graphite2/src/inc/Machine.h
+--- a/gfx/graphite2/src/inc/Machine.h
++++ b/gfx/graphite2/src/inc/Machine.h
+@@ -105,17 +105,19 @@ enum opcode {
+ 
+     PUSH_IGLYPH_ATTR,    // not implemented
+ 
+     POP_RET,                        RET_ZERO,           RET_TRUE,
+     IATTR_SET,                      IATTR_ADD,          IATTR_SUB,
+     PUSH_PROC_STATE,                PUSH_VERSION,
+     PUT_SUBS,                       PUT_SUBS2,          PUT_SUBS3,
+     PUT_GLYPH,                      PUSH_GLYPH_ATTR,    PUSH_ATT_TO_GLYPH_ATTR,
+-    MAX_OPCODE,
++    BITOR,                          BITAND,             BITNOT,
++    BITSET,                         SET_FEAT,
++    MAX_OPCODE,                     
+     // private opcodes for internal use only, comes after all other on disk opcodes
+     TEMP_COPY = MAX_OPCODE
+ };
+ 
+ struct opcode_t 
+ {
+     instr           impl[2];
+     uint8           param_sz;
+@@ -143,17 +145,17 @@ public:
+ 
+     Machine(SlotMap &) throw();
+     static const opcode_t *   getOpcodeTable() throw();
+ 
+     CLASS_NEW_DELETE;
+ 
+     SlotMap   & slotMap() const throw();
+     status_t    status() const throw();
+-    operator bool () const throw();
++//    operator bool () const throw();
+ 
+ private:
+     void    check_final_stack(const stack_t * const sp);
+     stack_t run(const instr * program, const byte * data,
+                 slotref * & map) HOT;
+ 
+     SlotMap       & _map;
+     stack_t         _stack[STACK_MAX + 2*STACK_GUARD];
+diff --git a/gfx/graphite2/src/inc/Main.h b/gfx/graphite2/src/inc/Main.h
+--- a/gfx/graphite2/src/inc/Main.h
++++ b/gfx/graphite2/src/inc/Main.h
+@@ -80,25 +80,25 @@ struct telemetry  {};
+ // typesafe wrapper around malloc for simple types
+ // use free(pointer) to deallocate
+ 
+ template <typename T> T * gralloc(size_t n)
+ {
+ #ifdef GRAPHITE2_TELEMETRY
+     telemetry::count_bytes(sizeof(T) * n);
+ #endif
+-    return reinterpret_cast<T*>(malloc(sizeof(T) * n));
++    return static_cast<T*>(malloc(sizeof(T) * n));
+ }
+ 
+ template <typename T> T * grzeroalloc(size_t n)
+ {
+ #ifdef GRAPHITE2_TELEMETRY
+     telemetry::count_bytes(sizeof(T) * n);
+ #endif
+-    return reinterpret_cast<T*>(calloc(n, sizeof(T)));
++    return static_cast<T*>(calloc(n, sizeof(T)));
+ }
+ 
+ template <typename T>
+ inline T min(const T a, const T b)
+ {
+     return a < b ? a : b;
+ }
+ 
+@@ -115,13 +115,32 @@ inline T max(const T a, const T b)
+     void * operator new   (size_t, void * p) throw() { return p; } \
+     void * operator new[] (size_t size) {return gralloc<byte>(size);} \
+     void * operator new[] (size_t, void * p) throw() { return p; } \
+     void operator delete   (void * p) throw() { free(p);} \
+     void operator delete   (void *, void *) throw() {} \
+     void operator delete[] (void * p)throw() { free(p); } \
+     void operator delete[] (void *, void *) throw() {}
+ 
+-#ifdef __GNUC__
++#if defined(__GNUC__)  || defined(__clang__)
+ #define GR_MAYBE_UNUSED __attribute__((unused))
+ #else
+ #define GR_MAYBE_UNUSED
+ #endif
++
++#if defined(__clang__) && __cplusplus >= 201103L
++   /* clang's fallthrough annotations are only available starting in C++11. */
++    #define GR_FALLTHROUGH [[clang::fallthrough]]
++#elif defined(_MSC_VER)
++   /*
++    * MSVC's __fallthrough annotations are checked by /analyze (Code Analysis):
++    * https://msdn.microsoft.com/en-us/library/ms235402%28VS.80%29.aspx
++    */
++    #include <sal.h>
++    #define GR_FALLTHROUGH __fallthrough
++#else
++    #define GR_FALLTHROUGH /* fallthrough */
++#endif
++
++#ifdef _MSC_VER
++#pragma warning(disable: 4800)
++#pragma warning(disable: 4355)
++#endif
+diff --git a/gfx/graphite2/src/inc/Pass.h b/gfx/graphite2/src/inc/Pass.h
+--- a/gfx/graphite2/src/inc/Pass.h
++++ b/gfx/graphite2/src/inc/Pass.h
+@@ -34,65 +34,85 @@ namespace graphite2 {
+ class Segment;
+ class Face;
+ class Silf;
+ struct Rule;
+ struct RuleEntry;
+ struct State;
+ class FiniteStateMachine;
+ class Error;
++class ShiftCollider;
++class KernCollider;
++class json;
++
++enum passtype;
+ 
+ class Pass
+ {   
+ public:
+     Pass();
+     ~Pass();
+     
+-    bool readPass(const byte * pPass, size_t pass_length, size_t subtable_base, Face & face, Error &e);
+-    void runGraphite(vm::Machine & m, FiniteStateMachine & fsm) const;
++    bool readPass(const byte * pPass, size_t pass_length, size_t subtable_base, Face & face,
++        enum passtype pt, uint32 version, Error &e);
++    bool runGraphite(vm::Machine & m, FiniteStateMachine & fsm, bool reverse) const;
+     void init(Silf *silf) { m_silf = silf; }
+-    byte spaceContextuals() const { return (m_flags & 0x0E) >> 1; }
++    byte collisionLoops() const { return m_numCollRuns; }
++    bool reverseDir() const { return m_isReverseDir; }
+ 
+     CLASS_NEW_DELETE
+ private:
+     void    findNDoRule(Slot* & iSlot, vm::Machine &, FiniteStateMachine& fsm) const;
+     int     doAction(const vm::Machine::Code* codeptr, Slot * & slot_out, vm::Machine &) const;
+     bool    testPassConstraint(vm::Machine & m) const;
+     bool    testConstraint(const Rule & r, vm::Machine &) const;
+     bool    readRules(const byte * rule_map, const size_t num_entries,
+                      const byte *precontext, const uint16 * sort_key,
+                      const uint16 * o_constraint, const byte *constraint_data, 
+                      const uint16 * o_action, const byte * action_data,
+-                     Face &, Error &e);
++                     Face &, enum passtype pt, Error &e);
+     bool    readStates(const byte * starts, const byte * states, const byte * o_rule_map, Face &, Error &e);
+     bool    readRanges(const byte * ranges, size_t num_ranges, Error &e);
+     uint16  glyphToCol(const uint16 gid) const;
+     bool    runFSM(FiniteStateMachine & fsm, Slot * slot) const;
+     void    dumpRuleEventConsidered(const FiniteStateMachine & fsm, const RuleEntry & re) const;
+-    void    dumpRuleEventOutput(const FiniteStateMachine & fsm, const Rule & r, Slot * os) const;
++    void    dumpRuleEventOutput(const FiniteStateMachine & fsm, vm::Machine & m, const Rule & r, Slot * os) const;
+     void    adjustSlot(int delta, Slot * & slot_out, SlotMap &) const;
+-    const Silf* m_silf;
+-    uint16    * m_cols;
+-    Rule      * m_rules; // rules
+-    RuleEntry * m_ruleMap;
+-    uint16    * m_startStates; // prectxt length
+-    uint16    * m_transitions;
+-    State     * m_states;
+-    
+-    byte   m_flags;
++    bool    collisionShift(Segment *seg, int dir, json * const dbgout) const;
++    bool    collisionKern(Segment *seg, int dir, json * const dbgout) const;
++    bool    collisionFinish(Segment *seg, GR_MAYBE_UNUSED json * const dbgout) const;
++    bool    resolveCollisions(Segment *seg, Slot *slot, Slot *start, ShiftCollider &coll, bool isRev,
++                     int dir, bool &moved, bool &hasCol, json * const dbgout) const;
++    float   resolveKern(Segment *seg, Slot *slot, Slot *start, KernCollider &coll, int dir,
++                     float &ymin, float &ymax, json *const dbgout) const;
++
++    const Silf        * m_silf;
++    uint16            * m_cols;
++    Rule              * m_rules; // rules
++    RuleEntry         * m_ruleMap;
++    uint16            * m_startStates; // prectxt length
++    uint16            * m_transitions;
++    State             * m_states;
++    vm::Machine::Code * m_codes;
++    byte              * m_progs;
++
++    byte   m_numCollRuns;
++    byte   m_kernColls;
+     byte   m_iMaxLoop;
+     uint16 m_numGlyphs;
+     uint16 m_numRules;
+     uint16 m_numStates;
+     uint16 m_numTransition;
+     uint16 m_numSuccess;
+     uint16 m_successStart;
+     uint16 m_numColumns;
+     byte m_minPreCtxt;
+     byte m_maxPreCtxt;
++    byte m_colThreshold;
++    bool m_isReverseDir;
+     vm::Machine::Code m_cPConstraint;
+     
+ private:        //defensive
+     Pass(const Pass&);
+     Pass& operator=(const Pass&);
+ };
+ 
+ } // namespace graphite2
+diff --git a/gfx/graphite2/src/inc/Position.h b/gfx/graphite2/src/inc/Position.h
+--- a/gfx/graphite2/src/inc/Position.h
++++ b/gfx/graphite2/src/inc/Position.h
+@@ -45,15 +45,24 @@ public:
+ 
+ class Rect
+ {
+ public :
+     Rect() {}
+     Rect(const Position& botLeft, const Position& topRight): bl(botLeft), tr(topRight) {}
+     Rect widen(const Rect& other) { return Rect(Position(bl.x > other.bl.x ? other.bl.x : bl.x, bl.y > other.bl.y ? other.bl.y : bl.y), Position(tr.x > other.tr.x ? tr.x : other.tr.x, tr.y > other.tr.y ? tr.y : other.tr.y)); }
+     Rect operator + (const Position &a) const { return Rect(Position(bl.x + a.x, bl.y + a.y), Position(tr.x + a.x, tr.y + a.y)); }
++    Rect operator - (const Position &a) const { return Rect(Position(bl.x - a.x, bl.y - a.y), Position(tr.x - a.x, tr.y - a.y)); }
+     Rect operator * (float m) const { return Rect(Position(bl.x, bl.y) * m, Position(tr.x, tr.y) * m); }
++    float width() const { return tr.x - bl.x; }
++    float height() const { return tr.y - bl.y; }
++
++    bool hitTest(Rect &other);
++
++    // returns Position(overlapx, overlapy) where overlap<0 if overlapping else positive)
++    Position overlap(Position &offset, Rect &other, Position &otherOffset);
++    //Position constrainedAvoid(Position &offset, Rect &box, Rect &sdbox, Position &other, Rect &obox, Rect &osdbox);
+ 
+     Position bl;
+     Position tr;
+ };
+ 
+ } // namespace graphite2
+diff --git a/gfx/graphite2/src/inc/Rule.h b/gfx/graphite2/src/inc/Rule.h
+--- a/gfx/graphite2/src/inc/Rule.h
++++ b/gfx/graphite2/src/inc/Rule.h
+@@ -36,30 +36,36 @@ struct Rule {
+   const vm::Machine::Code * constraint, 
+                  * action;
+   unsigned short   sort;
+   byte             preContext;
+ #ifndef NDEBUG
+   uint16           rule_idx;
+ #endif
+ 
+-  Rule() : constraint(0), action(0), sort(0), preContext(0) {}
+-  ~Rule();
++  Rule();
++  ~Rule() {}
+ 
+   CLASS_NEW_DELETE;
+ 
+ private:
+   Rule(const Rule &);
+   Rule & operator = (const Rule &);
+ };
+ 
+-inline Rule::~Rule()
++inline
++Rule::Rule()
++: constraint(0),
++  action(0),
++  sort(0),
++  preContext(0)
+ {
+-  delete constraint;
+-  delete action;
++#ifndef NDEBUG
++  rule_idx = 0;
++#endif
+ }
+ 
+ 
+ struct RuleEntry
+ {
+   const Rule   * rule;
+ 
+   inline
+@@ -91,40 +97,43 @@ bool State::empty() const
+     return rules_end == rules;
+ }
+ 
+ 
+ class SlotMap
+ {
+ public:
+   enum {MAX_SLOTS=64};
+-  SlotMap(Segment & seg);
++  SlotMap(Segment & seg, uint8 direction);
+   
+   Slot       * * begin();
+   Slot       * * end();
+   size_t         size() const;
+   unsigned short context() const;
+   void           reset(Slot &, unsigned short);
+   
+   Slot * const & operator[](int n) const;
+   Slot       * & operator [] (int);
+   void           pushSlot(Slot * const slot);
+-  void           collectGarbage();
++  void           collectGarbage(Slot *& aSlot);
+ 
+   Slot         * highwater() { return m_highwater; }
+   void           highwater(Slot *s) { m_highwater = s; m_highpassed = false; }
+   bool           highpassed() const { return m_highpassed; }
+   void           highpassed(bool v) { m_highpassed = v; }
+ 
++  uint8          dir() const { return m_dir; }
++
+   Segment &    segment;
+ private:
+   Slot         * m_slot_map[MAX_SLOTS+1];
+   unsigned short m_size;
+   unsigned short m_precontext;
+   Slot         * m_highwater;
++  uint8          m_dir;
+   bool           m_highpassed;
+ };
+ 
+ 
+ class FiniteStateMachine
+ {
+ public:
+   enum {MAX_RULES=128};
+@@ -228,18 +237,18 @@ void FiniteStateMachine::Rules::accumula
+       return;
+     }
+   }
+   while (rre != rrend && out != lrend) { *out++ = *rre++; }
+   m_end = out;
+ }
+ 
+ inline
+-SlotMap::SlotMap(Segment & seg)
+-: segment(seg), m_size(0), m_precontext(0), m_highwater(0), m_highpassed(false)
++SlotMap::SlotMap(Segment & seg, uint8 direction)
++: segment(seg), m_size(0), m_precontext(0), m_highwater(0), m_dir(direction), m_highpassed(false)
+ {
+     m_slot_map[0] = 0;
+ }
+ 
+ inline
+ Slot * * SlotMap::begin()
+ {
+   return &m_slot_map[1]; // allow map to go 1 before slot_map when inserting
+diff --git a/gfx/graphite2/src/inc/SegCache.h b/gfx/graphite2/src/inc/SegCache.h
+--- a/gfx/graphite2/src/inc/SegCache.h
++++ b/gfx/graphite2/src/inc/SegCache.h
+@@ -258,17 +258,17 @@ public:
+ 
+     CLASS_NEW_DELETE
+ private:
+     void freeLevel(SegCacheStore * store, SegCachePrefixArray prefixes, size_t level);
+     void purgeLevel(SegCacheStore * store, SegCachePrefixArray prefixes, size_t level,
+                     unsigned long long minAccessCount, unsigned long long oldAccessTime);
+ 
+     uint16 m_prefixLength;
+-    uint16 m_maxCachedSegLength;
++//    uint16 m_maxCachedSegLength;
+     size_t m_segmentCount;
+     SegCachePrefixArray m_prefixes;
+     Features m_features;
+     mutable unsigned long long m_totalAccessCount;
+     mutable unsigned long long m_totalMisses;
+     float m_purgeFactor;
+ };
+ 
+diff --git a/gfx/graphite2/src/inc/Segment.h b/gfx/graphite2/src/inc/Segment.h
+--- a/gfx/graphite2/src/inc/Segment.h
++++ b/gfx/graphite2/src/inc/Segment.h
+@@ -30,29 +30,28 @@ of the License or (at your option) any l
+ 
+ #include <cassert>
+ 
+ #include "inc/CharInfo.h"
+ #include "inc/Face.h"
+ #include "inc/FeatureVal.h"
+ #include "inc/GlyphCache.h"
+ #include "inc/GlyphFace.h"
+-//#include "inc/Silf.h"
+ #include "inc/Slot.h"
+ #include "inc/Position.h"
+ #include "inc/List.h"
+-#include "inc/Bidi.h"
++#include "inc/Collider.h"
+ 
+ #define MAX_SEG_GROWTH_FACTOR  256
+ 
+ namespace graphite2 {
+ 
+ typedef Vector<Features>        FeatureList;
+ typedef Vector<Slot *>          SlotRope;
+-typedef Vector<int16 *>        AttributeRope;
++typedef Vector<int16 *>         AttributeRope;
+ typedef Vector<SlotJustify *>   JustifyRope;
+ 
+ #ifndef GRAPHITE2_NSEGCACHE
+ class SegmentScopeState;
+ #endif
+ class Font;
+ class Segment;
+ class Silf;
+@@ -81,119 +80,151 @@ private:
+ 
+ class Segment
+ {
+     // Prevent copying of any kind.
+     Segment(const Segment&);
+     Segment& operator=(const Segment&);
+ 
+ public:
++
++    enum {
++        SEG_INITCOLLISIONS = 1,
++        SEG_HASCOLLISIONS = 2
++    };
++
+     unsigned int slotCount() const { return m_numGlyphs; }      //one slot per glyph
+     void extendLength(int num) { m_numGlyphs += num; }
+     Position advance() const { return m_advance; }
+     bool runGraphite() { if (m_silf) return m_face->runGraphite(this, m_silf); else return true;};
+     void chooseSilf(uint32 script) { m_silf = m_face->chooseSilf(script); }
+     const Silf *silf() const { return m_silf; }
+     unsigned int charInfoCount() const { return m_numCharinfo; }
+     const CharInfo *charinfo(unsigned int index) const { return index < m_numCharinfo ? m_charinfo + index : NULL; }
+     CharInfo *charinfo(unsigned int index) { return index < m_numCharinfo ? m_charinfo + index : NULL; }
+-    int8 dir() const { return m_dir; }
+ 
+     Segment(unsigned int numchars, const Face* face, uint32 script, int dir);
+     ~Segment();
+ #ifndef GRAPHITE2_NSEGCACHE
+     SegmentScopeState setScope(Slot * firstSlot, Slot * lastSlot, size_t subLength);
+     void removeScope(SegmentScopeState & state);
+     void append(const Segment &other);
+     void splice(size_t offset, size_t length, Slot * const startSlot,
+             Slot * endSlot, const Slot * srcSlot,
+             const size_t numGlyphs);
+ #endif
++    uint8 flags() const { return m_flags; }
++    void flags(uint8 f) { m_flags = f; }
+     Slot *first() { return m_first; }
+     void first(Slot *p) { m_first = p; }
+     Slot *last() { return m_last; }
+     void last(Slot *p) { m_last = p; }
+     void appendSlot(int i, int cid, int gid, int fid, size_t coffset);
+     Slot *newSlot();
+     void freeSlot(Slot *);
+     SlotJustify *newJustify();
+     void freeJustify(SlotJustify *aJustify);
+-    Position positionSlots(const Font *font, Slot *first=0, Slot *last=0);
++    Position positionSlots(const Font *font=0, Slot *first=0, Slot *last=0, bool isRtl = false, bool isFinal = true);
+     void associateChars(int offset, int num);
+     void linkClusters(Slot *first, Slot *last);
+     uint16 getClassGlyph(uint16 cid, uint16 offset) const { return m_silf->getClassGlyph(cid, offset); }
+     uint16 findClassIndex(uint16 cid, uint16 gid) const { return m_silf->findClassIndex(cid, gid); }
+     int addFeatures(const Features& feats) { m_feats.push_back(feats); return m_feats.size() - 1; }
+     uint32 getFeature(int index, uint8 findex) const { const FeatureRef* pFR=m_face->theSill().theFeatureMap().featureRef(findex); if (!pFR) return 0; else return pFR->getFeatureVal(m_feats[index]); }
++    void setFeature(int index, uint8 findex, uint32 val) {
++        const FeatureRef* pFR=m_face->theSill().theFeatureMap().featureRef(findex); 
++        if (pFR)
++        {
++            if (val > pFR->maxVal()) val = pFR->maxVal();
++            pFR->applyValToFeature(val, m_feats[index]);
++        } }
++    int8 dir() const { return m_dir; }
+     void dir(int8 val) { m_dir = val; }
++    bool currdir() const { return ((m_dir >> 6) ^ m_dir) & 1; }
+     unsigned int passBits() const { return m_passBits; }
+     void mergePassBits(const unsigned int val) { m_passBits &= val; }
+     int16 glyphAttr(uint16 gid, uint16 gattr) const { const GlyphFace * p = m_face->glyphs().glyphSafe(gid); return p ? p->attrs()[gattr] : 0; }
+-    int32 getGlyphMetric(Slot *iSlot, uint8 metric, uint8 attrLevel) const;
++    int32 getGlyphMetric(Slot *iSlot, uint8 metric, uint8 attrLevel, bool rtl) const;
+     float glyphAdvance(uint16 gid) const { return m_face->glyphs().glyph(gid)->theAdvance().x; }
+     const Rect &theGlyphBBoxTemporary(uint16 gid) const { return m_face->glyphs().glyph(gid)->theBBox(); }   //warning value may become invalid when another glyph is accessed
+     Slot *findRoot(Slot *is) const { return is->attachedTo() ? findRoot(is->attachedTo()) : is; }
+     int numAttrs() const { return m_silf->numUser(); }
+     int defaultOriginal() const { return m_defaultOriginal; }
+     const Face * getFace() const { return m_face; }
+     const Features & getFeatures(unsigned int /*charIndex*/) { assert(m_feats.size() == 1); return m_feats[0]; }
+-    void bidiPass(uint8 aBidi, int paradir, uint8 aMirror);
++    void bidiPass(int paradir, uint8 aMirror);
++    int8 getSlotBidiClass(Slot *s) const;
++    void doMirror(uint16 aMirror);
+     Slot *addLineEnd(Slot *nSlot);
+     void delLineEnd(Slot *s);
+     bool hasJustification() const { return m_justifies.size() != 0; }
++    void reverseSlots();
+ 
+     bool isWhitespace(const int cid) const;
+-
++    bool hasCollisionInfo() const { return (m_flags & SEG_HASCOLLISIONS); }
++    SlotCollision *collisionInfo(const Slot *s) const { return m_collisions ? m_collisions + s->index() : 0; }
+     CLASS_NEW_DELETE
+ 
+ public:       //only used by: GrSegment* makeAndInitialize(const GrFont *font, const GrFace *face, uint32 script, const FeaturesHandle& pFeats/*must not be IsNull*/, encform enc, const void* pStart, size_t nChars, int dir);
+     bool read_text(const Face *face, const Features* pFeats/*must not be NULL*/, gr_encform enc, const void*pStart, size_t nChars);
+-    void prepare_pos(const Font *font);
+-    void finalise(const Font *font);
++    void finalise(const Font *font, bool reverse=false);
+     float justify(Slot *pSlot, const Font *font, float width, enum justFlags flags, Slot *pFirst, Slot *pLast);
++    bool initCollisions();
+   
+ private:
+     Position        m_advance;          // whole segment advance
+     SlotRope        m_slots;            // Vector of slot buffers
+     AttributeRope   m_userAttrs;        // Vector of userAttrs buffers
+     JustifyRope     m_justifies;        // Slot justification info buffers
+     FeatureList     m_feats;            // feature settings referenced by charinfos in this segment
+     Slot          * m_freeSlots;        // linked list of free slots
+     SlotJustify   * m_freeJustifies;    // Slot justification blocks free list
+     CharInfo      * m_charinfo;         // character info, one per input character
++    SlotCollision * m_collisions;
+     const Face    * m_face;             // GrFace
+     const Silf    * m_silf;
+     Slot          * m_first;            // first slot in segment
+     Slot          * m_last;             // last slot in segment
+     unsigned int    m_bufSize,          // how big a buffer to create when need more slots
+                     m_numGlyphs,
+                     m_numCharinfo,      // size of the array and number of input characters
+                     m_passBits;         // if bit set then skip pass
+     int             m_defaultOriginal;  // number of whitespace chars in the string
+     int8            m_dir;
++    uint8           m_flags;            // General purpose flags
+ };
+ 
+-
++inline
++int8 Segment::getSlotBidiClass(Slot *s) const
++{
++    int8 res = s->getBidiClass();
++    if (res != -1) return res;
++    res = int8(glyphAttr(s->gid(), m_silf->aBidi()));
++    s->setBidiClass(res);
++    return res;
++}
+ 
+ inline
+-void Segment::finalise(const Font *font)
++void Segment::finalise(const Font *font, bool reverse)
+ {
+     if (!m_first) return;
+ 
+-    m_advance = positionSlots(font);
+-    associateChars(0, m_numCharinfo);
++    m_advance = positionSlots(font, m_first, m_last, m_silf->dir(), true);
++    //associateChars(0, m_numCharinfo);
++    if (reverse && currdir() != (m_dir & 1))
++        reverseSlots();
+     linkClusters(m_first, m_last);
+ }
+ 
+ inline
+-int32 Segment::getGlyphMetric(Slot *iSlot, uint8 metric, uint8 attrLevel) const {
++int32 Segment::getGlyphMetric(Slot *iSlot, uint8 metric, uint8 attrLevel, bool rtl) const {
+     if (attrLevel > 0)
+     {
+         Slot *is = findRoot(iSlot);
+-        return is->clusterMetric(this, metric, attrLevel);
++        return is->clusterMetric(this, metric, attrLevel, rtl);
+     }
+     else
+         return m_face->getGlyphMetric(iSlot->gid(), metric);
+ }
+ 
+ inline
+ bool Segment::isWhitespace(const int cid) const
+ {
+@@ -206,68 +237,12 @@ bool Segment::isWhitespace(const int cid
+          + (cid >= 0x2000) * (cid <= 0x200A)
+          + (cid == 0x2028)
+          + (cid == 0x2029)
+          + (cid == 0x202F)
+          + (cid == 0x205F)
+          + (cid == 0x3000)) != 0;
+ }
+ 
+-//inline
+-//bool Segment::isWhitespace(const int cid) const
+-//{
+-//    switch (cid >> 8)
+-//    {
+-//        case 0x00:
+-//            switch (cid)
+-//            {
+-//            case 0x09:
+-//            case 0x0A:
+-//            case 0x0B:
+-//            case 0x0C:
+-//            case 0x0D:
+-//            case 0x20:
+-//                return true;
+-//            default:
+-//                break;
+-//            }
+-//            break;
+-//        case 0x16:
+-//            return cid == 0x1680;
+-//            break;
+-//        case 0x18:
+-//            return cid == 0x180E;
+-//            break;
+-//        case 0x20:
+-//            switch (cid)
+-//            {
+-//            case 0x00:
+-//            case 0x01:
+-//            case 0x02:
+-//            case 0x03:
+-//            case 0x04:
+-//            case 0x05:
+-//            case 0x06:
+-//            case 0x07:
+-//            case 0x08:
+-//            case 0x09:
+-//            case 0x0A:
+-//            case 0x28:
+-//            case 0x29:
+-//            case 0x2F:
+-//            case 0x5F:
+-//                return true
+-//            default:
+-//                break;
+-//            }
+-//            break;
+-//        case 0x30:
+-//            return cid == 0x3000;
+-//            break;
+-//    }
+-//
+-//    return false;
+-//}
+-
+ } // namespace graphite2
+ 
+ struct gr_segment : public graphite2::Segment {};
+ 
+diff --git a/gfx/graphite2/src/inc/Silf.h b/gfx/graphite2/src/inc/Silf.h
+--- a/gfx/graphite2/src/inc/Silf.h
++++ b/gfx/graphite2/src/inc/Silf.h
+@@ -80,24 +80,26 @@ public:
+     uint16 getClassGlyph(uint16 cid, unsigned int index) const;
+     uint16 findPseudo(uint32 uid) const;
+     uint8 numUser() const { return m_aUser; }
+     uint8 aPseudo() const { return m_aPseudo; }
+     uint8 aBreak() const { return m_aBreak; }
+     uint8 aMirror() const {return m_aMirror; }
+     uint8 aPassBits() const { return m_aPassBits; }
+     uint8 aBidi() const { return m_aBidi; }
++    uint8 aCollision() const { return m_aCollision; }
+     uint8 substitutionPass() const { return m_sPass; }
+     uint8 positionPass() const { return m_pPass; }
+     uint8 justificationPass() const { return m_jPass; }
+     uint8 bidiPass() const { return m_bPass; }
+     uint8 numPasses() const { return m_numPasses; }
+     uint8 maxCompPerLig() const { return m_iMaxComp; }
+     uint16 numClasses() const { return m_nClass; }
+     byte  flags() const { return m_flags; }
++    byte  dir() const { return m_dir; }
+     uint8 numJustLevels() const { return m_numJusts; }
+     Justinfo *justAttrs() const { return m_justs; }
+     uint16 endLineGlyphid() const { return m_gEndLine; }
+     const gr_faceinfo *silfInfo() const { return &m_silfinfo; }
+ 
+     CLASS_NEW_DELETE;
+ 
+ private:
+@@ -107,23 +109,20 @@ private:
+     Pass          * m_passes;
+     Pseudo        * m_pseudos;
+     uint32        * m_classOffsets;
+     uint16        * m_classData;
+     Justinfo      * m_justs;
+     uint8           m_numPasses;
+     uint8           m_numJusts;
+     uint8           m_sPass, m_pPass, m_jPass, m_bPass,
+-                    m_flags;
++                    m_flags, m_dir;
+ 
+-    uint8   m_aPseudo, m_aBreak, m_aUser, m_aBidi, m_aMirror, m_aPassBits,
+-            m_iMaxComp;
+-    uint16  m_aLig,
+-            m_numPseudo,
+-            m_nClass,
+-            m_nLinear,
+-            m_gEndLine;
++    uint8       m_aPseudo, m_aBreak, m_aUser, m_aBidi, m_aMirror, m_aPassBits,
++                m_iMaxComp, m_aCollision;
++    uint16      m_aLig, m_numPseudo, m_nClass, m_nLinear,
++                m_gEndLine;
+     gr_faceinfo m_silfinfo;
+     
+     void releaseBuffers() throw();
+ };
+ 
+ } // namespace graphite2
+diff --git a/gfx/graphite2/src/inc/Slot.h b/gfx/graphite2/src/inc/Slot.h
+--- a/gfx/graphite2/src/inc/Slot.h
++++ b/gfx/graphite2/src/inc/Slot.h
+@@ -27,25 +27,23 @@ of the License or (at your option) any l
+ #pragma once
+ 
+ #include "graphite2/Types.h"
+ #include "graphite2/Segment.h"
+ #include "inc/Main.h"
+ #include "inc/Font.h"
+ #include "inc/Position.h"
+ 
+-
+-
+ namespace graphite2 {
+ 
+ typedef gr_attrCode attrCode;
+ 
+ class GlyphFace;
++class SegCacheEntry;
+ class Segment;
+-class SegCacheEntry;
+ 
+ struct SlotJustify
+ {
+     static const int NUMJUSTPARAMS = 5;
+ 
+     SlotJustify(const SlotJustify &);
+     SlotJustify & operator = (const SlotJustify &);
+ 
+@@ -70,73 +68,79 @@ class Slot
+     };
+ 
+ public:
+     struct iterator;
+ 
+     unsigned short gid() const { return m_glyphid; }
+     Position origin() const { return m_position; }
+     float advance() const { return m_advance.x; }
++    void advance(Position &val) { m_advance = val; }
+     Position advancePos() const { return m_advance; }
+     int before() const { return m_before; }
+     int after() const { return m_after; }
+     uint32 index() const { return m_index; }
+     void index(uint32 val) { m_index = val; }
+ 
+-    Slot();
++    Slot(int16 *m_userAttr = NULL);
+     void set(const Slot & slot, int charOffset, size_t numUserAttr, size_t justLevels, size_t numChars);
+     Slot *next() const { return m_next; }
+     void next(Slot *s) { m_next = s; }
+     Slot *prev() const { return m_prev; }
+     void prev(Slot *s) { m_prev = s; }
+     uint16 glyph() const { return m_realglyphid ? m_realglyphid : m_glyphid; }
+     void setGlyph(Segment *seg, uint16 glyphid, const GlyphFace * theGlyph = NULL);
+     void setRealGid(uint16 realGid) { m_realglyphid = realGid; }
+     void adjKern(const Position &pos) { m_shift = m_shift + pos; m_advance = m_advance + pos; }
+     void origin(const Position &pos) { m_position = pos + m_shift; }
+     void originate(int ind) { m_original = ind; }
+     int original() const { return m_original; }
+     void before(int ind) { m_before = ind; }
+     void after(int ind) { m_after = ind; }
+     bool isBase() const { return (!m_parent); }
+     void update(int numSlots, int numCharInfo, Position &relpos);
+-    Position finalise(const Segment* seg, const Font* font, Position & base, Rect & bbox, uint8 attrLevel, float & clusterMin);
++    Position finalise(const Segment* seg, const Font* font, Position & base, Rect & bbox, uint8 attrLevel, float & clusterMin, bool rtl, bool isFinal);
+     bool isDeleted() const { return (m_flags & DELETED) ? true : false; }
+     void markDeleted(bool state) { if (state) m_flags |= DELETED; else m_flags &= ~DELETED; }
+     bool isCopied() const { return (m_flags & COPIED) ? true : false; }
+     void markCopied(bool state) { if (state) m_flags |= COPIED; else m_flags &= ~COPIED; }
+     bool isPositioned() const { return (m_flags & POSITIONED) ? true : false; }
+     void markPositioned(bool state) { if (state) m_flags |= POSITIONED; else m_flags &= ~POSITIONED; }
+     bool isInsertBefore() const { return !(m_flags & INSERTED); }
+     uint8 getBidiLevel() const { return m_bidiLevel; }
+     void setBidiLevel(uint8 level) { m_bidiLevel = level; }
++    int8 getBidiClass(const Segment *seg);
+     int8 getBidiClass() const { return m_bidiCls; }
+     void setBidiClass(int8 cls) { m_bidiCls = cls; }
+     int16 *userAttrs() const { return m_userAttr; }
+     void userAttrs(int16 *p) { m_userAttr = p; }
+     void markInsertBefore(bool state) { if (!state) m_flags |= INSERTED; else m_flags &= ~INSERTED; }
+     void setAttr(Segment* seg, attrCode ind, uint8 subindex, int16 val, const SlotMap & map);
+     int getAttr(const Segment *seg, attrCode ind, uint8 subindex) const;
+     int getJustify(const Segment *seg, uint8 level, uint8 subindex) const;
+     void setJustify(Segment *seg, uint8 level, uint8 subindex, int16 value);
+     bool isLocalJustify() const { return m_justs != NULL; };
+     void attachTo(Slot *ap) { m_parent = ap; }
+     Slot *attachedTo() const { return m_parent; }
+     Position attachOffset() const { return m_attach - m_with; }
+     Slot* firstChild() const { return m_child; }
++    void firstChild(Slot *ap) { m_child = ap; }
+     bool child(Slot *ap);
+     Slot* nextSibling() const { return m_sibling; }
++    void nextSibling(Slot *ap) { m_sibling = ap; }
+     bool sibling(Slot *ap);
+     bool removeChild(Slot *ap);
+     bool removeSibling(Slot *ap);
+-    int32 clusterMetric(const Segment* seg, uint8 metric, uint8 attrLevel);
++    int32 clusterMetric(const Segment* seg, uint8 metric, uint8 attrLevel, bool rtl);
+     void positionShift(Position a) { m_position += a; }
+     void floodShift(Position adj);
+     float just() const { return m_just; }
+     void just(float j) { m_just = j; }
++    Slot *nextInCluster(const Slot *s) const;
++    bool isChildOf(const Slot *base) const;
+ 
+     CLASS_NEW_DELETE
+ 
+ private:
+     Slot *m_next;           // linked list of slots
+     Slot *m_prev;
+     unsigned short m_glyphid;        // glyph id
+     uint16 m_realglyphid;
+diff --git a/gfx/graphite2/src/inc/Sparse.h b/gfx/graphite2/src/inc/Sparse.h
+--- a/gfx/graphite2/src/inc/Sparse.h
++++ b/gfx/graphite2/src/inc/Sparse.h
+@@ -51,17 +51,17 @@ private:
+     static const unsigned char  SIZEOF_CHUNK = (sizeof(mask_t) - sizeof(key_type))*8;
+ 
+     struct chunk
+     {
+         mask_t          mask:SIZEOF_CHUNK;
+         key_type        offset;
+     };
+ 
+-    static chunk  empty_chunk;
++    static const chunk  empty_chunk;
+     sparse(const sparse &);
+     sparse & operator = (const sparse &);
+ 
+ public:
+     template<typename I>
+     sparse(I first, const I last);
+     sparse() throw();
+     ~sparse() throw();
+@@ -83,17 +83,17 @@ private:
+     }           m_array;
+     key_type    m_nchunks;
+ };
+ 
+ 
+ inline
+ sparse::sparse() throw() : m_nchunks(0)
+ {
+-    m_array.map = &empty_chunk;
++    m_array.map = const_cast<graphite2::sparse::chunk *>(&empty_chunk);
+ }
+ 
+ 
+ template <typename I>
+ sparse::sparse(I attr, const I last)
+ : m_nchunks(0)
+ {
+     m_array.map = 0;
+@@ -108,30 +108,31 @@ sparse::sparse(I attr, const I last)
+         if (v.first <= lastkey) { m_nchunks = 0; return; }
+ 
+         lastkey = v.first;
+         const key_type k = v.first / SIZEOF_CHUNK;
+         if (k >= m_nchunks) m_nchunks = k+1;
+     }
+     if (m_nchunks == 0)
+     {
+-        m_array.map=&empty_chunk;
++        m_array.map=const_cast<graphite2::sparse::chunk *>(&empty_chunk);
+         return;
+     }
+ 
+     m_array.values = grzeroalloc<mapped_type>((m_nchunks*sizeof(chunk) + sizeof(mapped_type)-1)
+                                                  / sizeof(mapped_type)
+                                                  + n_values);
+ 
+     if (m_array.values == 0)
+     {
+         free(m_array.values); m_array.map=0;
+         return;
+     }
+ 
++    // coverity[forward_null : FALSE] Since m_array is union and m_array.values is not NULL
+     chunk * ci = m_array.map;
+     ci->offset = (m_nchunks*sizeof(chunk) + sizeof(mapped_type)-1)/sizeof(mapped_type);
+     mapped_type * vi = m_array.values + ci->offset;
+     for (; attr != last; ++attr, ++vi)
+     {
+         const typename std::iterator_traits<I>::value_type v = *attr;
+         if (v.second == 0)  { --vi; continue; }
+ 
+diff --git a/gfx/graphite2/src/inc/TtfUtil.h b/gfx/graphite2/src/inc/TtfUtil.h
+--- a/gfx/graphite2/src/inc/TtfUtil.h
++++ b/gfx/graphite2/src/inc/TtfUtil.h
+@@ -132,21 +132,21 @@ public:
+     int GetLangsForNames(const void * pName, int nPlatformId, int nEncodingId,
+         int *nameIdList, int cNameIds, short *langIdList);
+     void SwapWString(void * pWStr, size_t nSize = 0); // throw (std::invalid_argument);
+ #endif
+ 
+     ////////////////////////////////// cmap lookup tools 
+     const void * FindCmapSubtable(const void * pCmap, int nPlatformId = 3, 
+         int nEncodingId = 1, size_t length = 0);
+-    bool CheckCmapSubtable4(const void * pCmap31);
++    bool CheckCmapSubtable4(const void * pCmap31, size_t table_len /*, unsigned int maxgid*/);
+     gid16 CmapSubtable4Lookup(const void * pCmapSubtabel4, unsigned int nUnicodeId, int rangeKey = 0);
+     unsigned int CmapSubtable4NextCodepoint(const void *pCmap31, unsigned int nUnicodeId,
+         int * pRangeKey = 0);
+-    bool CheckCmapSubtable12(const void *pCmap310);
++    bool CheckCmapSubtable12(const void *pCmap310, size_t table_len /*, unsigned int maxgid*/);
+     gid16 CmapSubtable12Lookup(const void * pCmap310, unsigned int uUnicodeId, int rangeKey = 0);
+     unsigned int CmapSubtable12NextCodepoint(const void *pCmap310, unsigned int nUnicodeId,
+         int * pRangeKey = 0);
+ 
+     ///////////////////////////////// horizontal metric data for a glyph
+     bool HorMetrics(gid16 nGlyphId, const void * pHmtx, size_t lHmtxSize, 
+         const void * pHhea, int & nLsb, unsigned int & nAdvWid);
+ 
+diff --git a/gfx/graphite2/src/inc/UtfCodec.h b/gfx/graphite2/src/inc/UtfCodec.h
+--- a/gfx/graphite2/src/inc/UtfCodec.h
++++ b/gfx/graphite2/src/inc/UtfCodec.h
+@@ -126,19 +126,22 @@ public:
+     static uchar_t get(const codeunit_t * cp, int8 & l) throw()
+     {
+         const int8 seq_sz = sz_lut[*cp >> 4];
+         uchar_t u = *cp & mask_lut[seq_sz];
+         l = 1;
+         bool toolong = false;
+ 
+         switch(seq_sz) {
+-            case 4:     u <<= 6; u |= *++cp & 0x3F; if (*cp >> 6 != 2) break; ++l; toolong  = (u < 0x10); // no break
+-            case 3:     u <<= 6; u |= *++cp & 0x3F; if (*cp >> 6 != 2) break; ++l; toolong |= (u < 0x20); // no break
+-            case 2:     u <<= 6; u |= *++cp & 0x3F; if (*cp >> 6 != 2) break; ++l; toolong |= (u < 0x80); // no break
++            case 4:     u <<= 6; u |= *++cp & 0x3F; if (*cp >> 6 != 2) break; ++l; toolong  = (u < 0x10); GR_FALLTHROUGH;
++                // no break
++            case 3:     u <<= 6; u |= *++cp & 0x3F; if (*cp >> 6 != 2) break; ++l; toolong |= (u < 0x20); GR_FALLTHROUGH;
++                // no break
++            case 2:     u <<= 6; u |= *++cp & 0x3F; if (*cp >> 6 != 2) break; ++l; toolong |= (u < 0x80); GR_FALLTHROUGH;
++                // no break
+             case 1:     break;
+             case 0:     l = -1; return 0xFFFD;
+         }
+ 
+         if (l != seq_sz || toolong)
+         {
+             l = -l;
+             return 0xFFFD;
+diff --git a/gfx/graphite2/src/inc/bits.h b/gfx/graphite2/src/inc/bits.h
+--- a/gfx/graphite2/src/inc/bits.h
++++ b/gfx/graphite2/src/inc/bits.h
+@@ -24,25 +24,73 @@ Mozilla Public License (http://mozilla.o
+ License, as published by the Free Software Foundation, either version 2
+ of the License or (at your option) any later version.
+ */
+ #pragma once
+ 
+ namespace graphite2
+ {
+ 
++
++#if defined GRAPHITE2_BUILTINS && (defined __GNUC__ || defined __clang__)
++
+ template<typename T>
+ inline unsigned int bit_set_count(T v)
+ {
+-    v = v - ((v >> 1) & T(~T(0)/3));                           // temp
+-    v = (v & T(~T(0)/15*3)) + ((v >> 2) & T(~T(0)/15*3));      // temp
+-    v = (v + (v >> 4)) & T(~T(0)/255*15);                      // temp
+-    return (T)(v * T(~T(0)/255)) >> (sizeof(T)-1)*8;           // count
++    return __builtin_popcount(v);
+ }
+ 
++template<>
++inline unsigned int bit_set_count(int16 v)
++{
++    return __builtin_popcount(static_cast<uint16>(v));
++}
++
++template<>
++inline unsigned int bit_set_count(int8 v)
++{
++    return __builtin_popcount(static_cast<uint8>(v));
++}
++
++template<>
++inline unsigned int bit_set_count(unsigned long v)
++{
++    return __builtin_popcountl(v);
++}
++
++template<>
++inline unsigned int bit_set_count(signed long v)
++{
++    return __builtin_popcountl(v);
++}
++
++template<>
++inline unsigned int bit_set_count(unsigned long long v)
++{
++    return __builtin_popcountll(v);
++}
++
++template<>
++inline unsigned int bit_set_count(signed long long v)
++{
++    return __builtin_popcountll(v);
++}
++#else
++
++template<typename T>
++inline unsigned int bit_set_count(T v)
++{
++    v = v - ((v >> 1) & T(~(0UL)/3));                           // temp
++    v = (v & T(~(0UL)/15*3)) + ((v >> 2) & T(~(0UL)/15*3));     // temp
++    v = (v + (v >> 4)) & T(~(0UL)/255*15);                      // temp
++    return (T)(v * T(~(0UL)/255)) >> (sizeof(T)-1)*8;           // count
++}
++
++#endif
++
+ 
+ template<int S>
+ inline unsigned long _mask_over_val(unsigned long v)
+ {
+     v = _mask_over_val<S/2>(v);
+     v |= v >> S*4;
+     return v;
+ }
+@@ -82,9 +130,17 @@ inline T has_zero(const T x)
+ 
+ template<typename T>
+ inline T zero_bytes(const T x, unsigned char n)
+ {
+     const T t = T(~T(0)/255*n);
+     return T((has_zero(x^t) >> 7)*n);
+ }
+ 
++#if 0
++inline float float_round(float x, uint32 m)
++{
++    *reinterpret_cast<unsigned int *>(&x) &= m;
++    return *reinterpret_cast<float *>(&x);
+ }
++#endif
++
++}
+diff --git a/gfx/graphite2/src/inc/debug.h b/gfx/graphite2/src/inc/debug.h
+--- a/gfx/graphite2/src/inc/debug.h
++++ b/gfx/graphite2/src/inc/debug.h
+@@ -49,31 +49,39 @@ struct objectid
+ {
+     char name[16];
+     objectid(const dslot &) throw();
+     objectid(const Segment * const p) throw();
+ };
+ 
+ 
+ json & operator << (json & j, const Position &) throw();
++json & operator << (json & j, const Rect &) throw();
+ json & operator << (json & j, const CharInfo &) throw();
+ json & operator << (json & j, const dslot &) throw();
+ json & operator << (json & j, const objectid &) throw();
+ json & operator << (json & j, const telemetry &) throw();
+ 
+ 
+ 
+ inline
+ json & operator << (json & j, const Position & p) throw()
+ {
+     return j << json::flat << json::array << p.x << p.y << json::close;
+ }
+ 
+ 
+ inline
++json & operator << (json & j, const Rect & p) throw()
++{
++    return j << json::flat << json::array << p.bl.x << p.bl.y << p.tr.x << p.tr.y << json::close;
++}
++
++
++inline
+ json & operator << (json & j, const objectid & sid) throw()
+ {
+     return j << sid.name;
+ }
+ 
+ 
+ } // namespace graphite2
+ 
+diff --git a/gfx/graphite2/src/inc/json.h b/gfx/graphite2/src/inc/json.h
+--- a/gfx/graphite2/src/inc/json.h
++++ b/gfx/graphite2/src/inc/json.h
+@@ -24,19 +24,21 @@ Mozilla Public License (http://mozilla.o
+ License, as published by the Free Software Foundation, either version 2
+ of the License or (at your option) any later version.
+ */
+ // JSON pretty printer for graphite font debug output logging.
+ // Created on: 15 Dec 2011
+ //     Author: Tim Eves
+ 
+ #pragma once
++
+ #include "inc/Main.h"
+ #include <cassert>
+-#include <stdio.h>
++#include <cstdio>
++#include "inc/List.h"
+ 
+ namespace graphite2 {
+ 
+ class json
+ {
+     // Prevent copying
+     json(const json &);
+     json & operator = (const json &);
+@@ -44,31 +46,36 @@ class json
+     typedef void (*_context_t)(json &);
+     class _null_t {};
+ 
+     FILE * const    _stream;
+     char            _contexts[128], // context stack
+                   * _context,       // current context (top of stack)
+                   * _flatten;       // if !0 points to context above which
+                                     //  pretty printed output should occur.
++    Vector<void *>  _env;
+ 
+     void context(const char current) throw();
+     void indent(const int d=0) throw();
+     void push_context(const char, const char) throw();
+     void pop_context() throw();
+ 
+ public:
+     class closer;
+ 
+     typedef const char *    string;
+     typedef double          number;
+     typedef long signed int integer;
+     typedef bool            boolean;
+     static const _null_t    null;
+ 
++    void setenv(unsigned int index, void *val) { _env.reserve(index + 1); if (index >= _env.size()) _env.insert(_env.end(), _env.size() - index + 1, 0); _env[index] = val; }
++    void *getenv(unsigned int index) const { return _env[index]; }
++    const Vector<void *> &getenvs() const { return _env; }
++
+     static void flat(json &) throw();
+     static void close(json &) throw();
+     static void object(json &) throw();
+     static void array(json &) throw();
+     static void item(json &) throw();
+ 
+     json(FILE * stream) throw();
+     ~json() throw ();
+diff --git a/gfx/graphite2/src/inc/opcode_table.h b/gfx/graphite2/src/inc/opcode_table.h
+--- a/gfx/graphite2/src/inc/opcode_table.h
++++ b/gfx/graphite2/src/inc/opcode_table.h
+@@ -38,17 +38,17 @@ of the License or (at your option) any l
+ //      sattrnum - 0 .. 29 (gr_slatJWidth) , 55 (gr_slatUserDefn)
+ //      attrid - 0 .. silf.numUser() where sattrnum == 55; 0..silf.m_iMaxComp where sattrnum == 15 otherwise 0
+ //      gattrnum - 0 .. face->getGlyphFaceCache->numAttrs()
+ //      gmetric - 0 .. 11 (kgmetDescent)
+ //      featidx - 0 .. face.numFeatures()
+ //      level - any byte
+ static const opcode_t opcode_table[] = 
+ {
+-    {{do2(nop)},                                    0,  "NOP"},
++    {{do2(nop)},                                    0, "NOP"},
+ 
+     {{do2(push_byte)},                              1, "PUSH_BYTE"},                // number
+     {{do2(push_byte_u)},                            1, "PUSH_BYTE_U"},              // number
+     {{do2(push_short)},                             2, "PUSH_SHORT"},               // number number
+     {{do2(push_short_u)},                           2, "PUSH_SHORT_U"},             // number number
+     {{do2(push_long)},                              4, "PUSH_LONG"},                // number number number number
+ 
+     {{do2(add)},                                    0, "ADD"},
+@@ -109,12 +109,17 @@ static const opcode_t opcode_table[] =
+     {{do2(push_proc_state)},                        1, "PUSH_PROC_STATE"},          // dummy
+     {{do2(push_version)},                           0, "PUSH_VERSION"},
+     {{do_(put_subs), NILOP},                        5, "PUT_SUBS"},                 // slot input_class input_class output_class output_class
+     {{NILOP,NILOP},                                 0, "PUT_SUBS2"},
+     {{NILOP,NILOP},                                 0, "PUT_SUBS3"},
+     {{do_(put_glyph), NILOP},                       2, "PUT_GLYPH"},                // output_class output_class
+     {{do2(push_glyph_attr)},                        3, "PUSH_GLYPH_ATTR"},          // gattrnum gattrnum slot
+     {{do2(push_att_to_glyph_attr)},                 3, "PUSH_ATT_TO_GLYPH_ATTR"},   // gattrnum gattrnum slot
++    {{do2(bor)},                                    0, "BITOR"},
++    {{do2(band)},                                   0, "BITAND"},
++    {{do2(bnot)},                                   0, "BITNOT"},   // 0x40
++    {{do2(setbits)},                                4, "BITSET"},
++    {{do2(set_feat)},                               2, "SET_FEAT"},
+     // private opcodes for internal use only, comes after all other on disk opcodes.
+     {{do_(temp_copy), NILOP},                       0, "TEMP_COPY"}
+ };
+ 
+diff --git a/gfx/graphite2/src/inc/opcodes.h b/gfx/graphite2/src/inc/opcodes.h
+--- a/gfx/graphite2/src/inc/opcodes.h
++++ b/gfx/graphite2/src/inc/opcodes.h
+@@ -56,16 +56,17 @@ of the License or (at your option) any l
+ //                    pushed.
+ //        seg       = A reference to the Segment this code is running over.
+ //        is        = The current slot index
+ //        isb       = The original base slot index at the start of this rule
+ //        isf       = The first positioned slot
+ //        isl       = The last positioned slot
+ //        ip        = The current instruction pointer
+ //        endPos    = Position of advance of last cluster
++//        dir       = writing system directionality of the font
+      
+ 
+ // #define NOT_IMPLEMENTED     assert(false)
+ #define NOT_IMPLEMENTED
+ 
+ #define binop(op)           const int32 a = pop(); *sp = int32(*sp) op a
+ #define use_params(n)       dp += n
+ 
+@@ -236,30 +237,34 @@ STARTOP(put_subs_8bit_obs)
+         index = seg.findClassIndex(input_class, slot->gid());
+         is->setGlyph(&seg, seg.getClassGlyph(output_class, index));
+     }
+ ENDOP
+ 
+ STARTOP(put_copy)
+     declare_params(1);
+     const int  slot_ref = int8(*param);
+-    if (is && (slot_ref ||is != *map))
++    if (is)
+     {
+-        int16 *tempUserAttrs = is->userAttrs();
+         slotref ref = slotat(slot_ref);
+-        if (ref)
++        if (ref && ref != is)
+         {
+-            memcpy(tempUserAttrs, ref->userAttrs(), seg.numAttrs() * sizeof(uint16));
++            int16 *tempUserAttrs = is->userAttrs();
++            if (is->attachedTo() || is->firstChild()) DIE
+             Slot *prev = is->prev();
+             Slot *next = is->next();
+-            memcpy(is, slotat(slot_ref), sizeof(Slot));
++            memcpy(tempUserAttrs, ref->userAttrs(), seg.numAttrs() * sizeof(uint16));
++            memcpy(is, ref, sizeof(Slot));
++            is->firstChild(NULL);
++            is->nextSibling(NULL);
+             is->userAttrs(tempUserAttrs);
+             is->next(next);
+             is->prev(prev);
+-            is->sibling(NULL);
++            if (is->attachedTo())
++                is->attachedTo()->child(is);
+         }
+         is->markCopied(false);
+         is->markDeleted(false);
+     }
+ ENDOP
+ 
+ STARTOP(insert)
+     Slot *newSlot = seg.newSlot();
+@@ -304,24 +309,26 @@ STARTOP(insert)
+     {
+         newSlot->originate(newSlot->prev()->original());
+         newSlot->after(newSlot->prev()->after());
+     }
+     else
+     {
+         newSlot->originate(seg.defaultOriginal());
+     }
++    if (is == smap.highwater())
++        smap.highpassed(false);
+     is = newSlot;
+     seg.extendLength(1);
+     if (map != &smap[-1]) 
+         --map;
+ ENDOP
+ 
+ STARTOP(delete_)
+-    if (!is) DIE
++    if (!is || is->isDeleted()) DIE
+     is->markDeleted(true);
+     if (is->prev())
+         is->prev()->next(is->next());
+     else
+         seg.first(is->next());
+     
+     if (is->next())
+         is->next()->prev(is->prev());
+@@ -380,30 +387,30 @@ STARTOP(attr_set)
+ ENDOP
+ 
+ STARTOP(attr_add)
+     declare_params(1);
+     const attrCode      slat = attrCode(uint8(*param));
+     const          int  val  = int(pop());
+     if ((slat == gr_slatPosX || slat == gr_slatPosY) && (flags & POSITIONED) == 0)
+     {
+-        seg.positionSlots(0, *smap.begin(), *(smap.end()-1));
++        seg.positionSlots(0, *smap.begin(), *(smap.end()-1), dir);
+         flags |= POSITIONED;
+     }
+     int res = is->getAttr(&seg, slat, 0);
+     is->setAttr(&seg, slat, 0, val + res, smap);
+ ENDOP
+ 
+ STARTOP(attr_sub)
+     declare_params(1);
+     const attrCode      slat = attrCode(uint8(*param));
+     const          int  val  = int(pop());
+     if ((slat == gr_slatPosX || slat == gr_slatPosY) && (flags & POSITIONED) == 0)
+     {
+-        seg.positionSlots(0, *smap.begin(), *(smap.end()-1));
++        seg.positionSlots(0, *smap.begin(), *(smap.end()-1), dir);
+         flags |= POSITIONED;
+     }
+     int res = is->getAttr(&seg, slat, 0);
+     is->setAttr(&seg, slat, 0, res - val, smap);
+ ENDOP
+ 
+ STARTOP(attr_set_slot)
+     declare_params(1);
+@@ -422,17 +429,17 @@ STARTOP(iattr_set_slot)
+ ENDOP
+ 
+ STARTOP(push_slot_attr)
+     declare_params(2);
+     const attrCode      slat     = attrCode(uint8(param[0]));
+     const int           slot_ref = int8(param[1]);
+     if ((slat == gr_slatPosX || slat == gr_slatPosY) && (flags & POSITIONED) == 0)
+     {
+-        seg.positionSlots(0, *smap.begin(), *(smap.end()-1));
++        seg.positionSlots(0, *smap.begin(), *(smap.end()-1), dir);
+         flags |= POSITIONED;
+     }
+     slotref slot = slotat(slot_ref);
+     if (slot)
+     {
+         int res = slot->getAttr(&seg, slat, 0);
+         push(res);
+     }
+@@ -449,17 +456,17 @@ ENDOP
+ 
+ STARTOP(push_glyph_metric)
+     declare_params(3);
+     const unsigned int  glyph_attr  = uint8(param[0]);
+     const int           slot_ref    = int8(param[1]);
+     const signed int    attr_level  = uint8(param[2]);
+     slotref slot = slotat(slot_ref);
+     if (slot)
+-        push(seg.getGlyphMetric(slot, glyph_attr, attr_level));
++        push(seg.getGlyphMetric(slot, glyph_attr, attr_level, dir));
+ ENDOP
+ 
+ STARTOP(push_feat)
+     declare_params(2);
+     const unsigned int  feat        = uint8(param[0]);
+     const int           slot_ref    = int8(param[1]);
+     slotref slot = slotat(slot_ref);
+     if (slot)
+@@ -487,28 +494,28 @@ STARTOP(push_att_to_glyph_metric)
+     const unsigned int  glyph_attr  = uint8(param[0]);
+     const int           slot_ref    = int8(param[1]);
+     const signed int    attr_level  = uint8(param[2]);
+     slotref slot = slotat(slot_ref);
+     if (slot)
+     {
+         slotref att = slot->attachedTo();
+         if (att) slot = att;
+-        push(int32(seg.getGlyphMetric(slot, glyph_attr, attr_level)));
++        push(int32(seg.getGlyphMetric(slot, glyph_attr, attr_level, dir)));
+     }
+ ENDOP
+ 
+ STARTOP(push_islot_attr)
+     declare_params(3);
+     const attrCode  slat     = attrCode(uint8(param[0]));
+     const int           slot_ref = int8(param[1]),
+                         idx      = uint8(param[2]);
+     if ((slat == gr_slatPosX || slat == gr_slatPosY) && (flags & POSITIONED) == 0)
+     {
+-        seg.positionSlots(0, *smap.begin(), *(smap.end()-1));
++        seg.positionSlots(0, *smap.begin(), *(smap.end()-1), dir);
+         flags |= POSITIONED;
+     }
+     slotref slot = slotat(slot_ref);
+     if (slot)
+     {
+         int res = slot->getAttr(&seg, slat, idx);
+         push(res);
+     }
+@@ -543,31 +550,31 @@ ENDOP
+ 
+ STARTOP(iattr_add)
+     declare_params(2);
+     const attrCode      slat = attrCode(uint8(param[0]));
+     const size_t        idx  = uint8(param[1]);
+     const          int  val  = int(pop());
+     if ((slat == gr_slatPosX || slat == gr_slatPosY) && (flags & POSITIONED) == 0)
+     {
+-        seg.positionSlots(0, *smap.begin(), *(smap.end()-1));
++        seg.positionSlots(0, *smap.begin(), *(smap.end()-1), dir);
+         flags |= POSITIONED;
+     }
+     int res = is->getAttr(&seg, slat, idx);
+     is->setAttr(&seg, slat, idx, val + res, smap);
+ ENDOP
+ 
+ STARTOP(iattr_sub)
+     declare_params(2);
+     const attrCode      slat = attrCode(uint8(param[0]));
+     const size_t        idx  = uint8(param[1]);
+     const          int  val  = int(pop());
+     if ((slat == gr_slatPosX || slat == gr_slatPosY) && (flags & POSITIONED) == 0)
+     {
+-        seg.positionSlots(0, *smap.begin(), *(smap.end()-1));
++        seg.positionSlots(0, *smap.begin(), *(smap.end()-1), dir);
+         flags |= POSITIONED;
+     }
+     int res = is->getAttr(&seg, slat, idx);
+     is->setAttr(&seg, slat, idx, res - val, smap);
+ ENDOP
+ 
+ STARTOP(push_proc_state)
+     use_params(1);
+@@ -631,16 +638,50 @@ STARTOP(push_att_to_glyph_attr)
+         slotref att = slot->attachedTo();
+         if (att) slot = att;
+         push(int32(seg.glyphAttr(slot->gid(), glyph_attr)));
+     }
+ ENDOP
+ 
+ STARTOP(temp_copy)
+     slotref newSlot = seg.newSlot();
+-    if (!newSlot) DIE;
++    if (!newSlot || !is) DIE;
+     int16 *tempUserAttrs = newSlot->userAttrs();
+     memcpy(newSlot, is, sizeof(Slot));
+     memcpy(tempUserAttrs, is->userAttrs(), seg.numAttrs() * sizeof(uint16));
+     newSlot->userAttrs(tempUserAttrs);
+     newSlot->markCopied(true);
+     *map = newSlot;
+ ENDOP
++
++STARTOP(band)
++    binop(&);
++ENDOP
++
++STARTOP(bor)
++    binop(|);
++ENDOP
++
++STARTOP(bnot)
++    *sp = ~*sp;
++ENDOP
++
++STARTOP(setbits)
++    declare_params(4);
++    const uint16 m  = uint16(param[0]) << 8
++                    | uint8(param[1]);
++    const uint16 v  = uint16(param[2]) << 8
++                    | uint8(param[3]);
++    *sp = ((*sp) & ~m) | v;
++ENDOP
++
++STARTOP(set_feat)
++    declare_params(2);
++    const unsigned int  feat        = uint8(param[0]);
++    const int           slot_ref    = int8(param[1]);
++    slotref slot = slotat(slot_ref);
++    if (slot)
++    {
++        uint8 fid = seg.charinfo(slot->original())->fid();
++        seg.setFeature(fid, feat, pop());
++    }
++ENDOP
++
+diff --git a/gfx/graphite2/src/json.cpp b/gfx/graphite2/src/json.cpp
+--- a/gfx/graphite2/src/json.cpp
++++ b/gfx/graphite2/src/json.cpp
+@@ -24,17 +24,18 @@ Mozilla Public License (http://mozilla.o
+ License, as published by the Free Software Foundation, either version 2
+ of the License or (at your option) any later version.
+ */
+ // JSON debug logging
+ // Author: Tim Eves
+ 
+ #if !defined GRAPHITE2_NTRACING
+ 
+-#include <stdio.h>
++#include <cstdio>
++#include <limits>
+ #include "inc/json.h"
+ 
+ using namespace graphite2;
+ 
+ namespace
+ {
+     enum
+     {
+@@ -111,16 +112,29 @@ json & json::operator << (json::string s
+     const char ctxt = _context[-1] == obj ? *_context == member ? seq : member : seq;
+     context(ctxt);
+     fprintf(_stream, "\"%s\"", s);
+     if (ctxt == member) fputc(' ', _stream);
+ 
+     return *this;
+ }
+ 
+-json & json::operator << (json::number f) throw()   { context(seq); fprintf(_stream, "%g", f); return *this; }
++json & json::operator << (json::number f) throw()
++{ 
++    context(seq); 
++    if (std::numeric_limits<json::number>::infinity() == f)
++        fputs("Infinity", _stream);
++    else if (-std::numeric_limits<json::number>::infinity() == f)
++        fputs("-Infinity", _stream);
++    else if (std::numeric_limits<json::number>::quiet_NaN() == f ||
++            std::numeric_limits<json::number>::signaling_NaN() == f)
++        fputs("NaN", _stream);
++    else
++        fprintf(_stream, "%g", f); 
++    return *this; 
++}
+ json & json::operator << (json::integer d) throw()  { context(seq); fprintf(_stream, "%ld", d); return *this; }
+ json & json::operator << (long unsigned d) throw()  { context(seq); fprintf(_stream, "%ld", d); return *this; }
+ json & json::operator << (json::boolean b) throw()  { context(seq); fputs(b ? "true" : "false", _stream); return *this; }
+ json & json::operator << (json::_null_t) throw()    { context(seq); fputs("null",_stream); return *this; }
+ 
+ #endif
+ 
+diff --git a/gfx/graphite2/src/moz.build b/gfx/graphite2/src/moz.build
+--- a/gfx/graphite2/src/moz.build
++++ b/gfx/graphite2/src/moz.build
+@@ -18,37 +18,40 @@ if CONFIG['GNU_CC']:
+     ]
+ else:
+     UNIFIED_SOURCES += [
+         'call_machine.cpp'
+     ]
+ 
+ # This should contain all of the _SOURCES from files.mk, except *_machine.cpp
+ UNIFIED_SOURCES += [
+-    'Bidi.cpp',
+     'CachedFace.cpp',
+     'CmapCache.cpp',
+     'Code.cpp',
++    'Collider.cpp',
++    'Decompressor.cpp',
+     'Face.cpp',
+     'FeatureMap.cpp',
+     'FileFace.cpp',
+     'Font.cpp',
+     'GlyphCache.cpp',
+     'GlyphFace.cpp',
+     'gr_char_info.cpp',
+     'gr_face.cpp',
+     'gr_features.cpp',
+     'gr_font.cpp',
+     'gr_logging.cpp',
+     'gr_segment.cpp',
+     'gr_slot.cpp',
++    'Intervals.cpp',
+     'json.cpp',
+     'Justifier.cpp',
+     'NameTable.cpp',
+     'Pass.cpp',
++    'Position.cpp',
+     'SegCache.cpp',
+     'SegCacheEntry.cpp',
+     'SegCacheStore.cpp',
+     'Segment.cpp',
+     'Silf.cpp',
+     'Slot.cpp',
+     'Sparse.cpp',
+     'TtfUtil.cpp',
+