linux: merge newer upstream harfbuzz

This merges includes the following changes.  The changes by Adam Langley were
previously in our tree while they were being upstreamed, but since that's now
happened I've removed the changes mentioned in README.google.

Adam Langley (3):
      Add contrib/ and initial file set
      Add fuzz testing tool.
      Make HB_ShaperItem a typedef to a named struct.

Behdad Esfahbod (4):
      Fix typo in unused code
      Bug 23973 memory leak in _HB_OPEN_Load_EmptyClassDefinition
      Bug 23976 memory leak in Free_BaseArray
      Bug 24540 arabicSyriacOpenTypeShape causes read past end of string in getArabicProperties

Graham Asher (1):
      Improved comments for HB_ShaperItem fields.

BUG=20621
(But it doesn't look like this fixes it, though -- the getArabicProperties
change mentioned in the diff was already available locally)

Review URL: http://codereview.chromium.org/295025

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@29544 0039d316-1c4b-4281-b951-d872f2087c98

1 files changed, 5 insertions, 3 deletions

diff --git a/third_party/harfbuzz/src/harfbuzz-gpos.c b/third_party/harfbuzz/src/harfbuzz-gpos.c
index 1ac3779..356dc01 100644
--- a/third_party/harfbuzz/src/harfbuzz-gpos.c
+++ b/third_party/harfbuzz/src/harfbuzz-gpos.c
@@ -2059,15 +2059,17 @@ static void  Free_BaseArray( HB_BaseArray*  ba,
   HB_BaseRecord  *br;
   HB_Anchor      *bans;
 
-  HB_UNUSED(num_classes);
-
   if ( ba->BaseRecord )
   {
     br    = ba->BaseRecord;
 
     if ( ba->BaseCount )
     {
+      HB_UShort i, count;
+      count = num_classes * ba->BaseCount;
       bans = br[0].BaseAnchor;
+      for (i = 0; i < count; i++)
+        Free_Anchor (&bans[i]);
       FREE( bans );
     }
 
@@ -2723,7 +2725,7 @@ static HB_Error  Load_Mark2Array( HB_Mark2Array*  m2a,
 {
   HB_Error  error;
 
-  HB_UShort        k, m, n, count;
+  HB_UShort        m, n, count;
   HB_UInt          cur_offset, new_offset, base_offset;
 
   HB_Mark2Record  *m2r;