From 64240602b4102a5fa3fdc678e60207d6a7ca1d9c Mon Sep 17 00:00:00 2001
From: Behdad Esfahbod <behdad@behdad.org>
Date: Thu, 13 Mar 2025 10:56:39 -0600
Subject: [PATCH] [aat] Fix memfail crash

---
 src/hb-aat-layout-common.hh | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/src/hb-aat-layout-common.hh b/src/hb-aat-layout-common.hh
index a9064213d..af7909d65 100644
--- a/src/hb-aat-layout-common.hh
+++ b/src/hb-aat-layout-common.hh
@@ -81,6 +81,8 @@ struct hb_aat_scratch_t
   }
   void destroy_buffer_glyph_set (hb_bit_set_t *s) const
   {
+    if (unlikely (!s))
+      return;
     if (buffer_glyph_set.cmpexch (nullptr, s))
       return;
     s->fini ();
@@ -137,7 +139,7 @@ struct hb_aat_apply_context_t :
 
   void setup_buffer_glyph_set ()
   {
-    using_buffer_glyph_set = buffer->len >= 4;
+    using_buffer_glyph_set = buffer->len >= 4 && buffer_glyph_set;
 
     if (using_buffer_glyph_set)
       buffer->collect_codepoints (*buffer_glyph_set);