From 99860de3cd08c11752b465c31a4257118d70ac28 Mon Sep 17 00:00:00 2001
From: Johnny Chen <jchen@openjdk.org>
Date: Wed, 24 Jul 2013 12:03:57 -0700
Subject: [PATCH] 8020293: JVM crash

Reviewed-by: prr, jgodinez
---
 jdk/src/share/classes/sun/font/GlyphLayout.java          | 7 ++++---
 jdk/src/share/native/sun/font/layout/SunLayoutEngine.cpp | 4 ++++
 2 files changed, 8 insertions(+), 3 deletions(-)

diff --git a/jdk/src/share/classes/sun/font/GlyphLayout.java b/jdk/src/share/classes/sun/font/GlyphLayout.java
index d29ecf34cb2..f2fc484caa0 100644
--- a/jdk/src/share/classes/sun/font/GlyphLayout.java
+++ b/jdk/src/share/classes/sun/font/GlyphLayout.java
@@ -468,9 +468,10 @@ public final class GlyphLayout {
                         _gvdata.grow();
                     }
                 }
-                if (_gvdata._count < 0) {
-                    break;
-                }
+            }
+            // Break out of the outer for loop if layout fails.
+            if (_gvdata._count < 0) {
+                break;
             }
         }
 
diff --git a/jdk/src/share/native/sun/font/layout/SunLayoutEngine.cpp b/jdk/src/share/native/sun/font/layout/SunLayoutEngine.cpp
index b32f2601b4d..858e3636038 100644
--- a/jdk/src/share/native/sun/font/layout/SunLayoutEngine.cpp
+++ b/jdk/src/share/native/sun/font/layout/SunLayoutEngine.cpp
@@ -104,6 +104,10 @@ Java_sun_font_SunLayoutEngine_initGVIDs
 
 int putGV(JNIEnv* env, jint gmask, jint baseIndex, jobject gvdata, const LayoutEngine* engine, int glyphCount) {
     int count = env->GetIntField(gvdata, gvdCountFID);
+    if (count < 0) {
+      JNU_ThrowInternalError(env, "count negative");
+      return 0;
+    }
 
     jarray glyphArray = (jarray)env->GetObjectField(gvdata, gvdGlyphsFID);
     if (IS_NULL(glyphArray)) {