Prevent errors in sanitizeTTProgram, during parsing of CALL functions, when encountering invalid functions stack deltas (bug 1473809)

*I was feeling bored; so this is a very quick, and somewhat naive, attempt at fixing the bug.*

The breaking error, i.e. `Error during font loading: invalid array length`, was thrown when attempting to re-size the `stack` to a *negative* length when parsing the CALL functions.

Fixes https://bugzilla.mozilla.org/show_bug.cgi?id=1473809.

src/core/fonts.js

@@ -2109,21 +2109,32 @@ var Font = (function FontClosure() {
             if (!inFDEF && !inELSE) {
               // collecting information about which functions are used
               funcId = stack[stack.length - 1];
-              ttContext.functionsUsed[funcId] = true;
+              if (isNaN(funcId)) {
-              if (funcId in ttContext.functionsStackDeltas) {
+                info('TT: CALL empty stack (or invalid entry).');
-                stack.length += ttContext.functionsStackDeltas[funcId];
+              } else {
-              } else if (funcId in ttContext.functionsDefined &&
+                ttContext.functionsUsed[funcId] = true;
-                         !functionsCalled.includes(funcId)) {
+                if (funcId in ttContext.functionsStackDeltas) {
-                callstack.push({ data, i, stackTop: stack.length - 1, });
+                  let newStackLength = stack.length +
-                functionsCalled.push(funcId);
+                                       ttContext.functionsStackDeltas[funcId];
-                pc = ttContext.functionsDefined[funcId];
+                  if (newStackLength < 0) {
-                if (!pc) {
+                    warn('TT: CALL invalid functions stack delta.');
-                  warn('TT: CALL non-existent function');
+                    ttContext.hintsValid = false;
-                  ttContext.hintsValid = false;
+                    return;
-                  return;
+                  }
+                  stack.length = newStackLength;
+                } else if (funcId in ttContext.functionsDefined &&
+                           !functionsCalled.includes(funcId)) {
+                  callstack.push({ data, i, stackTop: stack.length - 1, });
+                  functionsCalled.push(funcId);
+                  pc = ttContext.functionsDefined[funcId];
+                  if (!pc) {
+                    warn('TT: CALL non-existent function');
+                    ttContext.hintsValid = false;
+                    return;
+                  }
+                  data = pc.data;
+                  i = pc.i;
                 }
-                data = pc.data;
-                i = pc.i;
               }
             }
           } else if (op === 0x2C && !tooComplexToFollowFunctions) { // FDEF

test/pdfs/.gitignore

@@ -151,6 +151,7 @@
 !bug1108301.pdf
 !bug1157493.pdf
 !bug1250079.pdf
+!bug1473809.pdf
 !pdfjsbad1586.pdf
 !freeculture.pdf
 !issue6006.pdf

test/test_manifest.json

@@ -143,6 +143,13 @@
        "lastPage": 4,
        "type": "eq"
     },
+    {  "id": "bug1473809",
+       "file": "pdfs/bug1473809.pdf",
+       "md5": "4b1ca51cf8cad58a1ce0618667341c76",
+       "rounds": 1,
+       "link": false,
+       "type": "eq"
+    },
     {  "id": "issue2531",
       "file": "pdfs/issue2531.pdf",
       "md5": "c58e6642d8a6e2ddd5e07a543ef8f30d",