--- a/src/share/native/sun/font/layout/LayoutEngine.cpp	Wed Jun 23 13:50:19 2010 +0400
+++ b/src/share/native/sun/font/layout/LayoutEngine.cpp	Thu Jun 24 11:23:31 2010 -0700
@@ -292,7 +292,7 @@ le_int32 LayoutEngine::characterProcessi
         outCharCount = canonGSUBTable->process(glyphStorage, rightToLeft, scriptTag,
             langSysTag, NULL, substitutionFilter, canonFeatureMap, canonFeatureMapCount, FALSE);
 
-        out = (rightToLeft? count - 1 : 0);
+        out = (rightToLeft? outCharCount - 1 : 0);
 
         outChars = LE_NEW_ARRAY(LEUnicode, outCharCount);
         for (i = 0; i < outCharCount; i += 1, out += dir) {