t1_decoder_parse_metrics does not handle op_callsubr
Migrated from: [SAVANNAH-58646]
Tor Andersson reported:
Related to bug 57519. I've found another type 1 font where the optimized fast path metrics decoder fails. This time the font uses not only 'div' to calculate the metrics for the 'hsbw' operator, it calls a subroutine that contains the 'hsbw' operator.
Here's some disassembly from the offending Type1 font:
dup 518 {
27 27881 61 div
hsbw
-4 35 hstem
229 30 hstem
404 31 hstem
214 436 rmoveto
return
} NP
/e {
518 callsubr
517 callsubr
}ND
Some of the characters in this font have their metrics reported correctly, but for example 'e' is reported having 0 width.
I'm currently using a workaround in MuPDF by #define T1_CONFIG_OPTION_OLD_ENGINE 1 but this is not a good long term solution since Linux distributions always link to the common Freetype system library which exposes this bug.