Cherry-pick 3 upstream fixes
am: 9888dce90e

Change-Id: I84c5911c20662c5e0b985905ed54edd64f1fb8d0
diff --git a/README.android b/README.android
index d7c45fa..171803c 100644
--- a/README.android
+++ b/README.android
@@ -23,6 +23,20 @@
 The following commit is cherry-picked from the upstream:
 ( http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=da38be8 )
 
-  author Werner Lemberg <wl@gnu.org>     2017-03-30 13:24:03 +0200
   commit da38be831d2c8ea5443c73d01ecfbc750bba7045 (patch)
+  author Werner Lemberg <wl@gnu.org>     2017-03-30 13:24:03 +0200
   [truetype] Fix HVAR and VVAR handling (#50678).
+
+The following three commits are cherry-picked with some adjustment to apply:
+
+  commit 779309744222a736eba0f1731e8162fce6288d4e
+  Author: Werner Lemberg <wl@gnu.org> 2017-03-07 17:27:58 +0100
+  [sfnt] Improve handling for buggy variation fonts.
+
+  commit 7bbb91fbf47fc0775cc9705673caf0c47a81f94b
+  Author: Werner Lemberg <wl@gnu.org> 2017-03-08 15:09:41 +0100
+  [sfnt] Another fix for buggy variation fonts.
+
+  commit 447a0b62634802d8acdb56008cff5ff4e50be244
+  Author: Werner Lemberg <wl@gnu.org> 2017-03-13 07:42:34 +0100
+  [truetype] Ignore invalid MVAR tags.
diff --git a/src/sfnt/sfobjs.c b/src/sfnt/sfobjs.c
index 67e868c..9390242 100644
--- a/src/sfnt/sfobjs.c
+++ b/src/sfnt/sfobjs.c
@@ -1001,7 +1001,10 @@
         face->variation_support |= TT_FACE_FLAG_VAR_FVAR;
 
       /* we don't support Multiple Master CFFs yet */
-      if ( !face->goto_table( face, TTAG_CFF, stream, 0 ) )
+      /* note that `glyf' or `CFF2' have precedence */
+      if ( face->goto_table( face, TTAG_glyf, stream, 0 ) &&
+           face->goto_table( face, TTAG_CFF2, stream, 0 ) &&
+           !face->goto_table( face, TTAG_CFF, stream, 0 ) )
         num_instances = 0;
 
       /* we support at most 2^15 - 1 instances */
diff --git a/src/truetype/ttgxvar.c b/src/truetype/ttgxvar.c
index d6c2931..186b5bb 100644
--- a/src/truetype/ttgxvar.c
+++ b/src/truetype/ttgxvar.c
@@ -1259,9 +1259,16 @@
     for ( ; value < limit; value++ )
     {
       FT_Short*  p = ft_var_get_value_pointer( face, value->tag );
-
-
-      value->unmodified = *p;
+      if ( p )
+        value->unmodified = *p;
+#ifdef FT_DEBUG_LEVEL_TRACE
+      else
+        FT_TRACE1(( "ft_var_load_mvar: Ignoring unknown tag `%c%c%c%c'\n",
+                    (FT_Char)( value->tag >> 24 ),
+                    (FT_Char)( value->tag >> 16 ),
+                    (FT_Char)( value->tag >> 8 ),
+                    (FT_Char)( value->tag ) ));
+#endif
     }
 
     face->variation_support |= TT_FACE_FLAG_VAR_MVAR;
@@ -1318,17 +1325,20 @@
                                      value->outerIndex,
                                      value->innerIndex );
 
-      FT_TRACE5(( "value %c%c%c%c (%d units) adjusted by %d units (MVAR)\n",
-                  (FT_Char)( value->tag >> 24 ),
-                  (FT_Char)( value->tag >> 16 ),
-                  (FT_Char)( value->tag >> 8 ),
-                  (FT_Char)( value->tag ),
-                  value->unmodified,
-                  delta ));
+      if ( p )
+      {
+        FT_TRACE5(( "value %c%c%c%c (%d units) adjusted by %d units (MVAR)\n",
+                    (FT_Char)( value->tag >> 24 ),
+                    (FT_Char)( value->tag >> 16 ),
+                    (FT_Char)( value->tag >> 8 ),
+                    (FT_Char)( value->tag ),
+                    value->unmodified,
+                    delta ));
 
-      /* since we handle both signed and unsigned values as FT_Short, */
-      /* ensure proper overflow arithmetic                            */
-      *p = (FT_Short)( value->unmodified + (FT_Short)delta );
+        /* since we handle both signed and unsigned values as FT_Short, */
+        /* ensure proper overflow arithmetic                            */
+        *p = (FT_Short)( value->unmodified + (FT_Short)delta );
+      }
     }
 
     /* adjust all derived values */