This works around a problem with HarfBuzz (<= 0.9.26), which doesn't validate glyph indices returned by `hb_ot_layout_lookup_collect_glyphs'. * src/autofit/hbshim.c (af_get_coverage): Guard `idx'. * docs/CHANGES: Updated.